@letrquan/book 0.3.0 → 0.4.0-beta.0

package/dist/chunk-N2G4Q7ME.js

@@ -0,0 +1,2672 @@
+import {
+  globToRegex,
+  globWalkPlan,
+  sandboxCoverage
+} from "./chunk-XJRJVXJR.js";
+import {
+  applySettingsEnvOverrides,
+  emptyWorkspaceProviderGate,
+  migrateLegacyPermissions,
+  resolveSettingsWithProviderGate,
+  settingsLayerPaths
+} from "./chunk-UCFJ43OS.js";
+import {
+  hadRemovedAuthConfiguration
+} from "./chunk-HOZXKOE3.js";
+import {
+  DEFAULT_MAX_INDEX_LINES,
+  MAX_INDEX_BYTES,
+  loadMemoryContext
+} from "./chunk-EFXVSQ5J.js";
+import {
+  createModelWindowStore
+} from "./chunk-62EEAUID.js";
+import {
+  readsSingleQuoteAsPosix,
+  resolveShell
+} from "./chunk-W7SLYS3M.js";
+import {
+  containsPath,
+  pathHoldsHome,
+  rootHoldsHome
+} from "./chunk-4DKHLZRI.js";
+import {
+  canonicalToolName,
+  canonicalizePath,
+  comparablePath,
+  getPrimaryArg,
+  isBookLocalSettingsPath,
+  isOutside,
+  isUnderRoot,
+  messagePathFor,
+  mutationDisplayPath,
+  pathOutsideWorkspaceResult,
+  resolveMutationPath,
+  resolveReadablePathDetail,
+  resolveWorkspacePath,
+  toolFailure,
+  toolSuccess
+} from "./chunk-YIL6HTJX.js";
+import {
+  reachesUncPath
+} from "./chunk-EEX6QNXV.js";
+import {
+  WorkspaceProviderRefusalError,
+  environmentModelSelections,
+  evaluateLegacyBaseUrl,
+  parseSecretReference,
+  providerPrefixOf,
+  resolveSecretFilePath,
+  withEnvironmentSelections
+} from "./chunk-B5FC3MYZ.js";
+import {
+  defaultTrustStorePath,
+  loadWorkspaceTrust
+} from "./chunk-HFB74CLM.js";
+import {
+  ADVISOR_OFF_VALUE,
+  DEFAULT_SETTINGS,
+  effortLevelSchema,
+  unboundedInt
+} from "./chunk-REASC2QG.js";
+
+// src/permissions.ts
+import { realpathSync } from "fs";
+import { isAbsolute, relative as relative3, resolve as resolve3, sep as sep2 } from "path";
+
+// src/async.ts
+function throwIfAborted(signal) {
+  if (!signal?.aborted) return;
+  if (signal.reason instanceof Error) throw signal.reason;
+  throw new Error(typeof signal.reason === "string" ? signal.reason : "Operation cancelled");
+}
+function onAbort(signal, handler) {
+  if (!signal) return () => {
+  };
+  if (signal.aborted) {
+    handler();
+    return () => {
+    };
+  }
+  signal.addEventListener("abort", handler, { once: true });
+  return () => signal.removeEventListener("abort", handler);
+}
+async function delay(ms, signal) {
+  if (ms <= 0 || signal?.aborted) return;
+  await new Promise((resolve4) => {
+    const timer = setTimeout(() => {
+      unsubscribe();
+      resolve4();
+    }, ms);
+    const unsubscribe = onAbort(signal, () => {
+      clearTimeout(timer);
+      resolve4();
+    });
+  });
+}
+async function yieldToEventLoop(signal) {
+  throwIfAborted(signal);
+  await new Promise((resolve4) => setImmediate(resolve4));
+  throwIfAborted(signal);
+}
+
+// src/tools/diff.ts
+function splitLines(s) {
+  const lines = s.split("\n");
+  if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  return lines;
+}
+var DIFF_YIELD_CELLS = 32768;
+var DIFF_YIELD_ITEMS = 1024;
+function commonAffixes(a, b) {
+  const max = Math.min(a.length, b.length);
+  let prefix = 0;
+  while (prefix < max && a[prefix] === b[prefix]) prefix++;
+  let suffix = 0;
+  while (suffix < max - prefix && a[a.length - 1 - suffix] === b[b.length - 1 - suffix]) suffix++;
+  return { prefix, suffix };
+}
+function contextOps(a, from, count, bOffset) {
+  const ops = [];
+  for (let index = 0; index < count; index++) {
+    const ai = from + index;
+    ops.push({ kind: "ctx", text: a[ai], ai, bi: ai + bOffset });
+  }
+  return ops;
+}
+function editScript(a, b, dp, offset) {
+  const n = a.length;
+  const m = b.length;
+  const ops = [];
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (a[i] === b[j]) {
+      ops.push({ kind: "ctx", text: a[i], ai: offset + i, bi: offset + j });
+      i++;
+      j++;
+    } else if (dp[i + 1][j] >= dp[i][j + 1]) {
+      ops.push({ kind: "del", text: a[i], ai: offset + i, bi: offset + j });
+      i++;
+    } else {
+      ops.push({ kind: "add", text: b[j], ai: offset + i, bi: offset + j });
+      j++;
+    }
+  }
+  while (i < n) {
+    ops.push({ kind: "del", text: a[i], ai: offset + i, bi: offset + j });
+    i++;
+  }
+  while (j < m) {
+    ops.push({ kind: "add", text: b[j], ai: offset + i, bi: offset + j });
+    j++;
+  }
+  return ops;
+}
+function hunkBounds(ops, context) {
+  const bounds = [];
+  let k = 0;
+  while (k < ops.length) {
+    if (ops[k].kind === "ctx") {
+      k++;
+      continue;
+    }
+    const start = k;
+    let ctxBefore = 0;
+    let s = start - 1;
+    while (s >= 0 && ops[s].kind === "ctx" && ctxBefore < context) {
+      s--;
+      ctxBefore++;
+    }
+    let e = start;
+    while (e < ops.length && ops[e].kind !== "ctx") e++;
+    let ctxAfter = 0;
+    while (e < ops.length && ops[e].kind === "ctx" && ctxAfter < context) {
+      e++;
+      ctxAfter++;
+    }
+    const previous = bounds.at(-1);
+    if (previous && s + 1 <= previous[1]) previous[1] = e;
+    else bounds.push([s + 1, e]);
+    k = e;
+  }
+  return bounds;
+}
+function hunkFrom(ops, start, end) {
+  const hunkOps = ops.slice(start, end);
+  return {
+    oldStart: (hunkOps[0]?.ai ?? 0) + 1,
+    newStart: (hunkOps[0]?.bi ?? 0) + 1,
+    lines: hunkOps.map((o) => ({ kind: o.kind, text: o.text }))
+  };
+}
+async function lineDiffAsync(oldText, newText, context = 3, signal) {
+  const a = splitLines(oldText);
+  const b = splitLines(newText);
+  const { prefix, suffix } = commonAffixes(a, b);
+  const midA = a.slice(prefix, a.length - suffix);
+  const midB = b.slice(prefix, b.length - suffix);
+  const n = midA.length;
+  const m = midB.length;
+  const dp = [];
+  for (let row = 0; row <= n; row++) {
+    dp.push(new Array(m + 1).fill(0));
+    if (row > 0 && row % 128 === 0) await yieldToEventLoop(signal);
+  }
+  let cellsUntilYield = DIFF_YIELD_CELLS;
+  for (let i = n - 1; i >= 0; i--) {
+    for (let j = m - 1; j >= 0; j--) {
+      dp[i][j] = midA[i] === midB[j] ? dp[i + 1][j + 1] + 1 : Math.max(dp[i + 1][j], dp[i][j + 1]);
+      cellsUntilYield--;
+      if (cellsUntilYield === 0) {
+        cellsUntilYield = DIFF_YIELD_CELLS;
+        await yieldToEventLoop(signal);
+      }
+    }
+  }
+  throwIfAborted(signal);
+  const ops = [
+    ...contextOps(a, 0, prefix, 0),
+    ...editScript(midA, midB, dp, prefix),
+    ...contextOps(a, a.length - suffix, suffix, b.length - a.length)
+  ];
+  if (ops.length > DIFF_YIELD_ITEMS) await yieldToEventLoop(signal);
+  const hunks = [];
+  for (const [start, end] of hunkBounds(ops, context)) {
+    hunks.push(hunkFrom(ops, start, end));
+    await yieldToEventLoop(signal);
+  }
+  throwIfAborted(signal);
+  return hunks;
+}
+function diffStatsFromHunks(hunks) {
+  let addedLines = 0;
+  let removedLines = 0;
+  for (const hunk of hunks) {
+    for (const line of hunk.lines) {
+      if (line.kind === "add") addedLines++;
+      if (line.kind === "del") removedLines++;
+    }
+  }
+  return { addedLines, removedLines };
+}
+async function renderDiffWithStatsAsync(oldText, newText, context = 3, signal) {
+  const hunks = await lineDiffAsync(oldText, newText, context, signal);
+  if (hunks.length === 0) return { diff: "", stats: { addedLines: 0, removedLines: 0 } };
+  const out = [];
+  for (let hunkIndex = 0; hunkIndex < hunks.length; hunkIndex++) {
+    const hunk = hunks[hunkIndex];
+    out.push(`@@ -${hunk.oldStart} +${hunk.newStart} @@`);
+    for (let lineIndex = 0; lineIndex < hunk.lines.length; lineIndex++) {
+      const line = hunk.lines[lineIndex];
+      const prefix = line.kind === "add" ? "+" : line.kind === "del" ? "-" : " ";
+      out.push(prefix + line.text);
+      if (lineIndex > 0 && lineIndex % DIFF_YIELD_ITEMS === 0) await yieldToEventLoop(signal);
+    }
+    if (hunkIndex > 0 && hunkIndex % 64 === 0) await yieldToEventLoop(signal);
+  }
+  return { diff: out.join("\n"), stats: diffStatsFromHunks(hunks) };
+}
+
+// src/tools/file-provenance.ts
+import { createHash } from "crypto";
+import { readFile, stat } from "fs/promises";
+import { normalize, relative, resolve } from "path";
+function workspaceIdentity(workspaceRoot) {
+  const root = normalize(resolve(workspaceRoot));
+  const stable = process.platform === "win32" ? root.toLowerCase() : root;
+  return createHash("sha256").update(stable).digest("hex").slice(0, 24);
+}
+function normalizeObservedPath(path) {
+  const normalized = path.replace(/\\/g, "/");
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+function observationKey(workspaceId, path) {
+  return `${workspaceId}:${normalizeObservedPath(path)}`;
+}
+function observationPathFor(workspaceRoot, absolutePath) {
+  const root = canonicalizePath(resolve(workspaceRoot));
+  return relative(root, canonicalizePath(absolutePath)).replace(/\\/g, "/");
+}
+function isOutline(observation) {
+  return observation.operation === "outline";
+}
+function mayReplaceObservation(current, next) {
+  return !current || !isOutline(next) || isOutline(current);
+}
+function supersedesObservation(current, next) {
+  if (!current) return true;
+  if (isOutline(current) !== isOutline(next)) return isOutline(current);
+  return current.timestamp <= next.timestamp;
+}
+function seedObservationLedger(ledger, messages) {
+  for (const message of messages) {
+    for (const observation of message.fileObservations ?? []) {
+      const key = observationKey(observation.workspaceId, observation.path);
+      if (supersedesObservation(ledger.get(key), observation)) ledger.set(key, observation);
+    }
+  }
+  return ledger;
+}
+async function observeFile(ctx, absolutePath, operation, coverage) {
+  const bytes = await readFile(absolutePath);
+  const workspaceId = workspaceIdentity(ctx.workspaceRoot);
+  const path = observationPathFor(ctx.workspaceRoot, absolutePath);
+  const observation = {
+    path,
+    workspaceId,
+    sha256: createHash("sha256").update(bytes).digest("hex"),
+    byteSize: bytes.byteLength,
+    lineStart: coverage?.lineStart,
+    lineEnd: coverage?.lineEnd,
+    operation,
+    sourceRef: ctx.currentToolTraceId ?? "runtime-tool",
+    timestamp: Date.now()
+  };
+  const key = observationKey(workspaceId, path);
+  const ledger = ctx.fileObservationLedger;
+  if (ledger && mayReplaceObservation(ledger.get(key), observation)) ledger.set(key, observation);
+  return observation;
+}
+async function requireFreshObservation(ctx, absolutePath, displayPath) {
+  const workspaceId = workspaceIdentity(ctx.workspaceRoot);
+  const remembered = ctx.fileObservationLedger?.get(
+    observationKey(workspaceId, observationPathFor(ctx.workspaceRoot, absolutePath))
+  );
+  if (!remembered || isOutline(remembered)) return void 0;
+  try {
+    const info = await stat(absolutePath);
+    if (!info.isFile()) return staleMessage(displayPath);
+    const bytes = await readFile(absolutePath);
+    const currentHash = createHash("sha256").update(bytes).digest("hex");
+    return currentHash === remembered.sha256 ? void 0 : staleMessage(displayPath);
+  } catch {
+    return staleMessage(displayPath);
+  }
+}
+function staleMessage(path) {
+  return `SKIPPED: ${path} changed or disappeared since it was last shown to the model. Call Read (or mention the file again) before modifying it.`;
+}
+function requireObservationForMutation(ctx, absolutePath, displayPath, retryVerb) {
+  const ledger = ctx.fileObservationLedger;
+  if (!ledger) return void 0;
+  const workspaceId = workspaceIdentity(ctx.workspaceRoot);
+  const remembered = ledger.get(
+    observationKey(workspaceId, observationPathFor(ctx.workspaceRoot, absolutePath))
+  );
+  if (remembered && !isOutline(remembered)) return void 0;
+  const seen = remembered ? "has only been outlined in this session, and an outline is not the file's content" : "has not been read in this session";
+  return toolFailure(
+    `SKIPPED: ${displayPath} ${seen}. Call Read (or mention the file) before modifying it.`,
+    {
+      code: "file_not_observed",
+      remediation: `Read the file first, then retry the ${retryVerb}.`
+    }
+  );
+}
+
+// src/memory-write-guard.ts
+import { lstatSync, readFileSync } from "fs";
+import { basename, relative as relative2, resolve as resolve2, sep } from "path";
+
+// src/secret-detect.ts
+var SECRET_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/i,
+  /\b(api[_-]?key|token|password|passwd|secret)\s*[:=]\s*\S{8,}/i,
+  /https?:\/\/[^\s/]+:[^\s/]+@/i,
+  /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/,
+  /\bsk-[A-Za-z0-9_-]{20,}\b/
+];
+function containsSecretPattern(text) {
+  return SECRET_PATTERNS.some((re) => re.test(text));
+}
+function looksLikeSecretOrUnfit(text) {
+  const trimmed = text.trim();
+  if (trimmed.length === 0) return "empty";
+  if (SECRET_PATTERNS.some((re) => re.test(trimmed))) return "looks like a secret";
+  const longTokens = trimmed.match(/[A-Za-z0-9+/=_-]{48,}/g) ?? [];
+  if (longTokens.some((token) => new Set(token).size > 20)) return "contains high-entropy text";
+  return null;
+}
+
+// src/memory-write-guard.ts
+var TOPIC_FILE_WARN_BYTES = 4096;
+var INDEX_FILE = "MEMORY.md";
+var DELEGATED_TYPES = ["project", "reference"];
+function refuse(code, message, remediation) {
+  return { ok: false, failure: toolFailure(message, { code, remediation }) };
+}
+var stripCr = (line) => line.replace(/\r$/, "");
+function findFrontmatter(text) {
+  const lines = text.split("\n");
+  if (stripCr(lines[0] ?? "").trim() !== "---") return null;
+  for (let i = 1; i < lines.length; i++) {
+    if (stripCr(lines[i]) === "---") return { lines, close: i };
+  }
+  return null;
+}
+function metadataBlock({ lines, close }) {
+  const start = lines.findIndex((line, i) => i > 0 && i < close && /^metadata\s*:/.test(line));
+  if (start < 0) return null;
+  const rest = stripCr(lines[start]).replace(/^metadata\s*:/, "").replace(/\s+#.*$/, "").trim();
+  let last = start;
+  let indent = "  ";
+  let sawChild = false;
+  for (let i = start + 1; i < close; i++) {
+    const line = stripCr(lines[i]);
+    if (line.trim() === "") continue;
+    if (!/^\s/.test(line)) break;
+    if (!sawChild) {
+      indent = /^\s*/.exec(line)?.[0] ?? "  ";
+      sawChild = true;
+    }
+    last = i;
+  }
+  return {
+    start,
+    end: last + 1,
+    indent,
+    inline: rest === "" || rest.startsWith("#") ? null : rest
+  };
+}
+function scalar(raw) {
+  const value = raw.replace(/\s+#.*$/, "").trim();
+  return value.replace(/^(["'])(.*)\1$/, "$2");
+}
+function childKey(lines, block, key) {
+  for (let i = block.start + 1; i < block.end; i++) {
+    const line = stripCr(lines[i]);
+    if (!line.startsWith(block.indent)) continue;
+    const rest = line.slice(block.indent.length);
+    if (/^\s/.test(rest)) continue;
+    if (new RegExp(`^${key}\\s*:`).test(rest)) return i;
+  }
+  return -1;
+}
+function frontmatterValue(text, key) {
+  const fm = findFrontmatter(text);
+  if (!fm) return void 0;
+  const block = metadataBlock(fm);
+  if (block && block.inline === null) {
+    const at = childKey(fm.lines, block, key);
+    if (at >= 0)
+      return scalar(
+        stripCr(fm.lines[at]).slice(block.indent.length).replace(/^[^:]*:/, "")
+      );
+  }
+  for (let i = 1; i < fm.close; i++) {
+    const line = stripCr(fm.lines[i]);
+    if (new RegExp(`^${key}\\s*:`).test(line)) return scalar(line.replace(/^[^:]*:/, ""));
+  }
+  return void 0;
+}
+function yamlScalar(value) {
+  return /^[\w.:-]+$/.test(value) ? value : JSON.stringify(value);
+}
+function stamp(text, options) {
+  const fm = findFrontmatter(text);
+  if (!fm) return { text };
+  const { lines } = fm;
+  const cr = lines[0].endsWith("\r") ? "\r" : "";
+  let block = metadataBlock(fm);
+  if (block && block.inline !== null && block.inline !== "{}") {
+    return {
+      text,
+      warning: "The metadata block is written inline, so it was not stamped with provenance."
