@letrquan/book 0.3.0 → 0.4.0-beta.0

package/dist/chunk-J62VZYOB.js

@@ -1,1339 +0,0 @@
-import {
-  globToRegex,
-  globWalkPlan,
-  sandboxCoverage
-} from "./chunk-JTPOI3KU.js";
-import {
-  containsPath,
-  pathHoldsHome,
-  rootHoldsHome
-} from "./chunk-525CAZPY.js";
-import {
-  canonicalizePath,
-  isBookLocalSettingsPath,
-  isUnderRoot,
-  pathOutsideWorkspaceResult,
-  resolveMutationPath,
-  resolveReadablePathDetail,
-  resolveWorkspacePath
-} from "./chunk-X66I2NQO.js";
-import {
-  canonicalToolName,
-  getPrimaryArg,
-  toolFailure,
-  toolSuccess
-} from "./chunk-224FJZLH.js";
-
-// src/permissions.ts
-import { realpathSync } from "fs";
-import { isAbsolute, relative as relative2, sep } from "path";
-
-// src/async.ts
-function throwIfAborted(signal) {
-  if (!signal?.aborted) return;
-  if (signal.reason instanceof Error) throw signal.reason;
-  throw new Error(typeof signal.reason === "string" ? signal.reason : "Operation cancelled");
-}
-function onAbort(signal, handler) {
-  if (!signal) return () => {
-  };
-  if (signal.aborted) {
-    handler();
-    return () => {
-    };
-  }
-  signal.addEventListener("abort", handler, { once: true });
-  return () => signal.removeEventListener("abort", handler);
-}
-async function delay(ms, signal) {
-  if (ms <= 0 || signal?.aborted) return;
-  await new Promise((resolve2) => {
-    const timer = setTimeout(() => {
-      unsubscribe();
-      resolve2();
-    }, ms);
-    const unsubscribe = onAbort(signal, () => {
-      clearTimeout(timer);
-      resolve2();
-    });
-  });
-}
-async function yieldToEventLoop(signal) {
-  throwIfAborted(signal);
-  await new Promise((resolve2) => setImmediate(resolve2));
-  throwIfAborted(signal);
-}
-
-// src/tools/diff.ts
-function splitLines(s) {
-  const lines = s.split("\n");
-  if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
-  return lines;
-}
-var DIFF_YIELD_CELLS = 32768;
-var DIFF_YIELD_ITEMS = 1024;
-function commonAffixes(a, b) {
-  const max = Math.min(a.length, b.length);
-  let prefix = 0;
-  while (prefix < max && a[prefix] === b[prefix]) prefix++;
-  let suffix = 0;
-  while (suffix < max - prefix && a[a.length - 1 - suffix] === b[b.length - 1 - suffix]) suffix++;
-  return { prefix, suffix };
-}
-function contextOps(a, from, count, bOffset) {
-  const ops = [];
-  for (let index = 0; index < count; index++) {
-    const ai = from + index;
-    ops.push({ kind: "ctx", text: a[ai], ai, bi: ai + bOffset });
-  }
-  return ops;
-}
-function editScript(a, b, dp, offset) {
-  const n = a.length;
-  const m = b.length;
-  const ops = [];
-  let i = 0;
-  let j = 0;
-  while (i < n && j < m) {
-    if (a[i] === b[j]) {
-      ops.push({ kind: "ctx", text: a[i], ai: offset + i, bi: offset + j });
-      i++;
-      j++;
-    } else if (dp[i + 1][j] >= dp[i][j + 1]) {
-      ops.push({ kind: "del", text: a[i], ai: offset + i, bi: offset + j });
-      i++;
-    } else {
-      ops.push({ kind: "add", text: b[j], ai: offset + i, bi: offset + j });
-      j++;
-    }
-  }
-  while (i < n) {
-    ops.push({ kind: "del", text: a[i], ai: offset + i, bi: offset + j });
-    i++;
-  }
-  while (j < m) {
-    ops.push({ kind: "add", text: b[j], ai: offset + i, bi: offset + j });
-    j++;
-  }
-  return ops;
-}
-function hunkBounds(ops, context) {
-  const bounds = [];
-  let k = 0;
-  while (k < ops.length) {
-    if (ops[k].kind === "ctx") {
-      k++;
-      continue;
-    }
-    const start = k;
-    let ctxBefore = 0;
-    let s = start - 1;
-    while (s >= 0 && ops[s].kind === "ctx" && ctxBefore < context) {
-      s--;
-      ctxBefore++;
-    }
-    let e = start;
-    while (e < ops.length && ops[e].kind !== "ctx") e++;
-    let ctxAfter = 0;
-    while (e < ops.length && ops[e].kind === "ctx" && ctxAfter < context) {
-      e++;
-      ctxAfter++;
-    }
-    const previous = bounds.at(-1);
-    if (previous && s + 1 <= previous[1]) previous[1] = e;
-    else bounds.push([s + 1, e]);
-    k = e;
-  }
-  return bounds;
-}
-function hunkFrom(ops, start, end) {
-  const hunkOps = ops.slice(start, end);
-  return {
-    oldStart: (hunkOps[0]?.ai ?? 0) + 1,
-    newStart: (hunkOps[0]?.bi ?? 0) + 1,
-    lines: hunkOps.map((o) => ({ kind: o.kind, text: o.text }))
-  };
-}
-async function lineDiffAsync(oldText, newText, context = 3, signal) {
-  const a = splitLines(oldText);
-  const b = splitLines(newText);
-  const { prefix, suffix } = commonAffixes(a, b);
-  const midA = a.slice(prefix, a.length - suffix);
-  const midB = b.slice(prefix, b.length - suffix);
-  const n = midA.length;
-  const m = midB.length;
-  const dp = [];
-  for (let row = 0; row <= n; row++) {
-    dp.push(new Array(m + 1).fill(0));
-    if (row > 0 && row % 128 === 0) await yieldToEventLoop(signal);
-  }
-  let cellsUntilYield = DIFF_YIELD_CELLS;
-  for (let i = n - 1; i >= 0; i--) {
-    for (let j = m - 1; j >= 0; j--) {
-      dp[i][j] = midA[i] === midB[j] ? dp[i + 1][j + 1] + 1 : Math.max(dp[i + 1][j], dp[i][j + 1]);
-      cellsUntilYield--;
-      if (cellsUntilYield === 0) {
-        cellsUntilYield = DIFF_YIELD_CELLS;
-        await yieldToEventLoop(signal);
-      }
-    }
-  }
-  throwIfAborted(signal);
-  const ops = [
-    ...contextOps(a, 0, prefix, 0),
-    ...editScript(midA, midB, dp, prefix),
-    ...contextOps(a, a.length - suffix, suffix, b.length - a.length)
-  ];
-  if (ops.length > DIFF_YIELD_ITEMS) await yieldToEventLoop(signal);
-  const hunks = [];
-  for (const [start, end] of hunkBounds(ops, context)) {
-    hunks.push(hunkFrom(ops, start, end));
-    await yieldToEventLoop(signal);
-  }
-  throwIfAborted(signal);
-  return hunks;
-}
-function diffStatsFromHunks(hunks) {
-  let addedLines = 0;
-  let removedLines = 0;
-  for (const hunk of hunks) {
-    for (const line of hunk.lines) {
-      if (line.kind === "add") addedLines++;
-      if (line.kind === "del") removedLines++;
-    }
-  }
-  return { addedLines, removedLines };
-}
-async function renderDiffWithStatsAsync(oldText, newText, context = 3, signal) {
-  const hunks = await lineDiffAsync(oldText, newText, context, signal);
-  if (hunks.length === 0) return { diff: "", stats: { addedLines: 0, removedLines: 0 } };
-  const out = [];
-  for (let hunkIndex = 0; hunkIndex < hunks.length; hunkIndex++) {
-    const hunk = hunks[hunkIndex];
-    out.push(`@@ -${hunk.oldStart} +${hunk.newStart} @@`);
-    for (let lineIndex = 0; lineIndex < hunk.lines.length; lineIndex++) {
