@namzu/cli 35.0.0 → 36.1.0

package/dist/chunks/chunk-Q5YM2GCX.js

@@ -0,0 +1,283 @@
+import { createRequire as __namzuCreateRequire } from 'node:module';
+const require = __namzuCreateRequire(import.meta.url);
+import {
+  cliLogger
+} from "./chunk-HBBB2CAC.js";
+import {
+  AuthorizationGate,
+  NOOP_LOGGER,
+  builtinCommandArguments,
+  getBuiltinTools,
+  permissionPatternToRegExpSource
+} from "./chunk-EWKJGHRO.js";
+import {
+  __name
+} from "./chunk-76FLAFCG.js";
+
+// src/permissions/checks.ts
+function asEffect(decision) {
+  return decision === "review" ? "ask" : decision;
+}
+__name(asEffect, "asEffect");
+function verifyPermissionChecks(rules, checks) {
+  if (!checks || checks.length === 0) return [];
+  const diagnostics = [];
+  const gate = new AuthorizationGate(
+    {
+      enabled: true,
+      rules: [...rules],
+      allowReadOnlyTools: false,
+      // Off on purpose; see the note at the top of this file.
+      denyDangerousPatterns: false,
+      logDecisions: false
+    },
+    NOOP_LOGGER
+  );
+  for (const [index, check] of checks.entries()) {
+    const where = `permissionChecks[${index}]`;
+    if (typeof check?.tool !== "string" || check.tool === "") {
+      diagnostics.push({ tool: where, message: 'expected a "tool" naming the tool to evaluate' });
+      continue;
+    }
+    if (typeof check.input !== "object" || check.input === null || Array.isArray(check.input)) {
+      diagnostics.push({
+        tool: where,
+        message: `expected an "input" object for ${check.tool}; got ${describe(check.input)}`
+      });
+      continue;
+    }
+    if (!isPermissionEffect(check.expect)) {
+      diagnostics.push({
+        tool: where,
+        message: `expected "expect" to be "allow", "ask" or "deny"; got ${JSON.stringify(check.expect)}`
+      });
+      continue;
+    }
+    const builtin = getBuiltinTools().find((tool) => tool.name === check.tool);
+    const commandDialect = builtin?.commandDialect?.({ sandboxed: false });
+    const verdict = gate.evaluate({
+      toolName: check.tool,
+      toolInput: check.input,
+      toolDef: void 0,
+      ...commandDialect !== void 0 ? { commandDialect } : {}
+    });
+    const actual = asEffect(verdict.decision);
+    if (actual === check.expect) continue;
+    diagnostics.push({
+      tool: where,
+      message: `${check.tool} ${JSON.stringify(check.input)} is "${actual}", not the expected "${check.expect}" \u2014 ${verdict.reason}`
+    });
+  }
+  return diagnostics;
+}
+__name(verifyPermissionChecks, "verifyPermissionChecks");
+function describe(value) {
+  if (value === null) return "null";
+  return Array.isArray(value) ? "an array" : typeof value;
+}
+__name(describe, "describe");
+
+// src/permissions/rules.ts