+    };
+  }
+  if (block && block.inline === "{}") {
+    lines[block.start] = `metadata:${cr}`;
+    block = { ...block, inline: null };
+  }
+  const wanted = [
+    {
+      key: "originSessionId",
+      value: (existing) => existing ? void 0 : options.sessionId
+    },
+    { key: "modified", value: () => (/* @__PURE__ */ new Date()).toISOString() },
+    ...options.driver ? [{ key: "driver", value: () => "agent" }] : []
+  ];
+  if (!block) {
+    const indent = "  ";
+    const added = wanted.flatMap(({ key, value }) => {
+      const next = value(void 0);
+      return next === void 0 ? [] : [`${indent}${key}: ${yamlScalar(next)}${cr}`];
+    });
+    lines.splice(fm.close, 0, `metadata:${cr}`, ...added);
+    return { text: lines.join("\n") };
+  }
+  const inserts = [];
+  for (const { key, value } of wanted) {
+    const at = childKey(lines, block, key);
+    const line = at >= 0 ? stripCr(lines[at]) : "";
+    const existing = at >= 0 ? scalar(line.slice(block.indent.length).replace(/^[^:]*:/, "")) : void 0;
+    const next = value(existing || void 0);
+    if (next === void 0) continue;
+    if (at < 0) {
+      inserts.push(`${block.indent}${key}: ${yamlScalar(next)}${cr}`);
+      continue;
+    }
+    const comment = /(\s+#.*)$/.exec(line.slice(line.indexOf(":") + 1))?.[1] ?? "";
+    lines[at] = `${line.slice(0, line.indexOf(":") + 1)} ${yamlScalar(next)}${comment}${cr}`;
+  }
+  lines.splice(block.end, 0, ...inserts);
+  return { text: lines.join("\n") };
+}
+function entryTarget(line) {
+  return /^- \[[^\]]*\]\(([^()]+)\)/.exec(line)?.[1];
+}
+function normalizeLines(text) {
+  return text.replace(/\r\n/g, "\n").split("\n");
+}
+function readMemoryFile(root, name) {
+  const path = resolve2(root, name);
+  const rel = relative2(resolve2(root), path);
+  if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`)) return null;
+  try {
+    if (!lstatSync(path).isFile()) return null;
+    return readFileSync(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+var isAgentOwned = (text) => frontmatterValue(text, "driver") === "agent";
+var OWNED_BY_PERSON = "This session is driven by another agent, so it may change only memories it wrote itself (frontmatter `driver: agent`).";
+function checkMemoryWrite(ctx, absPath, next, prior) {
+  const memory = ctx.memoryWrite;
+  if (!memory) {
+    return refuse(
+      "memory_write_unavailable",
+      "Memory is not writable in this session.",
+      "Only the main agent may write memory, and only with memory enabled and autoSave on."
+    );
+  }
+  const root = canonicalizePath(memory.root);
+  const rel = relative2(root, canonicalizePath(absPath)).split(sep).join("/");
+  const isIndex = rel.toLowerCase() === INDEX_FILE.toLowerCase();
+  const learnings = memory.scope === "learnings";
+  if (next !== null) {
+    let judged = next;
+    if (isIndex && prior !== null) {
+      const had = new Set(normalizeLines(prior));
+      judged = normalizeLines(next).filter((line) => !had.has(line)).join("\n");
+    }
+    const reason = judged.trim() === "" ? null : looksLikeSecretOrUnfit(judged);
+    if (reason) {
+      return refuse(
+        "memory_secret_rejected",
+        `Memory text ${reason}, so it was not saved.`,
+        "Remove the secret or high-entropy text (keys, tokens, passwords, long random strings) and write the memory again."
+      );
+    }
+  }
+  if (learnings) {
+    if (isIndex) {
+      if (prior !== null) {
+        const kept = new Set(next === null ? [] : normalizeLines(next));
+        for (const line of normalizeLines(prior)) {
+          if (kept.has(line)) continue;
+          const target = entryTarget(line);
+          if (target === void 0) continue;
+          const file = readMemoryFile(memory.root, target);
+          if (file !== null && !isAgentOwned(file)) {
+            return refuse(
+              "memory_owned_by_person",
+              `The index line for ${target} was changed or removed, but ${target} is not a memory this session wrote. ${OWNED_BY_PERSON}`,
+              "Keep that line as it is; add new lines for what you learned."
+            );
+          }
+        }
+      }
+    } else {
+      if (next !== null) {
+        const type = frontmatterValue(next, "type");
+        if (!type || !DELEGATED_TYPES.includes(type)) {
+          return refuse(
+            "memory_type_not_allowed",
+            `A memory written by this session needs frontmatter \`metadata.type\` of project or reference${type ? ` (got "${type}")` : " (none found)"}.`,
+            "Add a frontmatter block with metadata.type: project or reference. Preferences and feedback are a person\u2019s to record."
+          );
+        }
+      }
+      if (prior !== null && !isAgentOwned(prior)) {
+        return refuse(
+          "memory_owned_by_person",
+          `${rel} is not a memory this session wrote. ${OWNED_BY_PERSON}`,
+          "Write a new memory file instead."
+        );
+      }
+    }
+  }
+  if (next === null) return { ok: true, content: null, warnings: [] };
+  const warnings = [];
+  let content = next;
+  if (!isIndex) {
+    const stamped = stamp(next, { sessionId: memory.sessionId, driver: learnings });
+    content = stamped.text;
+    if (stamped.warning) warnings.push(stamped.warning);
+  }
+  if (isIndex) {
+    const trimmed = content.trim();
+    const lines = trimmed.length > 0 ? trimmed.split("\n").length : 0;
+    const bytes = Buffer.byteLength(trimmed);
+    if (lines > DEFAULT_MAX_INDEX_LINES || bytes > MAX_INDEX_BYTES) {
+      warnings.push(
+        `MEMORY.md is ${lines} lines and ${bytes} bytes; only the first ${DEFAULT_MAX_INDEX_LINES} lines or ${MAX_INDEX_BYTES} bytes load in a new session. Merge entries and keep each to one line.`
+      );
+    }
+    const missing = normalizeLines(content).flatMap((line) => {
+      const target = entryTarget(line);
+      return target !== void 0 && readMemoryFile(memory.root, target) === null ? [target] : [];
+    });
+    if (missing.length > 0) {
+      warnings.push(
+        `MEMORY.md points to ${[...new Set(missing)].join(", ")}, which ${missing.length === 1 ? "does" : "do"} not exist in the memory directory (yet).`
+      );
+    }
+  } else if (Buffer.byteLength(content) > TOPIC_FILE_WARN_BYTES) {
+    warnings.push(
+      `${rel} is ${Buffer.byteLength(content)} bytes; keep a memory file under ${TOPIC_FILE_WARN_BYTES} bytes (one fact per file).`
+    );
+  }
+  return { ok: true, content, warnings };
+}
+function noticeMemoryWrite(ctx, absPath, change) {
+  const name = basename(absPath);
+  if (name.toLowerCase() === INDEX_FILE.toLowerCase()) return;
+  ctx.onNotice?.(`memory ${change}: ${name}`);
+}
+function withMemoryWarnings(content, warnings) {
+  return warnings.length === 0 ? content : `${content}
+
+${warnings.map((w) => `Warning: ${w}`).join("\n")}`;
+}
+
+// src/config.ts
+import { readFileSync as readFileSync3 } from "fs";
+
+// src/legacy-config.ts
+import { z } from "zod";
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { join } from "path";
+var legacyUrlSchema = z.string().check((ctx) => {
+  if (!URL.canParse(ctx.value)) {
+    ctx.issues.push({ code: "invalid_format", format: "url", input: ctx.value });
+  }
+});
+var legacyConfigSchema = z.object({
+  model: z.string().optional(),
+  baseUrl: legacyUrlSchema.optional(),
+  maxTurns: unboundedInt().min(1).optional(),
+  maxTokens: unboundedInt().min(1e3).optional(),
+  autoCompactEnabled: z.boolean().optional(),
+  animation: z.object({
+    typewriterSpeed: z.number().int().min(1).max(50).default(3),
+    spinnerStyle: z.enum(["braille", "dots"]).default("braille")
+  }).optional(),
+  accessibility: z.object({
+    screenReader: z.boolean().default(false),
+    reducedMotion: z.boolean().default(false)
+  }).optional()
+});
+function legacyConfigPath(workspace) {
+  return join(workspace, ".bookrc.json");
+}
+function parseLegacyConfig(workspace) {
+  const path = legacyConfigPath(workspace);
+  if (reachesUncPath(path) || !existsSync(path)) return null;
+  try {
+    return legacyConfigSchema.parse(JSON.parse(readFileSync2(path, "utf-8")));
+  } catch (e) {
+    if (e instanceof SyntaxError) {
+      throw new Error(`Invalid JSON in config file: ${path}`);
+    }
+    throw e;
+  }
+}
+function readLegacyBaseUrl(workspace) {
+  try {
+    return parseLegacyConfig(workspace)?.baseUrl;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/commands/effort.ts
+var EFFORT_LEVELS = effortLevelSchema.options;
+var EFFORT_USAGE = "Usage: /effort [low|medium|high|xhigh|max]";
+function parseEffortLevel(raw, source) {
+  const normalized = raw.trim().toLowerCase();
+  if (!isEffortLevel(normalized)) {
+    throw new Error(`${source} must be one of: ${EFFORT_LEVELS.join(", ")} (got "${raw}")`);
+  }
+  return normalized;
+}
+function isEffortLevel(value) {
+  return EFFORT_LEVELS.includes(value);
+}
+function getAvailableEffortLevels(config) {
+  const metadata = config.modelInfo?.effort;
+  if (metadata === false) return null;
+  if (typeof metadata === "object" && metadata.levels) {
+    return EFFORT_LEVELS.filter((level) => metadata.levels?.includes(level));
+  }
+  return [...EFFORT_LEVELS];
+}
+function getEffortUnavailableError(config) {
+  const model = config.modelSelection ?? config.model;
+  const levels = getAvailableEffortLevels(config);
+  if (levels === null) return `Model "${model}" does not support configurable effort.`;
+  if (levels.length === 0) return `Model "${model}" does not expose any effort levels.`;
+  return void 0;
+}
+function updateEffortLevel(config, level, persist, apply) {
+  const unavailable = getEffortUnavailableError(config);
+  if (unavailable) return { ok: false, error: unavailable };
+  const levels = getAvailableEffortLevels(config) ?? [];
+  if (!levels.includes(level)) {
+    const model = config.modelSelection ?? config.model;
+    return {
+      ok: false,
+      error: `Effort level "${level}" is not supported by model "${model}". Available levels: ${levels.join(", ")}.`
+    };
+  }
+  const result = persist(level);
+  if (!result.ok) {
+    return {
+      ok: false,
+      error: `Failed to save effort level${result.error ? `: ${result.error}` : "."}`
+    };
+  }
+  apply(level);
+  return { ok: true };
+}
+
+// src/config.ts
+var DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
+var DEFAULT_MAX_OUTPUT_TOKENS = 64e3;
+function loadLegacyConfig(workspace) {
+  const parsed = parseLegacyConfig(workspace);
+  if (!parsed) return null;
+  console.warn(
+    "\u26A0  .bookrc.json is deprecated. Move your settings to .book/settings.json (project), .book/settings.local.json (local overrides), or ~/.book/settings.json (user)."
