@poe-platform/safe-bash 0.1.441 → 0.1.443

package/dist/safe-bash/portable.js

@@ -2029,6 +2029,11 @@ function encodeValues(values, output2) {
 
 // packages/safe-bash/src/contracts/command.ts
 var argumentCarriers = /* @__PURE__ */ new WeakSet();
+var CommandArgumentIdentityError = class extends TypeError {
+  constructor() {
+    super("Command argument identity does not match its carrier");
+  }
+};
 function argumentAllocation(allocation) {
   const reservations = [];
   const tracked = allocation && {
@@ -2178,7 +2183,7 @@ function getCommandArguments(context2) {
   const carrier = context2.argumentValues;
   if (carrier === void 0) return createCommandArguments(context2.args);
   if (!argumentCarriers.has(carrier)) throw new TypeError("Expected owned command arguments");
-  if (carrier.args !== context2.args) throw new TypeError("Command argument identity does not match its carrier");
+  if (carrier.args !== context2.args) throw new CommandArgumentIdentityError();
   return carrier;
 }
 var CommandRegistry = class {
@@ -2690,6 +2695,24 @@ async function writeDiagnostic(sink, value2, signal) {
 // packages/safe-bash/src/commands/internal.ts
 init_platform();
 
+// packages/safe-bash/src/diagnostics.ts
+init_platform();
+var PublicDiagnostic = class extends Error {
+};
+function publicDiagnosticMessage(error, onInternalError) {
+  if (error instanceof FsError || error instanceof CommandArgumentIdentityError) return error.message;
+  if (error instanceof PublicDiagnostic && !Object.hasOwn(error, "cause")) return error.message;
+  const original = error instanceof PublicDiagnostic ? error.cause : error;
+  const detail = error instanceof PublicDiagnostic ? error.message : "internal error";
+  try {
+    const pending = onInternalError?.(original);
+    if (pending !== void 0) void Promise.resolve(pending).catch(() => void 0);
+  } catch {
+    return detail;
+  }
+  return detail;
+}
+
 // packages/safe-bash/src/commands/portable-requirements.ts
 init_platform();
 var inputRequirements = [
@@ -2777,7 +2800,7 @@ var RecordBuffer = class {
 var encoder3 = new TextEncoder();
 var decoder2 = new TextDecoder();
 var bufferLimit = 32 * 1024 * 1024;
-var UsageError = class extends Error {
+var UsageError = class extends PublicDiagnostic {
 };
 function options(args, short, long = {}, stopAtOperand = false, onOperand) {
   const flags3 = /* @__PURE__ */ new Set();
@@ -2858,7 +2881,7 @@ async function output(context2, text3) {
 }
 async function diagnostic(context2, error) {
   context2.signal.throwIfAborted();
-  await writeDiagnostic(context2.stderr, `${context2.command}: ${error instanceof Error ? error.message : String(error)}
+  await writeDiagnostic(context2.stderr, `${context2.command}: ${publicDiagnosticMessage(error, context2.onInternalError)}
 `, context2.signal);
 }
 function define(name2, handler, failureCode = 1) {
@@ -3500,7 +3523,7 @@ async function moveAcrossDevices(context2, source2, target, noClobber, budget) {
         } catch (error) {
           context2.signal.throwIfAborted();
           if (codeOf(error) !== "ENOTSUP" && codeOf(error) !== "EOPNOTSUPP") throw error;
-          await diagnostic(context2, new Error(`cannot preserve timestamps for '${entry.target}': operation not supported; retaining copied data`));
+          await diagnostic(context2, new PublicDiagnostic(`cannot preserve timestamps for '${entry.target}': operation not supported; retaining copied data`));
         }
       }
     }
@@ -4532,7 +4555,7 @@ var FollowSession = class {
         if ("reason" in outcome) reject(outcome.reason);
         else resolve(outcome.value);
       };
-      const cancel = () => finish({ reason: this.operation.signal.aborted ? this.operation.signal.reason : new Error("Tail follow is closed") });
+      const cancel = () => finish({ reason: this.operation.signal.aborted ? this.operation.signal.reason : new PublicDiagnostic("Tail follow is closed") });
       this.waiting.add(cancel);
       this.operation.signal.addEventListener("abort", cancel, { once: true });
       pending?.then((value2) => finish({ value: value2 }), (reason) => finish({ reason }));
@@ -4736,7 +4759,7 @@ async function followTail(caller, selection, cap, select, scheduler = tailFollow
     entry.offset = 0;
     if (!initial) {
       const message3 = replaced ? "has been replaced; following new file" : entry.error === "ENOENT" ? "has appeared; following new file" : "has become accessible";
-      await diagnostic(context2, new Error(`'${entry.name}' ${message3}`));
+      await diagnostic(context2, new PublicDiagnostic(`'${entry.name}' ${message3}`));
     }
     entry.error = void 0;
     return stat;
@@ -4799,7 +4822,7 @@ async function followTail(caller, selection, cap, select, scheduler = tailFollow
           }
           if (!stat) continue;
           if (stat.size < entry.offset) {
-            await diagnostic(context2, new Error(`${entry.name}: file truncated`));
+            await diagnostic(context2, new PublicDiagnostic(`${entry.name}: file truncated`));
             entry.offset = 0;
           }
           if (stat.size > entry.offset) round.push({ entry, end: stat.size });
@@ -5738,7 +5761,7 @@ function textCommands() {
             }
             return (async () => {
               if (records4.length && (await compare5(records4.at(-1), bytes3) > 0 || parsed.flags.has("u") && await keyCompare(records4.at(-1), bytes3) === 0)) {
-                await diagnostic(context2, new Error(`disorder at record ${records4.length + 1}`));
+                await diagnostic(context2, new PublicDiagnostic(`disorder at record ${records4.length + 1}`));
                 return false;
               }
               records4.push(bytes3);
@@ -6722,16 +6745,16 @@ var precedence = {
 function integer2(text3) {
   if (/^0[xX][\da-fA-F]+$/u.test(text3)) return BigInt(text3);
   if (/^0[0-7]+$/u.test(text3)) return BigInt(`0o${text3.slice(1)}`);
-  if (/^0\d+$/u.test(text3)) throw new Error("Invalid octal constant");
+  if (/^0\d+$/u.test(text3)) throw new PublicDiagnostic("Invalid octal constant");
   if (/^\d+$/u.test(text3)) return BigInt(text3);
   const match = /^(\d+)#([\da-zA-Z@_]+)$/u.exec(text3);
-  if (!match) throw new Error("Invalid arithmetic constant");
+  if (!match) throw new PublicDiagnostic("Invalid arithmetic constant");
   const base = Number(match[1]);
-  if (base < 2 || base > 64) throw new Error("Invalid arithmetic base");
+  if (base < 2 || base > 64) throw new PublicDiagnostic("Invalid arithmetic base");
   let value2 = 0n;
   for (const character of match[2]) {
     const digit2 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ@_".indexOf(base <= 36 ? character.toLowerCase() : character);
-    if (digit2 >= base || digit2 < 0) throw new Error("Digit exceeds arithmetic base");
+    if (digit2 >= base || digit2 < 0) throw new PublicDiagnostic("Digit exceeds arithmetic base");
     value2 = BigInt.asIntN(64, value2 * BigInt(base) + BigInt(digit2));
   }
   return value2;
@@ -6883,7 +6906,7 @@ function evaluateArithmetic(program, variables, budget = new ParseBudget()) {
       case ">=":
         return BigInt(left >= right);
       default:
-        throw new Error(`Unsupported arithmetic operator ${operator}`);
+        throw new PublicDiagnostic(`Unsupported arithmetic operator ${operator}`);
     }
   };
   try {
@@ -6893,11 +6916,11 @@ function evaluateArithmetic(program, variables, budget = new ParseBudget()) {
     while (pending.length) {
       const frame = pending.pop();
       if (frame.kind === "evaluate") {
-        if (++steps > 1e4) throw new Error("Arithmetic operation limit exceeded");
+        if (++steps > 1e4) throw new PublicDiagnostic("Arithmetic operation limit exceeded");
         const node = frame.node;
         if (node.kind === "literal") value2 = node.value;
         else if (node.kind === "name") {
-          if (visiting.has(node.name) || visiting.size >= 64) throw new Error("Arithmetic variable recursion");
+          if (visiting.has(node.name) || visiting.size >= 64) throw new PublicDiagnostic("Arithmetic variable recursion");
           visiting.add(node.name);
           pending.push({ kind: "variable", name: node.name }, { kind: "evaluate", node: parseArithmetic(variables[node.name] ?? "0", 0, budget) });
         } else if (node.kind === "conditional") {
@@ -6943,11 +6966,11 @@ function evaluateArithmetic(program, variables, budget = new ParseBudget()) {
     }
     return value2;
   } catch (error) {
-    if (error instanceof ArithmeticFailure) throw new Error(`${program.source.trimStart()}: ${error.message} (error token is "${program.source.slice(error.offset)}")`);
+    if (error instanceof ArithmeticFailure) throw new PublicDiagnostic(`${program.source.trimStart()}: ${error.message} (error token is "${program.source.slice(error.offset)}")`);
     if (error instanceof ShellSyntaxError) {
       const offset = error.offset >= program.source.trimEnd().length ? Math.max(0, program.source.trimEnd().length - 1) : error.offset;
       const reason = error.reason === "Invalid arithmetic operand" ? "arithmetic syntax error: operand expected" : "arithmetic syntax error in expression";
-      throw new Error(`${program.source.trimStart()}: ${reason} (error token is "${program.source.slice(offset)}")`);