+var EFFECTS = /* @__PURE__ */ new Set(["allow", "ask", "deny"]);
+function isPermissionEffect(value) {
+  return typeof value === "string" && EFFECTS.has(value);
+}
+__name(isPermissionEffect, "isPermissionEffect");
+function legacyMcpPermissionNames(config) {
+  return Object.keys(config ?? {}).filter((name) => /^mcp_(?!_)[^_]+_.+/.test(name));
+}
+__name(legacyMcpPermissionNames, "legacyMcpPermissionNames");
+var warnedLegacyMcpNames = /* @__PURE__ */ new Set();
+function warnLegacyMcpPermissionNames(config, log = cliLogger()) {
+  for (const name of legacyMcpPermissionNames(config)) {
+    if (warnedLegacyMcpNames.has(name)) continue;
+    warnedLegacyMcpNames.add(name);
+    log.warn(
+      "Former MCP permission name does not match the current mcp__<server>__<tool> naming scheme",
+      {
+        "namzu.permission.tool_name": name
+      }
+    );
+  }
+}
+__name(warnLegacyMcpPermissionNames, "warnLegacyMcpPermissionNames");
+function patternToRegExpSource(pattern) {
+  return permissionPatternToRegExpSource(pattern);
+}
+__name(patternToRegExpSource, "patternToRegExpSource");
+function toolScopedPattern(tool, pattern, decision = "deny") {
+  const toolPart = escapeRegExp(tool);
+  const argPart = patternToRegExpSource(pattern).slice(1, -1);
+  const anchorToValue = decision === "allow" && pattern.replaceAll("*", "") !== "";
+  return anchorToValue ? `^${toolPart} .*"${argPart}.*$` : `^${toolPart} .*${argPart}.*$`;
+}
+__name(toolScopedPattern, "toolScopedPattern");
+function commandRule(tool, argument, pattern, decision) {
+  if (pattern.replaceAll("*", "") === "") {
+    return decision === "allow" ? { type: "allow_by_name", toolNames: [tool] } : { type: "deny_by_name", toolNames: [tool] };
+  }
+  const anchored = patternToRegExpSource(pattern);
+  return {
+    type: "argument_pattern",
+    toolNames: [tool],
+    argument,
+    pattern: decision === "allow" ? anchored : anchored.slice(1, -1),
+    decision
+  };
+}
+__name(commandRule, "commandRule");
+function escapeRegExp(value) {
+  return value.replace(/[.*+^${}()|[\]\\?]/g, "\\$&");
+}
+__name(escapeRegExp, "escapeRegExp");
+function bySpecificity(a, b) {
+  if (a === "*" && b !== "*") return 1;
+  if (b === "*" && a !== "*") return -1;
+  const literal = /* @__PURE__ */ __name((p) => {
+    const star = p.search(/[*?]/);
+    return star === -1 ? p.length : star;
+  }, "literal");
+  const diff = literal(b) - literal(a);
+  if (diff !== 0) return diff;
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+__name(bySpecificity, "bySpecificity");
+function compilePermissions(config, checks) {
+  const rules = [];
+  const sourceDenials = [];
+  const sourceReviews = [];
+  const sourceAllowances = [];
+  const diagnostics = [];