+  );
+  return {
+    model: parsed.model,
+    baseUrl: parsed.baseUrl,
+    maxTurns: parsed.maxTurns,
+    maxTokens: parsed.maxTokens,
+    autoCompactEnabled: parsed.autoCompactEnabled,
+    animation: parsed.animation,
+    accessibility: parsed.accessibility
+  };
+}
+function loadConfig(workspace, options) {
+  const settingsOverridePath = options?.settingsOverridePath;
+  const noSettings = options?.noSettings ?? false;
+  const resolvedWorkspace = workspace || process.env.BOOK_WORKSPACE || process.cwd();
+  const resolveLayers = () => noSettings ? { settings: structuredClone(DEFAULT_SETTINGS), providerGate: emptyWorkspaceProviderGate() } : resolveSettingsWithProviderGate(
+    resolvedWorkspace,
+    settingsOverridePath,
+    options?.settingsPaths
+  );
+  let { settings, providerGate } = resolveLayers();
+  if (!noSettings && options?.runMigrations) {
+    const migrated = migrateLegacyPermissions(resolvedWorkspace, void 0, settings);
+    if (migrated) ({ settings, providerGate } = resolveLayers());
+  }
+  settings = applySettingsEnvOverrides(settings);
+  const legacy = loadLegacyConfig(resolvedWorkspace);
+  const retry = {
+    maxAttempts: process.env.BOOK_RETRY_MAX_ATTEMPTS ? clampInt(process.env.BOOK_RETRY_MAX_ATTEMPTS, 0, 15) : settings.retry?.maxAttempts ?? DEFAULT_SETTINGS.retry.maxAttempts,
+    baseDelayMs: process.env.BOOK_RETRY_BASE_DELAY_MS ? clampInt(process.env.BOOK_RETRY_BASE_DELAY_MS, 100, 6e4) : settings.retry?.baseDelayMs ?? DEFAULT_SETTINGS.retry.baseDelayMs,
+    maxDelayMs: process.env.BOOK_RETRY_MAX_DELAY_MS ? clampInt(process.env.BOOK_RETRY_MAX_DELAY_MS, 100, 3e5) : settings.retry?.maxDelayMs ?? DEFAULT_SETTINGS.retry.maxDelayMs,
+    totalBudgetMs: process.env.BOOK_RETRY_TOTAL_BUDGET_MS ? clampInt(process.env.BOOK_RETRY_TOTAL_BUDGET_MS, 0, 6e5) : settings.retry?.totalBudgetMs ?? DEFAULT_SETTINGS.retry.totalBudgetMs,
+    requestTimeoutMs: process.env.BOOK_REQUEST_TIMEOUT_MS ? clampInt(process.env.BOOK_REQUEST_TIMEOUT_MS, 5e3, 6e5) : settings.retry?.requestTimeoutMs ?? DEFAULT_SETTINGS.retry.requestTimeoutMs,
+    streamStallTimeoutMs: process.env.BOOK_STREAM_STALL_TIMEOUT_MS ? clampInt(process.env.BOOK_STREAM_STALL_TIMEOUT_MS, 5e3, 12e4) : settings.retry?.streamStallTimeoutMs ?? DEFAULT_SETTINGS.retry.streamStallTimeoutMs,
+    thinkingStallTimeoutMs: process.env.BOOK_THINKING_STALL_TIMEOUT_MS ? clampInt(process.env.BOOK_THINKING_STALL_TIMEOUT_MS, 1e4, 18e5) : settings.retry?.thinkingStallTimeoutMs ?? DEFAULT_SETTINGS.retry.thinkingStallTimeoutMs,
+    firstDeltaStallTimeoutMs: process.env.BOOK_FIRST_DELTA_STALL_TIMEOUT_MS ? clampInt(process.env.BOOK_FIRST_DELTA_STALL_TIMEOUT_MS, 5e3, 18e5) : settings.retry?.firstDeltaStallTimeoutMs ?? DEFAULT_SETTINGS.retry.firstDeltaStallTimeoutMs,
+    toolRetries: process.env.BOOK_TOOL_RETRIES ? clampInt(process.env.BOOK_TOOL_RETRIES, 0, 3) : settings.retry?.toolRetries ?? DEFAULT_SETTINGS.retry.toolRetries,
+    watchdog: process.env.BOOK_RETRY_WATCHDOG === "1" || settings.retry?.watchdog === true,
+    streamReissueAttempts: process.env.BOOK_STREAM_REISSUE_ATTEMPTS ? clampInt(process.env.BOOK_STREAM_REISSUE_ATTEMPTS, 0, 10) : settings.retry?.streamReissueAttempts ?? DEFAULT_SETTINGS.retry.streamReissueAttempts,
+    outputCapContinuations: settings.retry?.outputCapContinuations ?? DEFAULT_SETTINGS.retry.outputCapContinuations
+  };
+  const memoryContext = settings.memory.enabled ? loadMemoryContext(resolvedWorkspace) : void 0;
+  const envMaxTokens = parsePositiveInt(process.env.BOOK_MAX_TOKENS, "BOOK_MAX_TOKENS");
+  const maxTokensExplicit = envMaxTokens !== void 0 || settings.maxTokens !== void 0 || legacy?.maxTokens !== void 0;
+  const effortExplicit = Boolean(
+    options?.effortOverride || process.env.BOOK_EFFORT || settings.effort
+  );
+  const withheldIds = new Set(providerGate.withheld);
+  const selectedModel = options?.modelOverride || process.env.BOOK_MODEL || settings.model;
+  const legacyPrefix = selectedModel || legacy?.model === void 0 ? void 0 : providerPrefixOf(legacy.model);
+  const withheldLegacyModel = legacy?.model !== void 0 && legacyPrefix !== void 0 && withheldIds.has(legacyPrefix) ? {
+    key: "model",
+    value: legacy.model,
+    providerId: legacyPrefix,
+    path: legacyConfigPath(resolvedWorkspace),
+    fallback: void 0
+  } : void 0;
+  const rawModel = selectedModel || (withheldLegacyModel ? void 0 : legacy?.model) || "gpt-4o";
+  const compactModel = process.env.BOOK_COMPACT_MODEL || settings.compactModel;
+  const advisorModel = process.env.BOOK_ADVISOR_MODEL || settings.advisorModel;
+  const compactEffort = settings.compactEffort;
+  const compactStrategy = "summary";
+  const shell = resolveShell({ requested: settings.shell });
+  const defaultApiKey = process.env.BOOK_API_KEY || "";
+  const legacyBaseUrlGate = legacy?.baseUrl === void 0 ? void 0 : {
+    baseUrl: legacy.baseUrl,
+    state: evaluateLegacyBaseUrl(
+      noSettings ? loadWorkspaceTrust(
+        resolvedWorkspace,
+        options?.settingsPaths?.trustStorePath ?? defaultTrustStorePath(options?.settingsPaths?.home)
+      ).workspaceProviders : settings.workspaceProviders,
+      legacy.baseUrl
+    )
+  };
+  const legacyBaseUrl = legacyBaseUrlGate?.state === "approved" ? legacyBaseUrlGate.baseUrl : void 0;
+  const explicitBaseUrl = process.env.BOOK_BASE_URL || legacyBaseUrl;
+  const defaultProviderOverride = validateProvider(process.env.BOOK_PROVIDER) || "auto";
+  const defaultBaseUrl = explicitBaseUrl || DEFAULT_OPENAI_BASE_URL;
+  const defaultMaxTokens = envMaxTokens ?? settings.maxTokens ?? legacy?.maxTokens ?? DEFAULT_MAX_OUTPUT_TOKENS;
+  const defaultEffort = options?.effortOverride || validateEffort(process.env.BOOK_EFFORT) || settings.effort || "high";
+  const defaultProvider = defaultProviderOverride;
+  let config = {
+    apiKey: defaultApiKey,
+    baseUrl: defaultBaseUrl,
+    model: rawModel,
+    modelSelection: rawModel,
+    compactModel,
+    advisorModel,
+    compactEffort,
+    compactStrategy,
+    // Undefined = unlimited. Only set when env/settings/legacy explicitly provide a value.
+    maxTurns: process.env.BOOK_MAX_TURNS ? parseInt(process.env.BOOK_MAX_TURNS, 10) : settings.maxTurns ?? legacy?.maxTurns,
+    maxTokens: defaultMaxTokens,
+    maxTokensExplicit,
+    defaultMaxTokens,
+    effortExplicit,
+    defaultEffort,
+    defaultApiKey,
+    defaultBaseUrl,
+    defaultBaseUrlExplicit: Boolean(process.env.BOOK_BASE_URL),
+    workspaceProviderGate: {
+      ...providerGate,
+      withheldSelections: withheldLegacyModel ? [...providerGate.withheldSelections, withheldLegacyModel] : providerGate.withheldSelections,
+      // What `--model` and the environment chose counts too: those outrank every settings layer.
+      unaffectedSelections: withEnvironmentSelections(
+        providerGate.unaffectedSelections,
+        environmentModelSelections(options?.modelOverride),
+        withheldIds
+      ),
+      legacyBaseUrl: legacyBaseUrlGate
+    },
+    defaultProvider,
+    autoCompactEnabled: settings.autoCompactEnabled ?? legacy?.autoCompactEnabled ?? true,
+    workspace: resolvedWorkspace,
+    animation: legacy?.animation || { typewriterSpeed: 3, spinnerStyle: "braille" },
+    accessibility: legacy?.accessibility || { screenReader: false, reducedMotion: false },
+    settings,
+    shell,
+    settingsContext: {
+      overridePath: settingsOverridePath,
+      noSettings
+    },
+    retry,
+    memoryContext,
+    effort: defaultEffort,
+    provider: defaultProvider,
+    modelWindowStore: options?.modelWindowStore ?? createModelWindowStore()
+  };
+  config = applyModelDefaults(
+    resolveModelProviderConfig(config, rawModel, { trustedSelection: true })
+  );
+  const rawPrefix = providerPrefixOf(rawModel);
+  config.modelProviderWarning = rawPrefix !== void 0 && withheldIds.has(rawPrefix) ? void 0 : describeUnresolvedProviderPrefix(settings.provider, rawModel.trim());
+  if (!config.apiKey && !options?.allowMissingApiKey) {
+    throw new Error(
+      "BOOK_API_KEY or provider.<id>.apiKey not set. Set BOOK_API_KEY or use {env:VAR} in settings." + (hadRemovedAuthConfiguration(
+        noSettings ? [] : settingsLayerPaths(resolvedWorkspace, settingsOverridePath, options?.settingsPaths),
+        process.env
+      ) ? "\n\nSubscription authentication (`book auth login`) was removed in this version, and Book authenticates with API keys only. The auth configuration still on this machine is no longer read; `book doctor` lists it and what to delete." : "")
+    );
+  }
+  return config;
+}
+function inheritedApiKey(config, baseUrl) {
+  if (config.defaultApiKey) return config.defaultApiKey;
+  return sameEndpoint(baseUrl, config.baseUrl) ? config.apiKey : "";
+}
+function sameEndpoint(a, b) {
+  const normalise = (raw) => {
+    const trimmed = raw.trim();
+    try {
+      const url = new URL(trimmed);
+      const auth = url.username || url.password ? `${url.username}:${url.password}@` : "";
+      return `${url.protocol}//${auth}${url.host}${url.pathname.replace(/\/+$/, "")}${url.search}`;
+    } catch {
+      return trimmed.replace(/\/+$/, "");
+    }
+  };
+  return normalise(a) === normalise(b);
+}
+function plainModelConfig(config, model) {
+  const baseUrl = config.defaultBaseUrl || config.baseUrl;
+  return {
+    ...config,
+    apiKey: inheritedApiKey(config, baseUrl),
+    baseUrl,
+    model,
+    modelSelection: model,
+    modelInfo: void 0,
+    provider: config.defaultProvider ?? config.provider
+  };
+}
+function isEffortChosen(config) {
+  return config.effortChosen ?? config.effortExplicit === true;
+}
+function applyModelDefaults(config) {
+  const maxTokens = config.maxTokensExplicit ? config.maxTokens : config.modelInfo?.maxOutputTokens ?? config.defaultMaxTokens ?? config.maxTokens;
+  let effort = config.effort;
+  if (!isEffortChosen(config)) {
+    if (config.modelInfo?.effort === false) {
+      effort = void 0;
+    } else if (typeof config.modelInfo?.effort === "object" && config.modelInfo.effort.default) {
+      effort = config.modelInfo.effort.default;
+    } else {
+      effort = config.defaultEffort ?? effort;
+    }
+  }
+  return { ...config, maxTokens, effort };
+}
+function freezeAgentConfig(config) {
+  return deepFreeze(config);
+}
+function deepFreeze(value) {
+  if (!value || typeof value !== "object" || Object.isFrozen(value)) return value;
+  Object.freeze(value);
+  for (const child of Object.values(value)) deepFreeze(child);
+  return value;
+}
+function describeUnresolvedProviderPrefix(providers, rawModel) {
+  const slash = rawModel.indexOf("/");
+  if (slash <= 0 || slash === rawModel.length - 1) return void 0;
+  const prefix = rawModel.slice(0, slash);
+  const configured = Object.keys(providers);
+  if (configured.length === 0 || configured.includes(prefix)) return void 0;
+  return `Model "${rawModel}" names provider "${prefix}", which is not configured (configured: ${[...configured].sort().join(", ")}). Treating the whole id as a model name against the default endpoint. Add provider.${prefix} to settings, or use one of the configured ids.`;
+}
+function isWithheldWorkspaceProvider(config, providerId) {
+  return !Object.hasOwn(config.settings.provider, providerId) && (config.workspaceProviderGate?.withheld.includes(providerId) ?? false);
+}
+function resolveModelProviderConfig(config, rawModel = config.model, options = {}) {
+  const selection = rawModel.trim();
+  const providerId = providerPrefixOf(selection);
+  if (providerId === void 0) return plainModelConfig(config, selection);
+  if (providerId.length === selection.length - 1) {
+    throw new Error(`Invalid model "${selection}". Expected "provider/model".`);
+  }
+  const model = selection.slice(providerId.length + 1);
+  if (!Object.hasOwn(config.settings.provider, providerId)) {
+    if (!options.trustedSelection && isWithheldWorkspaceProvider(config, providerId)) {
+      throw new WorkspaceProviderRefusalError(providerId, selection, config.workspace);
+    }
+    return plainModelConfig(config, selection);
+  }
+  const provider = config.settings.provider[providerId];
+  const baseUrl = provider.baseURL ?? provider.baseUrl ?? config.defaultBaseUrl ?? config.baseUrl;
+  const apiKey = config.workspaceProviderGate?.declared.includes(providerId) ? resolveSecret(provider.apiKey, config.workspace) ?? "" : resolveSecret(provider.apiKey, config.workspace) ?? inheritedApiKey(config, baseUrl);
+  return {
+    ...config,
+    apiKey,
+    baseUrl,
+    model,
+    modelSelection: selection,
+    modelInfo: provider.models[model],
+    provider: provider.type
+  };
+}
+function clampEffortToCatalog(config, effort, options = {}) {