-      const line = hunk.lines[lineIndex];
-      const prefix = line.kind === "add" ? "+" : line.kind === "del" ? "-" : " ";
-      out.push(prefix + line.text);
-      if (lineIndex > 0 && lineIndex % DIFF_YIELD_ITEMS === 0) await yieldToEventLoop(signal);
-    }
-    if (hunkIndex > 0 && hunkIndex % 64 === 0) await yieldToEventLoop(signal);
-  }
-  return { diff: out.join("\n"), stats: diffStatsFromHunks(hunks) };
-}
-
-// src/tools/file-provenance.ts
-import { createHash } from "crypto";
-import { readFile, stat } from "fs/promises";
-import { normalize, relative, resolve } from "path";
-function workspaceIdentity(workspaceRoot) {
-  const root = normalize(resolve(workspaceRoot));
-  const stable = process.platform === "win32" ? root.toLowerCase() : root;
-  return createHash("sha256").update(stable).digest("hex").slice(0, 24);
-}
-function normalizeObservedPath(path) {
-  const normalized = path.replace(/\\/g, "/");
-  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
-}
-function observationKey(workspaceId, path) {
-  return `${workspaceId}:${normalizeObservedPath(path)}`;
-}
-function observationPathFor(workspaceRoot, absolutePath) {
-  const root = canonicalizePath(resolve(workspaceRoot));
-  return relative(root, canonicalizePath(absolutePath)).replace(/\\/g, "/");
-}
-function isOutline(observation) {
-  return observation.operation === "outline";
-}
-function mayReplaceObservation(current, next) {
-  return !current || !isOutline(next) || isOutline(current);
-}
-function supersedesObservation(current, next) {
-  if (!current) return true;
-  if (isOutline(current) !== isOutline(next)) return isOutline(current);
-  return current.timestamp <= next.timestamp;
-}
-function seedObservationLedger(ledger, messages) {
-  for (const message of messages) {
-    for (const observation of message.fileObservations ?? []) {
-      const key = observationKey(observation.workspaceId, observation.path);
-      if (supersedesObservation(ledger.get(key), observation)) ledger.set(key, observation);
-    }
-  }
-  return ledger;
-}
-async function observeFile(ctx, absolutePath, operation, coverage) {
-  const bytes = await readFile(absolutePath);
-  const workspaceId = workspaceIdentity(ctx.workspaceRoot);
-  const path = observationPathFor(ctx.workspaceRoot, absolutePath);
-  const observation = {
-    path,
-    workspaceId,
-    sha256: createHash("sha256").update(bytes).digest("hex"),
-    byteSize: bytes.byteLength,
-    lineStart: coverage?.lineStart,
-    lineEnd: coverage?.lineEnd,
-    operation,
-    sourceRef: ctx.currentToolTraceId ?? "runtime-tool",
-    timestamp: Date.now()
-  };
-  const key = observationKey(workspaceId, path);
-  const ledger = ctx.fileObservationLedger;
-  if (ledger && mayReplaceObservation(ledger.get(key), observation)) ledger.set(key, observation);
-  return observation;
-}
-async function requireFreshObservation(ctx, absolutePath, relativePath) {
-  const workspaceId = workspaceIdentity(ctx.workspaceRoot);
-  const normalizedPath = relativePath.replace(/\\/g, "/");
-  const remembered = ctx.fileObservationLedger?.get(
-    observationKey(workspaceId, observationPathFor(ctx.workspaceRoot, absolutePath))
-  );
-  if (!remembered || isOutline(remembered)) return void 0;
-  try {
-    const info = await stat(absolutePath);
-    if (!info.isFile()) return staleMessage(normalizedPath);
-    const bytes = await readFile(absolutePath);
-    const currentHash = createHash("sha256").update(bytes).digest("hex");
-    return currentHash === remembered.sha256 ? void 0 : staleMessage(normalizedPath);
-  } catch {
-    return staleMessage(normalizedPath);
-  }
-}
-function staleMessage(path) {
-  return `SKIPPED: ${path} changed or disappeared since it was last shown to the model. Call Read (or mention the file again) before modifying it.`;
-}
-function requireObservationForMutation(ctx, absolutePath, relativePath, retryVerb) {
-  const ledger = ctx.fileObservationLedger;
-  if (!ledger) return void 0;
-  const workspaceId = workspaceIdentity(ctx.workspaceRoot);
-  const normalizedPath = relativePath.replace(/\\/g, "/");
-  const remembered = ledger.get(
-    observationKey(workspaceId, observationPathFor(ctx.workspaceRoot, absolutePath))
-  );
-  if (remembered && !isOutline(remembered)) return void 0;
-  const seen = remembered ? "has only been outlined in this session, and an outline is not the file's content" : "has not been read in this session";
-  return toolFailure(
-    `SKIPPED: ${normalizedPath} ${seen}. Call Read (or mention the file) before modifying it.`,
-    {
-      code: "file_not_observed",
-      remediation: `Read the file first, then retry the ${retryVerb}.`
-    }
-  );
-}
-
-// src/tools/mutation.ts
-import { randomUUID } from "crypto";
-import { mkdir, readFile as readFile2, rename, rm, stat as stat2, writeFile } from "fs/promises";
-import { dirname } from "path";
-var pathLocks = /* @__PURE__ */ new Map();
-function looksBinary(bytes) {
-  const sample = bytes.subarray(0, 8192);
-  if (sample.includes(0)) return true;
-  let controls = 0;
-  for (const byte of sample) {
-    if (byte < 7 || byte > 13 && byte < 32) controls++;
-  }
-  return sample.length > 0 && controls / sample.length > 0.1;
-}
-async function readTextSnapshot(filePath, allowMissing = false) {
-  let bytes;
-  try {
-    bytes = await readFile2(filePath);
-  } catch (error) {
-    if (allowMissing && error.code === "ENOENT") {
-      return {
-        exists: false,
-        bytes: Buffer.alloc(0),
-        text: "",
-        bom: false,
-        lineEnding: "lf",
-        mixedLineEndings: false,
-        binary: false,
-        mode: void 0
-      };
-    }
-    throw error;
-  }
-  const bom = bytes.length >= 3 && bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191;
-  const body = bytes.subarray(bom ? 3 : 0);
-  let binary = looksBinary(bytes);
-  let decoded;
-  try {
-    decoded = new TextDecoder("utf-8", { fatal: true }).decode(body);
-  } catch {
-    binary = true;
-    decoded = body.toString("utf8");
-  }
-  const crlfCount = (decoded.match(/\r\n/g) ?? []).length;
-  const bareLfCount = (decoded.replace(/\r\n/g, "").match(/\n/g) ?? []).length;
-  const bareCrCount = (decoded.replace(/\r\n/g, "").match(/\r/g) ?? []).length;
-  const mixedLineEndings = crlfCount > 0 && bareLfCount > 0 || bareCrCount > 0;
-  const mode = (await stat2(filePath)).mode & 511;
-  return {
-    exists: true,
-    bytes,
-    text: decoded.replace(/\r\n/g, "\n"),