+      throw new PublicDiagnostic(`${program.source.trimStart()}: ${reason} (error token is "${program.source.slice(offset)}")`);
     }
     throw error;
   }
@@ -11947,8 +11970,9 @@ function resolveLimits(...limits) {
 }
 var budgetedSinks = /* @__PURE__ */ new WeakMap();
 var Budget = class {
-  constructor(limits, signal) {
+  constructor(limits, signal, onInternalError) {
     this.limits = limits;
+    this.onInternalError = onInternalError;
     this.signal = signal ? AbortSignal.any([signal, this.controller.signal]) : this.controller.signal;
     this.parsing = new ParseBudget(limits.maxParseUnits, this.signal, (error) => this.controller.abort(error));
     this.values = new ValueArena(limits.maxExpansionBytes, limits.maxExpansionFields, () => this.signal.throwIfAborted(), (limit) => this.fail(limit));
@@ -11956,6 +11980,7 @@ var Budget = class {
     this.#armWallClock();
   }
   limits;
+  onInternalError;
   executionScope = Object.freeze({});
   pathLookup = new PathLookup();
   parsing;
@@ -12384,13 +12409,16 @@ function saturatedSum(left, right) {
 function errorCode(error) {
   return typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
 }
-function message(error) {
-  return error instanceof Error ? error.message : String(error);
+function message(error, onInternalError) {
+  if (error instanceof ExpansionFailure || error instanceof CommandFailure || error instanceof ArrayFailure || error instanceof BraceExpansionFailure) return error.message;
+  return publicDiagnosticMessage(error, onInternalError);
 }
-function filesystemDiagnostic(error, target) {
+function filesystemDiagnostic(error, target, onInternalError) {
   const descriptions2 = { ENOENT: "No such file or directory", EACCES: "Permission denied", EPERM: "Operation not permitted", ENOTDIR: "Not a directory", EISDIR: "Is a directory", ELOOP: "Too many levels of symbolic links", ENOSPC: "No space left on device", EROFS: "Read-only file system" };
   const description = descriptions2[errorCode(error) ?? ""];
-  return description ? `${target}: ${description}` : void 0;
+  if (!description) return void 0;
+  publicDiagnosticMessage(error, onInternalError);
+  return `${target}: ${description}`;
 }
 function cdUtf8Width(codePoint) {
   return codePoint <= 127 ? 1 : codePoint <= 2047 ? 2 : codePoint <= 65535 ? 3 : 4;
@@ -12428,7 +12456,7 @@ var CdLookup = class {
   probes = 0;
   async charge(amount) {
     this.signal.throwIfAborted();
-    if (amount > 8388608 - this.spent) throw new Error("cd: helper work limit exceeded");
+    if (amount > 8388608 - this.spent) throw new PublicDiagnostic("cd: helper work limit exceeded");
     while (amount > 0) {
       const step = Math.min(amount, 128 - this.spent % 128);
       this.spent += step;
@@ -12449,8 +12477,8 @@ var CdLookup = class {
     for (let index = 0; index < value2.length; ) {
       const codePoint = value2.codePointAt(index);
       const width = cdUtf8Width(codePoint);
-      if (bytes3 + width > 65536) throw new Error(search ? "cd: CDPATH exceeds 65536 UTF-8 bytes" : "cd: path exceeds 65536 UTF-8 bytes");
-      if (search && codePoint === 58 && ++slots > 4096) throw new Error("cd: CDPATH exceeds 4096 components");
+      if (bytes3 + width > 65536) throw new PublicDiagnostic(search ? "cd: CDPATH exceeds 65536 UTF-8 bytes" : "cd: path exceeds 65536 UTF-8 bytes");
+      if (search && codePoint === 58 && ++slots > 4096) throw new PublicDiagnostic("cd: CDPATH exceeds 4096 components");
       await this.charge(width);
       if (search && codePoint === 58) {
         components.push({ start, end: index, bytes: bytes3 - startBytes });
@@ -12471,13 +12499,13 @@ var CdLookup = class {
     const search = eligible && cdpath ? await this.scan(cdpath, true) : void 0;
     const probe = async (component, componentBytes) => {
       const rawBytes = absolute ? targetBytes : component.startsWith("/") ? componentBytes + 1 + targetBytes : cwdBytes + 1 + (component ? componentBytes + 1 : 0) + targetBytes;
-      if (rawBytes > 65536) throw new Error("cd: path exceeds 65536 UTF-8 bytes");
+      if (rawBytes > 65536) throw new PublicDiagnostic("cd: path exceeds 65536 UTF-8 bytes");
       await this.charge(2 * rawBytes);
       const raw = absolute ? target : component.startsWith("/") ? `${component}/${target}` : component ? `${cwd}/${component}/${target}` : `${cwd}/${target}`;
       const path = resolvePath(cwd, raw);
       await this.scan(path);
       this.signal.throwIfAborted();
-      if (++this.probes > 4097) throw new Error("cd: probe limit exceeded");
+      if (++this.probes > 4097) throw new PublicDiagnostic("cd: probe limit exceeded");
       await this.charge(1);
       this.signal.throwIfAborted();
       const stat = await fs.stat(path, { signal: this.signal });
@@ -12629,7 +12657,7 @@ var DirectoryStackWork = class {
   }
 };
 var closedSink = { async write() {
-  throw Object.assign(new Error("Bad file descriptor"), { code: "EBADF" });
+  throw Object.assign(new PublicDiagnostic("Bad file descriptor"), { code: "EBADF" });
 } };
 var closedSource = { [Symbol.asyncIterator]() {
   let closed = false;
@@ -12646,7 +12674,7 @@ var closedSource = { [Symbol.asyncIterator]() {
       return enqueue(() => {
         if (closed) return { done: true, value: void 0 };
         closed = true;
-        throw Object.assign(new Error("Bad file descriptor"), { code: "EBADF" });
+        throw Object.assign(new PublicDiagnostic("Bad file descriptor"), { code: "EBADF" });
       });
     },
     return(value2) {
@@ -13113,14 +13141,14 @@ var Runtime = class _Runtime {
   }
   writeVariable(state, name2, value2, origin = "assignment") {
     if (arrayStore(state)?.get(name2)) throw new ArrayFailure(origin === "arithmetic" ? "indexed arithmetic is unsupported" : "indexed write requires prepared publication");
-    if (state.readonlyVariables?.has(name2)) throw new Error(`${name2}: readonly variable`);
+    if (state.readonlyVariables?.has(name2)) throw new PublicDiagnostic(`${name2}: readonly variable`);
     if (shellValueByteLength(value2) > this.budget.limits.maxExpansionBytes) this.budget.fail("maxExpansionBytes");
     if (name2 === "OPTIND" && state.getopts?.integer && origin !== "arithmetic") {
       try {
         value2 = String(evaluateArithmetic(prepareArithmetic(shellValueText(value2) || "0", this.budget.parsing), this.arithmeticVariables(state), this.budget.parsing));
       } catch (error) {
         this.rethrowArithmeticControl(error);
-        throw new ExpansionFailure(message(error));
+        throw new ExpansionFailure(message(error, this.budget.onInternalError));
       }
     }
     publishVariable(state, name2, value2);
@@ -13138,7 +13166,7 @@ var Runtime = class _Runtime {
     if (state.variables.OPTIND !== previous) this.syncGetopts(state);
   }
   unsetVariable(state, name2, internal = false) {
-    if (state.readonlyVariables?.has(name2)) throw new Error(`${name2}: readonly variable`);
+    if (state.readonlyVariables?.has(name2)) throw new PublicDiagnostic(`${name2}: readonly variable`);
     delete state.variables[name2];
     state.exported.delete(name2);
     if (name2 === "OPTIND" && !internal) this.syncGetopts(state);
@@ -13856,7 +13884,7 @@ var Runtime = class _Runtime {
             }, (prepared) => evaluateArithmetic(prepared, this.arithmeticVariables(state, io.diagnosticLine), this.budget.parsing)) === 0n);
           } catch (error) {
             this.rethrowArithmeticControl(error);
-            throw new Error(`((: ${message(error)}`);
+            throw new PublicDiagnostic(`((: ${message(error, this.budget.onInternalError)}`);
           }
         }
         if (command7.kind === "subshell") {
@@ -13951,9 +13979,10 @@ var Runtime = class _Runtime {
         if (command7.kind !== "simple" && command7.kind !== "subshell" && command7.kind !== "arithmetic" && command7.kind !== "conditional") this.errexit(141, state, io);
         return 141;
       }
+      const publicMessage = message(error, this.budget.onInternalError);
       const line = error instanceof ExpansionFailure ? error.line ?? io.diagnosticLine ?? 1 : io.diagnosticLine ?? 1;
       if (error instanceof NounsetFailure || error instanceof ParameterExpansionFailure) {
-        const detail = error instanceof ParameterExpansionFailure ? diagnostic4 ?? message(error) : message(error);
+        const detail = error instanceof ParameterExpansionFailure ? diagnostic4 ?? publicMessage : publicMessage;
         try {
           await writeDiagnostic(io.stderr, `${io.scriptName ?? "shell"}: line ${line}: ${detail}
 `);
@@ -13965,14 +13994,15 @@ var Runtime = class _Runtime {
         }
         throw completedExit(error instanceof ParameterExpansionFailure && !state.isolated ? 127 : 1);
       }
-      if (error instanceof ArrayFailure) await writeDiagnostic(io.stderr, `${io.scriptName ?? "shell"}: line ${line}: ${diagnostic4 ?? message(error)}
+      if (error instanceof ArrayFailure) await writeDiagnostic(io.stderr, `${io.scriptName ?? "shell"}: line ${line}: ${diagnostic4 ?? publicMessage}
 `);
       else {
         try {
-          await writeDiagnostic(io.stderr, `${io.scriptName ?? "shell"}: line ${line}: ${diagnostic4 ?? message(error)}
