@ordewell/core 0.4.7 → 0.4.9

package/dist/index.mjs

@@ -108,7 +108,6 @@ var AUTO_COMMANDS = [
   "pwd",
   "which",
   "type",
-  "env",
   "uname",
   "whoami",
   "cut",
@@ -119,13 +118,1233 @@ var AUTO_COMMANDS = [
   "jq",
   "yq"
 ];
+var UNIVERSAL_FLAGS = ["--help", "--version"];
+var COUNT_FLAG = /^-\d+$/;
+var FLAG_POLICY = {
+  ls: {
+    cluster: true,
+    booleans: [
+      "-1",
+      "-a",
+      "-A",
+      "-b",
+      "-c",
+      "-C",
+      "-d",
+      "-D",
+      "-f",
+      "-F",
+      "-g",
+      "-G",
+      "-h",
+      "-H",
+      "-i",
+      "-k",
+      "-l",
+      "-L",
+      "-m",
+      "-n",
+      "-N",
+      "-o",
+      "-p",
+      "-q",
+      "-Q",
+      "-r",
+      "-R",
+      "-s",
+      "-S",
+      "-t",
+      "-u",
+      "-U",
+      "-v",
+      "-x",
+      "-X",
+      "-Z",
+      "--all",
+      "--almost-all",
+      "--author",
+      "--escape",
+      "--classify",
+      "--file-type",
+      "--full-time",
+      "--no-group",
+      "--human-readable",
+      "--si",
+      "--dereference-command-line",
+      "--inode",
+      "--kibibytes",
+      "--dereference",
+      "--numeric-uid-gid",
+      "--literal",
+      "--hide-control-chars",
+      "--show-control-chars",
+      "--quote-name",
+      "--reverse",
+      "--recursive",
+      "--size",
+      "--directory",
+      "--group-directories-first",
+      "--context",
+      "--zero"
+    ],
+    values: [
+      "-w",
+      "-I",
+      "-T",
+      "--width",
+      "--ignore",
+      "--hide",
+      "--block-size",
+      "--color",
+      "--format",
+      "--sort",
+      "--time",
+      "--time-style",
+      "--indicator-style",
+      "--quoting-style",
+      "--tabsize"
+    ]
+  },
+  tree: {
+    cluster: true,
+    // `-o` is absent on purpose: it is tree's write-to-a-file flag, which the
+    // redirect check never sees because there is no redirect.
+    booleans: [
+      "-a",
+      "-d",
+      "-f",
+      "-i",
+      "-l",
+      "-x",
+      "-C",
+      "-n",
+      "-p",
+      "-s",
+      "-h",
+      "-u",
+      "-g",
+      "-D",
+      "-t",
+      "-c",
+      "-r",
+      "-F",
+      "-q",
+      "-N",
+      "-Q",
+      "-v",
+      "-J",
+      "-X",
+      "-Z",
+      "--noreport",
+      "--dirsfirst",
+      "--du",
+      "--prune",
+      "--matchdirs",
+      "--inodes",
+      "--device",
+      "--si",
+      "--gitignore",
+      "--ignore-case",
+      "--filesfirst",
+      "--nolinks",
+      "--hintro"
+    ],
+    values: [
+      "-L",
+      "-P",
+      "-I",
+      "-H",
+      "--filelimit",
+      "--timefmt",
+      "--charset",
+      "--sort",
+      "--gitfile",
+      "--info",
+      "--prefix"
+    ]
+  },
+  git: {
+    cluster: true,
+    // Absent on purpose, and each for a reason that was demonstrated rather than
+    // guessed at:
+    //   -c, --config-env  set configuration inline, and several configuration
+    //                     keys name a program to run (`core.pager`, `core.editor`,
+    //                     `diff.external`), so this is an execution flag with one
+    //                     indirection in front of it.
+    //   --exec-path       redirects where git finds its helper programs; a
+    //                     fabricated helper ran during an ordinary remote listing.
+    //   -O, --open-files-in-pager  runs an arbitrary named program over search hits.
+    //   --upload-pack, --receive-pack  name the program run on the other end.
+    //   --textconv, --ext-diff  run filters the repository itself configures.
+    //   --git-dir, --work-tree  repoint git at a tree whose configuration is not
+    //                     the one the developer is looking at.
+    //   -o, --output      write a file. `git ls-files -o` is a legitimate spelling
+    //                     of `--others`, but `git archive -o` writes, and the
+    //                     long spelling stays available for the read.
+    booleans: [
+      "-a",
+      "-b",
+      "-E",
+      "-F",
+      "-h",
+      "-H",
+      "-i",
+      "-I",
+      "-l",
+      "-p",
+      "-P",
+      "-q",
+      "-r",
+      "-R",
+      "-s",
+      "-t",
+      "-u",
+      "-v",
+      "-w",
+      "-z",
+      "--oneline",
+      "--graph",
+      "--stat",
+      "--shortstat",
+      "--numstat",
+      "--dirstat",
+      "--summary",
+      "--name-only",
+      "--name-status",
+      "--raw",
+      "--patch",
+      "--no-patch",
+      "--patch-with-stat",
+      "--cached",
+      "--staged",
+      "--porcelain",
+      "--short",
+      "--long",
+      "--branch",
+      "--show-stash",
+      "--show-current",
+      "--all",
+      "--tags",
+      "--heads",
+      "--remotes",
+      "--list",
+      "--verbose",
+      "--quiet",
+      "--abbrev-ref",
+      "--count",
+      "--reverse",
+      "--first-parent",
+      "--no-merges",
+      "--merges",
+      "--follow",
+      "--full-history",
+      "--simplify-merges",
+      "--sparse",
+      "--dense",
+      "--ancestry-path",
+      "--left-right",
+      "--cherry",
+      "--cherry-pick",
+      "--cherry-mark",
+      "--boundary",
+      "--topo-order",
+      "--date-order",
+      "--author-date-order",
+      "--relative-date",
+      "--parents",
+      "--children",
+      "--timestamp",
+      "--no-walk",
+      "--do-walk",
+      "--decorate",
+      "--no-decorate",
+      "--abbrev-commit",
+      "--no-abbrev-commit",
+      "--abbrev",
+      "--no-abbrev",
+      "--color",
+      "--no-color",
+      "--pretty",
+      "--format",
+      "--expand-tabs",
+      "--no-expand-tabs",
+      "--numbered",
+      "--email",
+      "--no-notes",
+      "--notes",
+      "--show-signature",
+      "--find-renames",
+      "--find-copies",
+      "--find-copies-harder",
+      "--break-rewrites",
+      "--no-renames",
+      "--irreversible-delete",
+      "--full-index",
+      "--binary",
+      "--text",
+      "--check",
+      "--exit-code",
+      "--word-diff",
+      "--function-context",
+      "--ignore-all-space",
+      "--ignore-space-change",
+      "--ignore-space-at-eol",
+      "--ignore-blank-lines",
+      "--ignore-cr-at-eol",
+      "--no-prefix",
+      "--default-prefix",
+      "--no-textconv",
+      "--no-ext-diff",
+      "--submodule",
+      "--ignore-submodules",
+      "--recurse-submodules",
+      "--no-recurse-submodules",
+      "--others",
+      "--deleted",
+      "--modified",
+      "--unmerged",
+      "--stage",
+      "--killed",
+      "--ignored",
+      "--exclude-standard",
+      "--error-unmatch",
+      "--full-name",
+      "--directory",
+      "--no-empty-directory",
+      "--untracked-files",
+      "--no-optional-locks",
+      "--no-pager",
+      "--paginate",
+      "--bare",
+      "--literal-pathspecs",
+      "--glob-pathspecs",
+      "--noglob-pathspecs",
+      "--icase-pathspecs",
+      "--line-number",
+      "--column",
+      "--heading",
+      "--no-index",
+      "--untracked",
+      "--no-recursive",
+      "--name-rev",
+      "--root",
+      "--dirty",
+      "--broken",
+      "--always",
+      "--merged",
+      "--no-merged",
+      "--show-toplevel",
+      "--show-cdup",
+      "--git-common-dir",
+      "--absolute-git-dir",
+      "--is-inside-work-tree",
+      "--is-inside-git-dir",
+      "--is-bare-repository",
+      "--symbolic",
+      "--symbolic-full-name",
+      "--verify",
+      "--short-hash",
+      "--textual",
+      "--batch",
+      "--batch-check",
+      "--batch-all-objects",
+      "--buffer",
+      "--follow-symlinks",
+      "--use-mailmap"
+    ],
+    values: [
+      "-n",
+      "-C",
+      "-B",
+      "-M",
+      "-L",
+      "-S",
+      "-G",
+      "-U",
+      "-e",
+      "-m",
+      "-f",
+      "-g",
+      "-x",
+      "-X",
+      "-W",
+      "--max-count",
+      "--skip",
+      "--since",
+      "--after",
+      "--until",
+      "--before",
+      "--author",
+      "--grep",
+      "--grep-reflog",
+      "--committer",
+      "--date",
+      "--diff-filter",
+      "--unified",
+      "--stat-width",
+      "--stat-name-width",
+      "--stat-count",
+      "--word-diff-regex",
+      "--line-prefix",
+      "--src-prefix",
+      "--dst-prefix",
+      "--pickaxe-regex",
+      "--anchored",
+      "--color-moved",
+      "--color-words",
+      "--inter-hunk-context",
+      "--max-parents",
+      "--min-parents",
+      "--simplify-by-decoration",
+      "--glob",
+      "--exclude",
+      "--sort",
+      "--contains",
+      "--points-at",
+      "--decorate-refs",
+      "--decorate-refs-exclude",
+      "--encoding",
+      "--context",
+      "--max-depth",
+      // `--filters` is absent from this list on purpose: it runs the clean and
+      // smudge filters the repository under research configures, which is the
+      // same execution vector as the configuration flag above with a different
+      // spelling.
+      "--and",
+      "--or",
+      "--not",
+      "--all-match",
+      "--threads",
+      "--path"
+    ],
+    patterns: [COUNT_FLAG]
+  },
+  wc: {
+    cluster: true,
+    booleans: [
+      "-c",
+      "-l",
+      "-m",
+      "-w",
+      "-L",
+      "--bytes",
+      "--chars",
+      "--lines",
+      "--words",
+      "--max-line-length",
+      "--total"
+    ]
+  },
+  du: {
+    cluster: true,
+    booleans: [
+      "-0",
+      "-a",
+      "-b",
+      "-c",
+      "-D",
+      "-h",
+      "-H",
+      "-k",
+      "-l",
+      "-L",
+      "-m",
+      "-P",
+      "-s",
+      "-S",
+      "-x",
+      "--all",
+      "--apparent-size",
+      "--bytes",
+      "--total",
+      "--dereference-args",
+      "--human-readable",
+      "--si",
+      "--inodes",
+      "--count-links",
+      "--dereference",
+      "--no-dereference",
+      "--separate-dirs",
+      "--summarize",
+      "--one-file-system",
+      "--null"
+    ],
+    values: [
+      "-d",
+      "-t",
+      "-B",
+      "-X",
+      "--max-depth",
+      "--threshold",
+      "--block-size",
+      "--exclude",
+      "--exclude-from",
+      "--time",
+      "--time-style",
+      "--files0-from"
+    ]
+  },
+  df: {
+    cluster: true,
+    booleans: [
+      "-a",
+      "-h",
+      "-H",
+      "-i",
+      "-k",
+      "-l",
+      "-m",
+      "-P",
+      "-T",
+      "-v",
+      "--all",
+      "--human-readable",
+      "--si",
+      "--inodes",
+      "--local",
+      "--portability",
+      "--print-type",
+      "--total",
+      "--sync",
+      "--no-sync"
+    ],
+    values: ["-B", "-t", "-x", "--block-size", "--type", "--exclude-type"]
+  },
+  file: {
+    cluster: true,
+    // `-C`/`--compile` is absent: it writes a compiled magic file.
+    booleans: [
+      "-b",
+      "-c",
+      "-h",
+      "-i",
+      "-k",
+      "-L",
+      "-n",
+      "-N",
+      "-p",
+      "-r",
+      "-s",
+      "-S",
+      "-v",
+      "-z",
+      "-0",
+      "--brief",
+      "--mime",
+      "--mime-type",
+      "--mime-encoding",
+      "--dereference",
+      "--no-dereference",
+      "--keep-going",
+      "--no-buffer",
+      "--no-pad",
+      "--raw",
+      "--special-files",
+      "--uncompress",
+      "--print0",
+      "--checking-printout"
+    ],
+    values: [
+      "-e",
+      "-m",
+      "-P",
+      "-F",
+      "--exclude",
+      "--magic-file",
+      "--separator",
+      "--parameter",
+      "--extension",
+      "--files-from"
+    ]
+  },
+  head: {
+    cluster: true,
+    booleans: ["-q", "-v", "-z", "--quiet", "--silent", "--verbose", "--zero-terminated"],
+    values: ["-c", "-n", "--bytes", "--lines"],
+    patterns: [COUNT_FLAG]
+  },
+  tail: {
+    cluster: true,
+    booleans: [
+      "-f",
+      "-F",
+      "-q",
+      "-v",
+      "-z",
+      "--follow",
+      "--retry",
+      "--quiet",
+      "--silent",
+      "--verbose",
+      "--zero-terminated"
+    ],
+    values: [
+      "-c",
+      "-n",
+      "-s",
+      "--bytes",
+      "--lines",
+      "--sleep-interval",
+      "--pid",
+      "--max-unchanged-stats"
+    ],
+    patterns: [COUNT_FLAG]
+  },
+  cat: {
+    cluster: true,
+    booleans: [
+      "-A",
+      "-b",
+      "-e",
+      "-E",
+      "-n",
+      "-s",
+      "-t",
+      "-T",
+      "-u",
+      "-v",
+      "--show-all",
+      "--number-nonblank",
+      "--show-ends",
+      "--number",
+      "--squeeze-blank",
+      "--show-tabs",
+      "--show-nonprinting"
+    ]
+  },
+  sort: {
+    cluster: true,
+    // Absent on purpose: `-o`/`--output` writes a file with no redirect for the
+    // redirect check to see, and `--compress-program` names a program that sort
+    // runs over its own temporary files — a permitted binary as an interpreter.
+    booleans: [
+      "-b",
+      "-c",
+      "-C",
+      "-d",
+      "-f",
+      "-g",
+      "-h",
+      "-i",
+      "-M",
+      "-n",
+      "-r",
+      "-R",
+      "-s",
+      "-u",
+      "-V",
+      "-z",
+      "--ignore-leading-blanks",
+      "--check",
+      "--dictionary-order",