-    bom,
-    lineEnding: crlfCount > bareLfCount ? "crlf" : "lf",
-    mixedLineEndings,
-    binary,
-    mode
-  };
-}
-function restoreTextEncoding(text, snapshot) {
-  const body = snapshot.lineEnding === "crlf" ? text.replace(/\n/g, "\r\n") : text;
-  return Buffer.from(`${snapshot.bom ? "\uFEFF" : ""}${body}`, "utf8");
-}
-async function writeFileAtomically(filePath, bytes, signal, mode) {
-  throwIfAborted(signal);
-  await mkdir(dirname(filePath), { recursive: true });
-  const temporary = `${filePath}.book-tmp-${randomUUID()}`;
-  try {
-    await writeFile(temporary, bytes, { flag: "wx", mode });
-    throwIfAborted(signal);
-    await rename(temporary, filePath);
-  } finally {
-    await rm(temporary, { force: true }).catch(() => void 0);
-  }
-}
-async function removeFileAtomically(filePath, signal) {
-  throwIfAborted(signal);
-  await rm(filePath, { force: false });
-}
-async function acquirePath(path) {
-  const previous = pathLocks.get(path) ?? Promise.resolve();
-  let release;
-  const current = new Promise((resolve2) => {
-    release = resolve2;
-  });
-  const queued = previous.then(() => current);
-  pathLocks.set(path, queued);
-  await previous;
-  return () => {
-    release();
-    if (pathLocks.get(path) === queued) pathLocks.delete(path);
-  };
-}
-async function withMutationLocks(paths, operation) {
-  const releases = [];
-  try {
-    for (const path of [...new Set(paths)].sort()) releases.push(await acquirePath(path));
-    return await operation();
-  } finally {
-    for (const release of releases.reverse()) release();
-  }
-}
-
-// src/tools/patch.ts
-var MAX_PATCH_BYTES = 1024 * 1024;
-var MAX_FILES = 100;
-var MAX_HUNKS = 1e3;
-function invalid(message, details) {
-  return toolFailure(message, {
-    code: "invalid_patch_syntax",
-    remediation: "Regenerate a Codex-style patch with Begin/End markers and valid file hunks.",
-    details
-  });
-}
-function parseHunkHeader(line) {
-  const match = line.match(/^@@(?: -(\d+)(?:,(\d+))?)?(?: \+(\d+)(?:,(\d+))?)?(?: @@.*)?$/);
-  if (!match) throw new Error(`Invalid hunk header: ${line}`);
-  return { oldStart: match[1] ? Number(match[1]) : void 0 };
-}
-function parsePatchUnsafe(patch) {
-  if (typeof patch !== "string" || patch.length === 0)
-    return invalid("patch must be a non-empty string");
-  const bytes = Buffer.byteLength(patch, "utf8");
-  if (bytes > MAX_PATCH_BYTES)
-    return toolFailure(`Patch input exceeds ${MAX_PATCH_BYTES} bytes`, {
-      code: "patch_limit_exceeded",
-      remediation: "Split the change into smaller patches.",
-      details: { limit: MAX_PATCH_BYTES, bytes }
-    });
-  const lines = patch.replace(/\r\n/g, "\n").split("\n");
-  if (lines.at(-1) === "") lines.pop();
-  if (lines[0] !== "*** Begin Patch" || lines.at(-1) !== "*** End Patch")
-    return invalid("Patch must start with *** Begin Patch and end with *** End Patch");
-  while (lines.length > 2 && lines[1] === "*** Begin Patch") lines.splice(1, 1);
-  while (lines.length > 2 && lines.at(-2) === "*** End Patch") lines.splice(-2, 1);
-  const operations = [];
-  let index = 1;
-  let hunkCount = 0;
-  while (index < lines.length - 1) {
-    const marker = lines[index];
-    const update = marker.match(/^\*\*\* Update File: (.+)$/);
-    const add = marker.match(/^\*\*\* Add File: (.+)$/);
-    const del = marker.match(/^\*\*\* Delete File: (.+)$/);
-    if (update) {
-      const hunks = [];
-      index++;
-      while (index < lines.length - 1 && !lines[index].startsWith("*** ")) {
-        if (!lines[index].startsWith("@@"))
-          throw new Error(`Expected @@ hunk header near line ${index + 1}`);
-        const header = lines[index];
-        const parsedHeader = parseHunkHeader(header);
-        index++;
-        const hunkLines = [];
-        while (index < lines.length - 1 && !lines[index].startsWith("@@") && !lines[index].startsWith("*** ")) {
-          const line = lines[index++];
-          if (line === "\") {
-            const previous = hunkLines.at(-1);
-            if (!previous)
-              throw new Error(`No-newline marker has no preceding hunk line near line ${index}`);
-            previous.noNewline = true;
-            continue;
-          }
-          if (line.startsWith(" ")) hunkLines.push({ kind: "context", text: line.slice(1) });
-          else if (line.startsWith("-")) hunkLines.push({ kind: "remove", text: line.slice(1) });
-          else if (line.startsWith("+")) hunkLines.push({ kind: "add", text: line.slice(1) });
-          else throw new Error(`Invalid hunk line near line ${index}`);
-        }
-        if (hunkLines.length === 0) throw new Error(`Empty hunk near line ${index}`);
-        if (!hunkLines.some((line) => line.kind !== "add"))
-          throw new Error(`Update hunk must contain context or removed lines near line ${index}`);
-        hunks.push({ header, oldStart: parsedHeader.oldStart, lines: hunkLines });
-        hunkCount++;
-      }
-      if (hunks.length === 0) throw new Error(`Update File ${update[1]} has no hunks`);
-      operations.push({ kind: "update", path: update[1].trim(), hunks });
-      continue;
-    }
-    if (add) {
-      index++;
-      const content = [];
-      while (index < lines.length - 1 && !lines[index].startsWith("*** ")) {
-        const line = lines[index++];
-        if (!line.startsWith("+"))
-          throw new Error(`Added file lines must begin with + near line ${index}`);
-        content.push(line.slice(1));
-      }
-      operations.push({ kind: "add", path: add[1].trim(), lines: content });
-      continue;
-    }
-    if (del) {
-      index++;
-      if (index < lines.length - 1 && !lines[index].startsWith("*** "))
-        throw new Error(`Delete File ${del[1]} cannot contain patch lines`);
-      operations.push({ kind: "delete", path: del[1].trim() });
-      continue;
-    }
-    throw new Error(`Expected a file operation near line ${index + 1}`);
-  }
-  if (operations.length === 0) return invalid("Patch contains no file operations");
-  if (operations.length > MAX_FILES || hunkCount > MAX_HUNKS)
-    return toolFailure(`Patch exceeds limits (${MAX_FILES} files, ${MAX_HUNKS} hunks)`, {
-      code: "patch_limit_exceeded",
-      remediation: "Split the change into smaller patches.",
-      details: { files: operations.length, hunks: hunkCount }
-    });
-  return { operations, bytes };
-}
-function parsePatch(patch) {
-  try {
