@orquentra/codebuddy 2.15.0 → 2.15.1

package/dist/{chunk-M75SN4D4.js.map → chunk-Y4QQML24.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/config-file.ts"],"sourcesContent":["import { execFile } from \"node:child_process\";\nimport { constants } from \"node:fs\";\nimport { access, chmod, mkdir, readdir, readFile, stat, writeFile } from \"node:fs/promises\";\nimport { basename, join, resolve } from \"node:path\";\nimport { z } from \"zod\";\nimport { writeAtomic } from \"./markdown-store-fs.js\";\nimport type { CodeBuddyConfig } from \"./types.js\";\n\nexport const CONFIG_DIR = \".codebuddy\";\nexport const CONFIG_FILE = \"config.json\";\nexport const POLICY_FILE = \"policies.yaml\";\n\nconst PROJECT_GITIGNORE = [\n  \"# CodeBuddy local-only files\",\n  \"/config.json\",\n  \"/cache/\",\n  \"/memory/review/\",\n  \"/memory/review-archive/\",\n  \"/plans/.locks/\",\n  \"/memory/.locks/\",\n  \"\",\n  \"# Keep these reviewable project artifacts shareable by default:\",\n  \"#   /memory/facts/*.md\",\n  \"#   /memory/summaries/*.md\",\n  \"#   /plans/*.md\",\n  \"# If your project memory is private, ignore /memory/ in the repo root .gitignore.\",\n  \"\",\n].join(\"\\n\");\n\nconst DEFAULT_POLICY_FILE = [\n  \"rules:\",\n  \"  - id: auth-sensitive\",\n  '    pattern: \"src/auth/**\"',\n  '    message: \"Auth changes need careful review.\"',\n  \"    weight: 70\",\n  \"\",\n].join(\"\\n\");\n\n/**\n * Plan policy controls how strongly CodeBuddy nudges agents toward writing\n * a plan before substantive work:\n *   - off:      plans are never suggested or required.\n *   - suggest:  agents are reminded to plan, but small tasks stay lightweight (default).\n *   - required: agents should refuse substantive changes without an active plan.\n */\nexport const PLAN_POLICIES = [\"off\", \"suggest\", \"required\"] as const;\nexport type PlanPolicy = (typeof PLAN_POLICIES)[number];\n\nconst fileSchema = z.object({\n  postgresUrl: z.string().min(1).optional(),\n  namespace: z.string().min(1).optional(),\n  tokenBudget: z.number().int().positive().optional(),\n  provider: z\n    .object({\n      type: z.enum([\"local\", \"huggingface\", \"openrouter\"]).default(\"local\"),\n      apiKey: z.string().min(1).optional(),\n      model: z.string().min(1).optional(),\n      relevanceFloor: z.number().min(-1).max(1).optional(),\n      recallFloor: z.number().min(-1).max(1).optional(),\n    })\n    .optional(),\n  /** Optional cross-encoder that orders recalled facts (off by default). */\n  rerank: z\n    .object({\n      provider: z.enum([\"off\", \"local\", \"huggingface\", \"openrouter\"]).default(\"off\"),\n      model: z.string().min(1).optional(),\n    })\n    .optional(),\n  plan: z\n    .object({\n      policy: z.enum(PLAN_POLICIES).default(\"suggest\"),\n    })\n    .optional(),\n  graphify: z\n    .object({\n      enabled: z.boolean(),\n      graphPath: z.string().min(1).optional(),\n    })\n    .optional(),\n  /** Git churn risk signal (`risk/signals/churn.ts`); defaults keep the 30-day window. */\n  risk: z\n    .object({\n      churnWindowDays: z.number().int().positive().max(3650).optional(),\n      churnMode: z.enum([\"window\", \"lifetime-size\"]).optional(),\n    })\n    .optional(),\n  /**\n   * Optional hosted small-model layer (bring your own key). Keys are read from\n   * the environment only, never from this file (`src/llm/config.ts`).\n   */\n  llm: z\n    .object({\n      enabled: z.boolean(),\n      provider: z.enum([\"groq\", \"openrouter\", \"local\"]).optional(),\n      model: z.string().min(1).optional(),\n      /** Local model size (`codebuddy models add local-llm --size`); default \"default\". */\n      size: z.enum([\"default\", \"better\"]).optional(),\n      fallback: z\n        .object({ provider: z.enum([\"groq\", \"openrouter\"]), model: z.string().min(1) })\n        .optional(),\n      timeoutMs: z.number().int().min(100).max(5_000).optional(),\n      dailyTokenBudget: z.number().int().positive().optional(),\n      features: z\n        .object({\n          summaries: z.boolean().optional(),\n          rerank: z.boolean().optional(),\n          memory: z.boolean().optional(),\n          facts: z.boolean().optional(),\n          expansion: z.boolean().optional(),\n        })\n        .optional(),\n    })\n    .optional(),\n  /** Task → file discovery tuning (`context/discovery.ts`). */\n  discovery: z\n    .object({\n      /** The agreement rule: top k per dense signal and the cosine floors for a vote. */\n      agreement: z\n        .object({\n          topK: z.number().int().min(1).max(20).optional(),\n          chunkFloor: z.number().min(-1).max(1).optional(),\n          cardFloor: z.number().min(-1).max(1).optional(),\n        })\n        .optional(),\n    })\n    .optional(),\n  /** Optional local semantic retrieval via zvec-grep (`zg`). Off unless enabled. */\n  zvec: z\n    .object({\n      enabled: z.boolean(),\n      binary: z.string().min(1).optional(),\n      timeoutMs: z.number().int().positive().max(10_000).optional(),\n      /** Task IDF coverage a vector-only file needs (0..1, default 0.3; docs/zvec-floor.md). */\n      minScore: z.number().min(0).max(1).optional(),\n      /** zg embedding model for the intent-card workspace (default local/bge-small-en-v1.5). */\n      cardModel: z.string().min(1).optional(),\n    })\n    .optional(),\n});\n\nexport type CodeBuddyFileConfig = z.infer<typeof fileSchema>;\n\nexport type ConfigPermissionReport = {\n  path: string;\n  exists: boolean;\n  mode: string | null;\n  ok: boolean;\n  warning?: string;\n};\n\nexport type ProjectScaffoldReport = {\n  codebuddyDir: { path: string; exists: boolean; ok: boolean; warning?: string };\n  memoryFactsDir: { path: string; exists: boolean; ok: boolean; warning?: string };\n  memorySummariesDir: { path: string; exists: boolean; ok: boolean; warning?: string };\n  plansDir: { path: string; exists: boolean; ok: boolean; warning?: string };\n  gitignore: { path: string; exists: boolean; ok: boolean; warning?: string };\n  policies: { path: string; exists: boolean; ok: boolean; warning?: string };\n};\n\nexport function configPath(cwd = process.cwd()): string {\n  return join(cwd, CONFIG_DIR, CONFIG_FILE);\n}\n\nexport async function initProjectScaffold(cwd = process.cwd()): Promise<{\n  codebuddyDir: string;\n  gitignorePath: string;\n  policyPath: string;\n}> {\n  const codebuddyDir = join(cwd, CONFIG_DIR);\n  await mkdir(join(codebuddyDir, \"memory\", \"facts\"), { recursive: true, mode: 0o700 });\n  await mkdir(join(codebuddyDir, \"memory\", \"summaries\"), { recursive: true, mode: 0o700 });\n  await mkdir(join(codebuddyDir, \"plans\"), { recursive: true, mode: 0o700 });\n\n  const gitignorePath = join(codebuddyDir, \".gitignore\");\n  try {\n    await access(gitignorePath, constants.F_OK);\n    let gitignore = await readFile(gitignorePath, \"utf8\");\n    const lines = new Set(gitignore.split(/\\r?\\n/));\n    const missing = [\"/memory/review/\", \"/memory/review-archive/\"].filter(\n      (line) => !lines.has(line),\n    );\n    if (missing.length > 0) {\n      gitignore = `${gitignore.trimEnd()}\\n${missing.join(\"\\n\")}\\n`;\n      await writeFile(gitignorePath, gitignore, { mode: 0o644 });\n    }\n  } catch {\n    await writeFile(gitignorePath, PROJECT_GITIGNORE, { mode: 0o644 });\n  }\n\n  const policyPath = join(codebuddyDir, POLICY_FILE);\n  try {\n    await access(policyPath, constants.F_OK);\n  } catch {\n    await writeFile(policyPath, DEFAULT_POLICY_FILE, { mode: 0o644 });\n  }\n\n  return { codebuddyDir, gitignorePath, policyPath };\n}\n\nexport async function initConfigFile(\n  cwd = process.cwd(),\n): Promise<{ path: string; created: boolean }> {\n  const path = configPath(cwd);\n  await initProjectScaffold(cwd);\n  try {\n    await access(path, constants.F_OK);\n    await chmod(path, 0o600);\n    return { path, created: false };\n  } catch {\n    const template: CodeBuddyFileConfig = {\n      postgresUrl: process.env.DATABASE_URL ?? \"postgres://localhost:5432/codebuddy\",\n      // Default to the folder name (sanitized) so a fresh scaffold agrees with\n      // doctor's expected default instead of warning immediately after init.\n      namespace: defaultNamespaceForCwd(cwd),\n      provider: { type: \"local\" },\n      tokenBudget: 4000,\n    };\n    await writeFile(path, `${JSON.stringify(template, null, 2)}\\n`, { mode: 0o600 });\n    await chmod(path, 0o600);\n    return { path, created: true };\n  }\n}\n\n/** Persist a complete project config without changing its private permissions. */\nexport async function writeConfigFile(\n  config: CodeBuddyFileConfig,\n  cwd = process.cwd(),\n): Promise<{ path: string }> {\n  const path = configPath(cwd);\n  await initProjectScaffold(cwd);\n  await writeFile(path, `${JSON.stringify(config, null, 2)}\\n`, { mode: 0o600 });\n  await chmod(path, 0o600);\n  return { path };\n}\n\nexport async function readConfigFile(cwd = process.cwd()): Promise<CodeBuddyFileConfig> {\n  const path = configPath(cwd);\n  let parsed: CodeBuddyFileConfig;\n  try {\n    const raw = await readFile(path, \"utf8\");\n    parsed = fileSchema.parse(JSON.parse(raw));\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return {};\n    throw error;\n  }\n  if ((parsed.zvec?.binary !== undefined || parsed.postgresUrl) && (await trackedByGit(cwd))) {\n    return withoutRepositorySuppliedSecrets(parsed, path);\n  }\n  return parsed;\n}\n\n/**\n * `init` gitignores `.codebuddy/config.json`, so a tracked one came with the\n * repository, not from this user. A cloned repository must not choose a\n * program for CodeBuddy to run (`zvec.binary`) or a database to send project\n * memory to (`postgresUrl`); those two keys are ignored in that case and must\n * come from the environment (DATABASE_URL) or an untracked config.\n */\nfunction withoutRepositorySuppliedSecrets(\n  config: CodeBuddyFileConfig,\n  path: string,\n): CodeBuddyFileConfig {\n  const { postgresUrl: _postgresUrl, ...rest } = config;\n  const ignored = [\n    ...(config.postgresUrl ? [\"postgresUrl\"] : []),\n    ...(config.zvec?.binary !== undefined ? [\"zvec.binary\"] : []),\n  ];\n  if (!warnedTracked.has(path)) {\n    warnedTracked.add(path);\n    process.stderr.write(\n      `codebuddy: ignoring ${ignored.join(\" and \")} in ${path}: the file is tracked by git, so it came with the repository. ` +\n        \"Untrack it (git rm --cached) or set DATABASE_URL.\\n\",\n    );\n  }\n  if (!rest.zvec) return rest;\n  const { binary: _binary, ...zvec } = rest.zvec;\n  return { ...rest, zvec };\n}\n\nconst warnedTracked = new Set<string>();\nconst trackedCache = new Map<string, Promise<boolean>>();\n\n/** Whether `.codebuddy/config.json` under `root` is tracked by git (cached per process). */\nfunction trackedByGit(root: string): Promise<boolean> {\n  const key = resolve(root);\n  let pending = trackedCache.get(key);\n  if (!pending) {\n    pending = new Promise((done) => {\n      execFile(\n        \"git\",\n        [\"ls-files\", \"--error-unmatch\", \"--\", \".codebuddy/config.json\"],\n        { cwd: key, timeout: 5_000 },\n        (error) => done(error === null),\n      );\n    });\n    trackedCache.set(key, pending);\n  }\n  return pending;\n}\n\n/**\n * The ONE namespace-resolution rule, shared by the DB/MCP runtime, every\n * file-based CLI command, and doctor. Precedence:\n *   1. CODEBUDDY_NAMESPACE env\n *   2. `.codebuddy/config.json` `namespace`\n *   3. the current folder name (sanitized) — matching what doctor reports as\n *      the expected default.