@wrongstack/cli 0.296.4 → 0.298.0

package/dist/chunk-XWEGWYDU.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/plugin-management.ts"],
-  "sourcesContent": ["import * as fs from 'node:fs/promises';\nimport { atomicWrite } from '@wrongstack/core/utils';\nimport type { Config, PluginConfig, PluginManagerConfig } from '@wrongstack/core/types';\nimport { OFFICIAL_PLUGIN_AUDIT_ENTRIES } from '@wrongstack/plugins/audit';\n\nexport interface PluginAuditEntry {\n  name: string;\n  risk: 'low' | 'medium' | 'high';\n  summary: string;\n  defaultState: 'active' | 'inactive';\n  canDisable: boolean;\n}\n\n/** Host-owned plugins that are not published by @wrongstack/plugins. */\nconst HOST_PLUGIN_AUDIT_ENTRIES: readonly PluginAuditEntry[] = [\n  {\n    name: 'wstack-prompts',\n    risk: 'medium',\n    summary: 'Prompt library and prompt authoring commands.',\n    defaultState: 'active',\n    canDisable: true,\n  },\n  {\n    name: 'wstack-sync',\n    risk: 'medium',\n    summary: 'Cloud sync commands for prompts, skills, settings, memory, and history.',\n    defaultState: 'active',\n    canDisable: true,\n  },\n  {\n    name: 'wstack-git',\n    risk: 'high',\n    summary: 'Git commands for commit, status checks, and push.',\n    defaultState: 'active',\n    canDisable: true,\n  },\n  {\n    name: 'wstack-observability',\n    risk: 'low',\n    summary: 'Runtime metrics and health slash commands.',\n    defaultState: 'active',\n    canDisable: true,\n  },\n  {\n    name: 'wstack-chimera',\n    risk: 'medium',\n    summary: 'Spawns a post-session code review subagent when explicitly enabled.',\n    defaultState: 'inactive',\n    canDisable: true,\n  },\n  {\n    name: 'wstack-skills',\n    risk: 'medium',\n    summary: 'Skill library, authoring, install, update, and uninstall commands.',\n    defaultState: 'active',\n    canDisable: true,\n  },\n  {\n    name: 'wstack-plan',\n    risk: 'medium',\n    summary: 'Strategic plan board slash command.',\n    defaultState: 'active',\n    canDisable: true,\n  },\n  {\n    name: '@wrongstack/plug-lsp',\n    risk: 'medium',\n    summary: 'Language Server Protocol tools and slash commands.',\n    defaultState: 'inactive',\n    canDisable: true,\n  },\n  {\n    name: 'telegram',\n    risk: 'medium',\n    summary: 'Telegram bridge for messages, approvals, and notifications.',\n    defaultState: 'inactive',\n    canDisable: true,\n  },\n] as const;\n\nexport const PLUGIN_AUDIT_ENTRIES: readonly PluginAuditEntry[] = Object.freeze([\n  ...HOST_PLUGIN_AUDIT_ENTRIES,\n  ...OFFICIAL_PLUGIN_AUDIT_ENTRIES,\n]);\n\nexport const OFFICIAL_PLUGINS = [\n  {\n    alias: 'telegram',\n    specifier: '@wrongstack/telegram',\n    description: 'Telegram bridge for prompts, notifications, and slash commands.',\n  },\n  {\n    alias: 'lsp',\n    specifier: '@wrongstack/plug-lsp',\n    description: 'Language Server Protocol tools for code intelligence.',\n  },\n] as const;\n\nexport interface PluginManagementDeps {\n  config: Config;\n  configPath: string;\n}\n\nexport interface PluginManagementResult {\n  code: number;\n  level: 'output' | 'info' | 'error';\n  message: string;\n  patch?: {\n    plugins?: (string | PluginConfig)[] | undefined;\n    features?: Record<string, unknown>;\n    pluginManager?: PluginManagerConfig | undefined;\n    /**\n     * Full replacement `extensions` map (patchConfig is a SHALLOW merge,\n     * so per-plugin llm overrides must ship the whole merged object).\n     */\n    extensions?: Record<string, Record<string, unknown>> | undefined;\n  };\n  restartRequired?: boolean | undefined;\n}\n\nconst OFFICIAL_ALIASES = new Map<string, string>(\n  OFFICIAL_PLUGINS.flatMap((p) => [\n    [p.alias, p.specifier],\n    [p.specifier, p.specifier],\n  ]),\n);\n\nexport async function runPluginManagementCommand(\n  args: string[],\n  deps: PluginManagementDeps,\n): Promise<PluginManagementResult> {\n  const sub = args[0];\n  if (!sub || sub === 'list' || sub === 'status') {\n    return {\n      code: 0,\n      level: 'output',\n      message: renderConfiguredPlugins(deps.config),\n    };\n  }\n  if (sub === 'official' || sub === 'officials') {\n    return {\n      code: 0,\n      level: 'output',\n      message: renderOfficialPlugins(deps.config),\n    };\n  }\n  if (sub === 'report' || sub === 'audit' || sub === 'menu') {\n    return {\n      code: 0,\n      level: 'output',\n      message: renderPluginAuditReport(deps.config),\n    };\n  }\n  if (sub === 'add' || sub === 'install') {\n    const spec = args[1];\n    if (!spec) {\n      return errorResult('Usage: wstack plugin add <specifier|official-alias> [--disabled]');\n    }\n    return upsertPlugin(\n      resolvePluginSpecifier(spec),\n      { enabled: !args.includes('--disabled') },\n      deps,\n      'Added',\n    );\n  }\n  if (sub === 'remove' || sub === 'rm' || sub === 'uninstall') {\n    const spec = args[1];\n    if (!spec) {\n      return errorResult('Usage: wstack plugin remove <specifier|official-alias>');\n    }\n    return removePlugin(resolvePluginSpecifier(spec), deps);\n  }\n  if (sub === 'enable' || sub === 'disable') {\n    const spec = args[1];\n    if (!spec) {\n      return errorResult(`Usage: wstack plugin ${sub} <specifier|official-alias>`);\n    }\n    return upsertPlugin(\n      resolvePluginSpecifier(spec),\n      { enabled: sub === 'enable' },\n      deps,\n      sub === 'enable' ? 'Enabled' : 'Disabled',\n    );\n  }\n  if (sub === 'toggle') {\n    const spec = args[1];\n    if (!spec) {\n      return errorResult('Usage: wstack plugin toggle <plugin-name|official-alias>');\n    }\n    return togglePlugin(resolvePluginToggleSpecifier(spec), deps);\n  }\n  if (sub === 'manager') {\n    return runPluginManagerPolicyCommand(args.slice(1), deps);\n  }\n  if (sub === 'llm') {\n    return runPluginLlmCommand(args.slice(1), deps);\n  }\n  return errorResult(\n    `Unknown plugin subcommand: ${sub}\\nUsage: wstack plugin [list|status|report|menu|official|add|install|remove|enable|disable|toggle|manager|llm]`,\n  );\n}\n\nconst PLUGIN_MANAGER_POLICY_USAGE = [\n  'Usage:',\n  '  wstack plugin manager                         List plugins locked against LLM state changes.',\n  '  wstack plugin manager lock <plugin|*>         Prevent plugin_manager from enabling/disabling it.',\n  '  wstack plugin manager unlock <plugin|*>       Restore plugin_manager enable/disable access.',\n  '',\n  'This policy affects only the LLM-facing plugin_manager tool. Human /plugin and',\n  'wstack plugin enable/disable commands remain available.',\n].join('\\n');\n\nasync function runPluginManagerPolicyCommand(\n  args: string[],\n  deps: PluginManagementDeps,\n): Promise<PluginManagementResult> {\n  const action = args[0] ?? 'list';\n  if (action === 'list') {\n    const locked = deps.config.pluginManager?.locked ?? [];\n    return {\n      code: 0,\n      level: 'output',\n      message:\n        locked.length === 0\n          ? 'LLM plugin-manager policy: no plugins are locked.'\n          : `LLM plugin-manager policy \u2014 locked (${locked.length}):\\n${locked.map((name) => `  ${name}`).join('\\n')}`,\n    };\n  }\n\n  if (action !== 'lock' && action !== 'unlock') {\n    return errorResult(PLUGIN_MANAGER_POLICY_USAGE);\n  }\n  const rawName = args[1];\n  if (!rawName) return errorResult(PLUGIN_MANAGER_POLICY_USAGE);\n  const name = rawName === '*' ? '*' : resolvePluginToggleSpecifier(rawName);\n\n  const existing = await readConfig(deps.configPath);\n  const filePolicy = isRecord(existing.pluginManager) ? existing.pluginManager : undefined;\n  const current = Array.isArray(filePolicy?.['locked'])\n    ? filePolicy['locked'].filter((entry): entry is string => typeof entry === 'string')\n    : [...(deps.config.pluginManager?.locked ?? [])];\n  const canonical = canonicalPolicyName(name);\n  const next =\n    action === 'lock'\n      ? current.some((entry) => canonicalPolicyName(entry) === canonical)\n        ? current\n        : [...current, name]\n      : current.filter((entry) => canonicalPolicyName(entry) !== canonical);\n\n  const pluginManager: PluginManagerConfig = { locked: next };\n  existing.pluginManager = { ...(filePolicy ?? {}), ...pluginManager };\n  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 0o600 });\n\n  return {\n    code: 0,\n    level: 'info',\n    message:\n      action === 'lock'\n        ? `Locked \"${name}\" against LLM enable/disable changes. Human plugin commands still work.`\n        : `Unlocked \"${name}\" for LLM enable/disable changes.`,\n    patch: { pluginManager },\n  };\n}\n\nfunction canonicalPolicyName(name: string): string {\n  if (name === '*') return name;\n  return resolvePluginToggleSpecifier(name).trim().toLowerCase();\n}\n\nconst PLUGIN_LLM_USAGE = [\n  'Usage:',\n  '  wstack plugin llm                               List every per-plugin LLM override.',\n  \"  wstack plugin llm <plugin>                      Show one plugin's LLM override.\",\n  '  wstack plugin llm <plugin> <provider> [model]   Route this plugin through a provider (and model).',\n  '  wstack plugin llm <plugin> - <model>            Keep the session provider, override only the model.',\n  '  wstack plugin llm <plugin> --clear              Remove the override (back to the session default).',\n  '',\n  'The override is stored as config.extensions.<plugin>.llm and is used by',\n  'every api.llm call the plugin makes. Without an override, plugins follow',\n  'the active session provider/model (the chat leader).',\n].join('\\n');\n\n/**\n * Render every configured per-plugin LLM override. Reads\n * `config.extensions.<plugin>.llm` across all plugins so the user can\n * see, at a glance, which plugins deviate from the session default.\n */\nfunction renderPluginLlmOverviews(config: Config, sessionDefault: string): string {\n  const rows: Array<{ name: string; provider: string; model: string }> = [];\n  for (const [pluginName, ext] of Object.entries(config.extensions ?? {})) {\n    const llm = (ext as Record<string, unknown>)?.['llm'];\n    if (llm && typeof llm === 'object') {\n      const o = llm as { provider?: string; model?: string };\n      rows.push({\n        name: pluginName,\n        provider: o.provider ?? '(session)',\n        model: o.model ?? '(session)',\n      });\n    }\n  }\n  const lines = [`Per-plugin LLM routing (session default: ${sessionDefault}):`];\n  if (rows.length === 0) {\n    lines.push(\n      '  No plugin overrides \u2014 every plugin follows the session default.',\n      '  Set one with: wstack plugin llm <plugin> <provider> [model]',\n    );\n  } else {\n    rows.sort((a, b) => a.name.localeCompare(b.name));\n    for (const r of rows) {\n      lines.push(`  ${r.name.padEnd(24)} provider=${r.provider.padEnd(16)} model=${r.model}`);\n    }\n    lines.push('', 'Clear one with: wstack plugin llm <plugin> --clear');\n  }\n  return lines.join('\\n');\n}\n\n/**\n * `wstack plugin llm \u2026` \u2014 per-plugin LLM routing. The chat leader's\n * provider/model stays the DEFAULT; this stores an override under\n * `config.extensions[<plugin>].llm = { provider?, model? }` which\n * `api.llm` resolves ahead of the session default on every call.\n */\nasync function runPluginLlmCommand(\n  args: string[],\n  deps: PluginManagementDeps,\n): Promise<PluginManagementResult> {\n  const sessionDefault = `${deps.config.provider ?? '?'} / ${deps.config.model ?? '?'}`;\n\n  // \u2500\u2500 List: `plugin llm` (no name) or `plugin llm list` \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  if (args.length === 0 || args[0] === 'list') {\n    return {\n      code: 0,\n      level: 'output',\n      message: renderPluginLlmOverviews(deps.config, sessionDefault),\n    };\n  }\n\n  const name = args[0];\n  if (!name || name.startsWith('-')) return errorResult(PLUGIN_LLM_USAGE);\n\n  const currentOverride = deps.config.extensions?.