@probelabs/probe 0.6.0-rc256 → 0.6.0-rc258

package/build/agent/index.js

@@ -11559,191 +11559,102 @@ var init_bashDefaults = __esm({
       "dir",
       "pwd",
       "cd",
-      "cd:*",
       // File reading commands
       "cat",
-      "cat:*",
       "head",
-      "head:*",
       "tail",
-      "tail:*",
       "less",
       "more",
       "view",
       // File information and metadata
       "file",
-      "file:*",
       "stat",
-      "stat:*",
       "wc",
-      "wc:*",
       "du",
-      "du:*",
       "df",
-      "df:*",
       "realpath",
-      "realpath:*",
-      // Search and find commands (read-only) - find restricted to safe operations
+      // Search and find commands (read-only)
+      // Note: bare 'find' allows all find variants; dangerous ones (find -exec) are blocked by deny list
       "find",
-      "find:-name:*",
-      "find:-type:*",
-      "find:-size:*",
-      "find:-mtime:*",
-      "find:-newer:*",
-      "find:-path:*",
-      "find:-iname:*",
-      "find:-maxdepth:*",
-      "find:-mindepth:*",
-      "find:-print",
       "grep",
-      "grep:*",
       "egrep",
-      "egrep:*",
       "fgrep",
-      "fgrep:*",
       "rg",
-      "rg:*",
       "ag",
-      "ag:*",
       "ack",
-      "ack:*",
       "which",
-      "which:*",
       "whereis",
-      "whereis:*",
       "locate",
-      "locate:*",
       "type",
-      "type:*",
       "command",
-      "command:*",
       // Tree and structure visualization
       "tree",
-      "tree:*",
       // Git read-only operations
       "git:status",
-      "git:status:*",
       "git:log",
-      "git:log:*",
       "git:diff",
-      "git:diff:*",
       "git:show",
-      "git:show:*",
       "git:branch",
-      "git:branch:*",
       "git:tag",
-      "git:tag:*",
       "git:describe",
-      "git:describe:*",
       "git:remote",
-      "git:remote:*",
-      "git:config:*",
+      "git:config",
       "git:blame",
-      "git:blame:*",
       "git:shortlog",
-      "git:shortlog:*",
       "git:reflog",
-      "git:reflog:*",
       "git:ls-files",
-      "git:ls-files:*",
       "git:ls-tree",
-      "git:ls-tree:*",
       "git:ls-remote",
-      "git:ls-remote:*",
       "git:rev-parse",
-      "git:rev-parse:*",
       "git:rev-list",
-      "git:rev-list:*",
       "git:cat-file",
-      "git:cat-file:*",
       "git:diff-tree",
-      "git:diff-tree:*",
       "git:diff-files",
-      "git:diff-files:*",
       "git:diff-index",
-      "git:diff-index:*",
       "git:for-each-ref",
-      "git:for-each-ref:*",
       "git:merge-base",
-      "git:merge-base:*",
       "git:name-rev",
-      "git:name-rev:*",
       "git:count-objects",
-      "git:count-objects:*",
       "git:verify-commit",
-      "git:verify-commit:*",
       "git:verify-tag",
-      "git:verify-tag:*",
       "git:check-ignore",
-      "git:check-ignore:*",
       "git:check-attr",
-      "git:check-attr:*",
       "git:stash:list",
       "git:stash:show",
-      "git:stash:show:*",
       "git:worktree:list",
-      "git:worktree:list:*",
       "git:notes:list",
       "git:notes:show",
-      "git:notes:show:*",
       "git:--version",
       "git:help",
-      "git:help:*",
       // GitHub CLI (gh) read-only operations
       "gh:--version",
       "gh:help",
-      "gh:help:*",
       "gh:status",
       "gh:auth:status",
-      "gh:auth:status:*",
       "gh:issue:list",
-      "gh:issue:list:*",
       "gh:issue:view",
-      "gh:issue:view:*",
       "gh:issue:status",
-      "gh:issue:status:*",
       "gh:pr:list",
-      "gh:pr:list:*",
       "gh:pr:view",
-      "gh:pr:view:*",
       "gh:pr:status",
-      "gh:pr:status:*",
       "gh:pr:diff",
-      "gh:pr:diff:*",
       "gh:pr:checks",
-      "gh:pr:checks:*",
       "gh:repo:list",
-      "gh:repo:list:*",
       "gh:repo:view",
-      "gh:repo:view:*",
       "gh:release:list",
-      "gh:release:list:*",
       "gh:release:view",
-      "gh:release:view:*",
       "gh:run:list",
-      "gh:run:list:*",
       "gh:run:view",
-      "gh:run:view:*",
       "gh:workflow:list",
-      "gh:workflow:list:*",
       "gh:workflow:view",
-      "gh:workflow:view:*",
       "gh:gist:list",
-      "gh:gist:list:*",
       "gh:gist:view",
-      "gh:gist:view:*",
       "gh:search:issues",
-      "gh:search:issues:*",
       "gh:search:prs",
-      "gh:search:prs:*",
       "gh:search:repos",
-      "gh:search:repos:*",
       "gh:search:code",
-      "gh:search:code:*",
       "gh:search:commits",
-      "gh:search:commits:*",
       "gh:api",
-      "gh:api:*",
       // Package managers (information only)
       "npm:list",
       "npm:ls",
@@ -11804,7 +11715,6 @@ var init_bashDefaults = __esm({
       "sqlite3:--version",
       // System information
       "uname",
-      "uname:*",
       "hostname",
       "whoami",
       "id",
@@ -11815,23 +11725,17 @@ var init_bashDefaults = __esm({
       "w",
       "users",
       "sleep",
-      "sleep:*",
       // Environment and shell
       "env",
       "printenv",
       "echo",
-      "echo:*",
       "printf",
-      "printf:*",
       "export",
-      "export:*",
       "set",
       "unset",
       // Process information (read-only)
       "ps",
-      "ps:*",
       "pgrep",
-      "pgrep:*",
       "jobs",
       "top:-n:1",
       // Network information (read-only)
@@ -11846,39 +11750,24 @@ var init_bashDefaults = __esm({
       // Text processing and utilities (awk removed - too powerful)
       "sed:-n:*",
       "cut",
-      "cut:*",
       "sort",
-      "sort:*",
       "uniq",
-      "uniq:*",
       "tr",
-      "tr:*",
       "column",
-      "column:*",
       "paste",
-      "paste:*",
       "join",
-      "join:*",
       "comm",
-      "comm:*",
       "diff",
-      "diff:*",
       "cmp",
-      "cmp:*",
       "patch:--dry-run:*",
       // Hashing and encoding (read-only)
       "md5sum",
-      "md5sum:*",
       "sha1sum",
-      "sha1sum:*",
       "sha256sum",
-      "sha256sum:*",
       "base64",
       "base64:-d",
       "od",
-      "od:*",
       "hexdump",
-      "hexdump:*",
       // Archive and compression (list/view only)
       "tar:-tf:*",
       "tar:-tzf:*",
@@ -11888,15 +11777,11 @@ var init_bashDefaults = __esm({
       "gunzip:-l:*",
       // Help and documentation
       "man",
-      "man:*",
       "--help",
       "help",
       "info",
-      "info:*",
       "whatis",
-      "whatis:*",
       "apropos",
-      "apropos:*",
       // Make (dry run and info)
       "make:-n",
       "make:--dry-run",
@@ -11919,36 +11804,30 @@ var init_bashDefaults = __esm({
       "rm:-rf",
       "rm:-f:/",
       "rm:/",
-      "rm:-rf:*",
       "rmdir",
       "chmod:777",
       "chmod:-R:777",
       "chown",
       "chgrp",
       "dd",
-      "dd:*",
       "shred",
-      "shred:*",
       // Dangerous find operations that can execute arbitrary commands
-      "find:-exec:*",
-      "find:*:-exec:*",
-      "find:-execdir:*",
-      "find:*:-execdir:*",
-      "find:-ok:*",
-      "find:*:-ok:*",
-      "find:-okdir:*",
-      "find:*:-okdir:*",
+      "find:-exec",
+      "find:*:-exec",
+      "find:-execdir",
+      "find:*:-execdir",
+      "find:-ok",
+      "find:*:-ok",
+      "find:-okdir",
+      "find:*:-okdir",
       // Powerful scripting tools that can execute arbitrary commands
       "awk",
-      "awk:*",
       "perl",
-      "perl:*",
