@wrongstack/tools 0.313.0 → 0.316.1

package/dist/bash.js

@@ -1,2312 +1,13 @@
-// src/bash.ts
-import { spawn as spawn2 } from "node:child_process";
-import * as os4 from "node:os";
-import { StringDecoder } from "node:string_decoder";
 import {
-  emitProcessCompleted,
-  emitProcessOutput,
-  emitProcessStarted
-} from "@wrongstack/core/observability";
-
-// src/_env.ts
-import { buildChildEnv } from "@wrongstack/core/utils";
-
-// src/_output-spool.ts
-import { createWriteStream, mkdirSync } from "node:fs";
-import * as fsp from "node:fs/promises";
-import * as path from "node:path";
-import { wstackGlobalRoot } from "@wrongstack/core/utils";
-var SPOOL_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
-var SPOOL_WRITE_HWM_BYTES = 4 * 1024 * 1024;
-var sweepStarted = false;
-function toolOutputDir() {
-  return path.join(wstackGlobalRoot(), "tool-output");
-}
-function sweepOldSpoolFiles(dir) {
-  if (sweepStarted) return;
-  sweepStarted = true;
-  void (async () => {
-    try {
-      const now = Date.now();
-      for (const name of await fsp.readdir(dir)) {
-        if (!name.endsWith(".log")) continue;
-        const p = path.join(dir, name);
-        try {
-          const st = await fsp.stat(p);
-          if (now - st.mtimeMs > SPOOL_RETENTION_MS) await fsp.unlink(p);
-        } catch {
-        }
-      }
-    } catch {
-    }
-  })();
-}
-function spoolNote(info) {
-  const dropped = info.droppedBytes > 0 ? `, ~${info.droppedBytes} bytes dropped under backpressure` : "";
-  return `
-[output truncated \u2014 full ${info.bytes} bytes at ${info.path}${dropped}; read/grep that file selectively instead of re-running with more output]`;
-}
-function createOutputSpool(opts) {
-  const threshold = opts.thresholdBytes ?? 32768;
-  const safeTool = opts.tool.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
-  let head = "";
-  let headBytes = 0;
-  let totalBytes = 0;
-  let droppedBytes = 0;
-  let stream = null;
-  let filePath = null;
-  let failed = false;
-  let finalized = false;
-  const open = () => {
-    if (stream || failed) return;
-    try {
-      const dir = toolOutputDir();
-      mkdirSync(dir, { recursive: true });
-      sweepOldSpoolFiles(dir);
-      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-      const rand = Math.random().toString(36).slice(2, 6);
-      filePath = path.join(dir, `${stamp}-${safeTool}-${rand}.log`);
-      stream = createWriteStream(filePath, { flags: "w", encoding: "utf8" });
-      stream.on("error", () => {
-        failed = true;
-        stream = null;
-        filePath = null;
-      });
-      stream.write(head);
-    } catch {
-      failed = true;
-      stream = null;
-      filePath = null;
-    }
-  };
-  return {
-    write(text) {
-      if (finalized || !text) return;
-      const textBytes = Buffer.byteLength(text, "utf8");
-      totalBytes += textBytes;
-      if (!stream && !failed) {
-        if (headBytes + textBytes <= threshold) {
-          head += text;
-          headBytes += textBytes;
-          return;
-        }
-        head += text;
-        open();
-        head = "";
-        return;
-      }
-      if (stream) {
-        if (stream.writableLength > SPOOL_WRITE_HWM_BYTES) {
-          droppedBytes += textBytes;
-          return;
-        }
-        stream.write(text);
-      }
-    },
-    finalize() {
-      if (finalized) {
-        return filePath ? { path: filePath, bytes: totalBytes, droppedBytes } : null;
-      }
-      finalized = true;
-      head = "";
-      if (!stream || !filePath) return null;
-      try {
-        stream.end();
-      } catch {
-      }
-      return { path: filePath, bytes: totalBytes, droppedBytes };
-    }
-  };
-}
-
-// src/_shell-pick.ts
-var POSIX_DEFAULT = "cmd";
-function pickShell(platform4, command, env) {
-  if (platform4 !== "win32") return POSIX_DEFAULT;
-  const override = env.get("WRONGSTACK_SHELL")?.trim().toLowerCase();
-  if (override === "cmd" || override === "cmd.exe") return "cmd";
-  if (override === "powershell" || override === "powershell.exe") return "powershell";
-  if (override === "pwsh" || override === "pwsh.exe") return "pwsh";
-  if (looksLikePowerShell(command)) return "pwsh";
-  return "cmd";
-}
-function looksLikePowerShell(command) {
-  if (!command) return false;
-  const trimmed = command.trimStart();
-  if (/\.ps1\b/i.test(trimmed)) return true;
-  if (/^\s*#requires\s/i.test(trimmed)) return true;
-  if (/^\s*param\s*\(/i.test(trimmed)) return true;
-  if (/\$[\w:{]/i.test(trimmed)) return true;
-  if (/\$\(/.test(trimmed)) return true;
-  if (/@\s*['"]/.test(trimmed)) return true;
-  if (/&\s+\$/.test(trimmed)) return true;
-  if (/(^|\s)@\s*\(/.test(trimmed)) return true;
-  if (/(^|\s)@\{/.test(trimmed)) return true;
-  if (/(?:^|[\s[({,;])(?:-eq|-ne|-lt|-gt|-le|-ge|-like|-notlike|-match|-notmatch|-contains|-notcontains|-in|-notin|-and|-or|-not|-band|-bor|-bxor|-replace|-isplit|-csplit|-osplit|-join|-is|-as|-f)(?:$|[\s\])},;])/i.test(
-    trimmed
-  )) {
-    return true;
-  }
-  if (PS_VERB_RE.test(trimmed)) return true;
-  if (/(?:^|[\s;&|])(gci|gi|gp|gcm|gps)\b/i.test(trimmed)) {
-    return true;
-  }
-  if (looksLikePowerShellExtended(command)) return true;
-  return false;
-}
-function looksLikePowerShellExtended(command) {
-  if (!command) return false;
-  const trimmed = command.trimStart();
-  if (/(?:^|\s)[-/](?:WhatIf|Confirm|ErrorAction)(?::[^\s]+|\s|=|$)/i.test(trimmed)) {
-    return true;
-  }
-  if (/(?:^|[\s;&|])(Where-Object|ForEach-Object|Select-Object|Sort-Object|Group-Object|Measure-Object|Compare-Object|Tee-Object)(?:\s|$)/i.test(
-    trimmed
-  )) {
-    return true;
-  }
-  if (/\bWrite-(?:Host|Output|Error|Warning|Verbose|Debug|Information)(?:\s|$)/i.test(trimmed)) {
-    return true;
-  }
-  if (/HK(?:LM|CU|CR|U|CC|DD|PD):\\/i.test(trimmed)) return true;
-  if (/\[(?:string|int|bool|xml|double|float|decimal|char|byte|long|System\.)/i.test(trimmed)) {
-    return true;
-  }
-  if (/^\s*<#|#>\s*$/m.test(trimmed)) return true;
-  if (/(?:^|\s)[-//](?:AsPlainText|PipelineVariable|pv|FilterHashtable|OutVariable|ov)(?:\s|=|$)/i.test(
-    trimmed
-  )) {
-    return true;
-  }
-  return false;
-}
-function wrapPowerShellScript(command) {
-  const bootstrap = "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8;$ConfirmPreference='None';$WhatIfPreference=$false";
-  return bootstrap + "\n$ErrorActionPreference='Stop'\n" + command + "\nif ($LASTEXITCODE -is [int]) { exit $LASTEXITCODE }";
-}
-var PS_VERB_RE = new RegExp(
-  // Boundaries: start-of-string, whitespace, `;`, `&`, `|`, `(`, `{`, `,`.