+  const levels = getAvailableEffortLevels(config);
+  if (levels === null || effort === void 0) return void 0;
+  const ceiling = EFFORT_LEVELS.indexOf(effort);
+  const clamped = levels.filter((level) => EFFORT_LEVELS.indexOf(level) <= ceiling).at(-1);
+  return clamped ?? (options.raiseToLowest ? levels[0] : void 0);
+}
+function compactModelEffort(config) {
+  const cap = EFFORT_LEVELS.indexOf("medium");
+  const target = config.compactEffort ?? (config.effort && EFFORT_LEVELS.indexOf(config.effort) > cap ? "medium" : config.effort);
+  return clampEffortToCatalog(config, target, {
+    raiseToLowest: config.compactEffort !== void 0
+  });
+}
+function resolveEffortExplicit(config, effort, chosen) {
+  if (effort === void 0) return false;
+  if (chosen) return true;
+  const catalog = config.modelInfo?.effort;
+  if (typeof catalog !== "object") return false;
+  return catalog.levels ? catalog.levels.includes(effort) : catalog.default !== void 0;
+}
+function compactsOnSessionModel(config) {
+  const compactModel = config.compactModel?.trim() || config.settings?.compactModel?.trim();
+  return !compactModel || compactModel === config.modelSelection || compactModel === config.model;
+}
+function resolveCompactModelConfig(config) {
+  const compactModel = config.compactModel?.trim() || config.settings.compactModel?.trim();
+  const resolved = compactsOnSessionModel(config) ? config : applyModelDefaults(
+    resolveModelProviderConfig(config, compactModel, { trustedSelection: true })
+  );
+  const effort = compactModelEffort(resolved);
+  const chosen = resolved.compactEffort !== void 0 || isEffortChosen(resolved);
+  return {
+    ...resolved,
+    effort,
+    effortChosen: chosen,
+    effortExplicit: resolveEffortExplicit(resolved, effort, chosen)
+  };
+}
+function configuredAdvisorModel(config) {
+  const configured = config.advisorModel?.trim() || config.settings?.advisorModel?.trim() || void 0;
+  return configured?.toLowerCase() === ADVISOR_OFF_VALUE ? void 0 : configured;
+}
+function advisorModelRefusal(config, advisorModel) {
+  const id = advisorModel.trim();
+  if (id.startsWith("/") || id.endsWith("/")) {
+    return `advisor model "${id}" is not a model id; use <provider>/<model>`;
+  }
+  const slash = id.indexOf("/");
+  if (id === config.modelSelection || id === config.model) return void 0;
+  const providers = config.settings.provider;
+  if (slash > 0 && Object.hasOwn(providers, id.slice(0, slash))) return void 0;
+  if (config.defaultBaseUrlExplicit) return void 0;
+  const resolved = resolveModelProviderConfig(config, id, { trustedSelection: true });
+  if (sameEndpoint(resolved.baseUrl, config.baseUrl) && resolved.apiKey === config.apiKey) {
+    return void 0;
+  }
+  const configured = Object.keys(providers).sort();
+  return `advisor model "${id}" names no configured provider, so its key and endpoint are ambiguous; use <provider>/<model>${configured.length ? ` (configured: ${configured.join(", ")})` : ""}`;
+}
+function resolveAdvisorModelConfig(config) {
+  const advisorModel = configuredAdvisorModel(config);
+  if (!advisorModel) return void 0;
+  const resolved = advisorModel === config.modelSelection || advisorModel === config.model ? config : applyModelDefaults(
+    resolveModelProviderConfig(config, advisorModel, { trustedSelection: true })
+  );
+  const capped = resolved.effort && EFFORT_LEVELS.indexOf(resolved.effort) > EFFORT_LEVELS.indexOf("high") ? "high" : resolved.effort;
+  const effort = clampEffortToCatalog(resolved, capped);
+  const chosen = isEffortChosen(resolved);
+  return {
+    ...resolved,
+    effort,
+    effortChosen: chosen,
+    effortExplicit: resolveEffortExplicit(resolved, effort, chosen)
+  };
+}
+function resolveReducerModelConfig(config) {
+  const resolved = resolveCompactModelConfig(config);
+  return {
+    ...resolved,
+    // A reducer request that dies before its first byte twice is not going to succeed
+    // at that size, and runCompaction already falls back to the deterministic
+    // checkpoint when the model path fails — ten attempts at five minutes each only
+    // delayed that fallback. The watchdog retries 429/529 without limit, which
+    // would lift this cap, so it is off for the reducer.
+    retry: {
+      ...resolved.retry,
+      maxAttempts: Math.min(resolved.retry.maxAttempts, 2),
+      watchdog: false
+    }
+  };
+}
+function resolveSecret(raw, workspace) {
+  if (!raw) return void 0;
+  const reference = parseSecretReference(raw);
+  if (reference.kind === "env") return process.env[reference.name];
+  if (reference.kind === "literal") return raw;
+  const file = resolveSecretFilePath(reference.path, workspace);
+  if (!file.readable) return void 0;
+  try {
+    return readFileSync3(file.path, "utf-8").trim();
+  } catch {
+    return void 0;
+  }
+}
+function validateEffort(raw) {
+  if (!raw) return void 0;
+  const normalized = raw.trim().toLowerCase();
+  return isEffortLevel(normalized) ? normalized : void 0;
+}
+var VALID_PROVIDERS = /* @__PURE__ */ new Set(["anthropic", "openai", "auto"]);
+function validateProvider(raw) {
+  if (!raw) return void 0;
+  const normalized = raw.trim().toLowerCase();
+  return VALID_PROVIDERS.has(normalized) ? normalized : void 0;
+}
+function clampInt(raw, min, max) {
+  const n = parseInt(raw, 10);
+  if (Number.isNaN(n)) return min;
+  return Math.max(min, Math.min(max, n));
+}
+function parsePositiveInt(raw, name) {
+  if (raw === void 0 || raw.trim() === "") return void 0;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n <= 0) {
+    throw new Error(`${name} must be a positive integer`);
+  }
+  return n;
+}
+
+// src/provider-secrets.ts
+var PROVIDER_KEY_MARKER = "[redacted: provider key]";
+var MIN_PROVIDER_SECRET_LENGTH = 8;
+var PLACEHOLDER_PROVIDER_KEYS = [
+  "not-needed",
+  "lm-studio",
+  "sk-no-key-required",
+  "no-key-required",
+  "no-api-key",
+  "dummy-key",
+  "placeholder"
+];
+function collectProviderSecrets(config) {
+  const candidates = [config.apiKey, process.env.BOOK_API_KEY];
+  for (const [id, provider] of Object.entries(config.settings.provider ?? {})) {
+    if (isWithheldWorkspaceProvider(config, id)) continue;
+    candidates.push(resolveSecret(provider.apiKey, config.workspace));
+  }
+  const secrets = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    if (typeof candidate !== "string") continue;
+    const value = candidate.trim();
+    if (value.length < MIN_PROVIDER_SECRET_LENGTH) continue;
+    if (PLACEHOLDER_PROVIDER_KEYS.includes(value.toLowerCase())) continue;
+    secrets.add(value);
+  }
+  return [...secrets].sort((a, b) => b.length - a.length || (a < b ? -1 : a > b ? 1 : 0));
+}
+function redactSecrets(text, secrets) {
+  if (!text || secrets.length === 0) return text;
+  const spans = [];
+  for (const secret of secrets) {
+    if (!secret) continue;
+    for (let at = text.indexOf(secret); at !== -1; at = text.indexOf(secret, at + 1)) {
+      spans.push([at, at + secret.length]);
+    }
+  }
+  if (spans.length === 0) return text;
+  spans.sort((a, b) => a[0] - b[0] || b[1] - a[1]);
+  let out = "";
+  let cursor = 0;
+  let [start, end] = spans[0];
+  const flush = () => {
+    out += text.slice(cursor, start) + PROVIDER_KEY_MARKER;
+    cursor = end;
+  };
+  for (const span of spans.slice(1)) {
+    if (span[0] < end) {
+      end = Math.max(end, span[1]);
+      continue;
+    }
+    flush();
+    [start, end] = span;
+  }
+  flush();
+  return out + text.slice(cursor);
+}
+function secretSafeCut(text, limit, secrets) {
+  const wanted = Math.min(Math.max(1, limit), text.length);
+  if (wanted >= text.length || secrets.length === 0) return wanted;
+  const spanning = (cut) => {
+    const found = [];
+    for (const secret of secrets) {
+      if (!secret) continue;
+      const from = Math.max(0, cut - secret.length + 1);
+      for (let at = text.indexOf(secret, from); at !== -1 && at < cut; ) {
+        found.push([at, at + secret.length]);
+        at = text.indexOf(secret, at + 1);
+      }
+    }
+    return found;
+  };
+  let back = wanted;
+  for (let spans = spanning(back); spans.length > 0; spans = spanning(back)) {
+    back = Math.min(...spans.map(([start]) => start));
+  }
+  if (back > 0) return back;
+  let forward = wanted;
+  for (let spans = spanning(forward); spans.length > 0; spans = spanning(forward)) {
+    forward = Math.max(...spans.map(([, end]) => end));
+  }
+  return forward;
+}
+function secretSafeStart(text, start, secrets) {
+  let safe = Math.min(Math.max(0, start), text.length);
+  if (safe === 0 || safe >= text.length || secrets.length === 0) return safe;
+  for (; ; ) {
+    let earliest = safe;
+    for (const secret of secrets) {
+      if (!secret) continue;
+      const from = Math.max(0, safe - secret.length + 1);
+      for (let at = text.indexOf(secret, from); at !== -1 && at < safe; ) {
+        earliest = Math.min(earliest, at);
+        at = text.indexOf(secret, at + 1);
+      }
+    }
+    if (earliest === safe) return safe;
+    safe = earliest;
+  }
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function redactValue(value, secrets, ancestors) {
+  if (typeof value === "string") return redactSecrets(value, secrets);
+  if (typeof value !== "object" || value === null) return value;
+  const isArray = Array.isArray(value);
+  if (!isArray && !isPlainObject(value)) return value;
+  if (ancestors.has(value)) return value;
+  ancestors.add(value);
+  try {
+    if (isArray) {
+      let copy2;
+      value.forEach((item, index) => {
+        const next = redactValue(item, secrets, ancestors);
+        if (next === item) return;
+        copy2 ??= [...value];
+        copy2[index] = next;
+      });
+      return copy2 ?? value;
+    }
+    const record = value;
+    let copy;
+    for (const [key, item] of Object.entries(record)) {
+      const next = redactValue(item, secrets, ancestors);
+      if (next === item) continue;
+      copy ??= { ...record };
+      copy[key] = next;
+    }
+    return copy ?? value;
+  } finally {
+    ancestors.delete(value);
+  }
+}
+var IDENTITY_FIELDS = /* @__PURE__ */ new Set(["version", "toolCallId", "status"]);
+function redactToolResultSecrets(result, secrets) {
+  if (secrets.length === 0) return result;
+  const ancestors = /* @__PURE__ */ new Set();
+  let copy;
+  for (const [key, value] of Object.entries(result)) {
+    if (IDENTITY_FIELDS.has(key)) continue;
+    const next = redactValue(value, secrets, ancestors);
+    if (next === value) continue;
+    copy ??= { ...result };
+    copy[key] = next;
+  }
+  return copy ?? result;
+}
+
+// src/tools/redacted-secret-guard.ts
+function holdsProviderKey(ctx, text) {
+  const secrets = ctx.providerSecrets;
+  return !!secrets?.length && secrets.some((secret) => text.includes(secret));
+}
+function redactedSecretOverwrite(ctx, shownPath, existing, incoming) {
+  if (!incoming.some((text) => text.includes(PROVIDER_KEY_MARKER))) return void 0;
+  if (!holdsProviderKey(ctx, existing)) return void 0;
+  return toolFailure(
+    `${shownPath} holds a provider key, which Book shows as ${PROVIDER_KEY_MARKER}. Writing that marker back would replace the real key.`,
+    {
+      code: "redacted_secret_overwrite",
+      remediation: "Use Edit on only the lines that need to change, without the line that shows the marker, or ask the user to make the change."
+    }
+  );
+}
+function markerCount(text) {
+  return text.split(PROVIDER_KEY_MARKER).length - 1;
+}
+function redactedSecretAddition(ctx, shownPath, before, after) {
+  if (!ctx.providerSecrets?.length) return void 0;
+  if (markerCount(after) <= markerCount(before)) return void 0;
+  return toolFailure(
+    `Writing ${shownPath} would add ${PROVIDER_KEY_MARKER}, which stands for a real provider key that the model cannot see. Book does not write the marker to any file while a provider key is configured.`,
+    {
+      code: "redacted_secret_write",
+      remediation: "Write a placeholder of your own instead, for example <your-api-key>, or ask the user to write that text."
+    }
+  );
+}
+function redactedSecretDeletion(ctx, shownPath, existing, subject = "file") {
+  if (!holdsProviderKey(ctx, existing)) return void 0;
+  return toolFailure(
+    `${shownPath} holds a provider key, which Book shows as ${PROVIDER_KEY_MARKER}. Deleting or rewriting the ${subject} would lose the real key, and Book cannot write it back.`,
+    {
+      code: "redacted_secret_overwrite",
+      remediation: "If the user asked for this file (or cell) to be deleted, ask them to delete it themselves. To change it, edit only the lines that need to change, with Edit or an Update File hunk that leaves the key line alone."