-    return parsePatchUnsafe(patch);
-  } catch (error) {
-    return invalid(error instanceof Error ? error.message : String(error));
-  }
-}
-function linesOf(text) {
-  const lines = text.split("\n");
-  if (lines.at(-1) === "") lines.pop();
-  return lines;
-}
-function sequenceMatches(haystack, needle) {
-  if (needle.length === 0) return [];
-  const matches = [];
-  for (let start = 0; start <= haystack.length - needle.length; start++) {
-    if (needle.every((line, offset) => haystack[start + offset] === line)) matches.push(start);
-  }
-  return matches;
-}
-function candidateLine(haystack, line) {
-  const matches = haystack.reduce((found, value, index) => {
-    if (value === line) found.push(index + 1);
-    return found;
-  }, []);
-  return matches.length === 1 ? matches[0] : void 0;
-}
-function applyHunks(text, hunks) {
-  let lines = linesOf(text);
-  let trailingNewline = text.endsWith("\n");
-  let cursor = 0;
-  for (let hunkIndex = 0; hunkIndex < hunks.length; hunkIndex++) {
-    const hunk = hunks[hunkIndex];
-    const oldLines = hunk.lines.filter((line) => line.kind !== "add").map((line) => line.text);
-    const newLines = hunk.lines.filter((line) => line.kind !== "remove").map((line) => line.text);
-    const matches = sequenceMatches(lines, oldLines);
-    const afterPrevious = matches.filter((start) => start >= cursor);
-    const index = matches.length === 1 ? matches[0] : afterPrevious.length === 1 ? afterPrevious[0] : -1;
-    if (matches.length === 0)
-      return {
-        text,
-        mismatch: toolFailure(`Hunk ${hunkIndex + 1}: patch context not found`, {
-          code: "patch_context_not_found",
-          remediation: "Reread the affected range and regenerate the hunk against the latest file contents.",
-          details: {
-            hunkIndex: hunkIndex + 1,
-            header: hunk.header,
-            firstContextLine: oldLines[0]?.slice(0, 200),
-            closestCandidateLine: oldLines[0] ? candidateLine(lines, oldLines[0]) : void 0,
-            suggestedReadRange: hunk.oldStart !== void 0 ? {
-              lineStart: Math.max(1, hunk.oldStart - 3),
-              lineEnd: hunk.oldStart + oldLines.length + 3
-            } : void 0
-          }
-        })
-      };
-    if (index < 0)
-      return {
-        text,
-        mismatch: toolFailure(`Hunk ${hunkIndex + 1}: patch context is ambiguous`, {
-          code: "ambiguous_patch_context",
-          remediation: "Add surrounding lines, such as the enclosing function signature, until the hunk occurs once in the file or once after the previous hunk, then regenerate the patch.",
-          details: {
-            hunkIndex: hunkIndex + 1,
-            header: hunk.header,
-            matches: matches.length,
-            matchesAfterPreviousHunk: afterPrevious.length
-          }
-        })
-      };
-    const touchesEndOfFile = index + oldLines.length === lines.length;
-    lines = [...lines.slice(0, index), ...newLines, ...lines.slice(index + oldLines.length)];
-    cursor = index + newLines.length;
-    if (touchesEndOfFile) {
-      const oldNoNewline = hunk.lines.some((line) => line.kind !== "add" && line.noNewline);
-      const newNoNewline = hunk.lines.some((line) => line.kind !== "remove" && line.noNewline);
-      if (newNoNewline) trailingNewline = false;
-      else if (oldNoNewline) trailingNewline = true;
-    }
-  }
-  return { text: lines.join("\n") + (trailingNewline && lines.length > 0 ? "\n" : "") };
-}
-function mutationFromDiff(relativePath, kind, stats) {
-  return {
-    kind,
-    filePath: relativePath,
-    addedLines: stats.addedLines,
-    removedLines: stats.removedLines
-  };
-}
-function errorCodeFor(error) {
-  return error instanceof Error && error.message.includes("changed or disappeared") ? "stale_file_observation" : "filesystem_error";
-}
-async function applyPatch(args, ctx) {
-  const parsed = parsePatch(args.patch);
-  if (!("operations" in parsed)) return parsed;
-  const paths = parsed.operations.map((operation) => operation.path);
-  const resolved = parsed.operations.map((operation) => {
-    const result = resolveMutationPath(ctx, operation.path);
-    return result ? { operation, ...result } : null;
-  });
-  if (resolved.some((entry) => !entry))
-    return pathOutsideWorkspaceResult(paths[resolved.findIndex((entry) => !entry)]);
-  const entries = resolved;
-  const canonicalKeys = entries.map(
-    (entry) => process.platform === "win32" ? entry.canonicalPath.toLowerCase() : entry.canonicalPath
-  );
-  if (new Set(canonicalKeys).size !== canonicalKeys.length)
-    return toolFailure("A patch may contain only one operation per file", {
-      code: "patch_conflict",
-      remediation: "Combine related updates into one file operation with multiple hunks."
-    });
-  return withMutationLocks(
-    entries.map((entry) => entry.canonicalPath),
-    async () => {
-      const staged = [];
-      try {
-        for (const entry of entries) {
-          throwIfAborted(ctx.signal);
-          const before = await readTextSnapshot(entry.filePath, entry.operation.kind === "add");
-          if (before.binary)
-            return toolFailure(`Binary file is unsupported: ${entry.relativePath}`, {
-              code: "binary_file_unsupported",
-              remediation: "Use a text file mutation or a dedicated binary workflow."
-            });
-          if (before.mixedLineEndings && entry.operation.kind === "update")
-            return toolFailure(
-              `Mixed line endings are unsupported for patch updates: ${entry.relativePath}`,
-              {
-                code: "patch_conflict",
-                remediation: "Normalize the file line endings, reread it, and regenerate the patch.",
-                details: { filePath: entry.relativePath, lineEnding: "mixed" }
-              }
-            );
-          const stale = entry.operation.kind === "add" ? void 0 : await requireFreshObservation(ctx, entry.filePath, entry.relativePath);
-          if (stale)
-            return toolFailure(stale, {
-              code: "stale_file_observation",
-              remediation: "Call Read before regenerating the patch."
-            });
-          if (entry.operation.kind === "add") {
-            if (before.exists)
-              return toolFailure(`File already exists: ${entry.relativePath}`, {
-                code: "patch_conflict",
-                remediation: "Use Update File for an existing file."