-  "(?:^|[\\s;&|\\(\\{,])(?:Get|Set|New|Remove|Add|Clear|Copy|Move|Rename|Test|Update|Write|Read|Push|Pop|Invoke|Start|Stop|Wait|Out|Format|Group|Measure|Compare|Resolve|ConvertTo|ConvertFrom|Convert|Import|Export|Select|Where|ForEach|Sort|Tee|Split|Join|Limit|Skip|Step|Trace|Debug|Register|Unregister|Enable|Disable|Restart|Suspend|Resume|Save|Open|Close|Lock|Unlock|Mount|Dismount|Enter|Exit|Use|Show|Hide|Find|Search|Watch|Initialize|Optimize|Compress|Expand|Merge|Checkpoint|Undo|Redo|Approve|Deny|Block|Grant|Revoke|Assert|Confirm|Receive|Send|Connect|Disconnect|Reset|Backup|Restore|Publish|Unpublish|Install|Uninstall|Build|Rebuild|Deploy|Submit|Process|Complete|Approve|Revoke|Pay|Refund|Decline|Receive|Send)-[A-Za-z][A-Za-z0-9]+(?:[\\-\\+][A-Za-z][A-Za-z0-9]+)*(?:$|[\\s\\-\\;\\&\\|\\(\\)\\{\\},])",
-  "i"
-);
-function shellArgs(shell) {
-  if (shell === "powershell" || shell === "pwsh") {
-    return ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand"];
-  }
-  return ["/c"];
-}
-function diagnoseBashism(command, shell) {
-  if (!command) return void 0;
-  const isCmd = shell === "cmd";
-  const hints = [];
-  const add = (h) => {
-    if (!hints.includes(h)) hints.push(h);
-  };
-  if (/\/dev\/null/.test(command)) {
-    add(
-      isCmd ? "use `nul` instead of `/dev/null` (e.g. `2>nul`)" : "use `$null` instead of `/dev/null` (e.g. `2>$null`)"
-    );
-  }
-  if (/(^|[;&|]\s*)export\s+[A-Za-z_]\w*=/.test(command)) {
-    add(
-      isCmd ? "set env vars with `set NAME=value`, not `export`" : "set env vars with `$env:NAME = 'value'`, not `export`"
-    );
-  }
-  if (/<<-?\s*['"]?[A-Za-z_]\w*/.test(command)) {
-    add(
-      isCmd ? "cmd has no heredocs \u2014 write the content to a file or use multiple `echo` lines" : "PowerShell has no heredocs \u2014 use a single-quoted here-string `@'\u2026'@` (closing `'@` at column 0)"
-    );
-  }
-  if (shell === "powershell" && /(&&|\|\|)/.test(command)) {
-    add(
-      "Windows PowerShell 5.1 has no `&&`/`||` \u2014 separate commands with `;` (check `$LASTEXITCODE`)"
-    );
-  }
-  if (/\brm\s+-[A-Za-z]*[rf]/.test(command)) {
-    add(
-      isCmd ? "`rm` is not a cmd builtin \u2014 use `del` (files) or `rmdir /s /q` (dirs)" : "use `Remove-Item -Recurse -Force` \u2014 the `rm -rf` bash flags don't exist in PowerShell"
-    );
-  }
-  if (/\bwhich\s+\S/.test(command)) {
-    add(
-      isCmd ? "use `where <cmd>` instead of `which`" : "use `Get-Command <cmd>` instead of `which`"
-    );
-  }
-  if (hints.length === 0) return void 0;
-  const label = isCmd ? "cmd.exe" : shell === "pwsh" ? "PowerShell 7" : "Windows PowerShell";
-  return `[wrongstack] This command failed and contains bash/POSIX syntax that ${label} does not accept \u2014 ${hints.join("; ")}. Rewrite it in ${isCmd ? "cmd" : "PowerShell"} syntax and retry.`;
-}
-
-// src/_util.ts
-import * as Core from "@wrongstack/core/utils";
-var COMMAND_OUTPUT_MAX_BYTES = 32768;
-var REPEAT_RUN_THRESHOLD = 3;
-function collapseCarriageReturns(text) {
-  const lf = text.replace(/\r\n/g, "\n");
-  if (!lf.includes("\r")) return lf;
-  return lf.split("\n").map((line) => line.includes("\r") ? line.slice(line.lastIndexOf("\r") + 1) : line).join("\n");
-}
-function collapseConsecutiveDuplicates(text, minRun = REPEAT_RUN_THRESHOLD) {
-  const lines = text.split("\n");
-  const out = [];
-  let i = 0;
-  while (i < lines.length) {
-    let j = i + 1;
-    while (j < lines.length && lines[j] === lines[i]) j++;
-    const run = j - i;
-    if (run >= minRun) {
-      out.push(lines[i], `\u2026 \u27E8repeated ${run}\xD7\u27E9`);
-    } else {
-      for (let k = i; k < j; k++) out.push(lines[k]);
-    }
-    i = j;
-  }
-  return out.join("\n");
-}
-function takeHeadBytes(s, maxBytes) {
-  if (maxBytes <= 0) return "";
-  if (Buffer.byteLength(s, "utf8") <= maxBytes) return s;
-  let lo = 0;
-  let hi = s.length;
-  while (lo < hi) {
-    const mid = Math.ceil((lo + hi) / 2);
-    if (Buffer.byteLength(s.slice(0, mid), "utf8") <= maxBytes) lo = mid;
-    else hi = mid - 1;
-  }
-  return s.slice(0, lo);
-}
-function takeTailBytes(s, maxBytes) {
-  if (maxBytes <= 0) return "";
-  if (Buffer.byteLength(s, "utf8") <= maxBytes) return s;
-  let lo = 0;
-  let hi = s.length;
-  while (lo < hi) {
-    const mid = Math.ceil((lo + hi) / 2);
-    if (Buffer.byteLength(s.slice(s.length - mid), "utf8") <= maxBytes) lo = mid;
-    else hi = mid - 1;
-  }
-  return s.slice(s.length - lo);
-}
-function truncateHeadTail(s, maxBytes) {
-  const total = Buffer.byteLength(s, "utf8");
-  if (total <= maxBytes) return s;
-  const MARKER_RESERVE = 64;
-  const avail = Math.max(0, maxBytes - MARKER_RESERVE);
-  const headBudget = Math.floor(avail * 0.45);
-  const head = takeHeadBytes(s, headBudget);
-  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, "utf8"));
-  const kept = Buffer.byteLength(head, "utf8") + Buffer.byteLength(tail, "utf8");
-  return `${head}
-\u2026[truncated ${total - kept} bytes]\u2026
-${tail}`;
-}
-function normalizeCommandOutput(raw, opts = {}) {
-  if (!raw) return raw;
-  let text = Core.stripAnsi(raw);
-  text = collapseCarriageReturns(text);
-  text = text.replace(/[ \t]+$/gm, "");
-  text = collapseConsecutiveDuplicates(text);
-  text = text.replace(/\n{3,}/g, "\n\n");
-  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);
-}
-
-// src/_win32-resolve.ts
-import * as fs from "node:fs";
-import * as path2 from "node:path";
-function resolveWin32Command(cmd) {
-  if (process.platform !== "win32") return cmd;
-  if (cmd.includes("/") || cmd.includes("\\") || path2.extname(cmd.replace(/\//g, "\\"))) {
-    return cmd;
-  }
-  const pathext = (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC").toLowerCase().split(";");
-  const pathDirs = (process.env["PATH"] ?? "").split(path2.delimiter);
-  for (const dir of pathDirs) {
-    const base = path2.join(dir, cmd);
-    for (const ext of pathext) {
-      const full = `${base}${ext}`;
-      try {
-        fs.accessSync(full, fs.constants.X_OK);
-        return full;
-      } catch {
-      }
-    }
-  }
-  return cmd;
-}
-function resolvePowerShell(cmd) {
-  if (process.platform !== "win32") return cmd;
-  const lower = cmd.toLowerCase();
-  if (lower !== "pwsh" && lower !== "powershell" && lower !== "pwsh.exe" && lower !== "powershell.exe") {
-    return resolveWin32Command(cmd);
-  }
-  const primary = lower.startsWith("pwsh") ? "pwsh" : "powershell";
-  const fallback = lower.startsWith("pwsh") ? "powershell" : "pwsh";
-  const resolved = resolveWin32Command(primary);
-  if (resolved === primary) {
-    const fb = resolveWin32Command(fallback);
-    return fb === fallback ? cmd : fb;
-  }
-  return resolved;
-}
-
-// src/bash-kill-guard.ts
-import * as os3 from "node:os";
-
-// src/process-registry-persistent.ts
-import * as fs2 from "node:fs/promises";
-import * as os2 from "node:os";
-import { wstackGlobalRoot as wstackGlobalRoot3 } from "@wrongstack/core/utils";
-import * as path3 from "node:path";
-
-// src/process-registry.ts
-import { spawn } from "node:child_process";
-import * as os from "node:os";
-
-// src/circuit-breaker.ts
-var DEFAULT_MAX_CONSECUTIVE_FAILURES = 5;
-var DEFAULT_SLOW_CALL_THRESHOLD_MS = 18e4;
-var DEFAULT_MAX_SLOW_CALLS = 3;
-var DEFAULT_WINDOW_MS = 6e4;
-var DEFAULT_MAX_CALLS_PER_WINDOW = 30;
-var DEFAULT_COOLDOWN_MS = 3e4;
-var CircuitBreaker = class {
-  maxConsecutiveFailures;
-  slowCallThresholdMs;
-  maxSlowCalls;
-  windowMs;
-  maxCallsPerWindow;
-  cooldownMs;
-  state = "closed";
-  consecutiveFailures = 0;
-  window = [];
-  lastFailureAt = null;
-  lastSlowAt = null;
-  /** Timestamp when the breaker was opened (for cooldown calculation). */
-  openedAt = null;
-  /**
-   * Master enable flag. When false the breaker is bypassed: `beforeCall`
-   * always returns true and `afterCall` records nothing. The class itself
-   * defaults to enabled (so the standalone unit tests exercise tripping); the
-   * ProcessRegistry flips this off until the user opts in via `/settings`.
-   */
-  enabled = true;
-  /**
-   * Fired (best-effort) when the breaker transitions into the `open` state.
-   * The registry uses this to arm its auto kill/reset countdown.
-   */
-  onTrip;
-  /**
-   * Fired (best-effort) when the breaker returns to `closed` after having been
-   * open/half-open. The registry uses this to cancel a pending kill/reset.
-   */
-  onReset;
-  constructor(config = {}) {
-    this.maxConsecutiveFailures = config.maxConsecutiveFailures ?? DEFAULT_MAX_CONSECUTIVE_FAILURES;
-    this.slowCallThresholdMs = config.slowCallThresholdMs ?? DEFAULT_SLOW_CALL_THRESHOLD_MS;
-    this.maxSlowCalls = config.maxSlowCalls ?? DEFAULT_MAX_SLOW_CALLS;
-    this.windowMs = config.windowMs ?? DEFAULT_WINDOW_MS;
-    this.maxCallsPerWindow = config.maxCallsPerWindow ?? DEFAULT_MAX_CALLS_PER_WINDOW;
-    this.cooldownMs = config.cooldownMs ?? DEFAULT_COOLDOWN_MS;
-  }
-  /** Toggle the master enable. Disabling resets to a clean `closed` state. */
-  setEnabled(enabled) {
-    if (this.enabled === enabled) return;
-    this.enabled = enabled;
-    if (!enabled) this._reset();
-  }
-  get isEnabled() {
-    return this.enabled;
-  }
-  /**
-   * Returns true if the circuit allows a new call to proceed.
-   * When false, callers should abort the tool call and return a
-   * circuit-breaker error instead of spawning a process.
-   */
-  get canProceed() {
-    if (!this.enabled) return true;
-    this._checkStateTransition();
-    return this.state !== "open";
-  }
-  /**
-   * Snapshot of the current breaker state for observability (`/kill`).
-   */
-  snapshot() {
-    this._checkStateTransition();
-    const now = Date.now();
-    let cooldownRemaining = null;
-    if (this.openedAt !== null && this.state === "open") {
-      const elapsed = now - this.openedAt;
-      cooldownRemaining = Math.max(0, this.cooldownMs - elapsed);
-    }
-    return {
-      state: this.state,
-      consecutiveFailures: this.consecutiveFailures,
-      slowCallsInWindow: this.window.filter((c) => c.slow).length,
-      callsInWindow: this.window.length,
-      windowMs: this.windowMs,
-      cooldownRemainingMs: cooldownRemaining,
-      lastFailureAt: this.lastFailureAt,
-      lastSlowAt: this.lastSlowAt
-    };
-  }
-  /**
-   * Call this BEFORE spawning a bash/exec process.
-   * Returns true if the call is allowed; false if the breaker is open.
-   * When false, callers MUST NOT spawn a process.
-   *
-   * @param bypass - If true, skip the circuit breaker check entirely.
-   *                  Use for background/fire-and-forget processes that should
-   *                  not affect breaker state.
-   */
-  beforeCall(bypass = false) {
-    if (bypass || !this.enabled) return true;
-    this._checkStateTransition();
-    if (this.state === "open") return false;
-    return true;
-  }
-  /**
-   * Call this AFTER a bash/exec process finishes (success or failure).
-   * `durationMs` is the wall-clock time the process ran.
-   * `failed` is true when the process returned a non-zero exit code or
-   * threw an exception before spawning.
-   *
-   * @param bypass - If true, do not update breaker state.
-   *                  Use for background/fire-and-forget processes.
