@prestyj/cli 5.8.0 → 5.10.0

package/dist/core/message-images.d.ts

@@ -0,0 +1,12 @@
+import type { Message } from "@prestyj/ai";
+/**
+ * Repair images restored from older sessions that predate attachment resizing.
+ *
+ * Anthropic accepts images up to 8000 px normally, but lowers the limit to
+ * 2000 px per side once the full request history contains more than 20 images.
+ * Mutating the in-memory blocks prevents an old oversized image from poisoning
+ * every later turn; malformed blocks are left alone so session loading remains
+ * best-effort.
+ */
+export declare function normalizeMessageImages(messages: Message[]): Promise<number>;
+//# sourceMappingURL=message-images.d.ts.map

package/dist/core/message-images.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-images.d.ts","sourceRoot":"","sources":["../../src/core/message-images.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,OAAO,EAAE,MAAM,aAAa,CAAC;AAuBzD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBjF"}

package/dist/core/message-images.js

@@ -0,0 +1,52 @@
+import { shrinkToFit } from "../utils/image.js";
+function imageBlocks(message) {
+    if (message.role === "system" || typeof message.content === "string")
+        return [];
+    const images = [];
+    if (message.role === "tool") {
+        for (const result of message.content) {
+            if (typeof result.content === "string")
+                continue;
+            for (const block of result.content) {
+                if (block.type === "image")
+                    images.push(block);
+            }
+        }
+        return images;
+    }
+    for (const block of message.content) {
+        if (block.type === "image")
+            images.push(block);
+    }
+    return images;
+}
+/**
+ * Repair images restored from older sessions that predate attachment resizing.
+ *
+ * Anthropic accepts images up to 8000 px normally, but lowers the limit to
+ * 2000 px per side once the full request history contains more than 20 images.
+ * Mutating the in-memory blocks prevents an old oversized image from poisoning
+ * every later turn; malformed blocks are left alone so session loading remains
+ * best-effort.
+ */
+export async function normalizeMessageImages(messages) {
+    let normalizedCount = 0;
+    for (const message of messages) {
+        for (const block of imageBlocks(message)) {
+            try {
+                const original = Buffer.from(block.data, "base64");
+                const resized = await shrinkToFit(original, block.mediaType);
+                if (resized.buffer !== original || resized.mediaType !== block.mediaType) {
+                    block.data = resized.buffer.toString("base64");
+                    block.mediaType = resized.mediaType;
+                    normalizedCount++;
+                }
+            }
+            catch {
+                // A bad historical image should not make the entire session unloadable.
+            }
+        }
+    }
+    return normalizedCount;
+}
+//# sourceMappingURL=message-images.js.map

package/dist/core/message-images.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-images.js","sourceRoot":"","sources":["../../src/core/message-images.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,SAAS,WAAW,CAAC,OAAgB;IACnC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEhF,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;gBAAE,SAAS;YACjD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;oBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAmB;IAC9D,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACnD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;oBACzE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBAC/C,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;oBACpC,eAAe,EAAE,CAAC;gBACpB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wEAAwE;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/core/message-images.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=message-images.test.d.ts.map

package/dist/core/message-images.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-images.test.d.ts","sourceRoot":"","sources":["../../src/core/message-images.test.ts"],"names":[],"mappings":""}

package/dist/core/message-images.test.js

@@ -0,0 +1,62 @@
+import { describe, expect, it } from "vitest";
+import { normalizeMessageImages } from "./message-images.js";
+async function oversizedPng() {
+    const sharpModule = await import("sharp");
+    return sharpModule
+        .default({
+        create: {
+            width: 2400,
+            height: 1200,
+            channels: 3,
+            background: { r: 20, g: 40, b: 60 },
+        },
+    })
+        .png()
+        .toBuffer();
+}
+describe("normalizeMessageImages", () => {
+    it("repairs oversized images restored in user and tool-result history", async () => {
+        const original = await oversizedPng();
+        const data = original.toString("base64");
+        const messages = [
+            {
+                role: "user",
+                content: [{ type: "image", mediaType: "image/png", data }],
+            },
+            {
+                role: "tool",
+                content: [
+                    {
+                        type: "tool_result",
+                        toolCallId: "tool-1",
+                        content: [{ type: "image", mediaType: "image/png", data }],
+                    },
+                ],
+            },
+        ];
+        expect(await normalizeMessageImages(messages)).toBe(2);
+        const userMessage = messages[0];
+        const toolMessage = messages[1];
+        if (userMessage.role !== "user" || toolMessage.role !== "tool") {
+            throw new Error("Unexpected test message shape");
+        }
+        const userContent = userMessage.content;
+        if (typeof userContent === "string")
+            throw new Error("Expected user image content");
+        const userImage = userContent[0];
+        const toolResultContent = toolMessage.content[0].content;
+        if (userImage.type !== "image" || typeof toolResultContent === "string") {
+            throw new Error("Expected image blocks");
+        }
+        const toolImage = toolResultContent[0];
+        if (toolImage.type !== "image")
+            throw new Error("Expected tool-result image block");
+        const sharpModule = await import("sharp");
+        for (const image of [userImage, toolImage]) {
+            const metadata = await sharpModule.default(Buffer.from(image.data, "base64")).metadata();
+            expect(metadata.width).toBeLessThanOrEqual(2000);
+            expect(metadata.height).toBeLessThanOrEqual(2000);
+        }
+    });
+});
+//# sourceMappingURL=message-images.test.js.map