-              });
-            const afterText = entry.operation.lines.join("\n") + (entry.operation.lines.length > 0 ? "\n" : "");
-            const { stats } = await renderDiffWithStatsAsync("", afterText, 3, ctx.signal);
-            staged.push({
-              operation: entry.operation,
-              absolutePath: entry.filePath,
-              writePath: entry.canonicalPath,
-              relativePath: entry.relativePath,
-              before,
-              afterText,
-              afterBytes: Buffer.from(afterText, "utf8"),
-              mutation: mutationFromDiff(entry.relativePath, "create", stats)
-            });
-          } else if (entry.operation.kind === "delete") {
-            if (!before.exists)
-              return toolFailure(`File not found: ${entry.relativePath}`, {
-                code: "patch_conflict",
-                remediation: "Reread the workspace and regenerate the patch."
-              });
-            staged.push({
-              operation: entry.operation,
-              absolutePath: entry.filePath,
-              writePath: entry.filePath,
-              relativePath: entry.relativePath,
-              before,
-              mutation: {
-                kind: "delete",
-                filePath: entry.relativePath,
-                addedLines: 0,
-                removedLines: linesOf(before.text).length
-              }
-            });
-          } else {
-            if (!before.exists)
-              return toolFailure(`File not found: ${entry.relativePath}`, {
-                code: "patch_context_not_found",
-                remediation: "Reread the file and regenerate the patch."
-              });
-            const applied = applyHunks(before.text, entry.operation.hunks);
-            if (applied.mismatch)
-              return toolFailure(
-                `${entry.relativePath}: ${applied.mismatch.structuredError?.message}`,
-                {
-                  ...applied.mismatch.structuredError,
-                  code: applied.mismatch.structuredError?.code ?? "patch_context_not_found",
-                  remediation: applied.mismatch.structuredError?.remediation,
-                  details: {
-                    ...applied.mismatch.structuredError?.details,
-                    filePath: entry.relativePath,
-                    lineEnding: before.mixedLineEndings ? "mixed" : before.lineEnding,
-                    normalizedMatching: true
-                  }
-                }
-              );
-            const afterText = applied.text;
-            const { stats } = await renderDiffWithStatsAsync(before.text, afterText, 3, ctx.signal);
-            staged.push({
-              operation: entry.operation,
-              absolutePath: entry.filePath,
-              writePath: entry.canonicalPath,
-              relativePath: entry.relativePath,
-              before,
-              afterText,
-              afterBytes: restoreTextEncoding(afterText, before),
-              mutation: mutationFromDiff(entry.relativePath, "update", stats)
-            });
-          }
-        }
-        const mutations = staged.map((file) => file.mutation);
-        const changedLines = mutations.reduce(
-          (total, mutation) => total + mutation.addedLines + mutation.removedLines,
-          0
-        );
-        const contextLines = parsed.operations.reduce(
-          (total, operation) => total + (operation.kind === "update" ? operation.hunks.reduce(
-            (hunkTotal, hunk) => hunkTotal + hunk.lines.filter((line) => line.kind === "context").length,
-            0
-          ) : 0),
-          0
-        );
-        const changeBudgetWarnings = [];
-        if (changedLines > 2e3) changeBudgetWarnings.push("large_change");
-        if (changedLines > 100 && changedLines > Math.max(1, contextLines) * 20)
-          changeBudgetWarnings.push("low_context_to_change_ratio");
-        const diffs = [];
-        for (const file of staged) {
-          throwIfAborted(ctx.signal);
-          const afterText = file.afterText ?? "";
-          const { diff } = await renderDiffWithStatsAsync(
-            file.before.text,
-            afterText,
-            3,
-            ctx.signal
-          );
-          if (diff) diffs.push(`--- ${file.relativePath}
-+++ ${file.relativePath}
-${diff}`);
-        }
-        const committed = [];
-        try {
-          for (const file of staged) {
-            throwIfAborted(ctx.signal);
-            committed.push(file);
-            if (file.operation.kind === "delete")
-              await removeFileAtomically(file.absolutePath, ctx.signal);
-            else
-              await writeFileAtomically(
-                file.writePath,
-                file.afterBytes,
-                ctx.signal,
-                file.before.mode
-              );
-            const check = await readTextSnapshot(
-              file.absolutePath,
-              file.operation.kind === "delete"
-            );
-            if (file.operation.kind === "delete" ? check.exists : !check.exists || !check.bytes.equals(file.afterBytes))
-              throw new Error(`Post-write verification failed for ${file.relativePath}`);
-          }
-        } catch (error) {
-          let rollbackFailed = false;
-          for (const file of committed.reverse()) {
-            try {
-              if (file.before.exists)
-                await writeFileAtomically(
-                  file.writePath,
-                  file.before.bytes,
-                  void 0,
-                  file.before.mode
-                );
-              else await removeFileAtomically(file.absolutePath).catch(() => void 0);
-            } catch {
-              rollbackFailed = true;
-            }
-          }
-          return toolFailure(
-            `Patch commit failed${rollbackFailed ? "; rollback also failed" : " and was rolled back"}: ${error instanceof Error ? error.message : String(error)}`,
-            {
-              code: rollbackFailed ? "patch_rollback_failed" : "filesystem_error",
-              remediation: rollbackFailed ? "Inspect the affected files and restore them manually." : "Retry after checking the workspace state."
-            }
-          );
-        }
-        const observations = [];
-        for (const file of staged) {
-          if (file.operation.kind !== "delete")
-            observations.push(
-              await observeFile(
-                ctx,
-                file.absolutePath,
-                file.operation.kind === "add" ? "create" : "edit"
-              )
-            );
-        }
-        const result = toolSuccess(
-          diffs.join("\n") || "Patch applied successfully (no textual change)",
-          {
-            data: {
-              files: mutations.map((mutation) => mutation.filePath),
-              changedFiles: mutations.length,
-              changedLines,
-              patchBytes: parsed.bytes,
-              changeBudgetWarnings
-            },
-            artifacts: {
-              fileMutation: mutations[0],
-              fileMutations: mutations,
-              fileObservations: observations
-            },
-            presentation: {
-              kind: "diff",
-              summary: `Applied patch to ${mutations.length} ${mutations.length === 1 ? "file" : "files"}`,
-              target: mutations.length === 1 ? mutations[0].filePath : `${mutations.length} files`
-            }
-          }
-        );
-        if (!staged.every((file) => file.mutation.kind === "create")) return result;
-        return {
-          ...result,
-          maskedPlaceholder: `${staged.map(
-            (file, order) => `${order === 0 ? "Created" : "created"} ${file.relativePath} (${file.mutation.addedLines} lines, ${file.afterBytes?.byteLength ?? 0} bytes)`
-          ).join("; ")}.`
-        };
-      } catch (error) {
-        const code = errorCodeFor(error);
-        return toolFailure(error instanceof Error ? error.message : String(error), {
-          code,
-          remediation: "Reread the affected file and regenerate the patch."
