@wrongstack/tools 0.8.4 → 0.8.6

package/dist/git.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/git.ts"],"names":[],"mappings":";;;;;;AAkDA,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,UAAA,GAAa,GAAA;AAEZ,IAAM,OAAA,GAAqC;AAAA,EAChD,IAAA,EAAM,KAAA;AAAA,EACN,QAAA,EAAU,KAAA;AAAA,EACV,WAAA,EACE,oIAAA;AAAA,EACF,SAAA,EACE,mKAAA;AAAA,EACF,UAAA,EAAY,SAAA;AAAA;AAAA;AAAA;AAAA,EAIZ,QAAA,EAAU,IAAA;AAAA,EACV,SAAA,EAAW,UAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM;AAAA,UACJ,QAAA;AAAA,UACA,KAAA;AAAA,UACA,MAAA;AAAA,UACA,QAAA;AAAA,UACA,QAAA;AAAA,UACA,UAAA;AAAA,UACA,OAAA;AAAA,UACA,MAAA;AAAA,UACA,MAAA;AAAA,UACA,OAAA;AAAA,UACA,OAAA;AAAA,UACA;AAAA,SACF;AAAA,QACA,WAAA,EAAa;AAAA,OACf;AAAA,MACA,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EACE;AAAA,OACJ;AAAA,MACA,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,sCAAA,EAAuC;AAAA,MAC/E,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,iCAAA,EAAkC;AAAA,MACzE,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,OAAA,EAAS,SAAA,EAAW,QAAQ,OAAO,CAAA;AAAA,QAC1C,WAAA,EAAa;AAAA,OACf;AAAA,MACA,KAAA,EAAO,EAAE,IAAA,EAAM,SAAA,EAAW,aAAa,6BAAA,EAA8B;AAAA,MACrE,OAAA,EAAS,EAAE,IAAA,EAAM,SAAA,EAAW,aAAa,0CAAA,EAA2C;AAAA,MACpF,cAAA,EAAgB;AAAA,QACd,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,MAAA,EAAQ,KAAA,EAAO,UAAU,OAAO,CAAA;AAAA,QACvC,WAAA,EAAa;AAAA,OACf;AAAA,MACA,YAAA,EAAc;AAAA,QACZ,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,SAAA,EAAW;AAAA,QACT,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA;AACf,KACF;AAAA,IACA,QAAA,EAAU,CAAC,SAAS;AAAA,GACtB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,CAAC,KAAA,EAAO,OAAA,EAAS,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAE/D,IAAA,IAAI,KAAA,CAAM,OAAA,KAAY,QAAA,IAAY,CAAC,MAAM,OAAA,EAAS;AAChD,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,QAAA;AAAA,QACT,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,yCAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW;AAAA,OACb;AAAA,IACF;AAIA,IAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,GAAA,EAAK,IAAI,WAAW,CAAA;AAClD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO;AAAA,QACL,SAAS,KAAA,CAAM,OAAA;AAAA,QACf,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,+CAAA;AAAA,QACR,QAAA,EAAU,GAAA;AAAA,QACV,SAAA,EAAW;AAAA,OACb;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,UAAU,KAAK,CAAA;AAC5B,IAAA,OAAO,MAAM,MAAA,CAAO,IAAA,EAAM,MAAA,EAAQ,KAAK,MAAM,CAAA;AAAA,EAC/C;AACF;AAEA,SAAS,UAAA,CAAW,KAAa,WAAA,EAAoC;AACnE,EAAA,MAAM,IAAA,GAAO,WAAA;AACb,EAAA,IAAI,GAAA,GAAM,GAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA,KAAA,CAAO,CAAA;AACnC,MAAA,IAAI,IAAA,CAAK,WAAA,EAAY,EAAG,OAAO,GAAA;AAAA,IACjC,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAI,QAAQ,IAAA,EAAM;AAClB,IAAA,MAAM,MAAA,GAAS,QAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