\n */\nexport function sanitizeNamespace(value: string): string {\n  return value.replace(/[^a-zA-Z0-9_.:-]/g, \"-\").slice(0, 128);\n}\n\n/** Folder-name fallback used when neither env nor config specify a namespace. */\nexport function defaultNamespaceForCwd(cwd = process.cwd()): string {\n  return sanitizeNamespace(basename(cwd)) || \"default\";\n}\n\nexport async function resolveNamespaceFrom(cwd = process.cwd()): Promise<string> {\n  if (process.env.CODEBUDDY_NAMESPACE) return process.env.CODEBUDDY_NAMESPACE;\n  const file = await readConfigFile(cwd);\n  return file.namespace ?? defaultNamespaceForCwd(cwd);\n}\n\n/** Scaffolds before 2.0 wrote this literal, so every project shared one namespace. */\nconst LEGACY_NAMESPACE = \"default\";\n\n/**\n * Rewrites a legacy `\"namespace\": \"default\"` in `.codebuddy/config.json` to the\n * folder's default and returns the new namespace, or null when nothing changed.\n * Skipped when the file is tracked by git (it belongs to the repository) or\n * when Markdown memory was saved under \"default\" (it would drop out of recall).\n */\nexport async function migrateLegacyNamespace(cwd = process.cwd()): Promise<string | null> {\n  const target = defaultNamespaceForCwd(cwd);\n  if (target === LEGACY_NAMESPACE) return null;\n  const path = configPath(cwd);\n  let raw: Record<string, unknown>;\n  try {\n    raw = JSON.parse(await readFile(path, \"utf8\")) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n  if (raw.namespace !== LEGACY_NAMESPACE) return null;\n  if ((await trackedByGit(cwd)) || (await hasMemoryInNamespace(cwd, LEGACY_NAMESPACE))) {\n    return null;\n  }\n  await writeAtomic(path, `${JSON.stringify({ ...raw, namespace: target }, null, 2)}\\n`);\n  return target;\n}\n\nasync function hasMemoryInNamespace(cwd: string, namespace: string): Promise<boolean> {\n  const memoryDir = join(cwd, \".codebuddy\", \"memory\");\n  let entries: string[];\n  try {\n    entries = await readdir(memoryDir, { recursive: true });\n  } catch {\n    return false;\n  }\n  const line = new RegExp(`^namespace: ['\"]?${namespace}['\"]?$`, \"m\");\n  for (const entry of entries) {\n    if (!entry.endsWith(\".md\")) continue;\n    const text = await readFile(join(memoryDir, entry), \"utf8\").catch(() => \"\");\n    if (line.test(text)) return true;\n  }\n  return false;\n}\n\nexport const MISSING_DATABASE_URL =\n  \"DATABASE_URL or .codebuddy/config.json postgresUrl is required.\";\n\n/**\n * `requireDatabase: false` (the MCP server) returns an empty `postgresUrl`\n * instead of throwing, so file-based tools still run without PostgreSQL;\n * `createRuntime` rejects the empty URL with the same message.\n */\nexport async function loadRuntimeConfig(\n  cwd = process.cwd(),\n  options: { requireDatabase?: boolean } = {},\n): Promise<CodeBuddyConfig> {\n  const projectRoot = process.env.CODEBUDDY_PROJECT_ROOT ?? cwd;\n  const file = await readConfigFile(projectRoot);\n  const postgresUrl = process.env.DATABASE_URL ?? file.postgresUrl ?? \"\";\n  if (!postgresUrl && options.requireDatabase !== false) {\n    throw new Error(MISSING_DATABASE_URL);\n  }\n  const hfToken = process.env.HF_TOKEN ?? file.provider?.apiKey;\n  return {\n    postgresUrl,\n    namespace:\n      process.env.CODEBUDDY_NAMESPACE ?? file.namespace ?? defaultNamespaceForCwd(projectRoot),\n    projectRoot,\n    provider: {\n      type: file.provider?.type ?? \"local\",\n      ...(hfToken ? { apiKey: hfToken } : {}),\n      ...(file.provider?.model ? { model: file.provider.model } : {}),\n      ...(file.provider?.relevanceFloor !== undefined\n        ? { relevanceFloor: file.provider.relevanceFloor }\n        : {}),\n      ...(file.provider?.recallFloor !== undefined\n        ? { recallFloor: file.provider.recallFloor }\n        : {}),\n    },\n    ...(file.tokenBudget ? { tokenBudget: file.tokenBudget } : {}),\n    ...(file.graphify ? { graphify: file.graphify } : {}),\n  };\n}\n\nexport async function checkConfigPermissions(cwd = process.cwd()): Promise<ConfigPermissionReport> {\n  const path = configPath(cwd);\n  try {\n    const info = await stat(path);\n    const modeNumber = info.mode & 0o777;\n    const mode = modeNumber.toString(8).padStart(4, \"0\");\n    // Windows has no POSIX mode bits (stat reports 0o666/0o444 whatever chmod\n    // did); the file is protected by the user profile's ACL instead.\n    const ok = process.platform === \"win32\" || modeNumber === 0o600;\n    return {\n      path,\n      exists: true,\n      mode,\n      ok,\n      ...(ok ? {} : { warning: \".codebuddy/config.json should be chmod 0600.\" }),\n    };\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n      return { path, exists: false, mode: null, ok: true };\n    }\n    throw error;\n  }\n}\n\nexport async function checkProjectScaffold(cwd = process.cwd()): Promise<ProjectScaffoldReport> {\n  const codebuddyDir = join(cwd, CONFIG_DIR);\n  const memoryFactsDir = join(codebuddyDir, \"memory\", \"facts\");\n  const memorySummariesDir = join(codebuddyDir, \"memory\", \"summaries\");\n  const plansDir = join(codebuddyDir, \"plans\");\n  const gitignorePath = join(codebuddyDir, \".gitignore\");\n  const policyPath = join(codebuddyDir, POLICY_FILE);\n\n  const [\n    codebuddyDirExists,\n    memoryFactsDirExists,\n    memorySummariesDirExists,\n    plansDirExists,\n    gitignoreExists,\n    policiesExist,\n  ] = await Promise.all([\n    pathExists(codebuddyDir),\n    pathExists(memoryFactsDir),\n    pathExists(memorySummariesDir),\n    pathExists(plansDir),\n    pathExists(gitignorePath),\n    pathExists(policyPath),\n  ]);\n\n  return {\n    codebuddyDir: {\n      path: codebuddyDir,\n      exists: codebuddyDirExists,\n      ok: codebuddyDirExists,\n      ...(codebuddyDirExists\n        ? {}\n        : { warning: \"Run `codebuddy use` or `codebuddy init` to create the project scaffold.\" }),\n    },\n    memoryFactsDir: {\n      path: memoryFactsDir,\n      exists: memoryFactsDirExists,\n      ok: memoryFactsDirExists,\n      ...(memoryFactsDirExists ? {} : { warning: \"Missing .codebuddy/memory/facts directory.\" }),\n    },\n    memorySummariesDir: {\n      path: memorySummariesDir,\n      exists: memorySummariesDirExists,\n      ok: memorySummariesDirExists,\n      ...(memorySummariesDirExists\n        ? {}\n        : { warning: \"Missing .codebuddy/memory/summaries directory.\" }),\n    },\n    plansDir: {\n      path: plansDir,\n      exists: plansDirExists,\n      ok: plansDirExists,\n      ...(plansDirExists ? {} : { warning: \"Missing .codebuddy/plans directory.\" }),\n    },\n    gitignore: {\n      path: gitignorePath,\n      exists: gitignoreExists,\n      ok: gitignoreExists,\n      ...(gitignoreExists ? {} : { warning: \"Missing .codebuddy/.gitignore.\" }),\n    },\n    policies: {\n      path: policyPath,\n      exists: policiesExist,\n      ok: policiesExist,\n      ...(policiesExist\n        ? {}\n        : {\n            warning:\n              \"Missing .codebuddy/policies.yaml. Run `codebuddy use` or `codebuddy init` to scaffold it.\",\n          }),\n    },\n  };\n}\n\n/** Read the plan policy, honoring CODEBUDDY_PLAN_POLICY then the config file. */\nexport async function loadPlanPolicy(cwd = process.cwd()): Promise<PlanPolicy> {\n  const fromEnv = process.env.CODEBUDDY_PLAN_POLICY;\n  if (fromEnv && (PLAN_POLICIES as readonly string[]).includes(fromEnv)) {\n    return fromEnv as PlanPolicy;\n  }\n  const file = await readConfigFile(cwd);\n  return file.plan?.policy ?? \"suggest\";\n}\n\n/** Persist the plan policy into `.codebuddy/config.json`, creating it if needed. */\nexport async function setPlanPolicy(policy: PlanPolicy, cwd = process.cwd()): Promise<void> {\n  await initConfigFile(cwd);\n  const path = configPath(cwd);\n  const raw = JSON.parse(await readFile(path, \"utf8\")) as Record<string, unknown>;\n  raw.plan = { ...(raw.plan as Record<string, unknown> | undefined), policy };\n  // Atomic rewrite: this file holds the postgresUrl and provider apiKey.\n  await writeAtomic(path, `${JSON.stringify(raw, null, 2)}\\n`, { mode: 0o600 });\n}\n\n/** Turn optional zvec-grep retrieval on or off in `.codebuddy/config.json`. */\nexport async function setZvecEnabled(enabled: boolean, cwd = process.cwd()): Promise<void> {\n  await initConfigFile(cwd);\n  const path = configPath(cwd);\n  const raw = JSON.parse(await readFile(path, \"utf8\")) as Record<string, unknown>;\n  raw.zvec = { ...(raw.zvec as Record<string, unknown> | undefined), enabled };\n  await writeAtomic(path, `${JSON.stringify(raw, null, 2)}\\n`, { mode: 0o600 });\n}\n\n/** Turn the BYOK LLM layer on or off; never writes a key (keys live in the environment). */\nexport async function setLlmEnabled(\n  enabled: boolean,\n  options: { provider?: \"groq\" | \"openrouter\"; model?: string } = {},\n  cwd = process.cwd(),\n): Promise<void> {\n  await initConfigFile(cwd);\n  const path = configPath(cwd);\n  const raw = JSON.parse(await readFile(path, \"utf8\")) as Record<string, unknown>;\n  raw.llm = {\n    ...(raw.llm as Record<string, unknown> | undefined),\n    enabled,\n    ...(options.provider ? { provider: options.provider } : {}),\n    ...(options.model ? { model: options.model } : {}),\n  };\n  await writeAtomic(path, `${JSON.stringify(raw, null, 2)}\\n`, { mode: 0o600 });\n}\n\n/**\n * Replace one top-level block of `.codebuddy/config.json` (`provider`,\n * `rerank`), keeping every other key and the private file mode. The result\n * must still parse, so a bad value never reaches disk.\n */\nexport async function setConfigBlock(\n  key: \"provider\" | \"rerank\" | \"llm\",\n  value: Record<string, unknown>,\n  cwd = process.cwd(),\n): Promise<void> {\n  await initConfigFile(cwd);\n  const path = configPath(cwd);\n  const raw = JSON.parse(await readFile(path, \"utf8\")) as Record<string, unknown>;\n  raw[key] = value;\n  fileSchema.parse(raw);\n  await writeAtomic(path, `${JSON.stringify(raw, null, 2)}\\n`, { mode: 0o600 });\n}\n\nexport function redactSecrets(value: unknown): unknown {\n  if (typeof value === \"string\") {\n    let redacted = value;\n    // Provider keys (HF, BYOK LLM) literally anywhere in a string.\n    for (const key of [\n      process.env.HF_TOKEN,\n      process.env.GROQ_API_KEY,\n      process.env.OPENROUTER_API_KEY,\n      process.env.CODEBUDDY_LLM_API_KEY,\n    ]) {\n      if (key) redacted = redacted.split(key).join(\"[REDACTED]\");\n    }\n    // Credentials embedded in connection URLs (postgres://user:pass@host…).\n    // The password — not the username — is the secret.\n    redacted = redacted.replace(\n      /(\\b[a-z][a-z0-9+.-]*:\\/\\/[^:/\\s@]+:)[^/\\s@]+(@)/gi,\n      \"$1[REDACTED]$2\",\n    );\n    return redacted;\n  }\n  if (Array.isArray(value)) return value.map(redactSecrets);\n  if (!value || typeof value !