package/dist/core/message-images.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-images.test.js","sourceRoot":"","sources":["../../src/core/message-images.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,KAAK,UAAU,YAAY;IACzB,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,WAAW;SACf,OAAO,CAAC;QACP,MAAM,EAAE;YACN,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;SACpC;KACF,CAAC;SACD,GAAG,EAAE;SACL,QAAQ,EAAE,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAc;YAC1B;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;aAC3D;YACD;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,aAAa;wBACnB,UAAU,EAAE,QAAQ;wBACpB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;qBAC3D;iBACF;aACF;SACF,CAAC;QAEF,MAAM,CAAC,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEvD,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACjC,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC;QACxC,IAAI,OAAO,WAAW,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACpF,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;QAClC,MAAM,iBAAiB,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;QAC1D,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,CAAC,CAAE,CAAC;QACxC,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAEpF,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/core/network-guard.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Network egress allowlist.
+ *
+ * Two layers, with very different strength:
+ *
+ * 1. **Real enforcement** — the agent's own egress paths (`web-fetch`,
+ *    `web-search`) check every request URL and every redirect hop against the
+ *    allowlist. Nothing gets out of those tools to a disallowed host.
+ *
+ * 2. **Defence in depth (bypassable by design)** — {@link extractCommandHosts}
+ *    recognises the common network command shapes (`curl`, `wget`, `git`,
+ *    `ssh`/`scp`, package installs) so `bash` can refuse an obvious egress to a
+ *    disallowed host. It is *not* a sandbox: `python -c`, a shell variable, a
+ *    base64'd URL, or any unrecognised tool walks straight past it. It exists
+ *    to catch accidents, not to contain a hostile model. Real containment needs
+ *    OS-level enforcement (sandbox-exec, Landlock/seccomp, a netns proxy).
+ *
+ * Deliberately allow-shaped, not deny-shaped: a command with no recognised host
+ * is never blocked, so ordinary work is unaffected.
+ */
+/** Host pattern match: exact, or `*.example.com` matching any subdomain. */
+export declare function isHostAllowed(host: string, allow: readonly string[]): boolean;
+/** Hostname of a URL-ish token, or undefined when it isn't one. */
+export declare function hostFromUrl(value: string): string | undefined;
+/**
+ * Best-effort extraction of the hosts a shell command would contact.
+ * Returns an empty array when nothing recognisable is found — never guesses.
+ */
+export declare function extractCommandHosts(command: string): string[];
+/**
+ * Check a shell command against the allowlist.
+ * @returns an error string when a recognised host is disallowed, else null.
+ */
+export declare function checkCommandNetwork(command: string, mode: "off" | "allowlist", allow: readonly string[]): string | null;
+/** Check a URL the agent is about to fetch (or a redirect target). */
+export declare function checkUrlNetwork(url: string, mode: "off" | "allowlist", allow: readonly string[]): string | null;
+/** Resolved egress policy, read lazily so a settings change applies live. */
+export interface NetworkPolicy {
+    mode: "off" | "allowlist";
+    allow: readonly string[];
+}
+export type GetNetworkPolicy = () => NetworkPolicy | undefined;
+/** Check a URL against a possibly-absent policy. */
+export declare function checkUrlPolicy(url: string, getPolicy?: GetNetworkPolicy): string | null;
+/** Check a shell command against a possibly-absent policy. */
+export declare function checkCommandPolicy(command: string, getPolicy?: GetNetworkPolicy): string | null;
+//# sourceMappingURL=network-guard.d.ts.map

package/dist/core/network-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-guard.d.ts","sourceRoot":"","sources":["../../src/core/network-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAc7E;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ7D;AA0CD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAoE7D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,KAAK,GAAG,WAAW,EACzB,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,MAAM,GAAG,IAAI,CAUf;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,KAAK,GAAG,WAAW,EACzB,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,MAAM,GAAG,IAAI,CAUf;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,KAAK,GAAG,WAAW,CAAC;IAC1B,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,aAAa,GAAG,SAAS,CAAC;AAE/D,oDAAoD;AACpD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAIvF;AAED,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAI/F"}

