@wrongstack/tools 0.313.0 → 0.316.1

package/dist/exec.js

@@ -1,3135 +1,20 @@
-// src/exec.ts
-import { spawn as spawn2 } from "node:child_process";
 import {
-  emitProcessCompleted,
-  emitProcessOutput,
-  emitProcessStarted
-} from "@wrongstack/core/observability";
-import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils/error";
-
-// src/_danger-detect.ts
-var argHas = (args, value) => args.includes(value);
-var argMatches = (args, re) => args.some((a) => re.test(a));
-var hasShortFlags = (args, letters) => {
-  const seen = /* @__PURE__ */ new Set();
-  for (const a of args) {
-    if (!/^-[a-zA-Z]+$/.test(a)) continue;
-    for (const ch of a.slice(1)) seen.add(ch);
-  }
-  return letters.split("").every((l) => seen.has(l));
-};
-var RULES = [
-  // ----- rm / rmdir: recursive force delete (any path) -----
-  // Note: BLOCKED_ARG_PATTERNS already hard-denies root/home/glob paths,
-  // but `rm -rf ./build` is a normal dev workflow that the user might
-  // want to do intentionally. We downgrade it to 'destructive' so the
-  // confirm prompt can approve.
-  {
-    id: "rm-recursive",
-    level: "destructive",
-    test: (cmd, args) => (cmd === "rm" || cmd === "rmdir") && hasShortFlags(args, "rf"),
-    reason: "recursive force-delete"
-  },
-  // ----- Windows PowerShell Remove-Item: -Recurse -Force -----
-  {
-    id: "powershell-remove-item-recursive-force",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (cmd !== "powershell" && cmd !== "pwsh") return false;
-      const hasRecurse = argMatches(args, /^-(?:R|Recurse|Recurse\s)/);
-      const hasForce = argHas(args, "-Force") || argHas(args, "-F");
-      if (argHas(args, "-WhatIf")) return false;
-      return hasRecurse && hasForce;
-    },
-    reason: "Remove-Item with -Recurse -Force"
-  },
-  // ----- Windows PowerShell Disk & Volume destruction -----
-  {
-    id: "powershell-disk-volume-destroy",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (cmd !== "powershell" && cmd !== "pwsh") return false;
-      return args.some(
-        (a) => /^(?:Format-Volume|Clear-Disk|Initialize-Disk|Remove-Partition|Clear-Volume)(?:\s|$)/i.test(a)
-      );
-    },
-    reason: "PowerShell disk/volume partition destruction"
-  },
-  // ----- Windows PowerShell System Restart / Shutdown -----
-  {
-    id: "powershell-stop-restart-computer",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (cmd !== "powershell" && cmd !== "pwsh") return false;
-      return args.some((a) => /^(?:Stop-Computer|Restart-Computer)(?:\s|$)/i.test(a));
-    },
-    reason: "PowerShell system shutdown or restart"
-  },
-  // ----- Windows PowerShell ExecutionPolicy / Payload evasion -----
-  {
-    id: "powershell-execution-policy-bypass",
-    level: "caution",
-    test: (cmd, args) => {
-      if (cmd !== "powershell" && cmd !== "pwsh") return false;
-      return args.some(
-        (a) => /Set-ExecutionPolicy\s+(?:Bypass|Unrestricted)|-(?:EncodedCommand|enc)\b/i.test(a)
-      );
-    },
-    reason: "PowerShell execution policy bypass or encoded command"
-  },
-  // ----- find -exec / -ok / -execdir -----
-  {
-    id: "find-exec",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (cmd !== "find") return false;
-      return args.some(
-        (a) => a === "-exec" || a === "-exec;" || a === "-ok" || a === "-ok;" || a === "-execdir" || a === "-execdir;" || a.startsWith("-exec=") || a.startsWith("-ok=") || a.startsWith("-execdir=")
-      );
-    },
-    reason: "find with -exec/-ok (executes arbitrary command on matches)"
-  },
-  // ----- git --exec= / --upload-pack= / --receive-pack= -----
-  // These run arbitrary commands via the git transport layer.
-  {
-    id: "git-exec",
-    level: "destructive",
-    test: (cmd, args) => cmd === "git" && args.some(
-      (a) => a.startsWith("--exec=") || a.startsWith("--upload-pack=") || a.startsWith("--receive-pack=") || a === "--exec" || a === "--upload-pack" || a === "--receive-pack"
-    ),
-    reason: "git with --exec/--upload-pack/--receive-pack (runs arbitrary code)"
-  },
-  // ----- Windows: format / diskpart / bcdedit -----
-  {
-    id: "win32-format",
-    level: "destructive",
-    test: (cmd) => cmd === "format" || cmd === "format.exe",
-    reason: "format (Windows disk format)"
-  },
-  {
-    id: "win32-diskpart",
-    level: "destructive",
-    test: (cmd) => cmd === "diskpart" || cmd === "diskpart.exe",
-    reason: "diskpart (Windows partition editor)"
-  },
-  {
-    id: "win32-bcdedit",
-    level: "destructive",
-    test: (cmd) => cmd === "bcdedit" || cmd === "bcdedit.exe",
-    reason: "bcdedit (Windows boot config editor)"
-  },
-  // ----- mkfs family -----
-  {
-    id: "mkfs",
-    level: "destructive",
-    test: (cmd) => /^mkfs(\.[a-z0-9]+)?$/.test(cmd) || cmd === "mkswap",
-    reason: "mkfs (filesystem creation \u2014 destroys existing data)"
-  },
-  // ----- dd writing to a block device -----
-  {
-    id: "dd-to-block-device",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (cmd !== "dd") return false;
-      return args.some((a) => /of=\/dev\/(sd|hd|nvme|vd|mmcblk|xvd|loop|disk)/.test(a));
-    },
-    reason: "dd writing to a block device"
-  },
-  // ----- Secure-erase tools -----
-  {
-    id: "shred",
-    level: "destructive",
-    test: (cmd) => cmd === "shred" || cmd === "shred.exe",
-    reason: "shred (secure file delete)"
-  },
-  {
-    id: "wipefs",
-    level: "destructive",
-    test: (cmd) => cmd === "wipefs" || cmd === "wipefs.exe",
-    reason: "wipefs (signature wipe \u2014 destroys filesystem headers)"
-  },
-  {
-    id: "sdelete",
-    level: "destructive",
-    test: (cmd) => cmd === "sdelete" || cmd === "sdelete.exe",
-    reason: "sdelete (Sysinternals secure delete)"
-  },
-  // ----- VCS history rewrite (destructive) -----
-  // `git push --force` / `-f` rewrites remote history. `--force-with-lease`
-  // is the safer variant (checks remote hasn't moved) but still rewrites.
-  {
-    id: "git-push-force",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (cmd !== "git") return false;
-      const pushIdx = args.indexOf("push");
-      if (pushIdx < 0) return false;
-      for (let i = pushIdx + 1; i < args.length; i++) {
-        const a = args[i];
-        if (a === "--force" || a === "-f" || a === "--force-with-lease") return true;
-        if (!a.startsWith("-") && !a.includes("=")) continue;
-        if (a.startsWith("--force")) return true;
-      }
-      return false;
-    },
-    reason: "git push with --force / -f (rewrites remote history)"
-  },
-  // ----- git reset --hard (destructive) -----
-  {
-    id: "git-reset-hard",
-    level: "destructive",
-    test: (cmd, args) => cmd === "git" && args.some((a) => a === "--hard" || a.startsWith("--hard=")),
-    reason: "git reset --hard (discards working tree + index)"
-  },
-  // ----- git clean -f / -fd (destructive) -----
-  {
-    id: "git-clean-force",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (cmd !== "git") return false;
-      const cleanIdx = args.indexOf("clean");
-      if (cleanIdx < 0) return false;
-      return args.slice(cleanIdx + 1).some(
-        (a) => a === "-f" || a === "--force" || a.startsWith("-f") || a.startsWith("--force=")
-      );
-    },
-    reason: "git clean -f (deletes untracked files)"
-  },
-  // ----- package publish (destructive — public, irreversible) -----
-  {
-    id: "npm-publish",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (!["npm", "pnpm", "yarn", "bun", "cargo"].includes(cmd)) return false;
-      return args.includes("publish") || cmd === "cargo" && args.includes("yank");
-    },
-    reason: "publishing to a public package registry (hard to reverse)"
-  },
-  // ----- k8s cluster-wide destructive ops (destructive) -----
-  {
-    id: "kubectl-delete-namespace",
-    level: "destructive",
-    test: (cmd, args) => {
-      if (cmd !== "kubectl") return false;
-      const delIdx = args.indexOf("delete");
-      if (delIdx < 0) return false;
-      const after = args.slice(delIdx + 1);
-      return after[0] === "namespace" || after[0] === "ns";
-    },
-    reason: "kubectl delete namespace (deletes all resources in the namespace)"
-  },
-  {
-    id: "kubectl-drain",
-    level: "destructive",
-    test: (cmd, args) => cmd === "kubectl" && args.includes("drain"),
-    reason: "kubectl drain (evicts pods, marks node unschedulable)"
-  },
-  // ----- inline code evaluation (caution — high false-positive) -----
-  // Common in scripts: `python -c "..."`, `node -e "..."`, `bash -c "..."`.
-  // We tag 'caution' rather than 'destructive' because these are used in
-  // many legitimate one-liners (e.g. `python -c "print(1)"`).
-  {
-    id: "inline-eval",
-    level: "caution",
-    test: (cmd, args) => {
-      if (![
-        "python",
-        "python3",
-        "python2",
-        "node",
-        "bash",
-        "sh",
-        "zsh",
-        "ruby",
-        "perl",
-        "lua"
-      ].includes(cmd)) {
-        return false;
-      }
-      return args.some(
-        (a) => a === "-c" || a === "-e" || a === "--eval" || a === "-eval" || a === "-E"
-      );
-    },
-    reason: "inline script evaluation (-c / -e / --eval)"
-  },
-  // ----- pipe-to-shell (destructive — download-and-run pattern) -----
-  // The classic `curl https://... | sh` download-and-run vector. Detected by
-  // looking for a known fetcher piped into a shell or expression evaluator.
-  // A shell command passed through `bash -c` / `pwsh -Command` arrives as one
-  // argv string, so scan the reconstructed argv text rather than individual
-  // tokens only.
-  {
-    id: "pipe-to-shell",
-    level: "destructive",
-    test: (cmd, args) => /\b(?:curl|wget|fetch|httpie|http|irm|iwr|Invoke-WebRequest|Invoke-RestMethod)\b[\s\S]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash|zsh|fish|pwsh|powershell|iex|Invoke-Expression)\b/i.test(
-      [cmd, ...args].join(" ")
-    ),
-    reason: "network fetch piped to a shell (download-and-run pattern)"
-  },
-  // ----- privilege escalation (caution) -----
-  {
-    id: "sudo",
-    level: "caution",
-    test: (cmd) => cmd === "sudo" || cmd === "doas",
-    reason: "privilege escalation (sudo / doas)"
-  },
-  {
-    id: "runas",
-    level: "caution",
-    test: (cmd) => cmd === "runas" || cmd === "runas.exe",
-    reason: "Windows runas (run as different user)"
-  },
-  // ----- world-writable permissions (caution) -----
-  // `chmod 777` is rarely correct. `chmod -R 777` is almost always wrong.
-  // We only flag octal modes; symbolic modes like `chmod o+w` are
-  // left to the operator's discretion.
-  {
-    id: "chmod-world-writable",
-    level: "caution",
-    test: (cmd, args) => {
-      if (cmd !== "chmod") return false;
-      return args.some((a) => /^[0-7]{3,4}$/.test(a) && /7/.test(a));
-    },
-    reason: "chmod with world-writable octal mode (e.g. 777)"
-  },
-  // ----- network recon / offensive scanners (caution) -----
-  // These tools are purpose-built for network reconnaissance and offensive
-  // security. They have legitimate uses in dev (security testing, infra
-  // debugging) but their presence in an agent's command stream is worth a
-  // caution banner so the user can notice an unexpected scan.
-  {
-    id: "network-scanner",
-    level: "caution",
-    test: (cmd) => cmd === "nmap" || cmd === "masscan" || cmd === "zmap" || cmd === "nuclei" || cmd === "hping3" || cmd === "naabu" || cmd === "katana" || cmd === "amass" || cmd === "subfinder" || cmd === "httpx" || cmd === "rustscan" || cmd === "zgrab",
-    reason: "network scanner / offensive reconnaissance tool"
-  },
-  // ----- process termination (caution) -----
-  // kill/killall/pkill terminate processes. The exec kill guard
-  // (exec-kill-guard.ts) hard-blocks attempts on protected WrongStack
-  // processes; this rule adds a caution banner for generic process
-  // termination so the user sees a warning even for non-protected targets.
-  {
-    id: "process-kill",
-    level: "caution",
-    test: (cmd) => cmd === "kill" || cmd === "killall" || cmd === "pkill",
-    reason: "process termination command"
-  },
-  // ----- shell/interpreter launchers (caution) -----
-  // `env bash -c '…'`, `timeout sh`, `nohup perl -e '…'` etc. wrap a child
-  // binary that bypasses the allowlist name-gate entirely (the wrapper
-  // resolves the child from PATH, not from the allowlist). We flag caution
-  // when a known launcher has a shell/interpreter as its target program.