       "python:-c:*",
       "node:-e:*",
       // System administration and modification
-      "sudo:*",
+      "sudo",
       "su",
-      "su:*",
       "passwd",
       "adduser",
       "useradd",
@@ -11986,11 +11865,11 @@ var init_bashDefaults = __esm({
       "composer:install",
       "composer:update",
       "composer:remove",
-      "apt:*",
-      "apt-get:*",
-      "yum:*",
-      "dnf:*",
-      "zypper:*",
+      "apt",
+      "apt-get",
+      "yum",
+      "dnf",
+      "zypper",
       "brew:install",
       "brew:uninstall",
       "brew:upgrade",
@@ -11998,11 +11877,11 @@ var init_bashDefaults = __esm({
       "conda:remove",
       "conda:update",
       // Service and system control
-      "systemctl:*",
-      "service:*",
-      "chkconfig:*",
-      "initctl:*",
-      "upstart:*",
+      "systemctl",
+      "service",
+      "chkconfig",
+      "initctl",
+      "upstart",
       // Network operations that could be dangerous
       "curl:-d:*",
       "curl:--data:*",
@@ -12011,32 +11890,21 @@ var init_bashDefaults = __esm({
       "wget:-O:/",
       "wget:--post-data:*",
       "ssh",
-      "ssh:*",
       "scp",
-      "scp:*",
       "sftp",
-      "sftp:*",
-      "rsync:*",
+      "rsync",
       "nc",
-      "nc:*",
       "netcat",
-      "netcat:*",
       "telnet",
-      "telnet:*",
       "ftp",
-      "ftp:*",
       // Process control and termination
       "kill",
-      "kill:*",
       "killall",
-      "killall:*",
       "pkill",
-      "pkill:*",
-      "nohup:*",
-      "disown:*",
+      "nohup",
+      "disown",
       // System control and shutdown
       "shutdown",
-      "shutdown:*",
       "reboot",
       "halt",
       "poweroff",
@@ -12044,168 +11912,92 @@ var init_bashDefaults = __esm({
       "telinit",
       // Kernel and module operations
       "insmod",
-      "insmod:*",
       "rmmod",
-      "rmmod:*",
       "modprobe",
-      "modprobe:*",
       "sysctl:-w:*",
       // Dangerous git operations
       "git:push",
-      "git:push:*",
       "git:force",
       "git:reset",
-      "git:reset:*",
       "git:clean",
-      "git:clean:*",
       "git:rm",
-      "git:rm:*",
       "git:commit",
-      "git:commit:*",
       "git:merge",
-      "git:merge:*",
       "git:rebase",
-      "git:rebase:*",
       "git:cherry-pick",
-      "git:cherry-pick:*",
       "git:stash:drop",
-      "git:stash:drop:*",
       "git:stash:pop",
-      "git:stash:pop:*",
       "git:stash:push",
-      "git:stash:push:*",
       "git:stash:clear",
       "git:branch:-d",
-      "git:branch:-d:*",
       "git:branch:-D",
-      "git:branch:-D:*",
       "git:branch:--delete",
-      "git:branch:--delete:*",
       "git:tag:-d",
-      "git:tag:-d:*",
       "git:tag:--delete",
-      "git:tag:--delete:*",
       "git:remote:remove",
-      "git:remote:remove:*",
       "git:remote:rm",
-      "git:remote:rm:*",
       "git:checkout:--force",
-      "git:checkout:--force:*",
       "git:checkout:-f",
-      "git:checkout:-f:*",
       "git:submodule:deinit",
-      "git:submodule:deinit:*",
       "git:notes:add",
-      "git:notes:add:*",
       "git:notes:remove",
-      "git:notes:remove:*",
       "git:worktree:add",
-      "git:worktree:add:*",
       "git:worktree:remove",
-      "git:worktree:remove:*",
       // Dangerous GitHub CLI (gh) write operations
       "gh:issue:create",
-      "gh:issue:create:*",
       "gh:issue:close",
-      "gh:issue:close:*",
       "gh:issue:delete",
-      "gh:issue:delete:*",
       "gh:issue:edit",
-      "gh:issue:edit:*",
       "gh:issue:reopen",
-      "gh:issue:reopen:*",
       "gh:issue:comment",
-      "gh:issue:comment:*",
       "gh:pr:create",
-      "gh:pr:create:*",
       "gh:pr:close",
-      "gh:pr:close:*",
       "gh:pr:merge",
-      "gh:pr:merge:*",
       "gh:pr:edit",
-      "gh:pr:edit:*",
       "gh:pr:reopen",
-      "gh:pr:reopen:*",
       "gh:pr:review",
-      "gh:pr:review:*",
       "gh:pr:comment",
-      "gh:pr:comment:*",
       "gh:repo:create",
-      "gh:repo:create:*",
       "gh:repo:delete",
-      "gh:repo:delete:*",
       "gh:repo:fork",
-      "gh:repo:fork:*",
       "gh:repo:rename",
-      "gh:repo:rename:*",
       "gh:repo:archive",
-      "gh:repo:archive:*",
       "gh:repo:clone",
-      "gh:repo:clone:*",
       "gh:release:create",
-      "gh:release:create:*",
       "gh:release:delete",
-      "gh:release:delete:*",
       "gh:release:edit",
-      "gh:release:edit:*",
       "gh:run:cancel",
-      "gh:run:cancel:*",
       "gh:run:rerun",
-      "gh:run:rerun:*",
       "gh:workflow:run",
-      "gh:workflow:run:*",
       "gh:workflow:enable",
-      "gh:workflow:enable:*",
       "gh:workflow:disable",
-      "gh:workflow:disable:*",
       "gh:gist:create",
-      "gh:gist:create:*",
       "gh:gist:delete",
-      "gh:gist:delete:*",
       "gh:gist:edit",
-      "gh:gist:edit:*",
       "gh:secret:set",
-      "gh:secret:set:*",
       "gh:secret:delete",
-      "gh:secret:delete:*",
       "gh:variable:set",
-      "gh:variable:set:*",
       "gh:variable:delete",
-      "gh:variable:delete:*",
       "gh:label:create",
-      "gh:label:create:*",
       "gh:label:delete",
-      "gh:label:delete:*",
       "gh:ssh-key:add",
-      "gh:ssh-key:add:*",
       "gh:ssh-key:delete",
-      "gh:ssh-key:delete:*",
       // File system mounting and partitioning
       "mount",
-      "mount:*",
       "umount",
-      "umount:*",
       "fdisk",
-      "fdisk:*",
       "parted",
-      "parted:*",
       "mkfs",
-      "mkfs:*",
       "fsck",
-      "fsck:*",
       // Cron and scheduling
       "crontab",
-      "crontab:*",
       "at",
-      "at:*",
       "batch",
-      "batch:*",
       // Compression with potential overwrite
       "tar:-xf:*",
       "unzip",
-      "unzip:*",
-      "gzip:*",
-      "gunzip:*",
+      "gzip",
+      "gunzip",
       // Build and compilation that might modify files
       "make",
       "make:install",
@@ -12218,11 +12010,8 @@ var init_bashDefaults = __esm({
       "gradle:build",
       // Docker operations that could modify state
       "docker:run",
-      "docker:run:*",
       "docker:exec",
-      "docker:exec:*",
       "docker:build",
-      "docker:build:*",
       "docker:pull",
       "docker:push",
       "docker:rm",
@@ -12236,22 +12025,15 @@ var init_bashDefaults = __esm({
       "mongo:--eval:*",
       // Text editors that could modify files
       "vi",
-      "vi:*",
       "vim",
-      "vim:*",
       "nano",
-      "nano:*",
       "emacs",
-      "emacs:*",
       "sed:-i:*",
       "perl:-i:*",
       // Potentially dangerous utilities
       "eval",
-      "eval:*",
       "exec",
-      "exec:*",
       "source",
-      "source:*",
       "bash:-c:*",
       "sh:-c:*",
       "zsh:-c:*"
@@ -12530,9 +12312,19 @@ var init_bashPermissions = __esm({
     BashPermissionChecker = class {
       /**
        * Create a permission checker
+       *
+       * Priority order (highest to lowest):
+       *   1. Custom deny  — always blocks (user explicitly blocked it)
+       *   2. Custom allow — overrides default deny (user explicitly allowed it)
+       *   3. Default deny — blocks by default
+       *   4. Allow list   — allows recognized safe commands
+       *
+       * This means `--bash-allow "git:push"` overrides the default deny for git:push
+       * without requiring `--no-default-bash-deny`.