-        });
-      }
-    }
-  );
-}
-var patchTools = [
-  {
-    name: "ApplyPatch",
-    argumentAliases: { input: "patch" },
-    description: "Apply a Codex-style patch with Update File, Add File, or Delete File operations across one or more files atomically. Read the targets first; use exact contextual hunks, and regenerate the patch after a context mismatch instead of resending it unchanged.",
-    parameters: {
-      type: "object",
-      properties: {
-        patch: {
-          type: "string",
-          minLength: 1,
-          maxLength: MAX_PATCH_BYTES,
-          description: "Patch text beginning with *** Begin Patch and ending with *** End Patch"
-        },
-        baseObservation: {
-          type: "string",
-          maxLength: 128,
-          description: "Optional short observation identifier for diagnostics; freshness is checked implicitly."
-        }
-      },
-      required: ["patch"],
-      additionalProperties: false
-    },
-    execute: applyPatch
-  }
-];
-
-// src/permissions.ts
-function isUnreadablePattern(target) {
-  return typeof target === "object" && target !== null && target.target === "invalid";
-}
-var WORKSPACE_READ_TOOLS = /* @__PURE__ */ new Set(["Read", "Glob", "Grep"]);
-var PATH_RULE_TOOLS = /* @__PURE__ */ new Set([
-  "Read",
-  "Write",
-  "Edit",
-  "MultiEdit",
-  "NotebookEdit"
-]);
-var WORKSPACE_READ_JUDGING_MODES = /* @__PURE__ */ new Set([
-  "default",
-  "accept-edits",
-  "plan"
-]);
-var WORKSPACE_READ_REFUSAL_MODES = /* @__PURE__ */ new Set([
-  ...WORKSPACE_READ_JUDGING_MODES,
-  "dontAsk"
-]);
-var WORKSPACE_READ_ONLY_GIT_TOOLS = /* @__PURE__ */ new Set([
-  "GitStatus",
-  "GitDiff",
-  "GitLog",
-  "GitBranch"
-]);
-function parseRule(rule) {
-  const parenIdx = rule.indexOf("(");
-  if (parenIdx === -1) {
-    return { toolName: rule.trim(), pattern: null };
-  }
-  const toolName = rule.slice(0, parenIdx).trim();
-  const closeIdx = rule.lastIndexOf(")");
-  if (closeIdx === -1 || closeIdx <= parenIdx) {
-    return { toolName, pattern: null };
-  }
-  const pattern = rule.slice(parenIdx + 1, closeIdx).trim();
-  return { toolName, pattern: pattern.length === 0 ? null : pattern };
-}
-function normalizePathArg(s) {
-  if (s.startsWith("./")) return s.slice(2);
-  return s;
-}
-function toolNameMatchesRule(ruleToolName, toolName) {
-  if (ruleToolName === toolName) return true;
-  if (!ruleToolName.startsWith("mcp__")) return false;
-  const serverName = ruleToolName.slice("mcp__".length);
-  return Boolean(
-    serverName && !serverName.includes("__") && toolName.startsWith(`${ruleToolName}__`)
-  );
-}
-var caseFoldingPathRule = (value) => value.toLowerCase();
-function ruleMatchesCandidate(rule, toolName, primaryArg, fold) {
-  if (!toolNameMatchesRule(rule.toolName, toolName)) return false;
-  if (rule.pattern === null) return true;
-  const normalizedArg = normalizePathArg(primaryArg);
-  const normalizedPattern = rule.pattern.startsWith("./") ? rule.pattern.slice(2) : rule.pattern;
-  if (!fold) return globToRegex(normalizedPattern).test(normalizedArg);
-  return globToRegex(caseFoldingPathRule(normalizedPattern)).test(
-    caseFoldingPathRule(normalizedArg)
-  );
-}
-function ruleMatches(rule, toolName, primaryArg) {
-  return ruleMatchesCandidate(rule, toolName, primaryArg, false);
-}
-function permissionRuleForToolCall(call) {
-  const toolName = canonicalToolName(call.name);
-  const primaryArg = getPrimaryArg(call.arguments);
-  if (toolName === "WebSearch") return toolName;
-  if (toolName === "WebFetch" && primaryArg) {
-    try {
-      const url = new URL(primaryArg);
-      return `${toolName}(${url.origin}/**)`;
-    } catch {
-    }
-  }
-  if (!primaryArg) return void 0;
-  return `${toolName}(${primaryArg})`;
-}
-function permissionResultOf(decision) {
-  return typeof decision === "string" ? decision : decision.result;
-}
-function permissionRuleOf(decision) {
-  return typeof decision === "string" ? void 0 : decision.rule;
-}
-function permissionReasonOf(decision) {
-  return typeof decision === "string" ? void 0 : decision.reason;
-}
-var RULE_LADDER_MAX = 3;
-var SHELL_CHAINING = /[;&|><`$(){}\n]/;
-function permissionRuleLadder(call) {
-  const exact = permissionRuleForToolCall(call);
-  if (!exact) return [];
-  if (canonicalToolName(call.name) !== "Bash") return [exact];
-  const command = getPrimaryArg(call.arguments).trim();
-  if (!command || SHELL_CHAINING.test(command)) return [exact];
-  const tokens = command.split(/\s+/);
-  const ladder = [exact];
-  for (let take = tokens.length - 1; take >= 1 && ladder.length < RULE_LADDER_MAX; take -= 1) {
-    const prefix = `Bash(${tokens.slice(0, take).join(" ")} *)`;
-    if (!ladder.includes(prefix)) ladder.push(prefix);
-  }
-  return ladder;
-}
-function permissionRuleMatchesCall(rule, call) {
-  const toolName = canonicalToolName(call.name);
-  const primaryArg = getPrimaryArg(call.arguments);
-  if (toolName === "WebFetch" && primaryArg) {
-    try {
-      return ruleMatches(parseRule(rule), toolName, new URL(primaryArg).toString());
-    } catch {
-    }
-  }
-  return ruleMatches(parseRule(rule), toolName, primaryArg);
-}
-function patchOperations(args) {
-  const parsed = parsePatch(args.patch);
-  return "operations" in parsed ? parsed.operations : [];
-}
-function ruleMatchesPatch(rule, paths, fold) {
-  return paths.some((path) => ruleMatchesCandidate(rule, rule.toolName, path, fold));
-}
-function patchRuleSupportsOperation(rule, operation) {
-  if (rule.toolName === "ApplyPatch") return true;
-  if (rule.toolName === "Edit") return operation.kind === "update";
-  if (rule.toolName === "Write") return operation.kind === "update" || operation.kind === "add";
-  return false;
-}
-function compatiblePatchRuleMatches(rule, operations, spellingsOf, fold) {
-  if (!["ApplyPatch", "Edit", "Write"].includes(rule.toolName)) return false;
-  if (rule.toolName === "ApplyPatch" && rule.pattern === null) return true;
-  return operations.some(
-    (operation) => patchRuleSupportsOperation(rule, operation) && (rule.pattern === null || ruleMatchesPatch(rule, spellingsOf(operation.path, fold), fold))
-  );
-}
-function primaryArgForRule(_toolName, args) {
-  return getPrimaryArg(args);
-}
-function hasAdjudicationPolicy(settings) {