+          await writeDiagnostic(io.stderr, `${io.scriptName ?? "shell"}: line ${line}: ${diagnostic4 ?? publicMessage}
 `);
-        } catch {
+        } catch (failure) {
           this.signal.throwIfAborted();
+          publicDiagnosticMessage(failure, this.budget.onInternalError);
         }
       }
       if (error instanceof ExpansionFailure || error instanceof BraceExpansionFailure) throw completedExit(error instanceof ParameterExpansionFailure && !state.isolated ? 127 : 1);
@@ -14080,7 +14110,7 @@ var Runtime = class _Runtime {
             if (error instanceof NounsetFailure) throw error;
             if (error instanceof ParameterExpansionFailure && !isolatedInlineInput) throw error;
             if (error instanceof ParameterExpansionFailure) throw new CommandFailure(error.message, state.isolated ? 1 : 127);
-            if (error instanceof ExpansionFailure) throw new Error(error.message);
+            if (error instanceof ExpansionFailure) throw new PublicDiagnostic(error.message);
             throw error;
           }
           if (hereString) {
@@ -14093,18 +14123,18 @@ var Runtime = class _Runtime {
           continue;
         }
         const targets = await this.word(redirect.target, state, currentIO());
-        if (targets.length !== 1) throw new Error("Ambiguous redirect");
+        if (targets.length !== 1) throw new PublicDiagnostic("Ambiguous redirect");
         const target = targets[0];
         errorTarget = target;
         if (redirect.operator.endsWith("&")) {
           if (target === "-") descriptors.delete(redirect.descriptor);
           else {
-            if (!/^\d+-?$/u.test(target)) throw new Error(`${target}: Bad file descriptor`);
+            if (!/^\d+-?$/u.test(target)) throw new PublicDiagnostic(`${target}: Bad file descriptor`);
             const move = target.endsWith("-");
-            if (move && !redirect.move) throw new Error(`${target}: ambiguous redirect`);
+            if (move && !redirect.move) throw new PublicDiagnostic(`${target}: ambiguous redirect`);
             const sourceDescriptor = Number(move ? target.slice(0, -1) : target);
             const descriptor2 = descriptors.get(sourceDescriptor);
-            if (!descriptor2 || descriptor2.closed || !move && (redirect.operator === "<&" ? !descriptor2.input : !descriptor2.output)) throw new Error(`${move ? sourceDescriptor : target}: Bad file descriptor`);
+            if (!descriptor2 || descriptor2.closed || !move && (redirect.operator === "<&" ? !descriptor2.input : !descriptor2.output)) throw new PublicDiagnostic(`${move ? sourceDescriptor : target}: Bad file descriptor`);
             descriptors.set(redirect.descriptor, { ...descriptor2 });
             if (move && sourceDescriptor !== redirect.descriptor) {
               descriptors.delete(sourceDescriptor);
@@ -14117,7 +14147,7 @@ var Runtime = class _Runtime {
           if (redirect.operator === "<") {
             await interruptible(this.fs.access(path, 4, options3), this.signal);
             const stat = await interruptible(this.fs.stat(path, options3), this.signal);
-            if (stat.type === "directory" && !fileShortcut) throw new Error(`${target}: Is a directory`);
+            if (stat.type === "directory" && !fileShortcut) throw new PublicDiagnostic(`${target}: Is a directory`);
             const source2 = stat.type === "directory" ? toByteSource("") : await fileInput(this.fs, path, this.budget.limits.maxInputBytes, this.signal);
             const input3 = new ShellInput(source2, this.budget, this.signal);
             inputs2.add(input3);
@@ -14379,7 +14409,7 @@ var Runtime = class _Runtime {
       if (!inlineInput) await assign();
       if (fileShortcut) {
         const input3 = io.descriptors?.get(command7.redirects[0].descriptor)?.input;
-        if (!input3) throw new Error("Bad file descriptor");
+        if (!input3) throw new PublicDiagnostic("Bad file descriptor");
         await pipeBytes(input3, io.stdout, this.signal);
         return 0;
       }
@@ -14389,7 +14419,7 @@ var Runtime = class _Runtime {
       this.signal.throwIfAborted();
       const original = error instanceof ExecutionFailure ? error.original : error;
       if (special2 && !(original instanceof ShellLimitError) && !(original instanceof ExpansionFailure) && !(original instanceof Flow) && !(original instanceof ShellSyntaxError)) {
-        throw new ExecutionFailure(new FatalCommandFailure(message(original), 1), error instanceof ExecutionFailure ? error.io : io, error instanceof ExecutionFailure ? error.diagnostic : void 0);
+        throw new ExecutionFailure(new FatalCommandFailure(message(original, this.budget.onInternalError), 1), error instanceof ExecutionFailure ? error.io : io, error instanceof ExecutionFailure ? error.diagnostic : void 0);
       }
       if (error instanceof ExecutionFailure) throw error;
       throw new ExecutionFailure(error, io);
@@ -14450,6 +14480,7 @@ var Runtime = class _Runtime {
       fs: this.fs,
       signal: this.commandSignal,
       executionScope: this.budget.executionScope,
+      onInternalError: this.budget.onInternalError,
       registerCleanup: (cleanup) => {
         scope.register(cleanup);
       },
@@ -14831,8 +14862,8 @@ ${functionDisplay(name2, state.functions.get(name2))}`;
         }
         const code = errorCode(error);
         if (code === "ENOENT" || code === "ENOTDIR") continue;
-        if (code !== "EACCES" && code !== "EPERM") throw new CommandFailure(filesystemDiagnostic(error, target) ?? `${target}: ${message(error)}`, 126);
-        denied ??= new CommandFailure(filesystemDiagnostic(error, target) ?? `${target}: ${message(error)}`, 126);
+        if (code !== "EACCES" && code !== "EPERM") throw new CommandFailure(filesystemDiagnostic(error, target, this.budget.onInternalError) ?? `${target}: ${message(error, this.budget.onInternalError)}`, 126);
+        denied ??= new CommandFailure(filesystemDiagnostic(error, target, this.budget.onInternalError) ?? `${target}: ${message(error, this.budget.onInternalError)}`, 126);
       }
     }
     if (denied && !matches3.length && !discovery) throw denied;
@@ -15054,6 +15085,7 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
         args: argumentValues.args,
         argumentValues,
         executionScope: this.budget.executionScope,
+        onInternalError: this.budget.onInternalError,
         env: Object.assign(/* @__PURE__ */ Object.create(null), incoming.env),
         stdin: input3 ?? incoming.stdin,
         stdout: this.budget.sink(incoming.stdout, runtime.signal),
@@ -15241,7 +15273,7 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
       this.signal.throwIfAborted();
       if (error instanceof ShellLimitError || error instanceof CommandFailure) throw error;
       if (errorCode(error) === "EFBIG") this.budget.fail("maxSourceBytes");
-      throw new CommandFailure(filesystemDiagnostic(error, target) ?? `${target}: ${message(error)}`, errorCode(error) === "ENOENT" ? 127 : 126);
+      throw new CommandFailure(filesystemDiagnostic(error, target, this.budget.onInternalError) ?? `${target}: ${message(error, this.budget.onInternalError)}`, errorCode(error) === "ENOENT" ? 127 : 126);
     }
     if (direct && environmentInterpreter) return this.envShebang(context2, state, io, environmentInterpreter[1], target, args, { path, source: source2 });
     const units = [];
@@ -15386,7 +15418,7 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
       this.signal.throwIfAborted();
       if (error instanceof ShellLimitError) throw error;
       if (errorCode(error) === "EFBIG") this.budget.fail("maxSourceBytes");
-      const diagnostic4 = error instanceof CommandFailure ? error.message : filesystemDiagnostic(error, target) ?? `${target}: ${message(error)}`;
+      const diagnostic4 = error instanceof CommandFailure ? error.message : filesystemDiagnostic(error, target, this.budget.onInternalError) ?? `${target}: ${message(error, this.budget.onInternalError)}`;
       if (special2) throw new FatalCommandFailure(diagnostic4, 1);
       throw new CommandFailure(diagnostic4, error instanceof CommandFailure ? error.status : 1);
     }
@@ -15599,7 +15631,7 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
         value2 = evaluateArithmetic(prepareArithmetic(args[index], this.budget.parsing), variables, this.budget.parsing);
       } catch (error) {
         this.rethrowArithmeticControl(error);
-        throw new Error(`let: ${message(error)}`);
+        throw new PublicDiagnostic(`let: ${message(error, this.budget.onInternalError)}`);
       }
       if ((index - offset + 1) % 128 === 0) await checkpoint();
     }
@@ -15694,7 +15726,7 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
     this.writeVariable(state, "OPTIND", String(result2.optind), "getopts");
     if (result2.argument.kind === "set") this.writeVariable(state, "OPTARG", result2.argument.value, "getopts");
     else this.unsetVariable(state, "OPTARG", true);
-    if (!/^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(name2)) throw new Error(`getopts: \`${name2}': not a valid identifier`);
+    if (!/^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(name2)) throw new PublicDiagnostic(`getopts: \`${name2}': not a valid identifier`);
