@vibe-agent-toolkit/utils 0.1.41-rc.7 → 0.1.41

package/dist/git-tracker.d.ts

@@ -58,6 +58,8 @@ export declare class GitTracker {
     private readonly activeAncestors;
     private initialized;
     private activeSetPopulated;
+    /** Whether `git ls-files` actually answered during {@link initialize}. */
+    private gitAnswered;
     constructor(projectRoot: string);
     /**
      * Initialize the tracker by pre-populating cache from git ls-files.
@@ -72,6 +74,21 @@ export declare class GitTracker {
      * `git check-ignore` via {@link isIgnored}.
      */
     initialize(options?: GitTrackerInitOptions): Promise<void>;
+    /**
+     * Did git actually answer, or is this tracker an empty shell?
+     *
+     * `gitLsFiles` returns `null` for every way asking can fail — no `git` on
+     * `PATH`, a corrupt `.git`, an unreadable `.git`, a non-repository cwd — and
+     * that `null` is otherwise indistinguishable here from "git answered, and the
+     * repository is empty": both leave the active set with zero entries, after
+     * which {@link isIgnoredByActiveSet} reports every path as NOT ignored.
+     *
+     * For a walker that is fine — unfiltered is the safe default. For a caller that
+     * INFERS something from "not ignored" (provenance, publication, leakage) it is
+     * not: the inference silently becomes a fixed answer. Such callers must ask
+     * this first and treat `false` as "no answer available", never as a verdict.
+     */
+    isUsable(): boolean;
     /**
      * Walk up from each active-set file's directory and record every ancestor up to projectRoot.
      *
@@ -97,9 +114,21 @@ export declare class GitTracker {
     /**
      * Fast O(1) ignore check against the pre-populated active set.
      *
-     * For paths INSIDE the project root, membership in the active set is
-     * authoritative: a path is ignored iff it is not in the active set AND not
-     * an ancestor of any active-set path. No `git check-ignore` spawn.
+     * For paths INSIDE the project root **that exist on disk**, membership in the
+     * active set is authoritative: such a path is ignored iff it is not in the
+     * active set AND not an ancestor of any active-set path. No `git
+     * check-ignore` spawn.
+     *
+     * The existence qualifier is load-bearing, not a caveat. The active set is
+     * built from `git ls-files`, so it can only ever contain paths that EXIST — a
+     * path that does not exist is trivially absent from it, and a bare set lookup
+     * would call every typo'd or never-built path "ignored". Callers acted on
+     * that: a broken markdown link was reported as a gitignored-data leak rather
+     * than a broken link. Such paths therefore fall back to {@link isIgnored},
+     * i.e. `git check-ignore`, which answers from the ignore PATTERNS and is
+     * correct for a path that is merely named (`dist/out.js` under an ignored
+     * `dist/` is ignored; `docs/typo.md` is not). The fallback result is cached,
+     * so a repeated miss on the same path stays O(1).
      *
      * For paths OUTSIDE the project root, falls back to {@link isIgnored} so
      * legacy behavior is preserved.

package/dist/git-tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-tracker.d.ts","sourceRoot":"","sources":["../src/git-tracker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmC;IACzD,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0B;IAC1D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,kBAAkB,CAAS;gBAEvB,WAAW,EAAE,MAAM;IAK/B;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBhE;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAQlD;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAenD,OAAO,CAAC,mBAAmB;IAQ3B;;;;;;;OAOG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAqBpC;;OAEG;IACH,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE;IAQrF;;OAEG;IACH,KAAK,IAAI,IAAI;CAOd"}
+{"version":3,"file":"git-tracker.d.ts","sourceRoot":"","sources":["../src/git-tracker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmC;IACzD,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0B;IAC1D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,kBAAkB,CAAS;IACnC,0EAA0E;IAC1E,OAAO,CAAC,WAAW,CAAS;gBAEhB,WAAW,EAAE,MAAM;IAK/B;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BhE;;;;;;;;;;;;;OAaG;IACH,QAAQ,IAAI,OAAO;IAInB;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAQlD;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IA0BnD,OAAO,CAAC,mBAAmB;IAQ3B;;;;;;;OAOG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAqBpC;;OAEG;IACH,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE;IAQrF;;OAEG;IACH,KAAK,IAAI,IAAI;CAQd"}

package/dist/git-tracker.js

@@ -4,6 +4,7 @@
  * Problem: Calling git check-ignore on every file is expensive (spawns process each time).
  * Solution: Cache results and pre-populate with git ls-files (tracked + untracked non-ignored).
  */
+import { existsSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { gitLsFiles, isGitIgnored } from './git-utils.js';
 import { safePath, toForwardSlash } from './path-utils.js';
@@ -43,6 +44,8 @@ export class GitTracker {
     activeAncestors = new Set();
     initialized = false;
     activeSetPopulated = false;
+    /** Whether `git ls-files` actually answered during {@link initialize}. */
+    gitAnswered = false;
     constructor(projectRoot) {
         this.projectRoot = projectRoot;
         this.normalizedProjectRoot = safePath.resolve(projectRoot);
@@ -76,9 +79,27 @@ export class GitTracker {
             }
             this.populateAncestorSet();
         }
+        this.gitAnswered = files !== null;
         this.activeSetPopulated = includeUntracked && files !== null;
         this.initialized = true;
     }
+    /**
+     * Did git actually answer, or is this tracker an empty shell?
+     *
+     * `gitLsFiles` returns `null` for every way asking can fail — no `git` on
+     * `PATH`, a corrupt `.git`, an unreadable `.git`, a non-repository cwd — and
+     * that `null` is otherwise indistinguishable here from "git answered, and the
+     * repository is empty": both leave the active set with zero entries, after
+     * which {@link isIgnoredByActiveSet} reports every path as NOT ignored.
+     *
+     * For a walker that is fine — unfiltered is the safe default. For a caller that
+     * INFERS something from "not ignored" (provenance, publication, leakage) it is
+     * not: the inference silently becomes a fixed answer. Such callers must ask
+     * this first and treat `false` as "no answer available", never as a verdict.
+     */
+    isUsable() {
+        return this.gitAnswered;
+    }
     /**
      * Walk up from each active-set file's directory and record every ancestor up to projectRoot.
      *
@@ -129,9 +150,21 @@ export class GitTracker {
     /**
      * Fast O(1) ignore check against the pre-populated active set.
      *
-     * For paths INSIDE the project root, membership in the active set is
-     * authoritative: a path is ignored iff it is not in the active set AND not
-     * an ancestor of any active-set path. No `git check-ignore` spawn.
+     * For paths INSIDE the project root **that exist on disk**, membership in the
+     * active set is authoritative: such a path is ignored iff it is not in the
+     * active set AND not an ancestor of any active-set path. No `git
+     * check-ignore` spawn.
+     *
+     * The existence qualifier is load-bearing, not a caveat. The active set is
+     * built from `git ls-files`, so it can only ever contain paths that EXIST — a
+     * path that does not exist is trivially absent from it, and a bare set lookup
+     * would call every typo'd or never-built path "ignored". Callers acted on
+     * that: a broken markdown link was reported as a gitignored-data leak rather
+     * than a broken link. Such paths therefore fall back to {@link isIgnored},
+     * i.e. `git check-ignore`, which answers from the ignore PATTERNS and is
+     * correct for a path that is merely named (`dist/out.js` under an ignored
+     * `dist/` is ignored; `docs/typo.md` is not). The fallback result is cached,
+     * so a repeated miss on the same path stays O(1).
      *
      * For paths OUTSIDE the project root, falls back to {@link isIgnored} so
      * legacy behavior is preserved.
@@ -152,7 +185,16 @@ export class GitTracker {
         if (!this.isWithinProjectRoot(normalized)) {
             return this.isIgnored(absolutePath);
         }
-        return !(this.activeSet.has(normalized) || this.activeAncestors.has(normalized));
+        if (this.activeSet.has(normalized) || this.activeAncestors.has(normalized)) {
+            return false;
+        }
+        // Absent from the active set. That means "ignored" only for a path that is
+        // actually there; otherwise the set has no opinion and git must be asked.
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- caller-supplied path, read-only existence probe
+        if (!existsSync(normalized)) {
+            return this.isIgnored(absolutePath);
+        }
+        return true;
     }
     isWithinProjectRoot(normalizedAbsolutePath) {
         const root = this.normalizedProjectRoot;
@@ -205,6 +247,7 @@ export class GitTracker {
         this.activeAncestors.clear();
         this.initialized = false;
         this.activeSetPopulated = false;
+        this.gitAnswered = false;
     }
 }
 //# sourceMappingURL=git-tracker.js.map

