@vibe-agent-toolkit/utils 0.2.0-rc.1 → 0.2.0-rc.10

package/dist/process.d.ts

@@ -10,5 +10,12 @@
 export { type StdioBlockingResult, makeStdioBlocking, describeStdioBlocking, } from './stdio-blocking.js';
 export { type SafeExecOptions, type SafeExecResult, CommandExecutionError, safeExecSync, safeExecResult, isToolAvailable, getToolVersion, hasShellSyntax, safeExecFromString, } from './safe-exec.js';
 export { spawnHardened } from './spawn-hardened.js';
+/**
+ * On `./process` because "is this process running me as its entry script?" is a
+ * question about the process, and because every package that has a bin or a
+ * build script needs it — including ones that must not depend on the private
+ * `dev-tools` package, which is where it used to live.
+ */
+export { isEntrypoint } from './entrypoint.js';
 export { shouldUseShell, windowsShellQuote, buildWindowsShellLine, isPathLike, resolveShellCommandToken, } from './windows-shell.js';
 //# sourceMappingURL=process.d.ts.map

package/dist/process.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../src/process.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,wBAAwB,GACzB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../src/process.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,wBAAwB,GACzB,MAAM,oBAAoB,CAAC"}

package/dist/process.js

@@ -10,5 +10,12 @@
 export { makeStdioBlocking, describeStdioBlocking, } from './stdio-blocking.js';
 export { CommandExecutionError, safeExecSync, safeExecResult, isToolAvailable, getToolVersion, hasShellSyntax, safeExecFromString, } from './safe-exec.js';
 export { spawnHardened } from './spawn-hardened.js';
+/**
+ * On `./process` because "is this process running me as its entry script?" is a
+ * question about the process, and because every package that has a bin or a
+ * build script needs it — including ones that must not depend on the private
+ * `dev-tools` package, which is where it used to live.
+ */
+export { isEntrypoint } from './entrypoint.js';
 export { shouldUseShell, windowsShellQuote, buildWindowsShellLine, isPathLike, resolveShellCommandToken, } from './windows-shell.js';
 //# sourceMappingURL=process.js.map

package/dist/process.js.map

@@ -1 +1 @@
-{"version":3,"file":"process.js","sourceRoot":"","sources":["../src/process.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAEL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAGL,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,wBAAwB,GACzB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../src/process.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAEL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAGL,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,wBAAwB,GACzB,MAAM,oBAAoB,CAAC"}

package/dist/project-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-utils.d.ts","sourceRoot":"","sources":["../src/project-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmBrE;AAgBD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAG7C;AAoED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK/D"}
+{"version":3,"file":"project-utils.d.ts","sourceRoot":"","sources":["../src/project-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyBrE;AAgBD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAG7C;AAkED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK/D"}

package/dist/project-utils.js

@@ -6,10 +6,12 @@
  * fallbacks — a caller with no root must decide one rather than silently
  * falling back to an absolute path.
  */
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { dirname, parse } from 'node:path';
+import { isPathAbsentError } from './errors/errno.js';
 import { resetGitRootCache } from './git-root-cache.js';
 import { safePath } from './path-utils.js';
+import { readTextContentSync } from './text-file.js';
 const CONFIG_FILENAME = 'vibe-agent-toolkit.config.yaml';
 const PACKAGE_JSON_FILENAME = 'package.json';
 /**
@@ -26,7 +28,6 @@ export function findConfigFile(startDir) {
     const root = parse(current).root;
     while (true) {
         const candidate = safePath.join(current, CONFIG_FILENAME);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- walk-up is intentional
         if (existsSync(candidate))
             return candidate;
         if (current === root)
@@ -51,17 +52,24 @@ export function findNodeWorkspaceRoot(startDir) {
     let current = safePath.resolve(startDir);
     while (current !== dirname(current)) {
         const pkgPath = safePath.join(current, PACKAGE_JSON_FILENAME);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- walk-up is intentional
         if (existsSync(pkgPath)) {
             try {
-                // eslint-disable-next-line security/detect-non-literal-fs-filename -- walk-up is intentional
-                const parsed = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+                // Through the decoding seam: this is the ADOPTER's manifest, not ours,
+                // and a UTF-8 BOM in front of `{` makes `JSON.parse` throw — which the
+                // `catch` below would silently report as "not the workspace root".
+                const parsed = JSON.parse(readTextContentSync(pkgPath).text);
                 if (typeof parsed === 'object' && parsed !== null && 'workspaces' in parsed) {
                     return current;
                 }
             }
-            catch {
-                // Invalid JSON — skip and continue walking up.
+            catch (error) {
+                // Not JSON: not a manifest this walk can read, so skip it and keep
+                // walking up. Gone between `existsSync` and the read counts the same. A
+                // manifest the OS refused (`EACCES`), or a directory named
+                // `package.json` (`EISDIR`), is neither — reading past it would make
+                // the walk settle on the WRONG root, silently.
+                if (!(error instanceof SyntaxError) && !isPathAbsentError(error))
+                    throw error;
             }
         }
         current = dirname(current);
@@ -123,7 +131,6 @@ function configWalkPhase(startDir, visited) {
             return { kind: 'found', configRoot: cached.configRoot };
         }
         visited.push(current);
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- walk-up is intentional
         if (existsSync(safePath.join(current, CONFIG_FILENAME))) {
             const entry = { configRoot: current };
             propagateCache(visited, entry);
@@ -143,7 +150,6 @@ function configWalkPhase(startDir, visited) {
 function gitWalkPhase(startDir, visited) {
     let current = safePath.resolve(startDir);
     while (true) {
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- walk-up is intentional
         if (existsSync(safePath.join(current, '.git'))) {
             const entry = { configRoot: current };
             propagateCache(visited, entry);