-   */
-  afterCall(durationMs, failed, bypass = false) {
-    if (bypass || !this.enabled) return;
-    const now = Date.now();
-    if (this.state === "half-open") {
-      if (failed) {
-        this._trip();
-        return;
-      }
-      this._reset();
-      return;
-    }
-    this._pruneWindow(now);
-    const slow = durationMs >= this.slowCallThresholdMs;
-    this.window.push({ at: now, failed, slow });
-    if (failed) {
-      this.consecutiveFailures++;
-      this.lastFailureAt = now;
-      if (this.consecutiveFailures >= this.maxConsecutiveFailures) {
-        this._trip();
-      }
-      return;
-    }
-    this.consecutiveFailures = 0;
-    if (slow) {
-      this.lastSlowAt = now;
-      const slowCount = this.window.filter((c) => c.slow).length;
-      if (slowCount >= this.maxSlowCalls) {
-        this._trip();
-      }
-    }
-    const callCount = this.window.length;
-    if (callCount >= this.maxCallsPerWindow) {
-      this._trip();
-    }
-  }
-  /** Force the breaker open. Used by /kill force and Ctrl+C. */
-  forceOpen() {
-    this._trip();
-  }
-  /** Force a reset to closed. Used by tests and /kill reset. */
-  forceReset() {
-    this._reset();
-  }
-  _trip() {
-    if (this.state === "open") return;
-    this.state = "open";
-    this.openedAt = Date.now();
-    this.window = [];
-    try {
-      this.onTrip?.();
-    } catch {
-    }
-  }
-  _reset() {
-    const wasRecovering = this.state !== "closed";
-    this.state = "closed";
-    this.consecutiveFailures = 0;
-    this.window = [];
-    this.openedAt = null;
-    if (wasRecovering) {
-      try {
-        this.onReset?.();
-      } catch {
-      }
-    }
-  }
-  /** Transition from open → half-open when cooldown elapses. */
-  _checkStateTransition() {
-    if (this.state !== "open" || this.openedAt === null) return;
-    const elapsed = Date.now() - this.openedAt;
-    if (elapsed >= this.cooldownMs) {
-      this.state = "half-open";
-      this.openedAt = null;
-    }
-  }
-  _pruneWindow(now) {
-    const cutoff = now - this.windowMs;
-    this.window = this.window.filter((c) => c.at >= cutoff);
-  }
-};
-
-// src/_redact-command.ts
-import { expectDefined } from "@wrongstack/core/utils";
-var SENSITIVE_FLAG_PATTERNS = [
-  // --flag=value  or  --flag "value"  (value captured up to next space or comma)
-  /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
-  // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
-  // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
-  // The value must be token-like (>= 8 chars) so ordinary combined flags such
-  // as `tar -tf` / `ssh -tt` are not eaten. Global flag: EVERY occurrence is
-  // redacted, not just the first.
-  // NOTE: synced with @wrongstack/core observability/redact-command.ts.
-  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]{8,}/g,
-  // -p|-password|-a (redis auth) short flags: attached + separated + =value.
-  // Same token-start anchor; over-redaction is an accepted tradeoff for a
-  // redaction function. Synced with core copy.
-  /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
-  // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
-  // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
-  // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
-  // every such flag in the command line is redacted, not just the first.
-  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/g
-];
-function redactCommand(cmd) {
-  let result = cmd;
-  for (const pattern of SENSITIVE_FLAG_PATTERNS) {
-    result = result.replace(pattern, (match) => {
-      const eq = match.indexOf("=");
-      const sp = match.search(/\s/);
-      const delim = eq !== -1 ? "=" : sp !== -1 ? match[sp] : null;
-      if (delim !== null) {
-        const flag = match.slice(0, match.indexOf(expectDefined(delim)) + 1);
-        return `${flag}[REDACTED]`;
-      }
-      if (match.startsWith("--")) {
-        return match;
-      }
-      return `${match.slice(0, 2)}[REDACTED]`;
-    });
-  }
-  return result;
-}
-
-// src/process-registry.ts
-var DEFAULT_GRACE_MS = 2e3;
-var WIN32_TASKKILL_TIMEOUT_MS = 5e3;
-function killWin32Tree(pid, opts = {}) {
-  try {
-    const child = spawn("taskkill", ["/pid", String(pid), "/T", "/F"], {
-      stdio: "ignore",
-      windowsHide: true
-    });
-    let settled = false;
-    let timeout;
-    const settle = () => {
-      if (settled) return;
-      settled = true;
-      if (timeout) clearTimeout(timeout);
-      try {
-        opts.onSettled?.();
-      } catch {
-      }
-    };
-    child.on("error", settle);
-    child.on("close", settle);
-    timeout = setTimeout(
-      () => {
-        try {
-          child.kill();
-        } catch {
-        }
-        settle();
-      },
-      Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS)
-    );
-    timeout.unref?.();
-    child.unref();
-    return true;
-  } catch {
-    return false;
-  }
-}
-var ProcessRegistryImpl = class {
-  processes = /* @__PURE__ */ new Map();
-  breaker;
-  /**
-   * Auto kill/reset config. When the breaker trips and `autoKillResetMs > 0`,
-   * a countdown is armed; on expiry all tracked processes are killed and the
-   * breaker is reset to closed (forced recovery). Zero means manual recovery
-   * only (`/kill reset`).
-   */
-  autoKillResetMs = 0;
-  autoKillTimer = null;
-  autoKillArmedAt = null;
-  breakerCountdownListeners = [];
-  constructor(breakerConfig) {
-    this.breaker = new CircuitBreaker(breakerConfig);
-    this.breaker.onTrip = () => this._armAutoKillReset();
-    this.breaker.onReset = () => this._cancelAutoKillReset();
-    this.breaker.setEnabled(false);
-  }
-  register(info) {
-    this.processes.set(info.pid, {
-      ...info,
-      killed: false,
-      protected: info.protected ?? false,
-      background: info.background ?? false
-    });
-  }
-  _isSafeSignalPid(pid) {
-    return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
-  }
-  _canSignalProcessGroup(p) {
-    return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && p.child !== null && typeof p.child.pid === "number" && p.child.pid === p.pid;
-  }
-  _killChildDirect(p, signal) {
-    try {
-      if (p.child) {
-        p.child.kill(signal);
-        return;
-      }
-      if (this._isSafeSignalPid(p.pid)) process.kill(p.pid, signal);
-    } catch {
-    }
-  }
-  _killPosix(p, signal) {
-    if (this._canSignalProcessGroup(p)) {
-      try {
-        process.kill(-p.pid, signal);
-        return;
-      } catch {
-      }
-    }
-    this._killChildDirect(p, signal);
-  }
-  /** Unregister a process by PID. Called on 'close' / 'exit' events. */
-  unregister(pid) {
-    this.processes.delete(pid);
-  }
-  /** Get a single process by PID. */
-  get(pid) {
-    this._pruneStale(pid);
-    return this.processes.get(pid);
-  }
-  /** Get all tracked processes. */
-  list() {
-    this._pruneAllStale();
-    return Array.from(this.processes.values());
-  }
-  /** Get processes filtered by name (e.g. 'bash', 'exec'). */
-  byName(name) {
-    return this.list().filter((p) => p.name === name);
-  }
-  /** Get processes filtered by session. */
-  bySession(sessionId) {
-    return this.list().filter((p) => p.sessionId === sessionId);
-  }
-  /** Count of active (non-killed) processes. */
-  get activeCount() {
-    let n = 0;
-    for (const p of this.processes.values()) {
-      if (!p.killed) n++;
-    }
-    return n;
-  }
-  /** Count of active jobs explicitly launched in background mode. */
-  get activeBackgroundCount() {
-    let n = 0;
-    for (const p of this.processes.values()) {
-      if (p.background && !p.killed) n++;
-    }
-    return n;
-  }
-  /**
-   * Combined stats for observability — used by /ps and the TUI status bar.
-   */
-  stats() {
-    this._pruneAllStale();
-    return {
-      activeCount: this.activeCount,
-      backgroundCount: this.activeBackgroundCount,
-      totalCount: this.processes.size,
-      breaker: this.breaker.snapshot()
-    };
-  }
-  /**
-   * Returns true if the circuit allows a new bash/exec call to proceed.
-   * When false, callers MUST NOT spawn a process.
-   */
-  get canProceed() {
-    return this.breaker.canProceed;
-  }
-  /**
-   * Called before spawning a process. Returns true if allowed; false if
-   * the circuit breaker is open.
-   *
-   * @param bypass - If true, skip circuit breaker check (for background processes).
-   */
-  beforeCall(bypass = false) {
-    return this.breaker.beforeCall(bypass);
-  }
-  /**
-   * Called after a process finishes. `durationMs` is wall-clock time;
-   * `failed` is true for non-zero exit codes.
-   *
-   * @param bypass - If true, do not update circuit breaker state (for background processes).
-   */
-  afterCall(durationMs, failed, bypass = false) {
-    this.breaker.afterCall(durationMs, failed, bypass);
-  }
-  /** Force-open the circuit breaker (Ctrl+C, /kill force). */
-  forceBreakerOpen() {
-    this.breaker.forceOpen();
-  }
-  /** Force-reset the circuit breaker to closed (/kill reset). */
-  forceBreakerReset() {
-    this.breaker.forceReset();
-  }
-  /**
-   * Configure circuit-breaker protection at runtime. Called from `/settings`
-   * (instant, all modes) and on TUI mount (applies persisted config).
-   *
-   * - `enabled` toggles whether the breaker gates `bash`/`exec`.
-   * - `autoKillResetMs` arms the auto kill/reset countdown when the breaker
-   *   trips (0 = manual recovery only).
-   *
-   * Re-applies cleanly on every call: cancels a pending countdown when the
-   * timeout is cleared or protection disabled, and re-arms if the breaker is
-   * currently open under the new settings.
-   */
-  setBreakerConfig(cfg) {
-    if (cfg.enabled !== void 0) this.breaker.setEnabled(cfg.enabled);
-    if (cfg.autoKillResetMs !== void 0) this.autoKillResetMs = Math.max(0, cfg.autoKillResetMs);
-    if (this.autoKillResetMs <= 0) {
-      this._cancelAutoKillReset();
-      return;
-    }
-    if (this.breaker.isEnabled && this.breaker.snapshot().state === "open") {
-      this._armAutoKillReset();
-    }
-  }
-  /**
-   * Live countdown to the next auto kill/reset, or null when nothing is armed.
-   * The TUI polls this on a 1s tick while armed so the statusline decrements.
-   */
-  getBreakerCountdown() {
-    if (this.autoKillArmedAt === null || this.autoKillResetMs <= 0) return null;
-    const elapsed = Date.now() - this.autoKillArmedAt;
-    return {
-      remainingMs: Math.max(0, this.autoKillResetMs - elapsed),
-      totalMs: this.autoKillResetMs
-    };
-  }
-  /**
-   * Subscribe to countdown arm/cancel events. Returns an unsubscribe function.
-   * Use {@link getBreakerCountdown} for the live ticking value between events.
-   */
-  onBreakerCountdownChange(listener) {
-    this.breakerCountdownListeners.push(listener);
-    return () => {
-      this.breakerCountdownListeners = this.breakerCountdownListeners.filter((l) => l !== listener);
-    };
-  }
-  _emitBreakerCountdown() {
-    const snap = this.getBreakerCountdown();
-    for (const l of this.breakerCountdownListeners) {
-      try {
-        l(snap);
-      } catch {
-      }
-    }
-  }
-  /**
-   * Arm the auto kill/reset countdown. Idempotent: re-arming resets the window
-   * (a fresh trip after a failed half-open probe restarts the clock). No-op
-   * when protection is off or no timeout is configured.