package/dist/core/network-guard.js

@@ -0,0 +1,208 @@
+/**
+ * Network egress allowlist.
+ *
+ * Two layers, with very different strength:
+ *
+ * 1. **Real enforcement** — the agent's own egress paths (`web-fetch`,
+ *    `web-search`) check every request URL and every redirect hop against the
+ *    allowlist. Nothing gets out of those tools to a disallowed host.
+ *
+ * 2. **Defence in depth (bypassable by design)** — {@link extractCommandHosts}
+ *    recognises the common network command shapes (`curl`, `wget`, `git`,
+ *    `ssh`/`scp`, package installs) so `bash` can refuse an obvious egress to a
+ *    disallowed host. It is *not* a sandbox: `python -c`, a shell variable, a
+ *    base64'd URL, or any unrecognised tool walks straight past it. It exists
+ *    to catch accidents, not to contain a hostile model. Real containment needs
+ *    OS-level enforcement (sandbox-exec, Landlock/seccomp, a netns proxy).
+ *
+ * Deliberately allow-shaped, not deny-shaped: a command with no recognised host
+ * is never blocked, so ordinary work is unaffected.
+ */
+/** Host pattern match: exact, or `*.example.com` matching any subdomain. */
+export function isHostAllowed(host, allow) {
+    const target = host.trim().toLowerCase().replace(/\.$/, "");
+    if (!target)
+        return false;
+    for (const raw of allow) {
+        const pattern = raw.trim().toLowerCase().replace(/\.$/, "");
+        if (!pattern)
+            continue;
+        if (pattern.startsWith("*.")) {
+            const suffix = pattern.slice(1); // ".example.com"
+            if (target.endsWith(suffix) && target.length > suffix.length)
+                return true;
+            continue;
+        }
+        if (target === pattern)
+            return true;
+    }
+    return false;
+}
+/** Hostname of a URL-ish token, or undefined when it isn't one. */
+export function hostFromUrl(value) {
+    const candidate = /^[a-z][a-z0-9+.-]*:\/\//i.test(value) ? value : `https://${value}`;
+    try {
+        const host = new URL(candidate).hostname.toLowerCase();
+        return host || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Default registry hosts for package managers that install from the network. */
+const REGISTRY_HOSTS = {
+    npm: "registry.npmjs.org",
+    pnpm: "registry.npmjs.org",
+    yarn: "registry.yarnpkg.com",
+    bun: "registry.npmjs.org",
+    pip: "pypi.org",
+    pip3: "pypi.org",
+};
+const INSTALL_SUBCOMMANDS = new Set(["install", "i", "add", "ci", "update", "upgrade", "dlx", "x"]);
+const GIT_NETWORK_SUBCOMMANDS = new Set(["clone", "fetch", "pull", "push", "ls-remote"]);
+function stripQuotes(token) {
+    const trimmed = token.trim();
+    if (trimmed.length >= 2 &&
+        ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+            (trimmed.startsWith("'") && trimmed.endsWith("'")))) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed;
+}
+/**
+ * Host part of an `scp`/`ssh` target: `[user@]host[:path]`.
+ * `requireRemoteMarker` distinguishes `scp file.txt host:/tmp` (only the second
+ * token is remote) from `ssh host` (a bare host is the target).
+ */
+function hostFromSshTarget(token, requireRemoteMarker = false) {
+    if (requireRemoteMarker && !token.includes("@") && !token.includes(":"))
+        return undefined;
+    const withoutUser = token.includes("@") ? token.slice(token.lastIndexOf("@") + 1) : token;
+    const host = withoutUser.split(":")[0];
+    if (!host || host.startsWith("-") || !/^[a-z0-9._-]+$/i.test(host))
+        return undefined;
+    // A bare local path (`./dir`, `dir`) has no dots-as-domain shape.
+    if (!host.includes(".") && host !== "localhost")
+        return undefined;
+    return host.toLowerCase();
+}
+/**
+ * Best-effort extraction of the hosts a shell command would contact.
+ * Returns an empty array when nothing recognisable is found — never guesses.
+ */
+export function extractCommandHosts(command) {
+    const hosts = new Set();
+    // Split on shell separators so `cd x && curl https://…` is inspected too.
+    for (const segment of command.split(/(?:&&|\|\||[;|\n])/)) {
+        const tokens = segment
+            .trim()
+            .split(/\s+/)
+            .map(stripQuotes)
+            .filter((t) => t.length > 0);
+        if (tokens.length === 0)
+            continue;
+        let index = 0;
+        if (tokens[index] === "sudo")
+            index++;
+        const program = (tokens[index] ?? "").split("/").pop() ?? "";
+        const args = tokens.slice(index + 1);
+        if (program === "curl" || program === "wget" || program === "http" || program === "https") {
+            for (const arg of args) {
+                if (arg.startsWith("-"))
+                    continue;
+                const host = /^[a-z][a-z0-9+.-]*:\/\//i.test(arg) ? hostFromUrl(arg) : undefined;
+                if (host)
+                    hosts.add(host);
+            }
+            continue;
+        }
+        if (program === "git") {
+            const sub = args.find((a) => !a.startsWith("-"));
+            if (!sub || !GIT_NETWORK_SUBCOMMANDS.has(sub))
+                continue;
+            for (const arg of args.slice(args.indexOf(sub) + 1)) {
+                if (arg.startsWith("-"))
+                    continue;
+                if (/^[a-z][a-z0-9+.-]*:\/\//i.test(arg)) {
+                    const host = hostFromUrl(arg);
+                    if (host)
+                        hosts.add(host);
+                    continue;
+                }
+                // scp-style remote: git@github.com:owner/repo.git
+                if (arg.includes("@") && arg.includes(":")) {
+                    const host = hostFromSshTarget(arg);
+                    if (host)
+                        hosts.add(host);
+                }
+            }
+            continue;
+        }
+        if (program === "ssh" || program === "scp" || program === "sftp" || program === "rsync") {
+            // Only `ssh`'s first bare operand is a host; file-copy tools mark the
+            // remote side with `user@` or `host:path`.
+            const requireRemoteMarker = program !== "ssh";
+            for (const arg of args) {
+                if (arg.startsWith("-"))
+                    continue;
+                const host = hostFromSshTarget(arg, requireRemoteMarker);
+                if (host) {
+                    hosts.add(host);
+                    break;
+                }
+            }
+            continue;
+        }
+        const registry = REGISTRY_HOSTS[program];
+        if (registry) {
+            const sub = args.find((a) => !a.startsWith("-"));
+            if (sub && INSTALL_SUBCOMMANDS.has(sub))
+                hosts.add(registry);
+            continue;
+        }
+    }
+    return [...hosts];
+}
+/**
+ * Check a shell command against the allowlist.
+ * @returns an error string when a recognised host is disallowed, else null.
+ */
+export function checkCommandNetwork(command, mode, allow) {
+    if (mode !== "allowlist")
+        return null;
+    const blocked = extractCommandHosts(command).filter((host) => !isHostAllowed(host, allow));
+    if (blocked.length === 0)
+        return null;
+    const allowed = allow.length > 0 ? allow.join(", ") : "(none)";
+    return (`Blocked by the network allowlist: ${blocked.join(", ")}. ` +
+        `Allowed hosts: ${allowed}. Ask the user to add the host to the networkAllow setting, ` +
+        `or accomplish the task without network access.`);
+}
+/** Check a URL the agent is about to fetch (or a redirect target). */
+export function checkUrlNetwork(url, mode, allow) {
+    if (mode !== "allowlist")
+        return null;
+    const host = hostFromUrl(url);
+    if (!host)
+        return `Blocked by the network allowlist: ${url} has no resolvable host.`;
+    if (isHostAllowed(host, allow))
+        return null;
+    const allowed = allow.length > 0 ? allow.join(", ") : "(none)";
+    return (`Blocked by the network allowlist: ${host}. Allowed hosts: ${allowed}. ` +
+        `Ask the user to add the host to the networkAllow setting.`);
+}
+/** Check a URL against a possibly-absent policy. */
+export function checkUrlPolicy(url, getPolicy) {
+    const policy = getPolicy?.();
+    if (!policy)
+        return null;
+    return checkUrlNetwork(url, policy.mode, policy.allow);
+}
+/** Check a shell command against a possibly-absent policy. */
+export function checkCommandPolicy(command, getPolicy) {
+    const policy = getPolicy?.();
+    if (!policy)
+        return null;
+    return checkCommandNetwork(command, policy.mode, policy.allow);
+}
+//# sourceMappingURL=network-guard.js.map