package/dist/project-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-utils.js","sourceRoot":"","sources":["../src/project-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,MAAM,eAAe,GAAG,gCAAgC,CAAC;AACzD,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACjC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC1D,6FAA6F;QAC7F,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAC9D,6FAA6F;QAC7F,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,6FAA6F;gBAC7F,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACnE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;oBAC5E,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,+CAA+C;YACjD,CAAC;QACH,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,GAA+C,IAAI,GAAG,EAAE,CAAC;AAE1E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB;IACpC,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,iBAAiB,EAAE,CAAC;AACtB,CAAC;AAED,iEAAiE;AACjE,SAAS,cAAc,CAAC,OAA8B,EAAE,KAAoC;IAC1F,KAAK,MAAM,GAAG,IAAI,OAAO;QAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CACtB,QAAgB,EAChB,OAAiB;IAEjB,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEtB,6FAA6F;QAC7F,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YACtC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACrD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAAgB,EAAE,OAA8B;IACpE,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,IAAI,EAAE,CAAC;QACZ,6FAA6F;QAC7F,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YACtC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,cAAc,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC,UAAU,CAAC;IAChE,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"project-utils.js","sourceRoot":"","sources":["../src/project-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,eAAe,GAAG,gCAAgC,CAAC;AACzD,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACjC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC1D,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAC9D,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,uEAAuE;gBACvE,uEAAuE;gBACvE,mEAAmE;gBACnE,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;oBAC5E,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,mEAAmE;gBACnE,wEAAwE;gBACxE,2DAA2D;gBAC3D,qEAAqE;gBACrE,+CAA+C;gBAC/C,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;YAChF,CAAC;QACH,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,GAA+C,IAAI,GAAG,EAAE,CAAC;AAE1E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB;IACpC,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,iBAAiB,EAAE,CAAC;AACtB,CAAC;AAED,iEAAiE;AACjE,SAAS,cAAc,CAAC,OAA8B,EAAE,KAAoC;IAC1F,KAAK,MAAM,GAAG,IAAI,OAAO;QAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CACtB,QAAgB,EAChB,OAAiB;IAEjB,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEtB,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YACtC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACrD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAAgB,EAAE,OAA8B;IACpE,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YACtC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,cAAc,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC,UAAU,CAAC;IAChE,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC"}

package/dist/project.d.ts

@@ -14,11 +14,13 @@
  * they largely are not, for the reasons documented on the guard test in
  * `test/package-exports.test.ts`. But the question that decides whether an entry
  * should exist is "how heavy is the only remaining door?" With `./project` gone,
- * the sole route to these functions was the `.` barrel, which reaches
- * `handlebars`, `yaml`, `picomatch`, `ignore` and `which`. A consumer that avoids
- * the barrel on graph-weight grounds — which is the entire premise of this
- * package's subpath layout — could no longer reach a capability whose own code
- * imports nothing but `node:fs` and `node:path`.
+ * the sole route to these functions was the `.` barrel, which at the time reached
+ * five third-party packages. A consumer that avoids the barrel on graph-weight
+ * grounds — which is the entire premise of this package's subpath layout — could
+ * no longer reach a capability whose own code imports nothing but `node:fs` and
+ * `node:path`. The barrel is dependency-free today, which generalizes the
+ * argument rather than retiring it: every domain that carries weight is its own
+ * entry, and reaching a pure one must not cost a neighbour's graph.
  *
  * The functions remain VAT-shaped and are documented as such in README.md: they
  * look for `vibe-agent-toolkit.config.yaml`, then `.git/`. If your notion of a