+    }
+  );
+}
+function redactedSecretCommand(ctx, command) {
+  if (!ctx.providerSecrets?.length) return void 0;
+  if (!command?.includes(PROVIDER_KEY_MARKER)) return void 0;
+  return toolFailure(
+    `The command contains ${PROVIDER_KEY_MARKER}, which stands for a real provider key that the model cannot see. A command must not write or use it.`,
+    {
+      code: "redacted_secret_command",
+      remediation: "The marker is not the key, and Book cannot write the real key. To change a file that holds a key, edit only the lines that need to change with Edit. To delete or replace such a file, or to run a command that needs the key, ask the user. To search for or quote the marker text itself, leave out the brackets."
+    }
+  );
+}
+
+// src/tools/mutation.ts
+import { randomUUID } from "crypto";
+import { mkdir, readFile as readFile2, rename, rm, stat as stat2, writeFile } from "fs/promises";
+import { dirname } from "path";
+var pathLocks = /* @__PURE__ */ new Map();
+function looksBinary(bytes) {
+  const sample = bytes.subarray(0, 8192);
+  if (sample.includes(0)) return true;
+  let controls = 0;
+  for (const byte of sample) {
+    if (byte < 7 || byte > 13 && byte < 32) controls++;
+  }
+  return sample.length > 0 && controls / sample.length > 0.1;
+}
+async function readTextSnapshot(filePath, allowMissing = false) {
+  let bytes;
+  try {
+    bytes = await readFile2(filePath);
+  } catch (error) {
+    if (allowMissing && error.code === "ENOENT") {
+      return {
+        exists: false,
+        bytes: Buffer.alloc(0),
+        text: "",
+        bom: false,
+        lineEnding: "lf",
+        mixedLineEndings: false,
+        binary: false,
+        mode: void 0
+      };
+    }
+    throw error;
+  }
+  const bom = bytes.length >= 3 && bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191;
+  const body = bytes.subarray(bom ? 3 : 0);
+  let binary = looksBinary(bytes);
+  let decoded;
+  try {
+    decoded = new TextDecoder("utf-8", { fatal: true }).decode(body);
+  } catch {
+    binary = true;
+    decoded = body.toString("utf8");
+  }
+  const crlfCount = (decoded.match(/\r\n/g) ?? []).length;
+  const bareLfCount = (decoded.replace(/\r\n/g, "").match(/\n/g) ?? []).length;
+  const bareCrCount = (decoded.replace(/\r\n/g, "").match(/\r/g) ?? []).length;
+  const mixedLineEndings = crlfCount > 0 && bareLfCount > 0 || bareCrCount > 0;
+  const mode = (await stat2(filePath)).mode & 511;
+  return {
+    exists: true,
+    bytes,
+    text: decoded.replace(/\r\n/g, "\n"),
+    bom,
+    lineEnding: crlfCount > bareLfCount ? "crlf" : "lf",
+    mixedLineEndings,
+    binary,
+    mode
+  };
+}
+function restoreTextEncoding(text, snapshot) {
+  const body = snapshot.lineEnding === "crlf" ? text.replace(/\n/g, "\r\n") : text;
+  return Buffer.from(`${snapshot.bom ? "\uFEFF" : ""}${body}`, "utf8");
+}
+async function writeFileAtomically(filePath, bytes, signal, mode) {
+  throwIfAborted(signal);
+  await mkdir(dirname(filePath), { recursive: true });
+  const temporary = `${filePath}.book-tmp-${randomUUID()}`;
+  try {
+    await writeFile(temporary, bytes, { flag: "wx", mode });
+    throwIfAborted(signal);
+    await rename(temporary, filePath);
+  } finally {
+    await rm(temporary, { force: true }).catch(() => void 0);
+  }
+}
+async function removeFileAtomically(filePath, signal) {
+  throwIfAborted(signal);
+  await rm(filePath, { force: false });
+}
+async function acquirePath(path) {
+  const previous = pathLocks.get(path) ?? Promise.resolve();
+  let release;
+  const current = new Promise((resolve4) => {
+    release = resolve4;
+  });
+  const queued = previous.then(() => current);
+  pathLocks.set(path, queued);
+  await previous;
+  return () => {
+    release();
+    if (pathLocks.get(path) === queued) pathLocks.delete(path);
+  };
+}
+async function withMutationLocks(paths, operation) {
+  const releases = [];
+  try {
+    for (const path of [...new Set(paths)].sort()) releases.push(await acquirePath(path));
+    return await operation();
+  } finally {
+    for (const release of releases.reverse()) release();
+  }
+}
+
+// src/tools/patch.ts
+var MAX_PATCH_BYTES = 1024 * 1024;
+var MAX_FILES = 100;
+var MAX_HUNKS = 1e3;
+function invalid(message, details) {
+  return toolFailure(message, {
+    code: "invalid_patch_syntax",
+    remediation: "Regenerate a Codex-style patch with Begin/End markers and valid file hunks.",
+    details
+  });
+}
+function parseHunkHeader(line) {
+  const match = line.match(/^@@(?: -(\d+)(?:,(\d+))?)?(?: \+(\d+)(?:,(\d+))?)?(?: @@.*)?$/);
+  if (!match) throw new Error(`Invalid hunk header: ${line}`);
+  return { oldStart: match[1] ? Number(match[1]) : void 0 };
+}
+function parsePatchUnsafe(patch) {
+  if (typeof patch !== "string" || patch.length === 0)
+    return invalid("patch must be a non-empty string");
+  const bytes = Buffer.byteLength(patch, "utf8");
+  if (bytes > MAX_PATCH_BYTES)
+    return toolFailure(`Patch input exceeds ${MAX_PATCH_BYTES} bytes`, {
+      code: "patch_limit_exceeded",
+      remediation: "Split the change into smaller patches.",
+      details: { limit: MAX_PATCH_BYTES, bytes }
+    });
+  const lines = patch.replace(/\r\n/g, "\n").split("\n");
+  if (lines.at(-1) === "") lines.pop();
+  if (lines[0] !== "*** Begin Patch" || lines.at(-1) !== "*** End Patch")
+    return invalid("Patch must start with *** Begin Patch and end with *** End Patch");
+  while (lines.length > 2 && lines[1] === "*** Begin Patch") lines.splice(1, 1);
+  while (lines.length > 2 && lines.at(-2) === "*** End Patch") lines.splice(-2, 1);
+  const operations = [];
+  let index = 1;
+  let hunkCount = 0;
+  while (index < lines.length - 1) {
+    const marker = lines[index];
+    const update = marker.match(/^\*\*\* Update File: (.+)$/);
+    const add = marker.match(/^\*\*\* Add File: (.+)$/);
+    const del = marker.match(/^\*\*\* Delete File: (.+)$/);
+    if (update) {
+      const hunks = [];
+      index++;
+      while (index < lines.length - 1 && !lines[index].startsWith("*** ")) {
+        if (!lines[index].startsWith("@@"))
+          throw new Error(`Expected @@ hunk header near line ${index + 1}`);
+        const header = lines[index];
+        const parsedHeader = parseHunkHeader(header);
+        index++;
+        const hunkLines = [];
+        while (index < lines.length - 1 && !lines[index].startsWith("@@") && !lines[index].startsWith("*** ")) {
+          const line = lines[index++];
+          if (line === "\") {
+            const previous = hunkLines.at(-1);
+            if (!previous)
+              throw new Error(`No-newline marker has no preceding hunk line near line ${index}`);
+            previous.noNewline = true;
+            continue;
+          }
+          if (line.startsWith(" ")) hunkLines.push({ kind: "context", text: line.slice(1) });
+          else if (line.startsWith("-")) hunkLines.push({ kind: "remove", text: line.slice(1) });
+          else if (line.startsWith("+")) hunkLines.push({ kind: "add", text: line.slice(1) });
+          else throw new Error(`Invalid hunk line near line ${index}`);
+        }
+        if (hunkLines.length === 0) throw new Error(`Empty hunk near line ${index}`);
+        if (!hunkLines.some((line) => line.kind !== "add"))
+          throw new Error(`Update hunk must contain context or removed lines near line ${index}`);
+        hunks.push({ header, oldStart: parsedHeader.oldStart, lines: hunkLines });
+        hunkCount++;
+      }
+      if (hunks.length === 0) throw new Error(`Update File ${update[1]} has no hunks`);
+      operations.push({ kind: "update", path: update[1].trim(), hunks });
+      continue;
+    }
+    if (add) {
+      index++;
+      const content = [];
+      while (index < lines.length - 1 && !lines[index].startsWith("*** ")) {
+        const line = lines[index++];
+        if (!line.startsWith("+"))
+          throw new Error(`Added file lines must begin with + near line ${index}`);
+        content.push(line.slice(1));
+      }
+      operations.push({ kind: "add", path: add[1].trim(), lines: content });
+      continue;
+    }
+    if (del) {
+      index++;
+      if (index < lines.length - 1 && !lines[index].startsWith("*** "))
+        throw new Error(`Delete File ${del[1]} cannot contain patch lines`);
+      operations.push({ kind: "delete", path: del[1].trim() });
+      continue;
+    }
+    throw new Error(`Expected a file operation near line ${index + 1}`);
+  }
+  if (operations.length === 0) return invalid("Patch contains no file operations");
+  if (operations.length > MAX_FILES || hunkCount > MAX_HUNKS)
+    return toolFailure(`Patch exceeds limits (${MAX_FILES} files, ${MAX_HUNKS} hunks)`, {
+      code: "patch_limit_exceeded",
+      remediation: "Split the change into smaller patches.",
+      details: { files: operations.length, hunks: hunkCount }
+    });
+  return { operations, bytes };
+}
+function parsePatch(patch) {
+  try {
+    return parsePatchUnsafe(patch);
+  } catch (error) {
+    return invalid(error instanceof Error ? error.message : String(error));
+  }
+}
+function linesOf(text) {
+  const lines = text.split("\n");
+  if (lines.at(-1) === "") lines.pop();
+  return lines;
+}
+function sequenceMatches(haystack, needle) {
+  if (needle.length === 0) return [];
+  const matches = [];
+  for (let start = 0; start <= haystack.length - needle.length; start++) {
+    if (needle.every((line, offset) => haystack[start + offset] === line)) matches.push(start);
+  }
+  return matches;
+}
+function candidateLine(haystack, line) {
+  const matches = haystack.reduce((found, value, index) => {
+    if (value === line) found.push(index + 1);
+    return found;
+  }, []);
+  return matches.length === 1 ? matches[0] : void 0;
+}
+function applyHunks(text, hunks) {
+  let lines = linesOf(text);
+  let trailingNewline = text.endsWith("\n");
+  let cursor = 0;
+  for (let hunkIndex = 0; hunkIndex < hunks.length; hunkIndex++) {
+    const hunk = hunks[hunkIndex];
+    const oldLines = hunk.lines.filter((line) => line.kind !== "add").map((line) => line.text);
+    const newLines = hunk.lines.filter((line) => line.kind !== "remove").map((line) => line.text);
+    const matches = sequenceMatches(lines, oldLines);
+    const afterPrevious = matches.filter((start) => start >= cursor);
+    const index = matches.length === 1 ? matches[0] : afterPrevious.length === 1 ? afterPrevious[0] : -1;
+    if (matches.length === 0)
+      return {
+        text,
+        mismatch: toolFailure(`Hunk ${hunkIndex + 1}: patch context not found`, {
+          code: "patch_context_not_found",
+          remediation: "Reread the affected range and regenerate the hunk against the latest file contents.",
+          details: {
+            hunkIndex: hunkIndex + 1,
+            header: hunk.header,
+            firstContextLine: oldLines[0]?.slice(0, 200),
+            closestCandidateLine: oldLines[0] ? candidateLine(lines, oldLines[0]) : void 0,
+            suggestedReadRange: hunk.oldStart !== void 0 ? {
+              lineStart: Math.max(1, hunk.oldStart - 3),
+              lineEnd: hunk.oldStart + oldLines.length + 3
+            } : void 0
+          }
+        })
+      };
+    if (index < 0)
+      return {
+        text,
+        mismatch: toolFailure(`Hunk ${hunkIndex + 1}: patch context is ambiguous`, {
+          code: "ambiguous_patch_context",
+          remediation: "Add surrounding lines, such as the enclosing function signature, until the hunk occurs once in the file or once after the previous hunk, then regenerate the patch.",
+          details: {
+            hunkIndex: hunkIndex + 1,
+            header: hunk.header,
+            matches: matches.length,
+            matchesAfterPreviousHunk: afterPrevious.length
+          }
+        })
+      };
+    const touchesEndOfFile = index + oldLines.length === lines.length;
+    lines = [...lines.slice(0, index), ...newLines, ...lines.slice(index + oldLines.length)];
+    cursor = index + newLines.length;
+    if (touchesEndOfFile) {
+      const oldNoNewline = hunk.lines.some((line) => line.kind !== "add" && line.noNewline);
+      const newNoNewline = hunk.lines.some((line) => line.kind !== "remove" && line.noNewline);
+      if (newNoNewline) trailingNewline = false;
+      else if (oldNoNewline) trailingNewline = true;
+    }
+  }
+  return { text: lines.join("\n") + (trailingNewline && lines.length > 0 ? "\n" : "") };
+}
+function mutationFromDiff(target, kind, stats) {
+  return {
+    kind,
+    filePath: target.displayPath,
+    ...target.memory ? { memory: true } : {},
+    addedLines: stats.addedLines,
+    removedLines: stats.removedLines
+  };
+}
+function errorCodeFor(error) {
+  return error instanceof Error && error.message.includes("changed or disappeared") ? "stale_file_observation" : "filesystem_error";
+}
+async function redactedSecretRefusal(ctx, entries) {
+  for (const { operation, filePath, messagePath } of entries) {
+    if (operation.kind === "add") continue;
+    const added = operation.kind === "update" ? operation.hunks.flatMap(
+      (hunk) => hunk.lines.filter((line) => line.kind === "add").map((line) => line.text)
+    ) : [];
+    if (operation.kind === "update" && !added.some((text) => text.includes(PROVIDER_KEY_MARKER)))
+      continue;
+    let existing;
+    try {
+      existing = (await readTextSnapshot(filePath, true)).text;
+    } catch {
+      continue;
+    }
+    const refused = operation.kind === "delete" ? redactedSecretDeletion(ctx, messagePath, existing) : redactedSecretOverwrite(ctx, messagePath, existing, added);
+    if (refused) return refused;
+  }
+  return void 0;
+}
+async function applyPatch(args, ctx) {
+  const parsed = parsePatch(args.patch);
+  if (!("operations" in parsed)) return parsed;
+  const paths = parsed.operations.map((operation) => operation.path);
+  const resolved = parsed.operations.map((operation) => {
+    const result = resolveMutationPath(ctx, operation.path);
+    return result ? {
+      operation,
+      ...result,
+      displayPath: mutationDisplayPath(result),
+      messagePath: messagePathFor(result)
+    } : null;
+  });
+  if (resolved.some((entry) => !entry))
+    return pathOutsideWorkspaceResult(paths[resolved.findIndex((entry) => !entry)]);
+  const entries = resolved;
+  const refused = await redactedSecretRefusal(ctx, entries);
+  if (refused) return refused;
+  const canonicalKeys = entries.map(
+    (entry) => process.platform === "win32" ? entry.canonicalPath.toLowerCase() : entry.canonicalPath
+  );
+  if (new Set(canonicalKeys).size !== canonicalKeys.length)
+    return toolFailure("A patch may contain only one operation per file", {
+      code: "patch_conflict",
+      remediation: "Combine related updates into one file operation with multiple hunks."