+      "--ignore-case",
+      "--general-numeric-sort",
+      "--human-numeric-sort",
+      "--ignore-nonprinting",
+      "--month-sort",
+      "--numeric-sort",
+      "--random-sort",
+      "--reverse",
+      "--stable",
+      "--unique",
+      "--version-sort",
+      "--zero-terminated",
+      "--debug"
+    ],
+    values: [
+      "-k",
+      "-t",
+      "-S",
+      "-T",
+      "--key",
+      "--field-separator",
+      "--buffer-size",
+      "--temporary-directory",
+      "--random-source",
+      "--batch-size",
+      "--parallel",
+      "--sort"
+    ]
+  },
+  uniq: {
+    cluster: true,
+    booleans: [
+      "-c",
+      "-d",
+      "-D",
+      "-i",
+      "-u",
+      "-z",
+      "--count",
+      "--repeated",
+      "--all-repeated",
+      "--ignore-case",
+      "--unique",
+      "--zero-terminated"
+    ],
+    values: ["-f", "-s", "-w", "--skip-fields", "--skip-chars", "--check-chars", "--group"]
+  },
+  // No flag on either runs a program or writes a file, and the planner's
+  // commonest use of `echo` is a section marker — `echo --- files changed ---`
+  // is three tokens that all begin with a dash and none of them is a flag.
+  echo: { freeform: true },
+  printf: { freeform: true },
+  date: {
+    cluster: true,
+    // `-s`/`--set` is absent: it sets the system clock.
+    booleans: [
+      "-u",
+      "-R",
+      "-I",
+      "--utc",
+      "--universal",
+      "--rfc-email",
+      "--rfc-3339",
+      "--iso-8601",
+      "--debug"
+    ],
+    values: ["-d", "-f", "-r", "--date", "--file", "--reference"]
+  },
+  stat: {
+    cluster: true,
+    booleans: ["-f", "-L", "-t", "--file-system", "--terse", "--dereference"],
+    values: ["-c", "--format", "--printf", "--cached"]
+  },
+  basename: {
+    cluster: true,
+    booleans: ["-a", "-z", "--multiple", "--zero"],
+    values: ["-s", "--suffix"]
+  },
+  dirname: {
+    cluster: true,
+    booleans: ["-z", "--zero"]
+  },
+  realpath: {
+    cluster: true,
+    booleans: [
+      "-e",
+      "-m",
+      "-L",
+      "-P",
+      "-q",
+      "-s",
+      "-z",
+      "--canonicalize-existing",
+      "--canonicalize-missing",
+      "--logical",
+      "--physical",
+      "--quiet",
+      "--strip",
+      "--no-symlinks",
+      "--zero"
+    ],
+    values: ["--relative-to", "--relative-base"]
+  },
+  pwd: { cluster: true, booleans: ["-L", "-P", "--logical", "--physical"] },
+  which: { cluster: true, booleans: ["-a", "-s", "--all"] },
+  type: { cluster: true, booleans: ["-a", "-f", "-p", "-P", "-t"] },
+  uname: {
+    cluster: true,
+    booleans: [
+      "-a",
+      "-i",
+      "-m",
+      "-n",
+      "-o",
+      "-p",
+      "-r",
+      "-s",
+      "-v",
+      "--all",
+      "--kernel-name",
+      "--nodename",
+      "--kernel-release",
+      "--kernel-version",
+      "--machine",
+      "--processor",
+      "--hardware-platform",
+      "--operating-system"
+    ]
+  },
+  whoami: {},
+  cut: {
+    cluster: true,
+    // `--output-delimiter` names a separator string, not a file.
+    booleans: ["-n", "-s", "-z", "--only-delimited", "--complement", "--zero-terminated"],
+    values: [
+      "-b",
+      "-c",
+      "-d",
+      "-f",
+      "--bytes",
+      "--characters",
+      "--delimiter",
+      "--fields",
+      "--output-delimiter"
+    ]
+  },
+  nl: {
+    cluster: true,
+    booleans: ["-p", "--no-renumber"],
+    values: [
+      "-b",
+      "-d",
+      "-f",
+      "-h",
+      "-i",
+      "-l",
+      "-n",
+      "-s",
+      "-v",
+      "-w",
+      "--body-numbering",
+      "--section-delimiter",
+      "--footer-numbering",
+      "--header-numbering",
+      "--join-blank-lines",
+      "--line-increment",
+      "--number-format",
+      "--number-separator",
+      "--starting-line-number",
+      "--number-width"
+    ]
+  },
+  rg: {
+    cluster: true,
+    // `--pre` runs a named preprocessor over every file searched and
+    // `--hostname-bin` runs a named program to resolve the hostname; both are
+    // absent, and `--pre-glob` with them.
+    booleans: [
+      "-a",
+      "-c",
+      "-F",
+      "-h",
+      "-H",
+      "-i",
+      "-I",
+      "-l",
+      "-L",
+      "-n",
+      "-N",
+      "-o",
+      "-p",
+      "-P",
+      "-q",
+      "-s",
+      "-S",
+      "-u",
+      "-uu",
+      "-uuu",
+      "-U",
+      "-v",
+      "-V",
+      "-w",
+      "-x",
+      "-z",
+      "--text",
+      "--count",
+      "--count-matches",
+      "--fixed-strings",
+      "--files",
+      "--files-with-matches",
+      "--files-without-match",
+      "--follow",
+      "--hidden",
+      "--no-hidden",
+      "--ignore-case",
+      "--case-sensitive",
+      "--smart-case",
+      "--invert-match",
+      "--line-number",
+      "--no-line-number",
+      "--with-filename",
+      "--no-filename",
+      "--heading",
+      "--no-heading",
+      "--column",
+      "--no-column",
+      "--byte-offset",
+      "--vimgrep",
+      "--json",
+      "--stats",
+      "--trim",
+      "--pretty",
+      "--passthru",
+      "--word-regexp",
+      "--line-regexp",
+      "--multiline",
+      "--multiline-dotall",
+      "--no-multiline",
+      "--crlf",
+      "--null",
+      "--null-data",
+      "--binary",
+      "--search-zip",
+      "--no-ignore",
+      "--no-ignore-dot",
+      "--no-ignore-exclude",
+      "--no-ignore-files",
+      "--no-ignore-global",
+      "--no-ignore-parent",
+      "--no-ignore-vcs",
+      "--no-ignore-messages",
+      "--no-messages",
+      "--no-require-git",
+      "--require-git",
+      "--one-file-system",
+      "--pcre2",
+      "--no-pcre2",
+      "--auto-hybrid-regex",
+      "--line-buffered",
+      "--block-buffered",
+      "--unicode",
+      "--no-unicode",
+      "--unrestricted",
+      "--type-list",
+      "--debug",
+      "--trace",
+      "--include-zero",
+      "--no-context-separator",
+      "--stop-on-nonmatch",
+      "--quiet",
+      "--no-binary"
+    ],
+    values: [
+      "-A",
+      "-B",
+      "-C",
+      "-d",
+      "-e",
+      "-E",
+      "-f",
+      "-g",
+      "-j",
+      "-m",
+      "-M",
+      "-r",
+      "-t",
+      "-T",
+      "--after-context",
+      "--before-context",
+      "--context",
+      "--context-separator",
+      "--field-context-separator",
+      "--field-match-separator",
+      "--regexp",
+      "--file",
+      "--glob",
+      "--iglob",
+      "--glob-case-insensitive",
+      "--type",
+      "--type-not",
+      "--type-add",
+      "--type-clear",
+      "--max-count",
+      "--max-columns",
+      "--max-depth",
+      "--maxdepth",
+      "--max-filesize",
+      "--replace",
+      "--threads",
+      "--encoding",
+      "--engine",
+      "--sort",
+      "--sortr",
+      "--color",
+      "--colors",
+      "--path-separator",
+      "--ignore-file",
+      "--dfa-size-limit",
+      "--regex-size-limit",
+      "--binary-files",
+      "--max-columns-preview"
+    ]
+  },
+  grep: {
+    cluster: true,
+    // `-o` here is `--only-matching`, which writes nothing. It is the same two
+    // characters as `sort -o`, which writes a file — the reason these sets are
+    // per-binary rather than one shared list.
+    booleans: [
+      "-a",
+      "-b",
+      "-c",
+      "-E",
+      "-F",
+      "-G",
+      "-H",
+      "-h",
+      "-i",
+      "-I",
+      "-l",
+      "-L",
+      "-n",
+      "-o",
+      "-P",
+      "-q",
+      "-r",
+      "-R",
+      "-s",
+      "-T",
+      "-U",
+      "-v",
+      "-w",
+      "-x",
+      "-y",
+      "-z",
+      "-Z",
+      "--extended-regexp",
+      "--fixed-strings",
+      "--basic-regexp",
+      "--perl-regexp",
+      "--ignore-case",
+      "--no-ignore-case",
+      "--invert-match",
+      "--word-regexp",
+      "--line-regexp",
+      "--count",
+      "--files-with-matches",
+      "--files-without-match",
+      "--line-number",
+      "--with-filename",
+      "--no-filename",
+      "--only-matching",
+      "--quiet",
+      "--silent",
+      "--no-messages",
+      "--text",
+      "--binary",
+      "--line-buffered",
+      "--null",
+      "--null-data",
+      "--byte-offset",
+      "--recursive",
+      "--dereference-recursive",
+      "--initial-tab",
+      "--unix-byte-offsets",
+      "--no-group-separator",
+      "--color",
+      "--colour"
+    ],
+    values: [
+      "-A",
+      "-B",
+      "-C",
+      "-d",
+      "-D",
+      "-e",
+      "-f",
+      "-m",
+      "--after-context",
+      "--before-context",
+      "--context",
+      "--regexp",
+      "--file",
+      "--max-count",
+      "--devices",
+      "--directories",
+      "--binary-files",
+      "--include",
+      "--exclude",
+      "--exclude-dir",
+      "--exclude-from",
+      "--label",
+      "--group-separator"
+    ]
+  },
+  find: {
+    // No clustering: find spells its flags as single-dash words, so walking the
+    // characters of `-name` would read it as five short flags. And its arguments
+    // are an expression, so `--` does not end them.
+    expressionArgs: true,
+    // Absent on purpose: `-exec`, `-execdir`, `-ok` and `-okdir` run an inner
+    // command (also caught by the named guard below, which says so more
+    // precisely), `-delete` removes files, and `-fprint`, `-fprint0`, `-fprintf`
+    // and `-fls` are find's write family — the same write as `> file` with no
+    // redirect for the redirect check to see.
+    booleans: [
+      "-H",
+      "-L",
+      "-P",
+      "-a",
+      "-and",
+      "-o",
+      "-or",
+      "-not",
+      "-d",
+      "-depth",
+      "-daystart",
+      "-empty",
+      "-executable",
+      "-false",
+      "-follow",
+      "-help",
+      "--help",
+      "-ignore_readdir_race",
+      "-noignore_readdir_race",
+      "-ls",
+      "-mount",
+      "-nogroup",
+      "-noleaf",
+      "-nouser",
+      "-print",
+      "-print0",
+      "-prune",
+      "-quit",
+      "-readable",
+      "-true",
+      "-version",
+      "-writable",
+      "-xdev"
+    ],
+    values: [
+      "-maxdepth",
+      "-mindepth",
+      "-name",
+      "-iname",
+      "-path",
+      "-ipath",
+      "-wholename",
+      "-iwholename",
+      "-regex",
+      "-iregex",
+      "-lname",
+      "-ilname",
+      "-type",
+      "-xtype",
+      "-size",
+      "-newer",
+      "-anewer",
+      "-cnewer",
+      "-mtime",
+      "-mmin",
+      "-ctime",
+      "-cmin",
+      "-atime",
+      "-amin",
+      "-used",
+      "-uid",
+      "-gid",
+      "-user",
+      "-group",
+      "-perm",
+      "-links",
+      "-inum",
+      "-samefile",
+      "-fstype",
+      "-regextype",
+      "-files0-from",
+      "-printf",
+      "-context",
+      "-D"
+    ],
+    // `find -O2` glues the optimisation level on, and `-newermt`/`-newerat` and
+    // friends spell the two comparison fields into the flag name.
+    patterns: [/^-O\d$/, /^-newer[acmBt][acmBt]$/]
+  },
+  jq: {
+    cluster: true,
+    booleans: [
+      "-a",
+      "-c",
+      "-C",
+      "-e",
+      "-h",
+      "-j",
+      "-M",
+      "-n",
+      "-r",
+      "-R",
+      "-s",
+      "-S",
+      "--ascii-output",
+      "--compact-output",
+      "--color-output",
+      "--monochrome-output",
+      "--exit-status",
+      "--join-output",
+      "--null-input",
+      "--raw-input",
+      "--raw-output",
+      "--raw-output0",
+      "--slurp",
+      "--sort-keys",
+      "--seq",
+      "--stream",
+      "--stream-errors",
+      "--tab",
+      "--unbuffered",
+      "--args",
+      "--jsonargs"
+    ],
+    values: [
+      "-f",
+      "-L",
+      "--arg",
+      "--argjson",
+      "--slurpfile",
+      "--rawfile",
+      "--indent",
+      "--from-file"
+    ]
+  },
+  yq: {
+    cluster: true,
+    // `-i`/`--inplace`/`--in-place` rewrite the file, and `-s`/`--split-exp`
+    // writes one file per document. All absent — and all bare or near-bare
+    // booleans, which is why exempting booleans was not an option.
+    booleans: [
+      "-C",
+      "-e",
+      "-h",
+      "-j",
+      "-M",
+      "-n",
+      "-N",
+      "-P",
+      "-r",
+      "-S",
+      "-v",
+      "-y",
+      "-Y",
+      "--colors",
+      "--no-colors",
+      "--exit-status",
+      "--no-doc",
+      "--null-input",
+      "--prettyPrint",
+      "--raw-output",
+      "--sort-keys",
+      "--tojson",
+      "--yaml-output",
+      "--yaml-roundtrip",
+      "--unwrapScalar",
+      "--header-preprocess",
+      "--no-exit-status",
+      "--verbose",
+      "--xml-strict-mode"
+    ],
+    values: [
+      "-I",
+      "-o",
+      "-p",
+      "-L",
+      "--indent",
+      "--output-format",
+      "--input-format",
+      "--expression",
+      "--width",
+      "--xml-attribute-prefix",
+      "--xml-content-name"
+    ]
+  }
+};
 var GIT_READONLY_SUBCOMMANDS = [
   "log",
   "status",
   "diff",
   "show",
   "ls-files",
-  "ls-remote",
   "ls-tree",
   "branch",
   "tag",
@@ -240,6 +1459,26 @@ var REFUSED_SUBCOMMANDS = {
   az: ["login", "logout"],