package/dist/project.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}

package/dist/project.js

@@ -14,11 +14,13 @@
  * they largely are not, for the reasons documented on the guard test in
  * `test/package-exports.test.ts`. But the question that decides whether an entry
  * should exist is "how heavy is the only remaining door?" With `./project` gone,
- * the sole route to these functions was the `.` barrel, which reaches
- * `handlebars`, `yaml`, `picomatch`, `ignore` and `which`. A consumer that avoids
- * the barrel on graph-weight grounds — which is the entire premise of this
- * package's subpath layout — could no longer reach a capability whose own code
- * imports nothing but `node:fs` and `node:path`.
+ * the sole route to these functions was the `.` barrel, which at the time reached
+ * five third-party packages. A consumer that avoids the barrel on graph-weight
+ * grounds — which is the entire premise of this package's subpath layout — could
+ * no longer reach a capability whose own code imports nothing but `node:fs` and
+ * `node:path`. The barrel is dependency-free today, which generalizes the
+ * argument rather than retiring it: every domain that carries weight is its own
+ * entry, and reaching a pure one must not cost a neighbour's graph.
  *
  * The functions remain VAT-shaped and are documented as such in README.md: they
  * look for `vibe-agent-toolkit.config.yaml`, then `.git/`. If your notion of a

package/dist/project.js.map

@@ -1 +1 @@
-{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}

package/dist/safe-exec.d.ts

@@ -1,3 +1,4 @@
+import { VatError } from './errors/vat-error.js';
 /**
  * Options for safe command execution
  */
@@ -6,7 +7,12 @@ export interface SafeExecOptions {
     encoding?: BufferEncoding;
     /** Standard I/O configuration */
     stdio?: 'pipe' | 'ignore' | 'inherit' | Array<'pipe' | 'ignore' | 'inherit'>;
-    /** Environment variables (merged with process.env if not fully specified) */
+    /**
+     * The child's complete environment. It **replaces** `process.env` rather than
+     * merging with it, so a partial object is a partial environment — build one
+     * by spreading (`{ ...process.env, ... }`). A `git` child cannot get here at
+     * all — `runGit()` owns that, and this function refuses it.
+     */
     env?: NodeJS.ProcessEnv;
     /** Working directory */
     cwd?: string;
@@ -14,6 +20,24 @@ export interface SafeExecOptions {
     maxBuffer?: number;
     /** Timeout in milliseconds */
     timeout?: number;
+    /**
+     * Run `git` here instead of refusing it — for an argv the **operator supplied**
+     * rather than one VAT composed.
+     *
+     * {@link refuseGit} exists because only the caller knows whether a git command
+     * means the path it was handed or the repository it stands in, and VAT's own
+     * call sites must say. That reasoning does not reach a command a user
+     * configured: VAT neither composed it nor knows what it means, and refusing it
+     * blocks a legitimate configuration rather than preventing a mistake.
+     *
+     * ⚠️ Setting this makes the git environment **your** problem. The one caller
+     * that does — `link-auth`'s `defaultRunCommand` — strips every `GIT_*` key
+     * case-insensitively before spawning, which is stricter than {@link runGit}'s
+     * targeted scrub, not looser. Do not set it to silence the error.
+     *
+     * @default false
+     */
+    allowGit?: boolean;
 }
 /**
  * Result of a safe command execution
@@ -33,7 +57,7 @@ export interface SafeExecResult {
 /**
  * Error thrown when command execution fails
  */
-export declare class CommandExecutionError extends Error {
+export declare class CommandExecutionError extends VatError {
     readonly status: number;
     readonly stdout: Buffer | string;
     readonly stderr: Buffer | string;
@@ -46,7 +70,11 @@ export declare class CommandExecutionError extends Error {
  * - Resolves PATH once using pure Node.js (which package)
  * - Executes with absolute path and shell: false
  * - No shell interpreter = no command injection risk
- * - Supports custom env vars (e.g., GIT_INDEX_FILE)
+ * - Supports custom env vars
+ *
+ * ⛔ **Not for `git`** — it throws. "Safe" here means shell-injection-safe and
+ * says nothing about `GIT_DIR`/`GIT_INDEX_FILE`, which silently decide which
+ * repository a git command answers about. Use `runGit()`.
  *
  * @param command - Command name (e.g., 'git', 'gitleaks', 'node')
  * @param args - Array of arguments
@@ -59,14 +87,11 @@ export declare class CommandExecutionError extends Error {
  * safeExecSync('gitleaks', ['--version'], { stdio: 'ignore' });
  *
  * @example
- * // Git with custom env
- * safeExecSync('git', ['add', '--all'], {
- *   env: { ...process.env, GIT_INDEX_FILE: tempFile }
- * });
- *
- * @example
  * // Get output as string
  * const version = safeExecSync('node', ['--version'], { encoding: 'utf8' });
+ *
+ * @throws {Error} When `command` is git — use `runGit()` instead, which owns the
+ *   inherited-environment problem this helper cannot see
  */
 export declare function safeExecSync(command: string, args?: string[], options?: SafeExecOptions): Buffer | string;
 /**
@@ -81,12 +106,14 @@ export declare function safeExecSync(command: string, args?: string[], options?:
  * @returns Detailed execution result
  *
  * @example
- * const result = safeExecResult('git', ['status']);
+ * const result = safeExecResult('gh', ['pr', 'list']);
  * if (result.success) {
  *   console.log(result.stdout.toString());
  * } else {
  *   console.error(`Failed: ${result.stderr.toString()}`);
  * }
+ *
+ * @throws {Error} When `command` is git — use `runGit()` instead
  */
 export declare function safeExecResult(command: string, args?: string[], options?: SafeExecOptions): SafeExecResult;
 /**
@@ -183,9 +210,11 @@ export declare function hasShellSyntax(commandString: string): {
  * @example
  * ```typescript
  * // ✅ Simple commands (these work)
- * safeExecFromString('git status');
  * safeExecFromString('pnpm test --watch');
  * safeExecFromString('gh pr view 123');
+ *
+ * // ❌ git is refused here too — the string form is not a back door around
+ * //    the chokepoint. Use runGit(['status'], { cwd }).
  * ```
  *
  * @example