+  if (!config) return { rules, diagnostics: verifyPermissionChecks(rules, checks) };
+  const commandArguments = builtinCommandArguments();
+  for (const [tool, permission] of Object.entries(config)) {
+    if (tool === "sources") {
+      if (typeof permission !== "object" || permission === null || Array.isArray(permission)) {
+        diagnostics.push({ tool, message: "expected a table of source id globs and effects" });
+        continue;
+      }
+      for (const source of Object.keys(permission).sort(bySpecificity)) {
+        const effect = permission[source];
+        if (!source) {
+          diagnostics.push({ tool, pattern: source, message: "source id glob must not be empty" });
+          continue;
+        }
+        if (!isPermissionEffect(effect)) {
+          diagnostics.push({
+            tool,
+            pattern: source,
+            message: `expected "allow", "ask" or "deny"; got ${JSON.stringify(effect)}`
+          });
+          continue;
+        }
+        const rule = {
+          type: "by_source",
+          sources: [source],
+          decision: effect === "ask" ? "review" : effect
+        };
+        if (effect === "allow") sourceAllowances.push(rule);
+        else if (effect === "deny") sourceDenials.push(rule);
+        else sourceReviews.push(rule);
+      }
+      continue;
+    }
+    if (isPermissionEffect(permission)) {
+      if (permission === "allow") rules.push({ type: "allow_by_name", toolNames: [tool] });
+      if (permission === "deny") rules.push({ type: "deny_by_name", toolNames: [tool] });
+      if (permission === "ask") {
+        rules.push({
+          type: "custom_pattern",
+          pattern: `^${escapeRegExp(tool)}$`,
+          target: "name",
+          decision: "review"
+        });
+      }
+      continue;
+    }
+    if (typeof permission !== "object" || permission === null) {
+      diagnostics.push({
+        tool,
+        message: `expected "allow", "ask", "deny", or a table of patterns; got ${typeof permission}`
+      });
+      continue;
+    }
+    for (const pattern of Object.keys(permission).sort(bySpecificity)) {
+      const effect = permission[pattern];
+      if (!isPermissionEffect(effect)) {
+        diagnostics.push({
+          tool,
+          pattern,
+          message: `expected "allow", "ask" or "deny"; got ${JSON.stringify(effect)}`
+        });
+        continue;
+      }
+      try {
+        new RegExp(patternToRegExpSource(pattern));
+      } catch (err) {
+        diagnostics.push({
+          tool,
+          pattern,
+          message: `pattern is not usable: ${err instanceof Error ? err.message : String(err)}`
+        });
+        continue;
+      }
+      if (effect === "ask") {
+        rules.push({
+          type: "custom_pattern",