package/dist/core/network-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-guard.js","sourceRoot":"","sources":["../../src/core/network-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAwB;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;YAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAC1E,SAAS;QACX,CAAC;QACD,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACvD,OAAO,IAAI,IAAI,SAAS,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,cAAc,GAA2B;IAC7C,GAAG,EAAE,oBAAoB;IACzB,IAAI,EAAE,oBAAoB;IAC1B,IAAI,EAAE,sBAAsB;IAC5B,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,UAAU;IACf,IAAI,EAAE,UAAU;CACjB,CAAC;AAEF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACpG,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAEzF,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IACE,OAAO,CAAC,MAAM,IAAI,CAAC;QACnB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EACrD,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,KAAa,EAAE,mBAAmB,GAAG,KAAK;IACnE,IAAI,mBAAmB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1F,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrF,kEAAkE;IAClE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,0EAA0E;IAC1E,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,OAAO;aACnB,IAAI,EAAE;aACN,KAAK,CAAC,KAAK,CAAC;aACZ,GAAG,CAAC,WAAW,CAAC;aAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAElC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,KAAK,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAErC,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YAC1F,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAClC,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjF,IAAI,IAAI;oBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACxD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACpD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAClC,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;oBAC9B,IAAI,IAAI;wBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC1B,SAAS;gBACX,CAAC;gBACD,kDAAkD;gBAClD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;oBACpC,IAAI,IAAI;wBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxF,sEAAsE;YACtE,2CAA2C;YAC3C,MAAM,mBAAmB,GAAG,OAAO,KAAK,KAAK,CAAC;YAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAClC,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;gBACzD,IAAI,IAAI,EAAE,CAAC;oBACT,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAChB,MAAM;gBACR,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACjD,IAAI,GAAG,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,IAAyB,EACzB,KAAwB;IAExB,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/D,OAAO,CACL,qCAAqC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC3D,kBAAkB,OAAO,8DAA8D;QACvF,gDAAgD,CACjD,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,IAAyB,EACzB,KAAwB;IAExB,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,qCAAqC,GAAG,0BAA0B,CAAC;IACrF,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/D,OAAO,CACL,qCAAqC,IAAI,oBAAoB,OAAO,IAAI;QACxE,2DAA2D,CAC5D,CAAC;AACJ,CAAC;AAUD,oDAAoD;AACpD,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,SAA4B;IACtE,MAAM,MAAM,GAAG,SAAS,EAAE,EAAE,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,SAA4B;IAC9E,MAAM,MAAM,GAAG,SAAS,EAAE,EAAE,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}