-  {
-    id: "shell-launcher",
-    level: "caution",
-    test: (cmd, args) => {
-      const launchers = [
-        "env",
-        "timeout",
-        "nohup",
-        "nice",
-        "script",
-        "expect",
-        "tmux",
-        "screen",
-        "byobu",
-        "dtach"
-      ];
-      if (!launchers.includes(cmd)) return false;
-      const shells = [
-        "sh",
-        "bash",
-        "zsh",
-        "fish",
-        "python",
-        "python3",
-        "perl",
-        "ruby",
-        "node",
-        "pwsh",
-        "powershell",
-        "cmd"
-      ];
-      if (cmd === "env") {
-        const prog = args.find((a) => !a.includes("=") && !a.startsWith("-"));
-        return prog !== void 0 && shells.includes(prog);
-      }
-      return args.some((a) => shells.includes(a));
-    },
-    reason: "launcher wrapping a shell/interpreter (bypasses allowlist name-gate)"
-  }
-];
-function detectDanger(cmd, args, bypass) {
-  const reasons = [];
-  let level = "safe";
-  let matchedRule;
-  for (const rule of RULES) {
-    if (bypass?.has(rule.id)) continue;
-    if (!rule.test(cmd, args)) continue;
-    reasons.push(rule.reason);
-    if (matchedRule === void 0 || levelRank(rule.level) >= levelRank(level)) {
-      matchedRule = rule.id;
-    }
-    if (levelRank(rule.level) > levelRank(level)) {
-      level = rule.level;
-    }
-  }
-  if (level === "safe") return { level: "safe", reasons: [] };
-  const result = { level, reasons };
-  if (matchedRule !== void 0) result.matchedRule = matchedRule;
-  return result;
-}
-function levelRank(level) {
-  switch (level) {
-    case "safe":
-      return 0;
-    case "caution":
-      return 1;
-    case "destructive":
-      return 2;
-  }
-}
-
-// src/_env.ts
-import { buildChildEnv } from "@wrongstack/core/utils";
-
-// src/_output-spool.ts
-import { createWriteStream, mkdirSync } from "node:fs";
-import * as fsp from "node:fs/promises";
-import * as path from "node:path";
-import { wstackGlobalRoot } from "@wrongstack/core/utils";
-var SPOOL_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
-var SPOOL_WRITE_HWM_BYTES = 4 * 1024 * 1024;
-var sweepStarted = false;
-function toolOutputDir() {
-  return path.join(wstackGlobalRoot(), "tool-output");
-}
-function sweepOldSpoolFiles(dir) {
-  if (sweepStarted) return;
-  sweepStarted = true;
-  void (async () => {
-    try {
-      const now = Date.now();
-      for (const name of await fsp.readdir(dir)) {
-        if (!name.endsWith(".log")) continue;
-        const p = path.join(dir, name);
-        try {
-          const st = await fsp.stat(p);
-          if (now - st.mtimeMs > SPOOL_RETENTION_MS) await fsp.unlink(p);
-        } catch {
-        }
-      }
-    } catch {
-    }
-  })();
-}
-function spoolNote(info) {
-  const dropped = info.droppedBytes > 0 ? `, ~${info.droppedBytes} bytes dropped under backpressure` : "";
-  return `
-[output truncated \u2014 full ${info.bytes} bytes at ${info.path}${dropped}; read/grep that file selectively instead of re-running with more output]`;
-}
-function createOutputSpool(opts) {
-  const threshold = opts.thresholdBytes ?? 32768;
-  const safeTool = opts.tool.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
-  let head = "";
-  let headBytes = 0;
-  let totalBytes = 0;
-  let droppedBytes = 0;
-  let stream = null;
-  let filePath = null;
-  let failed = false;
-  let finalized = false;
-  const open = () => {
-    if (stream || failed) return;
-    try {
-      const dir = toolOutputDir();
-      mkdirSync(dir, { recursive: true });
-      sweepOldSpoolFiles(dir);
-      const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-      const rand = Math.random().toString(36).slice(2, 6);
-      filePath = path.join(dir, `${stamp}-${safeTool}-${rand}.log`);
-      stream = createWriteStream(filePath, { flags: "w", encoding: "utf8" });
-      stream.on("error", () => {
-        failed = true;
-        stream = null;
-        filePath = null;
-      });
-      stream.write(head);
-    } catch {
-      failed = true;
-      stream = null;
-      filePath = null;
-    }
-  };
-  return {
-    write(text) {
-      if (finalized || !text) return;
-      const textBytes = Buffer.byteLength(text, "utf8");
-      totalBytes += textBytes;
-      if (!stream && !failed) {
-        if (headBytes + textBytes <= threshold) {
-          head += text;
-          headBytes += textBytes;
-          return;
-        }
-        head += text;
-        open();
-        head = "";
-        return;
-      }
-      if (stream) {
-        if (stream.writableLength > SPOOL_WRITE_HWM_BYTES) {
-          droppedBytes += textBytes;
-          return;
-        }
-        stream.write(text);
-      }
-    },
-    finalize() {
-      if (finalized) {
-        return filePath ? { path: filePath, bytes: totalBytes, droppedBytes } : null;
-      }
-      finalized = true;
-      head = "";
-      if (!stream || !filePath) return null;
-      try {
-        stream.end();
-      } catch {
-      }
-      return { path: filePath, bytes: totalBytes, droppedBytes };
-    }
-  };
-}
-
-// src/_util.ts
-import * as fsp2 from "node:fs/promises";
-import * as path2 from "node:path";
-import * as Core from "@wrongstack/core/utils";
-function resolvePath(input, ctx) {
-  return path2.isAbsolute(input) ? path2.normalize(input) : path2.resolve(ctx.workingDir ?? ctx.cwd, input);
-}
-function allowedRoots(ctx) {
-  return [path2.resolve(ctx.projectRoot), path2.resolve(Core.wstackGlobalRoot())];
-}
-function isInsideAny(target, roots) {
-  return roots.some((root) => {
-    const rel = path2.relative(root, target);
-    return rel === "" || !rel.startsWith("..") && !path2.isAbsolute(rel);
-  });
-}
-function ensureInsideRoot(absPath, ctx) {
-  const target = path2.resolve(absPath);
-  if (ctx.allowOutsideProjectRoot) return target;
-  if (isInsideAny(target, allowedRoots(ctx))) return target;
-  throw new Error(`Path "${absPath}" is outside project root "${path2.resolve(ctx.projectRoot)}"`);
-}
-function safeResolve(input, ctx) {
-  return ensureInsideRoot(resolvePath(input, ctx), ctx);
-}
-async function resolveRealInsideRoot(absPath, ctx) {
-  if (ctx.allowOutsideProjectRoot) return absPath;
-  const realRoots = await Promise.all(
-    allowedRoots(ctx).map((r) => fsp2.realpath(r).catch(() => path2.resolve(r)))
-  );
-  let probe = absPath;
-  const pendingTail = [];
-  for (; ; ) {
-    let real;
-    try {
-      real = await fsp2.realpath(probe);
-    } catch (err) {
-      if (err.code === "ENOENT") {
-        const parent = path2.dirname(probe);
-        if (parent === probe) return absPath;
-        pendingTail.unshift(path2.basename(probe));
-        probe = parent;
-        continue;
-      }
-      throw err;
-    }
-    const candidate = pendingTail.length > 0 ? path2.join(real, ...pendingTail) : real;
-    if (isInsideAny(candidate, realRoots)) {
-      return candidate;
-    }
-    throw new Error(
-      `Path "${absPath}" resolves through a symlink outside project root "${realRoots[0]}"`
-    );
-  }
-}
-async function safeResolveReal(input, ctx) {
-  const abs = safeResolve(input, ctx);
-  return await resolveRealInsideRoot(abs, ctx);
-}
-var COMMAND_OUTPUT_MAX_BYTES = 32768;
-var REPEAT_RUN_THRESHOLD = 3;
-function collapseCarriageReturns(text) {
-  const lf = text.replace(/\r\n/g, "\n");
-  if (!lf.includes("\r")) return lf;
-  return lf.split("\n").map((line) => line.includes("\r") ? line.slice(line.lastIndexOf("\r") + 1) : line).join("\n");
-}
-function collapseConsecutiveDuplicates(text, minRun = REPEAT_RUN_THRESHOLD) {
-  const lines = text.split("\n");
-  const out = [];
-  let i = 0;
-  while (i < lines.length) {
-    let j = i + 1;
-    while (j < lines.length && lines[j] === lines[i]) j++;
-    const run = j - i;
-    if (run >= minRun) {
-      out.push(lines[i], `\u2026 \u27E8repeated ${run}\xD7\u27E9`);
-    } else {
-      for (let k = i; k < j; k++) out.push(lines[k]);
-    }
-    i = j;
-  }
-  return out.join("\n");
-}
-function takeHeadBytes(s, maxBytes) {
-  if (maxBytes <= 0) return "";
-  if (Buffer.byteLength(s, "utf8") <= maxBytes) return s;
-  let lo = 0;
-  let hi = s.length;
-  while (lo < hi) {
-    const mid = Math.ceil((lo + hi) / 2);
-    if (Buffer.byteLength(s.slice(0, mid), "utf8") <= maxBytes) lo = mid;
-    else hi = mid - 1;
-  }
-  return s.slice(0, lo);
-}
-function takeTailBytes(s, maxBytes) {
-  if (maxBytes <= 0) return "";
-  if (Buffer.byteLength(s, "utf8") <= maxBytes) return s;
-  let lo = 0;
-  let hi = s.length;
-  while (lo < hi) {
-    const mid = Math.ceil((lo + hi) / 2);
-    if (Buffer.byteLength(s.slice(s.length - mid), "utf8") <= maxBytes) lo = mid;
-    else hi = mid - 1;
-  }
-  return s.slice(s.length - lo);
-}
-function truncateHeadTail(s, maxBytes) {
-  const total = Buffer.byteLength(s, "utf8");
-  if (total <= maxBytes) return s;
-  const MARKER_RESERVE = 64;
-  const avail = Math.max(0, maxBytes - MARKER_RESERVE);
-  const headBudget = Math.floor(avail * 0.45);
-  const head = takeHeadBytes(s, headBudget);
-  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, "utf8"));
-  const kept = Buffer.byteLength(head, "utf8") + Buffer.byteLength(tail, "utf8");
-  return `${head}
-\u2026[truncated ${total - kept} bytes]\u2026
-${tail}`;
-}
-function normalizeCommandOutput(raw, opts = {}) {
-  if (!raw) return raw;
-  let text = Core.stripAnsi(raw);
-  text = collapseCarriageReturns(text);
-  text = text.replace(/[ \t]+$/gm, "");
-  text = collapseConsecutiveDuplicates(text);
-  text = text.replace(/\n{3,}/g, "\n\n");
-  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);
-}
-
-// src/_win32-resolve.ts
-import * as fs from "node:fs";
-import * as path3 from "node:path";
-function resolveWin32Command(cmd) {
-  if (process.platform !== "win32") return cmd;
-  if (cmd.includes("/") || cmd.includes("\\") || path3.extname(cmd.replace(/\//g, "\\"))) {
-    return cmd;
-  }
-  const pathext = (process.env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC").toLowerCase().split(";");
-  const pathDirs = (process.env["PATH"] ?? "").split(path3.delimiter);
-  for (const dir of pathDirs) {
-    const base = path3.join(dir, cmd);
-    for (const ext of pathext) {
-      const full = `${base}${ext}`;
-      try {
-        fs.accessSync(full, fs.constants.X_OK);
-        return full;
-      } catch {
-      }
-    }
-  }
-  return cmd;
-}
-var WIN32_SHELL_META = /[&|<>"%\r\n\0]/;
-function assertSafeWin32ShellArgs(args) {
-  for (const arg of args) {
-    if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
-      throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > " %, or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
-      );
-    }
-  }
-}
-function buildWin32CmdShimInvocation(command, args = []) {
-  assertSafeWin32ShellArgs([command, ...args]);
-  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
-  return {
-    command: process.env["COMSPEC"] ?? "cmd.exe",
-    args: ["/d", "/c", line],
-    windowsVerbatimArguments: true
-  };
-}
-function quoteWin32CmdArg(arg) {
-  return `"${arg}"`;
-}
-
-// src/exec-kill-guard.ts
-import * as os3 from "node:os";
-import * as path5 from "node:path";
-
-// src/process-registry-persistent.ts
-import * as fs2 from "node:fs/promises";
-import * as os2 from "node:os";
-import { wstackGlobalRoot as wstackGlobalRoot3 } from "@wrongstack/core/utils";
-import * as path4 from "node:path";
-
-// src/process-registry.ts
-import { spawn } from "node:child_process";
-import * as os from "node:os";
-
-// src/circuit-breaker.ts
-var DEFAULT_MAX_CONSECUTIVE_FAILURES = 5;
-var DEFAULT_SLOW_CALL_THRESHOLD_MS = 18e4;
-var DEFAULT_MAX_SLOW_CALLS = 3;
-var DEFAULT_WINDOW_MS = 6e4;
-var DEFAULT_MAX_CALLS_PER_WINDOW = 30;
-var DEFAULT_COOLDOWN_MS = 3e4;
-var CircuitBreaker = class {
-  maxConsecutiveFailures;
-  slowCallThresholdMs;
-  maxSlowCalls;
-  windowMs;
-  maxCallsPerWindow;
-  cooldownMs;
-  state = "closed";
-  consecutiveFailures = 0;
-  window = [];
-  lastFailureAt = null;
-  lastSlowAt = null;
-  /** Timestamp when the breaker was opened (for cooldown calculation). */
-  openedAt = null;
-  /**
-   * Master enable flag. When false the breaker is bypassed: `beforeCall`
-   * always returns true and `afterCall` records nothing. The class itself
-   * defaults to enabled (so the standalone unit tests exercise tripping); the
-   * ProcessRegistry flips this off until the user opts in via `/settings`.