+          pattern: toolScopedPattern(tool, pattern),
+          target: "both",
+          decision: "review"
+        });
+        continue;
+      }
+      const argument = commandArguments.get(tool);
+      if (argument === void 0) {
+        rules.push({
+          type: "custom_pattern",
+          pattern: toolScopedPattern(tool, pattern, effect),
+          target: "both",
+          decision: effect
+        });
+        continue;
+      }
+      rules.push(commandRule(tool, argument, pattern, effect));
+    }
+  }
+  const toolDenialBeforeSourceReview = [];
+  if (sourceReviews.length > 0 && rules.length > 0) {
+    const toolGate = new AuthorizationGate(
+      {
+        enabled: true,
+        rules: [...rules],
+        allowReadOnlyTools: false,
+        denyDangerousPatterns: false,
+        logDecisions: false
+      },
+      NOOP_LOGGER
+    );
+    const toolDecision = /* @__PURE__ */ __name((call) => toolGate.evaluate(call), "toolDecision");
+    toolDenialBeforeSourceReview.push({
+      type: "predicate",
+      description: "denied by a tool-specific permission rule",
+      decide: /* @__PURE__ */ __name((call) => toolDecision(call).decision === "deny" ? "deny" : null, "decide"),
+      describe: /* @__PURE__ */ __name((call) => toolDecision(call).reason, "describe")
+    });
+  }
+  const orderedRules = [
+    ...sourceDenials,
+    ...toolDenialBeforeSourceReview,
+    ...sourceReviews,
+    ...rules,
+    ...sourceAllowances
+  ];
+  diagnostics.push(...verifyPermissionChecks(orderedRules, checks));
+  return { rules: orderedRules, diagnostics };
+}
+__name(compilePermissions, "compilePermissions");
+
+export {
+  isPermissionEffect,
+  warnLegacyMcpPermissionNames,
+  compilePermissions
+};
+//# sourceMappingURL=chunk-Q5YM2GCX.js.map

package/dist/chunks/chunk-Q5YM2GCX.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../src/permissions/checks.ts", "../../src/permissions/rules.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAmEA,SAAS,SAAS,UAAyD;AAC1E,SAAO,aAAa,WAAW,QAAQ;AACxC;AAFS;AAaF,SAAS,uBACf,OACA,QACsB;AACtB,MAAI,CAAC,UAAU,OAAO,WAAW,EAAG,QAAO,CAAC;AAE5C,QAAM,cAAmC,CAAC;AAC1C,QAAM,OAAO,IAAI;AAAA,IAChB;AAAA,MACC,SAAS;AAAA,MACT,OAAO,CAAC,GAAG,KAAK;AAAA,MAChB,oBAAoB;AAAA;AAAA,MAEpB,uBAAuB;AAAA,MACvB,cAAc;AAAA,IACf;AAAA,IACA;AAAA,EACD;AAEA,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,GAAG;AAC9C,UAAM,QAAQ,oBAAoB,KAAK;AAEvC,QAAI,OAAO,OAAO,SAAS,YAAY,MAAM,SAAS,IAAI;AACzD,kBAAY,KAAK,EAAE,MAAM,OAAO,SAAS,gDAAgD,CAAC;AAC1F;AAAA,IACD;AACA,QAAI,OAAO,MAAM,UAAU,YAAY,MAAM,UAAU,QAAQ,MAAM,QAAQ,MAAM,KAAK,GAAG;AAC1F,kBAAY,KAAK;AAAA,QAChB,MAAM;AAAA,QACN,SAAS,kCAAkC,MAAM,IAAI,SAAS,SAAS,MAAM,KAAK,CAAC;AAAA,MACpF,CAAC;AACD;AAAA,IACD;AACA,QAAI,CAAC,mBAAmB,MAAM,MAAM,GAAG;AACtC,kBAAY,KAAK;AAAA,QAChB,MAAM;AAAA,QACN,SAAS,yDAAyD,KAAK,UAAU,MAAM,MAAM,CAAC;AAAA,MAC/F,CAAC;AACD;AAAA,IACD;AAKA,UAAM,UAAU,gBAAgB,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,MAAM,IAAI;AACzE,UAAM,iBAAiB,SAAS,iBAAiB,EAAE,WAAW,MAAM,CAAC;AACrE,UAAM,UAAU,KAAK,SAAS;AAAA,MAC7B,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM;AAAA,MACjB,SAAS;AAAA,MACT,GAAI,mBAAmB,SAAY,EAAE,eAAe,IAAI,CAAC;AAAA,IAC1D,CAAC;AACD,UAAM,SAAS,SAAS,QAAQ,QAAQ;AACxC,QAAI,WAAW,MAAM,OAAQ;AAK7B,gBAAY,KAAK;AAAA,MAChB,MAAM;AAAA,MACN,SAAS,GAAG,MAAM,IAAI,IAAI,KAAK,UAAU,MAAM,KAAK,CAAC,QAAQ,MAAM,wBAAwB,MAAM,MAAM,YAAO,QAAQ,MAAM;AAAA,IAC7H,CAAC;AAAA,EACF;AAEA,SAAO;AACR;AAjEgB;AAmEhB,SAAS,SAAS,OAAwB;AACzC,MAAI,UAAU,KAAM,QAAO;AAC3B,SAAO,MAAM,QAAQ,KAAK,IAAI,aAAa,OAAO;AACnD;AAHS;;;ACtHT,IAAM,UAAU,oBAAI,IAAY,CAAC,SAAS,OAAO,MAAM,CAAC;AAEjD,SAAS,mBAAmB,OAA2C;AAC7E,SAAO,OAAO,UAAU,YAAY,QAAQ,IAAI,KAAK;AACtD;AAFgB;AAiBT,SAAS,yBAAyB,QAA0D;AAClG,SAAO,OAAO,KAAK,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,qBAAqB,KAAK,IAAI,CAAC;AAClF;AAFgB;AAIhB,IAAM,uBAAuB,oBAAI,IAAY;AAGtC,SAAS,6BACf,QACA,MAA4B,UAAU,GAC/B;AACP,aAAW,QAAQ,yBAAyB,MAAM,GAAG;AACpD,QAAI,qBAAqB,IAAI,IAAI,EAAG;AACpC,yBAAqB,IAAI,IAAI;AAC7B,QAAI;AAAA,MACH;AAAA,MACA;AAAA,QACC,8BAA8B;AAAA,MAC/B;AAAA,IACD;AAAA,EACD;AACD;AAdgB;AAgDT,SAAS,sBAAsB,SAAyB;AAG9D,SAAO,gCAAgC,OAAO;AAC/C;AAJgB;AAuET,SAAS,kBACf,MACA,SACA,WAA6B,QACpB;AACT,QAAM,WAAW,aAAa,IAAI;AAClC,QAAM,UAAU,sBAAsB,OAAO,EAAE,MAAM,GAAG,EAAE;AAK1D,QAAM,gBAAgB,aAAa,WAAW,QAAQ,WAAW,KAAK,EAAE,MAAM;AAC9E,SAAO,gBAAgB,IAAI,QAAQ,OAAO,OAAO,QAAQ,IAAI,QAAQ,MAAM,OAAO;AACnF;AAbgB;AAgChB,SAAS,YACR,MACA,UACA,SACA,UACoB;AAIpB,MAAI,QAAQ,WAAW,KAAK,EAAE,MAAM,IAAI;AACvC,WAAO,aAAa,UACjB,EAAE,MAAM,iBAAiB,WAAW,CAAC,IAAI,EAAE,IAC3C,EAAE,MAAM,gBAAgB,WAAW,CAAC,IAAI,EAAE;AAAA,EAC9C;AACA,QAAM,WAAW,sBAAsB,OAAO;AAC9C,SAAO;AAAA,IACN,MAAM;AAAA,IACN,WAAW,CAAC,IAAI;AAAA,IAChB;AAAA,IACA,SAAS,aAAa,UAAU,WAAW,SAAS,MAAM,GAAG,EAAE;AAAA,IAC/D;AAAA,EACD;AACD;AAtBS;AAwBT,SAAS,aAAa,OAAuB;AAC5C,SAAO,MAAM,QAAQ,uBAAuB,MAAM;AACnD;AAFS;AAuBF,SAAS,cAAc,GAAW,GAAmB;AAC3D,MAAI,MAAM,OAAO,MAAM,IAAK,QAAO;AACnC,MAAI,MAAM,OAAO,MAAM,IAAK,QAAO;AACnC,QAAM,UAAU,wBAAC,MAAsB;AACtC,UAAM,OAAO,EAAE,OAAO,MAAM;AAC5B,WAAO,SAAS,KAAK,EAAE,SAAS;AAAA,EACjC,GAHgB;AAIhB,QAAM,OAAO,QAAQ,CAAC,IAAI,QAAQ,CAAC;AACnC,MAAI,SAAS,EAAG,QAAO;AACvB,SAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;AACjC;AAVgB;AAkBT,SAAS,mBACf,QACA,QACsB;AACtB,QAAM,QAA6B,CAAC;AACpC,QAAM,gBAAqC,CAAC;AAC5C,QAAM,gBAAqC,CAAC;AAC5C,QAAM,mBAAwC,CAAC;AAC/C,QAAM,cAAmC,CAAC;AAI1C,MAAI,CAAC,OAAQ,QAAO,EAAE,OAAO,aAAa,uBAAuB,OAAO,MAAM,EAAE;AAKhF,QAAM,mBAAmB,wBAAwB;AAEjD,aAAW,CAAC,MAAM,UAAU,KAAK,OAAO,QAAQ,MAAM,GAAG;AACxD,QAAI,SAAS,WAAW;AACvB,UAAI,OAAO,eAAe,YAAY,eAAe,QAAQ,MAAM,QAAQ,UAAU,GAAG;AACvF,oBAAY,KAAK,EAAE,MAAM,SAAS,kDAAkD,CAAC;AACrF;AAAA,MACD;AACA,iBAAW,UAAU,OAAO,KAAK,UAAU,EAAE,KAAK,aAAa,GAAG;AACjE,cAAM,SAAS,WAAW,MAAM;AAChC,YAAI,CAAC,QAAQ;AACZ,sBAAY,KAAK,EAAE,MAAM,SAAS,QAAQ,SAAS,mCAAmC,CAAC;AACvF;AAAA,QACD;AACA,YAAI,CAAC,mBAAmB,MAAM,GAAG;AAChC,sBAAY,KAAK;AAAA,YAChB;AAAA,YACA,SAAS;AAAA,YACT,SAAS,0CAA0C,KAAK,UAAU,MAAM,CAAC;AAAA,UAC1E,CAAC;AACD;AAAA,QACD;AACA,cAAM,OAA0B;AAAA,UAC/B,MAAM;AAAA,UACN,SAAS,CAAC,MAAM;AAAA,UAChB,UAAU,WAAW,QAAQ,WAAW;AAAA,QACzC;AACA,YAAI,WAAW,QAAS,kBAAiB,KAAK,IAAI;AAAA,iBACzC,WAAW,OAAQ,eAAc,KAAK,IAAI;AAAA,YAC9C,eAAc,KAAK,IAAI;AAAA,MAC7B;AACA;AAAA,IACD;AACA,QAAI,mBAAmB,UAAU,GAAG;AACnC,UAAI,eAAe,QAAS,OAAM,KAAK,EAAE,MAAM,iBAAiB,WAAW,CAAC,IAAI,EAAE,CAAC;AACnF,UAAI,eAAe,OAAQ,OAAM,KAAK,EAAE,MAAM,gBAAgB,WAAW,CAAC,IAAI,EAAE,CAAC;AACjF,UAAI,eAAe,OAAO;AACzB,cAAM,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS,IAAI,aAAa,IAAI,CAAC;AAAA,UAC/B,QAAQ;AAAA,UACR,UAAU;AAAA,QACX,CAAC;AAAA,MACF;AACA;AAAA,IACD;AACA,QAAI,OAAO,eAAe,YAAY,eAAe,MAAM;AAC1D,kBAAY,KAAK;AAAA,QAChB;AAAA,QACA,SAAS,gEAAgE,OAAO,UAAU;AAAA,MAC3F,CAAC;AACD;AAAA,IACD;AACA,eAAW,WAAW,OAAO,KAAK,UAAU,EAAE,KAAK,aAAa,GAAG;AAClE,YAAM,SAAS,WAAW,OAAO;AACjC,UAAI,CAAC,mBAAmB,MAAM,GAAG;AAChC,oBAAY,KAAK;AAAA,UAChB;AAAA,UACA;AAAA,UACA,SAAS,0CAA0C,KAAK,UAAU,MAAM,CAAC;AAAA,QAC1E,CAAC;AACD;AAAA,MACD;AACA,UAAI;AACH,YAAI,OAAO,sBAAsB,OAAO,CAAC;AAAA,MAC1C,SAAS,KAAK;AACb,oBAAY,KAAK;AAAA,UAChB;AAAA,UACA;AAAA,UACA,SAAS,0BAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACpF,CAAC;AACD;AAAA,MACD;AACA,UAAI,WAAW,OAAO;AACrB,cAAM,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS,kBAAkB,MAAM,OAAO;AAAA,UACxC,QAAQ;AAAA,UACR,UAAU;AAAA,QACX,CAAC;AACD;AAAA,MACD;AAKA,YAAM,WAAW,iBAAiB,IAAI,IAAI;AAC1C,UAAI,aAAa,QAAW;AAC3B,cAAM,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS,kBAAkB,MAAM,SAAS,MAAM;AAAA,UAChD,QAAQ;AAAA,UACR,UAAU;AAAA,QACX,CAAC;AACD;AAAA,MACD;AACA,YAAM,KAAK,YAAY,MAAM,UAAU,SAAS,MAAM,CAAC;AAAA,IACxD;AAAA,EACD;AASA,QAAM,+BAAoD,CAAC;AAC3D,MAAI,cAAc,SAAS,KAAK,MAAM,SAAS,GAAG;AACjD,UAAM,WAAW,IAAI;AAAA,MACpB;AAAA,QACC,SAAS;AAAA,QACT,OAAO,CAAC,GAAG,KAAK;AAAA,QAChB,oBAAoB;AAAA,QACpB,uBAAuB;AAAA,QACvB,cAAc;AAAA,MACf;AAAA,MACA;AAAA,IACD;AACA,UAAM,eAAe,wBAAC,SAAqC,SAAS,SAAS,IAAI,GAA5D;AACrB,iCAA6B,KAAK;AAAA,MACjC,MAAM;AAAA,MACN,aAAa;AAAA,MACb,QAAQ,wBAAC,SAAU,aAAa,IAAI,EAAE,aAAa,SAAS,SAAS,MAA7D;AAAA,MACR,UAAU,wBAAC,SAAS,aAAa,IAAI,EAAE,QAA7B;AAAA,IACX,CAAC;AAAA,EACF;AACA,QAAM,eAAe;AAAA,IACpB,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACJ;AACA,cAAY,KAAK,GAAG,uBAAuB,cAAc,MAAM,CAAC;AAChE,SAAO,EAAE,OAAO,cAAc,YAAY;AAC3C;AAzJgB;",
+  "names": []
+}

package/dist/chunks/chunk-R7DCDBRN.js

@@ -0,0 +1,106 @@
+import { createRequire as __namzuCreateRequire } from 'node:module';
+const require = __namzuCreateRequire(import.meta.url);
+import {
+  DEFAULT_WSL_MOUNT_ROOT,
+  detectWsl,
+  readWslMountRoot,