package/dist/core/network-guard.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=network-guard.test.d.ts.map

package/dist/core/network-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-guard.test.d.ts","sourceRoot":"","sources":["../../src/core/network-guard.test.ts"],"names":[],"mappings":""}

package/dist/core/network-guard.test.js

@@ -0,0 +1,72 @@
+import { describe, expect, it } from "vitest";
+import { checkCommandNetwork, checkUrlNetwork, extractCommandHosts, isHostAllowed, } from "./network-guard.js";
+describe("isHostAllowed", () => {
+    it("matches exact hosts case-insensitively", () => {
+        expect(isHostAllowed("GitHub.com", ["github.com"])).toBe(true);
+        expect(isHostAllowed("github.com", ["GITHUB.COM"])).toBe(true);
+        expect(isHostAllowed("gitlab.com", ["github.com"])).toBe(false);
+    });
+    it("matches a leading *. wildcard against subdomains only", () => {
+        expect(isHostAllowed("api.github.com", ["*.github.com"])).toBe(true);
+        expect(isHostAllowed("a.b.github.com", ["*.github.com"])).toBe(true);
+        expect(isHostAllowed("github.com", ["*.github.com"])).toBe(false);
+        expect(isHostAllowed("evilgithub.com", ["*.github.com"])).toBe(false);
+    });
+    it("rejects everything against an empty allowlist", () => {
+        expect(isHostAllowed("github.com", [])).toBe(false);
+        expect(isHostAllowed("", ["github.com"])).toBe(false);
+    });
+});
+describe("extractCommandHosts", () => {
+    it.each([
+        ["curl -sSL https://example.com/x.sh", ["example.com"]],
+        ["wget https://files.example.org/a.tar.gz -O a.tgz", ["files.example.org"]],
+        ["git clone https://github.com/owner/repo.git", ["github.com"]],
+        ["git clone git@gitlab.com:owner/repo.git", ["gitlab.com"]],
+        ["git push origin main", []],
+        ["ssh deploy@prod.example.com 'uptime'", ["prod.example.com"]],
+        ["scp file.txt deploy@prod.example.com:/tmp", ["prod.example.com"]],
+        ["npm install left-pad", ["registry.npmjs.org"]],
+        ["pnpm add -D vitest", ["registry.npmjs.org"]],
+        ["yarn add react", ["registry.yarnpkg.com"]],
+        ["pip install requests", ["pypi.org"]],
+        ["cd repo && curl https://api.example.com/v1", ["api.example.com"]],
+    ])("extracts hosts from %s", (command, expected) => {
+        expect(extractCommandHosts(command).sort()).toEqual(expected.sort());
+    });
+    it.each([
+        "ls -la",
+        "npm run build",
+        "git status",
+        "git commit -m 'curl https://example.com'",
+        "echo hello",
+        "python3 script.py",
+        "rm -rf node_modules",
+    ])("finds no host in %s (no false blocks)", (command) => {
+        expect(extractCommandHosts(command)).toEqual([]);
+    });
+});
+describe("checkCommandNetwork", () => {
+    it("is a total no-op when the mode is off", () => {
+        expect(checkCommandNetwork("curl https://evil.example", "off", [])).toBeNull();
+    });
+    it("blocks a disallowed host and names the setting", () => {
+        const error = checkCommandNetwork("curl https://evil.example/x", "allowlist", ["github.com"]);
+        expect(error).toContain("evil.example");
+        expect(error).toContain("networkAllow");
+    });
+    it("allows an allow-listed host and unrecognised commands", () => {
+        expect(checkCommandNetwork("git clone https://github.com/o/r.git", "allowlist", ["github.com"])).toBeNull();
+        expect(checkCommandNetwork("make build", "allowlist", [])).toBeNull();
+    });
+});
+describe("checkUrlNetwork", () => {
+    it("is a total no-op when the mode is off", () => {
+        expect(checkUrlNetwork("https://evil.example", "off", [])).toBeNull();
+    });
+    it("enforces the allowlist on a URL", () => {
+        expect(checkUrlNetwork("https://api.github.com/x", "allowlist", ["*.github.com"])).toBeNull();
+        expect(checkUrlNetwork("https://evil.example/x", "allowlist", ["*.github.com"])).toContain("evil.example");
+    });
+});
+//# sourceMappingURL=network-guard.test.js.map