   terraform: ["apply", "destroy"]
 };
+var SHELL_KEYWORDS = [
+  "{",
+  "}",
+  "if",
+  "then",
+  "elif",
+  "else",
+  "fi",
+  "for",
+  "while",
+  "until",
+  "do",
+  "done",
+  "case",
+  "esac",
+  "select",
+  "function",
+  "time",
+  "export"
+];
 var INTERPRETERS = [
   "sh",
   "bash",
@@ -309,6 +1548,52 @@ var MULTIPLEXERS = [
   "flutter",
   "dart"
 ];
+var HELP_FLAGS = ["--help", "--version"];
+var WRAPPER_FAMILY = {
+  env: {
+    valueFlags: ["-u", "--unset", "-C", "--chdir"],
+    booleanFlags: [
+      "-i",
+      "--ignore-environment",
+      "-0",
+      "--null",
+      "-v",
+      "--debug",
+      // Optional-value flags: see WrapperSpec.booleanFlags.
+      "--block-signal",
+      "--default-signal",
+      "--ignore-signal",
+      "--list-signal-handling",
+      ...HELP_FLAGS
+    ],
+    stringFlags: ["-S", "--split-string"],
+    acceptsAssignments: true
+  },
+  nice: {
+    valueFlags: ["-n", "--adjustment"],
+    booleanFlags: HELP_FLAGS,
+    booleanPattern: /^-\d+$/
+  },
+  timeout: {
+    valueFlags: ["-s", "--signal", "-k", "--kill-after"],
+    booleanFlags: ["--preserve-status", "--foreground", "-v", "--verbose", ...HELP_FLAGS],
+    positionals: 1
+  },
+  nohup: { booleanFlags: HELP_FLAGS },
+  setsid: { booleanFlags: ["-c", "--ctty", "-f", "--fork", "-w", "--wait", "-h", "-V", ...HELP_FLAGS] },
+  stdbuf: {
+    valueFlags: ["-i", "--input", "-o", "--output", "-e", "--error"],
+    booleanFlags: HELP_FLAGS
+  },
+  ionice: {
+    valueFlags: ["-c", "--class", "-n", "--classdata", "-p", "--pid", "-P", "--pgid", "-u", "--uid"],
+    booleanFlags: ["-t", "--ignore", "-h", "-V", ...HELP_FLAGS]
+  },
+  // The multi-call binary ships its own `rm`, `mv` and `sh`, so the refused
+  // name arrives as its first argument.
+  busybox: { booleanFlags: ["--list", "--install", ...HELP_FLAGS] },
+  command: { booleanFlags: ["-p"], noExecFlags: ["-v", "-V"] }
+};
 var POSIX_DIALECT = {
   escape: "\\",
   escapeInQuotes: true,
@@ -523,10 +1808,92 @@ function binaryName(token, dialect) {
   if (dot <= 0) return base;
   return dialect.strippedExtensions.includes(base.slice(dot).toLowerCase()) ? base.slice(0, dot) : base;
 }
+var ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
 function toSegment(tokens, piped, dialect) {
   const rest = [...tokens];
-  while (rest.length > 0 && /^[A-Za-z_][A-Za-z0-9_]*=/.test(rest[0])) rest.shift();
-  return { binary: rest.length > 0 ? binaryName(rest[0], dialect) : "", args: rest.slice(1), piped, expandable: false };
+  const assignments = [];
+  while (rest.length > 0 && ASSIGNMENT.test(rest[0])) assignments.push(rest.shift());
+  return {
+    binary: rest.length > 0 ? binaryName(rest[0], dialect) : "",
+    args: rest.slice(1),
+    assignments,
+    piped,
+    expandable: false
+  };
+}
+function joinedShortFlag(list, token) {
+  if (token.length <= 2) return void 0;
+  return list.find((f) => f.length === 2 && token.startsWith(f));
+}
+function scanWrapperArgs(binary, spec, args) {
+  const valueFlags = spec.valueFlags ?? [];
+  const stringFlags = spec.stringFlags ?? [];
+  const assignments = [];
+  let positionals = spec.positionals ?? 0;
+  let i = 0;
+  while (i < args.length) {
+    const token = args[i];
+    if (token === "--") {
+      i++;
+      break;
+    }
+    if (/^-./.test(token)) {
+      const eq = token.startsWith("--") ? token.indexOf("=") : -1;
+      const name = eq > 0 ? token.slice(0, eq) : token;
+      const selfContained = eq > 0;
+      if ((spec.noExecFlags ?? []).includes(name)) return { kind: "no-exec" };
+      if (stringFlags.includes(name) || joinedShortFlag(stringFlags, token)) {
+        return {
+          kind: "refuse",
+          reason: `"${binary} ${name}" splits a string into a command, which this classifier cannot inspect. Use the read-only research tools, or describe it as a task.`
+        };
+      }
+      if ((spec.booleanFlags ?? []).includes(name) || spec.booleanPattern?.test(token)) {
+        i++;
+        continue;
+      }
+      if (valueFlags.includes(name)) {
+        i += selfContained ? 1 : 2;
+        continue;
+      }
+      if (joinedShortFlag(valueFlags, token)) {
+        i++;
+        continue;
+      }
+      return {
+        kind: "refuse",
+        reason: `"${token}" is not a flag this classifier knows on the wrapper "${binary}", so it cannot tell which command "${binary}" would actually run. Re-run without it.`
+      };
+    }
+    if (spec.acceptsAssignments && ASSIGNMENT.test(token)) {
+      assignments.push(token);
+      i++;
+      continue;
+    }
+    if (positionals > 0) {
+      positionals--;
+      i++;
+      continue;
+    }
+    break;
+  }
+  return { kind: "command", tokens: args.slice(i), assignments };
+}
+function unwrap(seg, dialect) {
+  const wrappers = [];
+  const assignments = [...seg.assignments];
+  let current = seg;
+  while (WRAPPER_FAMILY[current.binary]) {
+    const scan = scanWrapperArgs(current.binary, WRAPPER_FAMILY[current.binary], current.args);
+    if (scan.kind === "refuse") return { seg: { ...current, assignments }, wrappers, reason: scan.reason };
+    if (scan.kind === "no-exec" || scan.tokens.length === 0) break;
+    assignments.push(...scan.assignments);
+    wrappers.push(current.binary);
+    const inner = toSegment(scan.tokens, current.piped, dialect);
+    assignments.push(...inner.assignments);
+    current = { ...inner, assignments: [], expandable: current.expandable };
+  }
+  return { seg: { ...current, assignments }, wrappers };
 }
 function lexAll(command, dialect) {
   const queue = [];
@@ -555,16 +1922,79 @@ function pathLikeArgs(command, opts = {}) {
     return !a.startsWith("-") && looksLikePath(a) ? [a] : [];
   }));
 }
+function matchFlag(spec, booleans, values, token) {
+  if (token.startsWith("--")) {
+    const eq = token.indexOf("=");
+    const name = eq > 0 ? token.slice(0, eq) : token;
+    if (booleans.has(name)) return "boolean";
+    if (values.has(name)) return eq > 0 ? "boolean" : "value";
+    return void 0;
+  }
+  if (booleans.has(token)) return "boolean";
+  if (values.has(token)) return "value";
+  if (spec.patterns?.some((p) => p.test(token))) return "boolean";
+  if (!spec.cluster) return void 0;
+  for (let i = 1; i < token.length; i++) {
+    const short = `-${token[i]}`;
+    if (booleans.has(short)) continue;
+    if (values.has(short)) return i === token.length - 1 ? "value" : "boolean";
+    return void 0;
+  }
+  return "boolean";
+}
+function takesNextToken(next) {
+  if (next === void 0) return false;
+  return !/^-./.test(next) || /^-\d/.test(next);
+}
+function flagLabel(token) {
+  const eq = token.startsWith("--") ? token.indexOf("=") : -1;
+  return eq > 0 ? token.slice(0, eq) : token;
+}
+function scanFlags(seg) {
+  const spec = FLAG_POLICY[seg.binary];
+  if (!spec || spec.freeform) return void 0;
+  const booleans = /* @__PURE__ */ new Set([...spec.booleans ?? [], ...UNIVERSAL_FLAGS]);
+  const values = new Set(spec.values ?? []);
+  const operands = [];
+  let i = 0;
+  while (i < seg.args.length) {
+    const token = seg.args[i];
+    if (token === "--" && !spec.expressionArgs) {
+      operands.push(...seg.args.slice(i + 1));
+      break;
+    }
+    if (!/^-./.test(token)) {
+      operands.push(token);
+      i++;
+      continue;
+    }
+    const shape = matchFlag(spec, booleans, values, token);
+    if (shape === void 0) return { unknown: flagLabel(token), operands };
+    i += shape === "value" && takesNextToken(seg.args[i + 1]) ? 2 : 1;
+  }
+  return { operands };
+}
+function subcommandOf(seg) {
+  const scan = scanFlags(seg);
+  if (scan) return scan.operands[0];
+  return seg.args.find((a) => !a.startsWith("-"));
+}
+var SCOPE_LEAD_ARGS = 2;
 function scopeFor(seg) {
   if (!MULTIPLEXERS.includes(seg.binary)) return seg.binary;
-  const sub = seg.args.find((a) => !a.startsWith("-"));
-  return sub ? `${seg.binary} ${sub}` : seg.binary;
+  const lead = [];
+  for (const arg of seg.args) {
+    if (arg.startsWith("-")) break;
+    lead.push(arg);
+    if (lead.length === SCOPE_LEAD_ARGS) break;
+  }
+  return [seg.binary, ...lead].join(" ");
 }
 function isAuto(seg) {
   if (!AUTO_COMMANDS.includes(seg.binary)) return false;
   if (seg.expandable) return false;
   if (seg.binary !== "git") return true;
-  const sub = seg.args.find((a) => !a.startsWith("-"));
+  const sub = subcommandOf(seg);
   return sub !== void 0 && GIT_READONLY_SUBCOMMANDS.includes(sub);
 }
 function refusalFor(seg) {
@@ -574,20 +2004,32 @@ function refusalFor(seg) {
   if (seg.binary === "eval" || seg.binary === "exec") {
     return `"${seg.binary}" runs a string as a command, which this classifier cannot inspect. Use the read-only research tools, or describe it as a task.`;
   }
+  if (seg.binary === "source" || seg.binary === ".") {
+    return `"${seg.binary}" runs a file's contents as commands, which this classifier cannot inspect. Use the read-only research tools, or describe it as a task.`;
+  }
+  if (SHELL_KEYWORDS.includes(seg.binary)) {
+    return `"${seg.binary}" is a shell keyword or compound-command opener. This classifier only inspects the command that runs first, and a keyword hides the real one from it. Run the inner command directly, or describe it as a task.`;
+  }
   const subs = REFUSED_SUBCOMMANDS[seg.binary];
   if (subs) {
-    const sub = seg.args.find((a) => !a.startsWith("-"));
+    const sub = subcommandOf(seg);
     if (sub && subs.includes(sub)) {
       return `"${seg.binary} ${sub}" changes state or reaches outward. You are a read-only planner \u2014 put it in the plan and let the runner do it.`;
     }
   }
   if (seg.binary === "git") {
-    const sub = seg.args.find((a) => !a.startsWith("-"));
+    const sub = subcommandOf(seg);
     if (sub === "branch" || sub === "tag") {
       const flag = seg.args.find((a) => ["-D", "-d", "-m", "-M", "--delete", "--move"].includes(a));
       if (flag) {
         return `"git ${sub} ${flag}" mutates refs. You are a read-only planner \u2014 describe the change as a task instead.`;
       }
+      const listing = seg.args.includes("-l") || seg.args.includes("--list");
+      const scan2 = scanFlags(seg);
+      const target = scan2?.operands[1];
+      if (!listing && target) {
+        return `"git ${sub} ${target}" creates or moves a ref. You are a read-only planner \u2014 describe the change as a task instead.`;
+      }
     }
   }
   if (seg.binary === "find") {
@@ -611,8 +2053,24 @@ function refusalFor(seg) {
       return `Inline code via "${seg.binary} ${seg.args.find(isInlineCodeFlag)}" is not available to the planner. Use the read-only research tools, or describe it as a task.`;
     }
   }
+  if (seg.assignments.length > 0) {
+    return `The environment assignment "${seg.assignments[0]}" decides what "${seg.binary}" actually does, and this classifier cannot judge the value. Re-run the command without the assignment.`;
+  }
+  const scan = scanFlags(seg);
+  if (scan?.unknown) {
+    return `"${scan.unknown}" is not a flag this classifier knows to be read-only on "${seg.binary}", and flags on otherwise read-only binaries can run a helper program or write a file. Re-run with read-only flags only, or describe the work as a task.`;
+  }
+  if (seg.binary === "uniq" && scan && scan.operands.length > 1) {
+    return `"uniq" writes to its second file argument ("${scan.operands[1]}"). You are a read-only planner \u2014 pipe the output instead of naming an output file, or describe the write as a task.`;
+  }
   return void 0;
 }
+function withWrapperNote(reason, wrappers) {
+  if (wrappers.length === 0) return reason;
+  const quoted = wrappers.map((w) => `"${w}"`);
+  const names = quoted.length > 1 ? `${quoted.slice(0, -1).join(", ")} and ${quoted[quoted.length - 1]}` : quoted[0];
+  return `${reason} Wrapping it in ${names} does not change what runs.`;
+}
 function classifyCommand(command, opts = {}) {
   const trimmed = command.trim();
   if (!trimmed) return { tier: "refuse", scope: "", reason: "Empty command." };
@@ -641,11 +2099,13 @@ function classifyCommand(command, opts = {}) {
     };
   }
   if (segments.length === 0) return { tier: "refuse", scope: "", reason: "No command found." };
-  for (const seg of segments) {
+  const unwrapped = segments.map((seg) => unwrap(seg, dialect));
+  for (const { seg, wrappers, reason: wrapperReason } of unwrapped) {
+    if (wrapperReason) return { tier: "refuse", scope: "", reason: wrapperReason };
     const reason = refusalFor(seg);
-    if (reason) return { tier: "refuse", scope: "", reason };
+    if (reason) return { tier: "refuse", scope: "", reason: withWrapperNote(reason, wrappers) };
   }
-  const nonAuto = segments.filter((s) => !isAuto(s));
+  const nonAuto = unwrapped.map((u) => u.seg).filter((s) => !isAuto(s));
   if (nonAuto.length === 0) return { tier: "auto", scope: "" };
   const scope = [...new Set(nonAuto.map(scopeFor))].sort().join(" + ");
   return { tier: "ask", scope };
@@ -989,6 +2449,139 @@ It is outside the auto-allowed read-only set (${scope}). Continue with the read-
   }
 };
 