== \"object\") return value;\n  return Object.fromEntries(\n    Object.entries(value as Record<string, unknown>).map(([key, nested]) => [\n      key,\n      /token|apiKey|authorization|secret/i.test(key) ? \"[REDACTED]\" : redactSecrets(nested),\n    ]),\n  );\n}\n\nasync function pathExists(path: string): Promise<boolean> {\n  try {\n    await access(path, constants.F_OK);\n    return true;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;AAAA,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;AAC1B,SAAS,QAAQ,OAAO,OAAO,SAAS,UAAU,MAAM,iBAAiB;AACzE,SAAS,UAAU,MAAM,eAAe;AACxC,SAAS,SAAS;AAIX,IAAM,aAAa;AACnB,IAAM,cAAc;AACpB,IAAM,cAAc;AAE3B,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AAEX,IAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AASJ,IAAM,gBAAgB,CAAC,OAAO,WAAW,UAAU;AAG1D,IAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAClD,UAAU,EACP,OAAO;AAAA,IACN,MAAM,EAAE,KAAK,CAAC,SAAS,eAAe,YAAY,CAAC,EAAE,QAAQ,OAAO;AAAA,IACpE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IACnC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAClC,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IACnD,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClD,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,QAAQ,EACL,OAAO;AAAA,IACN,UAAU,EAAE,KAAK,CAAC,OAAO,SAAS,eAAe,YAAY,CAAC,EAAE,QAAQ,KAAK;AAAA,IAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACpC,CAAC,EACA,SAAS;AAAA,EACZ,MAAM,EACH,OAAO;AAAA,IACN,QAAQ,EAAE,KAAK,aAAa,EAAE,QAAQ,SAAS;AAAA,EACjD,CAAC,EACA,SAAS;AAAA,EACZ,UAAU,EACP,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ;AAAA,IACnB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,MAAM,EACH,OAAO;AAAA,IACN,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,IAChE,WAAW,EAAE,KAAK,CAAC,UAAU,eAAe,CAAC,EAAE,SAAS;AAAA,EAC1D,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKZ,KAAK,EACF,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ;AAAA,IACnB,UAAU,EAAE,KAAK,CAAC,QAAQ,cAAc,OAAO,CAAC,EAAE,SAAS;AAAA,IAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,IAElC,MAAM,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC,EAAE,SAAS;AAAA,IAC7C,UAAU,EACP,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,YAAY,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAC7E,SAAS;AAAA,IACZ,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAK,EAAE,SAAS;AAAA,IACzD,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACvD,UAAU,EACP,OAAO;AAAA,MACN,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,MAChC,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,MAC7B,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,MAC7B,OAAO,EAAE,QAAQ,EAAE,SAAS;AAAA,MAC5B,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,IAClC,CAAC,EACA,SAAS;AAAA,EACd,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,WAAW,EACR,OAAO;AAAA;AAAA,IAEN,WAAW,EACR,OAAO;AAAA,MACN,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,MAC/C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAC/C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAChD,CAAC,EACA,SAAS;AAAA,EACd,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,MAAM,EACH,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ;AAAA,IACnB,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IACnC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,SAAS;AAAA;AAAA,IAE5D,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,IAE5C,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,CAAC,EACA,SAAS;AACd,CAAC;AAqBM,SAAS,WAAW,MAAM,QAAQ,IAAI,GAAW;AACtD,SAAO,KAAK,KAAK,YAAY,WAAW;AAC1C;AAEA,eAAsB,oBAAoB,MAAM,QAAQ,IAAI,GAIzD;AACD,QAAM,eAAe,KAAK,KAAK,UAAU;AACzC,QAAM,MAAM,KAAK,cAAc,UAAU,OAAO,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACnF,QAAM,MAAM,KAAK,cAAc,UAAU,WAAW,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACvF,QAAM,MAAM,KAAK,cAAc,OAAO,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAEzE,QAAM,gBAAgB,KAAK,cAAc,YAAY;AACrD,MAAI;AACF,UAAM,OAAO,eAAe,UAAU,IAAI;AAC1C,QAAI,YAAY,MAAM,SAAS,eAAe,MAAM;AACpD,UAAM,QAAQ,IAAI,IAAI,UAAU,MAAM,OAAO,CAAC;AAC9C,UAAM,UAAU,CAAC,mBAAmB,yBAAyB,EAAE;AAAA,MAC7D,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI;AAAA,IAC3B;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,kBAAY,GAAG,UAAU,QAAQ,CAAC;AAAA,EAAK,QAAQ,KAAK,IAAI,CAAC;AAAA;AACzD,YAAM,UAAU,eAAe,WAAW,EAAE,MAAM,IAAM,CAAC;AAAA,IAC3D;AAAA,EACF,QAAQ;AACN,UAAM,UAAU,eAAe,mBAAmB,EAAE,MAAM,IAAM,CAAC;AAAA,EACnE;AAEA,QAAM,aAAa,KAAK,cAAc,WAAW;AACjD,MAAI;AACF,UAAM,OAAO,YAAY,UAAU,IAAI;AAAA,EACzC,QAAQ;AACN,UAAM,UAAU,YAAY,qBAAqB,EAAE,MAAM,IAAM,CAAC;AAAA,EAClE;AAEA,SAAO,EAAE,cAAc,eAAe,WAAW;AACnD;AAEA,eAAsB,eACpB,MAAM,QAAQ,IAAI,GAC2B;AAC7C,QAAM,OAAO,WAAW,GAAG;AAC3B,QAAM,oBAAoB,GAAG;AAC7B,MAAI;AACF,UAAM,OAAO,MAAM,UAAU,IAAI;AACjC,UAAM,MAAM,MAAM,GAAK;AACvB,WAAO,EAAE,MAAM,SAAS,MAAM;AAAA,EAChC,QAAQ;AACN,UAAM,WAAgC;AAAA,MACpC,aAAa,QAAQ,IAAI,gBAAgB;AAAA;AAAA;AAAA,MAGzC,WAAW,uBAAuB,GAAG;AAAA,MACrC,UAAU,EAAE,MAAM,QAAQ;AAAA,MAC1B,aAAa;AAAA,IACf;AACA,UAAM,UAAU,MAAM,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC/E,UAAM,MAAM,MAAM,GAAK;AACvB,WAAO,EAAE,MAAM,SAAS,KAAK;AAAA,EAC/B;AACF;AAGA,eAAsB,gBACpB,QACA,MAAM,QAAQ,IAAI,GACS;AAC3B,QAAM,OAAO,WAAW,GAAG;AAC3B,QAAM,oBAAoB,GAAG;AAC7B,QAAM,UAAU,MAAM,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC7E,QAAM,MAAM,MAAM,GAAK;AACvB,SAAO,EAAE,KAAK;AAChB;AAEA,eAAsB,eAAe,MAAM,QAAQ,IAAI,GAAiC;AACtF,QAAM,OAAO,WAAW,GAAG;AAC3B,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,MAAM,MAAM;AACvC,aAAS,WAAW,MAAM,KAAK,MAAM,GAAG,CAAC;AAAA,EAC3C,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,SAAU,QAAO,CAAC;AAChE,UAAM;AAAA,EACR;AACA,OAAK,OAAO,MAAM,WAAW,UAAa,OAAO,gBAAiB,MAAM,aAAa,GAAG,GAAI;AAC1F,WAAO,iCAAiC,QAAQ,IAAI;AAAA,EACtD;AACA,SAAO;AACT;AASA,SAAS,iCACP,QACA,MACqB;AACrB,QAAM,EAAE,aAAa,cAAc,GAAG,KAAK,IAAI;AAC/C,QAAM,UAAU;AAAA,IACd,GAAI,OAAO,cAAc,CAAC,aAAa,IAAI,CAAC;AAAA,IAC5C,GAAI,OAAO,MAAM,WAAW,SAAY,CAAC,aAAa,IAAI,CAAC;AAAA,EAC7D;AACA,MAAI,CAAC,cAAc,IAAI,IAAI,GAAG;AAC5B,kBAAc,IAAI,IAAI;AACtB,YAAQ,OAAO;AAAA,MACb,uBAAuB,QAAQ,KAAK,OAAO,CAAC,OAAO,IAAI;AAAA;AAAA,IAEzD;AAAA,EACF;AACA,MAAI,CAAC,KAAK,KAAM,QAAO;AACvB,QAAM,EAAE,QAAQ,SAAS,GAAG,KAAK,IAAI,KAAK;AAC1C,SAAO,EAAE,GAAG,MAAM,KAAK;AACzB;AAEA,IAAM,gBAAgB,oBAAI,IAAY;AACtC,IAAM,eAAe,oBAAI,IAA8B;AAGvD,SAAS,aAAa,MAAgC;AACpD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,UAAU,aAAa,IAAI,GAAG;AAClC,MAAI,CAAC,SAAS;AACZ,cAAU,IAAI,QAAQ,CAAC,SAAS;AAC9B;AAAA,QACE;AAAA,QACA,CAAC,YAAY,mBAAmB,MAAM,wBAAwB;AAAA,QAC9D,EAAE,KAAK,KAAK,SAAS,IAAM;AAAA,QAC3B,CAAC,UAAU,KAAK,UAAU,IAAI;AAAA,MAChC;AAAA,IACF,CAAC;AACD,iBAAa,IAAI,KAAK,OAAO;AAAA,EAC/B;AACA,SAAO;AACT;AAUO,SAAS,kBAAkB,OAAuB;AACvD,SAAO,MAAM,QAAQ,qBAAqB,GAAG,EAAE,MAAM,GAAG,GAAG;AAC7D;AAGO,SAAS,uBAAuB,MAAM,QAAQ,IAAI,GAAW;AAClE,SAAO,kBAAkB,SAAS,GAAG,CAAC,KAAK;AAC7C;AAEA,eAAsB,qBAAqB,MAAM,QAAQ,IAAI,GAAoB;AAC/E,MAAI,QAAQ,IAAI,oBAAqB,QAAO,QAAQ,IAAI;AACxD,QAAM,OAAO,MAAM,eAAe,GAAG;AACrC,SAAO,KAAK,aAAa,uBAAuB,GAAG;AACrD;AAGA,IAAM,mBAAmB;AAQzB,eAAsB,uBAAuB,MAAM,QAAQ,IAAI,GAA2B;AACxF,QAAM,SAAS,uBAAuB,GAAG;AACzC,MAAI,WAAW,iBAAkB,QAAO;AACxC,QAAM,OAAO,WAAW,GAAG;AAC3B,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,IAAI,cAAc,iBAAkB,QAAO;AAC/C,MAAK,MAAM,aAAa,GAAG,KAAO,MAAM,qBAAqB,KAAK,gBAAgB,GAAI;AACpF,WAAO;AAAA,EACT;AACA,QAAM,YAAY,MAAM,GAAG,KAAK,UAAU,EAAE,GAAG,KAAK,WAAW,OAAO,GAAG,MAAM,CAAC,CAAC;AAAA,CAAI;AACrF,SAAO;AACT;AAEA,eAAe,qBAAqB,KAAa,WAAqC;AACpF,QAAM,YAAY,KAAK,KAAK,cAAc,QAAQ;AAClD,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,QAAQ,WAAW,EAAE,WAAW,KAAK,CAAC;AAAA,EACxD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,OAAO,IAAI,OAAO,oBAAoB,SAAS,UAAU,GAAG;AAClE,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,MAAM,SAAS,KAAK,EAAG;AAC5B,UAAM,OAAO,MAAM,SAAS,KAAK,WAAW,KAAK,GAAG,MAAM,EAAE,MAAM,MAAM,EAAE;AAC1E,QAAI,KAAK,KAAK,IAAI,EAAG,QAAO;AAAA,EAC9B;AACA,SAAO;AACT;AAEO,IAAM,uBACX;AAOF,eAAsB,kBACpB,MAAM,QAAQ,IAAI,GAClB,UAAyC,CAAC,GAChB;AAC1B,QAAM,cAAc,QAAQ,IAAI,0BAA0B;AAC1D,QAAM,OAAO,MAAM,eAAe,WAAW;AAC7C,QAAM,cAAc,QAAQ,IAAI,gBAAgB,KAAK,eAAe;AACpE,MAAI,CAAC,eAAe,QAAQ,oBAAoB,OAAO;AACrD,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AACA,QAAM,UAAU,QAAQ,IAAI,YAAY,KAAK,UAAU;AACvD,SAAO;AAAA,IACL;AAAA,IACA,WACE,QAAQ,IAAI,uBAAuB,KAAK,aAAa,uBAAuB,WAAW;AAAA,IACzF;AAAA,IACA,UAAU;AAAA,MACR,MAAM,KAAK,UAAU,QAAQ;AAAA,MAC7B,GAAI,UAAU,EAAE,QAAQ,QAAQ,IAAI,CAAC;AAAA,MACrC,GAAI,KAAK,UAAU,QAAQ,EAAE,OAAO,KAAK,SAAS,MAAM,IAAI,CAAC;AAAA,MAC7D,GAAI,KAAK,UAAU,mBAAmB,SAClC,EAAE,gBAAgB,KAAK,SAAS,eAAe,IAC/C,CAAC;AAAA,MACL,GAAI,KAAK,UAAU,gBAAgB,SAC/B,EAAE,aAAa,KAAK,SAAS,YAAY,IACzC,CAAC;AAAA,IACP;AAAA,IACA,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,IAC5D,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,EACrD;AACF;AAEA,eAAsB,uBAAuB,MAAM,QAAQ,IAAI,GAAoC;AACjG,QAAM,OAAO,WAAW,GAAG;AAC3B,MAAI;AACF,UAAM,OAAO,MAAM,KAAK,IAAI;AAC5B,UAAM,aAAa,KAAK,OAAO;AAC/B,UAAM,OAAO,WAAW,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG;AAGnD,UAAM,KAAK,QAAQ,aAAa,WAAW,eAAe;AAC1D,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,GAAI,KAAK,CAAC,IAAI,EAAE,SAAS,+CAA+C;AAAA,IAC1E;AAAA,EACF,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,UAAU;AACtD,aAAO,EAAE,MAAM,QAAQ,OAAO,MAAM,MAAM,IAAI,KAAK;AAAA,IACrD;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,qBAAqB,MAAM,QAAQ,IAAI,GAAmC;AAC9F,QAAM,eAAe,KAAK,KAAK,UAAU;AACzC,QAAM,iBAAiB,KAAK,cAAc,UAAU,OAAO;AAC3D,QAAM,qBAAqB,KAAK,cAAc,UAAU,WAAW;AACnE,QAAM,WAAW,KAAK,cAAc,OAAO;AAC3C,QAAM,gBAAgB,KAAK,cAAc,YAAY;AACrD,QAAM,aAAa,KAAK,cAAc,WAAW;AAEjD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,MAAM,QAAQ,IAAI;AAAA,IACpB,WAAW,YAAY;AAAA,IACvB,WAAW,cAAc;AAAA,IACzB,WAAW,kBAAkB;AAAA,IAC7B,WAAW,QAAQ;AAAA,IACnB,WAAW,aAAa;AAAA,IACxB,WAAW,UAAU;AAAA,EACvB,CAAC;AAED,SAAO;AAAA,IACL,cAAc;AAAA,MACZ,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,GAAI,qBACA,CAAC,IACD,EAAE,SAAS,0EAA0E;AAAA,IAC3F;AAAA,IACA,gBAAgB;AAAA,MACd,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,GAAI,uBAAuB,CAAC,IAAI,EAAE,SAAS,6CAA6C;AAAA,IAC1F;AAAA,IACA,oBAAoB;AAAA,MAClB,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,GAAI,2BACA,CAAC,IACD,EAAE,SAAS,iDAAiD;AAAA,IAClE;AAAA,IACA,UAAU;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,GAAI,iBAAiB,CAAC,IAAI,EAAE,SAAS,sCAAsC;AAAA,IAC7E;AAAA,IACA,WAAW;AAAA,MACT,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,GAAI,kBAAkB,CAAC,IAAI,EAAE,SAAS,iCAAiC;AAAA,IACzE;AAAA,IACA,UAAU;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,GAAI,gBACA,CAAC,IACD;AAAA,QACE,SACE;AAAA,MACJ;AAAA,IACN;AAAA,EACF;AACF;AAGA,eAAsB,eAAe,MAAM,QAAQ,IAAI,GAAwB;AAC7E,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,WAAY,cAAoC,SAAS,OAAO,GAAG;AACrE,WAAO;AAAA,EACT;AACA,QAAM,OAAO,MAAM,eAAe,GAAG;AACrC,SAAO,KAAK,MAAM,UAAU;AAC9B;AAGA,eAAsB,cAAc,QAAoB,MAAM,QAAQ,IAAI,GAAkB;AAC1F,QAAM,eAAe,GAAG;AACxB,QAAM,OAAO,WAAW,GAAG;AAC3B,QAAM,MAAM,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AACnD,MAAI,OAAO,EAAE,GAAI,IAAI,MAA8C,OAAO;AAE1E,QAAM,YAAY,MAAM,GAAG,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC9E;AAGA,eAAsB,eAAe,SAAkB,MAAM,QAAQ,IAAI,GAAkB;AACzF,QAAM,eAAe,GAAG;AACxB,QAAM,OAAO,WAAW,GAAG;AAC3B,QAAM,MAAM,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AACnD,MAAI,OAAO,EAAE,GAAI,IAAI,MAA8C,QAAQ;AAC3E,QAAM,YAAY,MAAM,GAAG,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC9E;AAGA,eAAsB,cACpB,SACA,UAAgE,CAAC,GACjE,MAAM,QAAQ,IAAI,GACH;AACf,QAAM,eAAe,GAAG;AACxB,QAAM,OAAO,WAAW,GAAG;AAC3B,QAAM,MAAM,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AACnD,MAAI,MAAM;AAAA,IACR,GAAI,IAAI;AAAA,IACR;AAAA,IACA,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,EAClD;AACA,QAAM,YAAY,MAAM,GAAG,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC9E;AAOA,eAAsB,eACpB,KACA,OACA,MAAM,QAAQ,IAAI,GACH;AACf,QAAM,eAAe,GAAG;AACxB,QAAM,OAAO,WAAW,GAAG;AAC3B,QAAM,MAAM,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AACnD,MAAI,GAAG,IAAI;AACX,aAAW,MAAM,GAAG;AACpB,QAAM,YAAY,MAAM,GAAG,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC9E;AAEO,SAAS,cAAc,OAAyB;AACrD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,WAAW;AAEf,eAAW,OAAO;AAAA,MAChB,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI;AAAA,IACd,GAAG;AACD,UAAI,IAAK,YAAW,SAAS,MAAM,GAAG,EAAE,KAAK,YAAY;AAAA,IAC3D;AAGA,eAAW,SAAS;AAAA,MAClB;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,aAAa;AACxD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,KAAgC,EAAE,IAAI,CAAC,CAAC,KAAK,MAAM,MAAM;AAAA,MACtE;AAAA,MACA,qCAAqC,KAAK,GAAG,IAAI,eAAe,cAAc,MAAM;AAAA,IACtF,CAAC;AAAA,EACH;AACF;AAEA,eAAe,WAAW,MAAgC;AACxD,MAAI;AACF,UAAM,OAAO,MAAM,UAAU,IAAI;AACjC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/core/config-file.ts"],"sourcesContent":["import { execFile } from \"node:child_process\";\nimport { constants } from \"node:fs\";\nimport { access, chmod, mkdir, readdir, readFile, stat, writeFile } from \"node:fs/promises\";\nimport { basename, join, resolve } from \"node:path\";\nimport { z } from \"zod\";\nimport { writeAtomic } from \"./markdown-store-fs.js\";\nimport type { CodeBuddyConfig } from \"./types.js\";\n\nexport const CONFIG_DIR = \".codebuddy\";\nexport const CONFIG_FILE = \"config.json\";\nexport const POLICY_FILE = \"policies.yaml\";\n\nconst PROJECT_GITIGNORE = [\n  \"# CodeBuddy local-only files\",\n  \"/config.json\",\n  \"/cache/\",\n  \"/memory/review/\",\n  \"/memory/review-archive/\",\n  \"/plans/.locks/\",\n  \"/memory/.locks/\",\n  \"\",\n  \"# Keep these reviewable project artifacts shareable by default:\",\n  \"#   /memory/facts/*.md\",\n  \"#   /memory/summaries/*.md\",\n  \"#   /plans/*.md\",\n  \"# If your project memory is private, ignore /memory/ in the repo root .gitignore.