-  return settings.permissions.deny.length > 0 || settings.permissions.ask.length > 0;
-}
-function sandboxAutoAllows(toolName, args, settings, options) {
-  if (!settings.sandbox.autoAllowBashIfSandboxed) return false;
-  if (canonicalToolName(toolName) !== "Bash") return false;
-  if (hasAdjudicationPolicy(settings)) return false;
-  const command = typeof args.command === "string" ? args.command.trim() : "";
-  if (!command) return false;
-  return sandboxCoverage(command, settings.sandbox, options.sandboxBackendAvailable).sandboxed;
-}
-var toPosix = (value) => value.replace(/\\/g, "/");
-function realRootOf(scope) {
-  if (scope.realRoot) return scope.realRoot;
-  try {
-    return realpathSync.native(scope.root);
-  } catch {
-    return void 0;
-  }
-}
-function pathArgument(toolName, args) {
-  const value = toolName === "NotebookEdit" ? args.notebook_path : args.filePath;
-  return typeof value === "string" && value.trim() !== "" ? value : void 0;
-}
-function rulesName(lists, toolName) {
-  return [...lists.deny, ...lists.ask, ...lists.allow].some(
-    ({ parsed }) => parsed.toolName === toolName
-  );
-}
-function resolvedPathScope(scope) {
-  const detailCache = /* @__PURE__ */ new Map();
-  const rootsFor = (includeReadOnly) => ({
-    workspaceRoot: scope.root,
-    readOnlyRoots: includeReadOnly ? scope.readOnlyRoots : void 0,
-    additionalRoots: scope.additionalRoots
-  });
-  const holdsHomeByRoot = /* @__PURE__ */ new Map();
-  const holdsHome = (root) => {
-    let known = holdsHomeByRoot.get(root);
-    if (known === void 0) {
-      known = rootHoldsHome(root, scope.homeGuards ?? []);
-      holdsHomeByRoot.set(root, known);
-    }
-    return known;
-  };
-  const guardedRoots = [scope.root, ...scope.additionalRoots ?? []].filter(holdsHome);
-  const servingRootOf = (canonicalPath) => [realRootOf(scope), ...scope.additionalRoots ?? []].find(
-    (root) => typeof root === "string" && root.length > 0 && isUnderRoot(canonicalPath, root)
-  );
-  return {
-    scope,
-    roots: rootsFor,
-    detail: (raw, includeReadOnly) => {
-      const key = `${includeReadOnly ? "r" : "w"}\0${raw}`;
-      let known = detailCache.get(key);
-      if (!known) {
-        known = resolveReadablePathDetail(rootsFor(includeReadOnly), raw);
-        detailCache.set(key, known);
-      }
-      return known;
-    },
-    isGuarded: (canonicalPath) => {
-      const roots = [realRootOf(scope), ...scope.additionalRoots ?? []].filter(
-        (root) => typeof root === "string" && root.length > 0
-      );
-      if (roots.some((root) => isBookLocalSettingsPath(canonicalPath, root, { directory: true })))
-        return true;
-      if (guardedRoots.length === 0) return false;
-      if (!pathHoldsHome(canonicalPath, scope.homeGuards ?? [])) return false;
-      const serving = servingRootOf(canonicalPath);
-      return serving !== void 0 && holdsHome(serving);
-    },
-    /**
-     * Whether a Grep or Glob *scope* can reach a guarded home. A scope is a subtree, not a file,
-     * so it is guarded when the guarded home is inside it as well as when it is inside the home:
-     * `Grep {path: "/home"}` reads `~/.ssh` without naming a single file under it (PR #334
-     * finding 4). Compared canonically, both ways, because either side may be reached by a link.
-     */
-    scopeReachesHome: (canonicalScope) => {
-      const homes = scope.homeGuards ?? [];
-      if (homes.some((home) => containsPath(canonicalScope, home))) return true;
-      return guardedRoots.some((root) => containsPath(root, canonicalScope));
-    }
-  };
-}
-function spellingsOfPath(paths, raw, includeReadOnly, restrictive) {
-  const spellings = [];
-  const detail = paths.detail(raw, includeReadOnly);
-  if (!("path" in detail)) return [];
-  const resolved = detail.path;
-  const inWorkspace = resolveWorkspacePath(paths.scope.root, raw) !== null;
-  if (inWorkspace) {
-    spellings.push(
-      resolved.relativePath,
-      toPosix(resolved.filePath),
-      toPosix(resolved.canonicalPath)
-    );
-    const realRoot = realRootOf(paths.scope);
-    if (realRoot) spellings.push(toPosix(relative2(realRoot, resolved.canonicalPath)));
-  } else {
-    spellings.push(toPosix(resolved.filePath), toPosix(resolved.canonicalPath));
-    if (restrictive) {
-      for (const root of paths.scope.additionalRoots ?? []) {
-        const fromRoot = relative2(canonicalizePath(root), resolved.canonicalPath);
-        if (!fromRoot || isAbsolute(fromRoot) || fromRoot === ".." || fromRoot.startsWith(`..${sep}`)) {
-          continue;
-        }
-        spellings.push(toPosix(fromRoot));
-      }
-    }
-  }
-  return [...new Set(spellings)].filter((spelling) => spelling !== "" && spelling !== raw);
-}
-function pathRuleSpellings(paths, toolName, args, restrictive) {
-  const raw = pathArgument(toolName, args);
-  return raw ? spellingsOfPath(paths, raw, toolName === "Read", restrictive) : [];
-}
-function globTarget(pattern, paths) {
-  const { refusal, scopes } = globWalkPlan(pattern, paths.scope.root);
-  if (refusal) return { target: "invalid", reason: refusal };
-  if (scopes === null) return "outside";
-  let guarded = false;
-  for (const scope of scopes) {
-    const detail = paths.detail(scope, false);
-    if (!("path" in detail)) return "outside";
-    if (paths.scopeReachesHome(detail.path.canonicalPath)) guarded = true;
-  }
-  return guarded ? "guarded" : "servable";
-}
-function readToolTarget(toolName, args, paths) {
-  if (toolName === "Read") {
-    const raw2 = pathArgument(toolName, args);
-    if (!raw2) return "none";
-    const detail2 = paths.detail(raw2, true);
-    if (!("path" in detail2)) return detail2.reason === "excluded" ? "hidden" : "outside";
-    return paths.isGuarded(detail2.path.canonicalPath) ? "guarded" : "servable";
-  }
-  if (toolName === "Glob") {
-    const pattern = typeof args.pattern === "string" ? args.pattern.trim() : "";
-    if (!pattern) return "none";
-    return globTarget(pattern, paths);
-  }
-  const raw = typeof args.path === "string" ? args.path.trim() : "";
-  if (raw === "" || raw === ".") return "servable";
-  const detail = paths.detail(raw, false);
-  if (!("path" in detail)) return detail.reason === "excluded" ? "hidden" : "outside";