+       *
        * @param {Object} config - Configuration options
-       * @param {string[]} [config.allow] - Additional allow patterns
-       * @param {string[]} [config.deny] - Additional deny patterns
+       * @param {string[]} [config.allow] - Additional allow patterns (override default deny)
+       * @param {string[]} [config.deny] - Additional deny patterns (always win)
        * @param {boolean} [config.disableDefaultAllow] - Disable default allow list
        * @param {boolean} [config.disableDefaultDeny] - Disable default deny list
        * @param {boolean} [config.debug] - Enable debug logging
@@ -12541,40 +12333,22 @@ var init_bashPermissions = __esm({
       constructor(config = {}) {
         this.debug = config.debug || false;
         this.tracer = config.tracer || null;
-        this.allowPatterns = [];
-        if (!config.disableDefaultAllow) {
-          this.allowPatterns.push(...DEFAULT_ALLOW_PATTERNS);
-          if (this.debug) {
-            console.log(`[BashPermissions] Added ${DEFAULT_ALLOW_PATTERNS.length} default allow patterns`);
-          }
-        }
-        if (config.allow && Array.isArray(config.allow)) {
-          this.allowPatterns.push(...config.allow);
-          if (this.debug) {
-            console.log(`[BashPermissions] Added ${config.allow.length} custom allow patterns:`, config.allow);
-          }
-        }
-        this.denyPatterns = [];
-        if (!config.disableDefaultDeny) {
-          this.denyPatterns.push(...DEFAULT_DENY_PATTERNS);
-          if (this.debug) {
-            console.log(`[BashPermissions] Added ${DEFAULT_DENY_PATTERNS.length} default deny patterns`);
-          }
-        }
-        if (config.deny && Array.isArray(config.deny)) {
-          this.denyPatterns.push(...config.deny);
-          if (this.debug) {
-            console.log(`[BashPermissions] Added ${config.deny.length} custom deny patterns:`, config.deny);
-          }
-        }
+        this.defaultAllowPatterns = config.disableDefaultAllow ? [] : [...DEFAULT_ALLOW_PATTERNS];
+        this.customAllowPatterns = config.allow && Array.isArray(config.allow) ? [...config.allow] : [];
+        this.allowPatterns = [...this.defaultAllowPatterns, ...this.customAllowPatterns];
+        this.defaultDenyPatterns = config.disableDefaultDeny ? [] : [...DEFAULT_DENY_PATTERNS];
+        this.customDenyPatterns = config.deny && Array.isArray(config.deny) ? [...config.deny] : [];
+        this.denyPatterns = [...this.defaultDenyPatterns, ...this.customDenyPatterns];
         if (this.debug) {
+          console.log(`[BashPermissions] Default allow: ${this.defaultAllowPatterns.length}, Custom allow: ${this.customAllowPatterns.length}`);
+          console.log(`[BashPermissions] Default deny: ${this.defaultDenyPatterns.length}, Custom deny: ${this.customDenyPatterns.length}`);
           console.log(`[BashPermissions] Total patterns - Allow: ${this.allowPatterns.length}, Deny: ${this.denyPatterns.length}`);
         }
         this.recordBashEvent("permissions.initialized", {
           allowPatternCount: this.allowPatterns.length,
           denyPatternCount: this.denyPatterns.length,
-          hasCustomAllowPatterns: !!(config.allow && config.allow.length > 0),
-          hasCustomDenyPatterns: !!(config.deny && config.deny.length > 0),
+          hasCustomAllowPatterns: this.customAllowPatterns.length > 0,
+          hasCustomDenyPatterns: this.customDenyPatterns.length > 0,
           disableDefaultAllow: !!config.disableDefaultAllow,
           disableDefaultDeny: !!config.disableDefaultDeny
         });
@@ -12644,8 +12418,11 @@ var init_bashPermissions = __esm({
           console.log(`[BashPermissions] Checking simple command: "${command}"`);
           console.log(`[BashPermissions] Parsed: ${parsed.command} with args: [${parsed.args.join(", ")}]`);
         }
-        if (matchesAnyPattern(parsed, this.denyPatterns)) {
-          const matchedPatterns = this.denyPatterns.filter((pattern) => matchesPattern(parsed, pattern));
+        if (matchesAnyPattern(parsed, this.customDenyPatterns)) {
+          const matchedPatterns = this.customDenyPatterns.filter((pattern) => matchesPattern(parsed, pattern));
+          if (this.debug) {
+            console.log(`[BashPermissions] DENIED - matches custom deny pattern: ${matchedPatterns[0]}`);
+          }
           const result2 = {
             allowed: false,
             reason: `Command matches deny pattern: ${matchedPatterns[0]}`,
@@ -12658,7 +12435,31 @@ var init_bashPermissions = __esm({
             parsedCommand: parsed.command,
             reason: "matches_deny_pattern",
             matchedPattern: matchedPatterns[0],
-            isComplex: false
+            isComplex: false,
+            isCustomDeny: true
+          });
+          return result2;
+        }
+        const matchesCustomAllow = matchesAnyPattern(parsed, this.customAllowPatterns);
+        if (!matchesCustomAllow && matchesAnyPattern(parsed, this.defaultDenyPatterns)) {
+          const matchedPatterns = this.defaultDenyPatterns.filter((pattern) => matchesPattern(parsed, pattern));
+          if (this.debug) {
+            console.log(`[BashPermissions] DENIED - matches default deny pattern: ${matchedPatterns[0]}`);
+          }
+          const result2 = {
+            allowed: false,
+            reason: `Command matches deny pattern: ${matchedPatterns[0]}`,
+            command,
+            parsed,
+            matchedPatterns
+          };
+          this.recordBashEvent("permission.denied", {
+            command,
+            parsedCommand: parsed.command,
+            reason: "matches_deny_pattern",
+            matchedPattern: matchedPatterns[0],
+            isComplex: false,
+            isCustomDeny: false
           });
           return result2;
         }
@@ -12683,15 +12484,21 @@ var init_bashPermissions = __esm({
           allowed: true,
           command,
           parsed,
-          isComplex: false
+          isComplex: false,
+          overriddenDeny: matchesCustomAllow && matchesAnyPattern(parsed, this.defaultDenyPatterns)
         };
         if (this.debug) {
-          console.log(`[BashPermissions] ALLOWED - command passed all checks`);
+          if (result.overriddenDeny) {
+            console.log(`[BashPermissions] ALLOWED - custom allow overrides default deny`);
+          } else {
+            console.log(`[BashPermissions] ALLOWED - command passed all checks`);
+          }
         }
         this.recordBashEvent("permission.allowed", {
           command,
           parsedCommand: parsed.command,
-          isComplex: false
+          isComplex: false,
+          overriddenDeny: result.overriddenDeny || false
         });
         return result;
       }
@@ -12860,9 +12667,19 @@ var init_bashPermissions = __esm({
               deniedReason = parsed.error || "Component contains nested complex constructs";
               break;
             }
-            if (matchesAnyPattern(parsed, this.denyPatterns)) {
+            if (matchesAnyPattern(parsed, this.customDenyPatterns)) {
               if (this.debug) {
-                console.log(`[BashPermissions] Component "${component}" matches deny pattern`);
+                console.log(`[BashPermissions] Component "${component}" matches custom deny pattern`);
+              }
+              allAllowed = false;
+              deniedComponent = component;
+              deniedReason = "Component matches deny pattern";
+              break;
+            }
+            const componentMatchesCustomAllow = matchesAnyPattern(parsed, this.customAllowPatterns);
+            if (!componentMatchesCustomAllow && matchesAnyPattern(parsed, this.defaultDenyPatterns)) {
+              if (this.debug) {
+                console.log(`[BashPermissions] Component "${component}" matches default deny pattern`);
               }
               allAllowed = false;
               deniedComponent = component;
@@ -12942,6 +12759,10 @@ var init_bashPermissions = __esm({
         return {
           allowPatterns: this.allowPatterns.length,
           denyPatterns: this.denyPatterns.length,
+          customAllowPatterns: this.customAllowPatterns.length,
+          customDenyPatterns: this.customDenyPatterns.length,
+          defaultAllowPatterns: this.defaultAllowPatterns.length,
+          defaultDenyPatterns: this.defaultDenyPatterns.length,
           totalPatterns: this.allowPatterns.length + this.denyPatterns.length
         };
       }
@@ -13323,8 +13144,8 @@ Common reasons:
 2. The command is not in the allow list (not a recognized safe command)
 
 If you believe this command should be allowed, you can:
-- Use the --bash-allow option to add specific patterns
-- Use the --no-default-bash-deny flag to remove default restrictions (not recommended)
+- Use the --bash-allow option to add specific patterns (overrides default deny list)
+  Example: --bash-allow "git:push" allows git push while keeping all other deny rules
 