     await this.assignVariable(state, name2, result2.option, "getopts");
     return result2.status;
   }
@@ -15717,8 +15749,8 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
       selected = await new CdLookup(this.signal).find(this.fs, state.cwd, target || ".", state.variables.CDPATH);
     } catch (error) {
       this.signal.throwIfAborted();
-      const description = filesystemDiagnostic(error, "");
-      const text3 = description ? "" : message(error);
+      const description = filesystemDiagnostic(error, "", this.budget.onInternalError);
+      const text3 = description ? "" : message(error, this.budget.onInternalError);
       diagnose?.(error, cdDiagnostic(description ? [name2, ": ", target, description] : stackHooks && text3.startsWith("cd: ") ? [name2, text3.slice(2)] : [text3]));
       throw error;
     }
@@ -16624,7 +16656,7 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
         }, (prepared) => evaluateArithmetic(prepared, this.arithmeticVariables(state, io.diagnosticLine ?? part.line), this.budget.parsing)));
       } catch (error) {
         this.rethrowArithmeticControl(error);
-        throw new ExpansionFailure(message(error), io.diagnosticLine ?? part.line);
+        throw new ExpansionFailure(message(error, this.budget.onInternalError), io.diagnosticLine ?? part.line);
       }
     }
     if (part.kind === "substitution") {
@@ -16725,7 +16757,7 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
         alternate = shellValueText(retained);
         if (operator === "?") throw new ParameterExpansionFailure(`${part.name}: ${alternate || (part.operator.startsWith(":") ? "parameter null or not set" : "parameter not set")}`, io.diagnosticLine ?? part.line);
         if (operator === "=") {
-          if (!/^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(part.name)) throw new Error("Cannot assign special parameter");
+          if (!/^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(part.name)) throw new PublicDiagnostic("Cannot assign special parameter");
           this.writeVariable(state, part.name, retained);
         }
         value2 = alternate;
@@ -16783,7 +16815,7 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
           return { value: evaluateArithmetic(prepareArithmetic(source2, this.budget.parsing), variables, this.budget.parsing), source: source2 };
         } catch (error) {
           this.rethrowArithmeticControl(error);
-          throw new ExpansionFailure(`${part.name}: ${message(error)}`, line);
+          throw new ExpansionFailure(`${part.name}: ${message(error, this.budget.onInternalError)}`, line);
         } finally {
           retained?.release();
         }
@@ -17556,7 +17588,7 @@ var ShellInput = class _ShellInput {
       decoder3.decode();
       return { value: text3.finish(), escaped: escaped3, terminated };
     } catch (error) {
-      if (error instanceof TypeError && error.message.includes("encoded data")) throw new Error("read: unsupported non-UTF-8 text boundary");
+      if (error instanceof TypeError && error.message.includes("encoded data")) throw new PublicDiagnostic("read: unsupported non-UTF-8 text boundary");
       throw error;
     } finally {
       if (offset < chunk.length) this.#cursor.remainder = chunk.subarray(offset);
@@ -17726,6 +17758,7 @@ var Shell = class {
   #active = /* @__PURE__ */ new Set();
   constructor(options3) {
     if (!options3?.fs) throw new TypeError("Shell requires an explicit filesystem");
+    if (options3.onInternalError !== void 0 && typeof options3.onInternalError !== "function") throw new TypeError("onInternalError must be callable");
     warnIfHostProcessEnv(options3.env);
     resolveLimits(options3.limits);
     this.#options = { ...options3, cwd: resolvePath("/", options3.cwd ?? "/"), env: { ...options3.env }, limits: { ...options3.limits } };
@@ -17789,8 +17822,9 @@ var Shell = class {
   }
   async exec(source2, options3 = {}) {
     if (this.#disposed) throw new Error("Shell is disposed");
+    if (options3.onInternalError !== void 0 && typeof options3.onInternalError !== "function") throw new TypeError("onInternalError must be callable");
     warnIfHostProcessEnv(options3.env);
-    const budget = new Budget(resolveLimits(this.#options.limits, options3.limits), options3.signal);
+    const budget = new Budget(resolveLimits(this.#options.limits, options3.limits), options3.signal, options3.onInternalError ?? this.#options.onInternalError);
     const scope = new InvocationScope(options3.signal);
     const cancellationState = new RuntimeCancellationState();
     const owner = new RootInvocationCancellationOwner(scope);
@@ -18222,9 +18256,9 @@ var defaults = Object.freeze({
   workerOldGenerationMb: 128,
   workerStackMb: 4
 });
-var RegexExecutionError = class extends Error {
-  constructor(code, message3) {
-    super(code === "MATCH" ? message3 : `regex ${code}: ${message3}`);
+var RegexExecutionError = class extends PublicDiagnostic {
+  constructor(code, message3, options3) {
+    super(code === "MATCH" ? message3 : `regex ${code}: ${message3}`, options3);
     this.code = code;
     this.name = "RegexExecutionError";
   }
@@ -18431,7 +18465,7 @@ var Slot = class {
     if (this.receiver) this.receiver(value2);
     else this.fail(new RegexExecutionError("PROTOCOL", "unexpected idle message"));
   };
-  error = (error) => this.fail(new RegexExecutionError("WORKER_ERROR", error.message));
+  error = (error) => this.fail(new RegexExecutionError("WORKER_ERROR", "internal error", { cause: error }));
   messageerror = () => this.fail(new RegexExecutionError("PROTOCOL", "worker message could not be deserialized"));
   exit = (code) => {
     this.exited = true;
@@ -18796,7 +18830,7 @@ async function* requiredFileInput(context2, requirements, mode, file, maxBytes)
 }
 
 // packages/safe-bash/src/commands/text-programs/shared.ts
-var ProgramError = class extends Error {
+var ProgramError = class extends PublicDiagnostic {
 };
 var Budget3 = class {
   constructor(context2, options3) {
@@ -18885,7 +18919,7 @@ function command(name2, run4) {
         return { exitCode: await run4(context2) };
       } catch (error) {
         context2.signal.throwIfAborted();
-        await writeDiagnostic(context2.stderr, `${name2}: ${error instanceof Error ? error.message : String(error)}
+        await writeDiagnostic(context2.stderr, `${name2}: ${publicDiagnosticMessage(error, context2.onInternalError)}
 `, context2.signal);
         return { exitCode: error instanceof ProgramError ? 2 : 1 };
       }
@@ -20426,7 +20460,7 @@ var defaultFileTypes = Object.freeze({
 for (const patterns2 of Object.values(defaultFileTypes)) Object.freeze(patterns2);
 
 // packages/safe-bash/src/commands/search/options.ts
-var SearchError = class extends Error {
+var SearchError = class extends PublicDiagnostic {
 };
 function count(value2, flag) {
   if (!/^[0-9]+$/u.test(value2) || !Number.isSafeInteger(Number(value2))) throw new SearchError(`${flag} requires a nonnegative integer`);
@@ -20843,7 +20877,7 @@ var Limits = class {
   }
 };
 async function diagnostic2(context2, error) {
-  await writeDiagnostic(context2.stderr, `rg: ${error instanceof Error ? error.message : String(error)}
+  await writeDiagnostic(context2.stderr, `rg: ${publicDiagnosticMessage(error, context2.onInternalError)}
 `, context2.signal);
 }
 async function* lines2(source2, limits, state, binary3, nullData) {
@@ -21456,7 +21490,7 @@ var byteLength = Object.getOwnPropertyDescriptor(typedArrayPrototype2, "byteLeng
 var byteOffset = Object.getOwnPropertyDescriptor(typedArrayPrototype2, "byteOffset").get;
 var byteBuffer = Object.getOwnPropertyDescriptor(typedArrayPrototype2, "buffer").get;
 function fail(kind, message3) {
-  throw new Error(`bounded regex ${kind}: ${message3}`);
+  throw new PublicDiagnostic(`bounded regex ${kind}: ${message3}`);
 }
 function record3(value2, keys, optional = []) {
   if (value2 === null || typeof value2 !== "object" || Array.isArray(value2)) fail("protocol", "expected a data record");
@@ -21765,7 +21799,8 @@ var CooperativeWorker = class {
     try {
       owned = admit(input3, this.limits, this.#controller.signal);
     } catch (error) {
-      failure = error instanceof Error ? error.message.slice(0, 512) : "bounded regex protocol: request admission failed";
+      if (!(error instanceof PublicDiagnostic || error instanceof EreSyntaxError || error instanceof EreUnsupportedError || error instanceof EreProfileLimitError || error instanceof EreUsageUnknownError)) throw error;
+      failure = error.message.slice(0, 512);
     }
     this.#busy = true;
     const task = Promise.resolve().then(async () => {
@@ -21774,7 +21809,13 @@ var CooperativeWorker = class {
         this.#controller.signal.throwIfAborted();
         reply = owned ? await execute2(owned, this.#controller.signal) : { id, error: failure };
       } catch (error) {
-        reply = { id, error: error instanceof Error ? error.message.slice(0, 512) : "bounded regex request failed" };
+        if (!(error instanceof PublicDiagnostic || error instanceof EreSyntaxError || error instanceof EreUnsupportedError || error instanceof EreProfileLimitError || error instanceof EreUsageUnknownError)) {