+// src/utils/redactSecrets.ts
+var REDACTION_MARKER = "REDACTED";
+function marker(kind, length) {
+  return `[${REDACTION_MARKER} ${kind}: ${length} chars]`;
+}
+var LINE_PREFIX = String.raw`(?:[ \t]*\d+\||[^\s:]*:\d+:|)[ \t]*`;
+var LINE_PREFIX_ANCHORED = new RegExp("^" + LINE_PREFIX);
+var CREDENTIAL_WORD = String.raw`(?:api[_-]?keys?|secrets?|passwords?|passwd|passphrase|tokens?|access[_-]?keys?|private[_-]?keys?|client[_-]?secrets?|credentials?|auth)(?![a-z])`;
+var NAMED_CREDENTIAL = new RegExp(
+  String.raw`((?:^|[^A-Za-z0-9_])["']?[A-Za-z0-9_.\-]*` + CREDENTIAL_WORD + String.raw`[A-Za-z0-9_.\-]*["']?[ \t]*(?:=>|[:=])[ \t]*)(["'\x60]?)([A-Za-z0-9_\-./+=:~!@#%^&*]{8,})\2`,
+  "gi"
+);
+var DOTENV_CREDENTIAL = new RegExp(
+  String.raw`^(` + LINE_PREFIX + String.raw`(?:export[ \t]+)?[A-Z0-9_]*` + CREDENTIAL_WORD.toUpperCase() + String.raw`[A-Z0-9_]*[ \t]*=[ \t]*)(["'\x60]?)([^\s"'\x60]{3,})\2[ \t]*$`,
+  "gm"
+);
+var PROVIDER_KEY_PATTERNS = [
+  // OpenAI / Anthropic / OpenRouter and the many `sk-` derivatives
+  /(?<![A-Za-z0-9])sk-(?:ant-|proj-|or-v1-|live-|test-)?[A-Za-z0-9_-]{20,}/g,
+  // GitHub personal-access, OAuth, app and refresh tokens
+  /(?<![A-Za-z0-9])(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{22,}/g,
+  // Slack bot / user / app tokens
+  /(?<![A-Za-z0-9])xox[abprse]-[A-Za-z0-9-]{10,}/g,
+  // Stripe secret and restricted keys
+  /(?<![A-Za-z0-9])[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/g,
+  // Google API keys and OAuth access tokens
+  /(?<![A-Za-z0-9])AIza[A-Za-z0-9_-]{30,}/g,
+  /(?<![A-Za-z0-9])ya29\.[A-Za-z0-9_-]{20,}/g,
+  // npm, Hugging Face, Groq, GitLab, DigitalOcean, Shopify
+  /(?<![A-Za-z0-9])(?:npm|hf|gsk|glpat|dop_v1|shpat|shpss)[_-][A-Za-z0-9]{20,}/g,
+  /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}/g,
+  // Three-segment JWTs, whose payload segment is base64 for `{"`
+  /(?<![A-Za-z0-9])eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g
+];
+var CLOUD_ACCESS_KEY_ID = /(?<![A-Za-z0-9])(?:A3T[A-Z0-9]{2}|AKIA|ASIA|ABIA|ACCA|AGPA|AIDA|AIPA|ANPA|ANVA|AROA)[A-Z0-9]{16}(?![A-Za-z0-9])/g;
+var PEM_BEGIN = /-----BEGIN ((?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?)-----/;
+var PEM_BODY_LINE = /^[A-Za-z0-9+/=:,.\- \t]*$/;
+function redactPrivateKeyBlocks(text) {
+  if (!PEM_BEGIN.test(text)) return text;
+  const out = [];
+  let label = null;
+  let bodyChars = 0;
+  const closeBlock = () => {
+    if (label === null) return;
+    out.push(marker("private key", bodyChars));
+    label = null;
+    bodyChars = 0;
+  };
+  for (const line of text.split("\n")) {
+    if (label === null) {
+      out.push(line);
+      const begun = PEM_BEGIN.exec(line);
+      if (begun) label = begun[1];
+      continue;
+    }
+    const content = line.replace(LINE_PREFIX_ANCHORED, "");
+    if (content.includes(`-----END ${label}-----`)) {
+      closeBlock();
+      out.push(line);
+    } else if (PEM_BODY_LINE.test(content)) {
+      bodyChars += content.trim().length;
+    } else {
+      closeBlock();
+      out.push(line);
+    }
+  }
+  closeBlock();
+  return out.join("\n");
+}
+var NUMERIC = /^[-+]?\d+(?:\.\d+)?$/;
+var IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+var MEMBER_EXPRESSION = /^[A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)+$/;
+var SLUG = /^[a-z]+(?:[-_][a-z]+)+$/;
+var PATHISH = /^(?:\.{0,2}\/|~\/)/;
+var URLISH = /^[a-z][a-z0-9+.-]*:\/\//i;
+var CODE_KEYWORDS = /* @__PURE__ */ new Set([
+  "true",
+  "false",
+  "null",
+  "none",
+  "nil",
+  "undefined",
+  "void",
+  "string",
+  "number",
+  "boolean",
+  "object",
+  "any",
+  "unknown",
+  "bool",
+  "str",
+  "int"
+]);
+var UNAMBIGUOUS_CREDENTIAL_NAME = /(?:password|passwd|passphrase|secret|credentials?|private[_-]?key)/i;
+function looksLikeKeyMaterial(value) {
+  const hasDigit = /\d/.test(value);
+  const hasAlpha = /[A-Za-z]/.test(value);
+  const mixedCase = /[a-z]/.test(value) && /[A-Z]/.test(value);
+  return hasDigit && hasAlpha || mixedCase || value.length >= 24;
+}
+function looksLikeCode(value) {
+  return NUMERIC.test(value) || CODE_KEYWORDS.has(value.toLowerCase()) || MEMBER_EXPRESSION.test(value) || PATHISH.test(value) || URLISH.test(value);
+}
+function trimTrailingPunctuation(value) {
+  const match = /[.:!]+$/.exec(value);
+  if (!match || match.index === 0) return { value, tail: "" };
+  return { value: value.slice(0, match.index), tail: match[0] };
+}
+function redactSecrets(text) {
+  if (!text) return text;
+  let out = redactPrivateKeyBlocks(text);
+  out = out.replace(DOTENV_CREDENTIAL, (full, head, quote, value) => {
+    if (looksLikeCode(value) || value.startsWith("$")) return full;
+    return `${head}${quote}${marker("credential", value.length)}${quote}`;
+  });
+  out = out.replace(NAMED_CREDENTIAL, (full, head, quote, raw) => {
+    const { value, tail } = trimTrailingPunctuation(raw);
+    if (value.length < 8) return full;
+    if (looksLikeCode(value) || value.startsWith("$")) return full;
+    if (UNAMBIGUOUS_CREDENTIAL_NAME.test(head) && /\d/.test(value)) {
+      return `${head}${quote}${marker("credential", value.length)}${quote}${tail}`;
+    }
+    if (IDENTIFIER.test(value) || SLUG.test(value)) return full;
+    if (!UNAMBIGUOUS_CREDENTIAL_NAME.test(head) && !looksLikeKeyMaterial(value)) return full;
+    return `${head}${quote}${marker("credential", value.length)}${quote}${tail}`;
+  });
+  for (const pattern of PROVIDER_KEY_PATTERNS) {
+    out = out.replace(pattern, (hit) => marker("api key", hit.length));
+  }
+  out = out.replace(CLOUD_ACCESS_KEY_ID, (hit) => marker("access key id", hit.length));
+  return out;
+}
+
 // src/services/executeTool.ts
 var GREP_OUTPUT_MODES = ["content", "files", "count"];
 function num(value) {
@@ -1015,6 +2608,10 @@ function grepOptions(args) {
 }
 var STOPPED_TOOL_RESULT = "Stopped by the user \u2014 this call was not executed, and no further tool calls will run this turn.";
 async function executeTool(name, args, fs10, fetcher, signal) {
+  const outcome = await runTool(name, args, fs10, fetcher, signal);
+  return { ...outcome, output: redactSecrets(outcome.output) };
+}
+async function runTool(name, args, fs10, fetcher, signal) {
   if (signal?.aborted) return { success: false, output: STOPPED_TOOL_RESULT, truncated: false };
   switch (name) {
     case "read_file": {
@@ -1144,14 +2741,14 @@ var PendingApprovals = class {
   ask(request) {
     const id = `ap-${Date.now()}-${counter++}`;
     const pending = { id, request, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       const settle = (granted) => {
         const entry = this.entries.get(id);
         if (!entry) return;
         clearTimeout(entry.timer);
         this.entries.delete(id);
         this.opts.onSettled?.(id, granted);
-        resolve3(granted);
+        resolve4(granted);
       };
       const timer = setTimeout(() => settle(false), this.opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
       timer.unref?.();
@@ -4350,11 +5947,11 @@ function composeAugmentedPrompt(task, allTasks, opts) {
   if (isHitlTask(task)) {
     blocks.push(renderCheckpointInstruction());
   }
-  const marker = renderCompletionMarker(task);
-  if (blocks.length === 0) return basePrompt + marker;
+  const marker2 = renderCompletionMarker(task);
+  if (blocks.length === 0) return basePrompt + marker2;
   return `${blocks.join("\n\n")}
 