package/dist/git-tracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-tracker.js","sourceRoot":"","sources":["../src/git-tracker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAqB3D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,UAAU;IACJ,WAAW,CAAS;IACpB,qBAAqB,CAAS;IAC9B,KAAK,GAAyB,IAAI,GAAG,EAAE,CAAC;IACzD,6FAA6F;IAC5E,SAAS,GAAgB,IAAI,GAAG,EAAE,CAAC;IACpD,oFAAoF;IACnE,eAAe,GAAgB,IAAI,GAAG,EAAE,CAAC;IAClD,WAAW,GAAG,KAAK,CAAC;IACpB,kBAAkB,GAAG,KAAK,CAAC;IAEnC,YAAY,WAAmB;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,qBAAqB,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,OAA+B;QAC9C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,IAAI,IAAI,CAAC;QAE3D,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,GAAG,EAAE,IAAI,CAAC,WAAW;YACrB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QAEH,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,KAAK,MAAM,YAAY,IAAI,KAAK,EAAE,CAAC;gBACjC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;gBACtE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,sBAAsB;gBAC3D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,kBAAkB,GAAG,gBAAgB,IAAI,KAAK,KAAK,IAAI,CAAC;QAC7D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACK,mBAAmB;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAExC,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YAEpD,OAAO,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACxD,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtC,+EAA+E;oBAC/E,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAClC,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;oBACvB,MAAM;gBACR,CAAC;gBACD,OAAO,GAAG,MAAM,CAAC;YACnB,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,YAAoB;QACtC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChF,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,CAAC,YAAoB;QACvC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAElD,yEAAyE;QACzE,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACnF,CAAC;IAEO,mBAAmB,CAAC,sBAA8B;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,qBAAqB,CAAC;QACxC,IAAI,sBAAsB,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,sBAAsB,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,QAAgB;QACxB,sEAAsE;QACtE,oEAAoE;QACpE,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,wDAAwD;QACxD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAElC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC1B,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;YAClC,mBAAmB,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI;SAC/C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC;IAClC,CAAC;CACF"}
+{"version":3,"file":"git-tracker.js","sourceRoot":"","sources":["../src/git-tracker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAqB3D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,UAAU;IACJ,WAAW,CAAS;IACpB,qBAAqB,CAAS;IAC9B,KAAK,GAAyB,IAAI,GAAG,EAAE,CAAC;IACzD,6FAA6F;IAC5E,SAAS,GAAgB,IAAI,GAAG,EAAE,CAAC;IACpD,oFAAoF;IACnE,eAAe,GAAgB,IAAI,GAAG,EAAE,CAAC;IAClD,WAAW,GAAG,KAAK,CAAC;IACpB,kBAAkB,GAAG,KAAK,CAAC;IACnC,0EAA0E;IAClE,WAAW,GAAG,KAAK,CAAC;IAE5B,YAAY,WAAmB;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,qBAAqB,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,OAA+B;QAC9C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,IAAI,IAAI,CAAC;QAE3D,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,GAAG,EAAE,IAAI,CAAC,WAAW;YACrB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QAEH,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,KAAK,MAAM,YAAY,IAAI,KAAK,EAAE,CAAC;gBACjC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;gBACtE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,sBAAsB;gBAC3D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,KAAK,KAAK,IAAI,CAAC;QAClC,IAAI,CAAC,kBAAkB,GAAG,gBAAgB,IAAI,KAAK,KAAK,IAAI,CAAC;QAC7D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACK,mBAAmB;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAExC,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YAEpD,OAAO,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACxD,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtC,+EAA+E;oBAC/E,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAClC,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;oBACvB,MAAM;gBACR,CAAC;gBACD,OAAO,GAAG,MAAM,CAAC;YACnB,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,YAAoB;QACtC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChF,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,oBAAoB,CAAC,YAAoB;QACvC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAElD,yEAAyE;QACzE,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,sHAAsH;QACtH,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,mBAAmB,CAAC,sBAA8B;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,qBAAqB,CAAC;QACxC,IAAI,sBAAsB,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,sBAAsB,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,QAAgB;QACxB,sEAAsE;QACtE,oEAAoE;QACpE,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,wDAAwD;QACxD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAElC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC1B,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;YAClC,mBAAmB,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI;SAC/C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC;QAChC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;IAC3B,CAAC;CACF"}