\",\n  \"\",\n].join(\"\\n\");\n\nconst DEFAULT_POLICY_FILE = [\n  \"rules:\",\n  \"  - id: auth-sensitive\",\n  '    pattern: \"src/auth/**\"',\n  '    message: \"Auth changes need careful review.\"',\n  \"    weight: 70\",\n  \"\",\n].join(\"\\n\");\n\n/**\n * Plan policy controls how strongly CodeBuddy nudges agents toward writing\n * a plan before substantive work:\n *   - off:      plans are never suggested or required.\n *   - suggest:  agents are reminded to plan, but small tasks stay lightweight (default).\n *   - required: agents should refuse substantive changes without an active plan.\n */\nexport const PLAN_POLICIES = [\"off\", \"suggest\", \"required\"] as const;\nexport type PlanPolicy = (typeof PLAN_POLICIES)[number];\n\nconst fileSchema = z.object({\n  postgresUrl: z.string().min(1).optional(),\n  namespace: z.string().min(1).optional(),\n  tokenBudget: z.number().int().positive().optional(),\n  provider: z\n    .object({\n      type: z.enum([\"local\", \"huggingface\", \"openrouter\"]).default(\"local\"),\n      apiKey: z.string().min(1).optional(),\n      model: z.string().min(1).optional(),\n      relevanceFloor: z.number().min(-1).max(1).optional(),\n      recallFloor: z.number().min(-1).max(1).optional(),\n    })\n    .optional(),\n  /** Optional cross-encoder that orders recalled facts (off by default). */\n  rerank: z\n    .object({\n      provider: z.enum([\"off\", \"local\", \"huggingface\", \"openrouter\"]).default(\"off\"),\n      model: z.string().min(1).optional(),\n    })\n    .optional(),\n  plan: z\n    .object({\n      policy: z.enum(PLAN_POLICIES).default(\"suggest\"),\n    })\n    .optional(),\n  graphify: z\n    .object({\n      enabled: z.boolean(),\n      graphPath: z.string().min(1).optional(),\n    })\n    .optional(),\n  /** Git churn risk signal (`risk/signals/churn.ts`); defaults keep the 30-day window. */\n  risk: z\n    .object({\n      churnWindowDays: z.number().int().positive().max(3650).optional(),\n      churnMode: z.enum([\"window\", \"lifetime-size\"]).optional(),\n    })\n    .optional(),\n  /**\n   * Optional hosted small-model layer (bring your own key). Keys are read from\n   * the environment only, never from this file (`src/llm/config.ts`).\n   */\n  llm: z\n    .object({\n      enabled: z.boolean(),\n      provider: z.enum([\"groq\", \"openrouter\", \"local\"]).optional(),\n      model: z.string().min(1).optional(),\n      /** Local model size (`codebuddy models add local-llm --size`); default \"default\". */\n      size: z.enum([\"default\", \"better\"]).optional(),\n      fallback: z\n        .object({ provider: z.enum([\"groq\", \"openrouter\"]), model: z.string().min(1) })\n        .optional(),\n      timeoutMs: z.number().int().min(100).max(5_000).optional(),\n      dailyTokenBudget: z.number().int().positive().optional(),\n      features: z\n        .object({\n          summaries: z.boolean().optional(),\n          rerank: z.boolean().optional(),\n          memory: z.boolean().optional(),\n          facts: z.boolean().optional(),\n          expansion: z.boolean().optional(),\n        })\n        .optional(),\n    })\n    .optional(),\n  /** Task → file discovery tuning (`context/discovery.ts`). */\n  discovery: z\n    .object({\n      /** The agreement rule: top k per dense signal and the cosine floors for a vote. */\n      agreement: z\n        .object({\n          topK: z.number().int().min(1).max(20).optional(),\n          chunkFloor: z.number().min(-1).max(1).optional(),\n          cardFloor: z.number().min(-1).max(1).optional(),\n        })\n        .optional(),\n    })\n    .optional(),\n  /** Optional local semantic retrieval via zvec-grep (`zg`). Off unless enabled. */\n  zvec: z\n    .object({\n      enabled: z.boolean(),\n      binary: z.string().min(1).optional(),\n      timeoutMs: z.number().int().positive().max(10_000).optional(),\n      /** Task IDF coverage a vector-only file needs (0..1, default 0.3; docs/zvec-floor.md). */\n      minScore: z.number().min(0).max(1).optional(),\n      /** zg embedding model for the intent-card workspace (default local/bge-small-en-v1.5). */\n      cardModel: z.string().min(1).optional(),\n    })\n    .optional(),\n});\n\nexport type CodeBuddyFileConfig = z.infer<typeof fileSchema>;\n\nexport type ConfigPermissionReport = {\n  path: string;\n  exists: boolean;\n  mode: string | null;\n  ok: boolean;\n  warning?: string;\n};\n\nexport type ProjectScaffoldReport = {\n  codebuddyDir: { path: string; exists: boolean; ok: boolean; warning?: string };\n  memoryFactsDir: { path: string; exists: boolean; ok: boolean; warning?: string };\n  memorySummariesDir: { path: string; exists: boolean; ok: boolean; warning?: string };\n  plansDir: { path: string; exists: boolean; ok: boolean; warning?: string };\n  gitignore: { path: string; exists: boolean; ok: boolean; warning?: string };\n  policies: { path: string; exists: boolean; ok: boolean; warning?: string };\n};\n\nexport function configPath(cwd = process.cwd()): string {\n  return join(cwd, CONFIG_DIR, CONFIG_FILE);\n}\n\nexport async function initProjectScaffold(cwd = process.cwd()): Promise<{\n  codebuddyDir: string;\n  gitignorePath: string;\n  policyPath: string;\n}> {\n  const codebuddyDir = join(cwd, CONFIG_DIR);\n  await mkdir(join(codebuddyDir, \"memory\", \"facts\"), { recursive: true, mode: 0o700 });\n  await mkdir(join(codebuddyDir, \"memory\", \"summaries\"), { recursive: true, mode: 0o700 });\n  await mkdir(join(codebuddyDir, \"plans\"), { recursive: true, mode: 0o700 });\n\n  const gitignorePath = join(codebuddyDir, \".gitignore\");\n  try {\n    await access(gitignorePath, constants.F_OK);\n    let gitignore = await readFile(gitignorePath, \"utf8\");\n    const lines = new Set(gitignore.split(/\\r?\\n/));\n    const missing = [\"/memory/review/\", \"/memory/review-archive/\"].filter(\n      (line) => !lines.has(line),\n    );\n    if (missing.length > 0) {\n      gitignore = `${gitignore.trimEnd()}\\n${missing.join(\"\\n\")}\\n`;\n      await writeFile(gitignorePath, gitignore, { mode: 0o644 });\n    }\n  } catch {\n    await writeFile(gitignorePath, PROJECT_GITIGNORE, { mode: 0o644 });\n  }\n\n  const policyPath = join(codebuddyDir, POLICY_FILE);\n  try {\n    await access(policyPath, constants.F_OK);\n  } catch {\n    await writeFile(policyPath, DEFAULT_POLICY_FILE, { mode: 0o644 });\n  }\n\n  return { codebuddyDir, gitignorePath, policyPath };\n}\n\nexport async function initConfigFile(\n  cwd = process.cwd(),\n): Promise<{ path: string; created: boolean }> {\n  const path = configPath(cwd);\n  await initProjectScaffold(cwd);\n  try {\n    await access(path, constants.F_OK);\n    await chmod(path, 0o600);\n    return { path, created: false };\n  } catch {\n    const template: CodeBuddyFileConfig = {\n      postgresUrl: process.env.DATABASE_URL ?? \"postgres://localhost:5432/codebuddy\",\n      // Default to the folder name (sanitized) so a fresh scaffold agrees with\n      // doctor's expected default instead of warning immediately after init.\n      namespace: defaultNamespaceForCwd(cwd),\n      provider: { type: \"local\" },\n      tokenBudget: 4000,\n    };\n    await writeFile(path, `${JSON.stringify(template, null, 2)}\\n`, { mode: 0o600 });\n    await chmod(path, 0o600);\n    return { path, created: true };\n  }\n}\n\n/** Persist a complete project config without changing its private permissions. */\nexport async function writeConfigFile(\n  config: CodeBuddyFileConfig,\n  cwd = process.cwd(),\n): Promise<{ path: string }> {\n  const path = configPath(cwd);\n  await initProjectScaffold(cwd);\n  await writeFile(path, `${JSON.stringify(config, null, 2)}\\n`, { mode: 0o600 });\n  await chmod(path, 0o600);\n  return { path };\n}\n\nexport async function readConfigFile(cwd = process.cwd()): Promise<CodeBuddyFileConfig> {\n  const path = configPath(cwd);\n  let parsed: CodeBuddyFileConfig;\n  try {\n    const raw = await readFile(path, \"utf8\");\n    parsed = fileSchema.parse(JSON.parse(raw));\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return {};\n    throw error;\n  }\n  if ((parsed.zvec?.binary !== undefined || parsed.postgresUrl) && (await trackedByGit(cwd))) {\n    return withoutRepositorySuppliedSecrets(parsed, path);\n  }\n  return parsed;\n}\n\n/**\n * `init` gitignores `.codebuddy/config.json`, so a tracked one came with the\n * repository, not from this user. A cloned repository must not choose a\n * program for CodeBuddy to run (`zvec.binary`) or a database to send project\n * memory to (`postgresUrl`); those two keys are ignored in that case and must\n * come from the environment (DATABASE_URL) or an untracked config.\n */\nfunction withoutRepositorySuppliedSecrets(\n  config: CodeBuddyFileConfig,\n  path: string,\n): CodeBuddyFileConfig {\n  const { postgresUrl: _postgresUrl, ...rest } = config;\n  const ignored = [\n    ...(config.postgresUrl ? [\"postgresUrl\"] : []),\n    ...(config.zvec?.binary !== undefined ? [\"zvec.binary\"] : []),\n  ];\n  if (!warnedTracked.has(path)) {\n    warnedTracked.add(path);\n    process.stderr.write(\n      `codebuddy: ignoring ${ignored.join(\" and \")} in ${path}: the file is tracked by git, so it came with the repository. ` +\n        \"Untrack it (git rm --cached) or set DATABASE_URL.\\n\",\n    );\n  }\n  if (!rest.zvec) return rest;\n  const { binary: _binary, ...zvec } = rest.zvec;\n  return { ...rest, zvec };\n}\n\nconst warnedTracked = new Set<string>();\nconst trackedCache = new Map<string, Promise<boolean>>();\n\n/** Whether `.codebuddy/config.json` under `root` is tracked by git (cached per process). */\nfunction trackedByGit(root: string): Promise<boolean> {\n  const key = resolve(root);\n  let pending = trackedCache.get(key);\n  if (!pending) {\n    pending = new Promise((done) => {\n      execFile(\n        \"git\",\n        [\"ls-files\", \"--error-unmatch\", \"--\", \".codebuddy/config.json\"],\n        { cwd: key, timeout: 5_000 },\n        (error) => done(error === null),\n      );\n    });\n    trackedCache.set(key, pending);\n  }\n  return pending;\n}\n\n/**\n * The ONE namespace-resolution rule, shared by the DB/MCP runtime, every\n * file-based CLI command, and doctor. Precedence:\n *   1. CODEBUDDY_NAMESPACE env\n *   2. `.codebuddy/config.json` `namespace`\n *   3. the current folder name (sanitized) — matching what doctor reports as\n *      the expected default.