package/dist/safe-exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safe-exec.d.ts","sourceRoot":"","sources":["../src/safe-exec.ts"],"names":[],"mappings":"AAUA;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC7E,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,qBAAqB;IACrB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC,SAAgB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;gBAGtC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,MAAM,EAAE,MAAM,GAAG,MAAM;CAQ1B;AA2CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,eAAoB,GAC5B,MAAM,GAAG,MAAM,CAmBjB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,eAAoB,GAC5B,cAAc,CA4BhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAOzD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,MAAoB,GAC/B,MAAM,GAAG,IAAI,CAUf;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG;IACrD,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CA0CA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,eAAoB,GAC5B,MAAM,GAAG,MAAM,CAyBjB"}
+{"version":3,"file":"safe-exec.d.ts","sourceRoot":"","sources":["../src/safe-exec.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAQjD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,qBAAqB;IACrB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,QAAQ;IACjD,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC,SAAgB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;gBAGtC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,MAAM,EAAE,MAAM,GAAG,MAAM;CAO1B;AAgFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,eAAoB,GAC5B,MAAM,GAAG,MAAM,CAmBjB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,eAAoB,GAC5B,cAAc,CAkChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CASzD;AA+CD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,MAAoB,GAC/B,MAAM,GAAG,IAAI,CAEf;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG;IACrD,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CA0CA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,eAAoB,GAC5B,MAAM,GAAG,MAAM,CAyBjB"}