,UAAU,KAAA,EAA2B;AAC5C,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,EAAA;AAC7B,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,GAAA,CACf,KAAA,CAAM,OAAA,CAAQ,MAAM,KAAK,CAAA,GAAI,KAAA,CAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,MAAM,GAAG,CAAA,EAC9D,GAAA,CAAI,CAAC,CAAA,KAAc,CAAA,CAAE,IAAA,EAAM,CAAA,CAC3B,MAAA,CAAO,OAAO,CAAA,GACjB,EAAC;AAEL,EAAA,QAAQ,MAAM,OAAA;AAAS,IACrB,KAAK,QAAA;AACH,MAAA,OAAO,CAAC,QAAA,EAAU,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,IAAA,EAAM,GAAG,KAAK,CAAA,GAAI,EAAG,CAAA;AAAA,IAC7D,KAAK,KAAA;AACH,MAAA,OAAO;AAAA,QACL,KAAA;AAAA,QACA,eAAe,KAAK,CAAA,CAAA;AAAA,QACpB,GAAI,KAAA,CAAM,MAAA,KAAW,YAAY,CAAC,WAAW,IAAI,EAAC;AAAA,QAClD,GAAI,KAAA,CAAM,MAAA,KAAW,SAAS,CAAC,QAAQ,IAAI,EAAC;AAAA,QAC5C,GAAI,MAAM,MAAA,KAAW,OAAA,GAAU,CAAC,WAAA,EAAa,SAAA,EAAW,YAAY,CAAA,GAAI,EAAC;AAAA,QACzE,GAAI,MAAM,MAAA,KAAW,OAAA,IAAW,CAAC,KAAA,CAAM,MAAA,GAAS,EAAC,GAAI;AAAC,OACxD;AAAA,IACF,KAAK,MAAA;AACH,MAAA,OAAO,CAAC,MAAA,EAAQ,YAAA,EAAc,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,IAAA,EAAM,GAAG,KAAK,CAAA,GAAI,EAAG,CAAA;AAAA,IACzE,KAAK,QAAA;AACH,MAAA,OAAO;AAAA,QACL,QAAA;AAAA,QACA,GAAI,KAAA,CAAM,OAAA,GAAU,CAAC,WAAA,EAAa,aAAa,IAAI,EAAC;AAAA,QACpD,GAAI,MAAM,OAAA,GAAU,CAAC,MAAM,KAAA,CAAM,OAAO,IAAI,EAAC;AAAA,QAC7C,GAAI,MAAM,MAAA,GAAS,CAAC,MAAM,GAAG,KAAK,IAAI;AAAC,OACzC;AAAA,IACF,KAAK,QAAA;AAEH,MAAA,OAAO,MAAM,MAAA,GACT,CAAC,UAAU,GAAI,KAAA,CAAM,OAAO,UAAA,CAAW,GAAG,CAAA,GAAI,KAAK,CAAC,KAAA,CAAM,MAAM,CAAE,CAAA,GAClE,CAAC,QAAQ,CAAA;AAAA,IACf,KAAK,UAAA;AACH,MAAA,OAAO;AAAA,QACL,UAAA;AAAA,QACA,GAAI,MAAM,MAAA,GAAS,CAAC,MAAM,KAAA,CAAM,MAAM,IAAI,EAAC;AAAA,QAC3C,GAAI,MAAM,MAAA,GAAS,CAAC,MAAM,GAAG,KAAK,IAAI;AAAC,OACzC;AAAA,IACF,KAAK,OAAA;AACH,MAAA,OAAO,KAAA,CAAM,OAAA,GAAU,CAAC,OAAA,EAAS,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,OAAO,CAAA,GAAI,CAAC,OAAA,EAAS,MAAM,CAAA;AAAA,IAClF,KAAK,MAAA;AACH,MAAA,OAAO,CAAC,MAAM,CAAA;AAAA,IAChB,KAAK,MAAA;AACH,MAAA,OAAO,CAAC,MAAM,CAAA;AAAA,IAChB,KAAK,OAAA;AACH,MAAA,OAAO,CAAC,OAAA,EAAS,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,KAAA,CAAM,MAAM,CAAA,GAAI,CAAC,OAAO,CAAE,CAAA;AAAA,IACjE,KAAK,OAAA;AACH,MAAA,OAAO,CAAC,OAAO,CAAA;AAAA,IACjB,KAAK,UAAA;AACH,MAAA,QAAQ,MAAM,cAAA;AAAgB,QAC5B,KAAK,MAAA;AACH,UAAA,OAAO,CAAC,YAAY,MAAM,CAAA;AAAA,QAC5B,KAAK,KAAA;AACH,UAAA,OAAO;AAAA,YACL,UAAA;AAAA,YACA,KAAA;AAAA,YACA,GAAI,KAAA,CAAM,SAAA,GAAY,CAAC,IAAI,IAAI,EAAC;AAAA,YAChC,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,KAAA,CAAM,MAAM,IAAI,EAAC;AAAA,YACrC,MAAM,YAAA,IAAgB;AAAA,WACxB,CAAE,OAAO,OAAO,CAAA;AAAA,QAClB,KAAK,QAAA;AACH,UAAA,OAAO;AAAA,YACL,UAAA;AAAA,YACA,QAAA;AAAA,YACA,GAAI,KAAA,CAAM,KAAA,GAAQ,CAAC,SAAS,IAAI,EAAC;AAAA,YACjC,MAAM,YAAA,IAAgB;AAAA,WACxB,CAAE,OAAO,OAAO,CAAA;AAAA,QAClB,KAAK,OAAA;AACH,UAAA,OAAO,CAAC,YAAY,OAAO,CAAA;AAAA,QAC7