[name]?.['llm'];\n\n  // \u2500\u2500 Show \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  if (args.length === 1) {\n    const lines = [`LLM routing for plugin \"${name}\":`];\n    if (currentOverride && typeof currentOverride === 'object') {\n      const o = currentOverride as { provider?: string; model?: string };\n      lines.push(\n        `  override: provider=${o.provider ?? '(session)'} model=${o.model ?? '(session)'}`,\n        `  session default: ${sessionDefault}`,\n      );\n    } else {\n      lines.push(\n        `  no override \u2014 follows the session default (${sessionDefault}).`,\n        `  Set one with: wstack plugin llm ${name} <provider> [model]`,\n      );\n    }\n    return { code: 0, level: 'output', message: lines.join('\\n') };\n  }\n\n  const existing = await readConfig(deps.configPath);\n  const fileExtensions = isRecord(existing.extensions)\n    ? (existing.extensions as Record<string, unknown>)\n    : {};\n  const pluginExt = isRecord(fileExtensions[name])\n    ? { ...(fileExtensions[name] as Record<string, unknown>) }\n    : {};\n\n  // \u2500\u2500 Clear \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  if (args[1] === '--clear' || args[1] === 'clear') {\n    if (!('llm' in pluginExt) && !currentOverride) {\n      return { code: 0, level: 'info', message: `Plugin \"${name}\" has no LLM override.` };\n    }\n    delete pluginExt['llm'];\n    if (Object.keys(pluginExt).length === 0) delete fileExtensions[name];\n    else fileExtensions[name] = pluginExt;\n    existing.extensions = fileExtensions;\n    await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 0o600 });\n    const merged = mergeExtensionsForPatch(deps.config, fileExtensions);\n    // The in-memory config may still carry the old override \u2014 the merge\n    // above unions both sources, so drop the key explicitly.\n    const mergedEntry = merged[name];\n    if (mergedEntry) {\n      delete mergedEntry['llm'];\n      if (Object.keys(mergedEntry).length === 0) delete merged[name];\n    }\n    return {\n      code: 0,\n      level: 'info',\n      message:\n        `Cleared LLM override for \"${name}\" \u2014 it now follows the session default (${sessionDefault}). ` +\n        'Takes effect immediately for api.llm calls.',\n      patch: { extensions: merged },\n    };\n  }\n\n  // \u2500\u2500 Set \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const providerArg = args[1];\n  const modelArg = args[2];\n  if (!providerArg || providerArg.startsWith('--')) return errorResult(PLUGIN_LLM_USAGE);\n  const provider = providerArg === '-' ? undefined : providerArg;\n  const model = modelArg && modelArg !== '-' ? modelArg : undefined;\n  if (!provider && !model) return errorResult(PLUGIN_LLM_USAGE);\n\n  const llm: Record<string, unknown> = {};\n  if (provider) llm['provider'] = provider;\n  if (model) llm['model'] = model;\n  pluginExt['llm'] = llm;\n  fileExtensions[name] = pluginExt;\n  existing.extensions = fileExtensions;\n  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 0o600 });\n\n  // Soft sanity note: an unknown provider name still works if the\n  // models.dev catalog knows it, but flag likely typos against the\n  // user's configured providers.\n  const configured = Object.keys(deps.config.providers ?? {});\n  const note =\n    provider && configured.length > 0 && !configured.includes(provider)\n      ? `\\nNote: \"${provider}\" is not in config.providers (configured: ${configured.join(', ')}). ` +\n        'Catalog providers (anthropic, openai, \u2026) still resolve if credentials are available.'\n      : '';\n\n  const merged = mergeExtensionsForPatch(deps.config, fileExtensions);\n  return {\n    code: 0,\n    level: 'info',\n    message:\n      `Plugin \"${name}\" now routes api.llm calls via ` +\n      `provider=${provider ?? '(session)'} model=${model ?? '(session)'}. ` +\n      `Session default stays ${sessionDefault}. Takes effect immediately for api.llm calls.${note}`,\n    patch: { extensions: merged },\n  };\n}\n\n/**\n * patchConfig is a shallow merge \u2014 build the FULL extensions map:\n * in-memory config first, then the file's (just-written) entries win.\n */\nfunction mergeExtensionsForPatch(\n  config: Config,\n  fileExtensions: Record<string, unknown>,\n): Record<string, Record<string, unknown>> {\n  const merged: Record<string, Record<string, unknown>> = {};\n  for (const [k, v] of Object.entries(config.extensions ?? {})) {\n    merged[k] = { ...v };\n  }\n  for (const [k, v] of Object.entries(fileExtensions)) {\n    if (isRecord(v)) merged[k] = { ...(merged[k] ?? {}), ...v };\n  }\n  // A cleared plugin entry must disappear from the merged view too.\n  for (const k of Object.keys(merged)) {\n    if (!(k in fileExtensions) && !(k in (config.extensions ?? {}))) delete merged[k];\n  }\n  return merged;\n}\n\nexport function resolvePluginSpecifier(input: string): string {\n  return OFFICIAL_ALIASES.get(input.toLowerCase()) ?? input;\n}\n\nfunction resolvePluginToggleSpecifier(input: string): string {\n  if (input.toLowerCase() === '@wrongstack/telegram') return 'telegram';\n  if (auditEntryFor(input)) return input;\n  return resolvePluginSpecifier(input);\n}\n\nexport function renderOfficialPlugins(config?: Config): string {\n  return [\n    'Official plugins:',\n    ...OFFICIAL_PLUGINS.map((p) => {\n      const state = config ? officialPluginState(config, p.specifier) : '';\n      const status = state ? `${state.padEnd(14)} ` : '';\n      return `  ${p.alias.padEnd(12)} ${status}${p.specifier.padEnd(24)} ${p.description}`;\n    }),\n    '',\n    'Use `wstack plugin add <alias>` or `/plugin install <alias>`.',\n  ].join('\\n');\n}\n\nexport function renderConfiguredPlugins(config: Config): string {\n  const plugins = config.plugins ?? [];\n  if (plugins.length === 0) {\n    return [\n      'No plugins configured.',\n      'Use `wstack plugin add <specifier>` or `/plugin install <official-alias>`.',\n    ].join('\\n');\n  }\n  return plugins\n    .map((p) => {\n      const name = pluginName(p);\n      const enabled = typeof p === 'object' && p.enabled === false ? 'disabled' : 'enabled';\n      const official = OFFICIAL_PLUGINS.find((entry) => entry.specifier === name);\n      const suffix = official ? ` (${official.alias})` : '';\n      return `  ${`${name}${suffix}`.padEnd(44)} ${enabled}`;\n    })\n    .join('\\n');\n}\n\nexport function renderPluginAuditReport(config: Config): string {\n  const configured = config.plugins ?? [];\n  const lines = [\n    'Plugin audit report:',\n    '  State shows the effective boot state. Default-active plugins run unless disabled in config.',\n    '  Built-in audit rows are toggleable unless a future row explicitly marks itself locked.',\n    '',\n    '  Built-in audit entries:',\n  ];\n\n  for (const entry of PLUGIN_AUDIT_ENTRIES) {\n    const { state, source } = effectiveAuditState(config, entry);\n    const policy = entry.canDisable ? 'toggleable' : lockedReason(entry);\n    lines.push(\n      `  ${entry.name.padEnd(24)} ${state.padEnd(8)} ${source.padEnd(8)} risk=${entry.risk.padEnd(6)} ${policy.padEnd(24)} ${entry.summary}`,\n    );\n  }\n\n  const extra = configured.filter(\n    (plugin) => !PLUGIN_AUDIT_ENTRIES.some((entry) => pluginMatchesToggleSpec(plugin, entry.name)),\n  );\n  if (extra.length > 0) {\n    lines.push('', '  Configured plugins outside the audit list:');\n    for (const plugin of extra) {\n      const name = pluginName(plugin);\n      const state = typeof plugin === 'object' && plugin.enabled === false ? 'disabled' : 'enabled';\n      lines.push(\n        `  ${name.padEnd(24)} ${state.padEnd(8)} config   risk=custom user-configured plugin`,\n      );\n    }\n  }\n\n  lines.push(\n    '',\n    'Use `/plugin menu` in the TUI, or `wstack plugin toggle <name>` for toggleable rows.',\n  );\n  return lines.join('\\n');\n}\n\nasync function readConfig(file: string): Promise<Record<string, unknown>> {\n  try {\n    return JSON.parse(await fs.readFile(file, 'utf8')) as Record<string, unknown>;\n  } catch {\n    return {};\n  }\n}\n\nfunction pluginName(p: string | PluginConfig): string {\n  return typeof p === 'string' ? p : p.name;\n}\n\nfunction pluginEntry(spec: string, enabled: boolean): string | PluginConfig {\n  return enabled ? spec : { name: spec, enabled: false };\n}\n\nfunction pluginMatchesToggleSpec(p: string | PluginConfig, spec: string): boolean {\n  const name = pluginName(p);\n  if (spec === 'telegram') return name === 'telegram' || name === '@wrongstack/telegram';\n  return name === spec;\n}\n\nfunction effectiveAuditState(\n  config: Config,\n  entry: PluginAuditEntry,\n): { state: 'enabled' | 'disabled'; source: 'config' | 'default' } {\n  const configured = (config.plugins ?? []).find((plugin) =>\n    pluginMatchesToggleSpec(plugin, entry.name),\n  );\n  if (configured) {\n    return {\n      state:\n        typeof configured === 'object' && configured.enabled === false ? 'disabled' : 'enabled',\n      source: 'config',\n    };\n  }\n  return {\n    state: entry.defaultState === 'active' ? 'enabled' : 'disabled',\n    source: 'default',\n  };\n}\n\nfunction lockedReason(entry: PluginAuditEntry): string {\n  if (entry.canDisable) return 'toggleable';\n  if (entry.name === 'secret-scanner') {\n    return 'locked: safety guard';\n  }\n  return 'locked: core surface';\n}\n\nfunction auditEntryFor(spec: string): PluginAuditEntry | undefined {\n  return PLUGIN_AUDIT_ENTRIES.find((entry) => entry.name === spec);\n}\n\nfunction officialPluginState(\n  config: Config,\n  spec: string,\n): 'enabled' | 'disabled' | 'not configured' {\n  const match = (config.plugins ?? []).find((p) => pluginName(p) === spec);\n  if (!match) return 'not configured';\n  return typeof match === 'object' && match.enabled === false ? 'disabled' : 'enabled';\n}\n\nasync function togglePlugin(\n  spec: string,\n  deps: PluginManagementDeps,\n): Promise<PluginManagementResult> {\n  const auditEntry = auditEntryFor(spec);\n  if (auditEntry?.canDisable === false) {\n    return errorResult(`Plugin \"${spec}\" is locked and cannot be toggled from the plugin menu.`);\n  }\n\n  const existing = await readConfig(deps.configPath);\n  const plugins = Array.isArray(existing.plugins)\n    ? (existing.plugins as Array<string | PluginConfig>)\n    : [];\n  const idx = plugins.findIndex((p) => pluginMatchesToggleSpec(p, spec));\n  const configured = idx >= 0 ? plugins[idx] : undefined;\n  const enabled = configured\n    ? !(typeof configured === 'object' && configured.enabled === false)\n    : auditEntry?.defaultState === 'active';\n\n  if (!configured && !auditEntry) {\n    return errorResult(\n      `Plugin \"${spec}\" is not configured. Use \"wstack plugin add ${spec}\" first.`,\n    );\n  }\n\n  let nextPlugins: Array<string | PluginConfig>;\n  let nextEnabled: boolean;\n  if (enabled) {\n    nextEnabled = false;\n    nextPlugins = plugins.filter((p) => !pluginMatchesToggleSpec(p, spec));\n    if (auditEntry?.defaultState !== 'inactive') {\n      nextPlugins.push({ name: spec, enabled: false });\n    }\n  } else {\n    nextEnabled = true;\n    if (auditEntry?.defaultState === 'active') {\n      nextPlugins = plugins.filter((p) => !pluginMatchesToggleSpec(p, spec));\n    } else {\n      nextPlugins = plugins.filter((p) => !pluginMatchesToggleSpec(p, spec));\n      nextPlugins.push(spec);\n    }\n  }\n\n  const features = {\n    ...(isRecord(deps.config.features) ? deps.config.features : {}),\n    ...(isRecord(existing.features) ? existing.features : {}),\n    plugins: true,\n  };\n  existing.plugins = nextPlugins;\n  existing.features = features;\n  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 0o600 });\n  const restartRequired = spec === 'branch-guard' && !nextEnabled ? undefined : true;\n  return {\n    code: 0,\n    level: 'info',\n    message:\n      `${nextEnabled ? 