package/dist/safe-exec.js

@@ -1,21 +1,55 @@
 import { spawnSync } from 'node:child_process';
 import which from 'which';
+import { isPathAbsentError } from './errors/errno.js';
+import { VatError } from './errors/vat-error.js';
+import { runGit } from './git-run.js';
 import { buildWindowsShellLine, resolveShellCommandToken, shouldUseShell, } from './windows-shell.js';
 /**
  * Error thrown when command execution fails
  */
-export class CommandExecutionError extends Error {
+export class CommandExecutionError extends VatError {
     status;
     stdout;
     stderr;
     constructor(message, status, stdout, stderr) {
-        super(message);
-        this.name = 'CommandExecutionError';
+        super('COMMAND_EXECUTION', message);
         this.status = status;
         this.stdout = stdout;
         this.stderr = stderr;
     }
 }
+/**
+ * Refuse `git` here, and say where it belongs.
+ *
+ * "Safe" in this module's name has always meant *shell-injection*-safe: PATH
+ * resolved once, no shell interpreter. It says nothing about the environment,
+ * and `git` is the one command for which the environment silently decides which
+ * repository the answer describes — `GIT_DIR` and `GIT_INDEX_FILE`, exported
+ * into every child of a `git` hook, override the `cwd` passed here. The failure
+ * is a well-formed answer about the wrong repository at exit 0, so no caller
+ * discovers it by testing.
+ *
+ * A refusal rather than a silent scrub, because the two meanings are not
+ * interchangeable: only the caller knows whether it means the path it passed or
+ * the repository it stands in, and guessing on their behalf would be wrong half
+ * the time in a way nothing reports. {@link runGit} makes them say.
+ *
+ * @param command - The command about to be spawned
+ * @throws {Error} When the command is git
+ */
+function isGitCommand(command) {
+    const name = command.toLowerCase().replace(/\.(exe|cmd)$/, '');
+    return name === 'git' || name.endsWith('/git') || name.endsWith(String.raw `\git`);
+}
+function refuseGit(command) {
+    if (!isGitCommand(command))
+        return;
+    throw new Error('Use runGit() from @vibe-agent-toolkit/utils/git to run git, not safeExecSync/safeExecResult.\n' +
+        "  runGit(args, { cwd })                 — about a path you were handed (scrubs the inherited\n" +
+        '                                          GIT_DIR/GIT_INDEX_FILE that would override cwd)\n' +
+        '  runGit(args, { ambient: true })       — about the repository this process stands in\n' +
+        'Inside a git hook the difference decides which repository you read — or write.');
+}
 /**
  * Resolve command, build spawn options, and execute via spawnSync.
  *
@@ -31,6 +65,8 @@ export class CommandExecutionError extends Error {
  * value. Passing the raw command here used to break silently on `C:\Program Files\…`.
  */
 function resolveAndSpawn(command, args, options) {
+    if (options.allowGit !== true)
+        refuseGit(command);
     const commandPath = which.sync(command);
     const useShell = shouldUseShell(commandPath);
     const spawnOptions = {
@@ -46,7 +82,6 @@ function resolveAndSpawn(command, args, options) {
         return spawnSync(commandPath, args, spawnOptions);
     }
     const shellLine = buildWindowsShellLine(resolveShellCommandToken(command, commandPath), args);
-    // eslint-disable-next-line sonarjs/os-command -- Windows DEP0190 workaround: command resolved via which.sync(); args are per-arg shell-quoted via windowsShellQuote()
     return spawnSync(shellLine, { ...spawnOptions, shell: true });
 }
 /**
@@ -56,7 +91,11 @@ function resolveAndSpawn(command, args, options) {
  * - Resolves PATH once using pure Node.js (which package)
  * - Executes with absolute path and shell: false
  * - No shell interpreter = no command injection risk
- * - Supports custom env vars (e.g., GIT_INDEX_FILE)
+ * - Supports custom env vars
+ *
+ * ⛔ **Not for `git`** — it throws. "Safe" here means shell-injection-safe and
+ * says nothing about `GIT_DIR`/`GIT_INDEX_FILE`, which silently decide which
+ * repository a git command answers about. Use `runGit()`.
  *
  * @param command - Command name (e.g., 'git', 'gitleaks', 'node')
  * @param args - Array of arguments
@@ -69,14 +108,11 @@ function resolveAndSpawn(command, args, options) {
  * safeExecSync('gitleaks', ['--version'], { stdio: 'ignore' });
  *
  * @example
- * // Git with custom env
- * safeExecSync('git', ['add', '--all'], {
- *   env: { ...process.env, GIT_INDEX_FILE: tempFile }
- * });
- *
- * @example
  * // Get output as string
  * const version = safeExecSync('node', ['--version'], { encoding: 'utf8' });
+ *