-   */
-  _armAutoKillReset() {
-    if (this.autoKillResetMs <= 0 || !this.breaker.isEnabled) return;
-    this._clearAutoKillTimer();
-    this.autoKillArmedAt = Date.now();
-    this.autoKillTimer = setTimeout(() => {
-      this.autoKillTimer = null;
-      this.autoKillArmedAt = null;
-      this.killAll({ force: false, preserveBackground: true });
-      this.breaker.forceReset();
-      this._emitBreakerCountdown();
-    }, this.autoKillResetMs);
-    this.autoKillTimer.unref?.();
-    this._emitBreakerCountdown();
-  }
-  _cancelAutoKillReset() {
-    const wasArmed = this.autoKillArmedAt !== null;
-    this._clearAutoKillTimer();
-    if (wasArmed) {
-      this.autoKillArmedAt = null;
-      this._emitBreakerCountdown();
-    }
-  }
-  _clearAutoKillTimer() {
-    if (this.autoKillTimer !== null) {
-      clearTimeout(this.autoKillTimer);
-      this.autoKillTimer = null;
-    }
-  }
-  /** Kill a single process by PID.
-   *
-   *  On POSIX: sends SIGTERM to the *process group* (-pid) so that
-   *  runaway grandchild processes (`sleep 9999 & disown`) are also killed.
-   *  After `graceMs` a SIGKILL is sent if the process hasn't exited.
-   *
-   *  On Windows: `child.kill()` maps to TerminateProcess — process groups
-   *  are not meaningfully supported. A second `force=true` call sends
-   *  SIGKILL (which maps to TerminateProcess again — the distinction is
-   *  in the exit code, not the signal).
-   *
-   *  Returns true if the process was found and kill was attempted.
-   */
-  kill(pid, opts = {}) {
-    this._pruneStale(pid);
-    const p = this.processes.get(pid);
-    if (!p) return false;
-    if (p.killed && opts.force !== true) return true;
-    if (p.protected && opts.includeProtected !== true) return false;
-    if (opts.preserveBackground && p.background) return false;
-    const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
-    const isWin2 = os.platform() === "win32";
-    if (isWin2) {
-      const liveRealChild = p.child === null || p.child.exitCode === null && typeof p.child.pid === "number";
-      const directFallback = () => {
-        if (p.child && p.child.exitCode === null) {
-          try {
-            p.child.kill("SIGKILL");
-          } catch {
-          }
-        }
-      };
-      if (liveRealChild && killWin32Tree(pid, {
-        timeoutMs: Math.max(graceMs, WIN32_TASKKILL_TIMEOUT_MS),
-        onSettled: directFallback
-      })) {
-      } else {
-        this._killChildDirect(p, force ? "SIGKILL" : "SIGTERM");
-      }
-      p.killed = true;
-      return true;
-    }
-    try {
-      if (force) {
-        this._killPosix(p, "SIGKILL");
-      } else {
-        this._killPosix(p, "SIGTERM");
-        const timer = setTimeout(() => {
-          if (this.processes.has(pid) && !p.child?.killed) {
-            this._killPosix(p, "SIGKILL");
-          }
-        }, graceMs);
-        timer.unref?.();
-      }
-    } catch {
-    }
-    p.killed = true;
-    return true;
-  }
-  /**
-   * Kill all tracked processes.
-   * Returns the PIDs that were kill()ed.
-   */
-  killAll(opts = {}) {
-    const pids = Array.from(this.processes.keys());
-    const killed = [];
-    const includeProtected = opts.includeProtected === true;
-    for (const pid of pids) {
-      const p = this.processes.get(pid);
-      if (!p) continue;
-      if (p.protected && !includeProtected) continue;
-      if (opts.preserveBackground && p.background) continue;
-      if (this.kill(pid, opts)) killed.push(pid);
-    }
-    return killed;
-  }
-  /**
-   * Kill all processes for a specific session.
-   * Returns the PIDs that were kill()ed.
-   */
-  killSession(sessionId, opts = {}) {
-    const pids = this.bySession(sessionId).map((p) => p.pid);
-    const killed = [];
-    for (const pid of pids) {
-      if (this.kill(pid, opts)) killed.push(pid);
-    }
-    return killed;
-  }
-  /**
-   * Check whether a tracked process entry is stale — the child has exited
-   * (exitCode !== null) AND it's been in the registry long enough that the
-   * OS may have reused the PID for a new, unrelated process.
-   *
-   * P3 #24 (before-release.md): on POSIX, PIDs are reused after process
-   * exit. If a tracked process exits but its 'close' event hasn't fired yet
-   * (or was missed), the registry still holds the entry. A new process
-   * gets the same PID, and PID-based lookups (get, kill, shouldBlockKill)
-   * may incorrectly protect or target the wrong process.
-   *
-   * The 60s threshold is conservative — the OS typically waits much longer
-   * before reusing a PID, but we want to clean up before that becomes a risk.
-   */
-  _isStaleEntry(entry) {
-    if (entry.child === null) {
-      if (Date.now() - entry.startedAt <= 6e4) return false;
-      if (os.platform() === "win32") return false;
-      try {
-        process.kill(entry.pid, 0);
-        return false;
-      } catch (err) {
-        return err.code !== "EPERM";
-      }
-    }
-    return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
-  }
-  /**
-   * Remove a stale entry for a specific PID before any PID-based lookup.
-   * This prevents PID reuse from causing the registry to act on a dead
-   * process that has been replaced by a new one with the same PID.
-   */
-  _pruneStale(pid) {
-    const entry = this.processes.get(pid);
-    if (entry && this._isStaleEntry(entry)) {
-      this.processes.delete(pid);
-    }
-  }
-  /**
-   * Remove every stale entry, not just one PID. `list()`/`stats()` — the
-   * surfaces the TUI status bar and `/ps` poll — must prune too: a child
-   * whose 'close' event never fires (e.g. Windows grandchildren holding stdio
-   * open) would otherwise linger in the registry until someone looks up its
-   * exact PID, and PID reuse meanwhile makes `get()`/`kill()` target the
-   * wrong process. RAM-leak audit 2026-07-31, MEDIUM.
-   */
-  _pruneAllStale() {
-    for (const [pid, entry] of this.processes) {
-      if (this._isStaleEntry(entry)) this.processes.delete(pid);
-    }
-  }
-};
-var _registry;
-function getProcessRegistry() {
-  if (!_registry) {
-    _registry = new ProcessRegistryImpl();
-  }
-  return _registry;
-}
-
-// src/process-registry-persistent.ts
-var REGISTRY_FILE = "process-registry.json";
-function toErrorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-function emitStructuredLog(level, event, message, error) {
-  const payload = {
-    level,
-    event,
-    message,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  if (error !== void 0) {
-    payload.error = toErrorMessage(error);
-  }
-  console.log(JSON.stringify(payload));
-}
-var HEARTBEAT_INTERVAL_MS = 5e3;
-var STALE_THRESHOLD_MS = 3e4;
-var LOCK_STALE_MS = 3e4;
-var LOCKFILE = ".process-registry.lock";
-function generateInstanceId() {
-  const hostname2 = os2.hostname();
-  const pid = process.pid;
-  const random = Math.random().toString(36).slice(2, 8);
-  return `${hostname2}:${pid}:${random}`;
-}
-function isNodeError(err) {
-  return typeof err === "object" && err !== null && "code" in err;
-}
-async function acquireLock(lockfilePath, timeoutMs = 5e3) {
-  const start = Date.now();
-  const pidStr = String(process.pid);
-  const hostStr = os2.hostname();
-  try {
-    await fs2.mkdir(path3.dirname(lockfilePath), { recursive: true });
-  } catch {
-  }
-  while (Date.now() - start < timeoutMs) {
-    try {
-      await fs2.writeFile(lockfilePath, `${pidStr}:${hostStr}:${Date.now()}`, { flag: "wx" });
-      return async () => {
-        try {
-          await fs2.unlink(lockfilePath);
-        } catch {
-        }
-      };
-    } catch (err) {
-      if (isNodeError(err) && err.code === "EEXIST") {
-        try {
-          const content = await fs2.readFile(lockfilePath, "utf-8");
-          const parts = content.split(":");
-          const lockPid = parseInt(parts[0] ?? "0", 10);
-          const lockTs = Number(parts[parts.length - 1]);
-          const staleByAge = Number.isFinite(lockTs) && Date.now() - lockTs > LOCK_STALE_MS;
-          let holderDead = false;
-          if (process.platform !== "win32" && Number.isFinite(lockPid) && lockPid > 0) {
-            try {
-              process.kill(lockPid, 0);
-            } catch {
-              holderDead = true;
-            }
-          }
-          if (holderDead || staleByAge) {
-            await fs2.unlink(lockfilePath).catch(() => {
-            });
-            continue;
-          }
-        } catch {
-          await fs2.unlink(lockfilePath).catch(() => {
-          });
-          continue;
-        }
-        await new Promise((r) => setTimeout(r, 100));
-        continue;
-      }
-      throw err;
-    }
-  }
-  throw new Error(`Failed to acquire lock after ${timeoutMs}ms`);
-}
-function freshRegistryData() {
-  return {
-    version: 1,
-    instances: /* @__PURE__ */ new Map(),
-    protectedPatterns: ["wrongstack", "node"],
-    lastCleanup: Date.now()
-  };
-}
-async function readRegistryFile(filePath) {
-  let content;
-  try {
-    content = await fs2.readFile(filePath, "utf-8");
-  } catch (err) {
-    if (isNodeError(err) && err.code === "ENOENT") return freshRegistryData();
-    throw err;
-  }
-  try {
-    const parsed = JSON.parse(content);
-    if (!parsed || typeof parsed !== "object") return freshRegistryData();
-    const base = freshRegistryData();
-    return {
-      version: 1,
-      instances: Array.isArray(parsed.instances) ? new Map(parsed.instances) : base.instances,
-      protectedPatterns: Array.isArray(parsed.protectedPatterns) ? parsed.protectedPatterns : base.protectedPatterns,
-      lastCleanup: typeof parsed.lastCleanup === "number" ? parsed.lastCleanup : base.lastCleanup
-    };
-  } catch {
-    return freshRegistryData();
-  }
-}
-async function writeRegistryFile(filePath, data) {
-  const tmpPath = `${filePath}.tmp.${process.pid}`;
-  const content = JSON.stringify(
-    data,
-    (_k, v) => {
-      if (v instanceof Map) {
-        return Array.from(v.entries());
-      }
-      return v;
-    },
-    2
-  );
-  await fs2.writeFile(tmpPath, content, "utf-8");
-  await fs2.rename(tmpPath, filePath);
-}
-var PersistentProcessRegistry = class {
-  instanceId;
-  registryPath;
-  lockPath;
-  baseRegistry;
-  heartbeatInterval = null;
-  cleanupInterval = null;
-  heartbeatRunning = false;
-  cleanupRunning = false;
-  isShuttingDown = false;
-  onProcessExit = () => {
-    this.runInBackground(
-      this.syncToPersistent(),
-      "process_registry.exit_sync_failed",
-      "PersistentProcessRegistry: exit sync failed"
-    );
-  };
-  constructor(baseRegistry) {
-    this.instanceId = generateInstanceId();
-    const globalRoot = wstackGlobalRoot3();
-    this.registryPath = path3.join(globalRoot, REGISTRY_FILE);
-    this.lockPath = path3.join(globalRoot, LOCKFILE);
-    this.baseRegistry = baseRegistry ?? getProcessRegistry();
-    this.ensureDirectory().catch((err) => {
-      emitStructuredLog(
-        "warn",
-        "process_registry.dir_create_failed",
-        "PersistentProcessRegistry: failed to create .wrongstack directory",
-        err
-      );
-    });
-  }
-  async ensureDirectory() {
-    const dir = path3.dirname(this.registryPath);
-    try {
-      await fs2.mkdir(dir, { recursive: true });
-    } catch (err) {
-      if (!isNodeError(err) || err.code !== "EEXIST") throw err;
-    }
-  }
-  runInBackground(operation, event, message) {
-    void operation.catch((err) => {
-      emitStructuredLog("warn", event, message, err);
-    });
-  }
-  /**
-   * Start the heartbeat and periodic cleanup tasks.