-  if (paths.isGuarded(detail.path.canonicalPath)) return "guarded";
-  return paths.scopeReachesHome(detail.path.canonicalPath) ? "guarded" : "servable";
-}
-function parseRuleLists(settings) {
-  const list = (texts) => texts.map((text) => ({ text, parsed: parseRule(text) }));
-  return {
-    deny: list(settings.permissions.deny),
-    ask: list(settings.permissions.ask),
-    allow: list(settings.permissions.allow)
-  };
-}
-function hasReadAdjudication(lists) {
-  return [...lists.deny, ...lists.ask].some(
-    ({ parsed }) => WORKSPACE_READ_TOOLS.has(parsed.toolName)
-  );
-}
-function evaluatePermission(toolName, args, settings, options = {}) {
-  return evaluatePermissionDetail(toolName, args, settings, options).decision;
-}
-function evaluatePermissionDetail(toolName, args, settings, options = {}) {
-  const scope = options.workspace;
-  const paths = scope ? resolvedPathScope(scope) : void 0;
-  const parsed = parseRuleLists(settings);
-  if (toolName === "ApplyPatch") {
-    const operations = patchOperations(args);
-    const spellings = /* @__PURE__ */ new Map();
-    const restrictiveSpellings = /* @__PURE__ */ new Map();
-    const spellingsOf = (path, restrictive) => {
-      const cache = restrictive ? restrictiveSpellings : spellings;
-      let known = cache.get(path);
-      if (!known) {
-        known = paths ? [path, ...spellingsOfPath(paths, path, false, restrictive)] : [path];
-        cache.set(path, known);
-      }
-      return known;
-    };
-    const isCompatible = (rule) => rule.toolName === "ApplyPatch" || rule.toolName === "Edit" || rule.toolName === "Write";
-    for (const list of ["deny", "ask"]) {
-      for (const entry of parsed[list]) {
-        if (!isCompatible(entry.parsed)) continue;
-        if (compatiblePatchRuleMatches(entry.parsed, operations, spellingsOf, true)) {
-          return { decision: list, matchedRule: entry.text, source: list };
-        }
-      }
-    }
-    const allowRules = parsed.allow.filter(({ parsed: rule }) => isCompatible(rule));
-    const firstCompatible = allowRules[0]?.text;
-    if (operations.length > 0 && operations.every(
-      (operation) => allowRules.some(
-        ({ parsed: rule }) => patchRuleSupportsOperation(rule, operation) && (rule.pattern === null || ruleMatchesPatch(rule, spellingsOf(operation.path, false), false))
-      )
-    )) {
-      return { decision: "allow", matchedRule: firstCompatible, source: "allow" };
-    }
-    if (allowRules.some(({ parsed: rule }) => rule.toolName === "ApplyPatch" && rule.pattern === null)) {
-      return { decision: "allow", matchedRule: firstCompatible, source: "allow" };
-    }
-    return { decision: "ask", source: "default" };
-  }
-  const tool = canonicalToolName(toolName);
-  const candidates = [getPrimaryArg(args)];
-  let restrictiveCandidates = candidates;
-  if (scope && paths && PATH_RULE_TOOLS.has(tool) && rulesName(parsed, tool)) {
-    restrictiveCandidates = [...candidates, ...pathRuleSpellings(paths, tool, args, true)];
-    candidates.push(...pathRuleSpellings(paths, tool, args, false));
-  }
-  const matchesRule = (rule, fold) => {
-    const pool = fold ? restrictiveCandidates : candidates;
-    if (tool === "WebFetch") {
-      try {
-        const url = new URL(candidates[0]).toString();
-        return ruleMatchesCandidate(rule, tool, url, false);
-      } catch {
-      }
-    }
-    return pool.some((candidate) => ruleMatchesCandidate(rule, tool, candidate, fold));
-  };
-  const readTarget = scope && paths && (scope.judgeReads || scope.refuseUnreachableReads) && WORKSPACE_READ_TOOLS.has(tool) ? readToolTarget(tool, args, paths) : void 0;
-  const unreadablePattern = readTarget !== void 0 && isUnreadablePattern(readTarget) ? readTarget.reason : void 0;
-  const outside = readTarget === "outside" ? { outsideWorkspace: true } : {};
-  for (const entry of parsed.deny) {
-    if (matchesRule(entry.parsed, true)) {
-      return { decision: "deny", matchedRule: entry.text, source: "deny" };
-    }
-  }
-  for (const entry of parsed.ask) {
-    if (matchesRule(entry.parsed, true)) {
-      return { decision: "ask", matchedRule: entry.text, source: "ask", ...outside };
-    }
-  }
-  for (const entry of parsed.allow) {
-    if (matchesRule(entry.parsed, false)) {
-      return { decision: "allow", matchedRule: entry.text, source: "allow" };
-    }
-  }
-  if (sandboxAutoAllows(toolName, args, settings, options)) {
-    return { decision: "allow", source: "sandbox" };
-  }
-  if (scope?.autoAllowReads && (readTarget === "none" || readTarget === "servable" && (tool === "Read" || !hasReadAdjudication(parsed)))) {
-    return { decision: "allow", source: "workspace" };
-  }
-  if (scope?.autoAllowReads && WORKSPACE_READ_ONLY_GIT_TOOLS.has(tool)) {
-    return { decision: "allow", source: "workspace" };
-  }
-  if (ALWAYS_ALLOWED_TOOLS.has(tool)) {
-    return { decision: "allow", source: "default" };
-  }
-  if (unreadablePattern !== void 0) {
-    return { decision: "refuse", source: "default", unreadablePattern };
-  }
-  if (readTarget === "outside") {
-    return { decision: "refuse", source: "default", outsideWorkspace: true };
-  }
-  if (readTarget === "hidden") {
-    return { decision: "refuse", source: "default", excludedPath: true };
-  }
-  return { decision: "ask", source: "default" };
-}
-var ALWAYS_ALLOWED_TOOLS = /* @__PURE__ */ new Set(["MemorySave", "TodoWrite"]);
-
-export {
-  throwIfAborted,
-  onAbort,
-  delay,
-  yieldToEventLoop,
-  renderDiffWithStatsAsync,
-  workspaceIdentity,
-  normalizeObservedPath,
-  observationKey,
-  supersedesObservation,
-  seedObservationLedger,
-  observeFile,
-  requireFreshObservation,
-  requireObservationForMutation,
-  readTextSnapshot,
-  restoreTextEncoding,
-  writeFileAtomically,
-  withMutationLocks,
-  parsePatch,
-  applyHunks,
-  patchTools,
-  WORKSPACE_READ_TOOLS,
-  WORKSPACE_READ_JUDGING_MODES,
-  WORKSPACE_READ_REFUSAL_MODES,
-  WORKSPACE_READ_ONLY_GIT_TOOLS,
-  parseRule,
-  permissionRuleForToolCall,
-  permissionResultOf,
-  permissionRuleOf,
-  permissionReasonOf,
-  permissionRuleLadder,
-  permissionRuleMatchesCall,
-  primaryArgForRule,
-  hasAdjudicationPolicy,
-  evaluatePermission,
-  evaluatePermissionDetail,
-  ALWAYS_ALLOWED_TOOLS
-};
-//# sourceMappingURL=chunk-J62VZYOB.js.map