'Enabled' : 'Disabled'} \"${spec}\". Config written to ${deps.configPath}.` +\n      (spec === 'branch-guard' && !nextEnabled\n        ? ' The running branch-guard hook will disable itself on config update.'\n        : ''),\n    patch: { plugins: nextPlugins, features },\n    restartRequired,\n  };\n}\n\nasync function upsertPlugin(\n  spec: string,\n  opts: { enabled: boolean },\n  deps: PluginManagementDeps,\n  verb: string,\n): Promise<PluginManagementResult> {\n  const existing = await readConfig(deps.configPath);\n  const plugins = Array.isArray(existing.plugins)\n    ? (existing.plugins as Array<string | PluginConfig>)\n    : [];\n  const idx = plugins.findIndex((p) => pluginName(p) === spec);\n  const nextEntry = pluginEntry(spec, opts.enabled);\n  if (idx >= 0) plugins[idx] = nextEntry;\n  else plugins.push(nextEntry);\n  const features = {\n    ...(isRecord(deps.config.features) ? deps.config.features : {}),\n    ...(isRecord(existing.features) ? existing.features : {}),\n    plugins: true,\n  };\n  existing.plugins = plugins;\n  existing.features = features;\n  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 0o600 });\n  const restartRequired = spec === 'branch-guard' && !opts.enabled ? undefined : true;\n  return {\n    code: 0,\n    level: 'info',\n    message:\n      `${verb} \"${spec}\" (${opts.enabled ? 'enabled' : 'disabled'}). Config written to ${deps.configPath}.` +\n      (spec === 'branch-guard' && !opts.enabled\n        ? ' The running branch-guard hook will disable itself on config update.'\n        : ''),\n    patch: { plugins, features },\n    restartRequired,\n  };\n}\n\nasync function removePlugin(\n  spec: string,\n  deps: PluginManagementDeps,\n): Promise<PluginManagementResult> {\n  const existing = await readConfig(deps.configPath);\n  const plugins = Array.isArray(existing.plugins)\n    ? (existing.plugins as Array<string | PluginConfig>)\n    : [];\n  const next = plugins.filter((p) => pluginName(p) !== spec);\n  if (next.length === plugins.length) {\n    return errorResult(`Plugin \"${spec}\" not in config.`);\n  }\n  existing.plugins = next;\n  await atomicWrite(deps.configPath, JSON.stringify(existing, null, 2), { mode: 0o600 });\n  return {\n    code: 0,\n    level: 'info',\n    message: `Removed \"${spec}\" from config.`,\n    patch: { plugins: next },\n    restartRequired: true,\n  };\n}\n\nfunction errorResult(message: string): PluginManagementResult {\n  return { code: 1, level: 'error', message };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);\n}\n"],
-  "mappings": ";;;AAAA,YAAY,QAAQ;AACpB,SAAS,mBAAmB;AAE5B,SAAS,qCAAqC;AAW9C,IAAM,4BAAyD;AAAA,EAC7D;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,cAAc;AAAA,IACd,YAAY;AAAA,EACd;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,cAAc;AAAA,IACd,YAAY;AAAA,EACd;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,cAAc;AAAA,IACd,YAAY;AAAA,EACd;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,cAAc;AAAA,IACd,YAAY;AAAA,EACd;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,cAAc;AAAA,IACd,YAAY;AAAA,EACd;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,cAAc;AAAA,IACd,YAAY;AAAA,EACd;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,cAAc;AAAA,IACd,YAAY;AAAA,EACd;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,cAAc;AAAA,IACd,YAAY;AAAA,EACd;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,cAAc;AAAA,IACd,YAAY;AAAA,EACd;AACF;AAEO,IAAM,uBAAoD,OAAO,OAAO;AAAA,EAC7E,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAEM,IAAM,mBAAmB;AAAA,EAC9B;AAAA,IACE,OAAO;AAAA,IACP,WAAW;AAAA,IACX,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,WAAW;AAAA,IACX,aAAa;AAAA,EACf;AACF;AAwBA,IAAM,mBAAmB,IAAI;AAAA,EAC3B,iBAAiB,QAAQ,CAAC,MAAM;AAAA,IAC9B,CAAC,EAAE,OAAO,EAAE,SAAS;AAAA,IACrB,CAAC,EAAE,WAAW,EAAE,SAAS;AAAA,EAC3B,CAAC;AACH;AAEA,eAAsB,2BACpB,MACA,MACiC;AACjC,QAAM,MAAM,KAAK,CAAC;AAClB,MAAI,CAAC,OAAO,QAAQ,UAAU,QAAQ,UAAU;AAC9C,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SAAS,wBAAwB,KAAK,MAAM;AAAA,IAC9C;AAAA,EACF;AACA,MAAI,QAAQ,cAAc,QAAQ,aAAa;AAC7C,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SAAS,sBAAsB,KAAK,MAAM;AAAA,IAC5C;AAAA,EACF;AACA,MAAI,QAAQ,YAAY,QAAQ,WAAW,QAAQ,QAAQ;AACzD,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SAAS,wBAAwB,KAAK,MAAM;AAAA,IAC9C;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,QAAQ,WAAW;AACtC,UAAM,OAAO,KAAK,CAAC;AACnB,QAAI,CAAC,MAAM;AACT,aAAO,YAAY,kEAAkE;AAAA,IACvF;AACA,WAAO;AAAA,MACL,uBAAuB,IAAI;AAAA,MAC3B,EAAE,SAAS,CAAC,KAAK,SAAS,YAAY,EAAE;AAAA,MACxC;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,YAAY,QAAQ,QAAQ,QAAQ,aAAa;AAC3D,UAAM,OAAO,KAAK,CAAC;AACnB,QAAI,CAAC,MAAM;AACT,aAAO,YAAY,wDAAwD;AAAA,IAC7E;AACA,WAAO,aAAa,uBAAuB,IAAI,GAAG,IAAI;AAAA,EACxD;AACA,MAAI,QAAQ,YAAY,QAAQ,WAAW;AACzC,UAAM,OAAO,KAAK,CAAC;AACnB,QAAI,CAAC,MAAM;AACT,aAAO,YAAY,wBAAwB,GAAG,6BAA6B;AAAA,IAC7E;AACA,WAAO;AAAA,MACL,uBAAuB,IAAI;AAAA,MAC3B,EAAE,SAAS,QAAQ,SAAS;AAAA,MAC5B;AAAA,MACA,QAAQ,WAAW,YAAY;AAAA,IACjC;AAAA,EACF;AACA,MAAI,QAAQ,UAAU;AACpB,UAAM,OAAO,KAAK,CAAC;AACnB,QAAI,CAAC,MAAM;AACT,aAAO,YAAY,0DAA0D;AAAA,IAC/E;AACA,WAAO,aAAa,6BAA6B,IAAI,GAAG,IAAI;AAAA,EAC9D;AACA,MAAI,QAAQ,WAAW;AACrB,WAAO,8BAA8B,KAAK,MAAM,CAAC,GAAG,IAAI;AAAA,EAC1D;AACA,MAAI,QAAQ,OAAO;AACjB,WAAO,oBAAoB,KAAK,MAAM,CAAC,GAAG,IAAI;AAAA,EAChD;AACA,SAAO;AAAA,IACL,8BAA8B,GAAG;AAAA;AAAA,EACnC;AACF;AAEA,IAAM,8BAA8B;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AAEX,eAAe,8BACb,MACA,MACiC;AACjC,QAAM,SAAS,KAAK,CAAC,KAAK;AAC1B,MAAI,WAAW,QAAQ;AACrB,UAAM,SAAS,KAAK,OAAO,eAAe,UAAU,CAAC;AACrD,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SACE,OAAO,WAAW,IACd,sDACA,4CAAuC,OAAO,MAAM;AAAA,EAAO,OAAO,IAAI,CAACA,UAAS,KAAKA,KAAI,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,IAC/G;AAAA,EACF;AAEA,MAAI,WAAW,UAAU,WAAW,UAAU;AAC5C,WAAO,YAAY,2BAA2B;AAAA,EAChD;AACA,QAAM,UAAU,KAAK,CAAC;AACtB,MAAI,CAAC,QAAS,QAAO,YAAY,2BAA2B;AAC5D,QAAM,OAAO,YAAY,MAAM,MAAM,6BAA6B,OAAO;AAEzE,QAAM,WAAW,MAAM,WAAW,KAAK,UAAU;AACjD,QAAM,aAAa,SAAS,SAAS,aAAa,IAAI,SAAS,gBAAgB;AAC/E,QAAM,UAAU,MAAM,QAAQ,aAAa,QAAQ,CAAC,IAChD,WAAW,QAAQ,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IACjF,CAAC,GAAI,KAAK,OAAO,eAAe,UAAU,CAAC,CAAE;AACjD,QAAM,YAAY,oBAAoB,IAAI;AAC1C,QAAM,OACJ,WAAW,SACP,QAAQ,KAAK,CAAC,UAAU,oBAAoB,KAAK,MAAM,SAAS,IAC9D,UACA,CAAC,GAAG,SAAS,IAAI,IACnB,QAAQ,OAAO,CAAC,UAAU,oBAAoB,KAAK,MAAM,SAAS;AAExE,QAAM,gBAAqC,EAAE,QAAQ,KAAK;AAC1D,WAAS,gBAAgB,EAAE,GAAI,cAAc,CAAC,GAAI,GAAG,cAAc;AACnE,QAAM,YAAY,KAAK,YAAY,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AAErF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SACE,WAAW,SACP,WAAW,IAAI,4EACf,aAAa,IAAI;AAAA,IACvB,OAAO,EAAE,cAAc;AAAA,EACzB;AACF;AAEA,SAAS,oBAAoB,MAAsB;AACjD,MAAI,SAAS,IAAK,QAAO;AACzB,SAAO,6BAA6B,IAAI,EAAE,KAAK,EAAE,YAAY;AAC/D;AAEA,IAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AAOX,SAAS,yBAAyB,QAAgB,gBAAgC;AAChF,QAAM,OAAiE,CAAC;AACxE,aAAW,CAACC,aAAY,GAAG,KAAK,OAAO,QAAQ,OAAO,cAAc,CAAC,CAAC,GAAG;AACvE,UAAM,MAAO,MAAkC,KAAK;AACpD,QAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,YAAM,IAAI;AACV,WAAK,KAAK;AAAA,QACR,MAAMA;AAAA,QACN,UAAU,EAAE,YAAY;AAAA,QACxB,OAAO,EAAE,SAAS;AAAA,MACpB,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,QAAQ,CAAC,4CAA4C,cAAc,IAAI;AAC7E,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,EACF,OAAO;AACL,SAAK,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAChD,eAAW,KAAK,MAAM;AACpB,YAAM,KAAK,KAAK,EAAE,KAAK,OAAO,EAAE,CAAC,aAAa,EAAE,SAAS,OAAO,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE;AAAA,IACxF;AACA,UAAM,KAAK,IAAI,oDAAoD;AAAA,EACrE;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAQA,eAAe,oBACb,MACA,MACiC;AACjC,QAAM,iBAAiB,GAAG,KAAK,OAAO,YAAY,GAAG,MAAM,KAAK,OAAO,SAAS,GAAG;AAGnF,MAAI,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,QAAQ;AAC3C,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SAAS,yBAAyB,KAAK,QAAQ,cAAc;AAAA,IAC/D;AAAA,EACF;AAEA,QAAM,OAAO,KAAK,CAAC;AACnB,MAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,EAAG,QAAO,YAAY,gBAAgB;AAEtE,QAAM,kBAAkB,KAAK,OAAO,aAAa,IAAI,IAAI,KAAK;AAG9D,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,QAAQ,CAAC,2BAA2B,IAAI,IAAI;AAClD,QAAI,mBAAmB,OAAO,oBAAoB,UAAU;AAC1D,YAAM,IAAI;AACV,YAAM;AAAA,QACJ,wBAAwB,EAAE,YAAY,WAAW,UAAU,EAAE,SAAS,WAAW;AAAA,QACjF,sBAAsB,cAAc;AAAA,MACtC;AAAA,IACF,OAAO;AACL,YAAM;AAAA,QACJ,qDAAgD,cAAc;AAAA,QAC9D,qCAAqC,IAAI;AAAA,MAC3C;AAAA,IACF;AACA,WAAO,EAAE,MAAM,GAAG,OAAO,UAAU,SAAS,MAAM,KAAK,IAAI,EAAE;AAAA,EAC/D;AAEA,QAAM,WAAW,MAAM,WAAW,KAAK,UAAU;AACjD,QAAM,iBAAiB,SAAS,SAAS,UAAU,IAC9C,SAAS,aACV,CAAC;AACL,QAAM,YAAY,SAAS,eAAe,IAAI,CAAC,IAC3C,EAAE,GAAI,eAAe,IAAI,EAA8B,IACvD,CAAC;AAGL,MAAI,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,MAAM,SAAS;AAChD,QAAI,EAAE,SAAS,cAAc,CAAC,iBAAiB;AAC7C,aAAO,EAAE,MAAM,GAAG,OAAO,QAAQ,SAAS,WAAW,IAAI,yBAAyB;AAAA,IACpF;AACA,WAAO,UAAU,KAAK;AACtB,QAAI,OAAO,KAAK,SAAS,EAAE,WAAW,EAAG,QAAO,eAAe,IAAI;AAAA,QAC9D,gBAAe,IAAI,IAAI;AAC5B,aAAS,aAAa;AACtB,UAAM,YAAY,KAAK,YAAY,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AACrF,UAAMC,UAAS,wBAAwB,KAAK,QAAQ,cAAc;AAGlE,UAAM,cAAcA,QAAO,IAAI;AAC/B,QAAI,aAAa;AACf,aAAO,YAAY,KAAK;AACxB,UAAI,OAAO,KAAK,WAAW,EAAE,WAAW,EAAG,QAAOA,QAAO,IAAI;AAAA,IAC/D;AACA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SACE,6BAA6B,IAAI,gDAA2C,cAAc;AAAA,MAE5F,OAAO,EAAE,YAAYA,QAAO;AAAA,IAC9B;AAAA,EACF;AAGA,QAAM,cAAc,KAAK,CAAC;AAC1B,QAAM,WAAW,KAAK,CAAC;AACvB,MAAI,CAAC,eAAe,YAAY,WAAW,IAAI,EAAG,QAAO,YAAY,gBAAgB;AACrF,QAAM,WAAW,gBAAgB,MAAM,SAAY;AACnD,QAAM,QAAQ,YAAY,aAAa,MAAM,WAAW;AACxD,MAAI,CAAC,YAAY,CAAC,MAAO,QAAO,YAAY,gBAAgB;AAE5D,QAAM,MAA+B,CAAC;AACtC,MAAI,SAAU,KAAI,UAAU,IAAI;AAChC,MAAI,MAAO,KAAI,OAAO,IAAI;AAC1B,YAAU,KAAK,IAAI;AACnB,iBAAe,IAAI,IAAI;AACvB,WAAS,aAAa;AACtB,QAAM,YAAY,KAAK,YAAY,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AAKrF,QAAM,aAAa,OAAO,KAAK,KAAK,OAAO,aAAa,CAAC,CAAC;AAC1D,QAAM,OACJ,YAAY,WAAW,SAAS,KAAK,CAAC,WAAW,SAAS,QAAQ,IAC9D;AAAA,SAAY,QAAQ,6CAA6C,WAAW,KAAK,IAAI,CAAC,iGAEtF;AAEN,QAAM,SAAS,wBAAwB,KAAK,QAAQ,cAAc;AAClE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SACE,WAAW,IAAI,2CACH,YAAY,WAAW,UAAU,SAAS,WAAW,2BACxC,cAAc,gDAAgD,IAAI;AAAA,IAC7F,OAAO,EAAE,YAAY,OAAO;AAAA,EAC9B;AACF;AAMA,SAAS,wBACP,QACA,gBACyC;AACzC,QAAM,SAAkD,CAAC;AACzD,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,cAAc,CAAC,CAAC,GAAG;AAC5D,WAAO,CAAC,IAAI,EAAE,GAAG,EAAE;AAAA,EACrB;AACA,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,cAAc,GAAG;AACnD,QAAI,SAAS,CAAC,EAAG,QAAO,CAAC,IAAI,EAAE,GAAI,OAAO,CAAC,KAAK,CAAC,GAAI,GAAG,EAAE;AAAA,EAC5D;AAEA,aAAW,KAAK,OAAO,KAAK,MAAM,GAAG;AACnC,QAAI,EAAE,KAAK,mBAAmB,EAAE,MAAM,OAAO,cAAc,CAAC,IAAK,QAAO,OAAO,CAAC;AAAA,EAClF;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAAuB;AAC5D,SAAO,iBAAiB,IAAI,MAAM,YAAY,CAAC,KAAK;AACtD;AAEA,SAAS,6BAA6B,OAAuB;AAC3D,MAAI,MAAM,YAAY,MAAM,uBAAwB,QAAO;AAC3D,MAAI,cAAc,KAAK,EAAG,QAAO;AACjC,SAAO,uBAAuB,KAAK;AACrC;AAEO,SAAS,sBAAsB,QAAyB;AAC7D,SAAO;AAAA,IACL;AAAA,IACA,GAAG,iBAAiB,IAAI,CAAC,MAAM;AAC7B,YAAM,QAAQ,SAAS,oBAAoB,QAAQ,EAAE,SAAS,IAAI;AAClE,YAAM,SAAS,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAC,MAAM;AAChD,aAAO,KAAK,EAAE,MAAM,OAAO,EAAE,CAAC,IAAI,MAAM,GAAG,EAAE,UAAU,OAAO,EAAE,CAAC,IAAI,EAAE,WAAW;AAAA,IACpF,CAAC;AAAA,IACD;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEO,SAAS,wBAAwB,QAAwB;AAC9D,QAAM,UAAU,OAAO,WAAW,CAAC;AACnC,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACA,SAAO,QACJ,IAAI,CAAC,MAAM;AACV,UAAM,OAAO,WAAW,CAAC;AACzB,UAAM,UAAU,OAAO,MAAM,YAAY,EAAE,YAAY,QAAQ,aAAa;AAC5E,UAAM,WAAW,iBAAiB,KAAK,CAAC,UAAU,MAAM,cAAc,IAAI;AAC1E,UAAM,SAAS,WAAW,KAAK,SAAS,KAAK,MAAM;AACnD,WAAO,KAAK,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC,IAAI,OAAO;AAAA,EACtD,CAAC,EACA,KAAK,IAAI;AACd;AAEO,SAAS,wBAAwB,QAAwB;AAC9D,QAAM,aAAa,OAAO,WAAW,CAAC;AACtC,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