+          owned = void 0;
+          this.#busy = false;
+          for (const listener of this.#listeners.get("error") ?? []) listener(error);
+          return;
+        }
+        reply = { id, error: error.message.slice(0, 512) };
       }
       if (expression && "error" in reply) reply = { id, operation: "expr-match", category: "unsupported", error: reply.error };
       owned = void 0;
@@ -22065,7 +22106,7 @@ function findCommands(execute5, maxDirectoryEntries) {
     };
     const evaluate = args.length ? disjunction() : async () => true;
     if (offset !== args.length) throw new UsageError(`unexpected expression '${args[offset]}'`);
-    if (deletes && prunes && !explicitDepth) throw new Error("-delete implies -depth; -prune is ineffective unless -depth is explicitly supplied");
+    if (deletes && prunes && !explicitDepth) throw new PublicDiagnostic("-delete implies -depth; -prune is ineffective unless -depth is explicitly supplied");
     for (const reference of references.keys()) {
       context2.signal.throwIfAborted();
       const path = pathOf(context2, reference);
@@ -22125,7 +22166,7 @@ function createStandardCommandsWithGrep(options3, grep) {
   const execute5 = directExecutor(options3.execute ?? (async (context2) => {
     const command7 = commands.find((definition3) => definition3.name === context2.command);
     if (command7) return command7.execute(context2);
-    await diagnostic(context2, new Error("command not found"));
+    await diagnostic(context2, new PublicDiagnostic("command not found"));
     return { exitCode: 127 };
   }));
   commands.push(...basicCommands(), ...filesystemCommands(options3.maxDirectoryEntries), ...streamCommands(options3.maxTeeTargets, options3.maxTailFollowHandles), ...textCommands(), ...grep, ...predicateCommands(), ...executionCommands(execute5, options3.execution), ...findCommands(execute5, options3.maxDirectoryEntries));
@@ -26265,7 +26306,7 @@ async function* range(source2, skip, count2) {
     }
     if (!skip && !count2) return;
   }
-  if (skip) throw new Error("cannot skip past end of input");
+  if (skip) throw new PublicDiagnostic("cannot skip past end of input");
 }
 async function* rows(source2, width) {
   const row = new Uint8Array(width);
@@ -26305,7 +26346,7 @@ function numeric2(text3, suffixes = false) {
 }
 function addOffset(offset, length) {
   const result2 = offset + length;
-  if (!Number.isSafeInteger(result2)) throw new Error("input address exceeds safe integer range");
+  if (!Number.isSafeInteger(result2)) throw new PublicDiagnostic("input address exceeds safe integer range");
   return result2;
 }
 
@@ -26391,13 +26432,13 @@ async function decode(context2, files, alphabet, ignore, maxInputBytes) {
       }
     }
     if (pending.length) await output(context2, Uint8Array.from(pending));
-    if (invalid) throw new Error("invalid input");
+    if (invalid) throw new PublicDiagnostic("invalid input");
   }
   if (quantum.length) {
     if (lastByte !== 61) while (quantum.length < alphabet.quantum) quantum.push(-1);
     const decoded = decodeQuantum(quantum, alphabet);
     if (decoded.bytes.length) await output(context2, Uint8Array.from(decoded.bytes));
-    if (!decoded.valid) throw new Error("invalid input");
+    if (!decoded.valid) throw new PublicDiagnostic("invalid input");
   }
 }
 function createBaseCommand(name2, maxInputBytes) {
@@ -26557,9 +26598,9 @@ async function reversePlain(context2, files, maxInputBytes) {
       }
     }
     if (pending.length) await output(context2, Uint8Array.from(pending));
-    if (invalid) throw new Error("invalid input: expected hexadecimal digits or ASCII whitespace");
+    if (invalid) throw new PublicDiagnostic("invalid input: expected hexadecimal digits or ASCII whitespace");
   }
-  if (high >= 0) throw new Error("invalid input: unmatched hexadecimal digit");
+  if (high >= 0) throw new PublicDiagnostic("invalid input: unmatched hexadecimal digit");
 }
 async function reverseNormal(context2, files, columns, maxInputBytes) {
   let line = "";
@@ -26570,13 +26611,13 @@ async function reverseNormal(context2, files, columns, maxInputBytes) {
       return;
     }
     const match = /^([0-9a-fA-F]{1,14}):[ \t]?(.*)$/u.exec(line.replace(/\r$/u, ""));
-    if (!match) throw new Error("invalid input: expected hexadecimal address and colon");
+    if (!match) throw new PublicDiagnostic("invalid input: expected hexadecimal address and colon");
     const address = Number.parseInt(match[1], 16);
-    if (!Number.isSafeInteger(address) || address !== offset) throw new Error("invalid input: reverse requires contiguous addresses starting at zero");
+    if (!Number.isSafeInteger(address) || address !== offset) throw new PublicDiagnostic("invalid input: reverse requires contiguous addresses starting at zero");
     const field = match[2].split(/ {2,}|\t/u, 1)[0];
-    if (!/^(?:[0-9a-fA-F]{2})+(?: (?:[0-9a-fA-F]{2})+)*$/u.test(field)) throw new Error("invalid input: malformed hexadecimal data field");
+    if (!/^(?:[0-9a-fA-F]{2})+(?: (?:[0-9a-fA-F]{2})+)*$/u.test(field)) throw new PublicDiagnostic("invalid input: malformed hexadecimal data field");
     const digits = field.replaceAll(" ", "");
-    if (digits.length > columns * 2) throw new Error("invalid input: data exceeds configured columns");
+    if (digits.length > columns * 2) throw new PublicDiagnostic("invalid input: data exceeds configured columns");
     const bytes3 = new Uint8Array(digits.length / 2);
     for (let index = 0; index < bytes3.length; index++) bytes3[index] = Number.parseInt(digits.slice(index * 2, index * 2 + 2), 16);
     offset = addOffset(offset, bytes3.length);
@@ -26587,7 +26628,7 @@ async function reverseNormal(context2, files, columns, maxInputBytes) {
     for (const byte of chunk) {
       if (byte === 10) await emitLine();
       else {
-        if (line.length >= 4096) throw new Error("invalid input: reverse line exceeds 4096 bytes");
+        if (line.length >= 4096) throw new PublicDiagnostic("invalid input: reverse line exceeds 4096 bytes");
         line += String.fromCharCode(byte);
       }
     }
@@ -26887,7 +26928,7 @@ async function verify(context2, manifest2, algorithm, settings17, state) {
     if (entry === "skip") continue;
     if (!entry || manifest2 === "-" && entry.filename === "-") {
       malformed++;
-      if (settings17.report === "warn") await diagnostic(context2, `${escaped(manifest2).name}: ${lineNumber}: improperly formatted ${algorithm} checksum line`);
+      if (settings17.report === "warn") await diagnostic(context2, new PublicDiagnostic(`${escaped(manifest2).name}: ${lineNumber}: improperly formatted ${algorithm} checksum line`));
       continue;
     }
     valid = true;
@@ -26908,12 +26949,12 @@ async function verify(context2, manifest2, algorithm, settings17, state) {
     else mismatched++;
     if (settings17.report !== "status" && (!match || settings17.report !== "quiet")) await report(context2, entry.filename, match ? "OK" : "FAILED");
   }
-  if (!valid) await diagnostic(context2, `${escaped(manifest2).name}: no properly formatted checksum lines found`);
+  if (!valid) await diagnostic(context2, new PublicDiagnostic(`${escaped(manifest2).name}: no properly formatted checksum lines found`));
   else if (settings17.report !== "status") {
-    if (malformed) await diagnostic(context2, `WARNING: ${malformed} improperly formatted checksum line(s)`);
-    if (failures) await diagnostic(context2, `WARNING: ${failures} listed file(s) could not be read`);
-    if (mismatched) await diagnostic(context2, `WARNING: ${mismatched} computed checksum(s) did NOT match`);
-    if (settings17.ignoreMissing && !matched) await diagnostic(context2, `${escaped(manifest2).name}: no file was verified`);
+    if (malformed) await diagnostic(context2, new PublicDiagnostic(`WARNING: ${malformed} improperly formatted checksum line(s)`));
+    if (failures) await diagnostic(context2, new PublicDiagnostic(`WARNING: ${failures} listed file(s) could not be read`));
+    if (mismatched) await diagnostic(context2, new PublicDiagnostic(`WARNING: ${mismatched} computed checksum(s) did NOT match`));
+    if (settings17.ignoreMissing && !matched) await diagnostic(context2, new PublicDiagnostic(`${escaped(manifest2).name}: no file was verified`));
   }
   return valid && matched && !failures && !mismatched && (!settings17.strict || !malformed);
 }
@@ -26975,6 +27016,39 @@ import { createGzip } from "node:zlib";
 
 // packages/safe-bash/src/commands/bytes/compression/gunzip.ts
 init_platform();
+
+// packages/safe-bash/src/commands/bytes/compression/errors.ts
+init_platform();
+var dataErrors = /* @__PURE__ */ new Set([
+  "incorrect header check",
+  "unknown compression method",
+  "invalid window size",
+  "unknown header flags set",
+  "header crc mismatch",
+  "invalid block type",
+  "invalid stored block lengths",
+  "too many length or distance symbols",
+  "invalid code lengths set",
+  "invalid bit length repeat",
+  "invalid code -- missing end-of-block",
+  "invalid literal/lengths set",
+  "invalid distances set",
+  "invalid literal/length code",
+  "invalid distance code",
+  "invalid distance too far back",