+ * @throws {Error} When `command` is git — use `runGit()` instead, which owns the
+ *   inherited-environment problem this helper cannot see
  */
 export function safeExecSync(command, args = [], options = {}) {
     const result = resolveAndSpawn(command, args, options);
@@ -102,14 +138,22 @@ export function safeExecSync(command, args = [], options = {}) {
  * @returns Detailed execution result
  *
  * @example
- * const result = safeExecResult('git', ['status']);
+ * const result = safeExecResult('gh', ['pr', 'list']);
  * if (result.success) {
  *   console.log(result.stdout.toString());
  * } else {
  *   console.error(`Failed: ${result.stderr.toString()}`);
  * }
+ *
+ * @throws {Error} When `command` is git — use `runGit()` instead
  */
 export function safeExecResult(command, args = [], options = {}) {
+    // Deliberately OUTSIDE the try: this is a programming error to fix at the call
+    // site, not a command that failed. Folded into the result it would read as
+    // "git is unavailable" and callers that treat a failure as information — most
+    // of them — would carry on silently.
+    if (options.allowGit !== true)
+        refuseGit(command);
     try {
         const result = resolveAndSpawn(command, args, options);
         const status = result.status ?? -1;
@@ -148,12 +192,61 @@ export function safeExecResult(command, args = [], options = {}) {
  * }
  */
 export function isToolAvailable(toolName) {
+    if (isGitCommand(toolName))
+        return probeVersion(toolName, '--version') !== null;
     try {
         safeExecSync(toolName, ['--version'], { stdio: 'ignore' });
         return true;
     }
-    catch {
-        return false;
+    catch (error) {
+        if (isToolUnusable(error))
+            return false;
+        throw error;
+    }
+}
+/**
+ * Whether a failed version probe means the tool is not usable — the two
+ * failures every caller reads as "not installed": the binary is not on PATH
+ * (`which` and `spawn` both say `ENOENT`), or it ran and exited non-zero (a
+ * binary that does not answer `--version`). The OS refusing to execute a file
+ * `which` had just found (`EACCES`), a spawn that could not start for any other
+ * reason, or a bug in this module are none of those; `vat doctor` reporting
+ * "not installed" for an `EACCES` sends the adopter to reinstall a tool that is
+ * there, so those stay loud.
+ */
+function isToolUnusable(error) {
+    return isPathAbsentError(error) || error instanceof CommandExecutionError;
+}
+/**
+ * Ask a binary its version, routing `git` around {@link refuseGit}.
+ *
+ * A version probe names the *executable*, never a repository, so the refusal
+ * would be a false negative here — and a silent one, because both callers below
+ * report "not installed" for a null. `vat doctor` did exactly that: correct
+ * `git`, reported missing. {@link runGit} is the sanctioned path regardless.
+ *
+ * @param toolName - Binary to ask
+ * @param versionArg - Argument that makes it print its version
+ * @returns Trimmed version string, or null when the tool is genuinely absent
+ */
+function probeVersion(toolName, versionArg) {
+    if (isGitCommand(toolName)) {
+        // The scrub is a no-op for a command that reads nothing; keeping the safe
+        // default means no call site here has to reason about it.
+        const result = runGit([versionArg]);
+        return result.ok ? result.stdout : null;
+    }
+    try {
+        const version = safeExecSync(toolName, [versionArg], {
+            encoding: 'utf8',
+            stdio: 'pipe',
+        });
+        return version.trim();
+    }
+    catch (error) {
+        if (isToolUnusable(error))
+            return null;
+        throw error;
     }
 }
 /**
@@ -172,16 +265,7 @@ export function isToolAvailable(toolName) {
  * console.log(gitVersion); // "git version 2.39.2"
  */
 export function getToolVersion(toolName, versionArg = '--version') {
-    try {
-        const version = safeExecSync(toolName, [versionArg], {
-            encoding: 'utf8',
-            stdio: 'pipe',
-        });
-        return version.trim();
-    }
-    catch {
-        return null;
-    }
+    return probeVersion(toolName, versionArg);
 }
 /**
  * Shell syntax character sets for hyper-efficient single-pass detection
@@ -301,9 +385,11 @@ export function hasShellSyntax(commandString) {
  * @example
  * ```typescript
  * // ✅ Simple commands (these work)
- * safeExecFromString('git status');
  * safeExecFromString('pnpm test --watch');
  * safeExecFromString('gh pr view 123');
+ *
+ * // ❌ git is refused here too — the string form is not a back door around
+ * //    the chokepoint. Use runGit(['status'], { cwd }).
  * ```
  *
  * @example