-   */
-  enabled = true;
-  /**
-   * Fired (best-effort) when the breaker transitions into the `open` state.
-   * The registry uses this to arm its auto kill/reset countdown.
-   */
-  onTrip;
-  /**
-   * Fired (best-effort) when the breaker returns to `closed` after having been
-   * open/half-open. The registry uses this to cancel a pending kill/reset.
-   */
-  onReset;
-  constructor(config = {}) {
-    this.maxConsecutiveFailures = config.maxConsecutiveFailures ?? DEFAULT_MAX_CONSECUTIVE_FAILURES;
-    this.slowCallThresholdMs = config.slowCallThresholdMs ?? DEFAULT_SLOW_CALL_THRESHOLD_MS;
-    this.maxSlowCalls = config.maxSlowCalls ?? DEFAULT_MAX_SLOW_CALLS;
-    this.windowMs = config.windowMs ?? DEFAULT_WINDOW_MS;
-    this.maxCallsPerWindow = config.maxCallsPerWindow ?? DEFAULT_MAX_CALLS_PER_WINDOW;
-    this.cooldownMs = config.cooldownMs ?? DEFAULT_COOLDOWN_MS;
-  }
-  /** Toggle the master enable. Disabling resets to a clean `closed` state. */
-  setEnabled(enabled) {
-    if (this.enabled === enabled) return;
-    this.enabled = enabled;
-    if (!enabled) this._reset();
-  }
-  get isEnabled() {
-    return this.enabled;
-  }
-  /**
-   * Returns true if the circuit allows a new call to proceed.
-   * When false, callers should abort the tool call and return a
-   * circuit-breaker error instead of spawning a process.
-   */
-  get canProceed() {
-    if (!this.enabled) return true;
-    this._checkStateTransition();
-    return this.state !== "open";
-  }
-  /**
-   * Snapshot of the current breaker state for observability (`/kill`).
-   */
-  snapshot() {
-    this._checkStateTransition();
-    const now = Date.now();
-    let cooldownRemaining = null;
-    if (this.openedAt !== null && this.state === "open") {
-      const elapsed = now - this.openedAt;
-      cooldownRemaining = Math.max(0, this.cooldownMs - elapsed);
-    }
-    return {
-      state: this.state,
-      consecutiveFailures: this.consecutiveFailures,
-      slowCallsInWindow: this.window.filter((c) => c.slow).length,
-      callsInWindow: this.window.length,
-      windowMs: this.windowMs,
-      cooldownRemainingMs: cooldownRemaining,
-      lastFailureAt: this.lastFailureAt,
-      lastSlowAt: this.lastSlowAt
-    };
-  }
-  /**
-   * Call this BEFORE spawning a bash/exec process.
-   * Returns true if the call is allowed; false if the breaker is open.
-   * When false, callers MUST NOT spawn a process.
-   *
-   * @param bypass - If true, skip the circuit breaker check entirely.
-   *                  Use for background/fire-and-forget processes that should
-   *                  not affect breaker state.
-   */
-  beforeCall(bypass = false) {
-    if (bypass || !this.enabled) return true;
-    this._checkStateTransition();
-    if (this.state === "open") return false;
-    return true;
-  }
-  /**
-   * Call this AFTER a bash/exec process finishes (success or failure).
-   * `durationMs` is the wall-clock time the process ran.
-   * `failed` is true when the process returned a non-zero exit code or
-   * threw an exception before spawning.
-   *
-   * @param bypass - If true, do not update breaker state.
-   *                  Use for background/fire-and-forget processes.
-   */
-  afterCall(durationMs, failed, bypass = false) {
-    if (bypass || !this.enabled) return;
-    const now = Date.now();
-    if (this.state === "half-open") {
-      if (failed) {
-        this._trip();
-        return;
-      }
-      this._reset();
-      return;
-    }
-    this._pruneWindow(now);
-    const slow = durationMs >= this.slowCallThresholdMs;
-    this.window.push({ at: now, failed, slow });
-    if (failed) {
-      this.consecutiveFailures++;
-      this.lastFailureAt = now;
-      if (this.consecutiveFailures >= this.maxConsecutiveFailures) {
-        this._trip();
-      }
-      return;
-    }
-    this.consecutiveFailures = 0;
-    if (slow) {
-      this.lastSlowAt = now;
-      const slowCount = this.window.filter((c) => c.slow).length;
-      if (slowCount >= this.maxSlowCalls) {
-        this._trip();
-      }
-    }
-    const callCount = this.window.length;
-    if (callCount >= this.maxCallsPerWindow) {
-      this._trip();
-    }
-  }
-  /** Force the breaker open. Used by /kill force and Ctrl+C. */
-  forceOpen() {
-    this._trip();
-  }
-  /** Force a reset to closed. Used by tests and /kill reset. */
-  forceReset() {
-    this._reset();
-  }
-  _trip() {
-    if (this.state === "open") return;
-    this.state = "open";
-    this.openedAt = Date.now();
-    this.window = [];
-    try {
-      this.onTrip?.();
-    } catch {
-    }
-  }
-  _reset() {
-    const wasRecovering = this.state !== "closed";
-    this.state = "closed";
-    this.consecutiveFailures = 0;
-    this.window = [];
-    this.openedAt = null;
-    if (wasRecovering) {
-      try {
-        this.onReset?.();
-      } catch {
-      }
-    }
-  }
-  /** Transition from open → half-open when cooldown elapses. */
-  _checkStateTransition() {
-    if (this.state !== "open" || this.openedAt === null) return;
-    const elapsed = Date.now() - this.openedAt;
-    if (elapsed >= this.cooldownMs) {
-      this.state = "half-open";
-      this.openedAt = null;
-    }
-  }
-  _pruneWindow(now) {
-    const cutoff = now - this.windowMs;
-    this.window = this.window.filter((c) => c.at >= cutoff);
-  }
-};
-
-// src/_redact-command.ts
-import { expectDefined } from "@wrongstack/core/utils";
-var SENSITIVE_FLAG_PATTERNS = [
-  // --flag=value  or  --flag "value"  (value captured up to next space or comma)
-  /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
-  // -t short flag (token): attached (-tVALUE), separated (-t VALUE), or -t=VALUE.
-  // (?<![-\w]) anchors to a token start so we don't match the `-t` inside `--token`.
-  // The value must be token-like (>= 8 chars) so ordinary combined flags such
-  // as `tar -tf` / `ssh -tt` are not eaten. Global flag: EVERY occurrence is
-  // redacted, not just the first.
-  // NOTE: synced with @wrongstack/core observability/redact-command.ts.
-  /(?<![-\w])-t(?:[=\s]+)?[^\s,-]{8,}/g,
-  // -p|-password|-a (redis auth) short flags: attached + separated + =value.
-  // Same token-start anchor; over-redaction is an accepted tradeoff for a
-  // redaction function. Synced with core copy.
-  /(?<![-\w])-(?:password|p|a)(?:[=\s]+)?[^\s,-]+/gi,
-  // env var–style secrets: TOKEN=x, API_KEY=y, etc.
-  /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD|PASSPHRASE)\s*[=:]\s*[^\s,]+/gi,
-  // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
-  // when preceded by a flag name (e.g. --github-token=EyJ...). Global flag so
-  // every such flag in the command line is redacted, not just the first.
-  /--\w*(?:token|key|secret|password|passwd|auth|credential)\w*[=\s,][A-Za-z0-9+/=]{32,}/g
-];
-function redactCommand(cmd) {
-  let result = cmd;
-  for (const pattern of SENSITIVE_FLAG_PATTERNS) {
-    result = result.replace(pattern, (match) => {
-      const eq = match.indexOf("=");
-      const sp = match.search(/\s/);
-      const delim = eq !== -1 ? "=" : sp !== -1 ? match[sp] : null;
-      if (delim !== null) {
-        const flag = match.slice(0, match.indexOf(expectDefined(delim)) + 1);
-        return `${flag}[REDACTED]`;
-      }
-      if (match.startsWith("--")) {
-        return match;
-      }
-      return `${match.slice(0, 2)}[REDACTED]`;
-    });
-  }
-  return result;
-}
-
-// src/process-registry.ts
-var DEFAULT_GRACE_MS = 2e3;
-var WIN32_TASKKILL_TIMEOUT_MS = 5e3;
-function killWin32Tree(pid, opts = {}) {
-  try {
-    const child = spawn("taskkill", ["/pid", String(pid), "/T", "/F"], {
-      stdio: "ignore",
-      windowsHide: true
-    });
-    let settled = false;
-    let timeout;
-    const settle = () => {
-      if (settled) return;
-      settled = true;
-      if (timeout) clearTimeout(timeout);
-      try {
-        opts.onSettled?.();
-      } catch {
-      }
-    };
-    child.on("error", settle);
-    child.on("close", settle);
-    timeout = setTimeout(
-      () => {
-        try {
-          child.kill();
-        } catch {
-        }
-        settle();
-      },
-      Math.max(1, opts.timeoutMs ?? WIN32_TASKKILL_TIMEOUT_MS)
-    );
-    timeout.unref?.();
-    child.unref();
-    return true;
-  } catch {
-    return false;
-  }
-}
-var ProcessRegistryImpl = class {
-  processes = /* @__PURE__ */ new Map();
-  breaker;
-  /**
-   * Auto kill/reset config. When the breaker trips and `autoKillResetMs > 0`,
-   * a countdown is armed; on expiry all tracked processes are killed and the
-   * breaker is reset to closed (forced recovery). Zero means manual recovery
-   * only (`/kill reset`).
-   */
-  autoKillResetMs = 0;
-  autoKillTimer = null;
-  autoKillArmedAt = null;
-  breakerCountdownListeners = [];
-  constructor(breakerConfig) {
-    this.breaker = new CircuitBreaker(breakerConfig);
-    this.breaker.onTrip = () => this._armAutoKillReset();
-    this.breaker.onReset = () => this._cancelAutoKillReset();
-    this.breaker.setEnabled(false);
-  }
-  register(info) {
-    this.processes.set(info.pid, {
-      ...info,
-      killed: false,
-      protected: info.protected ?? false,
-      background: info.background ?? false
-    });
-  }
-  _isSafeSignalPid(pid) {
-    return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
-  }
-  _canSignalProcessGroup(p) {
-    return os.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && p.child !== null && typeof p.child.pid === "number" && p.child.pid === p.pid;
-  }
-  _killChildDirect(p, signal) {
-    try {
-      if (p.child) {
-        p.child.kill(signal);
-        return;
-      }
-      if (this._isSafeSignalPid(p.pid)) process.kill(p.pid, signal);
-    } catch {
-    }
-  }
-  _killPosix(p, signal) {
-    if (this._canSignalProcessGroup(p)) {
-      try {
-        process.kill(-p.pid, signal);
-        return;
-      } catch {
-      }
-    }
-    this._killChildDirect(p, signal);
-  }
-  /** Unregister a process by PID. Called on 'close' / 'exit' events. */
-  unregister(pid) {
-    this.processes.delete(pid);
-  }
-  /** Get a single process by PID. */
-  get(pid) {
-    this._pruneStale(pid);
-    return this.processes.get(pid);
-  }
-  /** Get all tracked processes. */
-  list() {
-    this._pruneAllStale();
-    return Array.from(this.processes.values());
-  }
-  /** Get processes filtered by name (e.g. 'bash', 'exec'). */
-  byName(name) {
-    return this.list().filter((p) => p.name === name);
-  }
-  /** Get processes filtered by session. */
-  bySession(sessionId) {
-    return this.list().filter((p) => p.sessionId === sessionId);
-  }
-  /** Count of active (non-killed) processes. */
-  get activeCount() {
-    let n = 0;
-    for (const p of this.processes.values()) {
-      if (!p.killed) n++;
-    }
-    return n;
-  }
-  /** Count of active jobs explicitly launched in background mode. */
-  get activeBackgroundCount() {
-    let n = 0;
-    for (const p of this.processes.values()) {
-      if (p.background && !p.killed) n++;
-    }
-    return n;
-  }
-  /**
-   * Combined stats for observability — used by /ps and the TUI status bar.
-   */
-  stats() {
-    this._pruneAllStale();
-    return {
-      activeCount: this.activeCount,
-      backgroundCount: this.activeBackgroundCount,
-      totalCount: this.processes.size,
-      breaker: this.breaker.snapshot()
-    };
-  }
-  /**
-   * Returns true if the circuit allows a new bash/exec call to proceed.
-   * When false, callers MUST NOT spawn a process.
-   */
-  get canProceed() {
-    return this.breaker.canProceed;
-  }
-  /**
-   * Called before spawning a process. Returns true if allowed; false if
-   * the circuit breaker is open.