-   */
-  start() {
-    if (this.heartbeatInterval) return;
-    this.isShuttingDown = false;
-    this.heartbeat();
-    this.heartbeatInterval = setInterval(() => {
-      this.heartbeat();
-    }, HEARTBEAT_INTERVAL_MS);
-    this.heartbeatInterval.unref?.();
-    this.cleanupInterval = setInterval(() => {
-      this.cleanup();
-    }, STALE_THRESHOLD_MS);
-    this.cleanupInterval.unref?.();
-    this.registerMainProcess();
-    process.on("exit", this.onProcessExit);
-  }
-  /**
-   * Stop the heartbeat and clean up.
-   */
-  stop() {
-    this.isShuttingDown = true;
-    if (this.heartbeatInterval) {
-      clearInterval(this.heartbeatInterval);
-      this.heartbeatInterval = null;
-    }
-    if (this.cleanupInterval) {
-      clearInterval(this.cleanupInterval);
-      this.cleanupInterval = null;
-    }
-    process.off("exit", this.onProcessExit);
-    this.runInBackground(
-      this.syncToPersistent(),
-      "process_registry.stop_sync_failed",
-      "PersistentProcessRegistry: stop sync failed"
-    );
-  }
-  /**
-   * Register the main WrongStack process as protected.
-   */
-  registerMainProcess() {
-    const mainPid = process.pid;
-    this.runInBackground(
-      this.updatePersistentEntry({
-        pid: mainPid,
-        name: "wrongstack-main",
-        command: process.argv.slice(0, 3).join(" "),
-        startedAt: Date.now(),
-        lastHeartbeat: Date.now(),
-        instanceId: this.instanceId,
-        hostname: os2.hostname(),
-        protected: true,
-        spawnMode: "main",
-        parentPid: process.ppid,
-        platform: process.platform
-      }),
-      "process_registry.main_register_failed",
-      "PersistentProcessRegistry: failed to register main process"
-    );
-  }
-  /**
-   * Register a spawned child process with the persistent registry.
-   */
-  registerChildProcess(pid, name, command, sessionId, spawnMode = "spawn") {
-    const entry = {
-      pid,
-      name,
-      command,
-      startedAt: Date.now(),
-      lastHeartbeat: Date.now(),
-      instanceId: this.instanceId,
-      hostname: os2.hostname(),
-      protected: true,
-      // All WrongStack child processes are protected by default
-      spawnMode,
-      parentPid: process.pid,
-      platform: process.platform
-    };
-    if (sessionId) {
-      entry.sessionId = sessionId;
-    }
-    this.runInBackground(
-      this.updatePersistentEntry(entry),
-      "process_registry.child_register_failed",
-      "PersistentProcessRegistry: failed to register child process"
-    );
-  }
-  /**
-   * Update or add an entry in the persistent registry.
-   */
-  async updatePersistentEntry(entry) {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      data.instances.set(String(entry.pid), entry);
-      this.baseRegistry.register({
-        pid: entry.pid,
-        name: entry.name,
-        command: entry.command,
-        startedAt: entry.startedAt,
-        sessionId: entry.sessionId,
-        protected: entry.protected,
-        child: null
-      });
-      await writeRegistryFile(this.registryPath, data);
-    } finally {
-      await release();
-    }
-  }
-  /**
-   * Unregister a process from the persistent registry.
-   */
-  async unregister(pid) {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      data.instances.delete(String(pid));
-      await writeRegistryFile(this.registryPath, data);
-    } finally {
-      await release();
-    }
-  }
-  /**
-   * Send heartbeat to mark all this instance's processes as alive.
-   */
-  heartbeat() {
-    if (this.isShuttingDown || this.heartbeatRunning) return;
-    this.heartbeatRunning = true;
-    void this.syncToPersistent().catch((err) => {
-      emitStructuredLog(
-        "warn",
-        "process_registry.heartbeat_failed",
-        "PersistentProcessRegistry: heartbeat failed",
-        err
-      );
-    }).finally(() => {
-      this.heartbeatRunning = false;
-    });
-  }
-  cleanup() {
-    if (this.isShuttingDown || this.cleanupRunning) return;
-    this.cleanupRunning = true;
-    void this.cleanupStaleEntries().catch((err) => {
-      emitStructuredLog(
-        "warn",
-        "process_registry.periodic_cleanup_failed",
-        "PersistentProcessRegistry: periodic cleanup failed",
-        err
-      );
-    }).finally(() => {
-      this.cleanupRunning = false;
-    });
-  }
-  /**
-   * Sync this instance's processes to the persistent registry.
-   */
-  async syncToPersistent() {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      const now = Date.now();
-      const updatedInstances = /* @__PURE__ */ new Map();
-      for (const [_pidStr, entry] of data.instances) {
-        if (entry.instanceId === this.instanceId) {
-          entry.lastHeartbeat = now;
-        }
-        if (entry.instanceId === this.instanceId || now - entry.lastHeartbeat < STALE_THRESHOLD_MS) {
-          updatedInstances.set(_pidStr, entry);
-        }
-      }
-      data.instances = updatedInstances;
-      data.lastCleanup = now;
-      await writeRegistryFile(this.registryPath, data);
-    } catch (err) {
-      emitStructuredLog(
-        "warn",
-        "process_registry.sync_failed",
-        "PersistentProcessRegistry: sync failed",
-        err
-      );
-    } finally {
-      await release();
-    }
-  }
-  /**
-   * Remove entries for processes that are no longer running.
-   */
-  async cleanupStaleEntries() {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      const now = Date.now();
-      const stalePids = [];
-      for (const [_pidStr, entry] of data.instances) {
-        const age = now - entry.lastHeartbeat;
-        if (age > STALE_THRESHOLD_MS) {
-          try {
-            if (process.platform !== "win32") {
-              process.kill(entry.pid, 0);
-            } else {
-              emitStructuredLog(
-                "debug",
-                "process_registry.stale_pid_check",
-                `PersistentProcessRegistry: checking stale pid ${entry.pid} (${age}ms old)`
-              );
-            }
-          } catch {
-            stalePids.push(_pidStr);
-          }
-        }
-      }
-      if (stalePids.length > 0) {
-        for (const pidStr of stalePids) {
-          data.instances.delete(pidStr);
-        }
-        await writeRegistryFile(this.registryPath, data);
-      }
-    } catch (err) {
-      emitStructuredLog(
-        "warn",
-        "process_registry.cleanup_failed",
-        "PersistentProcessRegistry: cleanup failed",
-        err
-      );
-    } finally {
-      await release();
-    }
-  }
-  /**
-   * Check if a PID belongs to a WrongStack process and should be protected.
-   */
-  async isProtectedPid(pid) {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      const entry = data.instances.get(String(pid));
-      if (!entry) return false;
-      if (Date.now() - entry.lastHeartbeat > STALE_THRESHOLD_MS) {
-        return false;
-      }
-      return entry.protected;
-    } finally {
-      await release();
-    }
-  }
-  /**
-   * Get all protected PIDs from all WrongStack instances.
-   */
-  async getAllProtectedPids() {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      const now = Date.now();
-      const protectedPids = [];
-      for (const [_pidStr, entry] of data.instances) {
-        if (entry.protected && now - entry.lastHeartbeat < STALE_THRESHOLD_MS) {
-          protectedPids.push(entry.pid);
-        }
-      }
-      return protectedPids;
-    } finally {
-      await release();
-    }
-  }
-  /**
-   * Get complete status of all tracked processes across all instances.
-   */
-  async getGlobalStatus() {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      const now = Date.now();
-      const instances = /* @__PURE__ */ new Map();
-      let protectedCount = 0;
-      let staleCount = 0;
-      for (const [_pidStr, entry] of data.instances) {
-        const instanceEntries = instances.get(entry.instanceId) ?? [];
-        instanceEntries.push(entry);
-        instances.set(entry.instanceId, instanceEntries);
-        if (entry.protected) protectedCount++;
-        if (now - entry.lastHeartbeat > STALE_THRESHOLD_MS) staleCount++;
-      }
-      return {
-        instances,
-        totalProcesses: data.instances.size,
-        protectedCount,
-        staleCount
-      };
-    } finally {
-      await release();
-    }
-  }
-  /**
-   * Get the instance ID for this process.
-   */
-  getInstanceId() {
-    return this.instanceId;
-  }
-  /**
-   * Check if a kill command should be blocked.
-   * Returns true if the kill should be blocked (target is a WrongStack process).
-   */
-  async shouldBlockKill(pid) {
-    const protectedPids = await this.getAllProtectedPids();
-    return protectedPids.includes(pid);
-  }
-  /**
-   * Add a pattern-based protection rule.
-   * Processes whose command matches any protected pattern are protected.