package/dist/safe-exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"safe-exec.js","sourceRoot":"","sources":["../src/safe-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAyB,MAAM,oBAAoB,CAAC;AAEtE,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAoC5B;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9B,MAAM,CAAS;IACf,MAAM,CAAkB;IACxB,MAAM,CAAkB;IAExC,YACE,OAAe,EACf,MAAc,EACd,MAAuB,EACvB,MAAuB;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,IAAc,EACd,OAAwB;IAExB,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAE7C,MAAM,YAAY,GAAqB;QACrC,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM;QAC9B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,wBAAwB,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9F,sKAAsK;IACtK,OAAO,SAAS,CAAC,SAAS,EAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,OAAiB,EAAE,EACnB,UAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAEvD,yBAAyB;IACzB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,qBAAqB,CAC7B,iCAAiC,MAAM,CAAC,MAAM,IAAI,SAAS,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAC3F,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,EACnB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,MAAM,CACd,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,OAAiB,EAAE,EACnB,UAA2B,EAAE;IAE7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACnC,MAAM,UAAU,GAAmB;YACjC,OAAO,EAAE,MAAM,KAAK,CAAC;YACrB,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;SACzC,CAAC;QAEF,mFAAmF;QACnF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAClC,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yCAAyC;QACzC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,CAAC,CAAC;YACV,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,aAAqB,WAAW;IAEhC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE;YACnD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,OAAQ,OAAkB,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACjD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE1D;;GAEG;AACH,MAAM,qBAAqB,GAAG;IAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE;IACnD,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE;IACrD,SAAS,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,YAAY,EAAE;IAChE,SAAS,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,sBAAsB,EAAE;CACzE,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,cAAc,CAAC,aAAqB;IAKlD,qDAAqD;IACrD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QAEjC,sBAAsB;QACtB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,IAAI;gBAC1C,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,OAAO;aAC9C,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI;gBACzC,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,OAAO;aAC7C,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,IAAI;gBAC7C,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,OAAO;aACjD,CAAC;QACJ,CAAC;QAED,6BAA6B;QAC7B,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,IAAI;gBAC7C,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,OAAO;aACjD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,UAAU,kBAAkB,CAChC,aAAqB,EACrB,UAA2B,EAAE;IAE7B,uDAAuD;IACvD,+EAA+E;IAC/E,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,iBAAiB,CAAC,KAAK;YACpF,aAAa,aAAa,MAAM;YAChC,4DAA4D;YAC5D,iCAAiC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM;YACzE,mEAAmE;YACnE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE5B,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"safe-exec.js","sourceRoot":"","sources":["../src/safe-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAyB,MAAM,oBAAoB,CAAC;AAEtE,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,GACf,MAAM,oBAAoB,CAAC;AA2D5B;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;IACjC,MAAM,CAAS;IACf,MAAM,CAAkB;IACxB,MAAM,CAAkB;IAExC,YACE,OAAe,EACf,MAAc,EACd,MAAuB,EACvB,MAAuB;QAEvB,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAA,MAAM,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;QAAE,OAAO;IAEnC,MAAM,IAAI,KAAK,CACb,gGAAgG;QAC9F,gGAAgG;QAChG,6FAA6F;QAC7F,yFAAyF;QACzF,gFAAgF,CACnF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,IAAc,EACd,OAAwB;IAExB,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;QAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAE7C,MAAM,YAAY,GAAqB;QACrC,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM;QAC9B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,wBAAwB,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAE9F,OAAO,SAAS,CAAC,SAAS,EAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,OAAiB,EAAE,EACnB,UAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAEvD,yBAAyB;IACzB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,qBAAqB,CAC7B,iCAAiC,MAAM,CAAC,MAAM,IAAI,SAAS,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAC3F,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,EACnB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,MAAM,CACd,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,OAAiB,EAAE,EACnB,UAA2B,EAAE;IAE7B,+EAA+E;IAC/E,2EAA2E;IAC3E,8EAA8E;IAC9E,qCAAqC;IACrC,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;QAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACnC,MAAM,UAAU,GAAmB;YACjC,OAAO,EAAE,MAAM,KAAK,CAAC;YACrB,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;SACzC,CAAC;QAEF,mFAAmF;QACnF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAClC,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yCAAyC;QACzC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,CAAC,CAAC;YACV,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,YAAY,CAAC,QAAQ,CAAC;QAAE,OAAO,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,IAAI,CAAC;IAChF,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,cAAc,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,qBAAqB,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,YAAY,CAAC,QAAgB,EAAE,UAAkB;IACxD,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,0EAA0E;QAC1E,0DAA0D;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE;YACnD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,OAAQ,OAAkB,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,cAAc,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,aAAqB,WAAW;IAEhC,OAAO,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACjD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE1D;;GAEG;AACH,MAAM,qBAAqB,GAAG;IAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE;IACnD,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE;IACrD,SAAS,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,YAAY,EAAE;IAChE,SAAS,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,sBAAsB,EAAE;CACzE,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,cAAc,CAAC,aAAqB;IAKlD,qDAAqD;IACrD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QAEjC,sBAAsB;QACtB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,IAAI;gBAC1C,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,OAAO;aAC9C,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI;gBACzC,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,OAAO;aAC7C,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,IAAI;gBAC7C,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,OAAO;aACjD,CAAC;QACJ,CAAC;QAED,6BAA6B;QAC7B,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,IAAI;gBAC7C,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,OAAO;aACjD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,UAAU,kBAAkB,CAChC,aAAqB,EACrB,UAA2B,EAAE;IAE7B,uDAAuD;IACvD,+EAA+E;IAC/E,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,iBAAiB,CAAC,KAAK;YACpF,aAAa,aAAa,MAAM;YAChC,4DAA4D;YAC5D,iCAAiC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM;YACzE,mEAAmE;YACnE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE5B,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC"}