package/dist/git-url.d.ts

@@ -6,11 +6,34 @@
  * - `ref` is an optional branch or tag name (deep commit SHAs are not
  *   guaranteed to work with shallow clone — see design spec for details).
  * - `subpath` is an optional subdirectory within the cloned repo to audit.
+ * - `inferredFromShorthand` records whether `cloneUrl` was *inferred* from bare
+ *   `owner/repo` shorthand rather than supplied verbatim by the user.
  */
 export interface ParsedGitUrl {
     cloneUrl: string;
     ref?: string;
     subpath?: string;
+    /**
+     * True when `cloneUrl` was synthesized from bare GitHub shorthand
+     * (`owner/repo`), false when the user typed a URL we pass through.
+     *
+     * This has to travel with the value: an expanded shorthand URL is
+     * byte-identical to a hand-typed one, so a consumer cannot recover the
+     * distinction by inspecting `cloneUrl`. Consumers need it because the two
+     * cases warrant opposite credential policies — see
+     * {@link nonInteractiveGitOverrides}.
+     */
+    inferredFromShorthand: boolean;
+}
+/**
+ * Environment and `git -c` overrides that make a clone non-interactive.
+ * Both collections are empty when no override is warranted.
+ */
+export interface NonInteractiveGitOverrides {
+    /** Overlay to merge over `process.env` when spawning git. */
+    env: Record<string, string>;
+    /** `git -c <name>=<value>` arguments to place *before* the subcommand. */
+    configArgs: string[];
 }
 /**
  * Parse a string into a {@link ParsedGitUrl}.
@@ -27,6 +50,43 @@ export interface ParsedGitUrl {
  * Throws on malformed input.
  */
 export declare function parseGitUrl(input: string): ParsedGitUrl;
+/**
+ * Credential-prompt overrides for cloning `parsed`.
+ *
+ * **Only inferred shorthand gets them.** A user who typed a full
+ * `https://…` URL for a private repo may legitimately intend to authenticate
+ * interactively, and silently disabling that would break a real workflow. A
+ * user who typed `owner/repo` and got it wrong should fail in milliseconds
+ * instead of sitting on a credential prompt for a minute.
+ *
+ * Why this exact set (verified against git 2.50.1 with `git credential fill`):
+ *
+ * - `GIT_TERMINAL_PROMPT=0` — suppresses git's own TTY prompt. On its own it is
+ *   **not** sufficient: `gitcredentials(7)` consults `GIT_ASKPASS`, then
+ *   `core.askPass`, then `SSH_ASKPASS`, and only prompts on the terminal if all
+ *   three are unset. Each askpass hook therefore bypasses this flag entirely —
+ *   which is exactly the case inside VS Code's integrated terminal, where
+ *   `GIT_ASKPASS` points at a GUI prompt.
+ * - `GIT_ASKPASS=''` — `getenv()` returns a non-NULL empty string, so git stops
+ *   walking the askpass chain *and* runs nothing, masking `core.askPass` and
+ *   `SSH_ASKPASS` in one move.
+ * - `SSH_ASKPASS=''` and `-c core.askPass=` — belt and braces for the same
+ *   chain, because an empty-valued environment variable is not reliably
+ *   distinguishable from an unset one on Windows. `-c` is used rather than
+ *   `GIT_CONFIG_*` precisely because `-c` is additive: writing
+ *   `GIT_CONFIG_COUNT` would silently clobber an overlay the caller supplied
+ *   (VAT's own tests use `GIT_CONFIG_*` to rewrite remotes via `insteadOf`).
+ * - `GCM_INTERACTIVE=never` — git's flags cannot reach a credential *helper*
+ *   that opens its own UI. Git Credential Manager (the default on Git for
+ *   Windows) is the common one; `never` still lets it serve a cached
+ *   credential, it only forbids escalating to a prompt.
+ *
+ * What is deliberately **not** here: nothing resets `credential.helper` and
+ * nothing sets `GIT_CONFIG_NOSYSTEM`. A helper holding a valid token is how a
+ * private repo typed as shorthand still clones successfully; the goal is to
+ * forbid *interaction*, not authentication.
+ */
+export declare function nonInteractiveGitOverrides(parsed: ParsedGitUrl): NonInteractiveGitOverrides;
 /**
  * Detect whether a string should be treated as a git URL (for the polymorphic
  * `[git-url-or-path]` audit argument). True for:

package/dist/git-url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-url.d.ts","sourceRoot":"","sources":["../src/git-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAyBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAgEvD;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAmB/C"}
+{"version":3,"file":"git-url.d.ts","sourceRoot":"","sources":["../src/git-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,0EAA0E;IAC1E,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAyBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAuEvD;AAcD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,YAAY,GAAG,0BAA0B,CAa3F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAmB/C"}