+  "incorrect data check",
+  "incorrect length check"
+]);
+function compressionDiagnostic(error) {
+  if (!(error instanceof Error) || error instanceof PublicDiagnostic) return error;
+  const code = "code" in error ? error.code : void 0;
+  if (code === "Z_DATA_ERROR" && dataErrors.has(error.message) || code === "Z_BUF_ERROR" && error.message === "unexpected end of file") {
+    return new PublicDiagnostic(error.message);
+  }
+  return error;
+}
+
+// packages/safe-bash/src/commands/bytes/compression/gunzip.ts
 import { createInflateRaw } from "node:zlib";
 var crcTable2 = Uint32Array.from({ length: 256 }, (_, value2) => {
   for (let bit = 0; bit < 8; bit++) value2 = value2 >>> 1 ^ (value2 & 1 ? 3988292384 : 0);
@@ -27015,7 +27089,7 @@ var Input = class {
   }
   async required() {
     const value2 = await this.byte();
-    if (value2 === void 0) throw new Error("unexpected end of file");
+    if (value2 === void 0) throw new PublicDiagnostic("unexpected end of file");
     return value2;
   }
   async exact(length) {
@@ -27029,9 +27103,9 @@ var Input = class {
 };
 async function header(input3, magic2) {
   const fixed2 = await input3.exact(8);
-  if (fixed2[0] !== 8) throw new Error("unknown compression method");
+  if (fixed2[0] !== 8) throw new PublicDiagnostic("unknown compression method");
   const flags3 = fixed2[1];
-  if (flags3 & 224) throw new Error("invalid gzip header flags");
+  if (flags3 & 224) throw new PublicDiagnostic("invalid gzip header flags");
   let crc = updateCrc(updateCrc(4294967295, magic2), fixed2);
   const next = async () => {
     const value2 = await input3.required();
@@ -27049,7 +27123,7 @@ async function header(input3, magic2) {
   }
   if (flags3 & 2) {
     const expected = await input3.required() | await input3.required() << 8;
-    if (((crc ^ 4294967295) & 65535) !== expected) throw new Error("header crc mismatch");
+    if (((crc ^ 4294967295) & 65535) !== expected) throw new PublicDiagnostic("header crc mismatch");
   }
 }
 async function* inflate(input3, signal) {
@@ -27068,7 +27142,7 @@ async function* inflate(input3, signal) {
           return;
         }
         const before = codec.bytesWritten;
-        await new Promise((resolve, reject) => codec.write(chunk, (error) => error ? reject(error) : resolve()));
+        await new Promise((resolve, reject) => codec.write(chunk, (error) => error ? reject(compressionDiagnostic(error)) : resolve()));
         const consumed = codec.bytesWritten - before;
         if (consumed < chunk.length) {
           input3.restore(chunk.subarray(consumed));
@@ -27077,8 +27151,9 @@ async function* inflate(input3, signal) {
         }
       }
     } catch (error) {
-      codec.destroy(error instanceof Error ? error : new Error(String(error)));
-      throw error;
+      const failure = error instanceof PublicDiagnostic || error instanceof FsError ? error : new PublicDiagnostic("internal error", { cause: error });
+      codec.destroy(failure);
+      throw failure;
     }
   })();
   void writing.catch(() => {
@@ -27086,6 +27161,9 @@ async function* inflate(input3, signal) {
   try {
     for await (const chunk of readBytes2(codec, signal)) yield chunk;
     await writing;
+  } catch (error) {
+    signal.throwIfAborted();
+    throw compressionDiagnostic(error);
   } finally {
     codec.destroy();
     signal.removeEventListener("abort", abort);
@@ -27100,7 +27178,7 @@ async function* gunzipMembers(source2, signal, force, warn) {
     for (; ; ) {
       const first = await input3.byte();
       if (first === void 0) {
-        if (!members && !force) throw new Error("unexpected end of file");
+        if (!members && !force) throw new PublicDiagnostic("unexpected end of file");
         return;
       }
       const second = await input3.byte();
@@ -27123,8 +27201,8 @@ async function* gunzipMembers(source2, signal, force, warn) {
           if (garbage) warn();
           return;
         }
-        if (second === void 0) throw new Error("unexpected end of file");
-        if (!members) throw new Error("not in gzip format");
+        if (second === void 0) throw new PublicDiagnostic("unexpected end of file");
+        if (!members) throw new PublicDiagnostic("not in gzip format");
         warn();
         return;
       }
@@ -27138,8 +27216,8 @@ async function* gunzipMembers(source2, signal, force, warn) {
       }
       const footer = await input3.exact(8);
       const view = new DataView(footer.buffer, footer.byteOffset, footer.byteLength);
-      if ((crc ^ 4294967295) >>> 0 !== view.getUint32(0, true)) throw new Error("incorrect data check (CRC)");
-      if (size !== view.getUint32(4, true)) throw new Error("incorrect length check");
+      if ((crc ^ 4294967295) >>> 0 !== view.getUint32(0, true)) throw new PublicDiagnostic("incorrect data check (CRC)");
+      if (size !== view.getUint32(4, true)) throw new PublicDiagnostic("incorrect length check");
       members++;
     }
   } finally {
@@ -27171,8 +27249,10 @@ async function transform(source2, consume, options3, parentSignal, maxOutput = I
   const controller = new AbortController();
   const signal = AbortSignal.any([parentSignal, controller.signal]);
   let failure;
+  let hasFailure = false;
   const fail4 = (error) => {
     if (!controller.signal.aborted) {
+      hasFailure = true;
       failure = error;
       controller.abort(error);
     }
@@ -27221,7 +27301,7 @@ async function transform(source2, consume, options3, parentSignal, maxOutput = I
     }, { signal });
   } catch (error) {
     parentSignal.throwIfAborted();
-    throw failure ?? error;
+    throw hasFailure ? failure : error;
   } finally {
     controller.abort();
     readable.destroy();
@@ -27401,7 +27481,10 @@ async function writeFileOperand(context2, plan, options3) {
     }
     await context2.fs.rm(directory2, { recursive: true, signal });
   } catch (error) {
-    if (failed) throw new AggregateError([failure, error], "compression failed and staging cleanup failed; input retained");
+    if (failed) {
+      const aggregate = new AggregateError([failure, error], "compression failed and staging cleanup failed; input retained");
+      throw new PublicDiagnostic(aggregate.message, { cause: aggregate });
+    }
     throw error;
   }
   if (failed) throw failure;
@@ -27517,7 +27600,7 @@ No FILE or FILE '-' uses stdin; file output uses private VFS staging.
           }, { ...options3, force: options3.force && (options3.stdout || options3.test || plan.source === "-") }, context2.signal);
         }
         if (warned2) {
-          await diagnostic(context2, new Error(`${plan.source}: decompression OK, trailing garbage ignored`));
+          await diagnostic(context2, new PublicDiagnostic(`${plan.source}: decompression OK, trailing garbage ignored`));
           if (exitCode === 0) exitCode = 2;
         }
       } catch (error) {
@@ -27543,7 +27626,7 @@ init_platform();
 
 // packages/safe-bash/src/commands/diff-patch/shared.ts
 init_platform();
-var ToolError = class extends Error {
+var ToolError = class extends PublicDiagnostic {
   constructor(message3, exitCode = 2) {
     super(message3);
     this.exitCode = exitCode;
@@ -27687,7 +27770,7 @@ function definition(name2, options3, run4) {
         return { exitCode: await run4(context2, new Budget13(context2, options3)) };
       } catch (error) {
         context2.signal.throwIfAborted();
-        const message3 = error instanceof Error ? error.message : String(error);
+        const message3 = publicDiagnosticMessage(error, context2.onInternalError);
         await writeDiagnostic(context2.stderr, `${name2}: ${message3.slice(0, 1e3)}${message3.length > 1e3 ? "\u2026" : ""}
 `, context2.signal);
         return { exitCode: error instanceof ToolError ? error.exitCode : 2 };
@@ -28839,7 +28922,7 @@ async function pruneDirectories(parents2, budget) {
       budget.context.signal.throwIfAborted();
       if (isFsError(error, "ENOENT")) continue;
       if (isFsError(error) || error instanceof ToolError) throw error;
-      throw new ToolError(`cannot prune directory ${parent}: ${error instanceof Error ? error.message : String(error)}`);
+      throw new ToolError(`cannot prune directory ${parent}: ${publicDiagnosticMessage(error, budget.context.onInternalError)}`);
     }
   }
 }
@@ -29222,7 +29305,7 @@ ${sourcePatch.hunks.length} out of ${sourcePatch.hunks.length} hunks ignored
     } catch (error) {
       context2.signal.throwIfAborted();
       if (committed === 0 && !publishing) throw error;
-      throw new ToolError(`commit stopped; ${committed}/${authorized.length} files committed; failing operation may have side effects; path ${activePath}: ${error instanceof Error ? error.message : String(error)}`);
+      throw new ToolError(`commit stopped; ${committed}/${authorized.length} files committed; failing operation may have side effects; path ${activePath}: ${publicDiagnosticMessage(error, budget.context.onInternalError)}`);
     }
   }
   if (options3.atomic && !options3.dryRun) {
@@ -29234,7 +29317,7 @@ ${sourcePatch.hunks.length} out of ${sourcePatch.hunks.length} hunks ignored
         committed++;
       } catch (error) {
         context2.signal.throwIfAborted();