 For code exploration, try these safe alternatives:
 - ls, cat, head, tail for file operations
@@ -23679,13 +23500,39 @@ var init_unescape = __esm({
 });
 
 // node_modules/minimatch/dist/esm/ast.js
-var types2, isExtglobType, startNoTraversal, startNoDot, addPatternStart, justDots, reSpecials, regExpEscape, qmark, star, starNoEmpty, AST;
+var _a, types2, isExtglobType, isExtglobAST, adoptionMap, adoptionWithSpaceMap, adoptionAnyMap, usurpMap, startNoTraversal, startNoDot, addPatternStart, justDots, reSpecials, regExpEscape, qmark, star, starNoEmpty, AST;
 var init_ast = __esm({
   "node_modules/minimatch/dist/esm/ast.js"() {
     init_brace_expressions();
     init_unescape();
     types2 = /* @__PURE__ */ new Set(["!", "?", "+", "*", "@"]);
     isExtglobType = (c) => types2.has(c);
+    isExtglobAST = (c) => isExtglobType(c.type);
+    adoptionMap = /* @__PURE__ */ new Map([
+      ["!", ["@"]],
+      ["?", ["?", "@"]],
+      ["@", ["@"]],
+      ["*", ["*", "+", "?", "@"]],
+      ["+", ["+", "@"]]
+    ]);
+    adoptionWithSpaceMap = /* @__PURE__ */ new Map([
+      ["!", ["?"]],
+      ["@", ["?"]],
+      ["+", ["?", "*"]]
+    ]);
+    adoptionAnyMap = /* @__PURE__ */ new Map([
+      ["!", ["?", "@"]],
+      ["?", ["?", "@"]],
+      ["@", ["?", "@"]],
+      ["*", ["*", "+", "?", "@"]],
+      ["+", ["+", "@", "?", "*"]]
+    ]);
+    usurpMap = /* @__PURE__ */ new Map([
+      ["!", /* @__PURE__ */ new Map([["!", "@"]])],
+      ["?", /* @__PURE__ */ new Map([["*", "*"], ["+", "*"]])],
+      ["@", /* @__PURE__ */ new Map([["!", "!"], ["?", "?"], ["@", "@"], ["*", "*"], ["+", "+"]])],
+      ["+", /* @__PURE__ */ new Map([["?", "*"], ["*", "*"]])]
+    ]);
     startNoTraversal = "(?!(?:^|/)\\.\\.?(?:$|/))";
     startNoDot = "(?!\\.)";
     addPatternStart = /* @__PURE__ */ new Set(["[", "."]);
@@ -23695,7 +23542,7 @@ var init_ast = __esm({
     qmark = "[^/]";
     star = qmark + "*?";
     starNoEmpty = qmark + "+?";
-    AST = class _AST {
+    AST = class {
       type;
       #root;
       #hasMagic;
@@ -23775,7 +23622,7 @@ var init_ast = __esm({
         for (const p of parts) {
           if (p === "")
             continue;
-          if (typeof p !== "string" && !(p instanceof _AST && p.#parent === this)) {
+          if (typeof p !== "string" && !(p instanceof _a && p.#parent === this)) {
             throw new Error("invalid part: " + p);
           }
           this.#parts.push(p);
@@ -23800,7 +23647,7 @@ var init_ast = __esm({
         const p = this.#parent;
         for (let i = 0; i < this.#parentIndex; i++) {
           const pp2 = p.#parts[i];
-          if (!(pp2 instanceof _AST && pp2.type === "!")) {
+          if (!(pp2 instanceof _a && pp2.type === "!")) {
             return false;
           }
         }
@@ -23825,13 +23672,14 @@ var init_ast = __esm({
           this.push(part.clone(this));
       }
       clone(parent) {
-        const c = new _AST(this.type, parent);
+        const c = new _a(this.type, parent);
         for (const p of this.#parts) {
           c.copyIn(p);
         }
         return c;
       }
-      static #parseAST(str, ast, pos, opt) {
+      static #parseAST(str, ast, pos, opt, extDepth) {
+        const maxDepth = opt.maxExtglobRecursion ?? 2;
         let escaping = false;
         let inBrace = false;
         let braceStart = -1;
@@ -23863,11 +23711,12 @@ var init_ast = __esm({
               acc2 += c;
               continue;
             }
-            if (!opt.noext && isExtglobType(c) && str.charAt(i2) === "(") {
+            const doRecurse = !opt.noext && isExtglobType(c) && str.charAt(i2) === "(" && extDepth <= maxDepth;
+            if (doRecurse) {
               ast.push(acc2);
               acc2 = "";
-              const ext2 = new _AST(c, ast);
-              i2 = _AST.#parseAST(str, ext2, i2, opt);
+              const ext2 = new _a(c, ast);
+              i2 = _a.#parseAST(str, ext2, i2, opt, extDepth + 1);
               ast.push(ext2);
               continue;
             }
@@ -23877,7 +23726,7 @@ var init_ast = __esm({
           return i2;
         }
         let i = pos + 1;
-        let part = new _AST(null, ast);
+        let part = new _a(null, ast);
         const parts = [];
         let acc = "";
         while (i < str.length) {
@@ -23904,19 +23753,22 @@ var init_ast = __esm({
             acc += c;
             continue;
           }
-          if (isExtglobType(c) && str.charAt(i) === "(") {
+          const doRecurse = isExtglobType(c) && str.charAt(i) === "(" && /* c8 ignore start - the maxDepth is sufficient here */
+          (extDepth <= maxDepth || ast && ast.#canAdoptType(c));
+          if (doRecurse) {
+            const depthAdd = ast && ast.#canAdoptType(c) ? 0 : 1;
             part.push(acc);
             acc = "";
-            const ext2 = new _AST(c, part);
+            const ext2 = new _a(c, part);
             part.push(ext2);
-            i = _AST.#parseAST(str, ext2, i, opt);
+            i = _a.#parseAST(str, ext2, i, opt, extDepth + depthAdd);
             continue;
           }
           if (c === "|") {
             part.push(acc);
             acc = "";
             parts.push(part);
-            part = new _AST(null, ast);
+            part = new _a(null, ast);
             continue;
           }
           if (c === ")") {
@@ -23935,9 +23787,101 @@ var init_ast = __esm({
         ast.#parts = [str.substring(pos - 1)];
         return i;
       }
+      #canAdoptWithSpace(child) {
+        return this.#canAdopt(child, adoptionWithSpaceMap);
+      }
+      #canAdopt(child, map2 = adoptionMap) {
+        if (!child || typeof child !== "object" || child.type !== null || child.#parts.length !== 1 || this.type === null) {
+          return false;
+        }
+        const gc = child.#parts[0];
+        if (!gc || typeof gc !== "object" || gc.type === null) {
+          return false;
+        }
+        return this.#canAdoptType(gc.type, map2);
+      }
+      #canAdoptType(c, map2 = adoptionAnyMap) {
+        return !!map2.get(this.type)?.includes(c);
+      }
+      #adoptWithSpace(child, index) {
+        const gc = child.#parts[0];
+        const blank = new _a(null, gc, this.options);
+        blank.#parts.push("");
+        gc.push(blank);
+        this.#adopt(child, index);
+      }
+      #adopt(child, index) {
+        const gc = child.#parts[0];
+        this.#parts.splice(index, 1, ...gc.#parts);
+        for (const p of gc.#parts) {
+          if (typeof p === "object")
+            p.#parent = this;
+        }
+        this.#toString = void 0;
+      }
+      #canUsurpType(c) {
+        const m = usurpMap.get(this.type);
+        return !!m?.has(c);
+      }
+      #canUsurp(child) {
+        if (!child || typeof child !== "object" || child.type !== null || child.#parts.length !== 1 || this.type === null || this.#parts.length !== 1) {
+          return false;
+        }
+        const gc = child.#parts[0];
+        if (!gc || typeof gc !== "object" || gc.type === null) {
+          return false;
+        }
+        return this.#canUsurpType(gc.type);
+      }
+      #usurp(child) {
+        const m = usurpMap.get(this.type);
+        const gc = child.#parts[0];
+        const nt = m?.get(gc.type);
+        if (!nt)
+          return false;
+        this.#parts = gc.#parts;
+        for (const p of this.#parts) {
+          if (typeof p === "object")
+            p.#parent = this;
+        }
+        this.type = nt;
+        this.#toString = void 0;
+        this.#emptyExt = false;
+      }
+      #flatten() {
+        if (!isExtglobAST(this)) {
+          for (const p of this.#parts) {
+            if (typeof p === "object")
+              p.#flatten();
+          }
+        } else {
+          let iterations = 0;
+          let done = false;
+          do {
+            done = true;
+            for (let i = 0; i < this.#parts.length; i++) {
+              const c = this.#parts[i];
+              if (typeof c === "object") {
+                c.#flatten();
+                if (this.#canAdopt(c)) {
+                  done = false;
+                  this.#adopt(c, i);
+                } else if (this.#canAdoptWithSpace(c)) {
+                  done = false;
+                  this.#adoptWithSpace(c, i);
+                } else if (this.#canUsurp(c)) {
+                  done = false;
+                  this.#usurp(c);
+                }
+              }
+            }
+          } while (!done && ++iterations < 10);
+        }
+        this.#toString = void 0;
+      }
       static fromGlob(pattern, options = {}) {
-        const ast = new _AST(null, void 0, options);
-        _AST.#parseAST(pattern, ast, 0, options);
+        const ast = new _a(null, void 0, options);
+        _a.#parseAST(pattern, ast, 0, options, 0);
         return ast;
       }
       // returns the regular expression if there's magic, or the unescaped
@@ -24031,12 +23975,14 @@ var init_ast = __esm({
       // or start or whatever) and prepend ^ or / at the Regexp construction.