package/dist/git-url.js

@@ -44,13 +44,13 @@ export function parseGitUrl(input) {
     // file:// natively.
     if (trimmed.startsWith('file://')) {
         const { base, ref, subpath } = splitFragment(trimmed);
-        return buildParsed(base, ref, subpath);
+        return buildParsed(base, ref, subpath, false);
     }
     // HTTPS .git form: https://host/path.git[#ref[:subpath]]
     if (/^https?:\/\//.test(trimmed)) {
         const { base, ref, subpath } = splitFragment(trimmed);
         if (base.endsWith('.git')) {
-            return buildParsed(base, ref, subpath);
+            return buildParsed(base, ref, subpath, false);
         }
         // GitHub web URL: https://github.com/owner/repo/tree/<ref>[/<subpath>]
         const ghWeb = 
@@ -61,41 +61,98 @@ export function parseGitUrl(input) {
             const repo = ghWeb[2] ?? '';
             const webRef = ghWeb[3];
             const webSubpath = ghWeb[4];
-            return buildParsed(`https://github.com/${owner}/${repo}.git`, webRef, webSubpath);
+            // A GitHub web URL is still something the user typed in full — only bare
+            // `owner/repo` counts as inferred.
+            return buildParsed(`https://github.com/${owner}/${repo}.git`, webRef, webSubpath, false);
         }
     }
     // SSH ssh:// form: ssh://git@host/path[#ref[:subpath]]
     if (trimmed.startsWith('ssh://')) {
         const { base, ref, subpath } = splitFragment(trimmed);
-        return buildParsed(base, ref, subpath);
+        return buildParsed(base, ref, subpath, false);
     }
     // SSH scp-like form: git@host:owner/repo.git[#ref[:subpath]]
     // Anchored, no alternation with nested quantifiers — safe from ReDoS.
     if (/^[^@\s]+@[^:\s]+:[^#\s]+/.test(trimmed)) {
         const { base, ref, subpath } = splitFragment(trimmed);
-        return buildParsed(base, ref, subpath);
+        return buildParsed(base, ref, subpath, false);
     }
-    // GitHub shorthand: owner/repo[#ref[:subpath]] (single slash in base)
+    // GitHub shorthand: owner/repo[#ref[:subpath]] (single slash in base).
+    // NOTE: this pattern is deliberately a superset of the stricter one in
+    // `isGitUrl` (it also admits `.` inside a segment). `isGitUrl` gates every
+    // call site, so it is the effective definition of "shorthand" in practice;
+    // the two must stay in the isGitUrl ⊆ parseGitUrl direction, or an input
+    // routed here as a URL would fall through to the "Invalid git URL" throw.
     const { base, ref, subpath } = splitFragment(trimmed);
     const shorthand = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(base);
     if (shorthand) {
         const owner = shorthand[1] ?? '';
         const repo = shorthand[2] ?? '';
-        return buildParsed(`https://github.com/${owner}/${repo}.git`, ref, subpath);
+        return buildParsed(`https://github.com/${owner}/${repo}.git`, ref, subpath, true);
     }
     throw new Error(`Invalid git URL or path: ${input}. Accepted forms: ` +
         `https://<host>/<owner>/<repo>.git, ` +
         `git@<host>:<owner>/<repo>.git, ` +
         `<owner>/<repo>, or a local filesystem path.`);
 }
-function buildParsed(cloneUrl, ref, subpath) {
-    const result = { cloneUrl };
+function buildParsed(cloneUrl, ref, subpath, inferredFromShorthand) {
+    const result = { cloneUrl, inferredFromShorthand };
     if (ref !== undefined && ref !== '')
         result.ref = ref;
     if (subpath !== undefined && subpath !== '')
         result.subpath = subpath;
     return result;
 }
+/**
+ * Credential-prompt overrides for cloning `parsed`.
+ *
+ * **Only inferred shorthand gets them.** A user who typed a full
+ * `https://…` URL for a private repo may legitimately intend to authenticate
+ * interactively, and silently disabling that would break a real workflow. A
+ * user who typed `owner/repo` and got it wrong should fail in milliseconds
+ * instead of sitting on a credential prompt for a minute.
+ *
+ * Why this exact set (verified against git 2.50.1 with `git credential fill`):
+ *
+ * - `GIT_TERMINAL_PROMPT=0` — suppresses git's own TTY prompt. On its own it is
+ *   **not** sufficient: `gitcredentials(7)` consults `GIT_ASKPASS`, then
+ *   `core.askPass`, then `SSH_ASKPASS`, and only prompts on the terminal if all
+ *   three are unset. Each askpass hook therefore bypasses this flag entirely —
+ *   which is exactly the case inside VS Code's integrated terminal, where
+ *   `GIT_ASKPASS` points at a GUI prompt.
+ * - `GIT_ASKPASS=''` — `getenv()` returns a non-NULL empty string, so git stops
+ *   walking the askpass chain *and* runs nothing, masking `core.askPass` and
+ *   `SSH_ASKPASS` in one move.
+ * - `SSH_ASKPASS=''` and `-c core.askPass=` — belt and braces for the same
+ *   chain, because an empty-valued environment variable is not reliably
+ *   distinguishable from an unset one on Windows. `-c` is used rather than
+ *   `GIT_CONFIG_*` precisely because `-c` is additive: writing
+ *   `GIT_CONFIG_COUNT` would silently clobber an overlay the caller supplied
+ *   (VAT's own tests use `GIT_CONFIG_*` to rewrite remotes via `insteadOf`).
+ * - `GCM_INTERACTIVE=never` — git's flags cannot reach a credential *helper*
+ *   that opens its own UI. Git Credential Manager (the default on Git for
+ *   Windows) is the common one; `never` still lets it serve a cached
+ *   credential, it only forbids escalating to a prompt.
+ *
+ * What is deliberately **not** here: nothing resets `credential.helper` and
+ * nothing sets `GIT_CONFIG_NOSYSTEM`. A helper holding a valid token is how a
+ * private repo typed as shorthand still clones successfully; the goal is to
+ * forbid *interaction*, not authentication.
+ */
+export function nonInteractiveGitOverrides(parsed) {
+    if (!parsed.inferredFromShorthand) {
+        return { env: {}, configArgs: [] };
+    }
+    return {
+        env: {
+            GIT_TERMINAL_PROMPT: '0',
+            GIT_ASKPASS: '',
+            SSH_ASKPASS: '',
+            GCM_INTERACTIVE: 'never',
+        },
+        configArgs: ['-c', 'core.askPass='],
+    };
+}
 /**
  * Detect whether a string should be treated as a git URL (for the polymorphic
  * `[git-url-or-path]` audit argument). True for:

package/dist/git-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-url.js","sourceRoot":"","sources":["../src/git-url.ts"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IACD,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;QAClC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,oBAAoB;IACpB,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,yDAAyD;IACzD,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QAED,uEAAuE;QACvE,MAAM,KAAK;QACT,mLAAmL;QACnL,yFAAyF,CAAC,IAAI,CAC5F,OAAO,CACR,CAAC;QACJ,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,WAAW,CAAC,sBAAsB,KAAK,IAAI,IAAI,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,6DAA6D;IAC7D,sEAAsE;IACtE,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,sEAAsE;IACtE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,WAAW,CAAC,sBAAsB,KAAK,IAAI,IAAI,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,KAAK,CACb,4BAA4B,KAAK,oBAAoB;QACnD,qCAAqC;QACrC,iCAAiC;QACjC,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,GAAY,EAAE,OAAgB;IACnE,MAAM,MAAM,GAAiB,EAAE,QAAQ,EAAE,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,mEAAmE;IACnE,uEAAuE;IACvE,sEAAsE;IACtE,2DAA2D;IAC3D,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,yEAAyE;IACzE,qEAAqE;IACrE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtE,OAAO,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"git-url.js","sourceRoot":"","sources":["../src/git-url.ts"],"names":[],"mappings":"AAuCA;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IACD,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;QAClC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,oBAAoB;IACpB,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,yDAAyD;IACzD,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QAED,uEAAuE;QACvE,MAAM,KAAK;QACT,mLAAmL;QACnL,yFAAyF,CAAC,IAAI,CAC5F,OAAO,CACR,CAAC;QACJ,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,yEAAyE;YACzE,mCAAmC;YACnC,OAAO,WAAW,CAAC,sBAAsB,KAAK,IAAI,IAAI,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,6DAA6D;IAC7D,sEAAsE;IACtE,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,WAAW,CAAC,sBAAsB,KAAK,IAAI,IAAI,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,IAAI,KAAK,CACb,4BAA4B,KAAK,oBAAoB;QACnD,qCAAqC;QACrC,iCAAiC;QACjC,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,QAAgB,EAChB,GAAuB,EACvB,OAA2B,EAC3B,qBAA8B;IAE9B,MAAM,MAAM,GAAiB,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IACjE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAoB;IAC7D,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAClC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IACD,OAAO;QACL,GAAG,EAAE;YACH,mBAAmB,EAAE,GAAG;YACxB,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,EAAE;YACf,eAAe,EAAE,OAAO;SACzB;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,mEAAmE;IACnE,uEAAuE;IACvE,sEAAsE;IACtE,2DAA2D;IAC3D,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,yEAAyE;IACzE,qEAAqE;IACrE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtE,OAAO,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC"}