-        throw new ToolError(`commit stopped; ${committed}/${prepared.length} files committed; failing operation may have side effects; path ${item.path}: ${error instanceof Error ? error.message : String(error)}`);
+        throw new ToolError(`commit stopped; ${committed}/${prepared.length} files committed; failing operation may have side effects; path ${item.path}: ${publicDiagnosticMessage(error, budget.context.onInternalError)}`);
       }
       for (const parent of item.parents) parents2.add(parent);
     }
@@ -29819,7 +29902,7 @@ function settings2(options3) {
   return Object.freeze(limits);
 }
 function fail2(message3) {
-  throw new Error(message3);
+  throw new PublicDiagnostic(message3);
 }
 function vfsPath(cwd, path) {
   return path.startsWith("/") ? path : `${cwd === "/" ? "" : cwd}/${path}`;
@@ -30510,14 +30593,15 @@ async function* compressed(source2, decode3, signal, limits) {
     try {
       for await (const chunk of bounded(source2, limits.maxArchiveBytes, combined, limits.chunkSize)) {
         await wait(combined, () => new Promise((resolve, reject) => {
-          transform2.write(chunk, (error) => error ? reject(error) : resolve());
+          transform2.write(chunk, (error) => error ? reject(compressionDiagnostic(error)) : resolve());
         }));
       }
       combined.throwIfAborted();
       transform2.end();
     } catch (error) {
-      transform2.destroy(error instanceof Error ? error : new Error(String(error)));
-      throw error;
+      const failure = error instanceof PublicDiagnostic || error instanceof FsError ? error : new PublicDiagnostic("internal error", { cause: error });
+      transform2.destroy(failure);
+      throw failure;
     }
   })();
   void pump.catch(() => {
@@ -30525,6 +30609,9 @@ async function* compressed(source2, decode3, signal, limits) {
   try {
     yield* bounded(transform2, limits.maxArchiveBytes, combined, limits.chunkSize);
     await pump;
+  } catch (error) {
+    signal.throwIfAborted();
+    throw compressionDiagnostic(error);
   } finally {
     controller.abort(new Error("archive compression finished"));
     combined.removeEventListener("abort", destroy);
@@ -30903,7 +30990,7 @@ function createTarCommand(options3 = {}) {
     } catch (error) {
       controller.abort(error);
       original.signal.throwIfAborted();
-      const message3 = escapeText(display((error instanceof Error ? error.message : String(error)).slice(0, 1024)), "diagnostic");
+      const message3 = escapeText(display(publicDiagnosticMessage(error, original.onInternalError).slice(0, 1024)), "diagnostic");
       await writeBytes(original.stderr, import_buffer.Buffer.from(`tar: ${message3}
 `).subarray(0, limits.maxDiagnosticBytes), original.signal);
       return { exitCode: 2 };
@@ -31051,7 +31138,7 @@ var RecordReader = class {
   }
   async closeOperand(name2) {
     this.budget.context.signal.throwIfAborted();
-    if (this.closed) throw new Error(`${name2}: Bad file descriptor`);
+    if (this.closed) throw new PublicDiagnostic(`${name2}: Bad file descriptor`);
     await this.close();
   }
   async close() {
@@ -31125,7 +31212,7 @@ var OrderCheck = class {
       if (this.mode === "check") fail3(message3);
       this.warned.add(file);
       this.failed = true;
-      await diagnostic(this.context, new Error(message3));
+      await diagnostic(this.context, new PublicDiagnostic(message3));
     }
   }
 };
@@ -32585,7 +32672,7 @@ function createRevCommand(limits) {
           await session.text("\n");
         }
         if (length !== record4.length) {
-          await diagnostic(session.context, new Error(`${name2 === "-" ? "stdin" : name2}: Illegal byte sequence`));
+          await diagnostic(session.context, new PublicDiagnostic(`${name2 === "-" ? "stdin" : name2}: Illegal byte sequence`));
           session.failed = true;
           break;
         }
@@ -32735,26 +32822,26 @@ function settings6(options3) {
 }
 function number3(text3, label, units = false, zero = false) {
   const match = /^[\t\n\v\f\r ]*\+?([0-9]*)([a-zA-Z]*)$/u.exec(text3);
-  if (!match || !match[1] && (!units || !match[2] || text3 !== match[2])) throw new Error(`invalid ${label}: '${text3}'`);
+  if (!match || !match[1] && (!units || !match[2] || text3 !== match[2])) throw new PublicDiagnostic(`invalid ${label}: '${text3}'`);
   const suffix2 = match[2];
   let multiplier2 = 1;
   if (suffix2) {
-    if (!units) throw new Error(`invalid ${label}: '${text3}'`);
+    if (!units) throw new PublicDiagnostic(`invalid ${label}: '${text3}'`);
     if (suffix2 === "b") multiplier2 = 512;
     else {
       const unit = /^([kKmMGTPEZYRQ])(?:(i?B))?$/u.exec(suffix2);
-      if (!unit) throw new Error(`invalid ${label}: '${text3}'`);
+      if (!unit) throw new PublicDiagnostic(`invalid ${label}: '${text3}'`);
       const exponent = "KMGTPEZYRQ".indexOf(unit[1].toUpperCase()) + 1;
       multiplier2 = (unit[2] === "B" ? 1e3 : 1024) ** exponent;
     }
   }
   const value2 = Number(match[1] || "1") * multiplier2;
-  if (!Number.isSafeInteger(value2) || value2 < (zero ? 0 : 1)) throw new Error(`invalid ${label}: '${text3}'`);
+  if (!Number.isSafeInteger(value2) || value2 < (zero ? 0 : 1)) throw new PublicDiagnostic(`invalid ${label}: '${text3}'`);
   return value2;
 }
 function parseArguments(args, limits) {
   if (args.reduce((total, argument2) => total + import_buffer.Buffer.byteLength(argument2), 0) > limits.maxArgumentBytes) {
-    throw new Error("split argument limit exceeded");
+    throw new PublicDiagnostic("split argument limit exceeded");
   }
   let mode;
   let size = 1e3;
@@ -32768,15 +32855,15 @@ function parseArguments(args, limits) {
     if (option === "d") {
       numeric4 = true;
       if (value2 !== void 0) {
-        if (!/^[0-9]*$/u.test(value2)) throw new Error(`invalid start value for numerical suffix: '${value2}'`);
+        if (!/^[0-9]*$/u.test(value2)) throw new PublicDiagnostic(`invalid start value for numerical suffix: '${value2}'`);
         numericStart = value2.replace(/^0+(?=\d)/u, "") || "0";
       }
     } else if (option === "a") suffixLength = number3(value2, "suffix length", false, true);
     else if (option === "additional-suffix") {
-      if (value2.includes("/") || value2.includes("\0")) throw new Error("invalid additional suffix: contains directory separator or NUL");
+      if (value2.includes("/") || value2.includes("\0")) throw new PublicDiagnostic("invalid additional suffix: contains directory separator or NUL");
       additionalSuffix = value2;
     } else {
-      if (mode) throw new Error("cannot split in more than one way");
+      if (mode) throw new PublicDiagnostic("cannot split in more than one way");
       mode = option === "l" ? "lines" : option === "b" ? "bytes" : "line-bytes";
       size = number3(value2, option === "l" ? "number of lines" : "number of bytes", option !== "l");
     }
@@ -32803,28 +32890,28 @@ function parseArguments(args, limits) {
       const equals = argument2.indexOf("=");
       const name2 = argument2.slice(2, equals < 0 ? void 0 : equals);
       const option = long[name2];
-      if (!option) throw new Error(`unrecognized option '${argument2}'`);
+      if (!option) throw new PublicDiagnostic(`unrecognized option '${argument2}'`);
       const value2 = equals < 0 ? option === "d" ? void 0 : args[++index] : argument2.slice(equals + 1);
-      if (option !== "d" && value2 === void 0) throw new Error(`option '--${name2}' requires an argument`);
+      if (option !== "d" && value2 === void 0) throw new PublicDiagnostic(`option '--${name2}' requires an argument`);
       apply(option, value2);
     } else {
       for (let offset = 1; offset < argument2.length; offset++) {
         const option = argument2[offset];
-        if (!"lbaCd".includes(option)) throw new Error(`invalid option -- '${option}'`);
+        if (!"lbaCd".includes(option)) throw new PublicDiagnostic(`invalid option -- '${option}'`);
         if (option === "d") apply(option);
         else {
           const value2 = argument2.slice(offset + 1) || args[++index];
-          if (value2 === void 0) throw new Error(`option requires an argument -- '${option}'`);
+          if (value2 === void 0) throw new PublicDiagnostic(`option requires an argument -- '${option}'`);
           apply(option, value2);
           break;
         }
       }
     }
   }
-  if (operands.length > 2) throw new Error(`extra operand '${operands[2]}'`);
-  if ((suffixLength || 2) > limits.maxSuffixLength) throw new Error("split suffix length limit exceeded");
-  if (numericStart !== void 0 && numericStart.length > (suffixLength || 2)) throw new Error("numerical suffix start value is too large for the suffix length");
-  if (mode === "line-bytes" && size > limits.maxBufferBytes) throw new Error("split line-bytes window exceeds buffer limit");
+  if (operands.length > 2) throw new PublicDiagnostic(`extra operand '${operands[2]}'`);
+  if ((suffixLength || 2) > limits.maxSuffixLength) throw new PublicDiagnostic("split suffix length limit exceeded");
+  if (numericStart !== void 0 && numericStart.length > (suffixLength || 2)) throw new PublicDiagnostic("numerical suffix start value is too large for the suffix length");