       toRegExpSource(allowDot) {
         const dot = allowDot ?? !!this.#options.dot;
-        if (this.#root === this)
+        if (this.#root === this) {
+          this.#flatten();
           this.#fillNegs();
-        if (!this.type) {
+        }
+        if (!isExtglobAST(this)) {
           const noEmpty = this.isStart() && this.isEnd();
           const src = this.#parts.map((p) => {
-            const [re, _, hasMagic2, uflag] = typeof p === "string" ? _AST.#parseGlob(p, this.#hasMagic, noEmpty) : p.toRegExpSource(allowDot);
+            const [re, _, hasMagic2, uflag] = typeof p === "string" ? _a.#parseGlob(p, this.#hasMagic, noEmpty) : p.toRegExpSource(allowDot);
             this.#hasMagic = this.#hasMagic || hasMagic2;
             this.#uflag = this.#uflag || uflag;
             return re;
@@ -24075,9 +24021,10 @@ var init_ast = __esm({
         let body = this.#partsToRegExp(dot);
         if (this.isStart() && this.isEnd() && !body && this.type !== "!") {
           const s = this.toString();
-          this.#parts = [s];
-          this.type = null;
-          this.#hasMagic = void 0;
+          const me = this;
+          me.#parts = [s];
+          me.type = null;
+          me.#hasMagic = void 0;
           return [s, unescape2(this.toString()), false, false];
         }
         let bodyDotAllowed = !repeated || allowDot || dot || !startNoDot ? "" : this.#partsToRegExp(true);
@@ -24166,6 +24113,7 @@ var init_ast = __esm({
         return [re, unescape2(glob2), !!hasMagic2, uflag];
       }
     };
+    _a = AST;
   }
 });
 
@@ -24339,11 +24287,13 @@ var init_esm3 = __esm({
       isWindows;
       platform;
       windowsNoMagicRoot;
+      maxGlobstarRecursion;
       regexp;
       constructor(pattern, options = {}) {
         assertValidPattern(pattern);
         options = options || {};
         this.options = options;
+        this.maxGlobstarRecursion = options.maxGlobstarRecursion ?? 200;
         this.pattern = pattern;
         this.platform = options.platform || defaultPlatform;
         this.isWindows = this.platform === "win32";
@@ -24676,7 +24626,8 @@ var init_esm3 = __esm({
       // out of pattern, then that's fine, as long as all
       // the parts match.
       matchOne(file, pattern, partial = false) {
-        const options = this.options;
+        let fileStartIndex = 0;
+        let patternStartIndex = 0;
         if (this.isWindows) {
           const fileDrive = typeof file[0] === "string" && /^[a-z]:$/i.test(file[0]);
           const fileUNC = !fileDrive && file[0] === "" && file[1] === "" && file[2] === "?" && /^[a-z]:$/i.test(file[3]);
@@ -24685,14 +24636,14 @@ var init_esm3 = __esm({
           const fdi = fileUNC ? 3 : fileDrive ? 0 : void 0;
           const pdi = patternUNC ? 3 : patternDrive ? 0 : void 0;
           if (typeof fdi === "number" && typeof pdi === "number") {
-            const [fd, pd] = [file[fdi], pattern[pdi]];
+            const [fd, pd] = [
+              file[fdi],
+              pattern[pdi]
+            ];
             if (fd.toLowerCase() === pd.toLowerCase()) {
               pattern[pdi] = fd;
-              if (pdi > fdi) {
-                pattern = pattern.slice(pdi);
-              } else if (fdi > pdi) {
-                file = file.slice(fdi);
-              }
+              patternStartIndex = pdi;
+              fileStartIndex = fdi;
             }
           }
         }
@@ -24700,51 +24651,114 @@ var init_esm3 = __esm({
         if (optimizationLevel >= 2) {
           file = this.levelTwoFileOptimize(file);
         }
-        this.debug("matchOne", this, { file, pattern });
-        this.debug("matchOne", file.length, pattern.length);
-        for (var fi = 0, pi = 0, fl = file.length, pl = pattern.length; fi < fl && pi < pl; fi++, pi++) {
-          this.debug("matchOne loop");
-          var p = pattern[pi];
-          var f = file[fi];
-          this.debug(pattern, p, f);
-          if (p === false) {
+        if (pattern.includes(GLOBSTAR)) {
+          return this.#matchGlobstar(file, pattern, partial, fileStartIndex, patternStartIndex);
+        }
+        return this.#matchOne(file, pattern, partial, fileStartIndex, patternStartIndex);
+      }
+      #matchGlobstar(file, pattern, partial, fileIndex, patternIndex) {
+        const firstgs = pattern.indexOf(GLOBSTAR, patternIndex);
+        const lastgs = pattern.lastIndexOf(GLOBSTAR);
+        const [head2, body, tail] = [
+          pattern.slice(patternIndex, firstgs),
+          pattern.slice(firstgs + 1, lastgs),
+          pattern.slice(lastgs + 1)
+        ];
+        if (head2.length) {
+          const fileHead = file.slice(fileIndex, fileIndex + head2.length);
+          if (!this.#matchOne(fileHead, head2, partial, 0, 0))
             return false;
-          }
-          if (p === GLOBSTAR) {
-            this.debug("GLOBSTAR", [pattern, p, f]);
-            var fr = fi;
-            var pr = pi + 1;
-            if (pr === pl) {
-              this.debug("** at the end");
-              for (; fi < fl; fi++) {
-                if (file[fi] === "." || file[fi] === ".." || !options.dot && file[fi].charAt(0) === ".")
