@vibgrate/cli 2026.729.2 → 2026.729.3

package/dist/{chunk-2ZHWF7C6.js → chunk-42RDYQFF.js}

@@ -1,6 +1,7 @@
-import { buildAgentMessages, redactSecrets, unifiedDiff, applyEdit } from './chunk-RZEXHDCF.js';
-import { localGraphBackend } from './chunk-TCJTQGAO.js';
-import { buildIdentifierTrieFromGraph, KvBlockRegistry, graphDraftCandidates, extractIdentifiers, scanIdentifiersAgainstTrie } from './chunk-JIBOJTGS.js';
+import { secretEgressRefusal, isSecretPath, secretRefusal, redactText } from './chunk-543E6WDJ.js';
+import { buildAgentMessages, redactSecrets, unifiedDiff, applyEdit } from './chunk-MYM5VIJ4.js';
+import { localGraphBackend } from './chunk-RGEVBSLK.js';
+import { buildIdentifierTrieFromGraph, KvBlockRegistry, graphDraftCandidates, extractIdentifiers, scanIdentifiersAgainstTrie } from './chunk-5HYCB55P.js';
 import { resolve } from './chunk-IPICO2RV.js';
 import { searchSymbols, resolveLib, loadCatalog, readDoc, localPackageDocs, resolveVersion } from './chunk-G4HTI4ZM.js';
 import { summarizeCapsule, CAPSULE_RANKING_VERSION, buildCodeContext, buildTaskCapsule, capsuleToCodeContext, recordCliCall, CLI_TOOL_ALIASES } from './chunk-US2DAKCM.js';
@@ -579,62 +580,13 @@ function locatorsFromGraph(nodes) {
   return (id) => map.get(id) ?? null;
 }
 
-// src/code/secrets.ts
-var SECRET_FILE = new RegExp(
-  [
-    String.raw`(^|/)\.env(\.[\w.-]+)?$`,
-    // .env, .env.local, .env.production
-    String.raw`(^|/)\.npmrc$`,
-    String.raw`(^|/)\.netrc$`,
-    String.raw`(^|/)\.pgpass$`,
-    String.raw`(^|/)\.git-credentials$`,
-    String.raw`(^|/)id_(rsa|dsa|ecdsa|ed25519)$`,
-    String.raw`\.pem$`,
-    String.raw`\.key$`,
-    String.raw`\.p12$`,
-    String.raw`\.pfx$`,
-    String.raw`(^|/)credentials(\.json)?$`,
-    // aws credentials, gcloud
-    String.raw`(^|/)\.aws/credentials$`,
-    String.raw`(^|/)secrets?\.(ya?ml|json|toml|env)$`
-  ].join("|"),
-  "i"
-);
-function isSecretPath(file) {
-  const normalized = file.replace(/\\/g, "/");
-  return SECRET_FILE.test(normalized);
-}
-function secretRefusal(file) {
-  return `refusing to read ${file} \u2014 it looks like a secrets/credentials file, and this content would be sent to the model. Reference the values by name instead, or read a non-secret file.`;
-}
-var TOKEN_SHAPES = /\b(sk|pk|rk|xoxb|xoxp|ghp|gho|ghs|ghu|glpat|AKIA|ASIA|AIza|ya29|hf|nvapi|sk-ant|sk-or)[-_][A-Za-z0-9\-_./+]{8,}/g;
-var BEARER = /\b(Authorization|Bearer|token|api[_-]?key)\b\s*[:=]\s*['"]?[A-Za-z0-9\-_./+]{12,}['"]?/gi;
-var ASSIGNMENT = /\b([A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|CREDENTIAL|PRIVATE|ACCESS|SESSION)[A-Za-z0-9_]*)\s*([:=])\s*['"]?([^\s'";,]{6,})/gi;
-var URL_AUTH = /\b([a-z][a-z0-9+.-]*:\/\/)([^:/\s]+):([^@/\s]+)@/gi;
-function redactText(text) {
-  return text.replace(URL_AUTH, "$1$2:***redacted***@").replace(TOKEN_SHAPES, (_m, prefix) => `${prefix}-***redacted***`).replace(BEARER, (_m, k) => `${k}: ***redacted***`).replace(ASSIGNMENT, (_m, name, op) => `${name}${op}***redacted***`);
-}
-function findSecretShapes(text) {
-  const hits = [];
-  const scan = (re, kind) => {
-    re.lastIndex = 0;
-    let m;
-    while ((m = re.exec(text)) !== null) {
-      hits.push({ kind, index: m.index });
-      if (m[0].length === 0) re.lastIndex++;
-    }
-  };
-  scan(TOKEN_SHAPES, "token");
-  scan(BEARER, "bearer");
-  scan(ASSIGNMENT, "assignment");
-  scan(URL_AUTH, "url-auth");
-  return hits.sort((a, b) => a.index - b.index || a.kind.localeCompare(b.kind));
-}
-function secretEgressRefusal(text, surface = "network payload") {
-  const hits = findSecretShapes(text);
-  if (hits.length === 0) return null;
-  const kinds = [...new Set(hits.map((h) => h.kind))].sort().join(", ");
-  return `refusing to send ${surface} \u2014 detected credential-shaped content (${kinds}). Remove secrets before any network call; path-level secrets files are also blocked.`;
+// src/code/preview-sides.ts
+var MAX_PREVIEW_CHARS = 256e3;
+function previewSides(before, after) {
+  const b = before ?? "";
+  const a = after ?? "";
+  if (b.length > MAX_PREVIEW_CHARS || a.length > MAX_PREVIEW_CHARS) return void 0;
+  return { before: b, after: a };
 }
 