+  if (mode === "line-bytes" && size > limits.maxBufferBytes) throw new PublicDiagnostic("split line-bytes window exceeds buffer limit");
   return {
     mode: mode ?? "lines",
     size,
@@ -32967,7 +33054,7 @@ var Names = class {
       for (let index = this.digits.length - 1; index >= 0; index--) {
         this.digits[index] = this.digits[index] + 1;
         if (index === 0 && this.args.automatic && this.digits[index] === this.args.alphabet.length - 1) {
-          if (this.extension.length + this.digits.length + 2 > this.limits.maxSuffixLength) throw new Error("split suffix length limit exceeded");
+          if (this.extension.length + this.digits.length + 2 > this.limits.maxSuffixLength) throw new PublicDiagnostic("split suffix length limit exceeded");
           this.extension += this.args.alphabet.at(-1);
           this.digits = Array.from({ length: this.digits.length + 1 }, () => 0);
           advanced = true;
@@ -32979,7 +33066,7 @@ var Names = class {
         }
         this.digits[index] = 0;
       }
-      if (!advanced) throw new Error("output file suffixes exhausted");
+      if (!advanced) throw new PublicDiagnostic("output file suffixes exhausted");
     }
     this.first = false;
     return this.args.prefix + this.extension + this.digits.map((digit2) => this.args.alphabet[digit2]).join("") + this.args.additionalSuffix;
@@ -33191,7 +33278,7 @@ function createSplitCommand(limits) {
       return { exitCode: 0 };
     } catch (error) {
       context2.signal.throwIfAborted();
-      const message3 = error instanceof FsError ? error.message.slice(error.code.length + 2) : error instanceof Error ? error.message : String(error);
+      const message3 = error instanceof FsError ? error.message.slice(error.code.length + 2) : publicDiagnosticMessage(error, context2.onInternalError);
       await writeDiagnostic(context2.stderr, `split: ${message3.slice(0, 4096)}
 `, context2.signal);
       return { exitCode: 1 };
@@ -34062,8 +34149,7 @@ var TreeLimitError = class extends FsError {
   }
 };
 function message2(error, budget) {
-  const value2 = error instanceof Error ? error.message : error;
-  const text3 = typeof value2 === "string" ? value2 : value2 === null || value2 === void 0 || typeof value2 === "number" || typeof value2 === "boolean" ? String(value2) : "non-string filesystem error";
+  const text3 = publicDiagnosticMessage(error, budget.context.onInternalError);
   budget.text(text3);
   return error instanceof Error ? text3.replace(/^[A-Z][A-Z0-9]+: /u, "") : text3;
 }
@@ -35373,7 +35459,7 @@ function diagnostics(context2, maximum) {
   return async (error) => {
     context2.signal.throwIfAborted();
     if (!remaining) return;
-    const message3 = error instanceof Error ? error.message : String(error);
+    const message3 = publicDiagnosticMessage(error, context2.onInternalError);
     const prefix3 = "column: ", marker = "...[diagnostic truncated]\n";
     const candidate = prefix3 + escapeText(message3.slice(0, remaining), "diagnostic") + "\n";
     let bytes3 = import_buffer.Buffer.from(candidate);
@@ -36894,7 +36980,7 @@ function createHtmlToMarkdownCommand(options3 = {}) {
       try {
         context2.signal.throwIfAborted();
         if (operation2?.signal.aborted && error === operation2.signal.reason) throw error;
-        const message3 = error instanceof Error ? error.message : String(error);
+        const message3 = error instanceof HtmlUsageError ? error.message : publicDiagnosticMessage(error, context2.onInternalError);
         const text3 = `html-to-markdown: ${escapeText(message3.slice(0, limits.maxDiagnosticBytes), "diagnostic")}
 `;
         let bytes3 = import_buffer.Buffer.from(text3);
@@ -36940,7 +37026,7 @@ init_platform();
 
 // packages/safe-bash/src/commands/du/format.ts
 init_platform();
-var UsageError3 = class extends Error {
+var UsageError3 = class extends PublicDiagnostic {
 };
 function blockSize2(value2) {
   if (value2 === "human-readable") return { unit: 1n, suffix: "", human: 1024 };
@@ -37260,7 +37346,7 @@ var Budget27 = class {
   }
   async diagnostic(error, path) {
     this.active(this.caller.signal);
-    const raw = error instanceof Error ? error.message : typeof error === "string" ? error : "filesystem operation failed";
+    const raw = error instanceof UsageError3 ? error.message : publicDiagnosticMessage(error, this.context.onInternalError);
     const maximum = 4096;
     const short = raw.length > maximum ? raw.slice(0, maximum) + " [diagnostic truncated]" : raw;
     const message3 = short.replace(/^[A-Z][A-Z0-9]+: /u, "");
@@ -37329,7 +37415,7 @@ var Walker3 = class {
   async add(left, right, display2) {
     this.budget.step();
     if (right.bytes > Number.MAX_SAFE_INTEGER - left.bytes) {
-      await this.failure(new Error("aggregate exceeds safe integer range; total suppressed"), display2);
+      await this.failure(new PublicDiagnostic("aggregate exceeds safe integer range; total suppressed"), display2);
       return { bytes: left.bytes, complete: false };
     }
     return { bytes: left.bytes + right.bytes, complete: left.complete && right.complete };
@@ -37349,7 +37435,7 @@ var Walker3 = class {
       return void 0;
     }
     if (!Array.isArray(entries2)) {
-      await this.failure(new Error("invalid directory listing"), display2);
+      await this.failure(new PublicDiagnostic("invalid directory listing"), display2);
       return void 0;
     }
     this.budget.check(entries2.length, limits.maxDirectoryEntries, "directory entry");
@@ -37357,12 +37443,12 @@ var Walker3 = class {
     for (const entry of entries2) {
       this.budget.step();
       if (!entry || typeof entry.name !== "string") {
-        await this.failure(new Error("invalid directory entry"), display2);
+        await this.failure(new PublicDiagnostic("invalid directory entry"), display2);
         return void 0;
       }
       this.budget.text(entry.name);
       if (!entry.name || entry.name === "." || entry.name === ".." || /[\/\0]/u.test(entry.name) || names.has(entry.name)) {
-        await this.failure(new Error("invalid or duplicate directory entry name"), display2);
+        await this.failure(new PublicDiagnostic("invalid or duplicate directory entry name"), display2);
         return void 0;
       }
       names.add(entry.name);
@@ -37379,13 +37465,13 @@ var Walker3 = class {
     this.budget.text(path);
     this.budget.text(display2);
     if (display2 === "") {
-      await this.failure(new Error("invalid zero-length file name"));
+      await this.failure(new PublicDiagnostic("invalid zero-length file name"));
       return { bytes: 0, complete: false };
     }
     let stat;
     try {
       stat = await this.budget.fs(() => context2.fs.lstat(path, { signal: context2.signal }));
-      if (!stat || !["file", "directory", "symlink"].includes(stat.type)) throw new Error("invalid entry type");
+      if (!stat || !["file", "directory", "symlink"].includes(stat.type)) throw new PublicDiagnostic("invalid entry type");
     } catch (error) {
       await this.failure(error, display2);
       return { bytes: 0, complete: false };
@@ -37393,7 +37479,7 @@ var Walker3 = class {
     const bytes3 = this.args.apparent ? stat.type === "directory" ? 0 : stat.size : stat.allocatedBytes;
     let amount;
     if (bytes3 === void 0 || !Number.isSafeInteger(bytes3) || bytes3 < 0) {
-      await this.failure(new Error(`${this.args.apparent ? "apparent size" : "allocated bytes"} ${bytes3 === void 0 ? "unknown" : "invalid"}; total suppressed`), display2);
+      await this.failure(new PublicDiagnostic(`${this.args.apparent ? "apparent size" : "allocated bytes"} ${bytes3 === void 0 ? "unknown" : "invalid"}; total suppressed`), display2);
       amount = { bytes: 0, complete: false };
     } else amount = { bytes: bytes3, complete: true };
     if (this.duplicate(stat)) return { bytes: 0, complete: amount.complete };
@@ -37911,7 +37997,8 @@ function createExprCommandWithExecutor(executor, options3 = {}) {
         await budget.yield();
       } catch (error) {
         context2.signal.throwIfAborted();
-        const detail = error instanceof ExprError || error instanceof ExprMatchError || error instanceof RegexExecutionError ? error.message : "execution or output failure";
+        const projected = error instanceof ExprError || error instanceof ExprMatchError ? error.message : publicDiagnosticMessage(error, context2.onInternalError);
+        const detail = error instanceof ExprError || error instanceof ExprMatchError || error instanceof RegexExecutionError ? projected : "execution or output failure";
         let message3;
         try {
           budget.check(detail.length + 7, limits.maxOutputBytes, "output bytes");
@@ -39386,7 +39473,7 @@ function commandExecutor(lookup) {
   return async (context2) => {
     const command7 = lookup(context2.command);
     if (command7) return command7.execute(context2);
-    await diagnostic(context2, new Error("command not found"));
+    await diagnostic(context2, new PublicDiagnostic("command not found"));
     return { exitCode: 127 };
   };
 }
@@ -39542,6 +39629,7 @@ function portableAgentCommands(options3) {
 }
 export {
   ACCESS_MODES,
+  CommandArgumentIdentityError,
   CommandRegistry,
   EreLedger,
   EreProfileLimitError,