package/dist/core/network-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-guard.test.js","sourceRoot":"","sources":["../../src/core/network-guard.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,aAAa,CAAC,gBAAgB,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,aAAa,CAAC,gBAAgB,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,aAAa,CAAC,gBAAgB,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,IAAI,CAAqB;QAC1B,CAAC,oCAAoC,EAAE,CAAC,aAAa,CAAC,CAAC;QACvD,CAAC,kDAAkD,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC3E,CAAC,6CAA6C,EAAE,CAAC,YAAY,CAAC,CAAC;QAC/D,CAAC,yCAAyC,EAAE,CAAC,YAAY,CAAC,CAAC;QAC3D,CAAC,sBAAsB,EAAE,EAAE,CAAC;QAC5B,CAAC,sCAAsC,EAAE,CAAC,kBAAkB,CAAC,CAAC;QAC9D,CAAC,2CAA2C,EAAE,CAAC,kBAAkB,CAAC,CAAC;QACnE,CAAC,sBAAsB,EAAE,CAAC,oBAAoB,CAAC,CAAC;QAChD,CAAC,oBAAoB,EAAE,CAAC,oBAAoB,CAAC,CAAC;QAC9C,CAAC,gBAAgB,EAAE,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC,sBAAsB,EAAE,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC,4CAA4C,EAAE,CAAC,iBAAiB,CAAC,CAAC;KACpE,CAAC,CAAC,wBAAwB,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACjD,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,QAAQ;QACR,eAAe;QACf,YAAY;QACZ,0CAA0C;QAC1C,YAAY;QACZ,mBAAmB;QACnB,qBAAqB;KACtB,CAAC,CAAC,uCAAuC,EAAE,CAAC,OAAO,EAAE,EAAE;QACtD,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,mBAAmB,CAAC,2BAA2B,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,KAAK,GAAG,mBAAmB,CAAC,6BAA6B,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CACJ,mBAAmB,CAAC,sCAAsC,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CACzF,CAAC,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,mBAAmB,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,eAAe,CAAC,sBAAsB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,eAAe,CAAC,0BAA0B,EAAE,WAAW,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9F,MAAM,CAAC,eAAe,CAAC,wBAAwB,EAAE,WAAW,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CACxF,cAAc,CACf,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/core/persistent-shell.d.ts