B;AACE,UAAA,OAAO,CAAC,YAAY,MAAM,CAAA;AAAA;AAC9B,IACF;AACE,MAAA,OAAO,CAAC,MAAM,OAAO,CAAA;AAAA;AAE3B;AAEA,SAAS,MAAA,CAAO,IAAA,EAAgB,GAAA,EAAa,MAAA,EAAyC;AACpF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC9B,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,EAAA;AAEb,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,EAAO,IAAA,EAAM;AAAA,MAC/B,GAAA;AAAA,MACA,MAAA;AAAA,MACA,KAAK,aAAA,EAAc;AAAA,MACnB,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,KACjC,CAAA;AAED,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,IAAI,MAAA,CAAO,SAAS,UAAA,EAAY;AAC9B,QAAA,MAAA,IAAU,MAAM,QAAA,EAAS;AAAA,MAC3B;AAAA,IACF,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,IAAI,MAAA,CAAO,SAAS,UAAA,EAAY;AAC9B,QAAA,MAAA,IAAU,MAAM,QAAA,EAAS;AAAA,MAC3B;AAAA,IACF,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAA,OAAA,CAAQ;AAAA,QACN,OAAA,EAAS,KAAK,CAAC,CAAA;AAAA,QACf,MAAA;AAAA,QACA,QAAQ,GAAA,CAAI,OAAA;AAAA,QACZ,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,OAAO,MAAA,IAAU;AAAA,OAC7B,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,MAAA,OAAA,CAAQ;AAAA,QACN,OAAA,EAAS,KAAK,CAAC,CAAA;AAAA,QACf,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,UAAU,IAAA,IAAQ,CAAA;AAAA,QAClB,SAAA,EAAW,MAAA,CAAO,MAAA,IAAU,UAAA,IAAc,OAAO,MAAA,IAAU;AAAA,OAC5D,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH","file":"git.js","sourcesContent":["import { spawn } from 'node:child_process';\nimport { statSync } from 'node:fs';\nimport { dirname } from 'node:path';\nimport { buildChildEnv } from '@wrongstack/core';\nimport type { Tool } from '@wrongstack/core';\n\ntype GitSubcommand =\n  | 'status'\n  | 'log'\n  | 'diff'\n  | 'commit'\n  | 'branch'\n  | 'checkout'\n  | 'stash'\n  | 'push'\n  | 'pull'\n  | 'fetch'\n  | 'reset'\n  | 'worktree';\n\ninterface GitInput {\n  command: GitSubcommand;\n  files?: string | string[];\n  dry_run?: boolean;\n  /** commit message for `commit` subcommand */\n  message?: string;\n  /** branch name for `checkout` / `branch` */\n  branch?: string;\n  /** pass --graph, --oneline, --stat for `log` */\n  format?: 'short' | 'oneline' | 'stat' | 'graph';\n  /** limit for `log` */\n  limit?: number;\n  /** worktree action: list, add, remove, prune */\n  worktreeAction?: 'list' | 'add' | 'remove' | 'prune';\n  /** path for worktree add/remove (e.g. \"../wt-feature-xyz\") */\n  worktreePath?: string;\n  /** create new branch when adding worktree */\n  newBranch?: boolean;\n  /** force operation (e.g. worktree remove --force) */\n  force?: boolean;\n}\n\ninterface GitOutput {\n  command: GitSubcommand;\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  truncated: boolean;\n}\n\nconst TIMEOUT_MS = 30_000;\nconst MAX_OUTPUT = 100_000;\n\nexport const gitTool: Tool<GitInput, GitOutput> = {\n  name: 