+    });
+  return withMutationLocks(
+    entries.map((entry) => entry.canonicalPath),
+    async () => {
+      const staged = [];
+      const memoryWarnings = [];
+      try {
+        for (const entry of entries) {
+          throwIfAborted(ctx.signal);
+          const before = await readTextSnapshot(entry.filePath, entry.operation.kind === "add");
+          if (before.binary)
+            return toolFailure(`Binary file is unsupported: ${entry.messagePath}`, {
+              code: "binary_file_unsupported",
+              remediation: "Use a text file mutation or a dedicated binary workflow."
+            });
+          if (before.mixedLineEndings && entry.operation.kind === "update")
+            return toolFailure(
+              `Mixed line endings are unsupported for patch updates: ${entry.messagePath}`,
+              {
+                code: "patch_conflict",
+                remediation: "Normalize the file line endings, reread it, and regenerate the patch.",
+                details: { filePath: entry.messagePath, lineEnding: "mixed" }
+              }
+            );
+          const stale = entry.operation.kind === "add" ? void 0 : await requireFreshObservation(ctx, entry.filePath, entry.messagePath);
+          if (stale)
+            return toolFailure(stale, {
+              code: "stale_file_observation",
+              remediation: "Call Read before regenerating the patch."
+            });
+          if (entry.operation.kind === "add") {
+            if (before.exists)
+              return toolFailure(`File already exists: ${entry.messagePath}`, {
+                code: "patch_conflict",
+                remediation: "Use Update File for an existing file."
+              });
+            let afterText = entry.operation.lines.join("\n") + (entry.operation.lines.length > 0 ? "\n" : "");
+            if (entry.memory) {
+              const checked = checkMemoryWrite(ctx, entry.filePath, afterText, null);
+              if (!checked.ok) return checked.failure;
+              afterText = checked.content ?? afterText;
+              memoryWarnings.push(...checked.warnings);
+            }
+            const added = redactedSecretAddition(ctx, entry.messagePath, "", afterText);
+            if (added) return added;
+            const { stats } = await renderDiffWithStatsAsync("", afterText, 3, ctx.signal);
+            staged.push({
+              operation: entry.operation,
+              absolutePath: entry.filePath,
+              writePath: entry.canonicalPath,
+              messagePath: entry.messagePath,
+              memory: entry.memory,
+              before,
+              afterText,
+              afterBytes: Buffer.from(afterText, "utf8"),
+              mutation: mutationFromDiff(entry, "create", stats)
+            });
+          } else if (entry.operation.kind === "delete") {
+            if (!before.exists)
+              return toolFailure(`File not found: ${entry.messagePath}`, {
+                code: "patch_conflict",
+                remediation: "Reread the workspace and regenerate the patch."
+              });
+            if (entry.memory) {
+              const checked = checkMemoryWrite(ctx, entry.filePath, null, before.text);
+              if (!checked.ok) return checked.failure;
+            }
+            staged.push({
+              operation: entry.operation,
+              absolutePath: entry.filePath,
+              writePath: entry.filePath,
+              messagePath: entry.messagePath,
+              memory: entry.memory,
+              before,
+              mutation: {
+                kind: "delete",
+                filePath: entry.displayPath,
+                ...entry.memory ? { memory: true } : {},
+                addedLines: 0,
+                removedLines: linesOf(before.text).length
+              }
+            });
+          } else {
+            if (!before.exists)
+              return toolFailure(`File not found: ${entry.messagePath}`, {
+                code: "patch_context_not_found",
+                remediation: "Reread the file and regenerate the patch."
+              });
+            const applied = applyHunks(before.text, entry.operation.hunks);
+            if (applied.mismatch)
+              return toolFailure(
+                `${entry.messagePath}: ${applied.mismatch.structuredError?.message}`,
+                {
+                  ...applied.mismatch.structuredError,
+                  code: applied.mismatch.structuredError?.code ?? "patch_context_not_found",
+                  remediation: applied.mismatch.structuredError?.remediation,
+                  details: {
+                    ...applied.mismatch.structuredError?.details,
+                    filePath: entry.messagePath,
+                    lineEnding: before.mixedLineEndings ? "mixed" : before.lineEnding,
+                    normalizedMatching: true
+                  }
+                }
+              );
+            let afterText = applied.text;
+            if (entry.memory) {
+              const checked = checkMemoryWrite(ctx, entry.filePath, afterText, before.text);
+              if (!checked.ok) return checked.failure;
+              afterText = checked.content ?? afterText;
+              memoryWarnings.push(...checked.warnings);
+            }
+            const added = redactedSecretAddition(ctx, entry.messagePath, before.text, afterText);
+            if (added) return added;
+            const { stats } = await renderDiffWithStatsAsync(before.text, afterText, 3, ctx.signal);
+            staged.push({
+              operation: entry.operation,
+              absolutePath: entry.filePath,
+              writePath: entry.canonicalPath,
+              messagePath: entry.messagePath,
+              memory: entry.memory,
+              before,
+              afterText,
+              afterBytes: restoreTextEncoding(afterText, before),
+              mutation: mutationFromDiff(entry, "update", stats)
+            });
+          }
+        }
+        const mutations = staged.map((file) => file.mutation);
+        const changedLines = mutations.reduce(
+          (total, mutation) => total + mutation.addedLines + mutation.removedLines,
+          0
+        );
+        const contextLines = parsed.operations.reduce(
+          (total, operation) => total + (operation.kind === "update" ? operation.hunks.reduce(
+            (hunkTotal, hunk) => hunkTotal + hunk.lines.filter((line) => line.kind === "context").length,
+            0
+          ) : 0),
+          0
+        );
+        const changeBudgetWarnings = [];
+        if (changedLines > 2e3) changeBudgetWarnings.push("large_change");
+        if (changedLines > 100 && changedLines > Math.max(1, contextLines) * 20)
+          changeBudgetWarnings.push("low_context_to_change_ratio");
+        const diffs = [];
+        for (const file of staged) {
+          throwIfAborted(ctx.signal);
+          const afterText = file.afterText ?? "";
+          const { diff } = await renderDiffWithStatsAsync(
+            file.before.text,
+            afterText,
+            3,
+            ctx.signal
+          );
+          if (diff) diffs.push(`--- ${file.messagePath}
++++ ${file.messagePath}
+${diff}`);
+        }
+        const committed = [];
+        try {
+          for (const file of staged) {
+            throwIfAborted(ctx.signal);
+            committed.push(file);
+            if (file.operation.kind === "delete")
+              await removeFileAtomically(file.absolutePath, ctx.signal);
+            else
+              await writeFileAtomically(
+                file.writePath,
+                file.afterBytes,
+                ctx.signal,
+                file.before.mode
+              );
+            const check = await readTextSnapshot(
+              file.absolutePath,
+              file.operation.kind === "delete"
+            );
+            if (file.operation.kind === "delete" ? check.exists : !check.exists || !check.bytes.equals(file.afterBytes))
+              throw new Error(`Post-write verification failed for ${file.messagePath}`);
+          }
+        } catch (error) {
+          let rollbackFailed = false;
+          for (const file of committed.reverse()) {
+            try {
+              if (file.before.exists)
+                await writeFileAtomically(
+                  file.writePath,
+                  file.before.bytes,
+                  void 0,
+                  file.before.mode
+                );
+              else await removeFileAtomically(file.absolutePath).catch(() => void 0);
+            } catch {
+              rollbackFailed = true;
+            }
+          }
+          return toolFailure(
+            `Patch commit failed${rollbackFailed ? "; rollback also failed" : " and was rolled back"}: ${error instanceof Error ? error.message : String(error)}`,
+            {
+              code: rollbackFailed ? "patch_rollback_failed" : "filesystem_error",
+              remediation: rollbackFailed ? "Inspect the affected files and restore them manually." : "Retry after checking the workspace state."
+            }
+          );
+        }
+        const observations = [];
+        for (const file of staged) {
+          if (file.operation.kind !== "delete")
+            observations.push(
+              await observeFile(
+                ctx,
+                file.absolutePath,
+                file.operation.kind === "add" ? "create" : "edit"
+              )
+            );
+        }
+        for (const file of staged) {
+          if (file.memory) {
+            noticeMemoryWrite(
+              ctx,
+              file.absolutePath,
+              file.operation.kind === "delete" ? "deleted" : "saved"
+            );
+          }
+        }
+        const result = toolSuccess(
+          withMemoryWarnings(
+            diffs.join("\n") || "Patch applied successfully (no textual change)",
+            memoryWarnings
+          ),
+          {
+            data: {
+              files: mutations.map((mutation) => mutation.filePath),
+              changedFiles: mutations.length,
+              changedLines,
+              patchBytes: parsed.bytes,
+              changeBudgetWarnings
+            },
+            artifacts: {
+              fileMutation: mutations[0],
+              fileMutations: mutations,
+              fileObservations: observations
+            },
+            presentation: {
+              kind: "diff",
+              summary: `Applied patch to ${mutations.length} ${mutations.length === 1 ? "file" : "files"}`,
+              target: mutations.length === 1 ? mutations[0].filePath : `${mutations.length} files`
+            }
+          }
+        );
+        if (!staged.every((file) => file.mutation.kind === "create")) return result;
+        return {
+          ...result,
+          maskedPlaceholder: withMemoryWarnings(
+            `${staged.map(
+              (file, order) => `${order === 0 ? "Created" : "created"} ${file.messagePath} (${file.mutation.addedLines} lines, ${file.afterBytes?.byteLength ?? 0} bytes)`
+            ).join("; ")}.`,
+            memoryWarnings
+          )
+        };
+      } catch (error) {
+        const code = errorCodeFor(error);
+        return toolFailure(error instanceof Error ? error.message : String(error), {
+          code,
+          remediation: "Reread the affected file and regenerate the patch."
+        });
+      }
+    }
+  );
+}
+var patchTools = [
+  {
+    name: "ApplyPatch",
+    argumentAliases: { input: "patch" },
+    description: "Apply a Codex-style patch with Update File, Add File, or Delete File operations across one or more files atomically. Read the targets first; use exact contextual hunks, and regenerate the patch after a context mismatch instead of resending it unchanged.",
+    parameters: {
+      type: "object",
+      properties: {
+        patch: {
+          type: "string",
+          minLength: 1,
+          maxLength: MAX_PATCH_BYTES,
+          description: "Patch text beginning with *** Begin Patch and ending with *** End Patch"
+        },
+        baseObservation: {
+          type: "string",
+          maxLength: 128,
+          description: "Optional short observation identifier for diagnostics; freshness is checked implicitly."