@@ -1,3 +1,4 @@
+import { type ResolveShellOpts } from "./shell.js";
 export interface PersistentRunResult {
     exitCode: number | "TIMEOUT";
     output: string;
@@ -6,10 +7,11 @@ export declare class PersistentShell {
     private readonly cwd;
     private readonly env;
     private readonly maxOutputBytes;
+    private readonly shellOpts?;
     private child;
     private buffer;
     private busy;
-    constructor(cwd: string, env: NodeJS.ProcessEnv, maxOutputBytes: number);
+    constructor(cwd: string, env: NodeJS.ProcessEnv, maxOutputBytes: number, shellOpts?: ResolveShellOpts | undefined);
     /** True while a previous persistent command is still running. */
     get isBusy(): boolean;
     private ensureChild;

package/dist/core/persistent-shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"persistent-shell.d.ts","sourceRoot":"","sources":["../../src/core/persistent-shell.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,eAAe;IAMxB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAPjC,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,IAAI,CAAS;gBAGF,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,cAAc,EAAE,MAAM;IAGzC,iEAAiE;IACjE,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,OAAO,CAAC,WAAW;IAkBnB;;;;;;OAMG;IACH,GAAG,CACD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC/B,OAAO,CAAC,mBAAmB,CAAC;IAgG/B,iEAAiE;IACjE,IAAI,IAAI,IAAI;CAKb"}
+{"version":3,"file":"persistent-shell.d.ts","sourceRoot":"","sources":["../../src/core/persistent-shell.ts"],"names":[],"mappings":"AAaA,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,eAAe;IAMxB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAR7B,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,IAAI,CAAS;gBAGF,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,cAAc,EAAE,MAAM,EACtB,SAAS,CAAC,EAAE,gBAAgB,YAAA;IAG/C,iEAAiE;IACjE,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,OAAO,CAAC,WAAW;IAyBnB;;;;;;OAMG;IACH,GAAG,CACD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC/B,OAAO,CAAC,mBAAmB,CAAC;IAgG/B,iEAAiE;IACjE,IAAI,IAAI,IAAI;CAKb"}

package/dist/core/persistent-shell.js

@@ -11,18 +11,21 @@
  */
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
+import { resolveShell } from "./shell.js";
 import { killProcessTree } from "../utils/process.js";
 export class PersistentShell {
     cwd;
     env;
     maxOutputBytes;
+    shellOpts;
     child = null;
     buffer = "";
     busy = false;
-    constructor(cwd, env, maxOutputBytes) {
+    constructor(cwd, env, maxOutputBytes, shellOpts) {
         this.cwd = cwd;
         this.env = env;
         this.maxOutputBytes = maxOutputBytes;
+        this.shellOpts = shellOpts;
     }
     /** True while a previous persistent command is still running. */
     get isBusy() {
@@ -33,11 +36,18 @@ export class PersistentShell {
             return this.child;
         }
         // Fresh session: no rc files so startup is fast and deterministic.
-        const child = spawn("bash", ["--norc", "--noprofile"], {
+        //
+        // Spawn the SAME bash the one-shot path resolved, not a bare `bash`: on
+        // Windows the caller only reaches persist mode when Git Bash was found,
+        // but Git for Windows puts `cmd\` on PATH and `bash.exe` in `bin\` — so a
+        // bare `bash` spawn is ENOENT and every persist-mode command failed.
+        const child = spawn(resolveShell("", this.shellOpts).file, ["--norc", "--noprofile"], {
             cwd: this.cwd,
             stdio: ["pipe", "pipe", "pipe"],
             env: this.env,
-            detached: true,
+            // Windows has no process groups; `detached` there only orphans the shell
+            // past a parent crash instead of grouping it for a clean tree-kill.
+            detached: process.platform !== "win32",
         });
         // Don't let a lingering session shell keep the parent process alive.
         child.unref();