-                  return false;
-              }
-              return true;
+          fileIndex += head2.length;
+        }
+        let fileTailMatch = 0;
+        if (tail.length) {
+          if (tail.length + fileIndex > file.length)
+            return false;
+          let tailStart = file.length - tail.length;
+          if (this.#matchOne(file, tail, partial, tailStart, 0)) {
+            fileTailMatch = tail.length;
+          } else {
+            if (file[file.length - 1] !== "" || fileIndex + tail.length === file.length) {
+              return false;
             }
-            while (fr < fl) {
-              var swallowee = file[fr];
-              this.debug("\nglobstar while", file, fr, pattern, pr, swallowee);
-              if (this.matchOne(file.slice(fr), pattern.slice(pr), partial)) {
-                this.debug("globstar found match!", fr, fl, swallowee);
-                return true;
-              } else {
-                if (swallowee === "." || swallowee === ".." || !options.dot && swallowee.charAt(0) === ".") {
-                  this.debug("dot detected!", file, fr, pattern, pr);
-                  break;
-                }
-                this.debug("globstar swallow a segment, and continue");
-                fr++;
-              }
+            tailStart--;
+            if (!this.#matchOne(file, tail, partial, tailStart, 0))
+              return false;
+            fileTailMatch = tail.length + 1;
+          }
+        }
+        if (!body.length) {
+          let sawSome = !!fileTailMatch;
+          for (let i2 = fileIndex; i2 < file.length - fileTailMatch; i2++) {
+            const f = String(file[i2]);
+            sawSome = true;
+            if (f === "." || f === ".." || !this.options.dot && f.startsWith(".")) {
+              return false;
             }
-            if (partial) {
-              this.debug("\n>>> no match, partial?", file, fr, pattern, pr);
-              if (fr === fl) {
-                return true;
-              }
+          }
+          return sawSome;
+        }
+        const bodySegments = [[[], 0]];
+        let currentBody = bodySegments[0];
+        let nonGsParts = 0;
+        const nonGsPartsSums = [0];
+        for (const b of body) {
+          if (b === GLOBSTAR) {
+            nonGsPartsSums.push(nonGsParts);
+            currentBody = [[], 0];
+            bodySegments.push(currentBody);
+          } else {
+            currentBody[0].push(b);
+            nonGsParts++;
+          }
+        }
+        let i = bodySegments.length - 1;
+        const fileLength = file.length - fileTailMatch;
+        for (const b of bodySegments) {
+          b[1] = fileLength - (nonGsPartsSums[i--] + b[0].length);
+        }
+        return !!this.#matchGlobStarBodySections(file, bodySegments, fileIndex, 0, partial, 0, !!fileTailMatch);
+      }
+      #matchGlobStarBodySections(file, bodySegments, fileIndex, bodyIndex, partial, globStarDepth, sawTail) {
+        const bs = bodySegments[bodyIndex];
+        if (!bs) {
+          for (let i = fileIndex; i < file.length; i++) {
+            sawTail = true;
+            const f = file[i];
+            if (f === "." || f === ".." || !this.options.dot && f.startsWith(".")) {
+              return false;
             }
+          }
+          return sawTail;
+        }
+        const [body, after] = bs;
+        while (fileIndex <= after) {
+          const m = this.#matchOne(file.slice(0, fileIndex + body.length), body, partial, fileIndex, 0);
+          if (m && globStarDepth < this.maxGlobstarRecursion) {
+            const sub = this.#matchGlobStarBodySections(file, bodySegments, fileIndex + body.length, bodyIndex + 1, partial, globStarDepth + 1, sawTail);
+            if (sub !== false)
+              return sub;
+          }
+          const f = file[fileIndex];
+          if (f === "." || f === ".." || !this.options.dot && f.startsWith(".")) {
             return false;
           }
+          fileIndex++;
+        }
+        return null;
+      }
+      #matchOne(file, pattern, partial, fileIndex, patternIndex) {
+        let fi;
+        let pi;
+        let pl;
+        let fl;
+        for (fi = fileIndex, pi = patternIndex, fl = file.length, pl = pattern.length; fi < fl && pi < pl; fi++, pi++) {
+          this.debug("matchOne loop");
+          let p = pattern[pi];
+          let f = file[fi];
+          this.debug(pattern, p, f);
+          if (p === false || p === GLOBSTAR)
+            return false;
           let hit;
           if (typeof p === "string") {
             hit = f === p;
@@ -42434,8 +42448,8 @@ var init_llk_lookahead = __esm({
     init_lookahead();
     LLkLookaheadStrategy = class {
       constructor(options) {
-        var _a;
-        this.maxLookahead = (_a = options === null || options === void 0 ? void 0 : options.maxLookahead) !== null && _a !== void 0 ? _a : DEFAULT_PARSER_CONFIG.maxLookahead;
+        var _a2;
+        this.maxLookahead = (_a2 = options === null || options === void 0 ? void 0 : options.maxLookahead) !== null && _a2 !== void 0 ? _a2 : DEFAULT_PARSER_CONFIG.maxLookahead;
       }
       validate(options) {
         const leftRecursionErrors = this.validateNoLeftRecursion(options.rules);
@@ -44304,8 +44318,8 @@ var init_parser = __esm({
               });
             }
             this.TRACE_INIT("ComputeLookaheadFunctions", () => {
-              var _a, _b;
-              (_b = (_a = this.lookaheadStrategy).initialize) === null || _b === void 0 ? void 0 : _b.call(_a, {
+              var _a2, _b;
+              (_b = (_a2 = this.lookaheadStrategy).initialize) === null || _b === void 0 ? void 0 : _b.call(_a2, {
                 rules: values_default(this.gastProductionsCache)
               });
               this.preComputeLookaheadFunctions(values_default(this.gastProductionsCache));
@@ -62259,7 +62273,7 @@ function toGraph(model) {
   return { graph: { nodes, edges, subgraphs, direction: model.direction }, laneGroups };
 }
 function renderState(model) {
-  var _a;
+  var _a2;
   const { graph, laneGroups } = toGraph(model);
   const layout = new DagreLayoutEngine().layout(graph);
   let svg = new SVGRenderer().render(layout);
@@ -62274,7 +62288,7 @@ function renderState(model) {
     const members = lg.nodes.map((id) => byId[id]).filter(Boolean);
     if (!members.length)
       continue;
-    (groupByParent[_a = lg.parentId] || (groupByParent[_a] = [])).push({ id: lg.id, nodes: members });
+    (groupByParent[_a2 = lg.parentId] || (groupByParent[_a2] = [])).push({ id: lg.id, nodes: members });
   }
   const laneIndex = (id) => {
     const m = /(.*)__lane(\d+)/.exec(id);
@@ -63362,12 +63376,12 @@ var require_code = __commonJS({
         return item === "" || item === '""';
       }
       get str() {
-        var _a;
-        return (_a = this._str) !== null && _a !== void 0 ? _a : this._str = this._items.reduce((s, c) => `${s}${c}`, "");
+        var _a2;
+        return (_a2 = this._str) !== null && _a2 !== void 0 ? _a2 : this._str = this._items.reduce((s, c) => `${s}${c}`, "");
       }
       get names() {
-        var _a;
-        return (_a = this._names) !== null && _a !== void 0 ? _a : this._names = this._items.reduce((names, c) => {
+        var _a2;
+        return (_a2 = this._names) !== null && _a2 !== void 0 ? _a2 : this._names = this._items.reduce((names, c) => {
           if (c instanceof Name)
             names[c.str] = (names[c.str] || 0) + 1;
           return names;
@@ -63513,8 +63527,8 @@ var require_scope = __commonJS({
         return `${prefix}${ng.index++}`;
       }
       _nameGroup(prefix) {
-        var _a, _b;
-        if (((_b = (_a = this._parent) === null || _a === void 0 ? void 0 : _a._prefixes) === null || _b === void 0 ? void 0 : _b.has(prefix)) || this._prefixes && !this._prefixes.has(prefix)) {
+        var _a2, _b;
+        if (((_b = (_a2 = this._parent) === null || _a2 === void 0 ? void 0 : _a2._prefixes) === null || _b === void 0 ? void 0 : _b.has(prefix)) || this._prefixes && !this._prefixes.has(prefix)) {
           throw new Error(`CodeGen: prefix "${prefix}" is not allowed in this scope`);
         }
         return this._names[prefix] = { prefix, index: 0 };
@@ -63547,12 +63561,12 @@ var require_scope = __commonJS({
         return new ValueScopeName(prefix, this._newName(prefix));
       }
       value(nameOrPrefix, value) {
-        var _a;
+        var _a2;
         if (value.ref === void 0)
           throw new Error("CodeGen: ref must be passed in value");
         const name = this.toName(nameOrPrefix);
         const { prefix } = name;
-        const valueKey = (_a = value.key) !== null && _a !== void 0 ? _a : value.ref;
+        const valueKey = (_a2 = value.key) !== null && _a2 !== void 0 ? _a2 : value.ref;
         let vs = this._values[prefix];
         if (vs) {
           const _name = vs.get(valueKey);
@@ -63870,8 +63884,8 @@ var require_codegen = __commonJS({
         return this;
       }
       optimizeNames(names, constants) {
-        var _a;
-        this.else = (_a = this.else) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants);
+        var _a2;