-   *
-   * @param bypass - If true, skip circuit breaker check (for background processes).
-   */
-  beforeCall(bypass = false) {
-    return this.breaker.beforeCall(bypass);
-  }
-  /**
-   * Called after a process finishes. `durationMs` is wall-clock time;
-   * `failed` is true for non-zero exit codes.
-   *
-   * @param bypass - If true, do not update circuit breaker state (for background processes).
-   */
-  afterCall(durationMs, failed, bypass = false) {
-    this.breaker.afterCall(durationMs, failed, bypass);
-  }
-  /** Force-open the circuit breaker (Ctrl+C, /kill force). */
-  forceBreakerOpen() {
-    this.breaker.forceOpen();
-  }
-  /** Force-reset the circuit breaker to closed (/kill reset). */
-  forceBreakerReset() {
-    this.breaker.forceReset();
-  }
-  /**
-   * Configure circuit-breaker protection at runtime. Called from `/settings`
-   * (instant, all modes) and on TUI mount (applies persisted config).
-   *
-   * - `enabled` toggles whether the breaker gates `bash`/`exec`.
-   * - `autoKillResetMs` arms the auto kill/reset countdown when the breaker
-   *   trips (0 = manual recovery only).
-   *
-   * Re-applies cleanly on every call: cancels a pending countdown when the
-   * timeout is cleared or protection disabled, and re-arms if the breaker is
-   * currently open under the new settings.
-   */
-  setBreakerConfig(cfg) {
-    if (cfg.enabled !== void 0) this.breaker.setEnabled(cfg.enabled);
-    if (cfg.autoKillResetMs !== void 0) this.autoKillResetMs = Math.max(0, cfg.autoKillResetMs);
-    if (this.autoKillResetMs <= 0) {
-      this._cancelAutoKillReset();
-      return;
-    }
-    if (this.breaker.isEnabled && this.breaker.snapshot().state === "open") {
-      this._armAutoKillReset();
-    }
-  }
-  /**
-   * Live countdown to the next auto kill/reset, or null when nothing is armed.
-   * The TUI polls this on a 1s tick while armed so the statusline decrements.
-   */
-  getBreakerCountdown() {
-    if (this.autoKillArmedAt === null || this.autoKillResetMs <= 0) return null;
-    const elapsed = Date.now() - this.autoKillArmedAt;
-    return {
-      remainingMs: Math.max(0, this.autoKillResetMs - elapsed),
-      totalMs: this.autoKillResetMs
-    };
-  }
-  /**
-   * Subscribe to countdown arm/cancel events. Returns an unsubscribe function.
-   * Use {@link getBreakerCountdown} for the live ticking value between events.
-   */
-  onBreakerCountdownChange(listener) {
-    this.breakerCountdownListeners.push(listener);
-    return () => {
-      this.breakerCountdownListeners = this.breakerCountdownListeners.filter((l) => l !== listener);
-    };
-  }
-  _emitBreakerCountdown() {
-    const snap = this.getBreakerCountdown();
-    for (const l of this.breakerCountdownListeners) {
-      try {
-        l(snap);
-      } catch {
-      }
-    }
-  }
-  /**
-   * Arm the auto kill/reset countdown. Idempotent: re-arming resets the window
-   * (a fresh trip after a failed half-open probe restarts the clock). No-op
-   * when protection is off or no timeout is configured.
-   */
-  _armAutoKillReset() {
-    if (this.autoKillResetMs <= 0 || !this.breaker.isEnabled) return;
-    this._clearAutoKillTimer();
-    this.autoKillArmedAt = Date.now();
-    this.autoKillTimer = setTimeout(() => {
-      this.autoKillTimer = null;
-      this.autoKillArmedAt = null;
-      this.killAll({ force: false, preserveBackground: true });
-      this.breaker.forceReset();
-      this._emitBreakerCountdown();
-    }, this.autoKillResetMs);
-    this.autoKillTimer.unref?.();
-    this._emitBreakerCountdown();
-  }
-  _cancelAutoKillReset() {
-    const wasArmed = this.autoKillArmedAt !== null;
-    this._clearAutoKillTimer();
-    if (wasArmed) {
-      this.autoKillArmedAt = null;
-      this._emitBreakerCountdown();
-    }
-  }
-  _clearAutoKillTimer() {
-    if (this.autoKillTimer !== null) {
-      clearTimeout(this.autoKillTimer);
-      this.autoKillTimer = null;
-    }
-  }
-  /** Kill a single process by PID.
-   *
-   *  On POSIX: sends SIGTERM to the *process group* (-pid) so that
-   *  runaway grandchild processes (`sleep 9999 & disown`) are also killed.
-   *  After `graceMs` a SIGKILL is sent if the process hasn't exited.
-   *
-   *  On Windows: `child.kill()` maps to TerminateProcess — process groups
-   *  are not meaningfully supported. A second `force=true` call sends
-   *  SIGKILL (which maps to TerminateProcess again — the distinction is
-   *  in the exit code, not the signal).
-   *
-   *  Returns true if the process was found and kill was attempted.
-   */
-  kill(pid, opts = {}) {
-    this._pruneStale(pid);
-    const p = this.processes.get(pid);
-    if (!p) return false;
-    if (p.killed && opts.force !== true) return true;
-    if (p.protected && opts.includeProtected !== true) return false;
-    if (opts.preserveBackground && p.background) return false;
-    const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
-    const isWin3 = os.platform() === "win32";
-    if (isWin3) {
-      const liveRealChild = p.child === null || p.child.exitCode === null && typeof p.child.pid === "number";
-      const directFallback = () => {
-        if (p.child && p.child.exitCode === null) {
-          try {
-            p.child.kill("SIGKILL");
-          } catch {
-          }
-        }
-      };
-      if (liveRealChild && killWin32Tree(pid, {
-        timeoutMs: Math.max(graceMs, WIN32_TASKKILL_TIMEOUT_MS),
-        onSettled: directFallback
-      })) {
-      } else {
-        this._killChildDirect(p, force ? "SIGKILL" : "SIGTERM");
-      }
-      p.killed = true;
-      return true;
-    }
-    try {
-      if (force) {
-        this._killPosix(p, "SIGKILL");
-      } else {
-        this._killPosix(p, "SIGTERM");
-        const timer = setTimeout(() => {
-          if (this.processes.has(pid) && !p.child?.killed) {
-            this._killPosix(p, "SIGKILL");
-          }
-        }, graceMs);
-        timer.unref?.();
-      }
-    } catch {
-    }
-    p.killed = true;
-    return true;
-  }
-  /**
-   * Kill all tracked processes.
-   * Returns the PIDs that were kill()ed.
-   */
-  killAll(opts = {}) {
-    const pids = Array.from(this.processes.keys());
-    const killed = [];
-    const includeProtected = opts.includeProtected === true;
-    for (const pid of pids) {
-      const p = this.processes.get(pid);
-      if (!p) continue;
-      if (p.protected && !includeProtected) continue;
-      if (opts.preserveBackground && p.background) continue;
-      if (this.kill(pid, opts)) killed.push(pid);
-    }
-    return killed;
-  }
-  /**
-   * Kill all processes for a specific session.
-   * Returns the PIDs that were kill()ed.
-   */
-  killSession(sessionId, opts = {}) {
-    const pids = this.bySession(sessionId).map((p) => p.pid);
-    const killed = [];
-    for (const pid of pids) {
-      if (this.kill(pid, opts)) killed.push(pid);
-    }
-    return killed;
-  }
-  /**
-   * Check whether a tracked process entry is stale — the child has exited
-   * (exitCode !== null) AND it's been in the registry long enough that the
-   * OS may have reused the PID for a new, unrelated process.
-   *
-   * P3 #24 (before-release.md): on POSIX, PIDs are reused after process
-   * exit. If a tracked process exits but its 'close' event hasn't fired yet
-   * (or was missed), the registry still holds the entry. A new process
-   * gets the same PID, and PID-based lookups (get, kill, shouldBlockKill)
-   * may incorrectly protect or target the wrong process.
-   *
-   * The 60s threshold is conservative — the OS typically waits much longer
-   * before reusing a PID, but we want to clean up before that becomes a risk.
-   */
-  _isStaleEntry(entry) {
-    if (entry.child === null) {
-      if (Date.now() - entry.startedAt <= 6e4) return false;
-      if (os.platform() === "win32") return false;
-      try {
-        process.kill(entry.pid, 0);
-        return false;
-      } catch (err) {
-        return err.code !== "EPERM";
-      }
-    }
-    return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
-  }
-  /**
-   * Remove a stale entry for a specific PID before any PID-based lookup.
-   * This prevents PID reuse from causing the registry to act on a dead
-   * process that has been replaced by a new one with the same PID.
-   */
-  _pruneStale(pid) {
-    const entry = this.processes.get(pid);
-    if (entry && this._isStaleEntry(entry)) {
-      this.processes.delete(pid);
-    }
-  }
-  /**
-   * Remove every stale entry, not just one PID. `list()`/`stats()` — the
-   * surfaces the TUI status bar and `/ps` poll — must prune too: a child
-   * whose 'close' event never fires (e.g. Windows grandchildren holding stdio
-   * open) would otherwise linger in the registry until someone looks up its
-   * exact PID, and PID reuse meanwhile makes `get()`/`kill()` target the
-   * wrong process. RAM-leak audit 2026-07-31, MEDIUM.
-   */
-  _pruneAllStale() {
-    for (const [pid, entry] of this.processes) {
-      if (this._isStaleEntry(entry)) this.processes.delete(pid);
-    }
-  }
-};
-var _registry;
-function getProcessRegistry() {
-  if (!_registry) {
-    _registry = new ProcessRegistryImpl();
-  }
-  return _registry;
-}
-
-// src/process-registry-persistent.ts
-var REGISTRY_FILE = "process-registry.json";
-function toErrorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-function emitStructuredLog(level, event, message, error) {
-  const payload = {
-    level,
-    event,
-    message,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  if (error !== void 0) {
-    payload.error = toErrorMessage(error);
-  }
-  console.log(JSON.stringify(payload));
-}
-var HEARTBEAT_INTERVAL_MS = 5e3;
-var STALE_THRESHOLD_MS = 3e4;
-var LOCK_STALE_MS = 3e4;
-var LOCKFILE = ".process-registry.lock";
-function generateInstanceId() {
-  const hostname2 = os2.hostname();
-  const pid = process.pid;
-  const random = Math.random().toString(36).slice(2, 8);
-  return `${hostname2}:${pid}:${random}`;
-}
-function isNodeError(err) {
-  return typeof err === "object" && err !== null && "code" in err;
-}
-async function acquireLock(lockfilePath, timeoutMs = 5e3) {
-  const start = Date.now();
-  const pidStr = String(process.pid);
-  const hostStr = os2.hostname();
-  try {
-    await fs2.mkdir(path4.dirname(lockfilePath), { recursive: true });
-  } catch {
-  }
-  while (Date.now() - start < timeoutMs) {
-    try {
-      await fs2.writeFile(lockfilePath, `${pidStr}:${hostStr}:${Date.now()}`, { flag: "wx" });
-      return async () => {
-        try {
-          await fs2.unlink(lockfilePath);
-        } catch {
-        }
-      };
-    } catch (err) {
-      if (isNodeError(err) && err.code === "EEXIST") {
-        try {
-          const content = await fs2.readFile(lockfilePath, "utf-8");
-          const parts = content.split(":");
-          const lockPid = parseInt(parts[0] ?? "0", 10);
-          const lockTs = Number(parts[parts.length - 1]);
-          const staleByAge = Number.isFinite(lockTs) && Date.now() - lockTs > LOCK_STALE_MS;
-          let holderDead = false;
-          if (process.platform !== "win32" && Number.isFinite(lockPid) && lockPid > 0) {
-            try {
-              process.kill(lockPid, 0);
-            } catch {
-              holderDead = true;
-            }
-          }
-          if (holderDead || staleByAge) {
-            await fs2.unlink(lockfilePath).catch(() => {
-            });
-            continue;
-          }
-        } catch {
-          await fs2.unlink(lockfilePath).catch(() => {
-          });
-          continue;
-        }
-        await new Promise((r) => setTimeout(r, 100));
-        continue;
-      }
-      throw err;
-    }
-  }
-  throw new Error(`Failed to acquire lock after ${timeoutMs}ms`);
-}
-function freshRegistryData() {
-  return {
-    version: 1,
-    instances: /* @__PURE__ */ new Map(),
-    protectedPatterns: ["wrongstack", "node"],
-    lastCleanup: Date.now()
-  };
-}
-async function readRegistryFile(filePath) {
-  let content;
-  try {
-    content = await fs2.readFile(filePath, "utf-8");
-  } catch (err) {
-    if (isNodeError(err) && err.code === "ENOENT") return freshRegistryData();
-    throw err;
-  }
-  try {
-    const parsed = JSON.parse(content);
-    if (!parsed || typeof parsed !== "object") return freshRegistryData();
-    const base = freshRegistryData();
-    return {
-      version: 1,
-      instances: Array.isArray(parsed.instances) ? new Map(parsed.instances) : base.instances,
-      protectedPatterns: Array.isArray(parsed.protectedPatterns) ? parsed.protectedPatterns : base.protectedPatterns,
-      lastCleanup: typeof parsed.lastCleanup === "number" ? parsed.lastCleanup : base.lastCleanup
-    };
-  } catch {
-    return freshRegistryData();
-  }
-}
-async function writeRegistryFile(filePath, data) {
-  const tmpPath = `${filePath}.tmp.${process.pid}`;
-  const content = JSON.stringify(
-    data,
-    (_k, v) => {
-      if (v instanceof Map) {
-        return Array.from(v.entries());
-      }
-      return v;
-    },
-    2
-  );
-  await fs2.writeFile(tmpPath, content, "utf-8");
-  await fs2.rename(tmpPath, filePath);
-}
-var PersistentProcessRegistry = class {
-  instanceId;
-  registryPath;
-  lockPath;
-  baseRegistry;
-  heartbeatInterval = null;
-  cleanupInterval = null;
-  heartbeatRunning = false;
-  cleanupRunning = false;
-  isShuttingDown = false;
-  onProcessExit = () => {
-    this.runInBackground(
-      this.syncToPersistent(),
-      "process_registry.exit_sync_failed",
-      "PersistentProcessRegistry: exit sync failed"
-    );
-  };
-  constructor(baseRegistry) {
-    this.instanceId = generateInstanceId();
-    const globalRoot = wstackGlobalRoot3();
-    this.registryPath = path4.join(globalRoot, REGISTRY_FILE);
-    this.lockPath = path4.join(globalRoot, LOCKFILE);
-    this.baseRegistry = baseRegistry ?? getProcessRegistry();
-    this.ensureDirectory().catch((err) => {
-      emitStructuredLog(
-        "warn",
-        "process_registry.dir_create_failed",
-        "PersistentProcessRegistry: failed to create .wrongstack directory",
-        err
-      );
-    });
-  }
-  async ensureDirectory() {
-    const dir = path4.dirname(this.registryPath);
-    try {
-      await fs2.mkdir(dir, { recursive: true });
-    } catch (err) {
-      if (!isNodeError(err) || err.code !== "EEXIST") throw err;
-    }
-  }
-  runInBackground(operation, event, message) {
-    void operation.catch((err) => {
-      emitStructuredLog("warn", event, message, err);
-    });
-  }
-  /**
-   * Start the heartbeat and periodic cleanup tasks.