package/dist/core/persistent-shell.js.map

@@ -1 +1 @@
-{"version":3,"file":"persistent-shell.js","sourceRoot":"","sources":["../../src/core/persistent-shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAOtD,MAAM,OAAO,eAAe;IAMP;IACA;IACA;IAPX,KAAK,GAAwB,IAAI,CAAC;IAClC,MAAM,GAAG,EAAE,CAAC;IACZ,IAAI,GAAG,KAAK,CAAC;IAErB,YACmB,GAAW,EACX,GAAsB,EACtB,cAAsB;QAFtB,QAAG,GAAH,GAAG,CAAQ;QACX,QAAG,GAAH,GAAG,CAAmB;QACtB,mBAAc,GAAd,cAAc,CAAQ;IACtC,CAAC;IAEJ,iEAAiE;IACjE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEO,WAAW;QACjB,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,mEAAmE;QACnE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE;YACrD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,qEAAqE;QACrE,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CACD,OAAe,EACf,SAAiB,EACjB,MAAmB,EACnB,OAAgC;QAEhC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,kDAAkD;aAC3D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,YAAY,UAAU,EAAE,IAAI,CAAC;QAC9C,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,OAAO,GAAG,KAAK,OAAO,yBAAyB,QAAQ,OAAO,CAAC;QAErE,OAAO,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,EAAE;YAClD,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,IAAI,GAAG,KAAK,CAAC;YAEjB,MAAM,MAAM,GAAG,CAAC,MAA2B,EAAQ,EAAE;gBACnD,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,GAAG,IAAI,CAAC;gBACZ,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAClC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAClC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC1B,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;gBAClB,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC;YAEF,yEAAyE;YACzE,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,UAAmB,EAAQ,EAAE;gBAChE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,GAAG,KAAK,CAAC,CAAC;oBAAE,OAAO;gBACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACnD,MAAM,CAAC;oBACL,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;oBACvC,MAAM,EACJ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;wBACvB,CAAC,UAAU,CAAC,CAAC,CAAC,uBAAuB,IAAI,CAAC,cAAc,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1E,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAQ,EAAE;gBACjC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACjC,IAAI,MAAM,EAAE,CAAC;oBACX,QAAQ,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC5D,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBACD,GAAG,IAAI,IAAI,CAAC;gBACZ,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;oBACrC,MAAM,GAAG,IAAI,CAAC;oBACd,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC9C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC1C,CAAC;gBACD,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;gBAChB,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACjD,CAAC,CAAC;YAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,CAAC,EAAE,SAAS,CAAC,CAAC;YAEd,MAAM,OAAO,GAAG,GAAS,EAAE;gBACzB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,CAAC,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAE1D,qEAAqE;YACrE,yEAAyE;YACzE,0BAA0B;YAC1B,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAQ,EAAE;gBAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;gBAClB,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YAClE,CAAC,CAAC;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAEzB,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAC5F,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE3B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACjC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG;YAAE,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;IACpB,CAAC;CACF"}
+{"version":3,"file":"persistent-shell.js","sourceRoot":"","sources":["../../src/core/persistent-shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAyB,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAOtD,MAAM,OAAO,eAAe;IAMP;IACA;IACA;IACA;IARX,KAAK,GAAwB,IAAI,CAAC;IAClC,MAAM,GAAG,EAAE,CAAC;IACZ,IAAI,GAAG,KAAK,CAAC;IAErB,YACmB,GAAW,EACX,GAAsB,EACtB,cAAsB,EACtB,SAA4B;QAH5B,QAAG,GAAH,GAAG,CAAQ;QACX,QAAG,GAAH,GAAG,CAAmB;QACtB,mBAAc,GAAd,cAAc,CAAQ;QACtB,cAAS,GAAT,SAAS,CAAmB;IAC5C,CAAC;IAEJ,iEAAiE;IACjE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEO,WAAW;QACjB,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,mEAAmE;QACnE,EAAE;QACF,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE;YACpF,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,yEAAyE;YACzE,oEAAoE;YACpE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACvC,CAAC,CAAC;QACH,qEAAqE;QACrE,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CACD,OAAe,EACf,SAAiB,EACjB,MAAmB,EACnB,OAAgC;QAEhC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,kDAAkD;aAC3D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,YAAY,UAAU,EAAE,IAAI,CAAC;QAC9C,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,OAAO,GAAG,KAAK,OAAO,yBAAyB,QAAQ,OAAO,CAAC;QAErE,OAAO,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,EAAE;YAClD,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,IAAI,GAAG,KAAK,CAAC;YAEjB,MAAM,MAAM,GAAG,CAAC,MAA2B,EAAQ,EAAE;gBACnD,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,GAAG,IAAI,CAAC;gBACZ,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAClC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAClC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC1B,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;gBAClB,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC;YAEF,yEAAyE;YACzE,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,UAAmB,EAAQ,EAAE;gBAChE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,GAAG,KAAK,CAAC,CAAC;oBAAE,OAAO;gBACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACnD,MAAM,CAAC;oBACL,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;oBACvC,MAAM,EACJ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;wBACvB,CAAC,UAAU,CAAC,CAAC,CAAC,uBAAuB,IAAI,CAAC,cAAc,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1E,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAQ,EAAE;gBACjC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACjC,IAAI,MAAM,EAAE,CAAC;oBACX,QAAQ,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC5D,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBACD,GAAG,IAAI,IAAI,CAAC;gBACZ,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;oBACrC,MAAM,GAAG,IAAI,CAAC;oBACd,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC9C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC1C,CAAC;gBACD,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;gBAChB,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACjD,CAAC,CAAC;YAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,CAAC,EAAE,SAAS,CAAC,CAAC;YAEd,MAAM,OAAO,GAAG,GAAS,EAAE;gBACzB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,CAAC,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAE1D,qEAAqE;YACrE,yEAAyE;YACzE,0BAA0B;YAC1B,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAQ,EAAE;gBAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;gBAClB,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YAClE,CAAC,CAAC;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAEzB,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAC5F,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE3B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACjC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG;YAAE,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;IACpB,CAAC;CACF"}