+        this.else = (_a2 = this.else) === null || _a2 === void 0 ? void 0 : _a2.optimizeNames(names, constants);
         if (!(super.optimizeNames(names, constants) || this.else))
           return;
         this.condition = optimizeExpr(this.condition, names, constants);
@@ -63975,16 +63989,16 @@ var require_codegen = __commonJS({
         return code;
       }
       optimizeNodes() {
-        var _a, _b;
+        var _a2, _b;
         super.optimizeNodes();
-        (_a = this.catch) === null || _a === void 0 ? void 0 : _a.optimizeNodes();
+        (_a2 = this.catch) === null || _a2 === void 0 ? void 0 : _a2.optimizeNodes();
         (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNodes();
         return this;
       }
       optimizeNames(names, constants) {
-        var _a, _b;
+        var _a2, _b;
         super.optimizeNames(names, constants);
-        (_a = this.catch) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants);
+        (_a2 = this.catch) === null || _a2 === void 0 ? void 0 : _a2.optimizeNames(names, constants);
         (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants);
         return this;
       }
@@ -64764,8 +64778,8 @@ var require_applicability = __commonJS({
     }
     exports2.shouldUseGroup = shouldUseGroup;
     function shouldUseRule(schema, rule) {
-      var _a;
-      return schema[rule.keyword] !== void 0 || ((_a = rule.definition.implements) === null || _a === void 0 ? void 0 : _a.some((kwd) => schema[kwd] !== void 0));
+      var _a2;
+      return schema[rule.keyword] !== void 0 || ((_a2 = rule.definition.implements) === null || _a2 === void 0 ? void 0 : _a2.some((kwd) => schema[kwd] !== void 0));
     }
     exports2.shouldUseRule = shouldUseRule;
   }
@@ -65153,14 +65167,14 @@ var require_keyword = __commonJS({
     }
     exports2.macroKeywordCode = macroKeywordCode;
     function funcKeywordCode(cxt, def) {
-      var _a;
+      var _a2;
       const { gen, keyword, schema, parentSchema, $data, it } = cxt;
       checkAsyncKeyword(it, def);
       const validate2 = !$data && def.compile ? def.compile.call(it.self, schema, parentSchema, it) : def.validate;
       const validateRef = useKeyword(gen, keyword, validate2);
       const valid = gen.let("valid");
       cxt.block$data(valid, validateKeyword);
-      cxt.ok((_a = def.valid) !== null && _a !== void 0 ? _a : valid);
+      cxt.ok((_a2 = def.valid) !== null && _a2 !== void 0 ? _a2 : valid);
       function validateKeyword() {
         if (def.errors === false) {
           assignValid();
@@ -65191,8 +65205,8 @@ var require_keyword = __commonJS({
         gen.assign(valid, (0, codegen_1._)`${_await}${(0, code_1.callValidateCode)(cxt, validateRef, passCxt, passSchema)}`, def.modifying);
       }
       function reportErrs(errors) {
-        var _a2;
-        gen.if((0, codegen_1.not)((_a2 = def.valid) !== null && _a2 !== void 0 ? _a2 : valid), errors);
+        var _a3;
+        gen.if((0, codegen_1.not)((_a3 = def.valid) !== null && _a3 !== void 0 ? _a3 : valid), errors);
       }
     }
     exports2.funcKeywordCode = funcKeywordCode;
@@ -66160,7 +66174,7 @@ var require_compile = __commonJS({
     var validate_1 = require_validate();
     var SchemaEnv = class {
       constructor(env) {
-        var _a;
+        var _a2;
         this.refs = {};
         this.dynamicAnchors = {};
         let schema;
@@ -66169,7 +66183,7 @@ var require_compile = __commonJS({
         this.schema = env.schema;
         this.schemaId = env.schemaId;
         this.root = env.root || this;
-        this.baseId = (_a = env.baseId) !== null && _a !== void 0 ? _a : (0, resolve_1.normalizeId)(schema === null || schema === void 0 ? void 0 : schema[env.schemaId || "$id"]);
+        this.baseId = (_a2 = env.baseId) !== null && _a2 !== void 0 ? _a2 : (0, resolve_1.normalizeId)(schema === null || schema === void 0 ? void 0 : schema[env.schemaId || "$id"]);
         this.schemaPath = env.schemaPath;
         this.localRefs = env.localRefs;
         this.meta = env.meta;
@@ -66265,14 +66279,14 @@ var require_compile = __commonJS({
     }
     exports2.compileSchema = compileSchema;
     function resolveRef(root2, baseId, ref2) {
-      var _a;
+      var _a2;
       ref2 = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref2);
       const schOrFunc = root2.refs[ref2];
       if (schOrFunc)
         return schOrFunc;
       let _sch = resolve9.call(this, root2, ref2);
       if (_sch === void 0) {
-        const schema = (_a = root2.localRefs) === null || _a === void 0 ? void 0 : _a[ref2];
+        const schema = (_a2 = root2.localRefs) === null || _a2 === void 0 ? void 0 : _a2[ref2];
         const { schemaId } = this.opts;
         if (schema)
           _sch = new SchemaEnv({ schema, schemaId, root: root2, baseId });
@@ -66341,8 +66355,8 @@ var require_compile = __commonJS({
       "definitions"
     ]);
     function getJsonPointer(parsedRef, { baseId, schema, root: root2 }) {
-      var _a;
-      if (((_a = parsedRef.fragment) === null || _a === void 0 ? void 0 : _a[0]) !== "/")
+      var _a2;
+      if (((_a2 = parsedRef.fragment) === null || _a2 === void 0 ? void 0 : _a2[0]) !== "/")
         return;
       for (const part of parsedRef.fragment.slice(1).split("/")) {
         if (typeof schema === "boolean")
@@ -67203,9 +67217,9 @@ var require_core = __commonJS({
     };
     var MAX_EXPRESSION = 200;
     function requiredOptions(o) {
-      var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0;
+      var _a2, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0;
       const s = o.strict;
-      const _optz = (_a = o.code) === null || _a === void 0 ? void 0 : _a.optimize;
+      const _optz = (_a2 = o.code) === null || _a2 === void 0 ? void 0 : _a2.optimize;
       const optimize = _optz === true || _optz === void 0 ? 1 : _optz || 0;
       const regExp = (_c = (_b = o.code) === null || _b === void 0 ? void 0 : _b.regExp) !== null && _c !== void 0 ? _c : defaultRegExp;
       const uriResolver = (_d = o.uriResolver) !== null && _d !== void 0 ? _d : uri_1.default;
@@ -67679,7 +67693,7 @@ var require_core = __commonJS({
       }
     }
     function addRule(keyword, definition, dataType) {
-      var _a;
+      var _a2;
       const post = definition === null || definition === void 0 ? void 0 : definition.post;
       if (dataType && post)
         throw new Error('keyword with "post" flag cannot have "type"');
@@ -67705,7 +67719,7 @@ var require_core = __commonJS({
       else
         ruleGroup.rules.push(rule);
       RULES.all[keyword] = rule;
-      (_a = definition.implements) === null || _a === void 0 ? void 0 : _a.forEach((kwd) => this.addKeyword(kwd));
+      (_a2 = definition.implements) === null || _a2 === void 0 ? void 0 : _a2.forEach((kwd) => this.addKeyword(kwd));
     }
     function addBeforeRule(ruleGroup, rule, before) {
       const i = ruleGroup.rules.findIndex((_rule) => _rule.keyword === before);
@@ -67839,10 +67853,10 @@ var require_ref = __commonJS({
         gen.assign(names_1.default.errors, (0, codegen_1._)`${names_1.default.vErrors}.length`);
       }
       function addEvaluatedFrom(source) {
-        var _a;
+        var _a2;
         if (!it.opts.unevaluated)
           return;
-        const schEvaluated = (_a = sch === null || sch === void 0 ? void 0 : sch.validate) === null || _a === void 0 ? void 0 : _a.evaluated;
+        const schEvaluated = (_a2 = sch === null || sch === void 0 ? void 0 : sch.validate) === null || _a2 === void 0 ? void 0 : _a2.evaluated;
         if (it.props !== true) {
           if (schEvaluated && !schEvaluated.dynamicProps) {
             if (schEvaluated.props !== void 0) {
@@ -69493,7 +69507,7 @@ var require_discriminator = __commonJS({
           return _valid;
         }
         function getMapping() {
-          var _a;
+          var _a2;
           const oneOfMapping = {};
           const topRequired = hasRequired(parentSchema);
           let tagRequired = true;
@@ -69507,7 +69521,7 @@ var require_discriminator = __commonJS({
               if (sch === void 0)
                 throw new ref_error_1.default(it.opts.uriResolver, it.baseId, ref2);
             }
-            const propSch = (_a = sch === null || sch === void 0 ? void 0 : sch.properties) === null || _a === void 0 ? void 0 : _a[tagName];
+            const propSch = (_a2 = sch === null || sch === void 0 ? void 0 : sch.properties) === null || _a2 === void 0 ? void 0 : _a2[tagName];
             if (typeof propSch != "object") {
               throw new Error(`discriminator: oneOf subschemas (or referenced schemas) must have "properties/${tagName}"`);
             }
@@ -71610,20 +71624,52 @@ When reviewing code:
 - Evaluate code style and consistency
 - Provide specific, actionable suggestions with code examples where appropriate`,
       "code-review-template": `You are going to perform code review according to provided user rules. Ensure to review only code provided in diff and latest commit, if provided. However you still need to fully understand how modified code works, and read dependencies if something is not clear.`,
-      "engineer": `You are senior engineer focused on software architecture and design.