+        }
+      },
+      required: ["patch"],
+      additionalProperties: false
+    },
+    execute: applyPatch
+  }
+];
+
+// src/tools/shell-chaining.ts
+var SHELL_CHAINING = /[;&|><`$(){}\n]/;
+var LINE_BREAK = /[\n\r\u0085\u2028\u2029]/;
+var TYPOGRAPHIC_QUOTE_RANGE = "\\u2018-\\u201E";
+var TYPOGRAPHIC_QUOTE = new RegExp(`[${TYPOGRAPHIC_QUOTE_RANGE}]`);
+var ANY_QUOTE = new RegExp(`['"${TYPOGRAPHIC_QUOTE_RANGE}]`);
+function hasCompoundShellSyntax(command, platform = process.platform, shell) {
+  const text = command.trim();
+  const refusesSingleQuote = platform === "win32" && !readsSingleQuoteAsPosix(shell);
+  let state = "outside";
+  for (let i = 0; i < text.length; i += 1) {
+    const char = text[i];
+    if (LINE_BREAK.test(char) || TYPOGRAPHIC_QUOTE.test(char)) return true;
+    if (refusesSingleQuote && char === "'") return true;
+    const next = text[i + 1];
+    const quoteFollows = next === '"' || next === "'";
+    if (char === "\\" && quoteFollows) return true;
+    if (state === "single") {
+      if (char === "'") state = "outside";
+      continue;
+    }
+    if (state === "double") {
+      if (char === "$" || char === "`") return true;
+      if (char === '"') state = "outside";
+      continue;
+    }
+    if (char === "^" && quoteFollows) return true;
+    if (char === '"') state = "double";
+    else if (char === "'") state = "single";
+    else if (SHELL_CHAINING.test(char)) return true;
+  }
+  return state !== "outside";
+}
+
+// src/tools/strict-rm.ts
+import { posix, win32 } from "path";
+var PLAIN_POSIX_OPERAND = /^\/[A-Za-z0-9_./@%+=:,-]*$/;
+var PLAIN_DRIVE_OPERAND = /^[A-Za-z]:[\\/](?:[A-Za-z0-9_.\\/@%+=,-]|~(?=[0-9]))*$/;
+function parseStrictRm(command, platform = process.platform) {
+  const words = command.trim().split(/[ \t]+/);
+  if (words[0] !== "rm" || words.length < 2) return null;
+  const operands = words.slice(1);
+  for (const operand of operands) {
+    const drive = platform === "win32" && PLAIN_DRIVE_OPERAND.test(operand);
+    if (!drive && !PLAIN_POSIX_OPERAND.test(operand)) return null;
+    const spelled = comparablePath(operand, platform);
+    const segments = spelled.slice(drive ? 3 : 1).split("/");
+    if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) {
+      return null;
+    }
+  }
+  return operands;
+}
+function isMarkdownFile(operand) {
+  const name = posix.basename(operand);
+  return name.length > ".md".length && !name.startsWith(".") && name.endsWith(".md");
+}
+function strictRmOperandsSpelledUnder(command, roots, platform = process.platform, respell = (operand) => operand) {
+  const operands = parseStrictRm(command, platform);
+  if (!operands) return null;
+  const spellings = roots.map(
+    (root) => posix.normalize(comparablePath(root, platform)).replace(/\/+$/, "")
+  );
+  const isUnder = (path) => {
+    const spelled = comparablePath(path, platform);
+    return spellings.some((spelling) => spelled.startsWith(`${spelling}/`));
+  };
+  for (const operand of operands) {
+    const spelled = comparablePath(operand, platform);
+    if (!isMarkdownFile(spelled) || posix.basename(spelled).toLowerCase() === "memory.md") {
+      return null;
+    }
+    if (!isUnder(operand) && !isUnder(respell(operand))) return null;
+  }
+  return operands;
+}
+function strictRmOfMarkdownUnder(command, root, platform = process.platform, canonicalize = canonicalizePath) {
+  const paths = platform === "win32" ? win32 : posix;
+  if (!paths.isAbsolute(root)) return null;
+  const canonicalRoot = canonicalize(root);
+  const operands = strictRmOperandsSpelledUnder(
+    command,
+    [root, canonicalRoot],
+    platform,
+    (operand) => paths.join(canonicalize(paths.dirname(operand)), paths.basename(operand))
+  );
+  if (!operands) return null;
+  for (const operand of operands) {
+    if (isOutside(canonicalRoot, canonicalize(paths.dirname(operand)), paths)) return null;
+  }
+  return operands;
+}
+function strictRmMatchesGlob(command, matchesOperand, platform = process.platform) {
+  const operands = parseStrictRm(command, platform);
+  return operands !== null && operands.every(matchesOperand);
+}
+
+// src/permissions.ts
+function isUnreadablePattern(target) {
+  return typeof target === "object" && target !== null && target.target === "invalid";
+}
+var WORKSPACE_READ_TOOLS = /* @__PURE__ */ new Set(["Read", "Glob", "Grep"]);
+var PATH_RULE_TOOLS = /* @__PURE__ */ new Set([
+  "Read",
+  "Write",
+  "Edit",
+  "MultiEdit",
+  "NotebookEdit"
+]);
+var WORKSPACE_READ_JUDGING_MODES = /* @__PURE__ */ new Set([
+  "default",
+  "accept-edits",
+  "plan"
+]);
+var WORKSPACE_READ_REFUSAL_MODES = /* @__PURE__ */ new Set([
+  ...WORKSPACE_READ_JUDGING_MODES,
+  "dontAsk"
+]);
+var WORKSPACE_READ_ONLY_GIT_TOOLS = /* @__PURE__ */ new Set([
+  "GitStatus",
+  "GitDiff",
+  "GitLog",
+  "GitBranch"
+]);
+function parseRule(rule) {
+  const parenIdx = rule.indexOf("(");
+  if (parenIdx === -1) {
+    return { toolName: rule.trim(), pattern: null };
+  }
+  const toolName = rule.slice(0, parenIdx).trim();
+  const closeIdx = rule.lastIndexOf(")");
+  if (closeIdx === -1 || closeIdx <= parenIdx) {
+    return { toolName, pattern: null };
+  }
+  const pattern = rule.slice(parenIdx + 1, closeIdx).trim();
+  return { toolName, pattern: pattern.length === 0 ? null : pattern };
+}
+function normalizePathArg(s) {
+  if (s.startsWith("./")) return s.slice(2);
+  return s;
+}
+function toolNameMatchesRule(ruleToolName, toolName) {
+  if (ruleToolName === toolName) return true;
+  if (!ruleToolName.startsWith("mcp__")) return false;
+  const serverName = ruleToolName.slice("mcp__".length);
+  return Boolean(
+    serverName && !serverName.includes("__") && toolName.startsWith(`${ruleToolName}__`)
+  );
+}
+var caseFoldingPathRule = (value) => value.toLowerCase();
+function ruleMatchesCandidate(rule, toolName, primaryArg, fold) {
+  if (!toolNameMatchesRule(rule.toolName, toolName)) return false;
+  if (rule.pattern === null) return true;
+  const normalizedArg = normalizePathArg(primaryArg);
+  const normalizedPattern = rule.pattern.startsWith("./") ? rule.pattern.slice(2) : rule.pattern;
+  if (!fold) return globToRegex(normalizedPattern).test(normalizedArg);
+  return globToRegex(caseFoldingPathRule(normalizedPattern)).test(
+    caseFoldingPathRule(normalizedArg)
+  );
+}
+function ruleMatches(rule, toolName, primaryArg) {
+  return ruleMatchesCandidate(rule, toolName, primaryArg, false);
+}
+function isExactPattern(rule) {
+  return rule.pattern !== null && !rule.pattern.includes("*");
+}
+function bashAllowRuleMatches(rule, command, platform, shell, reading) {
+  if (!toolNameMatchesRule(rule.toolName, "Bash")) return false;
+  if (rule.pattern === null) return true;
+  if (typeof command !== "string") return false;
+  const { trimmed, compound } = reading ?? readBashCommand(command, platform, shell);
+  if (isExactPattern(rule)) return trimmed === rule.pattern;
+  if (compound) return false;
+  return ruleMatchesCandidate(rule, "Bash", trimmed, false);
+}
+function readBashCommand(command, platform, shell) {
+  return { trimmed: command.trim(), compound: hasCompoundShellSyntax(command, platform, shell) };
+}
+function bashRestrictiveCandidates(command, firstLine) {
+  if (typeof command !== "string") return [firstLine];
+  const trimmed = command.trim();
+  return [.../* @__PURE__ */ new Set([firstLine, trimmed.split("\n")[0], trimmed])];
+}
+var RULE_WILDCARD = /[*?]/;
+function ruleScopeOf(toolName, primaryArg) {
+  if (!primaryArg) return void 0;
+  if (toolName === "WebFetch") {
+    try {
+      const origin = new URL(primaryArg).origin;
+      return { taken: origin, pattern: `${origin}/**` };
+    } catch {
+    }
+  }
+  return { taken: primaryArg, pattern: primaryArg };
+}
+function permissionRuleForToolCall(call) {
+  const toolName = canonicalToolName(call.name);
+  if (toolName === "Bash" && typeof call.arguments.command === "string") {
+    const command = call.arguments.command.trim();
+    if (!command || LINE_BREAK.test(command)) return void 0;
+    if (!getPrimaryArg(call.arguments).trim()) return void 0;
+    if (command.includes("*")) return void 0;
+    return `Bash(${command})`;
+  }
+  if (toolName === "WebSearch") return toolName;
+  const scope = ruleScopeOf(toolName, getPrimaryArg(call.arguments));
+  if (!scope || RULE_WILDCARD.test(scope.taken)) return void 0;
+  return `${toolName}(${scope.pattern})`;
+}
+function missingRuleReason(call) {
+  if (permissionRuleForToolCall(call) !== void 0) return void 0;
+  const toolName = canonicalToolName(call.name);
+  if (toolName === "Bash" && typeof call.arguments.command === "string") {
+    const command = call.arguments.command.trim();
+    return {
+      // A command that opens with a blank line has an empty first line, the line a rule holds.
+      lineBreak: LINE_BREAK.test(command) || command !== "" && !getPrimaryArg(call.arguments).trim(),
+      wildcard: command.includes("*")
+    };
+  }
+  const scope = ruleScopeOf(toolName, getPrimaryArg(call.arguments));
+  return scope && RULE_WILDCARD.test(scope.taken) ? { lineBreak: false, wildcard: true } : void 0;
+}
+function permissionResultOf(decision) {
+  return typeof decision === "string" ? decision : decision.result;
+}
+function permissionRuleOf(decision) {
+  return typeof decision === "string" ? void 0 : decision.rule;
+}
+function permissionReasonOf(decision) {
+  return typeof decision === "string" ? void 0 : decision.reason;
+}
+var RULE_LADDER_MAX = 3;
+function permissionRuleLadder(call) {
+  const exact = permissionRuleForToolCall(call);
+  if (!exact) return [];
+  if (canonicalToolName(call.name) !== "Bash") return [exact];
+  const raw = call.arguments.command;
+  const command = typeof raw === "string" ? raw.trim() : "";
+  if (!command || SHELL_CHAINING.test(command) || ANY_QUOTE.test(command) || command.includes("?")) {
+    return [exact];
+  }
+  const tokens = command.split(/\s+/);
+  const ladder = [exact];
+  for (let take = tokens.length - 1; take >= 1 && ladder.length < RULE_LADDER_MAX; take -= 1) {
+    const prefix = `Bash(${tokens.slice(0, take).join(" ")} *)`;
+    if (!ladder.includes(prefix)) ladder.push(prefix);
+  }
+  return ladder;
+}
+function permissionRuleMatchesCall(rule, call, platform = process.platform, shell) {
+  const toolName = canonicalToolName(call.name);
+  if (toolName === "Bash") {
+    return bashAllowRuleMatches(parseRule(rule), call.arguments.command, platform, shell);
+  }
+  const primaryArg = getPrimaryArg(call.arguments);
+  if (toolName === "WebFetch" && primaryArg) {
+    try {
+      return ruleMatches(parseRule(rule), toolName, new URL(primaryArg).toString());
+    } catch {
+    }
+  }
+  return ruleMatches(parseRule(rule), toolName, primaryArg);
+}
+function patchOperations(args) {
+  const parsed = parsePatch(args.patch);
+  return "operations" in parsed ? parsed.operations : [];
+}
+function ruleMatchesPatch(rule, paths, fold) {
+  return paths.some((path) => ruleMatchesCandidate(rule, rule.toolName, path, fold));
+}
+function patchRuleSupportsOperation(rule, operation) {
+  if (rule.toolName === "ApplyPatch") return true;
+  if (rule.toolName === "Edit") return operation.kind === "update";
+  if (rule.toolName === "Write") return operation.kind === "update" || operation.kind === "add";
+  return false;
+}
+function compatiblePatchRuleMatches(rule, operations, spellingsOf, fold) {
+  if (!["ApplyPatch", "Edit", "Write"].includes(rule.toolName)) return false;
+  if (rule.toolName === "ApplyPatch" && rule.pattern === null) return true;
+  return operations.some(
+    (operation) => patchRuleSupportsOperation(rule, operation) && (rule.pattern === null || ruleMatchesPatch(rule, spellingsOf(operation.path, fold), fold))
+  );
+}
+function primaryArgForRule(_toolName, args) {
+  return getPrimaryArg(args);
+}
+function hasAdjudicationPolicy(settings) {
+  return settings.permissions.deny.length > 0 || settings.permissions.ask.length > 0;
+}
+function hasBashAdjudicationPolicy(settings) {
+  return hasBashRestriction(parseRuleLists(settings));
+}
+function hasBashRestriction(lists) {
+  return [...lists.deny, ...lists.ask].some(
+    ({ parsed }) => toolNameMatchesRule(parsed.toolName, "Bash")
+  );
+}
+function sandboxAutoAllows(toolName, args, settings, options) {
+  if (!settings.sandbox.autoAllowBashIfSandboxed) return false;
+  if (canonicalToolName(toolName) !== "Bash") return false;
+  if (hasAdjudicationPolicy(settings)) return false;
+  const command = typeof args.command === "string" ? args.command.trim() : "";
+  if (!command) return false;
+  return sandboxCoverage(command, settings.sandbox, options.sandboxBackendAvailable).sandboxed;
+}
+var toPosix = (value) => value.replace(/\\/g, "/");
+function realRootOf(scope) {
+  if (scope.realRoot) return scope.realRoot;
+  try {
+    return realpathSync.native(scope.root);
+  } catch {
+    return void 0;
+  }
+}
+function pathArgument(toolName, args) {
+  const value = toolName === "NotebookEdit" ? args.notebook_path : args.filePath;
+  return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+function rulesName(lists, toolName) {
+  return [...lists.deny, ...lists.ask, ...lists.allow].some(
+    ({ parsed }) => parsed.toolName === toolName
+  );
+}
+function resolvedPathScope(scope) {
+  const detailCache = /* @__PURE__ */ new Map();
+  const rootsFor = (includeReadOnly) => ({
+    workspaceRoot: scope.root,
+    readOnlyRoots: includeReadOnly ? scope.readOnlyRoots : void 0,
+    memorySearchRoot: scope.memorySearchRoot,
+    additionalRoots: scope.additionalRoots
+  });
+  const holdsHomeByRoot = /* @__PURE__ */ new Map();
+  const holdsHome = (root) => {
+    let known = holdsHomeByRoot.get(root);
+    if (known === void 0) {
+      known = rootHoldsHome(root, scope.homeGuards ?? []);
+      holdsHomeByRoot.set(root, known);
+    }
+    return known;
+  };
+  const guardedRoots = [scope.root, ...scope.additionalRoots ?? []].filter(holdsHome);
+  const servingRootOf = (canonicalPath) => [realRootOf(scope), ...scope.additionalRoots ?? []].find(
+    (root) => typeof root === "string" && root.length > 0 && isUnderRoot(canonicalPath, root)
+  );
+  return {
+    scope,
+    roots: rootsFor,
+    detail: (raw, includeReadOnly) => {
+      const key = `${includeReadOnly ? "r" : "w"}\0${raw}`;
+      let known = detailCache.get(key);
+      if (!known) {
+        known = resolveReadablePathDetail(rootsFor(includeReadOnly), raw);
+        detailCache.set(key, known);
+      }
+      return known;
+    },
+    isGuarded: (canonicalPath) => {
+      const roots = [realRootOf(scope), ...scope.additionalRoots ?? []].filter(
+        (root) => typeof root === "string" && root.length > 0
+      );
+      if (roots.some((root) => isBookLocalSettingsPath(canonicalPath, root, { directory: true })))
+        return true;
+      if (guardedRoots.length === 0) return false;
+      if (!pathHoldsHome(canonicalPath, scope.homeGuards ?? [])) return false;
+      const serving = servingRootOf(canonicalPath);
+      return serving !== void 0 && holdsHome(serving);
+    },
+    /**
+     * Whether a Grep or Glob *scope* can reach a guarded home. A scope is a subtree, not a file,
+     * so it is guarded when the guarded home is inside it as well as when it is inside the home:
+     * `Grep {path: "/home"}` reads `~/.ssh` without naming a single file under it (PR #334
+     * finding 4). Compared canonically, both ways, because either side may be reached by a link.