package/dist/index.d.ts

@@ -8,6 +8,7 @@ export * from './safe-exec.js';
 export * from './windows-shell.js';
 export * from './spawn-hardened.js';
 export * from './path-utils.js';
+export * from './stdio-blocking.js';
 export * from './asset-reference.js';
 export * from './fs-utils.js';
 export * from './file-crawler.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,gBAAgB,CAAC;AAG/B,cAAc,oBAAoB,CAAC;AAGnC,cAAc,qBAAqB,CAAC;AAGpC,cAAc,iBAAiB,CAAC;AAGhC,cAAc,sBAAsB,CAAC;AAGrC,cAAc,eAAe,CAAC;AAG9B,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,cAAc,CAAC;AAG7B,cAAc,gBAAgB,CAAC;AAI/B,cAAc,oBAAoB,CAAC;AAGnC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,eAAe,CAAC;AAG9B,cAAc,oBAAoB,CAAC;AAInC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,uBAAuB,EACvB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAG7E,cAAc,uBAAuB,CAAC;AAGtC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,gBAAgB,CAAC;AAG/B,cAAc,oBAAoB,CAAC;AAGnC,cAAc,qBAAqB,CAAC;AAGpC,cAAc,iBAAiB,CAAC;AAGhC,cAAc,qBAAqB,CAAC;AAGpC,cAAc,sBAAsB,CAAC;AAGrC,cAAc,eAAe,CAAC;AAG9B,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,cAAc,CAAC;AAG7B,cAAc,gBAAgB,CAAC;AAI/B,cAAc,oBAAoB,CAAC;AAGnC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,eAAe,CAAC;AAG9B,cAAc,oBAAoB,CAAC;AAInC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,uBAAuB,EACvB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAG7E,cAAc,uBAAuB,CAAC;AAGtC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,yBAAyB,CAAC"}

package/dist/index.js

@@ -12,6 +12,8 @@ export * from './windows-shell.js';
 export * from './spawn-hardened.js';
 // Cross-platform path utilities
 export * from './path-utils.js';
+// Blocking stdio for published bins (process.exit must not truncate output)
+export * from './stdio-blocking.js';
 // Asset reference resolution (paths + npm bare specifiers)
 export * from './asset-reference.js';
 // Filesystem utilities

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,cAAc,gBAAgB,CAAC;AAE/B,4FAA4F;AAC5F,cAAc,oBAAoB,CAAC;AAEnC,+EAA+E;AAC/E,cAAc,qBAAqB,CAAC;AAEpC,gCAAgC;AAChC,cAAc,iBAAiB,CAAC;AAEhC,2DAA2D;AAC3D,cAAc,sBAAsB,CAAC;AAErC,uBAAuB;AACvB,cAAc,eAAe,CAAC;AAE9B,wCAAwC;AACxC,cAAc,mBAAmB,CAAC;AAElC,sBAAsB;AACtB,cAAc,wBAAwB,CAAC;AAEvC,uEAAuE;AACvE,cAAc,cAAc,CAAC;AAE7B,8CAA8C;AAC9C,cAAc,gBAAgB,CAAC;AAE/B,2DAA2D;AAC3D,iEAAiE;AACjE,cAAc,oBAAoB,CAAC;AAEnC,yDAAyD;AACzD,cAAc,kBAAkB,CAAC;AAEjC,oDAAoD;AACpD,cAAc,mBAAmB,CAAC;AAElC,4CAA4C;AAC5C,cAAc,wBAAwB,CAAC;AAEvC,2DAA2D;AAC3D,cAAc,eAAe,CAAC;AAE9B,oEAAoE;AACpE,cAAc,oBAAoB,CAAC;AAEnC,uDAAuD;AACvD,uEAAuE;AACvE,OAAO,EAKL,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAE7E,2EAA2E;AAC3E,cAAc,uBAAuB,CAAC;AAEtC,oEAAoE;AACpE,cAAc,wBAAwB,CAAC;AAEvC,gDAAgD;AAChD,cAAc,mBAAmB,CAAC;AAElC,8EAA8E;AAC9E,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,cAAc,gBAAgB,CAAC;AAE/B,4FAA4F;AAC5F,cAAc,oBAAoB,CAAC;AAEnC,+EAA+E;AAC/E,cAAc,qBAAqB,CAAC;AAEpC,gCAAgC;AAChC,cAAc,iBAAiB,CAAC;AAEhC,4EAA4E;AAC5E,cAAc,qBAAqB,CAAC;AAEpC,2DAA2D;AAC3D,cAAc,sBAAsB,CAAC;AAErC,uBAAuB;AACvB,cAAc,eAAe,CAAC;AAE9B,wCAAwC;AACxC,cAAc,mBAAmB,CAAC;AAElC,sBAAsB;AACtB,cAAc,wBAAwB,CAAC;AAEvC,uEAAuE;AACvE,cAAc,cAAc,CAAC;AAE7B,8CAA8C;AAC9C,cAAc,gBAAgB,CAAC;AAE/B,2DAA2D;AAC3D,iEAAiE;AACjE,cAAc,oBAAoB,CAAC;AAEnC,yDAAyD;AACzD,cAAc,kBAAkB,CAAC;AAEjC,oDAAoD;AACpD,cAAc,mBAAmB,CAAC;AAElC,4CAA4C;AAC5C,cAAc,wBAAwB,CAAC;AAEvC,2DAA2D;AAC3D,cAAc,eAAe,CAAC;AAE9B,oEAAoE;AACpE,cAAc,oBAAoB,CAAC;AAEnC,uDAAuD;AACvD,uEAAuE;AACvE,OAAO,EAKL,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAE7E,2EAA2E;AAC3E,cAAc,uBAAuB,CAAC;AAEtC,oEAAoE;AACpE,cAAc,wBAAwB,CAAC;AAEvC,gDAAgD;AAChD,cAAc,mBAAmB,CAAC;AAElC,8EAA8E;AAC9E,cAAc,yBAAyB,CAAC"}

package/dist/process.d.ts

@@ -6,5 +6,6 @@
  * the linkAuth, git, skill-testing, or macro-expansion machinery from the
  * full `"."` barrel.
  */
+export { type StdioBlockingResult, makeStdioBlocking, describeStdioBlocking, } from './stdio-blocking.js';
 export { type SafeExecOptions, type SafeExecResult, CommandExecutionError, safeExecSync, safeExecResult, isToolAvailable, getToolVersion, hasShellSyntax, safeExecFromString, } from './safe-exec.js';
 //# sourceMappingURL=process.d.ts.map

package/dist/process.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../src/process.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,kBAAkB,GACnB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../src/process.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,kBAAkB,GACnB,MAAM,gBAAgB,CAAC"}