,aAAW,SAAS,sBAAsB;AACxC,UAAM,EAAE,OAAO,OAAO,IAAI,oBAAoB,QAAQ,KAAK;AAC3D,UAAM,SAAS,MAAM,aAAa,eAAe,aAAa,KAAK;AACnE,UAAM;AAAA,MACJ,KAAK,MAAM,KAAK,OAAO,EAAE,CAAC,IAAI,MAAM,OAAO,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,SAAS,MAAM,KAAK,OAAO,CAAC,CAAC,IAAI,OAAO,OAAO,EAAE,CAAC,IAAI,MAAM,OAAO;AAAA,IACtI;AAAA,EACF;AAEA,QAAM,QAAQ,WAAW;AAAA,IACvB,CAAC,WAAW,CAAC,qBAAqB,KAAK,CAAC,UAAU,wBAAwB,QAAQ,MAAM,IAAI,CAAC;AAAA,EAC/F;AACA,MAAI,MAAM,SAAS,GAAG;AACpB,UAAM,KAAK,IAAI,8CAA8C;AAC7D,eAAW,UAAU,OAAO;AAC1B,YAAM,OAAO,WAAW,MAAM;AAC9B,YAAM,QAAQ,OAAO,WAAW,YAAY,OAAO,YAAY,QAAQ,aAAa;AACpF,YAAM;AAAA,QACJ,KAAK,KAAK,OAAO,EAAE,CAAC,IAAI,MAAM,OAAO,CAAC,CAAC;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AAEA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,eAAe,WAAW,MAAgD;AACxE,MAAI;AACF,WAAO,KAAK,MAAM,MAAS,YAAS,MAAM,MAAM,CAAC;AAAA,EACnD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,WAAW,GAAkC;AACpD,SAAO,OAAO,MAAM,WAAW,IAAI,EAAE;AACvC;AAEA,SAAS,YAAY,MAAc,SAAyC;AAC1E,SAAO,UAAU,OAAO,EAAE,MAAM,MAAM,SAAS,MAAM;AACvD;AAEA,SAAS,wBAAwB,GAA0B,MAAuB;AAChF,QAAM,OAAO,WAAW,CAAC;AACzB,MAAI,SAAS,WAAY,QAAO,SAAS,cAAc,SAAS;AAChE,SAAO,SAAS;AAClB;AAEA,SAAS,oBACP,QACA,OACiE;AACjE,QAAM,cAAc,OAAO,WAAW,CAAC,GAAG;AAAA,IAAK,CAAC,WAC9C,wBAAwB,QAAQ,MAAM,IAAI;AAAA,EAC5C;AACA,MAAI,YAAY;AACd,WAAO;AAAA,MACL,OACE,OAAO,eAAe,YAAY,WAAW,YAAY,QAAQ,aAAa;AAAA,MAChF,QAAQ;AAAA,IACV;AAAA,EACF;AACA,SAAO;AAAA,IACL,OAAO,MAAM,iBAAiB,WAAW,YAAY;AAAA,IACrD,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,aAAa,OAAiC;AACrD,MAAI,MAAM,WAAY,QAAO;AAC7B,MAAI,MAAM,SAAS,kBAAkB;AACnC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,cAAc,MAA4C;AACjE,SAAO,qBAAqB,KAAK,CAAC,UAAU,MAAM,SAAS,IAAI;AACjE;AAEA,SAAS,oBACP,QACA,MAC2C;AAC3C,QAAM,SAAS,OAAO,WAAW,CAAC,GAAG,KAAK,CAAC,MAAM,WAAW,CAAC,MAAM,IAAI;AACvE,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,OAAO,UAAU,YAAY,MAAM,YAAY,QAAQ,aAAa;AAC7E;AAEA,eAAe,aACb,MACA,MACiC;AACjC,QAAM,aAAa,cAAc,IAAI;AACrC,MAAI,YAAY,eAAe,OAAO;AACpC,WAAO,YAAY,WAAW,IAAI,yDAAyD;AAAA,EAC7F;AAEA,QAAM,WAAW,MAAM,WAAW,KAAK,UAAU;AACjD,QAAM,UAAU,MAAM,QAAQ,SAAS,OAAO,IACzC,SAAS,UACV,CAAC;AACL,QAAM,MAAM,QAAQ,UAAU,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACrE,QAAM,aAAa,OAAO,IAAI,QAAQ,GAAG,IAAI;AAC7C,QAAM,UAAU,aACZ,EAAE,OAAO,eAAe,YAAY,WAAW,YAAY,SAC3D,YAAY,iBAAiB;AAEjC,MAAI,CAAC,cAAc,CAAC,YAAY;AAC9B,WAAO;AAAA,MACL,WAAW,IAAI,+CAA+C,IAAI;AAAA,IACpE;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI,SAAS;AACX,kBAAc;AACd,kBAAc,QAAQ,OAAO,CAAC,MAAM,CAAC,wBAAwB,GAAG,IAAI,CAAC;AACrE,QAAI,YAAY,iBAAiB,YAAY;AAC3C,kBAAY,KAAK,EAAE,MAAM,MAAM,SAAS,MAAM,CAAC;AAAA,IACjD;AAAA,EACF,OAAO;AACL,kBAAc;AACd,QAAI,YAAY,iBAAiB,UAAU;AACzC,oBAAc,QAAQ,OAAO,CAAC,MAAM,CAAC,wBAAwB,GAAG,IAAI,CAAC;AAAA,IACvE,OAAO;AACL,oBAAc,QAAQ,OAAO,CAAC,MAAM,CAAC,wBAAwB,GAAG,IAAI,CAAC;AACrE,kBAAY,KAAK,IAAI;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,WAAW;AAAA,IACf,GAAI,SAAS,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,WAAW,CAAC;AAAA,IAC7D,GAAI,SAAS,SAAS,QAAQ,IAAI,SAAS,WAAW,CAAC;AAAA,IACvD,SAAS;AAAA,EACX;AACA,WAAS,UAAU;AACnB,WAAS,WAAW;AACpB,QAAM,YAAY,KAAK,YAAY,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AACrF,QAAM,kBAAkB,SAAS,kBAAkB,CAAC,cAAc,SAAY;AAC9E,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SACE,GAAG,cAAc,YAAY,UAAU,KAAK,IAAI,wBAAwB,KAAK,UAAU,OACtF,SAAS,kBAAkB,CAAC,cACzB,yEACA;AAAA,IACN,OAAO,EAAE,SAAS,aAAa,SAAS;AAAA,IACxC;AAAA,EACF;AACF;AAEA,eAAe,aACb,MACA,MACA,MACA,MACiC;AACjC,QAAM,WAAW,MAAM,WAAW,KAAK,UAAU;AACjD,QAAM,UAAU,MAAM,QAAQ,SAAS,OAAO,IACzC,SAAS,UACV,CAAC;AACL,QAAM,MAAM,QAAQ,UAAU,CAAC,MAAM,WAAW,CAAC,MAAM,IAAI;AAC3D,QAAM,YAAY,YAAY,MAAM,KAAK,OAAO;AAChD,MAAI,OAAO,EAAG,SAAQ,GAAG,IAAI;AAAA,MACxB,SAAQ,KAAK,SAAS;AAC3B,QAAM,WAAW;AAAA,IACf,GAAI,SAAS,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,WAAW,CAAC;AAAA,IAC7D,GAAI,SAAS,SAAS,QAAQ,IAAI,SAAS,WAAW,CAAC;AAAA,IACvD,SAAS;AAAA,EACX;AACA,WAAS,UAAU;AACnB,WAAS,WAAW;AACpB,QAAM,YAAY,KAAK,YAAY,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AACrF,QAAM,kBAAkB,SAAS,kBAAkB,CAAC,KAAK,UAAU,SAAY;AAC/E,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SACE,GAAG,IAAI,KAAK,IAAI,MAAM,KAAK,UAAU,YAAY,UAAU,wBAAwB,KAAK,UAAU,OACjG,SAAS,kBAAkB,CAAC,KAAK,UAC9B,yEACA;AAAA,IACN,OAAO,EAAE,SAAS,SAAS;AAAA,IAC3B;AAAA,EACF;AACF;AAEA,eAAe,aACb,MACA,MACiC;AACjC,QAAM,WAAW,MAAM,WAAW,KAAK,UAAU;AACjD,QAAM,UAAU,MAAM,QAAQ,SAAS,OAAO,IACzC,SAAS,UACV,CAAC;AACL,QAAM,OAAO,QAAQ,OAAO,CAAC,MAAM,WAAW,CAAC,MAAM,IAAI;AACzD,MAAI,KAAK,WAAW,QAAQ,QAAQ;AAClC,WAAO,YAAY,WAAW,IAAI,kBAAkB;AAAA,EACtD;AACA,WAAS,UAAU;AACnB,QAAM,YAAY,KAAK,YAAY,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AACrF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS,YAAY,IAAI;AAAA,IACzB,OAAO,EAAE,SAAS,KAAK;AAAA,IACvB,iBAAiB;AAAA,EACnB;AACF;AAEA,SAAS,YAAY,SAAyC;AAC5D,SAAO,EAAE,MAAM,GAAG,OAAO,SAAS,QAAQ;AAC5C;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;",
-  "names": ["name", "pluginName", "merged"]
-}

package/dist/chunk-YWUPHRGB.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/config-history.ts"],
-  "sourcesContent": ["import { randomUUID } from 'node:crypto';\nimport * as fs from 'node:fs/promises';\nimport os from 'node:os';\nimport * as path from 'node:path';\nimport { atomicWrite, resolveWstackPaths, writeErr } from '@wrongstack/core/utils';\nimport { ERROR_CODES, FsError } from '@wrongstack/core/types';\nimport { isSecretField } from '@wrongstack/core/security';\nimport { toErrorMessage } from '@wrongstack/core/utils';\n\n// \u2500\u2500 UID ownership \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ntype UidFn = () => string | number | undefined;\nconst defaultUidFn: UidFn = () => os.userInfo().uid;\n\nasync function getFileUid(filePath: string): Promise<string | number | undefined> {\n  try {\n    const stat = await fs.stat(filePath);\n    return stat.uid;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Verify the calling process owns config.json before allowing a write operation.\n * Guards against one user on a shared multi-user system overwriting another's config.\n *\n * On Windows, .uid is always undefined on the UserInfo object, and the NT ACL\n * model already restricts writes \u2014 so we skip the check on win32.\n * On Unix, we compare the process euid against the file's uid.\n * If config.json doesn't exist yet, we allow the write (first-time setup).\n */\nasync function checkConfigOwnership(\n  homeFn: HomeDirFn,\n  uidFn: UidFn = defaultUidFn,\n  targetConfigPath?: string,\n): Promise<boolean> {\n  if (os.platform() === 'win32') return true; // ACLs handle this on Windows\n\n  const cfg = configPath(homeFn, targetConfigPath);\n  const fileUid = await getFileUid(cfg);\n  if (fileUid === undefined) return true; // file doesn't exist yet \u2014 allow\n\n  const callerUid = uidFn();\n  if (callerUid === undefined) return true; // can't determine \u2014 allow, don't block\n\n  return fileUid === callerUid;\n}\n\n// \u2500\u2500 Protected files/directories \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// These are NEVER touched by any operation in this module.\n// Guards against bugs (glob patterns, typos, race conditions)\n// accidentally deleting critical user data.\nconst PROTECTED_BASENAMES = new Set(['config.json', '.key', 'index.json']);\nconst MAX_CONFIG_BACKUPS = 10;\nexport const MAX_CONFIG_HISTORY_ENTRIES = 50;\n\n// Top-level directories that should never be deleted even if a prune\n// pattern accidentally widens. These are absolute directory names\n// relative to the .wrongstack root.\n\n/**\n * Guard: throw if `filename` is a protected file or lives inside a protected\n * directory. Used before any unlink / rm call to make accidentally deleting\n * critical files impossible.\n */\nfunction assertSafeToDelete(filename: string, parentDir: string): void {\n  // 1. Exact-match protected files\n  if (PROTECTED_BASENAMES.has(filename)) {\n    throw new FsError({\n      message: `Refusing to delete protected file: ${filename}`,\n      code: ERROR_CODES.FS_DELETE_FAILED,\n      path: path.join(parentDir, filename),\n      context: { reason: 'protected_basename' },\n    });\n  }\n  // 2. No path traversal\n  if (filename !== path.basename(filename)) {\n    throw new FsError({\n      message: `Refusing to delete path with traversal: ${filename}`,\n      code: ERROR_CODES.FS_DELETE_FAILED,\n      path: filename,\n      context: { reason: 'path_traversal' },\n    });\n  }\n  // 3. Validate it's a timestamped config backup (config.json.{ts}.bak)\n  //    before we ever consider deleting it.\n  if (!filename.startsWith('config.json.') || !filename.endsWith('.bak')) {\n    // Unknown files \u2014 be conservative, refuse\n    throw new FsError({\n      message: `Refusing to delete unknown file: ${filename}`,\n      code: ERROR_CODES.FS_DELETE_FAILED,\n      path: path.join(parentDir, filename),\n      context: { reason: 'unknown_file_pattern' },\n    });\n  }\n  // 4. Check parent is the .wrongstack root and the target is not a dir\n  const resolvedParent = path.resolve(parentDir);\n  const parentOfProfile = path.dirname(resolvedParent);\n  const isGlobalRoot = path.basename(resolvedParent) === '.wrongstack';\n  const isProfileDir =\n    path.basename(parentOfProfile) === 'profiles' &&\n    path.basename(path.dirname(parentOfProfile)) === '.wrongstack';\n  if (!isGlobalRoot && !isProfileDir) {\n    throw new FsError({\n      message: `Unexpected parent directory for bak prune: ${resolvedParent}`,\n      code: ERROR_CODES.FS_DELETE_FAILED,\n      path: resolvedParent,\n      context: { reason: 'invalid_parent' },\n    });\n  }\n}\n\n/**\n * Safely delete a file only if it passes safety checks.\n * Never throws \u2014 errors are swallowed (best-effort).\n */\nasync function safeDelete(filePath: string): Promise<void> {\n  const dir = path.dirname(filePath);\n  const filename = path.basename(filePath);\n  try {\n    assertSafeToDelete(filename, dir);\n    await fs.unlink(filePath);\n  } catch (err) {\n    // Log but don't crash \u2014 safety check violations are logged for debugging\n    if (err instanceof Error && err.message.startsWith('Refusing')) {\n      writeErr(`[config-history] SAFETY: ${err.message}\\n`);\n    }\n    // Best-effort \u2014 ignore other errors (file doesn't exist, etc.)\n  }\n}\n\nexport interface HistoryEntry {\n  id: string;\n  timestamp: string;\n  description: string;\n  snapshotMasked: Record<string, unknown>;\n  diffSummary: string;\n}\n\ninterface HistoryIndex {\n  version: 1;\n  entries: Array<{ id: string; timestamp: string; description: string }>;\n}\n\nfunction maskConfigSecrets(cfg: Record<string, unknown>): Record<string, unknown> {\n  if (typeof cfg !== 'object' || cfg === null) return {};\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(cfg)) {\n    if (isSecretField(k)) {\n      out[k] = '[REDACTED]';\n    } else if (typeof v === 'object' && v !== null && !Array.isArray(v)) {\n      out[k] = maskConfigSecrets(v as Record<string, unknown>);\n    } else {\n      out[k] = v;\n    }\n  }\n  return out;\n}\n\nfunction diffSummary(oldCfg: Record<string, unknown>, newCfg: Record<string, unknown>): string {\n  const changes: string[] = [];\n  const allKeys = new Set([...Object.keys(oldCfg), ...Object.keys(newCfg)]);\n  for (const k of allKeys) {\n    const o = JSON.stringify(oldCfg[k]);\n    const n = JSON.stringify(newCfg[k]);\n    if (o !== n) {\n      if (isSecretField(k)) {\n        changes.push(`${k}: [CHANGED]`);\n      } else if (typeof newCfg[k] !