-${basePrompt}${marker}`;
+${basePrompt}${marker2}`;
 }
 
 // src/services/VerdictEngine.ts
@@ -5791,28 +7388,28 @@ function posixBinDirs() {
   ];
 }
 function windowsBinDirs(env, home) {
-  const join14 = (...parts) => path5.win32.join(...parts);
-  const under = (base, ...parts) => base ? [join14(base, ...parts)] : [];
+  const join16 = (...parts) => path5.win32.join(...parts);
+  const under = (base, ...parts) => base ? [join16(base, ...parts)] : [];
   const appData = env.APPDATA;
   const localAppData = env.LOCALAPPDATA;
   const programData = env.ProgramData;
   return [
     // Native per-user installers, PowerShell-driven and otherwise.
-    join14(home, ".local", "bin"),
-    join14(home, ".opencode", "bin"),
-    join14(home, ".claude", "bin"),
-    join14(home, ".codex", "bin"),
+    join16(home, ".local", "bin"),
+    join16(home, ".opencode", "bin"),
+    join16(home, ".claude", "bin"),
+    join16(home, ".codex", "bin"),
     ...under(localAppData, "Programs", "claude"),
     // Node package managers. npm's global prefix is `%APPDATA%\npm`; the
     // literal spelling is kept as a fallback for a host that does not export
     // APPDATA (a service account, a stripped CI container).
     ...under(appData, "npm"),
-    join14(home, "AppData", "Roaming", "npm"),
+    join16(home, "AppData", "Roaming", "npm"),
     ...under(localAppData, "pnpm"),
     ...under(localAppData, "Yarn", "bin"),
-    join14(home, ".bun", "bin"),
+    join16(home, ".bun", "bin"),
     // Windows package managers.
-    join14(home, "scoop", "shims"),
+    join16(home, "scoop", "shims"),
     ...under(env.SCOOP, "shims"),
     ...under(env.SCOOP_GLOBAL ?? programData, "scoop", "shims"),
     ...under(programData, "chocolatey", "bin"),
@@ -5822,7 +7419,7 @@ function windowsBinDirs(env, home) {
     ...under(localAppData, "Microsoft", "WindowsApps"),
     // Version managers. Volta's Windows home is not the POSIX `~/.volta`.
     ...under(localAppData, "Volta", "bin"),
-    join14(home, ".volta", "bin")
+    join16(home, ".volta", "bin")
   ];
 }
 function wellKnownBinDirs(deps = {}) {
@@ -6123,7 +7720,7 @@ var defaultAppServerClient = async (command, args, options) => {
   const PATH = await augmentedPath();
   const launch = await planDirectLaunch(command, args).catch(() => null);
   if (!launch) return null;
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let child;
     try {
       child = spawn(launch.file, launch.args, {
@@ -6132,7 +7729,7 @@ var defaultAppServerClient = async (command, args, options) => {
         windowsVerbatimArguments: launch.verbatim
       });
     } catch {
-      resolve3(null);
+      resolve4(null);
       return;
     }
     let settled = false;
@@ -6141,7 +7738,7 @@ var defaultAppServerClient = async (command, args, options) => {
       settled = true;
       clearTimeout(timer);
       killTree(child);
-      resolve3(value);
+      resolve4(value);
     };
     const timer = setTimeout(() => finish(null), options?.timeout ?? 2e4);
     child.on("error", () => finish(null));
@@ -7181,11 +8778,71 @@ var RunnerInstallation = class {
   }
 };
 
+// src/services/settingsEnvAllowlist.ts
+var ORDEWELL_SETTABLE_ENV = [
+  "AI_PROVIDER",
+  "ORCHESTRATOR_MODEL",
+  "ORDEWELL_SUBAGENT_MODEL",
+  "ORDEWELL_PLANNER_EFFORT",
+  "ORDEWELL_RESEARCH_ENABLED",
+  "ORDEWELL_MAX_PARALLEL"
+];
+var SETTINGS_ENV_REFUSED = [
+  // Approval posture and pre-approved scope.
+  "ORDEWELL_AUTONOMOUS_MODE",
+  "ORDEWELL_APPROVAL_MODE",
+  "ORDEWELL_APPROVAL_ALLOW",
+  // Where settings are persisted.
+  "ORDEWELL_SETTINGS_PATH",
+  // Runtime options and dynamic loaders.
+  "NODE_OPTIONS",
+  "NODE_REPL_EXTERNAL_MODULE",
+  "NODE_PATH",
+  "ELECTRON_RUN_AS_NODE",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "LD_AUDIT",
+  "DYLD_INSERT_LIBRARIES",
+  "DYLD_LIBRARY_PATH",
+  "DYLD_FRAMEWORK_PATH",
+  // Executable resolution.
+  "PATH",
+  "PATHEXT",
+  "NODE"
+];
+var REFUSED = new Set(SETTINGS_ENV_REFUSED);
+function providerEnvKeys() {
+  const keys = [];
+  for (const meta of Object.values(ALL_PROVIDERS)) {
+    if (meta.apiKeyEnvVar) keys.push(meta.apiKeyEnvVar);
+    if (meta.baseUrlEnvVar) keys.push(meta.baseUrlEnvVar);
+    for (const detect of meta.detectEnvVars) keys.push(detect);
+  }
+  return keys;
+}
+var PROVIDER_CREDENTIAL_ENV = new Set(providerEnvKeys());
+var SETTINGS_ENV_ALLOWLIST = new Set(
+  [...providerEnvKeys(), ...ORDEWELL_SETTABLE_ENV].filter((key) => !REFUSED.has(key))
+);
+function admitSettingsEnv(env) {
+  const accepted = {};
+  const rejected = [];
+  for (const [key, value] of Object.entries(env)) {
+    if (REFUSED.has(key) || !SETTINGS_ENV_ALLOWLIST.has(key) || typeof value !== "string") {
+      rejected.push(key);
+      continue;
+    }
+    accepted[key] = value;
+  }
+  return { accepted, rejected };
+}
+
 // src/services/harness/CliAgentAiService.ts
 import { spawn as nodeSpawn } from "child_process";
 
 // src/utils/workspace.ts
 import * as fs3 from "fs";
+import * as path9 from "path";
 var WorkspaceNotFoundError = class extends Error {
   constructor(workspace) {
     super(`Workspace "${workspace}" does not exist.`);
@@ -7205,6 +8862,46 @@ function assertWorkspaceExists(workspace, deps = {}) {
   const isDirectory = deps.isDirectory ?? defaultIsDirectory;
   if (!isDirectory(workspace)) throw new WorkspaceNotFoundError(workspace);
 }
+var WorkspaceNotAProjectError = class extends Error {
+  constructor(workspace) {
+    super(`Workspace "${workspace}" is not a project directory (no .ordewell state, version control, or recognized manifest found).`);
+    this.workspace = workspace;
+    this.name = "WorkspaceNotAProjectError";
+  }
+  workspace;
+};
+var PROJECT_MARKER_DIRS = [".ordewell", ".git", ".hg", ".svn", ".bzr"];
+var PROJECT_MARKER_FILES = [
+  "package.json",
+  "Cargo.toml",
+  "go.mod",
+  "pyproject.toml",
+  "setup.py",
+  "requirements.txt",
+  "Pipfile",
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  "Gemfile",
+  "composer.json",
+  "pubspec.yaml",
+  "mix.exs",
+  "CMakeLists.txt"
+];
+function assertWorkspaceIsProject(workspace, deps = {}) {
+  const realpath = deps.realpath ?? ((candidate) => fs3.realpathSync(candidate));
+  const exists = deps.exists ?? ((candidate) => fs3.existsSync(candidate));
+  let resolved;
+  try {
+    resolved = realpath(workspace);
+  } catch {
+    throw new WorkspaceNotAProjectError(workspace);
+  }
+  const hasMarker = [...PROJECT_MARKER_DIRS, ...PROJECT_MARKER_FILES].some(
+    (marker2) => exists(path9.join(resolved, marker2))
+  );
+  if (!hasMarker) throw new WorkspaceNotAProjectError(workspace);
+}
 