package/dist/process.js

@@ -6,5 +6,6 @@
  * the linkAuth, git, skill-testing, or macro-expansion machinery from the
  * full `"."` barrel.
  */
+export { makeStdioBlocking, describeStdioBlocking, } from './stdio-blocking.js';
 export { CommandExecutionError, safeExecSync, safeExecResult, isToolAvailable, getToolVersion, hasShellSyntax, safeExecFromString, } from './safe-exec.js';
 //# sourceMappingURL=process.js.map

package/dist/process.js.map

@@ -1 +1 @@
-{"version":3,"file":"process.js","sourceRoot":"","sources":["../src/process.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAGL,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,kBAAkB,GACnB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../src/process.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAEL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAGL,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,kBAAkB,GACnB,MAAM,gBAAgB,CAAC"}

package/dist/skill-targets.d.ts

@@ -19,19 +19,47 @@ interface SkillTargetPaths {
 /**
  * Target → {userRel, projectRel} lookup table.
  *
- * @vendor-claim reviewed=2026-04-08 verify=Each of the seven platforms' own published docs for where it reads skills from (claude, codex, copilot, gemini, cursor, windsurf, agents)
- *
- * Last reviewed against vendor conventions 2026-04-08. Update this table when
- * platforms change theirs — and re-check the vendor's own documentation when you
- * do, because nothing here is verified at build or test time: the tests below
- * assert the table's *shape*, never that a path is where a platform actually
- * looks. A stale entry installs a skill somewhere the target never reads, and
- * every check still passes.
- *
- * (This previously cited docs/plans/2026-04-08-agent-skills-ecosystem-analysis.md
- * as its justification. That file is not in the repository — `docs/plans/` is not
- * tracked — so the citation could not be followed. Recording the review date and
- * the verification gap is honest; pointing at an unreachable document was not.)
+ * @vendor-claim reviewed=2026-07-30 verify=Each of the seven platforms' own published docs for where it reads skills from (claude, codex, copilot, gemini, cursor, windsurf, agents)
+ *
+ * Last reviewed against vendor documentation 2026-07-30: all fourteen paths
+ * re-read from the first-party sources listed below, all fourteen unchanged.
+ * Update this table when platforms change theirs — and re-read those sources when
+ * you do, because nothing here is verified at build or test time. A stale entry
+ * installs a skill somewhere the target never reads, and every check still passes.
+ * The 90-day `@vendor-claim` clock above is the only thing watching these values.
+ *
+ * What the tests actually do: `packages/utils/test/skill-targets.test.ts` derives
+ * its expectations *from* this table and asserts invariants of it — every target
+ * present, both scopes non-empty, relative (never absolute, never a leading `~`),
+ * forward-slash only — plus that resolveSkillTarget composes base + rel. That
+ * verifies the resolver and the table's shape. It cannot verify that any path is
+ * where a platform actually looks; no test can. (An earlier version of that file
+ * restated all fourteen literals a second time. That pinned the values to a
+ * duplicate of this table rather than to vendor reality: a wrong path still
+ * passed, and a *corrected* path broke the suite until someone updated the copy —
+ * a change-detector masquerading as verification, and friction against exactly the
+ * correction the clock above exists to produce.)
+ *
+ * Sources, one per target, re-read 2026-07-30:
+ * - claude   https://code.claude.com/docs/en/skills
+ *            (docs.claude.com/en/docs/claude-code/skills now 301s here)
+ * - codex    https://developers.openai.com/codex/skills/
+ *            (308s to learn.chatgpt.com/docs/build-skills)
+ * - copilot  https://docs.github.com/en/copilot/concepts/agents/about-agent-skills
+ * - gemini   https://github.com/google-gemini/gemini-cli/blob/main/docs/cli/skills.md
+ * - cursor   https://cursor.com/docs/skills (skills shipped in Cursor 2.4)
+ * - windsurf https://docs.windsurf.com/windsurf/cascade/skills
+ *            (307s to docs.devin.ai/desktop/cascade/skills — Devin rebrand)
+ * - agents   https://agentskills.io/client-implementation/adding-skills-support
+ *            (convention, not specification — see AGENTS_SKILLS_PATH above)
+ *
+ * Deliberately non-exhaustive: each row is the ONE directory VAT installs into for
+ * that (target, scope). Most of these targets *read* several directories, which a
+ * 1:1 struct cannot express — so do not read a row as a claim of exclusivity.
+ * Notably `.agents/skills` is read by six of the seven targets (every one except
+ * `claude`), and both `gemini` and `cursor` rank it at or above the client-native
+ * path VAT writes to. Changing where VAT installs is a product decision, not a
+ * comment fix.
  */
 export declare const SKILL_TARGETS: Readonly<Record<SkillTarget, SkillTargetPaths>>;
 /**

package/dist/skill-targets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-targets.d.ts","sourceRoot":"","sources":["../src/skill-targets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,eAAO,MAAM,kBAAkB,mFAQrB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,eAAO,MAAM,iBAAiB,8BAA+B,CAAC;AAE9D,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D,UAAU,gBAAgB;IACxB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAQzE,CAAC;AAUF;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,MAAM,GACV,MAAM,CAgBR"}
+{"version":3,"file":"skill-targets.d.ts","sourceRoot":"","sources":["../src/skill-targets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,eAAO,MAAM,kBAAkB,mFAQrB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,eAAO,MAAM,iBAAiB,8BAA+B,CAAC;AAE9D,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D,UAAU,gBAAgB;IACxB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAQzE,CAAC;AAUF;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,MAAM,GACV,MAAM,CAgBR"}