== 'object') {\n        changes.push(`${k}: ${oldCfg[k] ?? '(unset)'} \u2192 ${newCfg[k]}`);\n      } else {\n        changes.push(`${k}: [CHANGED]`);\n      }\n    }\n  }\n  return changes.length > 0 ? changes.slice(0, 5).join(', ') : 'no changes';\n}\n\ntype HomeDirFn = () => string;\nconst defaultHomeDir: HomeDirFn = () => os.homedir();\n\nfunction activeProfileConfigPath(homeFn: HomeDirFn): string {\n  const paths =\n    homeFn === defaultHomeDir\n      ? resolveWstackPaths({ projectRoot: process.cwd() })\n      : resolveWstackPaths({ projectRoot: process.cwd(), userHome: homeFn() });\n  return paths.profileConfig(paths.profileName);\n}\n\nfunction historyDir(homeFn: HomeDirFn = defaultHomeDir, targetConfigPath?: string): string {\n  return path.join(path.dirname(configPath(homeFn, targetConfigPath)), 'config.history', 'entries');\n}\n\nfunction historyIndexPath(homeFn: HomeDirFn = defaultHomeDir, targetConfigPath?: string): string {\n  return path.join(path.dirname(configPath(homeFn, targetConfigPath)), 'config.history', 'index.json');\n}\n\nfunction configPath(homeFn: HomeDirFn = defaultHomeDir, targetConfigPath?: string): string {\n  return targetConfigPath ?? activeProfileConfigPath(homeFn);\n}\n\nfunction backupLastPath(homeFn: HomeDirFn = defaultHomeDir, targetConfigPath?: string): string {\n  return `${configPath(homeFn, targetConfigPath)}.last`;\n}\n\nfunction entryId(ts: string): string {\n  return `${ts.replace(/[:.]/g, '-')}-${randomUUID().slice(0, 8)}`;\n}\n\nasync function ensureHistoryDir(\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<void> {\n  try {\n    await fs.mkdir(historyDir(homeFn, targetConfigPath), { recursive: true });\n  } catch (err) {\n    throw new FsError({\n      message: toErrorMessage(err),\n      code: ERROR_CODES.FS_MKDIR_FAILED,\n      path: historyDir(homeFn, targetConfigPath),\n      cause: err,\n    });\n  }\n}\n\nasync function readIndex(\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<HistoryIndex> {\n  try {\n    const raw = await fs.readFile(historyIndexPath(homeFn, targetConfigPath), 'utf8');\n    return JSON.parse(raw) as HistoryIndex;\n  } catch {\n    return { version: 1, entries: [] };\n  }\n}\n\nasync function writeIndex(\n  idx: HistoryIndex,\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<void> {\n  await ensureHistoryDir(homeFn, targetConfigPath);\n  // atomicWrite: torn write here would wipe the entire config-history\n  // index, hiding the user's prior backups behind a \"no history\" UI.\n  try {\n    await atomicWrite(historyIndexPath(homeFn, targetConfigPath), JSON.stringify(idx, null, 2));\n  } catch (err) {\n    throw new FsError({\n      message: toErrorMessage(err),\n      code: ERROR_CODES.FS_ATOMIC_WRITE_FAILED,\n      path: historyIndexPath(homeFn, targetConfigPath),\n      cause: err,\n    });\n  }\n}\n\nasync function pruneHistoryEntries(\n  idx: HistoryIndex,\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<void> {\n  const removed = idx.entries.splice(MAX_CONFIG_HISTORY_ENTRIES);\n  const keep = new Set(idx.entries.map((entry) => `${entry.id}.json`));\n  const dir = historyDir(homeFn, targetConfigPath);\n\n  for (const entry of removed) {\n    try {\n      await fs.unlink(path.join(dir, `${entry.id}.json`));\n    } catch {\n      // best-effort: stale index entries should not block config writes\n    }\n  }\n\n  try {\n    const files = await fs.readdir(dir);\n    await Promise.all(\n      files\n        .filter((file) => file.endsWith('.json') && !keep.has(file))\n        .map(async (file) => {\n          try {\n            await fs.unlink(path.join(dir, file));\n          } catch {\n            // best-effort: orphan cleanup should not block config writes\n          }\n        }),\n    );\n  } catch {\n    // best-effort: missing history dir or readdir failure should not block writes\n  }\n}\n\n/**\n * Backup current config.json \u2192 config.json.last and timestamped .bak files.\n * Safe to call even if config.json doesn't exist. Never throws.\n *\n * IMPORTANT: config.json and .key are never deleted by this function.\n * Only config.json.*.bak timestamped snapshots are pruned.\n */\nexport async function backupCurrent(\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<void> {\n  const cfg = configPath(homeFn, targetConfigPath);\n  const last = backupLastPath(homeFn, targetConfigPath);\n  const ts = Date.now();\n\n  // Read existing config content for .last backup\n  let content: string | undefined;\n  try {\n    content = await fs.readFile(cfg, 'utf8');\n  } catch {\n    // May not exist yet \u2014 that's fine, we just skip the backup\n  }\n\n  if (content !== undefined) {\n    try {\n      await atomicWrite(last, content);\n    } catch (err) {\n      writeErr(\n        `[config-history] .last backup failed: ${toErrorMessage(err)}`,\n      );\n    }\n  }\n\n  // Create timestamped snapshot\n  if (content !== undefined) {\n    try {\n      const bakPath = `${cfg}.${ts}.bak`;\n      await atomicWrite(bakPath, content);\n    } catch (err) {\n      writeErr(\n        `[config-history] timestamped backup failed: ${toErrorMessage(err)}`,\n      );\n    }\n  }\n\n  // Prune old .bak files \u2014 keep last 10\n  try {\n    const dir = path.dirname(cfg);\n    const files = await fs.readdir(dir);\n    const baks = files\n      .filter((f) => f.startsWith('config.json.') && f.endsWith('.bak'))\n      .sort()\n      .reverse();\n    for (const f of baks.slice(MAX_CONFIG_BACKUPS)) {\n      await safeDelete(path.join(dir, f));\n    }\n  } catch (err) {\n    writeErr(\n      `[config-history] backup prune failed: ${toErrorMessage(err)}`,\n    );\n  }\n}\n\n/**\n * Append a history entry for a config change.\n */\nexport async function appendHistory(\n  oldCfg: Record<string, unknown>,\n  newCfg: Record<string, unknown>,\n  description: string,\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<string> {\n  const timestamp = new Date().toISOString();\n  const id = entryId(timestamp);\n\n  await ensureHistoryDir(homeFn, targetConfigPath);\n\n  const entry: HistoryEntry = {\n    id,\n    timestamp,\n    description,\n    snapshotMasked: maskConfigSecrets(newCfg) as Record<string, unknown>,\n    diffSummary: diffSummary(oldCfg, newCfg),\n  };\n\n  try {\n    await fs.writeFile(\n      path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),\n      JSON.stringify(entry, null, 2),\n      'utf8',\n    );\n  } catch (err) {\n    throw new FsError({\n      message: toErrorMessage(err),\n      code: ERROR_CODES.FS_WRITE_FAILED,\n      path: path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),\n      cause: err,\n    });\n  }\n\n  const idx = await readIndex(homeFn, targetConfigPath);\n  idx.entries.unshift({ id, timestamp, description });\n  await pruneHistoryEntries(idx, homeFn, targetConfigPath);\n  await writeIndex(idx, homeFn, targetConfigPath);\n\n  return id;\n}\n\n/**\n * List all history entries (newest first).\n */\nexport async function listHistory(\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<HistoryIndex['entries']> {\n  const idx = await readIndex(homeFn, targetConfigPath);\n  return idx.entries;\n}\n\n/**\n * Get a specific history entry by ID.\n */\nexport async function getHistoryEntry(\n  id: string,\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<HistoryEntry | null> {\n  try {\n    const raw = await fs.readFile(\n      path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),\n      'utf8',\n    );\n    return JSON.parse(raw) as HistoryEntry;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Restore config.json to a given history entry's snapshot.\n */\nexport async function restoreFromHistory(\n  id: string,\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<{ ok: boolean; backupId: string | null; error?: string | undefined }> {\n  const entry = await getHistoryEntry(id, homeFn, targetConfigPath);\n  if (!entry) return { ok: false, backupId: null, error: 'History entry not found' };\n\n  // Ownership guard \u2014 refuse to write config.json if the calling process\n  // does not own the file. Prevents one user on a multi-user system from\n  // overwriting another user's config via a shared wrongstack install.\n  if (!(await checkConfigOwnership(homeFn, defaultUidFn, targetConfigPath))) {\n    return {\n      ok: false,\n      backupId: null,\n      error: 'Operation denied: config file is not owned by current user',\n    };\n  }\n\n  await backupCurrent(homeFn, targetConfigPath);\n\n  let oldCfg: Record<string, unknown> = {};\n  try {\n    const raw = await fs.readFile(configPath(homeFn, targetConfigPath), 'utf8');\n    oldCfg = JSON.parse(raw);\n  } catch {\n    // No config to restore from\n  }\n\n  try {\n    await atomicWrite(configPath(homeFn, targetConfigPath), JSON.stringify(entry.snapshotMasked, null, 2));\n  } catch (err) {\n    return { ok: false, backupId: null, error: String(err) };\n  }\n\n  const backupId = await appendHistory(\n    oldCfg,\n    entry.snapshotMasked as Record<string, unknown>,\n    `Restored from history ${id}`,\n    homeFn,\n    targetConfigPath,\n  );\n\n  return { ok: true, backupId };\n}\n\n/**\n * Restore config.json to the .last backup.\n */\nexport async function restoreLast(\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<{ ok: boolean; error?: string | undefined }> {\n  const last = backupLastPath(homeFn, targetConfigPath);\n  const cfg = configPath(homeFn, targetConfigPath);\n\n  let oldCfg: Record<string, unknown> = {};\n  try {\n    const raw = await fs.readFile(cfg, 'utf8');\n    oldCfg = JSON.parse(raw);\n  } catch {\n    // Ignore\n  }\n\n  let lastCfg: Record<string, unknown> = {};\n  try {\n    const raw = await fs.readFile(last, 'utf8');\n    lastCfg = JSON.parse(raw);\n  } catch {\n    return { ok: false, error: 'No prior backup found' };\n  }\n\n  // Ownership guard \u2014 refuse to write config.json if the calling process\n  // does not own the file. Prevents one user on a multi-user system from\n  // overwriting another user's config via a shared wrongstack install.\n  if (!(await checkConfigOwnership(homeFn, defaultUidFn, targetConfigPath))) {\n    return { ok: false, error: 'Operation denied: config file is not owned by current user' };\n  }\n\n  await backupCurrent(homeFn, targetConfigPath);\n\n  try {\n    await atomicWrite(cfg, JSON.stringify(lastCfg, null, 2));\n  } catch (err) {\n    return { ok: false, error: String(err) };\n  }\n\n  await appendHistory(oldCfg, lastCfg, 'Restored from config.json.last', homeFn, targetConfigPath);\n\n  return { ok: true };\n}\n"],