-   */
-  start() {
-    if (this.heartbeatInterval) return;
-    this.isShuttingDown = false;
-    this.heartbeat();
-    this.heartbeatInterval = setInterval(() => {
-      this.heartbeat();
-    }, HEARTBEAT_INTERVAL_MS);
-    this.heartbeatInterval.unref?.();
-    this.cleanupInterval = setInterval(() => {
-      this.cleanup();
-    }, STALE_THRESHOLD_MS);
-    this.cleanupInterval.unref?.();
-    this.registerMainProcess();
-    process.on("exit", this.onProcessExit);
-  }
-  /**
-   * Stop the heartbeat and clean up.
-   */
-  stop() {
-    this.isShuttingDown = true;
-    if (this.heartbeatInterval) {
-      clearInterval(this.heartbeatInterval);
-      this.heartbeatInterval = null;
-    }
-    if (this.cleanupInterval) {
-      clearInterval(this.cleanupInterval);
-      this.cleanupInterval = null;
-    }
-    process.off("exit", this.onProcessExit);
-    this.runInBackground(
-      this.syncToPersistent(),
-      "process_registry.stop_sync_failed",
-      "PersistentProcessRegistry: stop sync failed"
-    );
-  }
-  /**
-   * Register the main WrongStack process as protected.
-   */
-  registerMainProcess() {
-    const mainPid = process.pid;
-    this.runInBackground(
-      this.updatePersistentEntry({
-        pid: mainPid,
-        name: "wrongstack-main",
-        command: process.argv.slice(0, 3).join(" "),
-        startedAt: Date.now(),
-        lastHeartbeat: Date.now(),
-        instanceId: this.instanceId,
-        hostname: os2.hostname(),
-        protected: true,
-        spawnMode: "main",
-        parentPid: process.ppid,
-        platform: process.platform
-      }),
-      "process_registry.main_register_failed",
-      "PersistentProcessRegistry: failed to register main process"
-    );
-  }
-  /**
-   * Register a spawned child process with the persistent registry.
-   */
-  registerChildProcess(pid, name, command, sessionId, spawnMode = "spawn") {
-    const entry = {
-      pid,
-      name,
-      command,
-      startedAt: Date.now(),
-      lastHeartbeat: Date.now(),
-      instanceId: this.instanceId,
-      hostname: os2.hostname(),
-      protected: true,
-      // All WrongStack child processes are protected by default
-      spawnMode,
-      parentPid: process.pid,
-      platform: process.platform
-    };
-    if (sessionId) {
-      entry.sessionId = sessionId;
-    }
-    this.runInBackground(
-      this.updatePersistentEntry(entry),
-      "process_registry.child_register_failed",
-      "PersistentProcessRegistry: failed to register child process"
-    );
-  }
-  /**
-   * Update or add an entry in the persistent registry.
-   */
-  async updatePersistentEntry(entry) {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      data.instances.set(String(entry.pid), entry);
-      this.baseRegistry.register({
-        pid: entry.pid,
-        name: entry.name,
-        command: entry.command,
-        startedAt: entry.startedAt,
-        sessionId: entry.sessionId,
-        protected: entry.protected,
-        child: null
-      });
-      await writeRegistryFile(this.registryPath, data);
-    } finally {
-      await release();
-    }
-  }
-  /**
-   * Unregister a process from the persistent registry.
-   */
-  async unregister(pid) {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      data.instances.delete(String(pid));
-      await writeRegistryFile(this.registryPath, data);
-    } finally {
-      await release();
-    }
-  }
-  /**
-   * Send heartbeat to mark all this instance's processes as alive.
-   */
-  heartbeat() {
-    if (this.isShuttingDown || this.heartbeatRunning) return;
-    this.heartbeatRunning = true;
-    void this.syncToPersistent().catch((err) => {
-      emitStructuredLog(
-        "warn",
-        "process_registry.heartbeat_failed",
-        "PersistentProcessRegistry: heartbeat failed",
-        err
-      );
-    }).finally(() => {
-      this.heartbeatRunning = false;
-    });
-  }
-  cleanup() {
-    if (this.isShuttingDown || this.cleanupRunning) return;
-    this.cleanupRunning = true;
-    void this.cleanupStaleEntries().catch((err) => {
-      emitStructuredLog(
-        "warn",
-        "process_registry.periodic_cleanup_failed",
-        "PersistentProcessRegistry: periodic cleanup failed",
-        err
-      );
-    }).finally(() => {
-      this.cleanupRunning = false;
-    });
-  }
-  /**
-   * Sync this instance's processes to the persistent registry.
-   */
-  async syncToPersistent() {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      const now = Date.now();
-      const updatedInstances = /* @__PURE__ */ new Map();
-      for (const [_pidStr, entry] of data.instances) {
-        if (entry.instanceId === this.instanceId) {
-          entry.lastHeartbeat = now;
-        }
-        if (entry.instanceId === this.instanceId || now - entry.lastHeartbeat < STALE_THRESHOLD_MS) {
-          updatedInstances.set(_pidStr, entry);
-        }
-      }
-      data.instances = updatedInstances;
-      data.lastCleanup = now;
-      await writeRegistryFile(this.registryPath, data);
-    } catch (err) {
-      emitStructuredLog(
-        "warn",
-        "process_registry.sync_failed",
-        "PersistentProcessRegistry: sync failed",
-        err
-      );
-    } finally {
-      await release();
-    }
-  }
-  /**
-   * Remove entries for processes that are no longer running.
-   */
-  async cleanupStaleEntries() {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      const now = Date.now();
-      const stalePids = [];
-      for (const [_pidStr, entry] of data.instances) {
-        const age = now - entry.lastHeartbeat;
-        if (age > STALE_THRESHOLD_MS) {
-          try {
-            if (process.platform !== "win32") {
-              process.kill(entry.pid, 0);
-            } else {
-              emitStructuredLog(
-                "debug",
-                "process_registry.stale_pid_check",
-                `PersistentProcessRegistry: checking stale pid ${entry.pid} (${age}ms old)`
-              );
-            }
-          } catch {
-            stalePids.push(_pidStr);
-          }
-        }
-      }
-      if (stalePids.length > 0) {
-        for (const pidStr of stalePids) {
-          data.instances.delete(pidStr);
-        }
-        await writeRegistryFile(this.registryPath, data);
-      }
-    } catch (err) {
-      emitStructuredLog(
-        "warn",
-        "process_registry.cleanup_failed",
-        "PersistentProcessRegistry: cleanup failed",
-        err
-      );
-    } finally {
-      await release();
-    }
-  }
-  /**
-   * Check if a PID belongs to a WrongStack process and should be protected.
-   */
-  async isProtectedPid(pid) {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      const entry = data.instances.get(String(pid));
-      if (!entry) return false;
-      if (Date.now() - entry.lastHeartbeat > STALE_THRESHOLD_MS) {
-        return false;
-      }
-      return entry.protected;
-    } finally {
-      await release();
-    }
-  }
-  /**
-   * Get all protected PIDs from all WrongStack instances.
-   */
-  async getAllProtectedPids() {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      const now = Date.now();
-      const protectedPids = [];
-      for (const [_pidStr, entry] of data.instances) {
-        if (entry.protected && now - entry.lastHeartbeat < STALE_THRESHOLD_MS) {
-          protectedPids.push(entry.pid);
-        }
-      }
-      return protectedPids;
-    } finally {
-      await release();
-    }
-  }
-  /**
-   * Get complete status of all tracked processes across all instances.
-   */
-  async getGlobalStatus() {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      const now = Date.now();
-      const instances = /* @__PURE__ */ new Map();
-      let protectedCount = 0;
-      let staleCount = 0;
-      for (const [_pidStr, entry] of data.instances) {
-        const instanceEntries = instances.get(entry.instanceId) ?? [];
-        instanceEntries.push(entry);
-        instances.set(entry.instanceId, instanceEntries);
-        if (entry.protected) protectedCount++;
-        if (now - entry.lastHeartbeat > STALE_THRESHOLD_MS) staleCount++;
-      }
-      return {
-        instances,
-        totalProcesses: data.instances.size,
-        protectedCount,
-        staleCount
-      };
-    } finally {
-      await release();
-    }
-  }
-  /**
-   * Get the instance ID for this process.
-   */
-  getInstanceId() {
-    return this.instanceId;
-  }
-  /**
-   * Check if a kill command should be blocked.
-   * Returns true if the kill should be blocked (target is a WrongStack process).
-   */
-  async shouldBlockKill(pid) {
-    const protectedPids = await this.getAllProtectedPids();
-    return protectedPids.includes(pid);
-  }
-  /**
-   * Add a pattern-based protection rule.
-   * Processes whose command matches any protected pattern are protected.