package/dist/skill-targets.js

@@ -18,24 +18,67 @@ export const SKILL_TARGET_NAMES = [
     'agents',
 ];
 export const SKILL_SCOPE_NAMES = ['user', 'project'];
-/** Shared path used by both codex and agents targets (and their user/project scopes). */
+/**
+ * Shared path used by both codex and agents targets (and their user/project scopes).
+ *
+ * Epistemic status — weaker than the other six rows, deliberately recorded here.
+ * `.agents/skills` is a cross-client *convention*, not a specified path. The Agent
+ * Skills specification defines only what goes *inside* a skill directory and
+ * explicitly declines to say where those directories live. The load-bearing
+ * citation is agentskills.io's client-implementation guide, which calls
+ * `.agents/skills/` "a widely-adopted convention for cross-client skill sharing"
+ * while stating the specification "does not mandate where skill directories live".
+ * Note also what is NOT a citation for this: agents.md says nothing about skills at
+ * all — no `.agents/skills`, no SKILL.md, no discovery paths — so anyone reaching
+ * for it to justify this row is citing a document that does not support it. Every
+ * other target below is documented by that target's own vendor for its own client;
+ * `agents` is documented convention instead.
+ */
 const AGENTS_SKILLS_PATH = '.agents/skills';
 /**
  * Target → {userRel, projectRel} lookup table.
  *
- * @vendor-claim reviewed=2026-04-08 verify=Each of the seven platforms' own published docs for where it reads skills from (claude, codex, copilot, gemini, cursor, windsurf, agents)
+ * @vendor-claim reviewed=2026-07-30 verify=Each of the seven platforms' own published docs for where it reads skills from (claude, codex, copilot, gemini, cursor, windsurf, agents)
+ *
+ * Last reviewed against vendor documentation 2026-07-30: all fourteen paths
+ * re-read from the first-party sources listed below, all fourteen unchanged.
+ * Update this table when platforms change theirs — and re-read those sources when
+ * you do, because nothing here is verified at build or test time. A stale entry
+ * installs a skill somewhere the target never reads, and every check still passes.
+ * The 90-day `@vendor-claim` clock above is the only thing watching these values.
+ *
+ * What the tests actually do: `packages/utils/test/skill-targets.test.ts` derives
+ * its expectations *from* this table and asserts invariants of it — every target
+ * present, both scopes non-empty, relative (never absolute, never a leading `~`),
+ * forward-slash only — plus that resolveSkillTarget composes base + rel. That
+ * verifies the resolver and the table's shape. It cannot verify that any path is
+ * where a platform actually looks; no test can. (An earlier version of that file
+ * restated all fourteen literals a second time. That pinned the values to a
+ * duplicate of this table rather than to vendor reality: a wrong path still
+ * passed, and a *corrected* path broke the suite until someone updated the copy —
+ * a change-detector masquerading as verification, and friction against exactly the
+ * correction the clock above exists to produce.)
  *
- * Last reviewed against vendor conventions 2026-04-08. Update this table when
- * platforms change theirs — and re-check the vendor's own documentation when you
- * do, because nothing here is verified at build or test time: the tests below
- * assert the table's *shape*, never that a path is where a platform actually
- * looks. A stale entry installs a skill somewhere the target never reads, and
- * every check still passes.
+ * Sources, one per target, re-read 2026-07-30:
+ * - claude   https://code.claude.com/docs/en/skills
+ *            (docs.claude.com/en/docs/claude-code/skills now 301s here)
+ * - codex    https://developers.openai.com/codex/skills/
+ *            (308s to learn.chatgpt.com/docs/build-skills)
+ * - copilot  https://docs.github.com/en/copilot/concepts/agents/about-agent-skills
+ * - gemini   https://github.com/google-gemini/gemini-cli/blob/main/docs/cli/skills.md
+ * - cursor   https://cursor.com/docs/skills (skills shipped in Cursor 2.4)
+ * - windsurf https://docs.windsurf.com/windsurf/cascade/skills
+ *            (307s to docs.devin.ai/desktop/cascade/skills — Devin rebrand)
+ * - agents   https://agentskills.io/client-implementation/adding-skills-support
+ *            (convention, not specification — see AGENTS_SKILLS_PATH above)
  *
- * (This previously cited docs/plans/2026-04-08-agent-skills-ecosystem-analysis.md
- * as its justification. That file is not in the repository — `docs/plans/` is not
- * tracked — so the citation could not be followed. Recording the review date and
- * the verification gap is honest; pointing at an unreachable document was not.)
+ * Deliberately non-exhaustive: each row is the ONE directory VAT installs into for
+ * that (target, scope). Most of these targets *read* several directories, which a
+ * 1:1 struct cannot express — so do not read a row as a claim of exclusivity.
+ * Notably `.agents/skills` is read by six of the seven targets (every one except
+ * `claude`), and both `gemini` and `cursor` rank it at or above the client-native
+ * path VAT writes to. Changing where VAT installs is a product decision, not a
+ * comment fix.
  */
 export const SKILL_TARGETS = {
     claude: { userRel: '.claude/skills', projectRel: '.claude/skills' },

package/dist/skill-targets.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-targets.js","sourceRoot":"","sources":["../src/skill-targets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,QAAQ;CACA,CAAC;AAIX,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,SAAS,CAAU,CAAC;AAW9D,yFAAyF;AACzF,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAoD;IAC5E,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,gBAAgB,EAAE;IACnE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,kBAAkB,EAAE;IACtE,OAAO,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,gBAAgB,EAAE;IACrE,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,gBAAgB,EAAE;IACnE,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,gBAAgB,EAAE;IACnE,QAAQ,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,UAAU,EAAE,kBAAkB,EAAE;IACjF,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,kBAAkB,EAAE;CACxE,CAAC;AAEF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAQ,iBAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAmB,EACnB,KAAiB,EACjB,GAAW;IAEX,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,CAAC,MAAM,CAAC,qBAAqB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,kBAAkB,MAAM,CAAC,KAAK,CAAC,oBAAoB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,MAAM,GAAG,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IAChE,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"skill-targets.js","sourceRoot":"","sources":["../src/skill-targets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,QAAQ;CACA,CAAC;AAIX,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,SAAS,CAAU,CAAC;AAW9D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,MAAM,aAAa,GAAoD;IAC5E,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,gBAAgB,EAAE;IACnE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,kBAAkB,EAAE;IACtE,OAAO,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,gBAAgB,EAAE;IACrE,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,gBAAgB,EAAE;IACnE,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,gBAAgB,EAAE;IACnE,QAAQ,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,UAAU,EAAE,kBAAkB,EAAE;IACjF,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,kBAAkB,EAAE;CACxE,CAAC;AAEF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAQ,iBAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAmB,EACnB,KAAiB,EACjB,GAAW;IAEX,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,CAAC,MAAM,CAAC,qBAAqB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,kBAAkB,MAAM,CAAC,KAAK,CAAC,oBAAoB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,MAAM,GAAG,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IAChE,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC"}