\n */\nexport function sanitizeNamespace(value: string): string {\n  return value.replace(/[^a-zA-Z0-9_.:-]/g, \"-\").slice(0, 128);\n}\n\n/** Folder-name fallback used when neither env nor config specify a namespace. */\nexport function defaultNamespaceForCwd(cwd = process.cwd()): string {\n  return sanitizeNamespace(basename(cwd)) || \"default\";\n}\n\nexport async function resolveNamespaceFrom(cwd = process.cwd()): Promise<string> {\n  if (process.env.CODEBUDDY_NAMESPACE) return process.env.CODEBUDDY_NAMESPACE;\n  const file = await readConfigFile(cwd);\n  return file.namespace ?? defaultNamespaceForCwd(cwd);\n}\n\n/** Scaffolds before 2.0 wrote this literal, so every project shared one namespace. */\nconst LEGACY_NAMESPACE = \"default\";\n\n/**\n * Rewrites a legacy `\"namespace\": \"default\"` in `.codebuddy/config.json` to the\n * folder's default and returns the new namespace, or null when nothing changed.\n * Skipped when the file is tracked by git (it belongs to the repository) or\n * when Markdown memory was saved under \"default\" (it would drop out of recall).\n */\nexport async function migrateLegacyNamespace(cwd = process.cwd()): Promise<string | null> {\n  const target = defaultNamespaceForCwd(cwd);\n  if (target === LEGACY_NAMESPACE) return null;\n  const path = configPath(cwd);\n  let raw: Record<string, unknown>;\n  try {\n    raw = JSON.parse(await readFile(path, \"utf8\")) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n  if (raw.namespace !== LEGACY_NAMESPACE) return null;\n  if ((await trackedByGit(cwd)) || (await hasMemoryInNamespace(cwd, LEGACY_NAMESPACE))) {\n    return null;\n  }\n  await writeAtomic(path, `${JSON.stringify({ ...raw, namespace: target }, null, 2)}\\n`);\n  return target;\n}\n\nasync function hasMemoryInNamespace(cwd: string, namespace: string): Promise<boolean> {\n  const memoryDir = join(cwd, \".codebuddy\", \"memory\");\n  let entries: string[];\n  try {\n    entries = await readdir(memoryDir, { recursive: true });\n  } catch {\n    return false;\n  }\n  const line = new RegExp(`^namespace: ['\"]?${namespace}['\"]?$`, \"m\");\n  for (const entry of entries) {\n    if (!entry.endsWith(\".md\")) continue;\n    const text = await readFile(join(memoryDir, entry), \"utf8\").catch(() => \"\");\n    if (line.test(text)) return true;\n  }\n  return false;\n}\n\nexport const MISSING_DATABASE_URL =\n  \"DATABASE_URL or .codebuddy/config.json postgresUrl is required.\";\n\n/**\n * `requireDatabase: false` (the MCP server) returns an empty `postgresUrl`\n * instead of throwing, so file-based tools still run without PostgreSQL;\n * `createRuntime` rejects the empty URL with the same message.\n */\nexport async function loadRuntimeConfig(\n  cwd = process.cwd(),\n  options: { requireDatabase?: boolean } = {},\n): Promise<CodeBuddyConfig> {\n  const projectRoot = process.env.CODEBUDDY_PROJECT_ROOT ?? cwd;\n  const file = await readConfigFile(projectRoot);\n  const postgresUrl = process.env.DATABASE_URL ?? file.postgresUrl ?? \"\";\n  if (!postgresUrl && options.requireDatabase !== false) {\n    throw new Error(MISSING_DATABASE_URL);\n  }\n  const hfToken = process.env.HF_TOKEN ?? file.provider?.apiKey;\n  return {\n    postgresUrl,\n    namespace:\n      process.env.CODEBUDDY_NAMESPACE ?? file.namespace ?? defaultNamespaceForCwd(projectRoot),\n    projectRoot,\n    provider: {\n      type: file.provider?.type ?? \"local\",\n      ...(hfToken ? { apiKey: hfToken } : {}),\n      ...(file.provider?.model ? { model: file.provider.model } : {}),\n      ...(file.provider?.relevanceFloor !== undefined\n        ? { relevanceFloor: file.provider.relevanceFloor }\n        : {}),\n      ...(file.provider?.recallFloor !== undefined\n        ? { recallFloor: file.provider.recallFloor }\n        : {}),\n    },\n    ...(file.tokenBudget ? { tokenBudget: file.tokenBudget } : {}),\n    ...(file.graphify ? { graphify: file.graphify } : {}),\n  };\n}\n\nexport async function checkConfigPermissions(cwd = process.cwd()): Promise<ConfigPermissionReport> {\n  const path = configPath(cwd);\n  try {\n    const info = await stat(path);\n    const modeNumber = info.mode & 0o777;\n    const mode = modeNumber.toString(8).padStart(4, \"0\");\n    // Windows has no POSIX mode bits (stat reports 0o666/0o444 whatever chmod\n    // did); the file is protected by the user profile's ACL instead.\n    const ok = process.platform === \"win32\" || modeNumber === 0o600;\n    return {\n      path,\n      exists: true,\n      mode,\n      ok,\n      ...(ok ? {} : { warning: \".codebuddy/config.json should be chmod 0600.\" }),\n    };\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n      return { path, exists: false, mode: null, ok: true };\n    }\n    throw error;\n  }\n}\n\nexport async function checkProjectScaffold(cwd = process.cwd()): Promise<ProjectScaffoldReport> {\n  const codebuddyDir = join(cwd, CONFIG_DIR);\n  const memoryFactsDir = join(codebuddyDir, \"memory\", \"facts\");\n  const memorySummariesDir = join(codebuddyDir, \"memory\", \"summaries\");\n  const plansDir = join(codebuddyDir, \"plans\");\n  const gitignorePath = join(codebuddyDir, \".gitignore\");\n  const policyPath = join(codebuddyDir, POLICY_FILE);\n\n  const [\n    codebuddyDirExists,\n    memoryFactsDirExists,\n    memorySummariesDirExists,\n    plansDirExists,\n    gitignoreExists,\n    policiesExist,\n  ] = await Promise.all([\n    pathExists(codebuddyDir),\n    pathExists(memoryFactsDir),\n    pathExists(memorySummariesDir),\n    pathExists(plansDir),\n    pathExists(gitignorePath),\n    pathExists(policyPath),\n  ]);\n\n  return {\n    codebuddyDir: {\n      path: codebuddyDir,\n      exists: codebuddyDirExists,\n      ok: codebuddyDirExists,\n      ...(codebuddyDirExists\n        ? {}\n        : { warning: \"Run `codebuddy` or `codebuddy init` to create the project scaffold.\" }),\n    },\n    memoryFactsDir: {\n      path: memoryFactsDir,\n      exists: memoryFactsDirExists,\n      ok: memoryFactsDirExists,\n      ...(memoryFactsDirExists ? {} : { warning: \"Missing .codebuddy/memory/facts directory.\" }),\n    },\n    memorySummariesDir: {\n      path: memorySummariesDir,\n      exists: memorySummariesDirExists,\n      ok: memorySummariesDirExists,\n      ...(memorySummariesDirExists\n        ? {}\n        : { warning: \"Missing .codebuddy/memory/summaries directory.\" }),\n    },\n    plansDir: {\n      path: plansDir,\n      exists: plansDirExists,\n      ok: plansDirExists,\n      ...(plansDirExists ? {} : { warning: \"Missing .codebuddy/plans directory.\" }),\n    },\n    gitignore: {\n      path: gitignorePath,\n      exists: gitignoreExists,\n      ok: gitignoreExists,\n      ...(gitignoreExists ? {} : { warning: \"Missing .codebuddy/.gitignore.\" }),\n    },\n    policies: {\n      path: policyPath,\n      exists: policiesExist,\n      ok: policiesExist,\n      ...(policiesExist\n        ? {}\n        : {\n            warning:\n              \"Missing .codebuddy/policies.yaml. Run `codebuddy` or `codebuddy init` to scaffold it.\",\n          }),\n    },\n  };\n}\n\n/** Read the plan policy, honoring CODEBUDDY_PLAN_POLICY then the config file. */\nexport async function loadPlanPolicy(cwd = process.cwd()): Promise<PlanPolicy> {\n  const fromEnv = process.env.CODEBUDDY_PLAN_POLICY;\n  if (fromEnv && (PLAN_POLICIES as readonly string[]).includes(fromEnv)) {\n    return fromEnv as PlanPolicy;\n  }\n  const file = await readConfigFile(cwd);\n  return file.plan?.policy ?? \"suggest\";\n}\n\n/** Persist the plan policy into `.codebuddy/config.json`, creating it if needed. */\nexport async function setPlanPolicy(policy: PlanPolicy, cwd = process.cwd()): Promise<void> {\n  await initConfigFile(cwd);\n  const path = configPath(cwd);\n  const raw = JSON.parse(await readFile(path, \"utf8\")) as Record<string, unknown>;\n  raw.plan = { ...(raw.plan as Record<string, unknown> | undefined), policy };\n  // Atomic rewrite: this file holds the postgresUrl and provider apiKey.\n  await writeAtomic(path, `${JSON.stringify(raw, null, 2)}\\n`, { mode: 0o600 });\n}\n\n/** Turn optional zvec-grep retrieval on or off in `.codebuddy/config.json`. */\nexport async function setZvecEnabled(enabled: boolean, cwd = process.cwd()): Promise<void> {\n  await initConfigFile(cwd);\n  const path = configPath(cwd);\n  const raw = JSON.parse(await readFile(path, \"utf8\")) as Record<string, unknown>;\n  raw.zvec = { ...(raw.zvec as Record<string, unknown> | undefined), enabled };\n  await writeAtomic(path, `${JSON.stringify(raw, null, 2)}\\n`, { mode: 0o600 });\n}\n\n/** Turn the BYOK LLM layer on or off; never writes a key (keys live in the environment). */\nexport async function setLlmEnabled(\n  enabled: boolean,\n  options: { provider?: \"groq\" | \"openrouter\"; model?: string } = {},\n  cwd = process.cwd(),\n): Promise<void> {\n  await initConfigFile(cwd);\n  const path = configPath(cwd);\n  const raw = JSON.parse(await readFile(path, \"utf8\")) as Record<string, unknown>;\n  raw.llm = {\n    ...(raw.llm as Record<string, unknown> | undefined),\n    enabled,\n    ...(options.provider ? { provider: options.provider } : {}),\n    ...(options.model ? { model: options.model } : {}),\n  };\n  await writeAtomic(path, `${JSON.stringify(raw, null, 2)}\\n`, { mode: 0o600 });\n}\n\n/**\n * Replace one top-level block of `.codebuddy/config.json` (`provider`,\n * `rerank`), keeping every other key and the private file mode. The result\n * must still parse, so a bad value never reaches disk.\n */\nexport async function setConfigBlock(\n  key: \"provider\" | \"rerank\" | \"llm\",\n  value: Record<string, unknown>,\n  cwd = process.cwd(),\n): Promise<void> {\n  await initConfigFile(cwd);\n  const path = configPath(cwd);\n  const raw = JSON.parse(await readFile(path, \"utf8\")) as Record<string, unknown>;\n  raw[key] = value;\n  fileSchema.parse(raw);\n  await writeAtomic(path, `${JSON.stringify(raw, null, 2)}\\n`, { mode: 0o600 });\n}\n\nexport function redactSecrets(value: unknown): unknown {\n  if (typeof value === \"string\") {\n    let redacted = value;\n    // Provider keys (HF, BYOK LLM) literally anywhere in a string.\n    for (const key of [\n      process.env.HF_TOKEN,\n      process.env.GROQ_API_KEY,\n      process.env.OPENROUTER_API_KEY,\n      process.env.CODEBUDDY_LLM_API_KEY,\n    ]) {\n      if (key) redacted = redacted.split(key).join(\"[REDACTED]\");\n    }\n    // Credentials embedded in connection URLs (postgres://user:pass@host…).\n    // The password — not the username — is the secret.\n    redacted = redacted.replace(\n      /(\\b[a-z][a-z0-9+.-]*:\\/\\/[^:/\\s@]+:)[^/\\s@]+(@)/gi,\n      \"$1[REDACTED]$2\",\n    );\n    return redacted;\n  }\n  if (Array.isArray(value)) return value.map(redactSecrets);\n  if (!value || typeof value !