 // src/code/safety.ts
@@ -1480,7 +1432,7 @@ async function editFile(ctx, path2, search2, replace) {
     return { content: `edit not applied (${outcome.status}): ${outcome.reason ?? ""}`, mutated: false };
   }
   const diff = unifiedDiff(before, after, path2);
-  if (!await ctx.approve({ kind: "edit", file: path2, diff })) {
+  if (!await ctx.approve({ kind: "edit", file: path2, diff, sides: previewSides(before, after) })) {
     return { content: `edit to ${path2} was declined by the user`, mutated: false };
   }
   ctx.fsImpl.write(path2, after ?? "");
@@ -1555,11 +1507,12 @@ async function applyPatchTool(ctx, raw) {
     return { content: "patch applied with no content changes (no-op)", mutated: false };
   }
   const files = planned.map((p) => {
-    if (p.op === "delete") return { file: p.file, op: "delete", diff: p.diff };
+    const sides = previewSides(p.before, p.after);
+    if (p.op === "delete") return { file: p.file, op: "delete", diff: p.diff, sides };
     if (p.op === "create") {
-      return { file: p.file, op: "create", bytes: Buffer.byteLength(p.after ?? ""), diff: p.diff };
+      return { file: p.file, op: "create", bytes: Buffer.byteLength(p.after ?? ""), diff: p.diff, sides };
     }
-    return { file: p.file, op: "edit", diff: p.diff };
+    return { file: p.file, op: "edit", diff: p.diff, sides };
   });
   if (!await ctx.approve({ kind: "patch", files })) {
     return {
@@ -2109,6 +2062,9 @@ async function runAgent(options) {
   let capsule = built.capsule;
   const useLadder = options.verifyLadder ?? !!capsule;
   const messages = buildAgentMessages(context);
+  if (options.projectRules) {
+    messages.push({ role: "user", content: options.projectRules });
+  }
   if (options.priorSummary) {
     messages.push({ role: "user", content: options.priorSummary });
   }
@@ -2185,13 +2141,29 @@ async function runAgent(options) {
     if (options.executionEnv) return options.executionEnv.run(command, { cwd: root });
     return options.run(command);
   };
+  const actionFiles = (action) => {
+    if (action.kind === "patch") return action.files.map((f) => f.file);
+    return "file" in action && action.file ? [action.file] : [];
+  };
+  const approveAndCheckpoint = async (action) => {
+    const approved = await options.approve(action);
+    if (!approved || !options.checkpoint) return approved;
+    const files = actionFiles(action);
+    if (!files.length) return approved;
+    try {
+      const cp = options.checkpoint(files);
+      if (cp) onEvent({ type: "checkpoint", ...cp, files });
+    } catch {
+    }
+    return approved;
+  };
   const ctx = {
     root,
     graph,
     fsImpl,
     spans,
     run: runShell,
-    approve: options.approve,
+    approve: approveAndCheckpoint,
     askUser: options.askUser,
     auto: options.auto,
     denyCommands: options.denyCommands,
@@ -2396,6 +2368,9 @@ Fix the failing tests, then call finish again.${verifyRounds === 0 ? " (last ver
     return "retry";
   };
   for (let step = 1; step <= maxSteps; step++) {
+    if (options.signal?.aborted) {
+      return finish("cancelled", "stopped at your request", step - 1);
+    }
     currentStep = step;
     onEvent({ type: "step", n: step });
     const compacted = compact(messages, contextBudget, changes);
@@ -2661,6 +2636,6 @@ function buildSpanIndex(graph) {
   return map;
 }
 
-export { CONTEXT_POLICY_VERSION, computeFcsReport, createTrajectoryCollector, renderFcsReportMarkdown, runAgent };
-//# sourceMappingURL=chunk-2ZHWF7C6.js.map
-//# sourceMappingURL=chunk-2ZHWF7C6.js.map
+export { CONTEXT_POLICY_VERSION, DISCOVERY_TOOLS, MUTATION_TOOLS, compact, computeFcsReport, createTrajectoryCollector, renderFcsReportMarkdown, runAgent };
+//# sourceMappingURL=chunk-42RDYQFF.js.map
+//# sourceMappingURL=chunk-42RDYQFF.js.map