package/dist/stdio-blocking.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Make a process's stdio blocking, so `process.exit()` can never discard output.
+ *
+ * Lives in utils rather than in the CLI because it is not CLI-specific: it
+ * belongs to any published bin that writes a payload and then exits. VAT ships
+ * two of those (`vat` and the resource-compiler bin), and the CLI package sits
+ * at the top of the dependency chain — nothing may depend on it — so a bin
+ * outside `packages/cli` could not reach this fix while it lived there.
+ */
+/** Whether each stdio stream was actually switched into blocking mode. */
+export interface StdioBlockingResult {
+    stdout: boolean;
+    stderr: boolean;
+}
+/**
+ * Make stdout/stderr BLOCKING, so that `process.exit()` can never discard output.
+ *
+ * Call once, first thing, from a bin's entry point.
+ *
+ * Node makes a pipe's stdio non-blocking, which is what turns `console.log` and
+ * `process.stdout.write` into buffered, asynchronous writes. `process.exit` does
+ * not drain those buffers, so a command that exits the moment it finishes can
+ * lose whatever had not yet reached the pipe (64 KB on Linux/macOS) — with exit
+ * code 0, so nothing signals the loss. An interactive TTY is unbuffered and
+ * looks perfect, which is why this class of bug survives: it only bites the
+ * piped consumer (`vat command | jq .status`).
+ *
+ * Fixing this at a single YAML writer would cover stdout only. It is done here
+ * because the same truncation applies to STDERR, which carries progress lines
+ * and `file:line:column: severity:` findings, and a report that loses its tail
+ * at 64 KB is worse than one that never printed. One mechanism covers both
+ * streams and every writer, present and future.
+ *
+ * `setBlocking` is the libuv behaviour behind `process.stdout` and the mechanism
+ * Node itself uses for TTYs; it is reached through the stream's INTERNAL handle,
+ * so every access is guarded and a failure is non-fatal — a platform where this
+ * is unavailable keeps the previous behaviour rather than crashing at startup.
+ *
+ * That guard is exactly why this reports back instead of returning `void`.
+ * Depending on an internal API means the silent-failure path is a genuine
+ * possibility — Windows named pipes do not present the same handle shape as
+ * POSIX pipes — and a silent failure here reverts to truncating output with
+ * nothing to distinguish it from a working run. Callers surface the result
+ * under a debug flag so a truncation report can be diagnosed rather than
+ * guessed at. See {@link describeStdioBlocking}.
+ */
+export declare function makeStdioBlocking(): StdioBlockingResult;
+/**
+ * Render {@link makeStdioBlocking}'s result as one debug line.
+ *
+ * Lives next to the thing it describes because every bin that calls
+ * `makeStdioBlocking` reports it, and hand-written copies of the wording
+ * would drift.
+ */
+export declare function describeStdioBlocking(result: StdioBlockingResult): string;
+//# sourceMappingURL=stdio-blocking.d.ts.map

package/dist/stdio-blocking.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio-blocking.d.ts","sourceRoot":"","sources":["../src/stdio-blocking.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CAChB;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,iBAAiB,IAAI,mBAAmB,CAKvD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAMzE"}

package/dist/stdio-blocking.js

@@ -0,0 +1,83 @@
+/**
+ * Make a process's stdio blocking, so `process.exit()` can never discard output.
+ *
+ * Lives in utils rather than in the CLI because it is not CLI-specific: it
+ * belongs to any published bin that writes a payload and then exits. VAT ships
+ * two of those (`vat` and the resource-compiler bin), and the CLI package sits
+ * at the top of the dependency chain — nothing may depend on it — so a bin
+ * outside `packages/cli` could not reach this fix while it lived there.
+ */
+/**
+ * Switch one stream's underlying handle into blocking mode.
+ *
+ * @returns `true` only if `setBlocking` was present AND completed without
+ * throwing. Both failure modes are real: a handle can be absent (stdio replaced,
+ * or a shape libuv does not wrap), and `setBlocking` can throw on a handle type
+ * that does not support it.
+ */
+function setStreamBlocking(stream) {
+    try {
+        const handle = stream._handle;
+        if (typeof handle?.setBlocking !== 'function')
+            return false;
+        handle.setBlocking(true);
+        return true;
+    }
+    catch {
+        // Best-effort: never let a startup nicety take down the process.
+        return false;
+    }
+}
+/**
+ * Make stdout/stderr BLOCKING, so that `process.exit()` can never discard output.
+ *
+ * Call once, first thing, from a bin's entry point.
+ *
+ * Node makes a pipe's stdio non-blocking, which is what turns `console.log` and
+ * `process.stdout.write` into buffered, asynchronous writes. `process.exit` does
+ * not drain those buffers, so a command that exits the moment it finishes can
+ * lose whatever had not yet reached the pipe (64 KB on Linux/macOS) — with exit
+ * code 0, so nothing signals the loss. An interactive TTY is unbuffered and
+ * looks perfect, which is why this class of bug survives: it only bites the
+ * piped consumer (`vat command | jq .status`).
+ *
+ * Fixing this at a single YAML writer would cover stdout only. It is done here
+ * because the same truncation applies to STDERR, which carries progress lines
+ * and `file:line:column: severity:` findings, and a report that loses its tail
+ * at 64 KB is worse than one that never printed. One mechanism covers both
+ * streams and every writer, present and future.
+ *
+ * `setBlocking` is the libuv behaviour behind `process.stdout` and the mechanism
+ * Node itself uses for TTYs; it is reached through the stream's INTERNAL handle,
+ * so every access is guarded and a failure is non-fatal — a platform where this
+ * is unavailable keeps the previous behaviour rather than crashing at startup.
+ *
+ * That guard is exactly why this reports back instead of returning `void`.
+ * Depending on an internal API means the silent-failure path is a genuine
+ * possibility — Windows named pipes do not present the same handle shape as
+ * POSIX pipes — and a silent failure here reverts to truncating output with
+ * nothing to distinguish it from a working run. Callers surface the result
+ * under a debug flag so a truncation report can be diagnosed rather than
+ * guessed at. See {@link describeStdioBlocking}.
+ */
+export function makeStdioBlocking() {
+    return {
+        stdout: setStreamBlocking(process.stdout),
+        stderr: setStreamBlocking(process.stderr),
+    };
+}
+/**
+ * Render {@link makeStdioBlocking}'s result as one debug line.
+ *
+ * Lives next to the thing it describes because every bin that calls
+ * `makeStdioBlocking` reports it, and hand-written copies of the wording
+ * would drift.
+ */
+export function describeStdioBlocking(result) {
+    const failed = ['stdout', 'stderr'].filter((name) => !result[name]);
+    if (failed.length === 0) {
+        return 'stdio: stdout and stderr are blocking; process.exit cannot truncate output';
+    }
+    return `stdio: could NOT make ${failed.join(' and ')} blocking — output on ${failed.length === 1 ? 'that stream' : 'those streams'} may be truncated at the pipe buffer when the CLI exits`;
+}
+//# sourceMappingURL=stdio-blocking.js.map

package/dist/stdio-blocking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio-blocking.js","sourceRoot":"","sources":["../src/stdio-blocking.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,MAA0B;IACpD,IAAI,CAAC;QACJ,MAAM,MAAM,GACX,MACA,CAAC,OAAO,CAAC;QACV,IAAI,OAAO,MAAM,EAAE,WAAW,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QAC5D,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,iEAAiE;QACjE,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,iBAAiB;IAChC,OAAO;QACN,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC;QACzC,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC;KACzC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA2B;IAChE,MAAM,MAAM,GAAI,CAAC,QAAQ,EAAE,QAAQ,CAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,4EAA4E,CAAC;IACrF,CAAC;IACD,OAAO,yBAAyB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,yDAAyD,CAAC;AAC7L,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-agent-toolkit/utils",
-  "version": "0.1.41-rc.7",
+  "version": "0.1.41",
   "type": "module",
   "description": "Core utility functions shared across the vibe-agent-toolkit packages",
   "sideEffects": false,