-   */
-  async addProtectedPattern(pattern) {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      if (!data.protectedPatterns.includes(pattern)) {
-        data.protectedPatterns.push(pattern);
-        await writeRegistryFile(this.registryPath, data);
-      }
-    } finally {
-      await release();
-    }
-  }
-};
-var _persistentRegistry;
-function getPersistentProcessRegistry() {
-  if (!_persistentRegistry) {
-    _persistentRegistry = new PersistentProcessRegistry();
-  }
-  return _persistentRegistry;
-}
-
-// src/bash-kill-guard.ts
-var isWin = os3.platform() === "win32";
-var SCRIPT_KILL_RE = /^(?:\.\\|\.\/)?(?:kill|terminate|stop)\S*\.(?:ps1|bat|cmd|sh)(?:\s|$)/i;
-var SCRIPT_KILL_RE_POSIX = /^(?:\.\/)?(?:kill|terminate|stop)\S*\.sh(?:\s|$)/i;
-var SCRIPT_KILL_FALLBACK_RE = /^\S*(?:kill|terminate|stop)\S*\.(?:ps1|bat|cmd|sh)\b/i;
-function extractKillCommand(command) {
-  const normalized = command.replace(/\s+/g, " ").trim();
-  const shellCMatch = normalized.match(/^.+?\s+-c\s+(['"])([\s\S]+)\1$/);
-  if (shellCMatch?.[2]) {
-    const inner = shellCMatch[2].trim();
-    return isKillRelatedCommand(inner) ? inner : null;
-  }
-  const shellCUnquoted = normalized.match(
-    /^.+?\s+-c\s+(kill(?:\s+-s\s+[a-zA-Z0-9]+|\s+-[a-zA-Z0-9]+)?\s+\d+)$/
-  );
-  if (shellCUnquoted?.[1]) {
-    return shellCUnquoted[1];
-  }
-  return null;
-}
-function isKillRelatedCommand(cmd) {
-  const normalized = cmd.toLowerCase().replace(/\s+/g, " ").trim();
-  if (isWin) {
-    if (/^taskkill\s/i.test(normalized)) return true;
-    if (/^tskill\s/i.test(normalized)) return true;
-    if (/^(stop-process|kill|stop)\s/i.test(normalized)) return true;
-    if (/^wmic\s+process\s/i.test(normalized) && /\bdelete\b/i.test(normalized)) return true;
-    if (SCRIPT_KILL_RE.test(normalized)) return true;
-    return false;
-  }
-  if (/^kill(\s|$)/.test(normalized)) return true;
-  if (/^(pkill|killall|pgrep|skill)\s/.test(normalized)) return true;
-  if (/^\/proc\/\d+\/(?:kill|fd)/.test(normalized)) return true;
-  if (SCRIPT_KILL_RE_POSIX.test(normalized)) return true;
-  return false;
-}
-function parseKillCommand(command) {
-  const normalized = command.replace(/\s+/g, " ").trim();
-  if (isWin) {
-    const hasTaskkillForce = /(?:^|\s)\/F(?=\s|$)/i.test(normalized);
-    const isSimpleTaskkill = /^taskkill\s+/i.test(normalized) && !/[|&<>]/.test(normalized);
-    const taskkillPidMatch = isSimpleTaskkill ? normalized.match(/(?:^|\s)\/PID\s+(\d+)(?=\s|$)/i) : null;
-    if (taskkillPidMatch?.[1]) {
-      return {
-        pid: parseInt(taskkillPidMatch[1], 10),
-        signal: hasTaskkillForce ? "FORCE" : "TERM",
-        isGroupKill: false,
-        isAllKill: false,
-        originalCommand: command
-      };
-    }
-    const taskkillImMatch = isSimpleTaskkill ? normalized.match(/(?:^|\s)\/IM\s+([^\s/]+)(?=\s|$)/i) : null;
-    if (taskkillImMatch?.[1]) {
-      return {
-        name: taskkillImMatch[1],
-        signal: hasTaskkillForce ? "FORCE" : "TERM",
-        isGroupKill: false,
-        isAllKill: false,
-        originalCommand: command
-      };
-    }
-    const taskkillFiMatch = isSimpleTaskkill ? normalized.match(/(?:^|\s)\/FI\s+"IMAGENAME\s+eq\s+([^"]+)"(?=\s|$)/i) : null;
-    if (taskkillFiMatch?.[1]) {
-      return {
-        name: taskkillFiMatch[1],
-        signal: hasTaskkillForce ? "FORCE" : "TERM",
-        isGroupKill: false,
-        isAllKill: false,
-        originalCommand: command
-      };
-    }
-    const tskillMatch = normalized.match(/^tskill\s+(\d+)/i);
-    if (tskillMatch?.[1]) {
-      return {
-        pid: parseInt(tskillMatch[1], 10),
-        signal: "TERM",
-        isGroupKill: false,
-        isAllKill: false,
-        originalCommand: command
-      };
-    }
-    const isStopProcIdCommand = /^(?:stop-process|kill)(?:\s+-(?:id|pid)\s+\d+|\s+-[a-zA-Z]+)+$/i.test(normalized);
-    const stopProcIdMatch = normalized.match(/(?:^|\s)-(?:id|pid)\s+(\d+)(?=\s|$)/i);
-    if (isStopProcIdCommand && stopProcIdMatch?.[1]) {
-      return {
-        pid: parseInt(stopProcIdMatch[1], 10),
-        signal: "FORCE",
-        isGroupKill: false,
-        isAllKill: false,
-        originalCommand: command
-      };
-    }
-    const killSignalOptionMatch = normalized.match(/^kill\s+-s\s+([a-zA-Z0-9]+)\s+(\d+)$/i);
-    if (killSignalOptionMatch?.[1] && killSignalOptionMatch[2]) {
-      return {
-        pid: parseInt(killSignalOptionMatch[2], 10),
-        signal: killSignalOptionMatch[1].toUpperCase(),
-        isGroupKill: false,
-        isAllKill: false,
-        originalCommand: command
-      };
-    }
-    const killPosixMatch = normalized.match(/^kill\s+(?:(-[a-zA-Z0-9]+)\s+)?(\d+)$/);
-    if (killPosixMatch?.[2]) {
-      const sig = killPosixMatch[1] ? killPosixMatch[1].slice(1).toUpperCase() : "TERM";
-      return {
-        pid: parseInt(killPosixMatch[2], 10),
-        signal: sig,
-        isGroupKill: false,
-        isAllKill: false,
-        originalCommand: command
-      };
-    }
-    const stopProcNameMatch = normalized.match(
-      /^(?:stop-process|kill)\s+-(?:name|n)\s+(?:['"]([a-zA-Z0-9_.-]+)['"]|([a-zA-Z0-9_.-]+))(?:\s|$)/i
-    );
-    const stopProcName = stopProcNameMatch?.[1] ?? stopProcNameMatch?.[2];
-    if (stopProcName) {
-      return {
-        name: stopProcName,
-        signal: "FORCE",
-        isGroupKill: false,
-        isAllKill: false,
-        originalCommand: command
-      };
-    }
-    const stopProcStandalone = normalized.match(
-      /^(?:stop-process|kill)\s+['"]?([a-zA-Z][a-zA-Z0-9_.-]+)['"]?$/i
-    );
-    if (stopProcStandalone?.[1]) {
-      return {
-        name: stopProcStandalone[1],
-        signal: "FORCE",
-        isGroupKill: false,
-        isAllKill: false,
-        originalCommand: command
-      };
-    }
-    const wmicMatch = normalized.match(
-      /^wmic\s+process\s+where\s+['"]?(?:name\s*=\s*['"]?)([a-zA-Z0-9_.-]+)/i
-    );
-    if (wmicMatch?.[1]) {
-      return {
-        name: wmicMatch[1],
-        signal: "FORCE",
-        isGroupKill: false,
-        isAllKill: false,
-        originalCommand: command
-      };
-    }
-    const wmicPidMatch = normalized.match(
-      /^wmic\s+process\s+where\s+['"]?processid\s*=\s*['"]?(\d+)/i
-    );
-    if (wmicPidMatch?.[1]) {
-      return {
-        pid: parseInt(wmicPidMatch[1], 10),
-        signal: "FORCE",
-        isGroupKill: false,
-        isAllKill: false,
-        originalCommand: command
-      };
-    }
-    const killScriptMatch = normalized.match(SCRIPT_KILL_RE);
-    if (killScriptMatch) {
-      return {
-        name: "kill-script",
-        // sentinel — isKillProtected always blocks "kill-script"
-        signal: "FORCE",
-        isGroupKill: false,
-        isAllKill: false,
-        originalCommand: command
-      };
-    }
-    return null;
-  }
-  const signalOptionMatch = normalized.match(/^kill\s+-s\s+([a-zA-Z0-9]+)\s+(\d+|-?\d+)$/i);
-  if (signalOptionMatch?.[1] && signalOptionMatch[2]) {
-    const pidOrGroup = signalOptionMatch[2];
-    const isGroupKill = pidOrGroup.startsWith("-");
-    return {
-      pid: parseInt(isGroupKill ? pidOrGroup.slice(1) : pidOrGroup, 10),
-      signal: signalOptionMatch[1].toUpperCase(),
-      isGroupKill,
-      isAllKill: false,
-      originalCommand: command
-    };
-  }
-  const simpleMatch = normalized.match(/^kill\s+(?:(-[a-zA-Z0-9]+)\s+)?(\d+|-?\d+)$/);
-  if (simpleMatch) {
-    const signal = simpleMatch[1] ?? "-TERM";
-    const pidOrGroup = simpleMatch[2];
-    if (!pidOrGroup) return null;
-    const isGroupKill = pidOrGroup.startsWith("-");
-    const pid = isGroupKill ? parseInt(pidOrGroup.slice(1), 10) : parseInt(pidOrGroup, 10);
-    return {
-      pid,
-      signal: signal.slice(1),
-      isGroupKill,
-      isAllKill: false,
-      originalCommand: command
-    };
-  }
-  const pkillMatch = normalized.match(/^pkill\s+(?:(-[a-zA-Z]+)\s+)?(.+)$/);
-  if (pkillMatch?.[2]) {
-    const name = pkillMatch[2];
-    const signalMatch = pkillMatch[1];
-    return {
-      name,
-      signal: signalMatch ? signalMatch.slice(1) : "TERM",
-      isGroupKill: false,
-      isAllKill: false,
-      originalCommand: command
-    };
-  }
-  const killallMatch = normalized.match(/^killall\s+(?:(-[a-zA-Z]+)\s+)?(.+)$/);
-  if (killallMatch?.[2]) {
-    const name = killallMatch[2];
-    const signalMatch = killallMatch[1];
-    return {
-      name,
-      signal: signalMatch ? signalMatch.slice(1) : "TERM",
-      isGroupKill: false,
-      isAllKill: false,
-      originalCommand: command
-    };
-  }
-  const pgrepMatch = normalized.match(/^pgrep\s+(.+)$/);
-  if (pgrepMatch) {
-    return null;
-  }
-  const posixScriptMatch = normalized.match(SCRIPT_KILL_RE_POSIX);
-  if (posixScriptMatch) {
-    return {
-      name: "kill-script",
-      signal: "FORCE",
-      isGroupKill: false,
-      isAllKill: false,
-      originalCommand: command
-    };
-  }
-  return null;
-}
-async function getProtectedEntries() {
-  const registry = getPersistentProcessRegistry();
-  const status = await registry.getGlobalStatus();
-  const entries = [];
-  for (const instanceEntries of status.instances.values()) {
-    for (const entry of instanceEntries) {
-      if (entry.protected && Date.now() - entry.lastHeartbeat < 3e4) {
-        entries.push(entry);
-      }
-    }
-  }
-  return entries;
-}
-async function isKillProtected(kill) {
-  const registry = getPersistentProcessRegistry();
-  if (kill.name === "kill-script") {
-    return true;
-  }
-  if (kill.name) {
-    const entries = await getProtectedEntries();
-    const killNameLower = kill.name.toLowerCase();
-    for (const entry of entries) {
-      if (entry.name?.toLowerCase().includes(killNameLower)) {
-        return true;
-      }
-    }
-    if (killNameLower.includes("wrongstack")) {
-      return true;
-    }
-    if (killNameLower.includes("node") && entries.length > 0) {
-      return true;
-    }
-    return false;
-  }
-  if (kill.isGroupKill) {
-    const protectedPids = await registry.getAllProtectedPids();
-    return protectedPids.length > 0;
-  }