 // src/services/harness/AgentAdapter.ts
 var LineBuffer = class {
@@ -7260,8 +8957,8 @@ var StdioAgentAdapter = class {
   }
   async start(opts) {
     assertWorkspaceExists(opts.cwd, { isDirectory: this.deps.isDirectory });
-    this.processEnded = new Promise((resolve3) => {
-      this.markEnded = resolve3;
+    this.processEnded = new Promise((resolve4) => {
+      this.markEnded = resolve4;
     });
     const spec = this.spawnSpec(opts);
     const resolvePath = this.deps.resolvePath ?? augmentedPath;
@@ -7309,7 +9006,7 @@ ${err.message}`).slice(-STDERR_TAIL_CHARS);
       onEvent({ type: "error", message: this.exitMessage() });
       return;
     }
-    await new Promise((resolve3) => {
+    await new Promise((resolve4) => {
       let settled = false;
       const finish = () => {
         if (settled) return;
@@ -7318,7 +9015,7 @@ ${err.message}`).slice(-STDERR_TAIL_CHARS);
         signal?.removeEventListener("abort", onAbort);
         this.process?.removeListener("exit", onExit);
         this.process?.removeListener("error", onExit);
-        resolve3();
+        resolve4();
       };
       const emit = (event) => {
         onEvent(event);
@@ -7519,14 +9216,14 @@ function codexSandboxUnavailableMessage() {
   ].join("\n");
 }
 function runProbe(deps, cwd, env, flags) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let output = "";
     let settled = false;
     const finish = (code) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve3({ code, output });
+      resolve4({ code, output });
     };
     const timer = setTimeout(() => finish(null), PROBE_TIMEOUT_MS);
     timer.unref?.();
@@ -7609,8 +9306,8 @@ var CodexAdapter = class extends StdioAgentAdapter {
   async handshake(opts) {
     this.sandbox = await probeCodexSandbox(this.deps, opts.cwd, this.spawnEnv);
     if (this.sandbox === "unavailable") throw new Error(codexSandboxUnavailableMessage());
-    const ready = new Promise((resolve3) => {
-      this.settleHandshake = resolve3;
+    const ready = new Promise((resolve4) => {
+      this.settleHandshake = resolve4;
     });
     this.writeLine({
       jsonrpc: "2.0",
@@ -7623,8 +9320,8 @@ var CodexAdapter = class extends StdioAgentAdapter {
       // A binary that rejects `app-server` outright dies immediately; waiting
       // out the timeout would turn a one-line diagnostic into a 30s stall.
       this.processEnded.then(() => false),
-      new Promise((resolve3) => {
-        const t = setTimeout(() => resolve3(false), HANDSHAKE_TIMEOUT_MS);
+      new Promise((resolve4) => {
+        const t = setTimeout(() => resolve4(false), HANDSHAKE_TIMEOUT_MS);
         t.unref?.();
       })
     ]);
@@ -7912,12 +9609,12 @@ var OpenCodeAdapter = class {
       cwd: opts.cwd,
       windowsVerbatimArguments: launch.verbatim
     });
-    const banner = new Promise((resolve3) => {
+    const banner = new Promise((resolve4) => {
       let seen = "";
       const scan = (chunk) => {
         seen += chunk.toString();
         const match = seen.match(/https?:\/\/[^\s]+/);
-        if (match) resolve3(match[0].replace(/[.,)]$/, ""));
+        if (match) resolve4(match[0].replace(/[.,)]$/, ""));
       };
       this.process.stdout?.on("data", scan);
       this.process.stderr?.on("data", (chunk) => {
@@ -7926,15 +9623,15 @@ var OpenCodeAdapter = class {
       });
       this.process.on("exit", () => {
         this.exited = true;
-        resolve3(null);
+        resolve4(null);
       });
       this.process.on("error", (err) => {
         this.exited = true;
         this.stderrTail = (this.stderrTail + `
 ${err.message}`).slice(-STDERR_TAIL_CHARS2);
-        resolve3(null);
+        resolve4(null);
       });
-      const timer = setTimeout(() => resolve3(null), SERVER_READY_TIMEOUT_MS);
+      const timer = setTimeout(() => resolve4(null), SERVER_READY_TIMEOUT_MS);
       timer.unref?.();
     });
     this.baseUrl = await banner;
@@ -7964,8 +9661,8 @@ ${this.stderrTail.trim()}` : ""}`);
     const streamAbort = new AbortController();
     let connected = () => {
     };
-    const streamReady = new Promise((resolve3) => {
-      connected = resolve3;
+    const streamReady = new Promise((resolve4) => {
+      connected = resolve4;
     });
     const live = this.streamEvents(
       streamAbort.signal,
@@ -8117,14 +9814,14 @@ ${this.stderrTail.trim()}` : ""}`);
       }
     }
   }
-  async json(method, path15, body, signal) {
-    const response = await this.deps.fetch(`${this.baseUrl}${path15}`, {
+  async json(method, path17, body, signal) {
+    const response = await this.deps.fetch(`${this.baseUrl}${path17}`, {
       method,
       headers: { "content-type": "application/json" },
       ...body === void 0 ? {} : { body: JSON.stringify(body) },
       ...signal ? { signal } : {}
     });
-    if (!response.ok) throw new Error(`${method} ${path15} failed: ${response.status} ${response.statusText}`);
+    if (!response.ok) throw new Error(`${method} ${path17} failed: ${response.status} ${response.statusText}`);
     return await response.json().catch(() => null);
   }
   nativeSessionId() {
@@ -8421,7 +10118,8 @@ var CliAgentAiService = class {
     let stepIndex = 0;
     const truncate = (value) => value.length > LOG_MAX_CHARS ? `${value.slice(0, LOG_MAX_CHARS)}
 [... truncated, total ${value.length} chars]` : value;
-    const settle = (id, output, success, outcome) => {
+    const settle = (id, rawOutput, success, outcome) => {
+      const output = redactSecrets(rawOutput);
       const call = pendingCalls.get(id);
       pendingCalls.delete(id);
       const step = {
@@ -8938,11 +10636,11 @@ function executionSummary(tasks) {
 
 // src/utils/sessionStore.ts
 import * as fs5 from "fs";
-import * as path10 from "path";
+import * as path11 from "path";
 
 // src/utils/fsHelpers.ts
 import * as fs4 from "fs";
-import * as path9 from "path";
+import * as path10 from "path";
 var STATE_DIR = ".ordewell";
 function ensureDir(dir) {
   if (!fs4.existsSync(dir)) {
@@ -8950,13 +10648,29 @@ function ensureDir(dir) {
   }
 }
 function getStateDir(baseDir) {
-  return path9.join(baseDir ?? process.cwd(), STATE_DIR);
+  return path10.join(baseDir ?? process.cwd(), STATE_DIR);
+}
+var IGNORE_FILE = ".gitignore";
+function ensureStateDirIgnored(baseDir) {
+  const dir = getStateDir(baseDir);
+  ensureDir(dir);
+  try {
+    fs4.writeFileSync(path10.join(dir, IGNORE_FILE), "*\n", { flag: "wx" });
+  } catch (err) {
+    if (err.code !== "EEXIST") throw err;
+  }
+}
+
+// src/utils/sessionId.ts
+import { randomBytes } from "crypto";
+function mintSessionId() {
+  return `session-${randomBytes(16).toString("hex")}`;
 }
 
 // src/utils/sessionStore.ts
 var SESSIONS_SUBDIR = "sessions";
 function getSessionsDir(baseDir) {
-  return path10.join(getStateDir(baseDir), SESSIONS_SUBDIR);
+  return path11.join(getStateDir(baseDir), SESSIONS_SUBDIR);
 }
 var REJECTION_MESSAGE = "This session was created with an older version of Ordewell. Please re-plan.";
 function hasScalarRunner(parsed) {
@@ -8975,9 +10689,10 @@ function sessionFilename(session) {
 function saveSession(plan, goal, baseDir, id) {
   const sessionsDir = getSessionsDir(baseDir);
   ensureDir(sessionsDir);
+  ensureStateDirIgnored(baseDir);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const meta = {
-    id: id || `session-${Date.now()}`,
+    id: id || mintSessionId(),
     goal: goal || "(untitled)",
     runners: plan.runners,
     taskCount: plan.tasks.flatMap((t) => [t, ...t.subtasks || []]).length,
@@ -8990,7 +10705,7 @@ function saveSession(plan, goal, baseDir, id) {
     plan: JSON.parse(JSON.stringify(plan))
   };
   const filename = sessionFilename(meta);
-  const filePath = path10.join(sessionsDir, filename);
+  const filePath = path11.join(sessionsDir, filename);
   fs5.writeFileSync(filePath, JSON.stringify(session, null, 2));
   return meta;
 }
@@ -9000,7 +10715,7 @@ function listSessions(baseDir, logger = defaultLogger) {
   const files = fs5.readdirSync(sessionsDir).filter((f) => f.endsWith(".json"));
   return files.map((f) => {
     try {
-      const raw = fs5.readFileSync(path10.join(sessionsDir, f), "utf-8");
+      const raw = fs5.readFileSync(path11.join(sessionsDir, f), "utf-8");
       const parsed = JSON.parse(raw);
       if (hasScalarRunner(parsed)) {
         logger.warn("sessionStore", `session file ${f}: ${REJECTION_MESSAGE}`);
@@ -9018,7 +10733,7 @@ function findSessionFile(sessionsDir, sessionId, logger) {
   const files = fs5.readdirSync(sessionsDir).filter((f) => f.endsWith(".json"));
   for (const f of files) {
     try {
-      const raw = fs5.readFileSync(path10.join(sessionsDir, f), "utf-8");
+      const raw = fs5.readFileSync(path11.join(sessionsDir, f), "utf-8");
       const session = JSON.parse(raw);
       if (session.meta.id === sessionId) return f;
     } catch (err) {
@@ -9033,7 +10748,7 @@ function loadSession(sessionId, baseDir, logger = defaultLogger) {
   try {
     const file = findSessionFile(sessionsDir, sessionId, logger);
     if (file) {
-      const raw = fs5.readFileSync(path10.join(sessionsDir, file), "utf-8");
+      const raw = fs5.readFileSync(path11.join(sessionsDir, file), "utf-8");
       const parsed = JSON.parse(raw);
       if (hasScalarRunner(parsed)) {
         logger.warn("sessionStore", `session file ${file}: ${REJECTION_MESSAGE}`);
@@ -9067,7 +10782,7 @@ function deleteSession(sessionId, baseDir, logger = defaultLogger) {
   try {
     const file = findSessionFile(sessionsDir, sessionId, logger);
     if (file) {
-      fs5.unlinkSync(path10.join(sessionsDir, file));
+      fs5.unlinkSync(path11.join(sessionsDir, file));
       return true;
     }
   } catch (err) {
@@ -9086,11 +10801,6 @@ var PlanEditError = class extends Error {
 function sessionRuntimeSettings(settings) {
   return { ...plannerRuntimeToggles(settings), modelAllowlist: settings.modelAllowlist };
 }
-var lastMintedAt = 0;
-function mintSessionId() {
-  lastMintedAt = Math.max(Date.now(), lastMintedAt + 1);
-  return `session-${lastMintedAt}`;
-}
 var Session = class {
   /** Injected by a test; when present it is the service, forever. */
   pinnedAiService;
@@ -10531,8 +12241,8 @@ var HeadlessRunner = class extends AbstractRunner {
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify4 } from "util";
 import { tmpdir } from "os";
-import { join as join9 } from "path";
-import { existsSync as existsSync5, readFileSync as readFileSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
+import { join as join10 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
 