== \"object\") return value;\n  return Object.fromEntries(\n    Object.entries(value as Record<string, unknown>).map(([key, nested]) => [\n      key,\n      /token|apiKey|authorization|secret/i.test(key) ? \"[REDACTED]\" : redactSecrets(nested),\n    ]),\n  );\n}\n\nasync function pathExists(path: string): Promise<boolean> {\n  try {\n    await access(path, constants.F_OK);\n    return true;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;AAAA,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;AAC1B,SAAS,QAAQ,OAAO,OAAO,SAAS,UAAU,MAAM,iBAAiB;AACzE,SAAS,UAAU,MAAM,eAAe;AACxC,SAAS,SAAS;AAIX,IAAM,aAAa;AACnB,IAAM,cAAc;AACpB,IAAM,cAAc;AAE3B,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AAEX,IAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AASJ,IAAM,gBAAgB,CAAC,OAAO,WAAW,UAAU;AAG1D,IAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAClD,UAAU,EACP,OAAO;AAAA,IACN,MAAM,EAAE,KAAK,CAAC,SAAS,eAAe,YAAY,CAAC,EAAE,QAAQ,OAAO;AAAA,IACpE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IACnC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAClC,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IACnD,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClD,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,QAAQ,EACL,OAAO;AAAA,IACN,UAAU,EAAE,KAAK,CAAC,OAAO,SAAS,eAAe,YAAY,CAAC,EAAE,QAAQ,KAAK;AAAA,IAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACpC,CAAC,EACA,SAAS;AAAA,EACZ,MAAM,EACH,OAAO;AAAA,IACN,QAAQ,EAAE,KAAK,aAAa,EAAE,QAAQ,SAAS;AAAA,EACjD,CAAC,EACA,SAAS;AAAA,EACZ,UAAU,EACP,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ;AAAA,IACnB,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,MAAM,EACH,OAAO;AAAA,IACN,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,IAChE,WAAW,EAAE,KAAK,CAAC,UAAU,eAAe,CAAC,EAAE,SAAS;AAAA,EAC1D,CAAC,EACA,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKZ,KAAK,EACF,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ;AAAA,IACnB,UAAU,EAAE,KAAK,CAAC,QAAQ,cAAc,OAAO,CAAC,EAAE,SAAS;AAAA,IAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,IAElC,MAAM,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC,EAAE,SAAS;AAAA,IAC7C,UAAU,EACP,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,YAAY,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAC7E,SAAS;AAAA,IACZ,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAK,EAAE,SAAS;AAAA,IACzD,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACvD,UAAU,EACP,OAAO;AAAA,MACN,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,MAChC,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,MAC7B,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,MAC7B,OAAO,EAAE,QAAQ,EAAE,SAAS;AAAA,MAC5B,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,IAClC,CAAC,EACA,SAAS;AAAA,EACd,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,WAAW,EACR,OAAO;AAAA;AAAA,IAEN,WAAW,EACR,OAAO;AAAA,MACN,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,MAC/C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAC/C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAChD,CAAC,EACA,SAAS;AAAA,EACd,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,MAAM,EACH,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ;AAAA,IACnB,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IACnC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,SAAS;AAAA;AAAA,IAE5D,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA,IAE5C,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,CAAC,EACA,SAAS;AACd,CAAC;AAqBM,SAAS,WAAW,MAAM,QAAQ,IAAI,GAAW;AACtD,SAAO,KAAK,KAAK,YAAY,WAAW;AAC1C;AAEA,eAAsB,oBAAoB,MAAM,QAAQ,IAAI,GAIzD;AACD,QAAM,eAAe,KAAK,KAAK,UAAU;AACzC,QAAM,MAAM,KAAK,cAAc,UAAU,OAAO,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACnF,QAAM,MAAM,KAAK,cAAc,UAAU,WAAW,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACvF,QAAM,MAAM,KAAK,cAAc,OAAO,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAEzE,QAAM,gBAAgB,KAAK,cAAc,YAAY;AACrD,MAAI;AACF,UAAM,OAAO,eAAe,UAAU,IAAI;AAC1C,QAAI,YAAY,MAAM,SAAS,eAAe,MAAM;AACpD,UAAM,QAAQ,IAAI,IAAI,UAAU,MAAM,OAAO,CAAC;AAC9C,UAAM,UAAU,CAAC,mBAAmB,yBAAyB,EAAE;AAAA,MAC7D,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI;AAAA,IAC3B;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,kBAAY,GAAG,UAAU,QAAQ,CAAC;AAAA,EAAK,QAAQ,KAAK,IAAI,CAAC;AAAA;AACzD,YAAM,UAAU,eAAe,WAAW,EAAE,MAAM,IAAM,CAAC;AAAA,IAC3D;AAAA,EACF,QAAQ;AACN,UAAM,UAAU,eAAe,mBAAmB,EAAE,MAAM,IAAM,CAAC;AAAA,EACnE;AAEA,QAAM,aAAa,KAAK,cAAc,WAAW;AACjD,MAAI;AACF,UAAM,OAAO,YAAY,UAAU,IAAI;AAAA,EACzC,QAAQ;AACN,UAAM,UAAU,YAAY,qBAAqB,EAAE,MAAM,IAAM,CAAC;AAAA,EAClE;AAEA,SAAO,EAAE,cAAc,eAAe,WAAW;AACnD;AAEA,eAAsB,eACpB,MAAM,QAAQ,IAAI,GAC2B;AAC7C,QAAM,OAAO,WAAW,GAAG;AAC3B,QAAM,oBAAoB,GAAG;AAC7B,MAAI;AACF,UAAM,OAAO,MAAM,UAAU,IAAI;AACjC,UAAM,MAAM,MAAM,GAAK;AACvB,WAAO,EAAE,MAAM,SAAS,MAAM;AAAA,EAChC,QAAQ;AACN,UAAM,WAAgC;AAAA,MACpC,aAAa,QAAQ,IAAI,gBAAgB;AAAA;AAAA;AAAA,MAGzC,WAAW,uBAAuB,GAAG;AAAA,MACrC,UAAU,EAAE,MAAM,QAAQ;AAAA,MAC1B,aAAa;AAAA,IACf;AACA,UAAM,UAAU,MAAM,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC/E,UAAM,MAAM,MAAM,GAAK;AACvB,WAAO,EAAE,MAAM,SAAS,KAAK;AAAA,EAC/B;AACF;AAGA,eAAsB,gBACpB,QACA,MAAM,QAAQ,IAAI,GACS;AAC3B,QAAM,OAAO,WAAW,GAAG;AAC3B,QAAM,oBAAoB,GAAG;AAC7B,QAAM,UAAU,MAAM,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC7E,QAAM,MAAM,MAAM,GAAK;AACvB,SAAO,EAAE,KAAK;AAChB;AAEA,eAAsB,eAAe,MAAM,QAAQ,IAAI,GAAiC;AACtF,QAAM,OAAO,WAAW,GAAG;AAC3B,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,MAAM,MAAM;AACvC,aAAS,WAAW,MAAM,KAAK,MAAM,GAAG,CAAC;AAAA,EAC3C,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,SAAU,QAAO,CAAC;AAChE,UAAM;AAAA,EACR;AACA,OAAK,OAAO,MAAM,WAAW,UAAa,OAAO,gBAAiB,MAAM,aAAa,GAAG,GAAI;AAC1F,WAAO,iCAAiC,QAAQ,IAAI;AAAA,EACtD;AACA,SAAO;AACT;AASA,SAAS,iCACP,QACA,MACqB;AACrB,QAAM,EAAE,aAAa,cAAc,GAAG,KAAK,IAAI;AAC/C,QAAM,UAAU;AAAA,IACd,GAAI,OAAO,cAAc,CAAC,aAAa,IAAI,CAAC;AAAA,IAC5C,GAAI,OAAO,MAAM,WAAW,SAAY,CAAC,aAAa,IAAI,CAAC;AAAA,EAC7D;AACA,MAAI,CAAC,cAAc,IAAI,IAAI,GAAG;AAC5B,kBAAc,IAAI,IAAI;AACtB,YAAQ,OAAO;AAAA,MACb,uBAAuB,QAAQ,KAAK,OAAO,CAAC,OAAO,IAAI;AAAA;AAAA,IAEzD;AAAA,EACF;AACA,MAAI,CAAC,KAAK,KAAM,QAAO;AACvB,QAAM,EAAE,QAAQ,SAAS,GAAG,KAAK,IAAI,KAAK;AAC1C,SAAO,EAAE,GAAG,MAAM,KAAK;AACzB;AAEA,IAAM,gBAAgB,oBAAI,IAAY;AACtC,IAAM,eAAe,oBAAI,IAA8B;AAGvD,SAAS,aAAa,MAAgC;AACpD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,UAAU,aAAa,IAAI,GAAG;AAClC,MAAI,CAAC,SAAS;AACZ,cAAU,IAAI,QAAQ,CAAC,SAAS;AAC9B;AAAA,QACE;AAAA,QACA,CAAC,YAAY,mBAAmB,MAAM,wBAAwB;AAAA,QAC9D,EAAE,KAAK,KAAK,SAAS,IAAM;AAAA,QAC3B,CAAC,UAAU,KAAK,UAAU,IAAI;AAAA,MAChC;AAAA,IACF,CAAC;AACD,iBAAa,IAAI,KAAK,OAAO;AAAA,EAC/B;AACA,SAAO;AACT;AAUO,SAAS,kBAAkB,OAAuB;AACvD,SAAO,MAAM,QAAQ,qBAAqB,GAAG,EAAE,MAAM,GAAG,GAAG;AAC7D;AAGO,SAAS,uBAAuB,MAAM,QAAQ,IAAI,GAAW;AAClE,SAAO,kBAAkB,SAAS,GAAG,CAAC,KAAK;AAC7C;AAEA,eAAsB,qBAAqB,MAAM,QAAQ,IAAI,GAAoB;AAC/E,MAAI,QAAQ,IAAI,oBAAqB,QAAO,QAAQ,IAAI;AACxD,QAAM,OAAO,MAAM,eAAe,GAAG;AACrC,SAAO,KAAK,aAAa,uBAAuB,GAAG;AACrD;AAGA,IAAM,mBAAmB;AAQzB,eAAsB,uBAAuB,MAAM,QAAQ,IAAI,GAA2B;AACxF,QAAM,SAAS,uBAAuB,GAAG;AACzC,MAAI,WAAW,iBAAkB,QAAO;AACxC,QAAM,OAAO,WAAW,GAAG;AAC3B,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,IAAI,cAAc,iBAAkB,QAAO;AAC/C,MAAK,MAAM,aAAa,GAAG,KAAO,MAAM,qBAAqB,KAAK,gBAAgB,GAAI;AACpF,WAAO;AAAA,EACT;AACA,QAAM,YAAY,MAAM,GAAG,KAAK,UAAU,EAAE,GAAG,KAAK,WAAW,OAAO,GAAG,MAAM,CAAC,CAAC;AAAA,CAAI;AACrF,SAAO;AACT;AAEA,eAAe,qBAAqB,KAAa,WAAqC;AACpF,QAAM,YAAY,KAAK,KAAK,cAAc,QAAQ;AAClD,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,QAAQ,WAAW,EAAE,WAAW,KAAK,CAAC;AAAA,EACxD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,OAAO,IAAI,OAAO,oBAAoB,SAAS,UAAU,GAAG;AAClE,aAAW,SAAS,SAAS;AAC3B,QAAI,CAAC,MAAM,SAAS,KAAK,EAAG;AAC5B,UAAM,OAAO,MAAM,SAAS,KAAK,WAAW,KAAK,GAAG,MAAM,EAAE,MAAM,MAAM,EAAE;AAC1E,QAAI,KAAK,KAAK,IAAI,EAAG,QAAO;AAAA,EAC9B;AACA,SAAO;AACT;AAEO,IAAM,uBACX;AAOF,eAAsB,kBACpB,MAAM,QAAQ,IAAI,GAClB,UAAyC,CAAC,GAChB;AAC1B,QAAM,cAAc,QAAQ,IAAI,0BAA0B;AAC1D,QAAM,OAAO,MAAM,eAAe,WAAW;AAC7C,QAAM,cAAc,QAAQ,IAAI,gBAAgB,KAAK,eAAe;AACpE,MAAI,CAAC,eAAe,QAAQ,oBAAoB,OAAO;AACrD,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AACA,QAAM,UAAU,QAAQ,IAAI,YAAY,KAAK,UAAU;AACvD,SAAO;AAAA,IACL;AAAA,IACA,WACE,QAAQ,IAAI,uBAAuB,KAAK,aAAa,uBAAuB,WAAW;AAAA,IACzF;AAAA,IACA,UAAU;AAAA,MACR,MAAM,KAAK,UAAU,QAAQ;AAAA,MAC7B,GAAI,UAAU,EAAE,QAAQ,QAAQ,IAAI,CAAC;AAAA,MACrC,GAAI,KAAK,UAAU,QAAQ,EAAE,OAAO,KAAK,SAAS,MAAM,IAAI,CAAC;AAAA,MAC7D,GAAI,KAAK,UAAU,mBAAmB,SAClC,EAAE,gBAAgB,KAAK,SAAS,eAAe,IAC/C,CAAC;AAAA,MACL,GAAI,KAAK,UAAU,gBAAgB,SAC/B,EAAE,aAAa,KAAK,SAAS,YAAY,IACzC,CAAC;AAAA,IACP;AAAA,IACA,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,IAC5D,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,EACrD;AACF;AAEA,eAAsB,uBAAuB,MAAM,QAAQ,IAAI,GAAoC;AACjG,QAAM,OAAO,WAAW,GAAG;AAC3B,MAAI;AACF,UAAM,OAAO,MAAM,KAAK,IAAI;AAC5B,UAAM,aAAa,KAAK,OAAO;AAC/B,UAAM,OAAO,WAAW,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG;AAGnD,UAAM,KAAK,QAAQ,aAAa,WAAW,eAAe;AAC1D,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,GAAI,KAAK,CAAC,IAAI,EAAE,SAAS,+CAA+C;AAAA,IAC1E;AAAA,EACF,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,UAAU;AACtD,aAAO,EAAE,MAAM,QAAQ,OAAO,MAAM,MAAM,IAAI,KAAK;AAAA,IACrD;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,qBAAqB,MAAM,QAAQ,IAAI,GAAmC;AAC9F,QAAM,eAAe,KAAK,KAAK,UAAU;AACzC,QAAM,iBAAiB,KAAK,cAAc,UAAU,OAAO;AAC3D,QAAM,qBAAqB,KAAK,cAAc,UAAU,WAAW;AACnE,QAAM,WAAW,KAAK,cAAc,OAAO;AAC3C,QAAM,gBAAgB,KAAK,cAAc,YAAY;AACrD,QAAM,aAAa,KAAK,cAAc,WAAW;AAEjD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,MAAM,QAAQ,IAAI;AAAA,IACpB,WAAW,YAAY;AAAA,IACvB,WAAW,cAAc;AAAA,IACzB,WAAW,kBAAkB;AAAA,IAC7B,WAAW,QAAQ;AAAA,IACnB,WAAW,aAAa;AAAA,IACxB,WAAW,UAAU;AAAA,EACvB,CAAC;AAED,SAAO;AAAA,IACL,cAAc;AAAA,MACZ,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,GAAI,qBACA,CAAC,IACD,EAAE,SAAS,sEAAsE;AAAA,IACvF;AAAA,IACA,gBAAgB;AAAA,MACd,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,GAAI,uBAAuB,CAAC,IAAI,EAAE,SAAS,6CAA6C;AAAA,IAC1F;AAAA,IACA,oBAAoB;AAAA,MAClB,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,GAAI,2BACA,CAAC,IACD,EAAE,SAAS,iDAAiD;AAAA,IAClE;AAAA,IACA,UAAU;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,GAAI,iBAAiB,CAAC,IAAI,EAAE,SAAS,sCAAsC;AAAA,IAC7E;AAAA,IACA,WAAW;AAAA,MACT,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,GAAI,kBAAkB,CAAC,IAAI,EAAE,SAAS,iCAAiC;AAAA,IACzE;AAAA,IACA,UAAU;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,GAAI,gBACA,CAAC,IACD;AAAA,QACE,SACE;AAAA,MACJ;AAAA,IACN;AAAA,EACF;AACF;AAGA,eAAsB,eAAe,MAAM,QAAQ,IAAI,GAAwB;AAC7E,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,WAAY,cAAoC,SAAS,OAAO,GAAG;AACrE,WAAO;AAAA,EACT;AACA,QAAM,OAAO,MAAM,eAAe,GAAG;AACrC,SAAO,KAAK,MAAM,UAAU;AAC9B;AAGA,eAAsB,cAAc,QAAoB,MAAM,QAAQ,IAAI,GAAkB;AAC1F,QAAM,eAAe,GAAG;AACxB,QAAM,OAAO,WAAW,GAAG;AAC3B,QAAM,MAAM,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AACnD,MAAI,OAAO,EAAE,GAAI,IAAI,MAA8C,OAAO;AAE1E,QAAM,YAAY,MAAM,GAAG,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC9E;AAGA,eAAsB,eAAe,SAAkB,MAAM,QAAQ,IAAI,GAAkB;AACzF,QAAM,eAAe,GAAG;AACxB,QAAM,OAAO,WAAW,GAAG;AAC3B,QAAM,MAAM,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AACnD,MAAI,OAAO,EAAE,GAAI,IAAI,MAA8C,QAAQ;AAC3E,QAAM,YAAY,MAAM,GAAG,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC9E;AAGA,eAAsB,cACpB,SACA,UAAgE,CAAC,GACjE,MAAM,QAAQ,IAAI,GACH;AACf,QAAM,eAAe,GAAG;AACxB,QAAM,OAAO,WAAW,GAAG;AAC3B,QAAM,MAAM,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AACnD,MAAI,MAAM;AAAA,IACR,GAAI,IAAI;AAAA,IACR;AAAA,IACA,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,EAClD;AACA,QAAM,YAAY,MAAM,GAAG,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC9E;AAOA,eAAsB,eACpB,KACA,OACA,MAAM,QAAQ,IAAI,GACH;AACf,QAAM,eAAe,GAAG;AACxB,QAAM,OAAO,WAAW,GAAG;AAC3B,QAAM,MAAM,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AACnD,MAAI,GAAG,IAAI;AACX,aAAW,MAAM,GAAG;AACpB,QAAM,YAAY,MAAM,GAAG,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,MAAM,IAAM,CAAC;AAC9E;AAEO,SAAS,cAAc,OAAyB;AACrD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,WAAW;AAEf,eAAW,OAAO;AAAA,MAChB,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI;AAAA,IACd,GAAG;AACD,UAAI,IAAK,YAAW,SAAS,MAAM,GAAG,EAAE,KAAK,YAAY;AAAA,IAC3D;AAGA,eAAW,SAAS;AAAA,MAClB;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,aAAa;AACxD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,KAAgC,EAAE,IAAI,CAAC,CAAC,KAAK,MAAM,MAAM;AAAA,MACtE;AAAA,MACA,qCAAqC,KAAK,GAAG,IAAI,eAAe,cAAc,MAAM;AAAA,IACtF,CAAC;AAAA,EACH;AACF;AAEA,eAAe,WAAW,MAAgC;AACxD,MAAI;AACF,UAAM,OAAO,MAAM,UAAU,IAAI;AACjC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/cli/index.js