-  if (kill.pid !== void 0) {
-    if (await registry.shouldBlockKill(kill.pid)) return true;
-    if (kill.pid === process.pid || kill.pid === process.ppid) return true;
-    return false;
-  }
-  return false;
-}
-async function checkAndBlockKillCommand(command) {
-  const normalized = command.replace(/\s+/g, " ").trim();
-  const killCmd = extractKillCommand(normalized) || (isKillRelatedCommand(normalized) ? normalized : null);
-  if (!killCmd) {
-    return { blocked: false };
-  }
-  const parsed = parseKillCommand(killCmd);
-  if (!parsed) {
-    if (killCmd.includes("kill") && /kill\s+.*\|/.test(killCmd)) {
-      return {
-        blocked: true,
-        reason: `Blocked: complex kill pipeline detected \u2014 "${killCmd.slice(0, 50)}..."`
-      };
-    }
-    if (SCRIPT_KILL_FALLBACK_RE.test(killCmd)) {
-      return {
-        blocked: true,
-        reason: `Blocked: script-based kill detected \u2014 "${killCmd.slice(0, 80)}" may target protected WrongStack processes (cannot inspect script body).`
-      };
-    }
-    return { blocked: false };
-  }
-  if (await isKillProtected(parsed)) {
-    let target;
-    if (parsed.name) {
-      target = `process name "${parsed.name}"`;
-    } else if (parsed.pid !== void 0) {
-      target = `PID ${parsed.pid}`;
-    } else {
-      target = "(unknown target)";
-    }
-    const signal = parsed.signal ? ` (${parsed.signal})` : "";
-    const groupNote = parsed.isGroupKill ? " (process group)" : "";
-    return {
-      blocked: true,
-      reason: `Blocked: kill${signal} ${target}${groupNote} targets a protected WrongStack process.`
-    };
-  }
-  return { blocked: false };
-}
-
-// src/bash.ts
-var MAX_OUTPUT = 32768;
-var DEFAULT_TIMEOUT_MS = 3e5;
-var STREAM_FLUSH_INTERVAL_MS = 200;
-var STREAM_FLUSH_BYTES = 4 * 1024;
-var MAX_QUEUE_CHUNKS = 500;
-var bashTool = {
-  name: "bash",
-  category: "Shell",
-  description: "Execute an arbitrary command in the user's default shell (bash/zsh/pwsh/cmd). stdout and stderr are merged into one stream. This is the most powerful and dangerous tool \u2014 it gives the model full access to the developer's machine. Prefer specialized tools whenever possible.",
-  usageHint: "SECURITY WARNING: This tool runs with the full privileges of the current user.\n\nBest practices for the model:\n- Strongly prefer `exec` for known safe commands (node, npm, pnpm, tsc, git, etc.).\n- Use bash only when you genuinely need shell features (pipes, redirection, complex one-liners).\n- Prefer single focused commands over huge `&&` chains.\n- Use `background: true` only for long-running processes (dev servers, watchers).\n- The working directory is the session working dir (changed via `set_working_dir`), defaulting to the project root.\n- Output may be truncated in the middle for very large results.",
-  selection: {
-    doNotUseWhen: "the command is allowlisted and does not require pipes, redirection, or shell expansion.",
-    useInstead: ["exec"]
-  },
-  permission: "confirm",
-  mutating: true,
-  riskTier: "destructive",
-  icon: "terminal",
-  // Trust rules match on the literal `command` string. Without subjectKey
-  // the policy heuristic would have done the same here, but declaring it
-  // explicitly removes the implicit cross-tool aliasing.
-  subjectKey: "command",
-  capabilities: ["shell.arbitrary"],
-  // Executor-level abort ceiling. Must sit ABOVE the per-call `timeout_ms`
-  // ceiling (600_000): the tool's own timer tree-kills and returns a
-  // structured `timed_out: true` result, while the executor's
-  // AbortSignal.timeout is a blunt abort. The old value (300_000) meant any
-  // timeout_ms > 5min was silently cut short by the executor. The 10s margin
-  // covers the kill/teardown window. (The executor additionally clamps to
-  // config `tools.maxToolTimeoutMs`.)
-  timeoutMs: 61e4,
-  maxOutputBytes: MAX_OUTPUT,
-  estimatedDurationMs: 3e4,
-  inputSchema: {
-    type: "object",
-    properties: {
-      command: {
-        type: "string",
-        description: "The exact shell command to run. Prefer simple, focused commands."
-      },
-      timeout_ms: {
-        type: "integer",
-        description: "Optional timeout for this specific command in milliseconds (default 300000, max 600000)."
-      },
-      background: {
-        type: "boolean",
-        description: "If true, launch the process in the background and return the PID immediately."
-      }
-    },
-    required: ["command"]
-  },
-  async execute(input, ctx, opts) {
-    let final;
-    const executeStream = bashTool.executeStream;
-    if (!executeStream) throw new Error("bashTool: stream execution unavailable");
-    for await (const ev of executeStream(input, ctx, opts)) {
-      if (ev.type === "final") final = ev.output;
-    }
-    if (!final) throw new Error("bash: stream ended without final event");
-    return final;
-  },
-  async *executeStream(input, ctx, opts) {
-    if (!input?.command) throw new Error("bash: command is required");
-    const registry = getProcessRegistry();
-    const bypassBreaker = !!input.background;
-    if (!registry.beforeCall(bypassBreaker)) {
-      yield {
-        type: "final",
-        output: {
-          output: "",
-          exit_code: 1,
-          timed_out: false,
-          pid: null,
-          error: "bash: circuit breaker open \u2014 too many consecutive failures or slow calls. Use /kill to inspect or /kill reset to recover."
-        }
-      };
-      return;
-    }
-    const killCheck = await checkAndBlockKillCommand(input.command);
-    if (killCheck.blocked) {
-      yield {
-        type: "final",
-        output: {
-          output: "",
-          exit_code: 1,
-          timed_out: false,
-          pid: null,
-          error: killCheck.reason || "Kill command blocked: targets a protected WrongStack process."
-        }
-      };
-      return;
-    }
-    const PIPE_TO_SHELL_PATTERN = /\|\s*(sh|bash|ksh|zsh|fish|cmd|powershell|pwsh)/i;
-    const pipeToShellNote = PIPE_TO_SHELL_PATTERN.test(input.command) ? "\n\n[wrongstack] Caution: this command pipes output into a shell interpreter (pipe-to-shell). Piped content executes as arbitrary code \u2014 review the source before trusting the result, and prefer downloading to a file and inspecting it first." : "";
-    const timeoutMs = Math.max(1, Math.min(input.timeout_ms ?? DEFAULT_TIMEOUT_MS, 6e5));
-    const isWin2 = os4.platform() === "win32";
-    let plan;
-    let winShellKind;
-    if (isWin2) {
-      const shell2 = pickShell("win32", input.command, {
-        get: (k) => process.env[k]
-      });
-      winShellKind = shell2;
-      const bin = shell2 === "powershell" ? resolvePowerShell("powershell.exe") : shell2 === "pwsh" ? resolvePowerShell("pwsh.exe") : process.env["COMSPEC"] ?? "cmd.exe";
-      plan = {
-        bin,
-        argv: shellArgs(shell2),
-        commandArg: shell2 === "powershell" || shell2 === "pwsh" ? Buffer.from(wrapPowerShellScript(input.command), "utf16le").toString("base64") : input.command
-      };
-    } else {
-      const explicit = process.env["WRONGSTACK_SHELL"];
-      let bin;
-      if (explicit) bin = explicit;
-      else {
-        const fromEnv = process.env["SHELL"];
-        if (fromEnv) {
-          const name = fromEnv.split("/").pop() ?? "";
-          if (["bash", "zsh", "sh", "dash", "fish"].includes(name)) bin = fromEnv;
-          else bin = "/bin/bash";
-        } else bin = "/bin/bash";
-      }
-      plan = { bin, argv: ["-c"], commandArg: input.command };
-    }
-    const shell = plan.bin;
-    const args = [...plan.argv, plan.commandArg];
-    const env = buildChildEnv(ctx.session?.id);
-    const spawnCwd = ctx.workingDir ?? ctx.projectRoot;
-    const detached = !isWin2;
-    const startedAt = Date.now();
-    if (input.background) {
-      const child2 = spawn2(shell, args, {
-        cwd: spawnCwd,
-        env,
-        stdio: ["ignore", "ignore", "ignore"],
-        detached: !isWin2,
-        windowsHide: true
-      });
-      const pid2 = child2.pid;
-      const stdoutBytes2 = 0;
-      const stderrBytes2 = 0;
-      let telemetryCompleted2 = false;
-      emitProcessStarted({
-        ...pid2 !== void 0 ? { pid: pid2 } : {},
-        parentPid: process.pid,
-        command: redactCommand(`${shell} ${args.join(" ")}`),
-        args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
-        cwd: spawnCwd,
-        background: true,
-        startedAt: new Date(startedAt).toISOString()
-      });
-      const completeBackground = (exitCode, signal) => {
-        if (telemetryCompleted2) return;
-        telemetryCompleted2 = true;
-        emitProcessCompleted({
-          ...pid2 !== void 0 ? { pid: pid2 } : {},
-          exitCode,
-          ...signal ? { signal } : {},
-          durationMs: Date.now() - startedAt,
-          stdoutBytes: stdoutBytes2,
-          stderrBytes: stderrBytes2,
-          timedOut: false,
-          endedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
-      };
-      if (typeof pid2 === "number") {
-        registry.register({
-          pid: pid2,
-          name: "bash",
-          command: redactCommand(input.command),
-          startedAt: Date.now(),
-          sessionId: ctx.session?.id,
-          child: child2,
-          processGroupLeader: detached && child2.pid === pid2,
-          background: true
-        });
-        child2.on("close", () => registry.unregister(pid2));
-      }
-      child2.on("error", () => {
-        if (typeof pid2 === "number") registry.unregister(pid2);
-        registry.afterCall(Date.now() - startedAt, true, bypassBreaker);
-        completeBackground(1);
-      });
-      child2.on("close", (code, signal) => {
-        registry.afterCall(Date.now() - startedAt, false, bypassBreaker);
-        completeBackground(code ?? (signal ? 1 : 0), signal ?? void 0);
-      });
-      if (typeof pid2 === "number") child2.unref();
-      yield {
-        type: "final",
-        output: {
-          // Background runs have no captured output; the pipe-to-shell caution
-          // (when present) is the only thing worth surfacing.