+     */
+    scopeReachesHome: (canonicalScope) => {
+      const homes = scope.homeGuards ?? [];
+      if (homes.some((home) => containsPath(canonicalScope, home))) return true;
+      return guardedRoots.some((root) => containsPath(root, canonicalScope));
+    }
+  };
+}
+function memoryTargetSpellings(target, canonicalRoot, restrictive, relativeOf = relative3) {
+  const spellings = [toPosix(target.filePath), toPosix(target.canonicalPath)];
+  if (restrictive) spellings.push(toPosix(relativeOf(canonicalRoot, target.canonicalPath)));
+  return spellings;
+}
+function spellingsOfPath(paths, raw, includeReadOnly, restrictive) {
+  const spellings = [];
+  const { memoryWrite } = paths.scope;
+  if (memoryWrite && !includeReadOnly) {
+    const memory = resolveMutationPath(
+      {
+        workspaceRoot: paths.scope.root,
+        additionalRoots: paths.scope.additionalRoots,
+        memoryWrite
+      },
+      raw
+    );
+    if (memory?.memory) {
+      spellings.push(
+        ...memoryTargetSpellings(memory, canonicalizePath(resolve3(memoryWrite.root)), restrictive)
+      );
+    }
+  }
+  const detail = paths.detail(raw, includeReadOnly);
+  if (!("path" in detail)) {
+    if (restrictive) spellings.push(toPosix(raw), toPosix(resolve3(paths.scope.root, raw)));
+    return [...new Set(spellings)].filter((s) => s !== "" && s !== raw);
+  }
+  const resolved = detail.path;
+  const inWorkspace = resolveWorkspacePath(paths.scope.root, raw) !== null;
+  if (inWorkspace) {
+    spellings.push(
+      resolved.relativePath,
+      toPosix(resolved.filePath),
+      toPosix(resolved.canonicalPath)
+    );
+    const realRoot = realRootOf(paths.scope);
+    if (realRoot) spellings.push(toPosix(relative3(realRoot, resolved.canonicalPath)));
+  } else {
+    spellings.push(toPosix(resolved.filePath), toPosix(resolved.canonicalPath));
+    if (restrictive) {
+      for (const root of paths.scope.additionalRoots ?? []) {
+        const fromRoot = relative3(canonicalizePath(root), resolved.canonicalPath);
+        if (!fromRoot || isAbsolute(fromRoot) || fromRoot === ".." || fromRoot.startsWith(`..${sep2}`)) {
+          continue;
+        }
+        spellings.push(toPosix(fromRoot));
+      }
+    }
+  }
+  return [...new Set(spellings)].filter((spelling) => spelling !== "" && spelling !== raw);
+}
+function pathRuleSpellings(paths, toolName, args, restrictive) {
+  const raw = pathArgument(toolName, args);
+  return raw ? spellingsOfPath(paths, raw, toolName === "Read", restrictive) : [];
+}
+function globTarget(pattern, paths) {
+  const { refusal, scopes } = globWalkPlan(pattern, paths.scope.root);
+  if (refusal) return { target: "invalid", reason: refusal };
+  if (scopes === null) return "outside";
+  let guarded = false;
+  for (const scope of scopes) {
+    const detail = paths.detail(scope, false);
+    if (!("path" in detail)) return "outside";
+    if (paths.scopeReachesHome(detail.path.canonicalPath)) guarded = true;
+  }
+  return guarded ? "guarded" : "servable";
+}
+function readToolTarget(toolName, args, paths) {
+  if (toolName === "Read") {
+    const raw2 = pathArgument(toolName, args);
+    if (!raw2) return "none";
+    const detail2 = paths.detail(raw2, true);
+    if (!("path" in detail2)) return "outside";
+    return paths.isGuarded(detail2.path.canonicalPath) ? "guarded" : "servable";
+  }
+  if (toolName === "Glob") {
+    const pattern = typeof args.pattern === "string" ? args.pattern.trim() : "";
+    if (!pattern) return "none";
+    return globTarget(pattern, paths);
+  }
+  const raw = typeof args.path === "string" ? args.path.trim() : "";
+  if (raw === "" || raw === ".") return "servable";
+  const detail = paths.detail(raw, false);
+  if (!("path" in detail)) return "outside";
+  if (paths.isGuarded(detail.path.canonicalPath)) return "guarded";
+  return paths.scopeReachesHome(detail.path.canonicalPath) ? "guarded" : "servable";
+}
+function parseRuleLists(settings) {
+  const list = (texts) => texts.map((text) => ({ text, parsed: parseRule(text) }));
+  return {
+    deny: list(settings.permissions.deny),
+    ask: list(settings.permissions.ask),
+    allow: list(settings.permissions.allow)
+  };
+}
+function hasReadAdjudication(lists) {
+  return [...lists.deny, ...lists.ask].some(
+    ({ parsed }) => WORKSPACE_READ_TOOLS.has(parsed.toolName)
+  );
+}
+var MEMORY_WRITE_TOOLS = /* @__PURE__ */ new Set([
+  "Write",
+  "Edit",
+  "MultiEdit",
+  "ApplyPatch"
+]);
+function writesOnlyMemory(tool, args, scope) {
+  if (!scope?.memoryWrite || !MEMORY_WRITE_TOOLS.has(tool)) return false;
+  const roots = {
+    workspaceRoot: scope.root,
+    additionalRoots: scope.additionalRoots,
+    memoryWrite: scope.memoryWrite
+  };
+  const targets = tool === "ApplyPatch" ? patchOperations(args).map((operation) => operation.path) : [pathArgument(tool, args)];
+  return targets.length > 0 && targets.every(
+    (target) => target !== void 0 && resolveMutationPath(roots, target)?.memory === true
+  );
+}
+function removesOnlyMemory(tool, args, scope) {
+  if (tool !== "Bash" || scope?.memoryWrite?.scope !== "full") return false;
+  if (typeof args.command !== "string" || args.run_in_background === true) return false;
+  return strictRmOfMarkdownUnder(args.command, scope.memoryWrite.root) !== null;
+}
+function evaluatePermission(toolName, args, settings, options = {}) {
+  return evaluatePermissionDetail(toolName, args, settings, options).decision;
+}
+function evaluatePermissionDetail(toolName, args, settings, options = {}) {
+  const scope = options.workspace;
+  const paths = scope ? resolvedPathScope(scope) : void 0;
+  const parsed = parseRuleLists(settings);
+  if (toolName === "ApplyPatch") {
+    const operations = patchOperations(args);
+    const spellings = /* @__PURE__ */ new Map();
+    const restrictiveSpellings = /* @__PURE__ */ new Map();
+    const spellingsOf = (path, restrictive) => {
+      const cache = restrictive ? restrictiveSpellings : spellings;
+      let known = cache.get(path);
+      if (!known) {
+        known = paths ? [path, ...spellingsOfPath(paths, path, false, restrictive)] : [path];
+        cache.set(path, known);
+      }
+      return known;
+    };
+    const isCompatible = (rule) => rule.toolName === "ApplyPatch" || rule.toolName === "Edit" || rule.toolName === "Write";
+    for (const list of ["deny", "ask"]) {
+      for (const entry of parsed[list]) {
+        if (!isCompatible(entry.parsed)) continue;
+        if (compatiblePatchRuleMatches(entry.parsed, operations, spellingsOf, true)) {
+          return { decision: list, matchedRule: entry.text, source: list };
+        }
+      }
+    }
+    const allowRules = parsed.allow.filter(({ parsed: rule }) => isCompatible(rule));
+    const firstCompatible = allowRules[0]?.text;
+    if (operations.length > 0 && operations.every(
+      (operation) => allowRules.some(
+        ({ parsed: rule }) => patchRuleSupportsOperation(rule, operation) && (rule.pattern === null || ruleMatchesPatch(rule, spellingsOf(operation.path, false), false))
+      )
+    )) {
+      return { decision: "allow", matchedRule: firstCompatible, source: "allow" };
+    }
+    if (allowRules.some(({ parsed: rule }) => rule.toolName === "ApplyPatch" && rule.pattern === null)) {
+      return { decision: "allow", matchedRule: firstCompatible, source: "allow" };
+    }
+    if (writesOnlyMemory("ApplyPatch", args, scope)) return { decision: "allow", source: "memory" };
+    return { decision: "ask", source: "default" };
+  }
+  const tool = canonicalToolName(toolName);
+  const candidates = [getPrimaryArg(args)];
+  let restrictiveCandidates = tool === "Bash" ? bashRestrictiveCandidates(args.command, candidates[0]) : candidates;
+  if (scope && paths && PATH_RULE_TOOLS.has(tool) && rulesName(parsed, tool)) {
+    restrictiveCandidates = [...candidates, ...pathRuleSpellings(paths, tool, args, true)];
+    candidates.push(...pathRuleSpellings(paths, tool, args, false));
+  }
+  const matchesRule = (rule, fold) => {
+    const pool = fold ? restrictiveCandidates : candidates;
+    if (tool === "WebFetch") {
+      try {
+        const url = new URL(candidates[0]).toString();
+        return ruleMatchesCandidate(rule, tool, url, false);
+      } catch {
+      }
+    }
+    return pool.some((candidate) => ruleMatchesCandidate(rule, tool, candidate, fold));
+  };
+  const readTarget = scope && paths && (scope.judgeReads || scope.refuseUnreachableReads) && WORKSPACE_READ_TOOLS.has(tool) ? readToolTarget(tool, args, paths) : void 0;
+  const unreadablePattern = readTarget !== void 0 && isUnreadablePattern(readTarget) ? readTarget.reason : void 0;
+  const outside = readTarget === "outside" ? { outsideWorkspace: true } : {};
+  const platform = options.platform ?? process.platform;
+  const bashReading = tool === "Bash" && typeof args.command === "string" ? readBashCommand(args.command, platform, options.shell) : void 0;
+  const compoundUnderPolicy = bashReading?.compound === true && hasBashRestriction(parsed) ? { compoundUnderPolicy: true } : {};
+  for (const entry of parsed.deny) {
+    if (matchesRule(entry.parsed, true)) {
+      return { decision: "deny", matchedRule: entry.text, source: "deny" };
+    }
+  }
+  for (const entry of parsed.ask) {
+    if (matchesRule(entry.parsed, true)) {
+      const askOutside = readTarget === void 0 && scope && paths && WORKSPACE_READ_TOOLS.has(tool) && readToolTarget(tool, args, paths) === "outside" ? { outsideWorkspace: true } : outside;
+      return {
+        decision: "ask",
+        matchedRule: entry.text,
+        source: "ask",
+        ...askOutside,
+        ...compoundUnderPolicy
+      };
+    }
+  }
+  if (tool === "Bash") {
+    for (const entry of parsed.allow) {
+      if (isExactPattern(entry.parsed) && bashAllowRuleMatches(entry.parsed, args.command, platform, options.shell, bashReading)) {
+        return { decision: "allow", matchedRule: entry.text, source: "allow" };
+      }
+    }
+    if (compoundUnderPolicy.compoundUnderPolicy) {
+      return { decision: "ask", source: "default", ...compoundUnderPolicy };
+    }
+  }
+  for (const entry of parsed.allow) {
+    const matched = tool === "Bash" ? bashAllowRuleMatches(entry.parsed, args.command, platform, options.shell, bashReading) : matchesRule(entry.parsed, false);
+    if (matched) {
+      return { decision: "allow", matchedRule: entry.text, source: "allow" };
+    }
+  }
+  if (writesOnlyMemory(tool, args, scope) || removesOnlyMemory(tool, args, scope)) {
+    return { decision: "allow", source: "memory" };
+  }
+  if (sandboxAutoAllows(toolName, args, settings, options)) {
+    return { decision: "allow", source: "sandbox" };
+  }
+  if (scope?.autoAllowReads && (readTarget === "none" || readTarget === "servable" && (tool === "Read" || !hasReadAdjudication(parsed)))) {
+    return { decision: "allow", source: "workspace" };
+  }
+  if (scope?.autoAllowReads && WORKSPACE_READ_ONLY_GIT_TOOLS.has(tool)) {
+    return { decision: "allow", source: "workspace" };
+  }
+  if (ALWAYS_ALLOWED_TOOLS.has(tool)) {
+    return { decision: "allow", source: "default" };
+  }
+  if (unreadablePattern !== void 0) {
+    return { decision: "refuse", source: "default", unreadablePattern };
+  }
+  if (readTarget === "outside") {
+    return { decision: "refuse", source: "default", outsideWorkspace: true };
+  }
+  return { decision: "ask", source: "default" };
+}
+var ALWAYS_ALLOWED_TOOLS = /* @__PURE__ */ new Set(["TodoWrite", "Advisor"]);
+
+export {
+  EFFORT_LEVELS,
+  EFFORT_USAGE,
+  parseEffortLevel,
+  isEffortLevel,
+  getAvailableEffortLevels,
+  getEffortUnavailableError,
+  updateEffortLevel,
+  readLegacyBaseUrl,
+  loadConfig,
+  isEffortChosen,
+  applyModelDefaults,
+  freezeAgentConfig,
+  describeUnresolvedProviderPrefix,
+  resolveModelProviderConfig,
+  clampEffortToCatalog,
+  resolveEffortExplicit,
+  compactsOnSessionModel,
+  resolveCompactModelConfig,
+  configuredAdvisorModel,
+  advisorModelRefusal,
+  resolveAdvisorModelConfig,
+  resolveReducerModelConfig,
+  resolveSecret,
+  throwIfAborted,
+  onAbort,
+  delay,
+  yieldToEventLoop,
+  renderDiffWithStatsAsync,
+  workspaceIdentity,
+  normalizeObservedPath,
+  observationKey,
+  observationPathFor,
+  supersedesObservation,
+  seedObservationLedger,
+  observeFile,
+  requireFreshObservation,
+  requireObservationForMutation,
+  containsSecretPattern,
+  checkMemoryWrite,
+  noticeMemoryWrite,
+  withMemoryWarnings,
+  collectProviderSecrets,
+  redactSecrets,
+  secretSafeCut,
+  secretSafeStart,
+  redactToolResultSecrets,
+  redactedSecretOverwrite,
+  redactedSecretAddition,
+  redactedSecretDeletion,
+  redactedSecretCommand,
+  readTextSnapshot,
+  restoreTextEncoding,
+  writeFileAtomically,
+  withMutationLocks,
+  parsePatch,
+  applyHunks,
+  patchTools,
+  hasCompoundShellSyntax,
+  strictRmMatchesGlob,
+  WORKSPACE_READ_TOOLS,
+  WORKSPACE_READ_JUDGING_MODES,
+  WORKSPACE_READ_REFUSAL_MODES,
+  WORKSPACE_READ_ONLY_GIT_TOOLS,
+  parseRule,
+  permissionRuleForToolCall,
+  missingRuleReason,
+  permissionResultOf,
+  permissionRuleOf,
+  permissionReasonOf,
+  permissionRuleLadder,
+  permissionRuleMatchesCall,
+  primaryArgForRule,
+  hasAdjudicationPolicy,
+  hasBashAdjudicationPolicy,
+  memoryTargetSpellings,
+  evaluatePermission,
+  evaluatePermissionDetail,
+  ALWAYS_ALLOWED_TOOLS
+};
+//# sourceMappingURL=chunk-N2G4Q7ME.js.map