@@ -11,10 +11,10 @@ if (command === "hooks" && (subcommand === "context" || subcommand === "lean"))
     const input = await readHookInput();
     if (skipPromptRetrieval(input.prompt)) return;
     if (subcommand === "lean") {
-      const { runLeanHook } = await import("../lean-MLTAFS5L.js");
+      const { runLeanHook } = await import("../lean-CBHVW6JM.js");
       await runLeanHook(input, writeStdout);
     } else {
-      const { runContextHook } = await import("../runtime-SWFWGTQ4.js");
+      const { runContextHook } = await import("../runtime-W5ACTDFS.js");
       await runContextHook(input, writeStdout);
     }
   });
@@ -24,7 +24,7 @@ if (command === "hooks" && (subcommand === "context" || subcommand === "lean"))
 } else if (command === "hooks" && (subcommand === "stage" || subcommand === "reset" || subcommand === "checkpoint" || subcommand === "resume")) {
   const [{ failSoft, readHookInput, writeStdout }, runtime] = await Promise.all([
     import("../stdio-HOV4P3DQ.js"),
-    import("../runtime-SWFWGTQ4.js")
+    import("../runtime-W5ACTDFS.js")
   ]);
   await failSoft(async () => {
     const input = await readHookInput();
@@ -34,7 +34,7 @@ if (command === "hooks" && (subcommand === "context" || subcommand === "lean"))
     else await runtime.runResetHook(input, writeStdout);
   });
 } else {
-  const { createCli } = await import("../main-RLMKQZW4.js");
+  const { createCli } = await import("../main-QF6Z552J.js");
   await createCli().parseAsync();
 }
 //# sourceMappingURL=index.js.map