+  wslSystem32
+} from "./chunk-2A37JQKY.js";
+import {
+  __name
+} from "./chunk-76FLAFCG.js";
+
+// src/tui/open-browser.ts
+import { spawn } from "node:child_process";
+import { constants, accessSync, existsSync } from "node:fs";
+import { platform } from "node:os";
+import { delimiter, isAbsolute, join } from "node:path";
+function executableOnPath(name, env) {
+  for (const directory of (env.PATH ?? "").split(delimiter)) {
+    if (!directory || !isAbsolute(directory)) continue;
+    const candidate = join(directory, name);
+    try {
+      accessSync(candidate, constants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+__name(executableOnPath, "executableOnPath");
+function wslPowershell(mountRoot = DEFAULT_WSL_MOUNT_ROOT) {
+  return `${wslSystem32(mountRoot)}/WindowsPowerShell/v1.0/powershell.exe`;
+}
+__name(wslPowershell, "wslPowershell");
+var WSL_POWERSHELL = wslPowershell();
+var WSL_OPEN_SCRIPT = [
+  "$ErrorActionPreference = 'Stop'",
+  "Start-Process -FilePath $env:NAMZU_OPEN_URL"
+].join("\n");
+function wslLaunch(url, env, host) {
+  const exists = host.exists ?? existsSync;
+  const mountRoot = host.readFile ? readWslMountRoot(host.readFile) : readWslMountRoot();
+  const wsl = detectWsl(env, { exists, list: /* @__PURE__ */ __name(() => [], "list"), mountRoot });
+  if (!wsl?.interop) return null;
+  const powershell = wslPowershell(mountRoot);
+  if (!exists(powershell)) return null;
+  const passed = (env.WSLENV ?? "").split(":").filter((name) => name && !name.startsWith("NAMZU_OPEN_URL"));
+  return {
+    command: powershell,
+    args: [
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-EncodedCommand",
+      Buffer.from(WSL_OPEN_SCRIPT, "utf16le").toString("base64")
+    ],
+    env: { ...env, NAMZU_OPEN_URL: url, WSLENV: [...passed, "NAMZU_OPEN_URL"].join(":") },
+    // A Windows program started from a Linux directory warns about UNC
+    // paths; the drive PowerShell lives on is a Windows directory.
+    cwd: `${mountRoot}c`
+  };
+}
+__name(wslLaunch, "wslLaunch");
+function launchFor(url, host) {
+  const currentPlatform = host.platform ?? platform();
+  const env = host.env ?? process.env;
+  if (currentPlatform === "win32") {
+    return {
+      command: join(env.SystemRoot ?? "C:\\Windows", "System32", "rundll32.exe"),
+      args: ["url.dll,FileProtocolHandler", url]
+    };
+  }
+  if (currentPlatform === "linux") {
+    const wsl = wslLaunch(url, env, host);
+    if (wsl) return wsl;
+  }
+  const command = executableOnPath(currentPlatform === "darwin" ? "open" : "xdg-open", env);
+  return command ? { command, args: [url] } : null;
+}
+__name(launchFor, "launchFor");
+function openInBrowser(url, host = {}) {
+  if (!/^https?:\/\//i.test(url)) return false;