package/dist/skill-targets.d.ts

@@ -21,7 +21,7 @@ interface SkillTargetPaths {
  *
  * @vendor-claim reviewed=2026-07-30 verify=Each of the seven platforms' own published docs for where it reads skills from (claude, codex, copilot, gemini, cursor, windsurf, agents)
  *
- * Last reviewed against vendor documentation 2026-07-30: all fourteen paths
+ * At the last review (the `reviewed=` date above): all fourteen paths
  * re-read from the first-party sources listed below, all fourteen unchanged.
  * Update this table when platforms change theirs — and re-read those sources when
  * you do, because nothing here is verified at build or test time. A stale entry
@@ -40,7 +40,7 @@ interface SkillTargetPaths {
  * a change-detector masquerading as verification, and friction against exactly the
  * correction the clock above exists to produce.)
  *
- * Sources, one per target, re-read 2026-07-30:
+ * Sources, one per target, re-read at that review:
  * - claude   https://code.claude.com/docs/en/skills
  *            (docs.claude.com/en/docs/claude-code/skills now 301s here)
  * - codex    https://developers.openai.com/codex/skills/

package/dist/skill-targets.js

@@ -40,7 +40,7 @@ const AGENTS_SKILLS_PATH = '.agents/skills';
  *
  * @vendor-claim reviewed=2026-07-30 verify=Each of the seven platforms' own published docs for where it reads skills from (claude, codex, copilot, gemini, cursor, windsurf, agents)
  *
- * Last reviewed against vendor documentation 2026-07-30: all fourteen paths
+ * At the last review (the `reviewed=` date above): all fourteen paths
  * re-read from the first-party sources listed below, all fourteen unchanged.
  * Update this table when platforms change theirs — and re-read those sources when
  * you do, because nothing here is verified at build or test time. A stale entry
@@ -59,7 +59,7 @@ const AGENTS_SKILLS_PATH = '.agents/skills';
  * a change-detector masquerading as verification, and friction against exactly the
  * correction the clock above exists to produce.)
  *
- * Sources, one per target, re-read 2026-07-30:
+ * Sources, one per target, re-read at that review:
  * - claude   https://code.claude.com/docs/en/skills
  *            (docs.claude.com/en/docs/claude-code/skills now 301s here)
  * - codex    https://developers.openai.com/codex/skills/

package/dist/skill-test/auth-resolver.d.ts

@@ -1,3 +1,4 @@
+import { VatError } from '../errors/vat-error.js';
 export type AuthMode = 'inherit' | 'subscription' | 'api-key' | 'auto';
 export type AuthMechanism = 'subscription' | 'api-key';
 export interface AuthStatusResult {
@@ -21,8 +22,8 @@ export interface ResolvedAuth {
     apiKeySource?: string;
 }
 /** A preflight auth failure — maps to exit code 2. */
-export declare class AuthPreflightError extends Error {
-    readonly exitCode: 2;
+export declare class AuthPreflightError extends VatError {
+    readonly reason: "preflight";
     constructor(message: string);
 }
 /**
@@ -30,5 +31,12 @@ export declare class AuthPreflightError extends Error {
  * given env: returns in ~150ms, exit 0, spends NO tokens. NOT a `-p` call.
  */
 export declare function probeAuthStatus(env: NodeJS.ProcessEnv): AuthStatusResult | null;
+/**
+ * Read what `claude auth status --json` printed. `null` means "not the JSON
+ * object the flag promises" — an older CLI answering in prose, or a bare
+ * literal — and only that: a failure inside this reader is a bug, not "not
+ * logged in", and `resolveAuth` would otherwise turn it into a preflight exit.
+ */
+export declare function parseAuthStatus(stdout: string): AuthStatusResult | null;
 export declare function resolveAuth(opts: ResolveAuthOptions): ResolvedAuth;
 //# sourceMappingURL=auth-resolver.d.ts.map

package/dist/skill-test/auth-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-resolver.d.ts","sourceRoot":"","sources":["../../src/skill-test/auth-resolver.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,GAAG,MAAM,CAAC;AACvE,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,SAAS,CAAC;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,gBAAgB,GAAG,IAAI,CAAC;AAElF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;IAC7B,uEAAuE;IACvE,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,kBAAkB,EAAE,aAAa,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,sDAAsD;AACtD,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,QAAQ,EAAG,CAAC,CAAU;gBACnB,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,gBAAgB,GAAG,IAAI,CAa/E;AAgBD,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,YAAY,CA+BlE"}
+{"version":3,"file":"auth-resolver.d.ts","sourceRoot":"","sources":["../../src/skill-test/auth-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAKlD,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,GAAG,MAAM,CAAC;AACvE,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,SAAS,CAAC;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,gBAAgB,GAAG,IAAI,CAAC;AAElF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;IAC7B,uEAAuE;IACvE,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,kBAAkB,EAAE,aAAa,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,sDAAsD;AACtD,qBAAa,kBAAmB,SAAQ,QAAQ;IAC9C,QAAQ,CAAC,MAAM,EAAG,WAAW,CAAU;gBAC3B,OAAO,EAAE,MAAM;CAG5B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,gBAAgB,GAAG,IAAI,CAI/E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAevE;AAgBD,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,YAAY,CA+BlE"}