 // src/utils/tmux.ts
 import { execSync as execSync2 } from "child_process";
@@ -10623,7 +12333,7 @@ var TmuxSession = class extends AbstractTerminalSession {
    * lets the user keep poking at a finished task's terminal.
    */
   async start(command, args, cwd, env) {
-    writeFileSync5(this.logPath, "");
+    writeFileSync6(this.logPath, "");
     const envAssignments = Object.entries(env ?? {}).map(([k, v]) => `${k}=${posixShellQuote(v)}`).join(" ");
     const inner = [command, ...args].map(posixShellQuote).join(" ");
     const prefix = envAssignments ? `env ${envAssignments} ` : "";
@@ -10637,7 +12347,7 @@ var TmuxSession = class extends AbstractTerminalSession {
     if (this.exited) return;
     let content;
     try {
-      content = existsSync5(this.logPath) ? readFileSync4(this.logPath, "utf8") : "";
+      content = existsSync6(this.logPath) ? readFileSync4(this.logPath, "utf8") : "";
     } catch {
       return;
     }
@@ -10816,7 +12526,7 @@ var TmuxRunner = class extends AbstractRunner {
       windowName,
       this.execFileImpl,
       this.pollIntervalMs,
-      join9(this.logDir, `${id}.log`),
+      join10(this.logDir, `${id}.log`),
       this.socket
     );
     invocation.env = { ...invocation.env, PATH: await this.resolvePath() };
@@ -10826,26 +12536,128 @@ var TmuxRunner = class extends AbstractRunner {
   }
 };
 
+// src/utils/daemonToken.ts
+import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { closeSync, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync5, unlinkSync as unlinkSync3, writeSync } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join11 } from "path";
+var BEARER_PREFIX = "bearer ";
+var DAEMON_TOKEN_SUBPROTOCOL_PREFIX = "ordewell.token.";
+var DAEMON_SUBPROTOCOL = "ordewell.v1";
+function configDir() {
+  return join11(homedir5(), ".config", "ordewell");
+}
+function daemonTokenPath(port) {
+  return join11(configDir(), `server-${port}.token`);
+}
+function mintDaemonToken(port) {
+  const token = randomBytes2(32).toString("base64url");
+  const file = daemonTokenPath(port);
+  mkdirSync5(configDir(), { recursive: true });
+  try {
+    unlinkSync3(file);
+  } catch {
+  }
+  const fd = openSync(file, "wx", 384);
+  try {
+    writeSync(fd, token);
+  } finally {
+    closeSync(fd);
+  }
+  return { token, file };
+}
+function readDaemonToken(port) {
+  try {
+    const token = readFileSync5(daemonTokenPath(port), "utf8").trim();
+    return token === "" ? void 0 : token;
+  } catch {
+    return void 0;
+  }
+}
+function clearDaemonToken(port) {
+  try {
+    unlinkSync3(daemonTokenPath(port));
+  } catch {
+  }
+}
+function bearerHeaderValue(token) {
+  return `Bearer ${token}`;
+}
+function tokenSubprotocols(token) {
+  return [DAEMON_SUBPROTOCOL, `${DAEMON_TOKEN_SUBPROTOCOL_PREFIX}${token}`];
+}
+function extractPresentedToken(carriers) {
+  const authorization = carriers.authorization;
+  if (authorization && authorization.toLowerCase().startsWith(BEARER_PREFIX)) {
+    const value = authorization.slice(BEARER_PREFIX.length).trim();
+    if (value !== "") return value;
+  }
+  for (const offered of (carriers.secWebSocketProtocol ?? "").split(",")) {
+    const value = offered.trim();
+    if (!value.startsWith(DAEMON_TOKEN_SUBPROTOCOL_PREFIX)) continue;
+    const token = value.slice(DAEMON_TOKEN_SUBPROTOCOL_PREFIX.length);
+    if (token !== "") return token;
+  }
+  return void 0;
+}
+function tokensMatch(presented, expected) {
+  if (presented === void 0) return false;
+  const a = Buffer.from(presented, "utf8");
+  const b = Buffer.from(expected, "utf8");
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+
 // src/plugins/RunnerRegistry.ts
 import * as fs7 from "fs";
-import * as path12 from "path";
+import * as path14 from "path";
 import * as os5 from "os";
-import { execSync as execSync3 } from "child_process";
+import { execFileSync } from "child_process";
+import { randomBytes as randomBytes3 } from "crypto";
 
 // src/plugins/FsPluginStore.ts
 import * as fs6 from "fs";
-import * as path11 from "path";
+import * as path13 from "path";
 import * as os4 from "os";
-function userPluginsDir() {
-  return path11.join(os4.homedir(), ".config", "ordewell", "plugins");
+
+// src/plugins/pluginNames.ts
+import * as path12 from "path";
+var PLUGIN_NAME_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+var MAX_PLUGIN_NAME_LENGTH = 64;
+function isPlainPluginName(name) {
+  return typeof name === "string" && name.length <= MAX_PLUGIN_NAME_LENGTH && PLUGIN_NAME_PATTERN.test(name);
+}
+function assertPlainPluginName(name) {
+  if (!isPlainPluginName(name)) {
+    throw new Error(
+      `Invalid plugin name: ${JSON.stringify(name)}. Names must be a single plain segment of letters, digits, '.', '-' or '_' (max ${MAX_PLUGIN_NAME_LENGTH} characters).`
+    );
+  }
 }
+function resolvePluginInstallDir(pluginsDir, name) {
+  assertPlainPluginName(name);
+  const root = path12.resolve(pluginsDir);
+  const dest = path12.resolve(root, name);
+  const relative3 = path12.relative(root, dest);
+  if (relative3 !== name || relative3 === "" || path12.isAbsolute(relative3)) {
+    throw new Error(`Plugin install path escapes the plugins directory: ${JSON.stringify(name)}`);
+  }
+  return dest;
+}
+
+// src/plugins/manifestValidation.ts
 function isValidManifest(obj) {
   if (!obj || typeof obj !== "object") return false;
   const m = obj;
-  return typeof m.name === "string" && typeof m.displayName === "string" && typeof m.description === "string" && typeof m.version === "string" && typeof m.runner === "object" && m.runner !== null && typeof m.runner.command === "string" && Array.isArray(m.runner.argsTemplate) && typeof m.features === "object" && m.features !== null && typeof m.modelDiscovery === "object" && m.modelDiscovery !== null;
+  return isPlainPluginName(m.name) && typeof m.displayName === "string" && typeof m.description === "string" && typeof m.version === "string" && typeof m.runner === "object" && m.runner !== null && typeof m.runner.command === "string" && Array.isArray(m.runner.argsTemplate) && typeof m.features === "object" && m.features !== null && typeof m.modelDiscovery === "object" && m.modelDiscovery !== null;
+}
+
+// src/plugins/FsPluginStore.ts
+function userPluginsDir() {
+  return path13.join(os4.homedir(), ".config", "ordewell", "plugins");
 }
 function loadManifestFromDir(dir) {
-  const manifestPath = path11.join(dir, "manifest.json");
+  const manifestPath = path13.join(dir, "manifest.json");
   if (!fs6.existsSync(manifestPath)) return null;
   try {
     const raw = fs6.readFileSync(manifestPath, "utf8");
@@ -10860,8 +12672,8 @@ function copyDirSync(src, dest) {
   ensureDir(dest);
   const entries = fs6.readdirSync(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = path11.join(src, entry.name);
-    const destPath = path11.join(dest, entry.name);
+    const srcPath = path13.join(src, entry.name);
+    const destPath = path13.join(dest, entry.name);
     if (entry.isDirectory()) {
       copyDirSync(srcPath, destPath);
     } else {
@@ -10873,7 +12685,7 @@ function rmDirSync(dir) {
   if (!fs6.existsSync(dir)) return;
   const entries = fs6.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const p = path11.join(dir, entry.name);
+    const p = path13.join(dir, entry.name);
     if (entry.isDirectory()) {
       rmDirSync(p);
     } else {
@@ -10897,6 +12709,13 @@ var FsPluginStore = class {
     }
     return entries.filter((e) => e.isDirectory()).map((e) => e.name);
   }
+  listDir(dir) {
+    try {
+      return fs6.readdirSync(dir);
+    } catch {
+      return [];
+    }
+  }
   loadManifest(pluginDir) {
     return loadManifestFromDir(pluginDir);
   }
@@ -10919,11 +12738,11 @@ var FsPluginStore = class {
       return null;
     }
   }
-  dirExists(path15) {
-    return fs6.existsSync(path15) && fs6.statSync(path15).isDirectory();
+  dirExists(path17) {
+    return fs6.existsSync(path17) && fs6.statSync(path17).isDirectory();
   }
-  exists(path15) {
-    return fs6.existsSync(path15);
+  exists(path17) {
+    return fs6.existsSync(path17);
   }
 };
 
@@ -11211,17 +13030,98 @@ var OPENCODE_MANIFEST = {
   ]
 };
 