-   */
-  async addProtectedPattern(pattern) {
-    const release = await acquireLock(this.lockPath);
-    try {
-      const data = await readRegistryFile(this.registryPath);
-      if (!data.protectedPatterns.includes(pattern)) {
-        data.protectedPatterns.push(pattern);
-        await writeRegistryFile(this.registryPath, data);
-      }
-    } finally {
-      await release();
-    }
-  }
-};
-var _persistentRegistry;
-function getPersistentProcessRegistry() {
-  if (!_persistentRegistry) {
-    _persistentRegistry = new PersistentProcessRegistry();
-  }
-  return _persistentRegistry;
-}
-
-// src/exec-kill-guard.ts
-var isWin = os3.platform() === "win32";
-async function checkExecKillCommand(cmd, args) {
-  if (!cmd) return { blocked: false };
-  const cmdLower = cmd.toLowerCase().trim();
-  const fullCommand = [cmdLower, ...args].join(" ").replace(/\s+/g, " ").trim();
-  if (isWin) {
-    if (cmdLower === "taskkill" || cmdLower === "taskkill.exe") {
-      const hasForce = args.some((a) => a.toUpperCase() === "/F" || a.toUpperCase() === "-F");
-      const signal = hasForce ? "FORCE" : "TERM";
-      for (let i = 0; i < args.length; i++) {
-        const a = args[i];
-        if (a.toUpperCase() === "/IM" || a.toUpperCase() === "-IM") {
-          const nameArg = args[i + 1];
-          if (nameArg) {
-            const result = await checkKillTarget({ name: nameArg, signal, cmd: fullCommand });
-            if (result.blocked) return result;
-          }
-        }
-      }
-      for (let i = 0; i < args.length; i++) {
-        const a = args[i];
-        if (a.toUpperCase() === "/PID" || a.toUpperCase() === "-PID") {
-          const pidArg = args[i + 1];
-          if (pidArg && /^\d+$/.test(pidArg)) {
-            const result = await checkKillTarget({
-              pid: parseInt(pidArg, 10),
-              signal,
-              cmd: fullCommand
-            });
-            if (result.blocked) return result;
-          }
-        }
-      }
-      for (let i = 0; i < args.length; i++) {
-        const a = args[i];
-        if (a.toUpperCase() === "/FI" || a.toUpperCase() === "-FI") {
-          const filterArg = args[i + 1];
-          if (filterArg) {
-            const nameMatch = filterArg.match(/IMAGENAME\s+eq\s+"?([^"\s]+)/i);
-            if (nameMatch?.[1]) {
-              const result = await checkKillTarget({
-                name: nameMatch[1],
-                signal,
-                cmd: fullCommand
-              });
-              if (result.blocked) return result;
-            }
-          }
-        }
-      }
-      return { blocked: false };
-    }
-    if (cmdLower === "powershell" || cmdLower === "powershell.exe" || cmdLower === "pwsh" || cmdLower === "pwsh.exe" || cmdLower === "cmd" || cmdLower === "cmd.exe") {
-      const shellFlagIndex = args.findIndex((arg) => {
-        const lower = arg.toLowerCase();
-        return lower === "-c" || lower === "-command" || lower === "/c";
-      });
-      if (shellFlagIndex >= 0) {
-        const innerTokens = tokenizeShellCommand(args.slice(shellFlagIndex + 1).join(" "));
-        const innerCommand = innerTokens[0];
-        if (innerCommand) {
-          const result = await checkExecKillCommand(innerCommand, innerTokens.slice(1));
-          if (result.blocked) return result;
-        }
-      }
-    }
-    if (cmdLower === "stop-process" || cmdLower === "kill") {
-      for (let i = 0; i < args.length; i++) {
-        const a = args[i];
-        if (a === "-Name" || a === "-n") {
-          const nameArg = args[i + 1]?.replace(/^['"]|['"]$/g, "");
-          if (nameArg) {
-            const result = await checkKillTarget({
-              name: nameArg,
-              signal: "FORCE",
-              cmd: fullCommand
-            });
-            if (result.blocked) return result;
-          }
-        }
-        if (a === "-Id" || a === "-PID" || a === "-pid") {
-          const pidArg = args[i + 1];
-          if (pidArg && /^\d+$/.test(pidArg)) {
-            const result = await checkKillTarget({
-              pid: parseInt(pidArg, 10),
-              signal: "FORCE",
-              cmd: fullCommand
-            });
-            if (result.blocked) return result;
-          }
-        }
-      }
-      const firstNonFlag = args.find((a) => !a.startsWith("-"));
-      if (firstNonFlag) {
-        const name = firstNonFlag.replace(/^['"]|['"]$/g, "");
-        const result = await checkKillTarget({ name, signal: "TERM", cmd: fullCommand });
-        if (result.blocked) return result;
-      }
-    }
-    if (cmdLower === "wmic" || cmdLower === "wmic.exe") {
-      const joined = args.join(" ").toLowerCase();
-      if (/\bprocess\b/.test(joined) && /\bdelete\b/.test(joined)) {
-        const nameMatch = joined.match(/name\s*=\s*['"]?([^'"]+)/);
-        if (nameMatch?.[1]) {
-          const result = await checkKillTarget({
-            name: nameMatch[1].trim(),
-            signal: "FORCE",
-            cmd: fullCommand
-          });
-          if (result.blocked) return result;
-        }
-        return {
-          blocked: true,
-          reason: "Blocked: wmic process delete targets all matched processes \u2014 would include protected WrongStack processes."
-        };
-      }
-    }
-    if (cmdLower === "node" || cmdLower === "node.exe") {
-      if (args.includes("-e") || args.includes("--eval")) {
-        const evalIdx = args.indexOf("-e") !== -1 ? args.indexOf("-e") : args.indexOf("--eval");
-        const evalCode = args[evalIdx + 1] ?? "";
-        if (/\bprocess\.kill\s*\(/.test(evalCode)) {
-          const pidMatch = evalCode.match(/process\.kill\s*\(\s*(\d+)/);
-          if (pidMatch?.[1]) {
-            const pid = parseInt(pidMatch[1], 10);
-            const result = await checkKillTarget({ pid, signal: "SIGTERM", cmd: fullCommand });
-            if (result.blocked) return result;
-          }
-          return {
-            blocked: true,
-            reason: "Blocked: node -e with process.kill() \u2014 would target protected WrongStack process(es)."
-          };
-        }
-      }
-    }
-  } else {
-    if (cmdLower === "kill") {
-      for (const a of args) {
-        const num = a.replace(/^-/, "");
-        if (/^\d+$/.test(num)) {
-          const pid = parseInt(num, 10);
-          const result = await checkKillTarget({ pid, signal: "SIGTERM", cmd: fullCommand });
-          if (result.blocked) return result;
-        }
-      }
-    }
-    if (cmdLower === "pkill" || cmdLower === "killall") {
-      const firstNonFlag = args.find((a) => !a.startsWith("-"));
-      if (firstNonFlag) {
-        const result = await checkKillTarget({
-          name: firstNonFlag,
-          signal: "SIGTERM",
-          cmd: fullCommand
-        });
-        if (result.blocked) return result;
-      }
-    }
-  }
-  return { blocked: false };
-}
-function tokenizeShellCommand(command) {
-  const tokens = [];
-  let current = "";
-  let quote = null;
-  for (const char of command.trim()) {
-    if (quote) {
-      if (char === quote) quote = null;
-      else current += char;
-      continue;
-    }
-    if (char === '"' || char === "'") {
-      quote = char;
-    } else if (/\s/.test(char)) {
-      if (current) {
-        tokens.push(current);
-        current = "";
-      }
-    } else {
-      current += char;
-    }
-  }
-  if (current) tokens.push(current);
-  return tokens;
-}
-async function checkKillTarget(target) {
-  const registry = getPersistentProcessRegistry();
-  if (target.pid !== void 0) {
-    const blocked = await registry.shouldBlockKill(target.pid);
-    if (blocked) {
-      return {
-        blocked: true,
-        reason: `Blocked: kill ${target.signal} PID ${target.pid} targets a protected WrongStack process (${target.cmd.slice(0, 80)}).`
-      };
-    }
-    if (target.pid === process.pid) {
-      return {
-        blocked: true,
-        reason: "Blocked: cannot kill the current WrongStack process."
-      };
-    }
-    if (target.pid === process.ppid) {
-      return {
-        blocked: true,
-        reason: "Blocked: cannot kill the parent terminal hosting WrongStack."
-      };
-    }
-    return { blocked: false };
-  }
-  if (target.name) {
-    const nameLower = target.name.toLowerCase().replace(/\.exe$/, "");
-    if (nameLower.includes("wrongstack")) {
-      return {
-        blocked: true,
-        reason: `Blocked: kill ${target.signal} '${target.name}' targets a WrongStack process name.`
-      };
-    }
-    const currentImage = path5.basename(process.execPath).toLowerCase().replace(/\.exe$/, "");
-    const targetsNodeRuntime = nameLower === "node" || nameLower.startsWith("node");
-    if (targetsNodeRuntime && currentImage === "node") {
-      return {
-        blocked: true,
-        reason: `Blocked: kill ${target.signal} '${target.name}' would kill the active WrongStack node.exe runtime.`
-      };
-    }
-    const protectedPids = await registry.getAllProtectedPids();
-    if (protectedPids.length > 0 && targetsNodeRuntime) {
-      return {
-        blocked: true,
-        reason: `Blocked: kill ${target.signal} '${target.name}' would kill all node.exe processes including active WrongStack instance(s).`
-      };
-    }
-    return { blocked: false };
-  }
-  return { blocked: false };
-}
-
-// src/exec-allowlist.ts
-var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
-  // JS / TS toolchain
-  "node",
-  "npm",
-  "pnpm",
-  "yarn",
-  "npx",
-  "bun",
-  "deno",
-  "corepack",
-  "tsc",
-  "tsx",
-  "ts-node",
-  "vite",
-  "vitest",
-  "jest",
-  "biome",
-  "eslint",
-  "prettier",
-  "turbo",
-  "nx",
-  "webpack",
-  "rollup",
-  "parcel",
-  "next",
-  "astro",
-  "playwright",
-  "cypress",
-  // version control
-  "git",
-  // Rust
-  "cargo",
-  "rustc",
-  // Go
-  "go",
-  // Python
-  "python",
-  "python3",
-  "pip",
-  "pip3",
-  "pytest",
-  "ruff",
-  "mypy",
-  "uv",
-  "uvx",
-  "poetry",
-  "hatch",
-  "tox",
-  // Ruby
-  "ruby",
-  "gem",
-  "bundle",
-  // PHP
-  "php",
-  "composer",
-  "phpunit",
-  // JVM
-  "java",
-  "javac",
-  "mvn",
-  "gradle",
-  "gradlew",
-  // .NET
-  "dotnet",
-  // C / C++ / native build
-  "make",
-  "cmake",
-  "ninja",
-  "clang",
-  "clang-cl",
-  "gcc",
-  "g++",
-  "link",
-  "msbuild",
-  // containers / orchestration
-  "docker",
-  "podman",
-  "kubectl",
-  // network fetch tools. Per-arg safety is NOT enforced by BLOCKED_ARG_PATTERNS
-  // (no curl/wget entries) — the real boundary is the per-call `confirm`
-  // permission gate (exec.ts permission:'confirm', subjectKey:'command'),
-  // the `pipe-to-shell` danger rule, and the kill guard. The allowlist is a
-  // guidance layer, not a security boundary on its own.
-  "curl",
-  "wget",
-  // common POSIX file/text utilities
-  "pwd",
-  "ls",
-  "cat",
-  "head",
-  "tail",
-  "wc",
-  "grep",
-  "rg",
-  "find",
-  "echo",
-  "sort",
-  "uniq",
-  "sed",
-  "awk",
-  "mkdir",
-  "cp",
-  "mv",
-  "rm",
-  "touch",
-  "tar",
-  // Windows-native tooling (win32). All non-destructive binaries; per-arg
-  // safety is still enforced by BLOCKED_ARG_PATTERNS + the destructive-ops
-  // gate in bash-kill-guard.ts. `gh` is included even though it lives at
-  // "C:\Program Files\GitHub CLI\gh.exe" — resolveWin32Command handles the
-  // space in the path.
-  "gh",
-  "where",
-  "tasklist",
-  "systeminfo",
-  "wmic",
-  "sc",
-  "netstat",
-  "ipconfig",
-  "nslookup",
-  "tracert",
-  "pathping",
-  // Windows shell interpreters. Without these, `exec` cannot run cmd builtins
-  // (`dir`, `type`, `copy`, …) or any PowerShell cmdlet on Windows — a major
-  // gap since those are the platform's primary shells. Arbitrary execution
-  // through `cmd /c …` / `powershell -c …` is NOT a new hole: the permission
-  // policy reconstructs the full command line (shellCommandLineFromInput) and
-  // still runs it through the YOLO destructive classifier, so a genuinely
-  // destructive `cmd /c del /s /q C:\…` continues to require confirmation.
-  "cmd",
-  "cmd.exe",
-  "powershell",
-  "powershell.exe",
-  "pwsh",
-  "pwsh.exe",
-  // [core] Extended default allowlist (added 4b3d18d1 + this commit). Broadly
-  // used dev binaries — NOT all non-destructive: this section contains
-  // process/system tools (kill, chown, mount, userdel), network scanners
-  // (nmap, masscan, zmap, nuclei), and launchers (env, perl, timeout, tmux).
-  // The real safety boundary for these is the per-call `confirm` permission
-  // gate (exec.ts permission:'confirm', subjectKey:'command' renders the full
-  // invocation) plus the danger rules in _danger-detect.ts. Per-arg hard-deny
-  // is still enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts, but only
-  // for the commands that have entries there (git, find, rm).