-Before jumping on the task you first, in details analyse user request, and try to provide elegant and concise solution.
-If solution is clear, you can jump to implementation right away, if not, you can ask user a clarification question, by calling attempt_completion tool, with required details.
+      "engineer": `You are a senior engineer focused on software architecture and design.
+Before jumping on the task you first analyse the user request in detail, and try to provide an elegant and concise solution.
+If the solution is clear, you can jump to implementation right away. If not, ask the user a clarification question by calling the attempt_completion tool with the required details.
 
-Before jumping to implementation:
+# Tone and Style
+- Be concise and direct. Explain your approach briefly before implementing, then let the code speak for itself.
+- Do not add unnecessary preamble or postamble. Skip "Here is what I will do" or "Here is a summary of changes" unless the user asks.
+- Do not add code comments unless the logic is genuinely complex and non-obvious.
+
+# Before Implementation
 - Focus on high-level design patterns and system organization
 - Identify architectural patterns and component relationships
 - Evaluate system structure and suggest architectural improvements
-- Focus on backward compatibility.
+- Focus on backward compatibility
 - Consider scalability, maintainability, and extensibility in your analysis
 
-During the implementation:
-- Avoid implementing special cases
-- Do not forget to add the tests`,
+# Following Conventions
+- NEVER assume a library or dependency is available. Before using any library, check the project's dependency file (package.json, Cargo.toml, go.mod, requirements.txt, etc.) to confirm it exists in the project.
+- Before writing new code, look at neighboring files and existing implementations to understand the project's code style, naming conventions, and patterns. Mimic them.
+- Check imports and existing utilities before creating new helpers \u2014 the project may already have what you need.
+
+# Task Planning
+- If the task tool is available, use it to break complex work into milestones before starting implementation.
+- Stay flexible \u2014 if your understanding changes mid-task, add, remove, or reorganize tasks as needed. The plan should serve you, not constrain you.
+
+# During Implementation
+- Always create a new branch before making changes to the codebase.
+- Fix problems at the root cause, not with surface-level patches. Prefer general solutions over special cases.
+- Avoid implementing special cases when a general approach works
+- Never expose secrets, API keys, or credentials in generated code. Never log sensitive information.
+- Do not surprise the user with unrequested changes. Do what was asked, including reasonable follow-up actions, but do not refactor surrounding code or add features that were not requested.
+- After every significant change, verify the project still builds and passes linting. Do not wait until the end to discover breakage.
+
+# After Implementation
+- Always run the project's tests before considering the task complete. If tests fail, fix them.
+- Run lint and typecheck commands if known for the project.
+- If a build, lint, or test fails, fix the issue before finishing.
+- When the task is done, respond to the user with a concise summary of what was implemented, what files were changed, and any relevant details. Include links (e.g. pull request URL) so the user has everything they need.
+
+# GitHub Integration
+- Use the \`gh\` CLI for all GitHub operations: issues, pull requests, checks, releases.
+- To create a pull request: commit your changes, push the branch, then use \`gh pr create --title "..." --body "..."\`.
+- To view issues or PRs: \`gh issue view <number>\`, \`gh pr view <number>\`.
+- If given a GitHub URL, use \`gh\` to fetch the relevant information rather than guessing.
+- Always return the pull request URL to the user after creating one.
+- When checking GitHub Actions, only read logs of failed jobs \u2014 do not waste time on successful ones. Use \`gh run view <run-id> --log-failed\` to fetch only the relevant output.`,
       "support": `You are ProbeChat Support, a specialized AI assistant focused on helping developers troubleshoot issues and solve problems. Your primary function is to help users diagnose errors, understand unexpected behaviors, and find solutions using the provided code analysis tools.
 
 When troubleshooting:
@@ -80696,10 +80742,10 @@ var init_FallbackManager = __esm({
       // Use custom provider list
     };
     DEFAULT_MODELS = {
-      anthropic: "claude-sonnet-4-5-20250929",
-      openai: "gpt-4o",
-      google: "gemini-2.0-flash-exp",
-      bedrock: "anthropic.claude-sonnet-4-20250514-v1:0"
+      anthropic: "claude-sonnet-4-6",
+      openai: "gpt-5.2",
+      google: "gemini-2.5-flash",
+      bedrock: "anthropic.claude-sonnet-4-6"
     };
     FallbackManager = class {
       /**
@@ -83219,7 +83265,7 @@ var init_ProbeAgent = __esm({
               }
               this.clientApiProvider = "claude-code";
               this.provider = null;
-              this.model = this.clientApiModel || "claude-3-5-sonnet-20241022";
+              this.model = this.clientApiModel || "claude-sonnet-4-6";
               this.apiType = "claude-code";
             } else if (codexAvailable) {
               if (this.debug) {
@@ -83228,7 +83274,7 @@ var init_ProbeAgent = __esm({
               }
               this.clientApiProvider = "codex";
               this.provider = null;
-              this.model = this.clientApiModel || "gpt-4o";
+              this.model = this.clientApiModel || "gpt-5.2";
               this.apiType = "codex";
             } else {
               throw new Error("No API key provided and neither claude nor codex command found. Please either:\n1. Set an API key: ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_GENERATIVE_AI_API_KEY, or AWS credentials\n2. Install claude command from https://docs.claude.com/en/docs/claude-code\n3. Install codex command from https://openai.com/codex");
@@ -83466,7 +83512,7 @@ var init_ProbeAgent = __esm({
         }
         if (this.clientApiProvider === "claude-code" || process.env.USE_CLAUDE_CODE === "true") {
           this.provider = null;
-          this.model = modelName || "claude-3-5-sonnet-20241022";
+          this.model = modelName || "claude-sonnet-4-6";
           this.apiType = "claude-code";
           if (this.debug) {
             console.log("[DEBUG] Claude Code engine selected - will use built-in access if available");
@@ -83833,7 +83879,7 @@ var init_ProbeAgent = __esm({
           apiKey,
           ...apiUrl && { baseURL: apiUrl }
         });
-        this.model = modelName || "claude-sonnet-4-5-20250929";
+        this.model = modelName || "claude-sonnet-4-6";
         this.apiType = "anthropic";
         if (this.debug) {
           console.log(`Using Anthropic API with model: ${this.model}${apiUrl ? ` (URL: ${apiUrl})` : ""}`);
@@ -83848,7 +83894,7 @@ var init_ProbeAgent = __esm({
           apiKey,
           ...apiUrl && { baseURL: apiUrl }
         });
-        this.model = modelName || "gpt-5-thinking";
+        this.model = modelName || "gpt-5.2";
         this.apiType = "openai";
         if (this.debug) {
           console.log(`Using OpenAI API with model: ${this.model}${apiUrl ? ` (URL: ${apiUrl})` : ""}`);
@@ -83952,7 +83998,7 @@ var init_ProbeAgent = __esm({
           config.baseURL = baseURL;
         }
         this.provider = createAmazonBedrock2(config);
-        this.model = modelName || "anthropic.claude-sonnet-4-20250514-v1:0";
+        this.model = modelName || "anthropic.claude-sonnet-4-6";
         this.apiType = "bedrock";
         if (this.debug) {
           const authMethod = apiKey ? "API Key" : "AWS Credentials";
@@ -84011,7 +84057,7 @@ var init_ProbeAgent = __esm({
               allowedTools: this.allowedTools,
               // Pass tool filtering configuration
               model: this.model
-              // Pass model name (e.g., gpt-4o, o3, etc.)
+              // Pass model name (e.g., gpt-5.2, o3, etc.)
             });
             if (this.debug) {
               console.log("[DEBUG] Using Codex CLI engine with Probe tools");
@@ -85266,9 +85312,7 @@ You are working with a workspace. Available paths: ${workspaceDesc}
             let maxResponseTokens = this.maxResponseTokens;
             if (!maxResponseTokens) {
               maxResponseTokens = 4e3;
-              if (this.model && this.model.includes("opus") || this.model && this.model.includes("sonnet") || this.model && this.model.startsWith("gpt-4-")) {
-                maxResponseTokens = 8192;
-              } else if (this.model && this.model.startsWith("gpt-4o")) {
+              if (this.model && this.model.includes("opus") || this.model && this.model.includes("sonnet") || this.model && this.model.startsWith("gpt-4") || this.model && this.model.startsWith("gpt-5")) {
                 maxResponseTokens = 8192;
               } else if (this.model && this.model.startsWith("gemini")) {
                 maxResponseTokens = 32e3;