+  const launch = launchFor(url, host);
+  if (!launch) return false;
+  try {
+    const child = spawn(launch.command, [...launch.args], {
+      stdio: "ignore",
+      detached: true,
+      ...launch.env ? { env: launch.env } : {},
+      ...launch.cwd ? { cwd: launch.cwd } : {}
+    });
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+__name(openInBrowser, "openInBrowser");
+
+export {
+  openInBrowser
+};
+//# sourceMappingURL=chunk-R7DCDBRN.js.map

package/dist/chunks/chunk-R7DCDBRN.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../src/tui/open-browser.ts"],
+  "mappings": ";;;;;;;;;;;;;AAqCA,SAAS,aAAa;AACtB,SAAS,WAAW,YAAY,kBAAkB;AAClD,SAAS,gBAAgB;AACzB,SAAS,WAAW,YAAY,YAAY;AAU5C,SAAS,iBAAiB,MAAc,KAAuC;AAC9E,aAAW,cAAc,IAAI,QAAQ,IAAI,MAAM,SAAS,GAAG;AAG1D,QAAI,CAAC,aAAa,CAAC,WAAW,SAAS,EAAG;AAC1C,UAAM,YAAY,KAAK,WAAW,IAAI;AACtC,QAAI;AACH,iBAAW,WAAW,UAAU,IAAI;AACpC,aAAO;AAAA,IACR,QAAQ;AAAA,IAER;AAAA,EACD;AACA,SAAO;AACR;AAdS;AAiBF,SAAS,cAAc,YAAoB,wBAAgC;AACjF,SAAO,GAAG,YAAY,SAAS,CAAC;AACjC;AAFgB;AAKT,IAAM,iBAAiB,cAAc;AAGrC,IAAM,kBAAkB;AAAA,EAC9B;AAAA,EACA;AACD,EAAE,KAAK,IAAI;AAmBX,SAAS,UAAU,KAAa,KAAwB,MAAkC;AACzF,QAAM,SAAS,KAAK,UAAU;AAG9B,QAAM,YAAY,KAAK,WAAW,iBAAiB,KAAK,QAAQ,IAAI,iBAAiB;AACrF,QAAM,MAAM,UAAU,KAAK,EAAE,QAAQ,MAAM,6BAAM,CAAC,GAAP,SAAU,UAAU,CAAC;AAChE,MAAI,CAAC,KAAK,QAAS,QAAO;AAC1B,QAAM,aAAa,cAAc,SAAS;AAC1C,MAAI,CAAC,OAAO,UAAU,EAAG,QAAO;AAChC,QAAM,UAAU,IAAI,UAAU,IAC5B,MAAM,GAAG,EACT,OAAO,CAAC,SAAS,QAAQ,CAAC,KAAK,WAAW,gBAAgB,CAAC;AAC7D,SAAO;AAAA,IACN,SAAS;AAAA,IACT,MAAM;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,KAAK,iBAAiB,SAAS,EAAE,SAAS,QAAQ;AAAA,IAC1D;AAAA,IACA,KAAK,EAAE,GAAG,KAAK,gBAAgB,KAAK,QAAQ,CAAC,GAAG,QAAQ,gBAAgB,EAAE,KAAK,GAAG,EAAE;AAAA;AAAA;AAAA,IAGpF,KAAK,GAAG,SAAS;AAAA,EAClB;AACD;AA3BS;AA6BT,SAAS,UAAU,KAAa,MAAkC;AACjE,QAAM,kBAAkB,KAAK,YAAY,SAAS;AAClD,QAAM,MAAM,KAAK,OAAO,QAAQ;AAChC,MAAI,oBAAoB,SAAS;AAChC,WAAO;AAAA,MACN,SAAS,KAAK,IAAI,cAAc,eAAe,YAAY,cAAc;AAAA,MACzE,MAAM,CAAC,+BAA+B,GAAG;AAAA,IAC1C;AAAA,EACD;AACA,MAAI,oBAAoB,SAAS;AAChC,UAAM,MAAM,UAAU,KAAK,KAAK,IAAI;AACpC,QAAI,IAAK,QAAO;AAAA,EACjB;AACA,QAAM,UAAU,iBAAiB,oBAAoB,WAAW,SAAS,YAAY,GAAG;AACxF,SAAO,UAAU,EAAE,SAAS,MAAM,CAAC,GAAG,EAAE,IAAI;AAC7C;AAfS;AAiBF,SAAS,cAAc,KAAa,OAAoB,CAAC,GAAY;AAI3E,MAAI,CAAC,gBAAgB,KAAK,GAAG,EAAG,QAAO;AAEvC,QAAM,SAAS,UAAU,KAAK,IAAI;AAClC,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACH,UAAM,QAAQ,MAAM,OAAO,SAAS,CAAC,GAAG,OAAO,IAAI,GAAG;AAAA,MACrD,OAAO;AAAA,MACP,UAAU;AAAA,MACV,GAAI,OAAO,MAAM,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC;AAAA,MACxC,GAAI,OAAO,MAAM,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC;AAAA,IACzC,CAAC;AAKD,UAAM,GAAG,SAAS,MAAM;AAAA,IAAC,CAAC;AAC1B,UAAM,MAAM;AACZ,WAAO;AAAA,EACR,QAAQ;AACP,WAAO;AAAA,EACR;AACD;AA1BgB;",
+  "names": []
+}