-  "mappings": ";;;AAAA,SAAS,kBAAkB;AAC3B,YAAY,QAAQ;AACpB,OAAO,QAAQ;AACf,YAAY,UAAU;AACtB,SAAS,aAAa,oBAAoB,gBAAgB;AAC1D,SAAS,aAAa,eAAe;AACrC,SAAS,qBAAqB;AAC9B,SAAS,sBAAsB;AAK/B,IAAM,eAAsB,MAAM,GAAG,SAAS,EAAE;AAEhD,eAAe,WAAW,UAAwD;AAChF,MAAI;AACF,UAAMA,QAAO,MAAS,QAAK,QAAQ;AACnC,WAAOA,MAAK;AAAA,EACd,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,eAAe,qBACb,QACA,QAAe,cACf,kBACkB;AAClB,MAAI,GAAG,SAAS,MAAM,QAAS,QAAO;AAEtC,QAAM,MAAM,WAAW,QAAQ,gBAAgB;AAC/C,QAAM,UAAU,MAAM,WAAW,GAAG;AACpC,MAAI,YAAY,OAAW,QAAO;AAElC,QAAM,YAAY,MAAM;AACxB,MAAI,cAAc,OAAW,QAAO;AAEpC,SAAO,YAAY;AACrB;AAMA,IAAM,sBAAsB,oBAAI,IAAI,CAAC,eAAe,QAAQ,YAAY,CAAC;AACzE,IAAM,qBAAqB;AACpB,IAAM,6BAA6B;AAW1C,SAAS,mBAAmB,UAAkB,WAAyB;AAErE,MAAI,oBAAoB,IAAI,QAAQ,GAAG;AACrC,UAAM,IAAI,QAAQ;AAAA,MAChB,SAAS,sCAAsC,QAAQ;AAAA,MACvD,MAAM,YAAY;AAAA,MAClB,MAAW,UAAK,WAAW,QAAQ;AAAA,MACnC,SAAS,EAAE,QAAQ,qBAAqB;AAAA,IAC1C,CAAC;AAAA,EACH;AAEA,MAAI,aAAkB,cAAS,QAAQ,GAAG;AACxC,UAAM,IAAI,QAAQ;AAAA,MAChB,SAAS,2CAA2C,QAAQ;AAAA,MAC5D,MAAM,YAAY;AAAA,MAClB,MAAM;AAAA,MACN,SAAS,EAAE,QAAQ,iBAAiB;AAAA,IACtC,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,SAAS,WAAW,cAAc,KAAK,CAAC,SAAS,SAAS,MAAM,GAAG;AAEtE,UAAM,IAAI,QAAQ;AAAA,MAChB,SAAS,oCAAoC,QAAQ;AAAA,MACrD,MAAM,YAAY;AAAA,MAClB,MAAW,UAAK,WAAW,QAAQ;AAAA,MACnC,SAAS,EAAE,QAAQ,uBAAuB;AAAA,IAC5C,CAAC;AAAA,EACH;AAEA,QAAM,iBAAsB,aAAQ,SAAS;AAC7C,QAAM,kBAAuB,aAAQ,cAAc;AACnD,QAAM,eAAoB,cAAS,cAAc,MAAM;AACvD,QAAM,eACC,cAAS,eAAe,MAAM,cAC9B,cAAc,aAAQ,eAAe,CAAC,MAAM;AACnD,MAAI,CAAC,gBAAgB,CAAC,cAAc;AAClC,UAAM,IAAI,QAAQ;AAAA,MAChB,SAAS,8CAA8C,cAAc;AAAA,MACrE,MAAM,YAAY;AAAA,MAClB,MAAM;AAAA,MACN,SAAS,EAAE,QAAQ,iBAAiB;AAAA,IACtC,CAAC;AAAA,EACH;AACF;AAMA,eAAe,WAAW,UAAiC;AACzD,QAAM,MAAW,aAAQ,QAAQ;AACjC,QAAM,WAAgB,cAAS,QAAQ;AACvC,MAAI;AACF,uBAAmB,UAAU,GAAG;AAChC,UAAS,UAAO,QAAQ;AAAA,EAC1B,SAAS,KAAK;AAEZ,QAAI,eAAe,SAAS,IAAI,QAAQ,WAAW,UAAU,GAAG;AAC9D,eAAS,4BAA4B,IAAI,OAAO;AAAA,CAAI;AAAA,IACtD;AAAA,EAEF;AACF;AAeA,SAAS,kBAAkB,KAAuD;AAChF,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO,CAAC;AACrD,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AACxC,QAAI,cAAc,CAAC,GAAG;AACpB,UAAI,CAAC,IAAI;AAAA,IACX,WAAW,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC,GAAG;AACnE,UAAI,CAAC,IAAI,kBAAkB,CAA4B;AAAA,IACzD,OAAO;AACL,UAAI,CAAC,IAAI;AAAA,IACX;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,QAAiC,QAAyC;AAC7F,QAAM,UAAoB,CAAC;AAC3B,QAAM,UAAU,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,GAAG,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC;AACxE,aAAW,KAAK,SAAS;AACvB,UAAM,IAAI,KAAK,UAAU,OAAO,CAAC,CAAC;AAClC,UAAM,IAAI,KAAK,UAAU,OAAO,CAAC,CAAC;AAClC,QAAI,MAAM,GAAG;AACX,UAAI,cAAc,CAAC,GAAG;AACpB,gBAAQ,KAAK,GAAG,CAAC,aAAa;AAAA,MAChC,WAAW,OAAO,OAAO,CAAC,MAAM,UAAU;AACxC,gBAAQ,KAAK,GAAG,CAAC,KAAK,OAAO,CAAC,KAAK,SAAS,WAAM,OAAO,CAAC,CAAC,EAAE;AAAA,MAC/D,OAAO;AACL,gBAAQ,KAAK,GAAG,CAAC,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AACA,SAAO,QAAQ,SAAS,IAAI,QAAQ,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI;AAC/D;AAGA,IAAM,iBAA4B,MAAM,GAAG,QAAQ;AAEnD,SAAS,wBAAwB,QAA2B;AAC1D,QAAM,QACJ,WAAW,iBACP,mBAAmB,EAAE,aAAa,QAAQ,IAAI,EAAE,CAAC,IACjD,mBAAmB,EAAE,aAAa,QAAQ,IAAI,GAAG,UAAU,OAAO,EAAE,CAAC;AAC3E,SAAO,MAAM,cAAc,MAAM,WAAW;AAC9C;AAEA,SAAS,WAAW,SAAoB,gBAAgB,kBAAmC;AACzF,SAAY,UAAU,aAAQ,WAAW,QAAQ,gBAAgB,CAAC,GAAG,kBAAkB,SAAS;AAClG;AAEA,SAAS,iBAAiB,SAAoB,gBAAgB,kBAAmC;AAC/F,SAAY,UAAU,aAAQ,WAAW,QAAQ,gBAAgB,CAAC,GAAG,kBAAkB,YAAY;AACrG;AAEA,SAAS,WAAW,SAAoB,gBAAgB,kBAAmC;AACzF,SAAO,oBAAoB,wBAAwB,MAAM;AAC3D;AAEA,SAAS,eAAe,SAAoB,gBAAgB,kBAAmC;AAC7F,SAAO,GAAG,WAAW,QAAQ,gBAAgB,CAAC;AAChD;AAEA,SAAS,QAAQ,IAAoB;AACnC,SAAO,GAAG,GAAG,QAAQ,SAAS,GAAG,CAAC,IAAI,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC;AAChE;AAEA,eAAe,iBACb,SAAoB,gBACpB,kBACe;AACf,MAAI;AACF,UAAS,SAAM,WAAW,QAAQ,gBAAgB,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,EAC1E,SAAS,KAAK;AACZ,UAAM,IAAI,QAAQ;AAAA,MAChB,SAAS,eAAe,GAAG;AAAA,MAC3B,MAAM,YAAY;AAAA,MAClB,MAAM,WAAW,QAAQ,gBAAgB;AAAA,MACzC,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,eAAe,UACb,SAAoB,gBACpB,kBACuB;AACvB,MAAI;AACF,UAAM,MAAM,MAAS,YAAS,iBAAiB,QAAQ,gBAAgB,GAAG,MAAM;AAChF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAAA,EACnC;AACF;AAEA,eAAe,WACb,KACA,SAAoB,gBACpB,kBACe;AACf,QAAM,iBAAiB,QAAQ,gBAAgB;AAG/C,MAAI;AACF,UAAM,YAAY,iBAAiB,QAAQ,gBAAgB,GAAG,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA,EAC5F,SAAS,KAAK;AACZ,UAAM,IAAI,QAAQ;AAAA,MAChB,SAAS,eAAe,GAAG;AAAA,MAC3B,MAAM,YAAY;AAAA,MAClB,MAAM,iBAAiB,QAAQ,gBAAgB;AAAA,MAC/C,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,eAAe,oBACb,KACA,SAAoB,gBACpB,kBACe;AACf,QAAM,UAAU,IAAI,QAAQ,OAAO,0BAA0B;AAC7D,QAAM,OAAO,IAAI,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,GAAG,MAAM,EAAE,OAAO,CAAC;AACnE,QAAM,MAAM,WAAW,QAAQ,gBAAgB;AAE/C,aAAW,SAAS,SAAS;AAC3B,QAAI;AACF,YAAS,UAAY,UAAK,KAAK,GAAG,MAAM,EAAE,OAAO,CAAC;AAAA,IACpD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI;AACF,UAAM,QAAQ,MAAS,WAAQ,GAAG;AAClC,UAAM,QAAQ;AAAA,MACZ,MACG,OAAO,CAAC,SAAS,KAAK,SAAS,OAAO,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,EAC1D,IAAI,OAAO,SAAS;AACnB,YAAI;AACF,gBAAS,UAAY,UAAK,KAAK,IAAI,CAAC;AAAA,QACtC,QAAQ;AAAA,QAER;AAAA,MACF,CAAC;AAAA,IACL;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AASA,eAAsB,cACpB,SAAoB,gBACpB,kBACe;AACf,QAAM,MAAM,WAAW,QAAQ,gBAAgB;AAC/C,QAAM,OAAO,eAAe,QAAQ,gBAAgB;AACpD,QAAM,KAAK,KAAK,IAAI;AAGpB,MAAI;AACJ,MAAI;AACF,cAAU,MAAS,YAAS,KAAK,MAAM;AAAA,EACzC,QAAQ;AAAA,EAER;AAEA,MAAI,YAAY,QAAW;AACzB,QAAI;AACF,YAAM,YAAY,MAAM,OAAO;AAAA,IACjC,SAAS,KAAK;AACZ;AAAA,QACE,yCAAyC,eAAe,GAAG,CAAC;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAGA,MAAI,YAAY,QAAW;AACzB,QAAI;AACF,YAAM,UAAU,GAAG,GAAG,IAAI,EAAE;AAC5B,YAAM,YAAY,SAAS,OAAO;AAAA,IACpC,SAAS,KAAK;AACZ;AAAA,QACE,+CAA+C,eAAe,GAAG,CAAC;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACF,UAAM,MAAW,aAAQ,GAAG;AAC5B,UAAM,QAAQ,MAAS,WAAQ,GAAG;AAClC,UAAM,OAAO,MACV,OAAO,CAAC,MAAM,EAAE,WAAW,cAAc,KAAK,EAAE,SAAS,MAAM,CAAC,EAChE,KAAK,EACL,QAAQ;AACX,eAAW,KAAK,KAAK,MAAM,kBAAkB,GAAG;AAC9C,YAAM,WAAgB,UAAK,KAAK,CAAC,CAAC;AAAA,IACpC;AAAA,EACF,SAAS,KAAK;AACZ;AAAA,MACE,yCAAyC,eAAe,GAAG,CAAC;AAAA,IAC9D;AAAA,EACF;AACF;AAKA,eAAsB,cACpB,QACA,QACA,aACA,SAAoB,gBACpB,kBACiB;AACjB,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,KAAK,QAAQ,SAAS;AAE5B,QAAM,iBAAiB,QAAQ,gBAAgB;AAE/C,QAAM,QAAsB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,kBAAkB,MAAM;AAAA,IACxC,aAAa,YAAY,QAAQ,MAAM;AAAA,EACzC;AAEA,MAAI;AACF,UAAS;AAAA,MACF,UAAK,WAAW,QAAQ,gBAAgB,GAAG,GAAG,EAAE,OAAO;AAAA,MAC5D,KAAK,UAAU,OAAO,MAAM,CAAC;AAAA,MAC7B;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI,QAAQ;AAAA,MAChB,SAAS,eAAe,GAAG;AAAA,MAC3B,MAAM,YAAY;AAAA,MAClB,MAAW,UAAK,WAAW,QAAQ,gBAAgB,GAAG,GAAG,EAAE,OAAO;AAAA,MAClE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,MAAM,MAAM,UAAU,QAAQ,gBAAgB;AACpD,MAAI,QAAQ,QAAQ,EAAE,IAAI,WAAW,YAAY,CAAC;AAClD,QAAM,oBAAoB,KAAK,QAAQ,gBAAgB;AACvD,QAAM,WAAW,KAAK,QAAQ,gBAAgB;AAE9C,SAAO;AACT;AAKA,eAAsB,YACpB,SAAoB,gBACpB,kBACkC;AAClC,QAAM,MAAM,MAAM,UAAU,QAAQ,gBAAgB;AACpD,SAAO,IAAI;AACb;AAKA,eAAsB,gBACpB,IACA,SAAoB,gBACpB,kBAC8B;AAC9B,MAAI;AACF,UAAM,MAAM,MAAS;AAAA,MACd,UAAK,WAAW,QAAQ,gBAAgB,GAAG,GAAG,EAAE,OAAO;AAAA,MAC5D;AAAA,IACF;AACA,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,eAAsB,mBACpB,IACA,SAAoB,gBACpB,kBAC+E;AAC/E,QAAM,QAAQ,MAAM,gBAAgB,IAAI,QAAQ,gBAAgB;AAChE,MAAI,CAAC,MAAO,QAAO,EAAE,IAAI,OAAO,UAAU,MAAM,OAAO,0BAA0B;AAKjF,MAAI,CAAE,MAAM,qBAAqB,QAAQ,cAAc,gBAAgB,GAAI;AACzE,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,cAAc,QAAQ,gBAAgB;AAE5C,MAAI,SAAkC,CAAC;AACvC,MAAI;AACF,UAAM,MAAM,MAAS,YAAS,WAAW,QAAQ,gBAAgB,GAAG,MAAM;AAC1E,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,YAAY,WAAW,QAAQ,gBAAgB,GAAG,KAAK,UAAU,MAAM,gBAAgB,MAAM,CAAC,CAAC;AAAA,EACvG,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,UAAU,MAAM,OAAO,OAAO,GAAG,EAAE;AAAA,EACzD;AAEA,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,MAAM;AAAA,IACN,yBAAyB,EAAE;AAAA,IAC3B;AAAA,IACA;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,MAAM,SAAS;AAC9B;AAKA,eAAsB,YACpB,SAAoB,gBACpB,kBACsD;AACtD,QAAM,OAAO,eAAe,QAAQ,gBAAgB;AACpD,QAAM,MAAM,WAAW,QAAQ,gBAAgB;AAE/C,MAAI,SAAkC,CAAC;AACvC,MAAI;AACF,UAAM,MAAM,MAAS,YAAS,KAAK,MAAM;AACzC,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AAAA,EAER;AAEA,MAAI,UAAmC,CAAC;AACxC,MAAI;AACF,UAAM,MAAM,MAAS,YAAS,MAAM,MAAM;AAC1C,cAAU,KAAK,MAAM,GAAG;AAAA,EAC1B,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAAA,EACrD;AAKA,MAAI,CAAE,MAAM,qBAAqB,QAAQ,cAAc,gBAAgB,GAAI;AACzE,WAAO,EAAE,IAAI,OAAO,OAAO,6DAA6D;AAAA,EAC1F;AAEA,QAAM,cAAc,QAAQ,gBAAgB;AAE5C,MAAI;AACF,UAAM,YAAY,KAAK,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAAA,EACzD,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE;AAAA,EACzC;AAEA,QAAM,cAAc,QAAQ,SAAS,kCAAkC,QAAQ,gBAAgB;AAE/F,SAAO,EAAE,IAAI,KAAK;AACpB;",
-  "names": ["stat"]
-}

package/dist/chunk-Z7YGASQP.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/tui-thinking-word.ts", "../src/settings-menu.ts", "../src/services/suggestion-store.ts"],
-  "sourcesContent": ["export const DEFAULT_TUI_THINKING_WORD = 'thinking';\nexport const MAX_TUI_THINKING_WORD_LENGTH = 16;\n\n/** Normalize autonomy.thinkingWord to a single short word for the TUI statusline. */\nexport function normalizeTuiThinkingWord(value: unknown): string {\n  if (typeof value !== 'string') return DEFAULT_TUI_THINKING_WORD;\n  const word = value.trim();\n  if (word.length === 0 || word.length > MAX_TUI_THINKING_WORD_LENGTH) {\n    return DEFAULT_TUI_THINKING_WORD;\n  }\n  if (!/^[\\p{L}\\p{N}_-]+$/u.test(word)) return DEFAULT_TUI_THINKING_WORD;\n  return word;\n}\n", "import * as fs from 'node:fs/promises';\nimport * as path from 'node:path';\nimport { atomicWrite, deepMerge } from '@wrongstack/core/utils';\nimport { ConfigError, ERROR_CODES, FsError, type SecretVault } from '@wrongstack/core/types';\nimport type { ConfigStore } from '@wrongstack/core/types';\nimport { decryptConfigSecrets, encryptConfigSecrets } from '@wrongstack/core/security';\n\n/** Configuration and storage dependencies needed to persist a setting.\n *  This is safe to call from non-interactive surfaces such as the TUI,\n *  headless runs, and the arg-driven `/settings` slash command. */\nexport interface PersistSettingDeps {\n  configStore: ConfigStore;\n  /** Path to the active profile config (~/.wrongstack/profiles/<name>/config.json). */\n  profileConfigPath: string;\n  /** Per-project config path (<project>/.wrongstack/config.json).\n   *  Used when configScope === 'project'. Lives inside the project\n   *  root so it can be gitignored or team-shared. */\n  inProjectConfigPath?: string | undefined;\n  vault: SecretVault;\n  /** Force writes to the active profile config even when configScope is project. */\n  forceGlobal?: boolean | undefined;\n  /**\n   * Optional resolver that recomputes the profile config path for a given\n   * profile name. When set, {@link resolveActualTarget} uses this to\n   * re-resolve the target path when `decrypted.activeProfile` differs from\n   * the one used to compute `profileConfigPath`. This prevents the write\n   * from landing in the wrong profile when the mutator changes activeProfile.\n   */\n  resolveProfilePath?: ((profileName: string) => string) | undefined;\n}\n\nexport function resolvePersistPath(deps: PersistSettingDeps): string {\n  if (deps.forceGlobal) return deps.profileConfigPath;\n  const scope = (deps.configStore.get() as { configScope?: string | undefined }).configScope;\n  if (scope === 'project' && deps.inProjectConfigPath) {\n    return deps.inProjectConfigPath;\n  }\n  // Default user scope always means the active profile, never the root bootstrap.\n  return deps.profileConfigPath;\n}\n\n/**\n * Re-resolve the target path after a mutator may have changed configScope.\n * Handles the two settings targets: project config or active profile config.\n */\nexport function resolveActualTarget(\n  deps: PersistSettingDeps,\n  decrypted: Record<string, unknown>,\n  fallbackPath: string,\n): string {\n  if (deps.forceGlobal) return deps.profileConfigPath;\n  const newScope = decrypted.configScope as string | undefined;\n  // Recompute profile path when activeProfile changed in the mutation block.\n  const newProfileName = decrypted.activeProfile as string | undefined;\n  const effectiveProfilePath =\n    newProfileName && deps.resolveProfilePath\n      ? deps.resolveProfilePath(newProfileName)\n      : deps.profileConfigPath;\n  if (newScope === 'project' && deps.inProjectConfigPath) {\n    return deps.inProjectConfigPath;\n  }\n  if (newScope === 'global') {\n    return effectiveProfilePath;\n  }\n  return fallbackPath;\n}\n\n/**\n * Returns true when the target path is the trusted active-profile config, so\n * secrets are NOT stripped before writing.\n * Returns false for project-scoped paths where credentials must be filtered.\n */\nfunction isProfileOrGlobalTarget(actualTarget: string, deps: PersistSettingDeps): boolean {\n  return actualTarget === deps.profileConfigPath;\n}\n\nasync function ensureProjectDir(filePath: string): Promise<void> {\n  const dir = path.dirname(filePath);\n  try {\n    await fs.mkdir(dir, { recursive: true });\n  } catch {\n    // Directory already exists or is inaccessible \u2014 the write will surface the real error.\n  }\n}\n\n/**\n * When configScope changed mid-save, the write target differs from the file\n * that was read.  Read the *destination* file, decrypt it, and deep-merge the\n * mutated `source` on top (prefer-patch so the user's explicit changes win).