+// src/plugins/pluginSource.ts
+var ALLOWED_PLUGIN_HOSTS = [
+  "github.com",
+  "gitlab.com",
+  "bitbucket.org",
+  "codeberg.org"
+];
+var SAFE_REPO_PATH = /^\/[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/;
+var HAS_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]+:/;
+var SCP_LIKE_REMOTE = /^[^/\\]+@[^/\\]+:/;
+function hasControlCharacter(value) {
+  for (let i = 0; i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (code < 32 || code === 127) return true;
+  }
+  return false;
+}
+function assertInstallablePluginUrl(url) {
+  if (typeof url !== "string" || url.trim() === "") {
+    throw new Error("A plugin repository URL is required.");
+  }
+  if (hasControlCharacter(url)) {
+    throw new Error("Plugin URL contains control characters.");
+  }
+  let parsed;
+  try {
+    parsed = new URL(url.trim());
+  } catch {
+    throw new Error(`Not a valid plugin repository URL: ${url}`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `Plugin repositories must be cloned over https (got "${parsed.protocol}//"). git transport helpers and non-https schemes are not accepted.`
+    );
+  }
+  if (parsed.username || parsed.password) {
+    throw new Error("Plugin URL must not embed credentials.");
+  }
+  if (parsed.port) {
+    throw new Error("Plugin URL must not specify a port.");
+  }
+  if (parsed.search || parsed.hash) {
+    throw new Error("Plugin URL must not carry a query string or fragment.");
+  }
+  const host = parsed.hostname.toLowerCase();
+  if (!ALLOWED_PLUGIN_HOSTS.includes(host)) {
+    throw new Error(
+      `Plugin host not allowed: ${host}. Allowed hosts: ${ALLOWED_PLUGIN_HOSTS.join(", ")}.`
+    );
+  }
+  if (!SAFE_REPO_PATH.test(parsed.pathname)) {
+    throw new Error(`Not a plain repository path: ${parsed.pathname}`);
+  }
+  return parsed;
+}
+function classifyPluginSource(source) {
+  const trimmed = source.trim();
+  if (trimmed.startsWith("github:")) {
+    const repo = trimmed.slice("github:".length).replace(/\.git$/, "");
+    return { kind: "git", url: `https://github.com/${repo}.git` };
+  }
+  if (HAS_SCHEME.test(trimmed) || SCP_LIKE_REMOTE.test(trimmed)) {
+    return { kind: "git", url: trimmed };
+  }
+  return { kind: "path", path: source };
+}
+
 // src/plugins/RunnerRegistry.ts
 var BUILTIN_MANIFESTS = [
   CLAUDE_CODE_MANIFEST,
   CODEX_MANIFEST,
   OPENCODE_MANIFEST
 ];
+var RESERVED_RUNNER_NAMES = new Set(BUILTIN_MANIFESTS.map((m) => m.name.toLowerCase()));
+function isReservedRunnerName(name) {
+  return RESERVED_RUNNER_NAMES.has(name.toLowerCase());
+}
+function gitClone(url, destDir) {
+  execFileSync("git", ["clone", "--depth", "1", "--", url, destDir], {
+    stdio: "pipe",
+    timeout: 3e4,
+    // A repository that demands credentials should fail, not hang on a prompt.
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+  });
+}
 var RunnerRegistry = class {
   plugins = /* @__PURE__ */ new Map();
   store;
-  constructor(store) {
+  clone;
+  constructor(store, clone) {
     this.store = store ?? new FsPluginStore();
+    this.clone = clone ?? gitClone;
     this.loadBuiltins();
   }
   loadBuiltins() {
@@ -11232,9 +13132,15 @@ var RunnerRegistry = class {
   loadUserPlugins() {
     const names = this.store.listUserPluginDirs();
     for (const name of names) {
-      const pluginDir = path12.join(this.store.getUserPluginsDir(), name);
+      let pluginDir;
+      try {
+        pluginDir = resolvePluginInstallDir(this.store.getUserPluginsDir(), name);
+      } catch {
+        continue;
+      }
       const manifest = this.store.loadManifest(pluginDir);
-      if (!manifest) continue;
+      if (!manifest || !isPlainPluginName(manifest.name)) continue;
+      if (isReservedRunnerName(manifest.name)) continue;
       this.plugins.set(manifest.name, {
         manifest,
         source: "user",
@@ -11263,7 +13169,7 @@ var RunnerRegistry = class {
     return entry?.source === "builtin";
   }
   installFromPath(sourcePath) {
-    const absPath = path12.resolve(sourcePath);
+    const absPath = path14.resolve(sourcePath);
     if (!this.store.dirExists(absPath)) {
       throw new Error(`Plugin source must be a directory: ${absPath}`);
     }
@@ -11271,48 +13177,50 @@ var RunnerRegistry = class {
     if (!manifest) {
       throw new Error(`No valid manifest.json found in: ${absPath}`);
     }
-    const destDir = path12.join(this.store.getUserPluginsDir(), manifest.name);
-    this.store.ensureDir(destDir);
-    this.store.copyDir(absPath, destDir);
-    this.plugins.set(manifest.name, {
-      manifest,
-      source: "user",
-      installPath: destDir
-    });
-    return manifest;
+    return this.registerInstalled(manifest, absPath);
   }
   installFromGit(url) {
-    const repoName = url.split("/").pop()?.replace(/\.git$/, "") || "plugin";
-    const tmpDir = path12.join(os5.tmpdir(), `ordewell-plugin-${Date.now()}`);
+    const validated = assertInstallablePluginUrl(url);
+    const tmpDir = path14.join(os5.tmpdir(), `ordewell-plugin-${randomBytes3(12).toString("hex")}`);
     this.store.ensureDir(tmpDir);
     try {
-      execSync3(`git clone --depth 1 "${url}" "${tmpDir}"`, { stdio: "pipe", timeout: 3e4 });
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      throw new Error(`Failed to clone repository: ${message}`);
-    }
-    const contents = fsReaddirSync(tmpDir);
-    const hasManifest = contents.some((f) => f === "manifest.json");
-    if (!hasManifest && contents.length === 1 && this.store.dirExists(path12.join(tmpDir, contents[0]))) {
-      const subDir = path12.join(tmpDir, contents[0]);
-      return this.finishInstall(subDir, repoName, tmpDir);
-    }
-    if (!hasManifest) {
+      try {
+        this.clone(validated.toString(), tmpDir);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to clone repository: ${message}`);
+      }
+      const contents = this.store.listDir(tmpDir);
+      const hasManifest = contents.some((f) => f === "manifest.json");
+      let sourceDir = tmpDir;
+      if (!hasManifest) {
+        const onlyEntry = contents.length === 1 ? path14.join(tmpDir, contents[0]) : void 0;
+        if (!onlyEntry || !this.store.dirExists(onlyEntry)) {
+          throw new Error(`No manifest.json found in repository: ${validated.toString()}`);
+        }
+        sourceDir = onlyEntry;
+      }
+      const manifest = this.store.loadManifest(sourceDir);
+      if (!manifest) {
+        throw new Error("No valid manifest.json found in cloned repository");
+      }
+      return this.registerInstalled(manifest, sourceDir);
+    } finally {
       this.store.removeDir(tmpDir);
-      throw new Error(`No manifest.json found in repository: ${url}`);
     }
-    return this.finishInstall(tmpDir, repoName, tmpDir);
   }
-  finishInstall(sourceDir, repoName, tmpDir) {
-    const manifest = this.store.loadManifest(sourceDir);
-    if (!manifest) {
-      this.store.removeDir(tmpDir);
-      throw new Error(`No valid manifest.json found in cloned repository`);
+  /**
+   * The single destination-building step both install routes share: the name is
+   * constrained to a plain segment and the resolved destination is asserted to
+   * be inside the plugins directory before anything is copied.
+   */
+  registerInstalled(manifest, sourceDir) {
+    if (isReservedRunnerName(manifest.name)) {
+      throw new Error(`Cannot install a plugin named after a built-in runner: ${manifest.name}`);
     }
-    const destDir = path12.join(this.store.getUserPluginsDir(), manifest.name);
+    const destDir = resolvePluginInstallDir(this.store.getUserPluginsDir(), manifest.name);
     this.store.ensureDir(destDir);
     this.store.copyDir(sourceDir, destDir);
-    this.store.removeDir(tmpDir);
     this.plugins.set(manifest.name, {
       manifest,
       source: "user",
@@ -11333,7 +13241,8 @@ var RunnerRegistry = class {
     this.plugins.delete(name);
   }
   createSkeleton(name, outputDir) {
-    const dir = path12.resolve(outputDir, name);
+    assertPlainPluginName(name);
+    const dir = path14.resolve(outputDir, name);
     this.store.ensureDir(dir);
     const manifest = {
       name,
@@ -11365,8 +13274,8 @@ var RunnerRegistry = class {
         ]
       }
     };
-    this.store.writeFile(path12.join(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
-    const runSh = path12.join(dir, "run.sh");
+    this.store.writeFile(path14.join(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
+    const runSh = path14.join(dir, "run.sh");
     const scriptContent = `#!/usr/bin/env bash
 # Custom runner script for ${name}
 # Receives:
@@ -11390,13 +13299,6 @@ echo "Running ${name} with prompt: $prompt"
     return dir;
   }
 };
-function fsReaddirSync(dir) {
-  try {
-    return fs7.readdirSync(dir);
-  } catch {
-    return [];
-  }
-}
 function fsChmodSync(fpath, mode) {
   try {
     fs7.chmodSync(fpath, mode);
@@ -11406,14 +13308,14 @@ function fsChmodSync(fpath, mode) {
 
 // src/utils/stateStore.ts
 import * as fs8 from "fs";
-import * as path13 from "path";
+import * as path15 from "path";
 var STATE_FILE = "state.json";
 function getStatePath(baseDir) {
-  return path13.join(getStateDir(baseDir), STATE_FILE);
+  return path15.join(getStateDir(baseDir), STATE_FILE);
 }
 function saveState(plan, baseDir) {
   const statePath = getStatePath(baseDir ?? process.cwd());
-  ensureDir(path13.dirname(statePath));
+  ensureDir(path15.dirname(statePath));
   plan.lastUpdated = (/* @__PURE__ */ new Date()).toISOString();
   fs8.writeFileSync(statePath, JSON.stringify(plan, null, 2));
 }
@@ -11446,7 +13348,7 @@ function stateExists(baseDir) {
 
 // src/services/SettingsService.ts
 import * as fs9 from "fs";
-import * as path14 from "path";
+import * as path16 from "path";
 import * as os6 from "os";
 var DEFAULTS = {
   grillMe: { enabled: false },
@@ -11459,7 +13361,7 @@ var DEFAULTS = {
 function getSettingsPath() {
   const override = process.env.ORDEWELL_SETTINGS_PATH;
   if (override && override.trim()) return override.trim();
-  return path14.join(os6.homedir(), ".config", "ordewell", "settings.json");
+  return path16.join(os6.homedir(), ".config", "ordewell", "settings.json");
 }
 function readPlannerModels(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
@@ -11624,7 +13526,7 @@ var SettingsService = class {
     return { ...DEFAULTS, grillMe: { ...DEFAULTS.grillMe }, tdd: { ...DEFAULTS.tdd }, prd: { ...DEFAULTS.prd }, review: { ...DEFAULTS.review }, verification: { ...DEFAULTS.verification }, researchSubagents: { ...DEFAULTS.researchSubagents } };
   }
   persist() {
-    const dir = path14.dirname(this.filePath);
+    const dir = path16.dirname(this.filePath);
     if (!fs9.existsSync(dir)) {
       fs9.mkdirSync(dir, { recursive: true });
     }
@@ -11668,6 +13570,7 @@ var PlannerModelMemory = class {
   }
 };
 export {
+  ALLOWED_PLUGIN_HOSTS,
   ALL_PROVIDERS,
   AUTO_COMMANDS,
   AbstractRunner,
@@ -11686,6 +13589,8 @@ export {
   CommandLineTooLongError,
   ConsoleLogger,
   ContextCollector,
+  DAEMON_SUBPROTOCOL,
+  DAEMON_TOKEN_SUBPROTOCOL_PREFIX,
   DENY_ALL,
   EmbeddedNewlineError,
   EnvConfig,
@@ -11702,9 +13607,12 @@ export {
   ModelResolver,
   OPENCODE_MANIFEST,
   ORCHESTRATOR_SHORTCUTS,
+  ORDEWELL_SETTABLE_ENV,
   OpenAiService,
   OpenCodeAdapter,
   PLAN_ENVELOPE_KEY,
+  PLUGIN_NAME_PATTERN,
+  PROVIDER_CREDENTIAL_ENV,
   PROVIDER_DETECT_PRIORITY,
   PROVIDER_LABEL,
   PROVIDER_PRIORITY,
@@ -11719,6 +13627,8 @@ export {
   RunnerInstallation,
   RunnerRegistry,
   SEARCH_EXCLUSIONS,
+  SETTINGS_ENV_ALLOWLIST,
+  SETTINGS_ENV_REFUSED,
   STATE_DIR,
   STOPPED_TOOL_RESULT,
   SYMBOL_LANGUAGES,
@@ -11731,13 +13641,19 @@ export {
   TmuxRunner,
   VerdictEngine,
   WINDOWS_MAX_COMMAND_LINE,
+  WorkspaceNotAProjectError,
   WorkspaceNotFoundError,
   addTaskToPlan,
+  admitSettingsEnv,
   applyHeadLimit,
   applyTaskOps,
+  assertInstallablePluginUrl,
+  assertPlainPluginName,
   assertWorkspaceExists,
+  assertWorkspaceIsProject,
   augmentPromptWithPriorOutputs,
   augmentedPath,
+  bearerHeaderValue,
   buildConversationSystemPrompt,
   buildFallbackGrepArgs,
   buildGlobArgs,
@@ -11765,7 +13681,9 @@ export {
   classifyCommand,
   classifyOutcome,
   classifyPlannerReply,
+  classifyPluginSource,
   clearAugmentedPathCache,
+  clearDaemonToken,
   clearResearchShellCache,
   clearState,
   clipboardCopyCommand,
@@ -11777,6 +13695,7 @@ export {
   createAiService,
   createEmptyPlan,
   createTask,
+  daemonTokenPath,
   defaultLogger,
   definitionPattern,
   deleteSession,
@@ -11787,6 +13706,7 @@ export {
   emptyWarnings,
   enabledRunners,
   ensureDir,
+  ensureStateDirIgnored,
   escapeControlCharsInStrings,
   executionLogBlock,
   executionSummary,
@@ -11794,6 +13714,7 @@ export {
   extractObjectWithBalance,
   extractObjectsWithKey,
   extractPrdBlock,
+  extractPresentedToken,
   fetchAllProviderModels,
   filterFallbackByAnchoredInclude,
   filterModelsForPrompt,
@@ -11811,6 +13732,9 @@ export {
   isCliProvider,
   isExecutableResolved,
   isOpenAiProvider,
+  isPlainPluginName,
+  isReservedRunnerName,
+  isValidManifest,
   killTree,
   knownModelId,
   languageForId,
@@ -11823,6 +13747,8 @@ export {
   migrateLegacyPlan,
   migratePlanState,
   migrateTask,
+  mintDaemonToken,
+  mintSessionId,
   modelContextBlock,
   modifyValidationFeedback,
   normalizeAgentArgs,
@@ -11838,6 +13764,7 @@ export {
   providerForRunner,
   reEmitPlanPrompt,
   reEmitTaskOpsPrompt,
+  readDaemonToken,
   referencePattern,
   removeTaskFromPlan,
   renderPlanMap,
@@ -11849,6 +13776,7 @@ export {
   resolveArgs,
   resolveDefaultMode,
   resolveModelShortcut,
+  resolvePluginInstallDir,
   resolveProvider,
   resolveProviderFromPrefix,
   resolveResearchShell,
@@ -11879,6 +13807,8 @@ export {
   tmuxSocketName,
   tmuxWindowName,
   toOrchestratorOptions,
+  tokenSubprotocols,
+  tokensMatch,
   truncatedPlanReEmitPrompt,
   updateTaskInPlan,
   validateModifiedPlan,