-          output: pipeToShellNote.trim(),
-          exit_code: null,
-          timed_out: false,
-          pid: pid2
-        }
-      };
-      ctx.recordSideEffect?.({
-        toolUseId: `bash-bg-${Date.now()}`,
-        toolName: "bash",
-        ts: (/* @__PURE__ */ new Date()).toISOString(),
-        input: { command: redactCommand(input.command), background: true },
-        outcome: `launched (pid ${pid2 ?? "unknown"})`,
-        risk: "shell"
-      });
-      return;
-    }
-    const child = spawn2(shell, args, {
-      cwd: spawnCwd,
-      env,
-      stdio: ["ignore", "pipe", "pipe"],
-      detached,
-      windowsHide: true,
-      ...isWin2 ? {} : { signal: opts.signal }
-    });
-    const pid = child.pid;
-    let stdoutBytes = 0;
-    let stderrBytes = 0;
-    let telemetryCompleted = false;
-    emitProcessStarted({
-      ...pid !== void 0 ? { pid } : {},
-      parentPid: process.pid,
-      command: redactCommand(`${shell} ${args.join(" ")}`),
-      args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
-      cwd: spawnCwd,
-      background: false,
-      startedAt: new Date(startedAt).toISOString()
-    });
-    const completeForeground = (exitCode, signal) => {
-      if (telemetryCompleted) return;
-      telemetryCompleted = true;
-      emitProcessCompleted({
-        ...pid !== void 0 ? { pid } : {},
-        exitCode,
-        ...signal ? { signal } : {},
-        durationMs: Date.now() - startedAt,
-        stdoutBytes,
-        stderrBytes,
-        timedOut,
-        endedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-    };
-    if (typeof pid === "number") {
-      registry.register({
-        pid,
-        name: "bash",
-        command: redactCommand(input.command),
-        startedAt: Date.now(),
-        sessionId: ctx.session?.id,
-        child,
-        processGroupLeader: detached && child.pid === pid
-      });
-    }
-    let buf = "";
-    let pending = "";
-    let timedOut = false;
-    const timers = [];
-    const spool = createOutputSpool({ tool: "bash", thresholdBytes: MAX_OUTPUT });
-    function killWithTimeout(child2, timeoutMs2) {
-      if (isWin2) {
-        if (typeof child2.pid === "number" && child2.exitCode === null) {
-          const attempted = registry.kill(child2.pid, { force: true, graceMs: timeoutMs2 });
-          if (!attempted) {
-            try {
-              child2.kill();
-            } catch {
-            }
-          }
-        } else {
-          try {
-            child2.kill();
-          } catch {
-          }
-        }
-        return;
-      }
-      if (typeof child2.pid === "number") {
-        registry.kill(child2.pid, { graceMs: timeoutMs2 });
-      } else {
-        try {
-          child2.kill("SIGTERM");
-        } catch {
-        }
-        const killTimer = setTimeout(() => {
-          try {
-            child2.kill("SIGKILL");
-          } catch {
-          }
-        }, timeoutMs2);
-        timers.push(killTimer);
-        killTimer.unref?.();
-      }
-    }
-    const timer = setTimeout(() => {
-      timedOut = true;
-      killWithTimeout(child, 2e3);
-    }, timeoutMs);
-    timers.push(timer);
-    timer.unref?.();
-    const onAbort = () => killWithTimeout(child, 2e3);
-    if (isWin2) {
-      if (opts.signal.aborted) onAbort();
-      else opts.signal.addEventListener("abort", onAbort, { once: true });
-    }
-    const queue = [];
-    let resolveNext = null;
-    const push = (c) => {
-      if (resolveNext) {
-        const r = resolveNext;
-        resolveNext = null;
-        r(c);
-      } else {
-        queue.push(c);
-      }
-    };
-    const next = () => new Promise((resolve) => {
-      const c = queue.shift();
-      if (c) resolve(c);
-      else resolveNext = resolve;
-    });
-    let lastFlush = Date.now();
-    const flush = () => {
-      if (pending.length === 0) return null;
-      const text = pending;
-      pending = "";
-      lastFlush = Date.now();
-      return text;
-    };
-    let paused = false;
-    const pauseIfFlooded = () => {
-      if (!paused && queue.length >= MAX_QUEUE_CHUNKS) {
-        paused = true;
-        child.stdout?.pause();
-        child.stderr?.pause();
-      }
-    };
-    const resumeIfDrained = () => {
-      if (paused && queue.length < MAX_QUEUE_CHUNKS) {
-        paused = false;
-        child.stdout?.resume();
-        child.stderr?.resume();
-      }
-    };
-    const stdoutDecoder = new StringDecoder("utf8");
-    const stderrDecoder = new StringDecoder("utf8");
-    const onData = (chunk, stream) => {
-      const text = (stream === "stdout" ? stdoutDecoder : stderrDecoder).write(chunk);
-      if (stream === "stdout") stdoutBytes += chunk.byteLength;
-      else stderrBytes += chunk.byteLength;
-      emitProcessOutput({ pid, stream, chunk });
-      if (buf.length < MAX_OUTPUT) {
-        buf += text.slice(0, MAX_OUTPUT - buf.length);
-      }
-      spool.write(text);
-      pending += text;
-      push({ kind: "data", text });
-      pauseIfFlooded();
-    };
-    const onStdoutData = (chunk) => onData(chunk, "stdout");
-    const onStderrData = (chunk) => onData(chunk, "stderr");
-    child.stdout?.on("data", onStdoutData);
-    child.stderr?.on("data", onStderrData);
-    child.on("error", (err) => {
-      for (const t of timers) clearTimeout(t);
-      registry.afterCall(Date.now() - startedAt, true);
-      completeForeground(1);
-      push({ kind: "error", err });
-    });
-    child.on("close", (code, signal) => {
-      for (const t of timers) clearTimeout(t);
-      if (typeof pid === "number") registry.unregister(pid);
-      registry.afterCall(Date.now() - startedAt, code !== 0 && code !== null);
-      completeForeground(timedOut ? 124 : code ?? (signal ? 1 : 0), signal ?? void 0);
-      const tail = stdoutDecoder.end() + stderrDecoder.end();
-      if (tail) {
-        if (buf.length < MAX_OUTPUT) buf += tail.slice(0, MAX_OUTPUT - buf.length);
-        spool.write(tail);
-        pending += tail;
-      }
-      push({ kind: "end", code });
-    });
-    try {
-      while (true) {
-        const c = await next();
-        resumeIfDrained();
-        if (c.kind === "error") throw c.err;
-        if (c.kind === "end") {
-          const remainder = flush();
-          if (remainder !== null) {
-            yield { type: "partial_output", text: remainder };
-          }
-          const spooled = spool.finalize();
-          const hint = !timedOut && typeof c.code === "number" && c.code !== 0 && winShellKind ? diagnoseBashism(input.command, winShellKind) : void 0;
-          yield {
-            type: "final",
-            output: {
-              output: normalizeCommandOutput(buf) + (spooled ? spoolNote(spooled) : "") + (hint ? `
-
-${hint}` : "") + pipeToShellNote,
-              exit_code: c.code,
-              timed_out: timedOut
-            }
-          };
-          ctx.recordSideEffect?.({
-            toolUseId: `bash-${Date.now()}`,
-            toolName: "bash",
-            ts: (/* @__PURE__ */ new Date()).toISOString(),
-            input: { command: redactCommand(input.command) },
-            outcome: timedOut ? `timed out (exit ${c.code})` : `exit ${c.code}`,
-            risk: "shell"
-          });
-          return;
-        }
-        const now = Date.now();
-        if (pending.length >= STREAM_FLUSH_BYTES || now - lastFlush >= STREAM_FLUSH_INTERVAL_MS) {
-          const text = flush();
-          if (text) yield { type: "partial_output", text };
-        }
-      }
-    } finally {
-      for (const t of timers) clearTimeout(t);
-      spool.finalize();
-      if (isWin2) opts.signal.removeEventListener("abort", onAbort);
-      child.stdout?.off("data", onStdoutData);
-      child.stderr?.off("data", onStderrData);
-      child.stdout?.destroy();
-      child.stderr?.destroy();
-      if (child.exitCode === null && !child.killed) {
-        if (typeof pid === "number") registry.kill(pid, { force: true });
-        else killWithTimeout(child, 2e3);
-      }
-    }
-  },
-  /**
-   * Tool-level teardown fired by `ToolExecutor.runToolCleanup()` when the
-   * tool's run is aborted/timeout'd. The generator's `finally` block above
-   * already force-kills the direct child, but that only runs if the
-   * executor closes the async iterator (via `iter.return()`). When the
-   * executor tears down without iterating — or a re-entrant abort races
-   * with the generator — a bash-spawned process tree can survive in the
-   * ProcessRegistry with `killed === false`, continuing to write files,
-   * consume CPU, or hold inherited stdio pipes open for the rest of the
-   * session.
-   *
-   * This is the defensive layer the executor calls via `tool.cleanup()`
-   * (see `types/tool.ts`): kill every bash-owned process still tracked
-   * for this session that hasn't exited yet. `registry.kill()` already
-   * handles process-group / taskkill tree-kill and the SIGTERM→SIGKILL
-   * grace window, so this just scopes the registry's existing kill path
-   * to "this session's runaway bash children". Idempotent — a process
-   * that already exited is skipped by `kill()` (it returns false), and a
-   * `protected` infrastructure process (dev server the user intentionally
-   * backgrounded) is left alone by design.
-   */
-  async cleanup(_input, ctx) {
-    const registry = getProcessRegistry();
-    const sessionId = ctx.session?.id;
-    if (!sessionId) return;
-    for (const entry of registry.bySession(sessionId)) {
-      if (entry.name !== "bash") continue;
-      if (entry.child && entry.child.exitCode !== null) continue;
-      if (entry.background) continue;
-      if (entry.protected) continue;
-      registry.kill(entry.pid, { force: true });
-    }
-  }
-};
+  bashTool
+} from "./chunk-IVWV2UM6.js";
+import "./chunk-BTSFTGIL.js";
+import "./chunk-NKNOBUBU.js";
+import "./chunk-2VSZC6QM.js";
+import "./chunk-3PVYQFRQ.js";
+import "./chunk-HFXSNKCV.js";
+import "./chunk-V43EQ6VR.js";
+import "./chunk-D33S4RQG.js";
 export {
   bashTool
 };