\n * This prevents a sparse source (e.g. project config without credentials)\n * from clobbering credential-bearing fields in the destination (e.g. profile\n * config with apiKey / providers / mcpServers).\n *\n * Returns `source` unchanged when destination does not exist yet.\n */\nasync function mergeWithDestinationIfExists(\n  destPath: string,\n  source: Record<string, unknown>,\n  vault: SecretVault,\n): Promise<Record<string, unknown>> {\n  let destRaw: string;\n  try {\n    destRaw = await fs.readFile(destPath, 'utf8');\n  } catch (err) {\n    // Only swallow ENOENT (destination doesn't exist yet).\n    // All other errors (EACCES, EIO, etc.) propagate as-is.\n    if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n      return source;\n    }\n    throw err;\n  }\n  let destParsed: Record<string, unknown>;\n  try {\n    destParsed = JSON.parse(destRaw) as Record<string, unknown>;\n  } catch (err) {\n    // Corrupt destination \u2014 don't merge, just write our content.\n    process.stderr.write(JSON.stringify({\n      level: 'warn',\n      event: 'settings_menu_merge_skipped',\n      message: `Skipping merge into corrupt destination file: ${destPath}`,\n      timestamp: new Date().toISOString(),\n    }) + '\\n');\n    void err;\n    return source;\n  }\n  const destDecrypted = decryptConfigSecrets(destParsed, vault) as Record<string, unknown>;\n  return deepMerge(destDecrypted, source) as Record<string, unknown>;\n}\n\n/**\n * Fields that are safe to persist in a per-project `.wrongstack/config.json`.\n * Credential-bearing fields (apiKey, providers, sync) MUST NOT appear here \u2014\n * they stay in the active profile config only. The active profile always gets the\n * full unfiltered object.\n *\n * When adding a field here, ask: \"Would I commit this to a shared repo?\"\n * If the answer is no, it doesn't belong on this list.\n */\nconst PROJECT_SAFE_FIELDS = new Set([\n  'provider',\n  'model',\n  'fallbackModels',\n  // Kept in sync with core's IN_PROJECT_ALLOWED_KEYS (config-loader.ts): these\n  // model-routing prefs are explicitly safe to READ from a per-project config,\n  // so the writer must not strip them \u2014 otherwise a scope=project /fallback\n  // profile/fav write (or a TUI full-config write under project scope) would be\n  // silently dropped while the loader would happily accept them on next boot.\n  'fallbackProfiles',\n  'favoriteModels',\n  'favoriteModelsOnly',\n  'modelAvailabilitySchedule',\n  'fallbackAuto',\n  'models',\n  'modelMatrix',\n  'maxConcurrent',\n  'autonomy',\n  'hints',\n  'nextPrediction',\n  'debugStream',\n  'configScope',\n  'yolo',\n  'features',\n  'context',\n  'log',\n  'session',\n  'indexing',\n  'tools',\n  'launch',\n  'circuitBreaker',\n  'adaptiveConcurrency',\n  'modelRuntime',\n]);\n\n/**\n * Strip credential-bearing and machine-specific fields from a config object\n * so it is safe to write into a per-project `.wrongstack/config.json` file.\n * Returns a new object \u2014 the original is not mutated.\n */\nexport function filterSafeForProject(cfg: Record<string, unknown>): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(cfg)) {\n    if (PROJECT_SAFE_FIELDS.has(key)) {\n      out[key] = value;\n    }\n  }\n  return out;\n}\n\n/**\n * Read the config file, apply `mutator` to its `autonomy` block, and write it\n * back atomically (then mirror into the in-memory config store). Pure I/O \u2014 no\n * terminal interaction \u2014 so it works identically under the plain REPL and the\n * Ink TUI.\n */\nexport async function persistAutonomySetting(\n  deps: PersistSettingDeps,\n  mutator: (autonomy: {\n    autoProceedDelayMs?: number | undefined;\n    defaultMode?: string | undefined;\n    enhance?: boolean | undefined;\n    enhanceDelayMs?: number | undefined;\n    enhanceLanguage?: string | undefined;\n  }) => void,\n): Promise<void> {\n  const targetPath = resolvePersistPath(deps);\n  await ensureProjectDir(targetPath);\n\n  let raw: string;\n  let fileExists = true;\n  try {\n    raw = await fs.readFile(targetPath, 'utf8');\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== 'ENOENT') {\n      throw new FsError({\n        message: `Could not read ${targetPath}`,\n        code: ERROR_CODES.FS_READ_FAILED,\n        path: targetPath,\n        cause: err,\n      });\n    }\n    fileExists = false;\n    raw = '{}';\n  }\n\n  let parsed: Record<string, unknown>;\n  try {\n    parsed = JSON.parse(raw) as Record<string, unknown>;\n  } catch (err) {\n    if (fileExists) {\n      throw new ConfigError({\n        message: `Config at ${targetPath} is not valid JSON`,\n        code: ERROR_CODES.CONFIG_PARSE_FAILED,\n        context: { path: targetPath },\n        cause: err,\n      });\n    }\n    parsed = {};\n  }\n\n  const decrypted = decryptConfigSecrets(parsed, deps.vault) as Record<string, unknown>;\n  const autonomy = (decrypted.autonomy as Record<string, unknown>) ?? {};\n  mutator(\n    autonomy as { autoProceedDelayMs?: number | undefined; defaultMode?: string | undefined },\n  );\n  decrypted.autonomy = autonomy;\n\n  // Re-resolve path \u2014 the mutator might have changed configScope.\n  const actualTarget = resolveActualTarget(deps, decrypted as Record<string, unknown>, targetPath);\n  if (actualTarget !== targetPath) {\n    await ensureProjectDir(actualTarget);\n  }\n\n  // When configScope changed mid-save, merge into the destination file's\n  // existing content so credential-bearing fields are preserved.\n  const effectiveConfig =\n    actualTarget !== targetPath\n      ? await mergeWithDestinationIfExists(actualTarget, decrypted, deps.vault)\n      : decrypted;\n\n  // When writing to the project-local config, strip credentials so\n  // apiKey / providers / sync never leak into a per-project file.\n  const toWrite =\n    isProfileOrGlobalTarget(actualTarget, deps) ? effectiveConfig : filterSafeForProject(effectiveConfig);\n\n  const encrypted = encryptConfigSecrets(toWrite, deps.vault);\n  await atomicWrite(actualTarget, JSON.stringify(encrypted, null, 2), { mode: 0o600 });\n\n  // Also update the in-memory config store so changes are immediately visible\n  deps.configStore.update({\n    autonomy: decrypted.autonomy as Parameters<typeof deps.configStore.update>[0]['autonomy'],\n  });\n}\n\n/**\n * Read the config file, apply `mutator` to the full decrypted object, and\n * write it back atomically. This is used for small top-level settings that do\n * not warrant a dedicated helper.\n */\nexport async function persistConfigSetting(\n  deps: PersistSettingDeps,\n  mutator: (config: Record<string, unknown>) => void,\n): Promise<void> {\n  const targetPath = resolvePersistPath(deps);\n  await ensureProjectDir(targetPath);\n\n  let raw: string;\n  let fileExists = true;\n  try {\n    raw = await fs.readFile(targetPath, 'utf8');\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== 'ENOENT') {\n      throw new FsError({\n        message: `Could not read ${targetPath}`,\n        code: ERROR_CODES.FS_READ_FAILED,\n        path: targetPath,\n        cause: err,\n      });\n    }\n    fileExists = false;\n    raw = '{}';\n  }\n\n  let parsed: Record<string, unknown>;\n  try {\n    parsed = JSON.parse(raw) as Record<string, unknown>;\n  } catch (err) {\n    if (fileExists) {\n      throw new ConfigError({\n        message: `Config at ${targetPath} is not valid JSON`,\n        code: ERROR_CODES.CONFIG_PARSE_FAILED,\n        context: { path: targetPath },\n        cause: err,\n      });\n    }\n    parsed = {};\n  }\n\n  const decrypted = decryptConfigSecrets(parsed, deps.vault) as Record<string, unknown>;\n  mutator(decrypted);\n\n  // If the mutator changed configScope, re-resolve the target path.\n  // Without this, a scope change from 'project' \u2192 'global' would write\n  // to the old project path instead of the new global one.\n  const actualTarget = resolveActualTarget(deps, decrypted, targetPath);\n\n  // Ensure the directory exists if we're writing to a new path\n  if (actualTarget !== targetPath) {\n    await ensureProjectDir(actualTarget);\n  }\n\n  // When configScope changed mid-save, merge into the destination file's\n  // existing content so credential-bearing fields are preserved.\n  const effectiveConfig =\n    actualTarget !== targetPath\n      ? await mergeWithDestinationIfExists(actualTarget, decrypted, deps.vault)\n      : decrypted;\n\n  // When writing to the project-local config, strip credentials so\n  // apiKey / providers / sync never leak into a per-project file.\n  const toWrite =\n    isProfileOrGlobalTarget(actualTarget, deps) ? effectiveConfig : filterSafeForProject(effectiveConfig);\n\n  const encrypted = encryptConfigSecrets(toWrite, deps.vault);\n  await atomicWrite(actualTarget, JSON.stringify(encrypted, null, 2), { mode: 0o600 });\n  deps.configStore.update(decrypted as Parameters<typeof deps.configStore.update>[0]);\n}\n\n/**\n * Persist Telegram plugin config to `extensions.telegram` in the active profile config\n * file. Mirrors `persistAutonomySetting` \u2014 reads the config, applies the\n * mutator, encrypts secrets, writes atomically, then updates ConfigStore.\n */\nexport async function persistTelegramConfig(\n  deps: PersistSettingDeps,\n  mutator: (telegram: Record<string, unknown>) => void,\n): Promise<void> {\n  const targetPath = deps.profileConfigPath;\n  let raw: string;\n  let fileExists = true;\n  try {\n    raw = await fs.readFile(targetPath, 'utf8');\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== 'ENOENT') {\n      throw new FsError({\n        message: `Could not read ${targetPath}: ${(err as Error).message}`,\n        code: 'FS_READ_FAILED',\n        path: targetPath,\n        context: { operation: 'readGlobalConfig', phase: 'read' },\n        cause: err,\n      });\n    }\n    fileExists = false;\n    raw = '{}';\n  }\n\n  let parsed: Record<string, unknown>;\n  try {\n    parsed = JSON.parse(raw) as Record<string, unknown>;\n  } catch (err) {\n    if (fileExists) {\n      throw new ConfigError({\n        message: `Config at ${targetPath} is not valid JSON: ${(err as Error).message}`,\n        code: 'CONFIG_PARSE_FAILED',\n        context: { filePath: targetPath, operation: 'readProfileConfig' },\n        cause: err,\n      });\n    }\n    parsed = {};\n  }\n\n  const decrypted = decryptConfigSecrets(parsed, deps.vault) as Record<string, unknown>;\n  const extensions = (decrypted.extensions as Record<string, Record<string, unknown>>) ?? {};\n  const telegram = extensions.telegram ?? {};\n  mutator(telegram);\n  extensions.telegram = telegram;\n  decrypted.extensions = extensions;\n\n  const encrypted = encryptConfigSecrets(decrypted, deps.vault);\n  await atomicWrite(targetPath, JSON.stringify(encrypted, null, 2), { mode: 0o600 });\n\n  // Also update the in-memory config store so changes are immediately visible\n  deps.configStore.update({\n    extensions: extensions as NonNullable<\n      Parameters<typeof deps.configStore.update>[0]['extensions']\n    >,\n  });\n}\n\n/**\n * Derive the filesystem-access pair (`features.allowOutsideProjectRoot` and\n * `tools.restrictToProjectRoot`) from a save input. The two are inverses\n * of each other and the codebase intentionally keeps both in sync for\n * backward compatibility with older readers that only know about\n * `tools.restrictToProjectRoot`.\n *\n * Single source of truth: `allowOutsideProjectRoot`. If the caller only\n * sets `restrictFsToRoot`, it is converted to its inverse. If both are\n * set (which the picker should not do, but defensive code paths may),\n * `allowOutsideProjectRoot` wins. Returns `undefined` if neither is set,\n * so the caller can skip the write.