package/dist/{config-TXQJCCVI.js → config-S2BDMT4B.js}

@@ -1,10 +1,10 @@
 import {
   redactLlmKeys,
   resolveLlmConfig
-} from "./chunk-WHKXUXHE.js";
-import "./chunk-M75SN4D4.js";
+} from "./chunk-RGIVHKBH.js";
+import "./chunk-Y4QQML24.js";
 import "./chunk-CG5B3LYG.js";
-import "./chunk-BTTQWSDS.js";
+import "./chunk-NNJSAYHY.js";
 import "./chunk-3QGW53GD.js";
 import "./chunk-HPOR6YXA.js";
 import "./chunk-PZ5AY32C.js";
@@ -12,4 +12,4 @@ export {
   redactLlmKeys,
   resolveLlmConfig
 };
-//# sourceMappingURL=config-TXQJCCVI.js.map
+//# sourceMappingURL=config-S2BDMT4B.js.map

package/dist/{expand-KWYGNCKZ.js → expand-TONFVT5D.js}

@@ -1,19 +1,19 @@
 import {
   chatJson
-} from "./chunk-6YI2D5F5.js";
+} from "./chunk-MNSMW4MZ.js";
 import {
   redactSensitive
 } from "./chunk-AL6VBTNA.js";
 import {
   resolveLlmConfig
-} from "./chunk-WHKXUXHE.js";
-import "./chunk-M75SN4D4.js";
+} from "./chunk-RGIVHKBH.js";
+import "./chunk-Y4QQML24.js";
 import {
   writeAtomic
 } from "./chunk-CG5B3LYG.js";
 import {
   isLocalModelWarm
-} from "./chunk-BTTQWSDS.js";
+} from "./chunk-NNJSAYHY.js";
 import "./chunk-3QGW53GD.js";
 import "./chunk-HPOR6YXA.js";
 import "./chunk-PZ5AY32C.js";
@@ -95,4 +95,4 @@ export {
   expandTask,
   normaliseTask
 };
-//# sourceMappingURL=expand-KWYGNCKZ.js.map
+//# sourceMappingURL=expand-TONFVT5D.js.map

package/dist/{file-vectors-MKXTSGGH.js → file-vectors-VREL75MA.js}

@@ -3,10 +3,10 @@ import {
   rankFilesByVector,
   refreshFileVectors,
   syncFileVectors
-} from "./chunk-UR3DF74I.js";
+} from "./chunk-4DTO2E4Y.js";
 import "./chunk-Y7D7PUBE.js";
 import "./chunk-AL6VBTNA.js";
-import "./chunk-M75SN4D4.js";
+import "./chunk-Y4QQML24.js";
 import "./chunk-CG5B3LYG.js";
 import "./chunk-HPOR6YXA.js";
 import "./chunk-PZ5AY32C.js";
@@ -16,4 +16,4 @@ export {
   refreshFileVectors,
   syncFileVectors
 };
-//# sourceMappingURL=file-vectors-MKXTSGGH.js.map
+//# sourceMappingURL=file-vectors-VREL75MA.js.map

package/dist/{index-facts-4MTEHKMN.js → index-facts-MBJKBYA3.js}

@@ -10,15 +10,15 @@ import {
   pruneIndexFacts,
   pyprojectFacts,
   workflowFacts
-} from "./chunk-UATJCD2T.js";
-import "./chunk-6YI2D5F5.js";
-import "./chunk-YMXFSHXT.js";
+} from "./chunk-BNZDEU5K.js";
+import "./chunk-MNSMW4MZ.js";
+import "./chunk-VBDM7HC5.js";
 import "./chunk-EMWGLKPR.js";
 import "./chunk-AL6VBTNA.js";
-import "./chunk-WHKXUXHE.js";
-import "./chunk-M75SN4D4.js";
+import "./chunk-RGIVHKBH.js";
+import "./chunk-Y4QQML24.js";
 import "./chunk-CG5B3LYG.js";
-import "./chunk-BTTQWSDS.js";
+import "./chunk-NNJSAYHY.js";
 import "./chunk-3QGW53GD.js";
 import "./chunk-HPOR6YXA.js";
 import "./chunk-PZ5AY32C.js";
@@ -35,4 +35,4 @@ export {
   pyprojectFacts,
   workflowFacts
 };
-//# sourceMappingURL=index-facts-4MTEHKMN.js.map
+//# sourceMappingURL=index-facts-MBJKBYA3.js.map

package/dist/index-pass-RP23G2CR.js

@@ -0,0 +1,15 @@
+import {
+  runIndexModelPass
+} from "./chunk-VF7DKRIU.js";
+import "./chunk-6OQKL35B.js";
+import "./chunk-RGIVHKBH.js";
+import "./chunk-Y4QQML24.js";
+import "./chunk-CG5B3LYG.js";
+import "./chunk-NNJSAYHY.js";
+import "./chunk-3QGW53GD.js";
+import "./chunk-HPOR6YXA.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  runIndexModelPass
+};
+//# sourceMappingURL=index-pass-RP23G2CR.js.map

package/dist/index.js

@@ -3,7 +3,7 @@ import {
   migrateMemoryToFiles,
   registerCodeBuddyTools,
   startMcpServer
-} from "./chunk-D5E7SGI5.js";
+} from "./chunk-GNV4X67F.js";
 import {
   ACTIVE_PLAN_STATUSES,
   ActivePlanExistsError,
@@ -21,18 +21,18 @@ import {
   createPolicySignal,
   readPolicyFile,
   resolveRiskPaths
-} from "./chunk-KQCP3ZYH.js";
+} from "./chunk-OO7Q7XZF.js";
 import "./chunk-YN7TEIUH.js";
 import "./chunk-7IPSDDO5.js";
 import "./chunk-TGFTKWOR.js";
 import "./chunk-GQKWUHMA.js";
 import "./chunk-DFV2SK6C.js";
-import "./chunk-4BSO3HST.js";
+import "./chunk-RKF4HBBQ.js";
 import {
   buildArchitectureMap,
   neighbours,
   queryMap
-} from "./chunk-UR3DF74I.js";
+} from "./chunk-4DTO2E4Y.js";
 import "./chunk-Y7D7PUBE.js";
 import {
   CodeBuddy,
@@ -48,7 +48,7 @@ import {
   isLangSmithTracingEnabled,
   listFactsPage,
   runDoctor
-} from "./chunk-KYRM3HPP.js";
+} from "./chunk-IM5RFEW4.js";
 import {
   clampBudgetForCallerModel,
   countTokens
@@ -57,7 +57,7 @@ import {
   FACT_CATEGORIES,
   INCIDENT_SEVERITIES,
   MemoryFileStore
-} from "./chunk-YMXFSHXT.js";
+} from "./chunk-VBDM7HC5.js";
 import "./chunk-EMWGLKPR.js";
 import "./chunk-AL6VBTNA.js";
 import "./chunk-6JCKMIQY.js";
@@ -71,9 +71,9 @@ import {
   loadRuntimeConfig,
   redactSecrets,
   setPlanPolicy
-} from "./chunk-M75SN4D4.js";
+} from "./chunk-Y4QQML24.js";
 import "./chunk-CG5B3LYG.js";
-import "./chunk-BTTQWSDS.js";
+import "./chunk-NNJSAYHY.js";
 import {
   LocalModelProvider
 } from "./chunk-3QGW53GD.js";

package/dist/{install-E3JWINTN.js → install-MCJIJMFF.js}

@@ -3,22 +3,22 @@ import {
   installClient,
   setHooks,
   uninstallClient
-} from "./chunk-RZ266NHE.js";
-import "./chunk-JJQDVGF7.js";
+} from "./chunk-PZ4EBFIA.js";
+import "./chunk-AFXWCSQ4.js";
 import "./chunk-V7PT6ER5.js";
-import "./chunk-KQCP3ZYH.js";
+import "./chunk-OO7Q7XZF.js";
 import "./chunk-YN7TEIUH.js";
 import "./chunk-7IPSDDO5.js";
 import "./chunk-TGFTKWOR.js";
 import "./chunk-GQKWUHMA.js";
 import "./chunk-DFV2SK6C.js";
-import "./chunk-UR3DF74I.js";
+import "./chunk-4DTO2E4Y.js";
 import "./chunk-Y7D7PUBE.js";
 import "./chunk-57642NGU.js";
-import "./chunk-YMXFSHXT.js";
+import "./chunk-VBDM7HC5.js";
 import "./chunk-EMWGLKPR.js";
 import "./chunk-AL6VBTNA.js";
-import "./chunk-M75SN4D4.js";
+import "./chunk-Y4QQML24.js";
 import "./chunk-CG5B3LYG.js";
 import "./chunk-HPOR6YXA.js";
 import "./chunk-PZ5AY32C.js";
@@ -28,4 +28,4 @@ export {
   setHooks,
   uninstallClient
 };
-//# sourceMappingURL=install-E3JWINTN.js.map
+//# sourceMappingURL=install-MCJIJMFF.js.map

package/dist/{lean-MLTAFS5L.js → lean-CBHVW6JM.js}

@@ -5,16 +5,16 @@ import {
   isReadOnlyPrompt,
   renderLeanBlock,
   runLeanHook
-} from "./chunk-JJQDVGF7.js";
+} from "./chunk-AFXWCSQ4.js";
 import "./chunk-7IPSDDO5.js";
 import "./chunk-TGFTKWOR.js";
 import "./chunk-GQKWUHMA.js";
-import "./chunk-UR3DF74I.js";
+import "./chunk-4DTO2E4Y.js";
 import "./chunk-Y7D7PUBE.js";
 import "./chunk-57642NGU.js";
 import "./chunk-EMWGLKPR.js";
 import "./chunk-AL6VBTNA.js";
-import "./chunk-M75SN4D4.js";
+import "./chunk-Y4QQML24.js";
 import "./chunk-CG5B3LYG.js";
 import "./chunk-HPOR6YXA.js";
 import "./chunk-PZ5AY32C.js";
@@ -26,4 +26,4 @@ export {
   renderLeanBlock,
   runLeanHook
 };
-//# sourceMappingURL=lean-MLTAFS5L.js.map
+//# sourceMappingURL=lean-CBHVW6JM.js.map

package/dist/{local-75DJECVR.js → local-TH5XCLVJ.js}

@@ -19,7 +19,7 @@ import {
   unloadLocalModel,
   waitForForeground,
   warmLocalModel
-} from "./chunk-BTTQWSDS.js";
+} from "./chunk-NNJSAYHY.js";
 import "./chunk-3QGW53GD.js";
 import "./chunk-HPOR6YXA.js";
 import "./chunk-PZ5AY32C.js";
@@ -45,4 +45,4 @@ export {
   waitForForeground,
   warmLocalModel
 };
-//# sourceMappingURL=local-75DJECVR.js.map
+//# sourceMappingURL=local-TH5XCLVJ.js.map

package/dist/{local-llm-MECVJTVU.js → local-llm-GZREB5DF.js}

@@ -3,10 +3,10 @@ import {
   addLocalLlm,
   printLocalLlmStatus,
   removeLocalLlm
-} from "./chunk-UTPC66MV.js";
-import "./chunk-M75SN4D4.js";
+} from "./chunk-K4XNTYV7.js";
+import "./chunk-Y4QQML24.js";
 import "./chunk-CG5B3LYG.js";
-import "./chunk-BTTQWSDS.js";
+import "./chunk-NNJSAYHY.js";
 import "./chunk-3QGW53GD.js";
 import "./chunk-HPOR6YXA.js";
 import "./chunk-PZ5AY32C.js";
@@ -16,4 +16,4 @@ export {
   printLocalLlmStatus,
   removeLocalLlm
 };
-//# sourceMappingURL=local-llm-MECVJTVU.js.map
+//# sourceMappingURL=local-llm-GZREB5DF.js.map