-  // --- Archives & compression ---
-  "7z",
-  "7za",
-  "bzip2",
-  "gzip",
-  "xz",
-  "unzip",
-  "zip",
-  "gtar",
-  "bsdtar",
-  "star",
-  "pax",
-  "cpio",
-  // --- Android / mobile dev ---
-  "adb",
-  "fastboot",
-  "sdkmanager",
-  // --- DevOps / config mgmt ---
-  "ansible",
-  "ansible-playbook",
-  "ansible-vault",
-  "ansible-lint",
-  "ansible-galaxy",
-  "molecule",
-  // --- Cloud CLIs ---
-  "aws",
-  "aws-vault",
-  "awslocal",
-  "az",
-  "azcopy",
-  "gcloud",
-  "gsutil",
-  "doctl",
-  "linode-cli",
-  // --- Native / C / C++ / linker tools ---
-  "clang++",
-  "clang-format",
-  "clang-tidy",
-  "clangd",
-  "lld",
-  "lldb",
-  "ctest",
-  "gmake",
-  "meson",
-  "conan",
-  "vcpkg",
-  "cl",
-  "rc",
-  "mt",
-  "dumpbin",
-  "dotnet-format",
-  // --- Image / media / binary tools ---
-  "convert",
-  "ffmpeg",
-  "ffprobe",
-  "magick",
-  "gs",
-  "exiftool",
-  // --- HTTP / fetch ---
-  "wget2",
-  "aria2c",
-  "axel",
-  "httpie",
-  "hey",
-  "ab",
-  "wrk",
-  "http",
-  // --- Diff / patch / merge ---
-  "diff",
-  "diff3",
-  "patch",
-  "meld",
-  "kdiff3",
-  "kompare",
-  // --- Encoding / file inspection ---
-  "dos2unix",
-  "unix2dos",
-  "iconv",
-  "file",
-  "stat",
-  "xxd",
-  "hexdump",
-  "od",
-  "base64",
-  // --- SSH / crypto / signing ---
-  "ssh",
-  "ssh-add",
-  "ssh-keygen",
-  "ssh-keyscan",
-  "scp",
-  "sftp",
-  "rsync",
-  "gpg",
-  "gpg2",
-  "gpg-agent",
-  "openssl",
-  "step",
-  "keytool",
-  // --- Search ---
-  "egrep",
-  "fgrep",
-  "ag",
-  "ack",
-  "sift",
-  "ugrep",
-  "fd",
-  "fdfind",
-  "jq",
-  "yq",
-  "xq",
-  "fx",
-  "gron",
-  // --- K8s / container ecosystem ---
-  "kubectl.exe",
-  "kubeadm",
-  "kubelet",
-  "helm",
-  "k9s",
-  "kustomize",
-  "skaffold",
-  "tilt",
-  "minikube",
-  "kind",
-  "k3d",
-  "k3s",
-  "docker-compose",
-  "buildah",
-  "skopeo",
-  "nerdctl",
-  "ctr",
-  "ctr.exe",
-  // --- Databases ---
-  "sqlite3",
-  "sqlite",
-  "psql",
-  "pg_dump",
-  "pg_restore",
-  "mysql",
-  "mysqladmin",
-  "mysqldump",
-  "mariadb",
-  "mariadb-dump",
-  "redis-cli",
-  "redis-server",
-  "memcached",
-  "etcdctl",
-  "consul",
-  "vault",
-  "nomad",
-  "mongosh",
-  "mongo",
-  "mongoexport",
-  "mongoimport",
-  "mongodump",
-  "mongorestore",
-  // --- Windows extended (read-mostly ops) ---
-  "taskkill",
-  "gpupdate",
-  "gpresult",
-  "hostname",
-  "whoami",
-  "who",
-  "net",
-  "net1",
-  // --- VCS ecosystem ---
-  "glab",
-  "hub",
-  "tea",
-  "git-lfs",
-  "tig",
-  "lazygit",
-  // --- POSIX text utilities (extended) ---
-  "gawk",
-  "tr",
-  "cut",
-  "paste",
-  "join",
-  "comm",
-  "expand",
-  "unexpand",
-  "fold",
-  "fmt",
-  "nl",
-  "pr",
-  "column",
-  "tsort",
-  "tty",
-  "ul",
-  "units",
-  "factor",
-  "seq",
-  "shuf",
-  "look",
-  "yes",
-  "true",
-  "false",
-  "test",
-  "[",
-  "printf",
-  "env",
-  "tree",
-  "locate",
-  "which",
-  "whereis",
-  // NOTE: shell builtins with no standalone binary (type, hash, pushd,
-  // popd, dirs, history, fc, jobs, bg, fg, wait, ulimit, umask, trap,
-  // exit, return, source, ., alias, unalias, set, unset, export, readonly,
-  // typeset, declare, local, eval, exec) are intentionally excluded —
-  // spawn() would fail with ENOENT on every platform because they only
-  // exist inside a shell process. Use the `bash` tool for builtins.
-  "nice",
-  "nohup",
-  "timeout",
-  "time",
-  // --- Process / system inspection ---
-  "htop",
-  "top",
-  "atop",
-  "glances",
-  "iotop",
-  "nethogs",
-  "iftop",
-  "lsof",
-  "strace",
-  "ltrace",
-  "sysstat",
-  "vmstat",
-  "iostat",
-  "mpstat",
-  "sar",
-  "free",
-  "df",
-  "du",
-  "mount",
-  "umount",
-  "lsblk",
-  "blkid",
-  "kill",
-  "killall",
-  "pkill",
-  "pgrep",
-  "pidof",
-  "ps",
-  "ps.exe",
-  // --- Network inspection ---
-  "ip",
-  "ss",
-  "route",
-  "arp",
-  "arping",
-  "ping",
-  "ping6",
-  "hping3",
-  "mtr",
-  "tracepath",
-  "tcpdump",
-  "nmap",
-  "netcat",
-  "nc",
-  "ncat",
-  "socat",
-  // --- Sync / backup ---
-  "rclone",
-  "restic",
-  "borg",
-  "duplicati",
-  "duplicacy",
-  "syncthing",
-  "syncthing-cli",
-  // --- Permissions / users / ACLs (POSIX) ---
-  "useradd",
-  "userdel",
-  "usermod",
-  "groupadd",
-  "groupdel",
-  "groupmod",
-  "chown",
-  "chmod",
-  "chgrp",
-  "getfacl",
-  "setfacl",
-  "setcap",
-  "getcap",
-  // --- Crypto / cert mgmt (extended) ---
-  "certbot",
-  "mkcert",
-  "jarsigner",
-  // --- Editors ---
-  "subl",
-  "code",
-  "code-insiders",
-  "cursor",
-  "atom",
-  "nano",
-  "vim",
-  "nvim",
-  "vi",
-  "emacs",
-  "helix",
-  "hx",
-  "micro",
-  "jed",
-  "ed",
-  "ex",
-  "mg",
-  // --- Terminal multiplexers ---
-  "asciinema",
-  "script",
-  "scriptreplay",
-  "expect",
-  "screen",
-  "tmux",
-  "byobu",
-  "dtach",
-  "abduco",
-  // --- Calculators / REPLs / scientific ---
-  "bc",
-  "dc",
-  "calc",
-  "qalc",
-  "genius",
-  "octave",
-  "R",
-  "Rscript",
-  "julia",
-  "irb",
-  "pry",
-  "ghci",
-  "stack",
-  "cabal",
-  "ghc",
-  // --- PHP / Lua / Perl / Ruby ecosystem (extended) ---
-  "php8",
-  "php7",
-  "phpcs",
-  "phpcbf",
-  "phpmd",
-  "phpstan",
-  "psalm",
-  "lua",
-  "lua5.1",
-  "lua5.2",
-  "lua5.3",
-  "lua5.4",
-  "luarocks",
-  "perl",
-  "cpan",
-  "prove",
-  "plackup",
-  "rake",
-  "rspec",
-  "jekyll",
-  "node-gyp",
-  "node-pre-gyp",
-  // --- JS / TS toolchain (extended) ---
-  "electron",
-  "electron-builder",
-  "electron-forge",
-  "vite-preview",
-  "swc",
-  "swc-cli",
-  "swcpack",
-  "mocha",
-  "chai",
-  "jasmine",
-  "puppeteer",
-  "lighthouse",
-  // --- Linters / formatters (extended) ---
-  "tslint",
-  "stylelint",
-  "htmlhint",
-  "jshint",
-  "jslint",
-  "jscs",
-  // --- Document conversion ---
-  "pandoc",
-  "weasyprint",
-  "wkhtmltopdf",
-  "wkhtmltoimage",
-  "prince",
-  "mdp",
-  "markdown",
-  "multimarkdown",
-  "cmark",
-  "cmark-gfm",
-  // --- Office / spreadsheet ---
-  "soffice",
-  "libreoffice",
-  "unoconv",
-  "abiword",
-  "gnumeric",
-  // --- Spell / grammar ---
-  "aspell",
-  "hunspell",
-  "enchant",
-  "languagetool",
-  // --- Source-highlight / diff tools ---
-  "delta",
-  "bat",
-  "ccat",
-  "hl",
-  "highlight",
-  "source-highlight",
-  "ansifilter",
-  // --- Job schedulers ---
-  "pueue",
-  "task-spooler",
-  "ts",
-  "at",
-  "atd",
-  "anacron",
-  "fcron",
-  "cronie",
-  "systemd-run",
-  "systemd-cat",
-  // --- Plotting / visualization ---
-  "gnuplot",
-  "gnuplot-nox",
-  "veusz",
-  "scidavis",
-  "grace",
-  "xmgrace",
-  "labplot",
-  // --- Security / recon (network + web) ---
-  "masscan",
-  "zmap",
-  "rustscan",
-  "amass",
-  "subfinder",
-  "httpx",
-  "nuclei",
-  "naabu",
-  "katana",
-  "dnsx",
-  "assetfinder",
-  "findomain",
-  "gau",
-  "waybackurls",
-  "httprobe",
-  "meg",
-  "subjack",
-  "sublert",
-  "chaos"
-]);
-
-// src/exec.ts
-var isWin2 = process.platform === "win32";
-var allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
-var normalizeCmd = (c) => c.trim();
-function configureExecPolicy(opts = {}) {
-  const next = new Set(DEFAULT_ALLOWED_COMMANDS);
-  for (const c of opts.allow ?? []) {
-    const n = normalizeCmd(c);
-    if (n) next.add(n);
-  }
-  for (const c of opts.deny ?? []) next.delete(normalizeCmd(c));
-  allowedCommands = next;
-}
-function resetExecPolicy() {
-  allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
-}
-var dangerBypass = /* @__PURE__ */ new Set();
-function configureDangerBypass(opts = {}) {
-  const next = /* @__PURE__ */ new Set();
-  for (const id of opts.bypass ?? []) {
-    const trimmed = id.trim();
-    if (trimmed) next.add(trimmed);
-  }
-  dangerBypass = next;
-}
-function resetDangerBypass() {
-  dangerBypass = /* @__PURE__ */ new Set();
-}
-function getDangerBypass() {
-  return dangerBypass;
-}
-function isExecCommandAllowed(cmd) {
-  return allowedCommands.has(normalizeCmd(cmd));
-}
-function getExecAllowlist() {
-  return [...allowedCommands].sort();
-}
-var MAX_ARGS = 20;
-var MAX_OUTPUT = 2e5;
-var DEFAULT_TIMEOUT_MS = 3e4;
-var MAX_TIMEOUT_MS = 6e5;
-var BLOCKED_ARG_PATTERNS = {
-  python: [],
-  // git --exec=<cmd> runs arbitrary commands via upload-pack/receive-pack;
-  // -C <dir> changes working directory, bypassing cwd sandbox;
-  // -c/--config <k>=<v> injects config that runs commands
-  // (e.g. core.sshCommand, core.pager, http.proxy, alias.x=!cmd).
-  git: [
-    /^--exec=/,
-    /^--upload-pack=/,
-    /^--receive-pack=/,
-    /^-C$/,
-    /^-c$/,
-    /^--config$/,
-    /^-c=/,
-    /^--config=/,
-    /^--config-env=/
-  ],
-  node: [],
-  go: [],
-  bun: [],
-  docker: [],
-  // find -exec/-ok/-execdir execute arbitrary commands
-  find: [
-    /^-exec$/,
-    /^-exec;$/,
-    /^-ok$/,
-    /^-ok;$/,
-    /^-execdir$/,
-    /^-execdir;$/,
-    /^-exec=/,
-    /^-ok=/,
-    /^-execdir=/
-  ],
-  // rm -rf / is catastrophic — block absolute paths, home, dot-dirs,
-  // and glob patterns that could expand to dangerous targets.
-  // `rm -rf ./src/*` expands to project files; `rm -rf ../../` escapes upward;
-  // `rm -rf /*` targets the filesystem root. All are blocked.
-  rm: [/^\//, /^[A-Za-z]:[\\/]/, /^~\//, /^~$/, /^\.$/, /^\.\.$/, /\*$/, /\/$/, /\/\*$/, /\.\//],
-  // npm/pnpm subcommands are checked separately below. Matching every arg here
-  // over-blocked normal dev flows such as `pnpm vitest run ...`.