\n *\n * The input is duck-typed (only the two relevant fields are read) so any\n * caller can pass a partial shape: the TUI's full `LiveSettingsInput`,\n * a slash-command's `{ restrictFsToRoot: boolean }`, or any future\n * save-handler that only carries these two knobs.\n */\nexport function deriveFsAccessPair(input: {\n  allowOutsideProjectRoot?: boolean | undefined;\n  restrictFsToRoot?: boolean | undefined;\n}): { allowOutsideProjectRoot: boolean; restrictToProjectRoot: boolean } | undefined {\n  if (input.allowOutsideProjectRoot !== undefined) {\n    const allow = input.allowOutsideProjectRoot;\n    return { allowOutsideProjectRoot: allow, restrictToProjectRoot: !allow };\n  }\n  if (input.restrictFsToRoot !== undefined) {\n    const restrict = input.restrictFsToRoot;\n    return { allowOutsideProjectRoot: !restrict, restrictToProjectRoot: restrict };\n  }\n  return undefined;\n}\n", "/**\n * Shared suggestion state used by command and runtime surfaces.\n *\n * Previously, suggestions were stored in a closure variable (`currentSuggestions`)\n * inside cli-main.ts, accessed via the `onSuggestions` callback on\n * `SlashCommandContext`. This closure-based approach works correctly in the REPL\n * but can fail in the TUI when the callback goes through multiple indirections\n * (SlashCommandRegistry \u2192 SlashCommand.run \u2192 closed-over opts).\n *\n * By using a module-level store, both /suggest (writer) and /next (reader)\n * access the same array directly, bypassing the callback indirection entirely.\n * The CLI's `onSuggestions` callback now reads/writes this shared store to\n * maintain backward compatibility with the REPL autonomy loop's\n * `getSuggestions`/`onSuggestionsParsed` flow.\n *\n * Auto suggestions (items with auto=\"true\" attribute) are stored separately\n * for YOLO+auto autonomy mode.\n */\n\nlet sharedSuggestions: string[] = [];\nlet sharedAutoSuggestions: string[] = [];\n\n/** Store suggestions (called by /suggest and onSuggestionsParsed). */\nexport function setSuggestions(suggestions: string[]): void {\n  sharedSuggestions = suggestions;\n}\n\n/** Store auto suggestions (items with auto=\"true\" attribute). Called by onAutoSuggestionsParsed. */\nexport function setAutoSuggestions(suggestions: string[]): void {\n  sharedAutoSuggestions = suggestions;\n}\n\n/** Retrieve current suggestions (called by /next selection and getSuggestions). */\nexport function getSuggestions(): string[] {\n  return sharedSuggestions;\n}\n\n/** Retrieve current auto suggestions (called by YOLO+auto autonomy). */\nexport function getAutoSuggestions(): string[] {\n  return sharedAutoSuggestions;\n}\n\n/**\n * Remove suggestions at the given 0-based indices.\n * Called by /next selection so selected prompts cannot be re-selected.\n * Also clears auto-suggestions since an explicit user selection should\n * override any auto-submit queue.\n */\nexport function removeSuggestions(indices: number[]): void {\n  if (indices.length === 0) return;\n  const set = new Set(indices);\n  sharedSuggestions = sharedSuggestions.filter((_, i) => !set.has(i));\n  sharedAutoSuggestions = [];\n}\n\n/** Clear suggestions (called by /next clear). */\nexport function clearSuggestions(): void {\n  sharedSuggestions = [];\n  sharedAutoSuggestions = [];\n}\n"],
-  "mappings": ";;;AAAO,IAAM,4BAA4B;AAClC,IAAM,+BAA+B;AAGrC,SAAS,yBAAyB,OAAwB;AAC/D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,OAAO,MAAM,KAAK;AACxB,MAAI,KAAK,WAAW,KAAK,KAAK,SAAS,8BAA8B;AACnE,WAAO;AAAA,EACT;AACA,MAAI,CAAC,qBAAqB,KAAK,IAAI,EAAG,QAAO;AAC7C,SAAO;AACT;;;ACZA,YAAY,QAAQ;AACpB,YAAY,UAAU;AACtB,SAAS,aAAa,iBAAiB;AACvC,SAAS,aAAa,aAAa,eAAiC;AAEpE,SAAS,sBAAsB,4BAA4B;AA0BpD,SAAS,mBAAmB,MAAkC;AACnE,MAAI,KAAK,YAAa,QAAO,KAAK;AAClC,QAAM,QAAS,KAAK,YAAY,IAAI,EAA2C;AAC/E,MAAI,UAAU,aAAa,KAAK,qBAAqB;AACnD,WAAO,KAAK;AAAA,EACd;AAEA,SAAO,KAAK;AACd;AAMO,SAAS,oBACd,MACA,WACA,cACQ;AACR,MAAI,KAAK,YAAa,QAAO,KAAK;AAClC,QAAM,WAAW,UAAU;AAE3B,QAAM,iBAAiB,UAAU;AACjC,QAAM,uBACJ,kBAAkB,KAAK,qBACnB,KAAK,mBAAmB,cAAc,IACtC,KAAK;AACX,MAAI,aAAa,aAAa,KAAK,qBAAqB;AACtD,WAAO,KAAK;AAAA,EACd;AACA,MAAI,aAAa,UAAU;AACzB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOA,SAAS,wBAAwB,cAAsB,MAAmC;AACxF,SAAO,iBAAiB,KAAK;AAC/B;AAEA,eAAe,iBAAiB,UAAiC;AAC/D,QAAM,MAAW,aAAQ,QAAQ;AACjC,MAAI;AACF,UAAS,SAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,EACzC,QAAQ;AAAA,EAER;AACF;AAYA,eAAe,6BACb,UACA,QACA,OACkC;AAClC,MAAI;AACJ,MAAI;AACF,cAAU,MAAS,YAAS,UAAU,MAAM;AAAA,EAC9C,SAAS,KAAK;AAGZ,QAAK,IAA8B,SAAS,UAAU;AACpD,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AACA,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,MAAM,OAAO;AAAA,EACjC,SAAS,KAAK;AAEZ,YAAQ,OAAO,MAAM,KAAK,UAAU;AAAA,MAClC,OAAO;AAAA,MACP,OAAO;AAAA,MACP,SAAS,iDAAiD,QAAQ;AAAA,MAClE,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,CAAC,IAAI,IAAI;AACT,SAAK;AACL,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,qBAAqB,YAAY,KAAK;AAC5D,SAAO,UAAU,eAAe,MAAM;AACxC;AAWA,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,SAAS,qBAAqB,KAAuD;AAC1F,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC9C,QAAI,oBAAoB,IAAI,GAAG,GAAG;AAChC,UAAI,GAAG,IAAI;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;AAQA,eAAsB,uBACpB,MACA,SAOe;AACf,QAAM,aAAa,mBAAmB,IAAI;AAC1C,QAAM,iBAAiB,UAAU;AAEjC,MAAI;AACJ,MAAI,aAAa;AACjB,MAAI;AACF,UAAM,MAAS,YAAS,YAAY,MAAM;AAAA,EAC5C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,UAAU;AACpD,YAAM,IAAI,QAAQ;AAAA,QAChB,SAAS,kBAAkB,UAAU;AAAA,QACrC,MAAM,YAAY;AAAA,QAClB,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,iBAAa;AACb,UAAM;AAAA,EACR;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,QAAI,YAAY;AACd,YAAM,IAAI,YAAY;AAAA,QACpB,SAAS,aAAa,UAAU;AAAA,QAChC,MAAM,YAAY;AAAA,QAClB,SAAS,EAAE,MAAM,WAAW;AAAA,QAC5B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,aAAS,CAAC;AAAA,EACZ;AAEA,QAAM,YAAY,qBAAqB,QAAQ,KAAK,KAAK;AACzD,QAAM,WAAY,UAAU,YAAwC,CAAC;AACrE;AAAA,IACE;AAAA,EACF;AACA,YAAU,WAAW;AAGrB,QAAM,eAAe,oBAAoB,MAAM,WAAsC,UAAU;AAC/F,MAAI,iBAAiB,YAAY;AAC/B,UAAM,iBAAiB,YAAY;AAAA,EACrC;AAIA,QAAM,kBACJ,iBAAiB,aACb,MAAM,6BAA6B,cAAc,WAAW,KAAK,KAAK,IACtE;AAIN,QAAM,UACJ,wBAAwB,cAAc,IAAI,IAAI,kBAAkB,qBAAqB,eAAe;AAEtG,QAAM,YAAY,qBAAqB,SAAS,KAAK,KAAK;AAC1D,QAAM,YAAY,cAAc,KAAK,UAAU,WAAW,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AAGnF,OAAK,YAAY,OAAO;AAAA,IACtB,UAAU,UAAU;AAAA,EACtB,CAAC;AACH;AAOA,eAAsB,qBACpB,MACA,SACe;AACf,QAAM,aAAa,mBAAmB,IAAI;AAC1C,QAAM,iBAAiB,UAAU;AAEjC,MAAI;AACJ,MAAI,aAAa;AACjB,MAAI;AACF,UAAM,MAAS,YAAS,YAAY,MAAM;AAAA,EAC5C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,UAAU;AACpD,YAAM,IAAI,QAAQ;AAAA,QAChB,SAAS,kBAAkB,UAAU;AAAA,QACrC,MAAM,YAAY;AAAA,QAClB,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,iBAAa;AACb,UAAM;AAAA,EACR;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,QAAI,YAAY;AACd,YAAM,IAAI,YAAY;AAAA,QACpB,SAAS,aAAa,UAAU;AAAA,QAChC,MAAM,YAAY;AAAA,QAClB,SAAS,EAAE,MAAM,WAAW;AAAA,QAC5B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,aAAS,CAAC;AAAA,EACZ;AAEA,QAAM,YAAY,qBAAqB,QAAQ,KAAK,KAAK;AACzD,UAAQ,SAAS;AAKjB,QAAM,eAAe,oBAAoB,MAAM,WAAW,UAAU;AAGpE,MAAI,iBAAiB,YAAY;AAC/B,UAAM,iBAAiB,YAAY;AAAA,EACrC;AAIA,QAAM,kBACJ,iBAAiB,aACb,MAAM,6BAA6B,cAAc,WAAW,KAAK,KAAK,IACtE;AAIN,QAAM,UACJ,wBAAwB,cAAc,IAAI,IAAI,kBAAkB,qBAAqB,eAAe;AAEtG,QAAM,YAAY,qBAAqB,SAAS,KAAK,KAAK;AAC1D,QAAM,YAAY,cAAc,KAAK,UAAU,WAAW,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AACnF,OAAK,YAAY,OAAO,SAA0D;AACpF;AAOA,eAAsB,sBACpB,MACA,SACe;AACf,QAAM,aAAa,KAAK;AACxB,MAAI;AACJ,MAAI,aAAa;AACjB,MAAI;AACF,UAAM,MAAS,YAAS,YAAY,MAAM;AAAA,EAC5C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,UAAU;AACpD,YAAM,IAAI,QAAQ;AAAA,QAChB,SAAS,kBAAkB,UAAU,KAAM,IAAc,OAAO;AAAA,QAChE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,EAAE,WAAW,oBAAoB,OAAO,OAAO;AAAA,QACxD,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,iBAAa;AACb,UAAM;AAAA,EACR;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,QAAI,YAAY;AACd,YAAM,IAAI,YAAY;AAAA,QACpB,SAAS,aAAa,UAAU,uBAAwB,IAAc,OAAO;AAAA,QAC7E,MAAM;AAAA,QACN,SAAS,EAAE,UAAU,YAAY,WAAW,oBAAoB;AAAA,QAChE,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,aAAS,CAAC;AAAA,EACZ;AAEA,QAAM,YAAY,qBAAqB,QAAQ,KAAK,KAAK;AACzD,QAAM,aAAc,UAAU,cAA0D,CAAC;AACzF,QAAM,WAAW,WAAW,YAAY,CAAC;AACzC,UAAQ,QAAQ;AAChB,aAAW,WAAW;AACtB,YAAU,aAAa;AAEvB,QAAM,YAAY,qBAAqB,WAAW,KAAK,KAAK;AAC5D,QAAM,YAAY,YAAY,KAAK,UAAU,WAAW,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AAGjF,OAAK,YAAY,OAAO;AAAA,IACtB;AAAA,EAGF,CAAC;AACH;AAoBO,SAAS,mBAAmB,OAGkD;AACnF,MAAI,MAAM,4BAA4B,QAAW;AAC/C,UAAM,QAAQ,MAAM;AACpB,WAAO,EAAE,yBAAyB,OAAO,uBAAuB,CAAC,MAAM;AAAA,EACzE;AACA,MAAI,MAAM,qBAAqB,QAAW;AACxC,UAAM,WAAW,MAAM;AACvB,WAAO,EAAE,yBAAyB,CAAC,UAAU,uBAAuB,SAAS;AAAA,EAC/E;AACA,SAAO;AACT;;;ACpaA,IAAI,oBAA8B,CAAC;AACnC,IAAI,wBAAkC,CAAC;AAGhC,SAAS,eAAe,aAA6B;AAC1D,sBAAoB;AACtB;AAGO,SAAS,mBAAmB,aAA6B;AAC9D,0BAAwB;AAC1B;AAGO,SAAS,iBAA2B;AACzC,SAAO;AACT;AAaO,SAAS,kBAAkB,SAAyB;AACzD,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,MAAM,IAAI,IAAI,OAAO;AAC3B,sBAAoB,kBAAkB,OAAO,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;AAClE,0BAAwB,CAAC;AAC3B;AAGO,SAAS,mBAAyB;AACvC,sBAAoB,CAAC;AACrB,0BAAwB,CAAC;AAC3B;",
-  "names": []
-}

package/dist/cli-bundled-prompts.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli-bundled-prompts.d.ts","sourceRoot":"","sources":["../src/cli-bundled-prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,wBAAgB,wBAAwB,IAAI,MAAM,GAAG,SAAS,CAQ7D"}

package/dist/cli-bundled-skills.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli-bundled-skills.d.ts","sourceRoot":"","sources":["../src/cli-bundled-skills.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAQ5D"}

package/dist/cli-context.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli-context.d.ts","sourceRoot":"","sources":["../src/cli-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAiBH,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAO3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAI7C,4DAA4D;AAC5D,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,MAAM,EAAE,QAAQ,CAAC;IACjB,SAAS,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,WAAW,CAAC,CAAC;IACzD,WAAW,EAAE,WAAW,CAAC;CAC1B;AAID;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,CA+KhF"}

package/dist/cli-entry-main.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli-entry-main.d.ts","sourceRoot":"","sources":["../src/cli-entry-main.ts"],"names":[],"mappings":"AA0BA,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ1D"}

package/dist/cli-entry-point.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli-entry-point.d.ts","sourceRoot":"","sources":["../src/cli-entry-point.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAmDH,UAAU,gBAAgB;IACxB,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC;IAChE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC;CAClE;AAED,UAAU,wBAAwB;IAChC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,CAAC;IAClD,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC7C;AAOD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,wBAA6B,GAAG,MAAM,IAAI,CAgB5F;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAqB3E"}

package/dist/cli-eternal-flag.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli-eternal-flag.d.ts","sourceRoot":"","sources":["../src/cli-eternal-flag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAa,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE;;;;;;;GAOG;AACH,KAAK,aAAa,GAAG;IAAE,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,EAAE,aAAa,CAAC;IACzB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;;;;OAKG;IACH,yBAAyB,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACxD,6EAA6E;IAC7E,mBAAmB,EAAE,MAAM,CAAC;IAG5B,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B,eAAe,EAAE;QAAE,OAAO,EAAE,YAAY,CAAA;KAAE,CAAC;IAC3C;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE;QACjB,OAAO,EAAE,qBAAqB,GAAG,SAAS,CAAC;KAC5C,CAAC;IACF,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAmDnF"}