-  npm: [],
-  pnpm: [],
-  npx: []
-};
-var BLOCKED_OPTION_NAMES = {
-  git: /* @__PURE__ */ new Set([
-    "--exec",
-    "--upload-pack",
-    "--receive-pack",
-    "--exec-path",
-    "--git-dir",
-    "--work-tree",
-    "--namespace",
-    "-c",
-    "--config",
-    "--config-env",
-    "-C"
-  ]),
-  find: /* @__PURE__ */ new Set(["-exec", "-ok", "-execdir"])
-};
-function optionName(arg) {
-  const eq = arg.indexOf("=");
-  return eq > 0 ? arg.slice(0, eq) : arg;
-}
-var BLOCKED_SUBCOMMANDS = {
-  docker: /* @__PURE__ */ new Set(["push"]),
-  podman: /* @__PURE__ */ new Set(["push"]),
-  npm: /* @__PURE__ */ new Set(["publish", "deploy"]),
-  pnpm: /* @__PURE__ */ new Set(["publish", "deploy"]),
-  yarn: /* @__PURE__ */ new Set(["publish"])
-};
-var BLOCKED_SUBCOMMAND_SEQUENCES = {
-  yarn: [["npm", "publish"]]
-};
-function firstSubcommand(args) {
-  for (const arg of args) {
-    if (arg === "--") return null;
-    if (!arg.startsWith("-")) return arg;
-  }
-  return null;
-}
-function subcommandArgs(args) {
-  const out = [];
-  for (const arg of args) {
-    if (arg === "--") break;
-    if (!arg.startsWith("-")) out.push(arg);
-  }
-  return out;
-}
-function validateArgs(cmd, args) {
-  const blockedSubcommands = BLOCKED_SUBCOMMANDS[cmd];
-  const subcommand = firstSubcommand(args);
-  if (blockedSubcommands && subcommand && blockedSubcommands.has(subcommand)) {
-    return `Blocked subcommand "${subcommand}" for command "${cmd}"`;
-  }
-  const blockedSequences = BLOCKED_SUBCOMMAND_SEQUENCES[cmd];
-  if (blockedSequences) {
-    const actual = subcommandArgs(args);
-    const blocked2 = blockedSequences.find((seq) => seq.every((part, idx) => actual[idx] === part));
-    if (blocked2) return `Blocked subcommand "${blocked2.join(" ")}" for command "${cmd}"`;
-  }
-  const blockedOptions = BLOCKED_OPTION_NAMES[cmd];
-  if (blockedOptions) {
-    for (const arg of args) {
-      if (arg === "--") break;
-      if (blockedOptions.has(optionName(arg))) {
-        return `Blocked option "${optionName(arg)}" for command "${cmd}"`;
-      }
-    }
-  }
-  const blocked = BLOCKED_ARG_PATTERNS[cmd];
-  if (!blocked) return null;
-  for (const arg of args) {
-    for (const pattern of blocked) {
-      if (pattern.test(arg)) {
-        return `Blocked argument "${arg}" for command "${cmd}" (matches security pattern ${pattern})`;
-      }
-    }
-  }
-  return null;
-}
-var SAFE_DANGER = { level: "safe", reasons: [] };
-var execTool = {
-  name: "exec",
-  category: "Shell",
-  description: "Execute a command from a **curated command roster** with argument validation and confirm gating. This is the **preferred** alternative to the `bash` tool for running development tools (node, npm, pnpm, tsc, git, tests, linters, etc.). It is NOT a sandbox \u2014 several rostered commands (node, python, powershell, \u2026) can run arbitrary code \u2014 so prefer least-privilege commands.",
-  usageHint: "PREFERRED SHELL TOOL for most cases.\n\nUse this instead of `bash` whenever possible.\n- `command` must be in the allowlist. Defaults cover JS (node/npm/pnpm/yarn/bun/deno/tsc/vitest/eslint/biome), Go (`go build`/`go test`), Rust (cargo), Python (python/pip), Ruby (gem/bundle), JVM (java/mvn/gradle), .NET (dotnet), native (make/cmake), and git. Users can extend it via `tools.exec.allow` in config.\n- Arguments are passed as a clean array (no shell interpretation).\n- `cwd` is validated to stay inside the project.\n- If a command is not allowlisted, the error explains how to add it; for one-off arbitrary commands, fall back to `bash` (with strong justification).\nThe curated roster + confirm gating narrows the surface compared to full shell access, but this is not a sandbox \u2014 prefer least-privilege commands.",
-  selection: {
-    doNotUseWhen: "the operation requires pipes, redirection, shell expansion, or a non-allowlisted command.",
-    useInstead: ["bash"]
-  },
-  permission: "confirm",
-  // WS-046: without this, every exec call collapsed onto the bare tool name.
-  // Three consequences followed: "always allow" stored a rule that could never
-  // match, pressing "no" once blocked ALL exec for the session, and the
-  // permission cache keyed one decision for every command. `subjectKey:
-  // 'command'` renders the FULL invocation (`command` + `args`) — using the
-  // program alone would make `exec git status` and `exec git push --force` the
-  // same subject, so trusting one would silently authorize the other.
-  subjectKey: "command",
-  mutating: true,
-  riskTier: "standard",
-  // Executor-level abort ceiling. Must sit ABOVE the per-call timeout ceiling
-  // (MAX_TIMEOUT_MS): the tool's own timer resolves with exit 124 + registry
-  // tree-kill; the executor's AbortSignal.timeout is a blunt abort that would
-  // otherwise fire first and discard the structured timeout result. The 10s
-  // margin covers the kill/teardown window. (The executor additionally clamps
-  // to config `tools.maxToolTimeoutMs`.)
-  timeoutMs: MAX_TIMEOUT_MS + 1e4,
-  capabilities: ["shell.restricted"],
-  icon: "terminal",
-  inputSchema: {
-    type: "object",
-    properties: {
-      command: {
-        type: "string",
-        description: 'The base command to run. Must be in the internal allowlist (e.g. "node", "pnpm", "git", "tsc").'
-      },
-      args: {
-        type: "array",
-        items: { type: "string" },
-        description: "Arguments passed to the command. Passed as an array (no shell parsing)."
-      },
-      cwd: {
-        type: "string",
-        description: "Optional working directory. Must resolve inside the project root."
-      },
-      timeout: {
-        type: "integer",
-        description: "Per-command timeout in milliseconds (default 30000, max 600000)."
-      }
-    },
-    required: ["command"]
-  },
-  async execute(input, ctx, opts) {
-    const registry = getProcessRegistry();
-    if (!registry.canProceed) {
-      return {
-        command: input.command,
-        args: input.args ?? [],
-        stdout: "",
-        stderr: "Circuit breaker is open \u2014 too many consecutive failures. Use /kill reset to recover.",
-        exitCode: 1,
-        truncated: false,
-        allowed: false,
-        danger: SAFE_DANGER
-      };
-    }
-    const cmd = input.command.trim();
-    if (!cmd)
-      return {
-        command: cmd,
-        args: [],
-        stdout: "",
-        stderr: "Empty command",
-        exitCode: 1,
-        truncated: false,
-        allowed: false,
-        danger: SAFE_DANGER
-      };
-    if (!isExecCommandAllowed(cmd)) {
-      return {
-        command: cmd,
-        args: input.args ?? [],
-        stdout: "",
-        stderr: `Command "${cmd}" not in allowlist. Add it to your active profile config (~/.wrongstack/profiles/<name>/config.json) under "tools": { "exec": { "allow": ["${cmd}"] } }, or use the bash tool for one-off arbitrary commands.`,
-        exitCode: 1,
-        truncated: false,
-        allowed: false,
-        danger: SAFE_DANGER
-      };
-    }
-    const args = (input.args ?? []).slice(0, MAX_ARGS);
-    const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS));
-    const danger = detectDanger(cmd, args, dangerBypass);
-    const killCheck = await checkExecKillCommand(cmd, args);
-    if (killCheck.blocked) {
-      return {
-        command: cmd,
-        args,
-        stdout: "",
-        stderr: killCheck.reason ?? "Kill command blocked: targets a protected WrongStack process.",
-        exitCode: 1,
-        truncated: false,
-        allowed: false,
-        danger
-      };
-    }
-    const argError = validateArgs(cmd, args);
-    if (argError) {
-      return {
-        command: cmd,
-        args,
-        stdout: "",
-        stderr: argError,
-        exitCode: 1,
-        truncated: false,
-        allowed: false,
-        danger
-      };
-    }
-    const defaultCwd = ctx.workingDir ?? ctx.cwd;
-    let cwd;
-    try {
-      cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : await safeResolveReal(defaultCwd, ctx);
-    } catch {
-      return {
-        command: cmd,
-        args,
-        stdout: "",
-        stderr: `cwd "${input.cwd ?? defaultCwd}" resolves outside project root`,
-        exitCode: 1,
-        truncated: false,
-        allowed: false,
-        danger
-      };
-    }
-    const signal = opts.signal;
-    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id, danger);
-  }
-};
-function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
-  return new Promise((resolve2) => {
-    let stdout = "";
-    let stderr = "";
-    let killed = false;
-    const resolvedOnce = { value: false };
-    const finish = (result) => {
-      if (resolvedOnce.value) return;
-      resolvedOnce.value = true;
-      resolve2(result);
-    };
-    const startedAt = Date.now();
-    let stdoutBytes = 0;
-    let stderrBytes = 0;
-    let telemetryCompleted = false;
-    let timedOut = false;
-    const spool = createOutputSpool({ tool: `exec-${cmd}`, thresholdBytes: MAX_OUTPUT });
-    const resolved = resolveWin32Command(cmd);
-    const needsShell = isWin2 && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
-    const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
-    const spawnCmd = shim?.command ?? resolved;
-    const spawnArgs = shim?.args ?? args;
-    const emitCompletedOnce = (exitCode, pid2, signal2) => {
-      if (telemetryCompleted) return;
-      telemetryCompleted = true;
-      emitProcessCompleted({
-        ...pid2 !== void 0 ? { pid: pid2 } : {},
-        exitCode,
-        ...signal2 ? { signal: signal2 } : {},
-        durationMs: Date.now() - startedAt,
-        stdoutBytes,
-        stderrBytes,
-        timedOut,
-        endedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-    };
-    let child;
-    try {
-      child = spawn2(spawnCmd, spawnArgs, {
-        cwd,
-        env: buildChildEnv(sessionId),
-        stdio: ["ignore", "pipe", "pipe"],
-        windowsHide: true,
-        ...isWin2 ? {} : { signal },
-        ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
-      });
-    } catch (err) {
-      spool.finalize();
-      emitProcessStarted({
-        parentPid: process.pid,
-        command: redactCommand(`${cmd} ${args.join(" ")}`),
-        args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
-        cwd,
-        background: false,
-        startedAt: new Date(startedAt).toISOString()
-      });
-      emitCompletedOnce(1, void 0);
-      finish({
-        command: cmd,
-        args,
-        stdout: "",
-        stderr: `spawn failed: ${toErrorMessage2(err)}`,
-        exitCode: 1,
-        truncated: false,
-        allowed: true,
-        danger
-      });
-      return;
-    }
-    emitProcessStarted({
-      ...child.pid !== void 0 ? { pid: child.pid } : {},
-      parentPid: process.pid,
-      command: redactCommand(`${cmd} ${args.join(" ")}`),
-      args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
-      cwd,
-      background: false,
-      startedAt: new Date(startedAt).toISOString()
-    });
-    child.on("error", (err) => {
-      const isAbort = err && err.code === "ABORT_ERR";
-      const stderrText = isAbort ? `Aborted: ${err.message}` : err.message;
-      clearTimeout(timer);
-      if (isWin2) signal.removeEventListener("abort", onAbort);
-      if (typeof pid === "number") registry.unregister(pid);
-      registry.afterCall(Date.now() - startedAt, true);
-      spool.finalize();
-      emitCompletedOnce(isAbort ? 124 : 1, child.pid, isAbort ? "ABORT" : void 0);
-      finish({
-        command: cmd,
-        args,
-        stdout: normalizeCommandOutput(stdout),
-        stderr: stderrText,
-        exitCode: isAbort ? 124 : 1,
-        truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES,
-        allowed: true,
-        danger
-      });
-    });
-    const registry = getProcessRegistry();
-    const pid = child.pid;
-    if (typeof pid === "number") {
-      const fullCommand = `${cmd} ${args.join(" ")}`;
-      registry.register({
-        pid,
-        name: "exec",
-        command: redactCommand(fullCommand),
-        startedAt: Date.now(),
-        sessionId,
-        child
-      });
-    }
-    const timer = setTimeout(() => {
-      killed = true;
-      timedOut = true;
-      if (typeof pid === "number") registry.kill(pid);
-      else child.kill("SIGTERM");
-    }, timeout);
-    const onAbort = () => {
-      killed = true;
-      if (typeof pid === "number") registry.kill(pid, { force: true });
-      else child.kill("SIGTERM");
-    };
-    if (isWin2) {
-      if (signal.aborted) onAbort();
-      else signal.addEventListener("abort", onAbort, { once: true });
-    }
-    child.stdout?.on("data", (chunk) => {
-      const text = chunk.toString();
-      stdoutBytes += chunk.byteLength;
-      emitProcessOutput({ pid, stream: "stdout", chunk });
-      if (stdout.length < MAX_OUTPUT) stdout += text;
-      spool.write(text);
-    });
-    child.stderr?.on("data", (chunk) => {
-      const text = chunk.toString();
-      stderrBytes += chunk.byteLength;
-      emitProcessOutput({ pid, stream: "stderr", chunk });
-      if (stderr.length < MAX_OUTPUT) stderr += text;
-      spool.write(text);
-    });
-    child.on("close", (code) => {
-      clearTimeout(timer);
-      if (isWin2) signal.removeEventListener("abort", onAbort);
-      if (typeof pid === "number") registry.unregister(pid);
-      const durationMs = Date.now() - startedAt;
-      const exitCode = killed ? 124 : code ?? 1;
-      emitCompletedOnce(exitCode, pid);
-      registry.afterCall(durationMs, exitCode !== 0);
-      const spooled = spool.finalize();
-      finish({
-        command: cmd,
-        args,
-        stdout: normalizeCommandOutput(stdout) + (spooled ? spoolNote(spooled) : ""),
-        stderr: normalizeCommandOutput(stderr),
-        exitCode,
-        truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES || Buffer.byteLength(stderr, "utf8") > COMMAND_OUTPUT_MAX_BYTES,
-        allowed: true,
-        danger
-      });
-    });
-  });
-}
+  configureDangerBypass,
+  configureExecPolicy,
+  execTool,
+  getDangerBypass,
+  getExecAllowlist,
+  isExecCommandAllowed,
+  resetDangerBypass,
+  resetExecPolicy
+} from "./chunk-T2F4S7U4.js";
+import "./chunk-BTSFTGIL.js";
+import "./chunk-NKNOBUBU.js";
+import "./chunk-2VSZC6QM.js";
+import "./chunk-3PVYQFRQ.js";
+import "./chunk-HFXSNKCV.js";
+import "./chunk-V43EQ6VR.js";
+import "./chunk-D33S4RQG.js";
 export {
   configureDangerBypass,
   configureExecPolicy,