'git',\n  category: 'Git',\n  description:\n    'Run git commands. Wraps common operations: status, log, diff, commit, branch, checkout, stash, push, pull, fetch, reset, worktree.',\n  usageHint:\n    'Prefer built-in subcommands over raw args. `command` is required. `message` for commits. `branch` for checkout/branch. `files` for status/diff. `format` for log.',\n  permission: 'confirm',\n  // Conservative: any of these may mutate. The non-mutating commands\n  // (status/log/diff/branch/fetch) are still gated on `permission: 'confirm'`\n  // and `MUTATING_SUBCOMMANDS` is consulted at runtime for per-call checks.\n  mutating: true,\n  timeoutMs: TIMEOUT_MS,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      command: {\n        type: 'string',\n        enum: [\n          'status',\n          'log',\n          'diff',\n          'commit',\n          'branch',\n          'checkout',\n          'stash',\n          'push',\n          'pull',\n          'fetch',\n          'reset',\n          'worktree',\n        ],\n        description: 'Git subcommand',\n      },\n      files: {\n        type: 'string',\n        description:\n          'File(s) for status/diff: single path, comma-separated list, or \"**/*.ts\" glob',\n      },\n      message: { type: 'string', description: 'Commit message (required for commit)' },\n      branch: { type: 'string', description: 'Branch name for checkout/branch' },\n      format: {\n        type: 'string',\n        enum: ['short', 'oneline', 'stat', 'graph'],\n        description: 'Log format (default: short)',\n      },\n      limit: { type: 'integer', description: 'Limit for log (default: 20)' },\n      dry_run: { type: 'boolean', description: 'For commit: show what would be committed' },\n      worktreeAction: {\n        type: 'string',\n        enum: ['list', 'add', 'remove', 'prune'],\n        description: 'Worktree action: list, add, remove, prune',\n      },\n      worktreePath: {\n        type: 'string',\n        description: 'Path for worktree add/remove (e.g. \"../wt-feature-xyz\")',\n      },\n      newBranch: {\n        type: 'boolean',\n        description: 'Create new branch when adding worktree',\n      },\n      force: {\n        type: 'boolean',\n        description: 'Force operation (e.g. worktree remove --force)',\n      },\n    },\n    required: ['command'],\n  },\n  async execute(input, ctx, opts) {\n    if (!input?.command) throw new Error('git: command is required');\n\n    if (input.command === 'commit' && !input.message) {\n      return {\n        command: 'commit',\n        stdout: '',\n        stderr: 'git commit requires a message (-m flag)',\n        exitCode: 1,\n        truncated: false,\n      };\n    }\n\n    // Bound the search at projectRoot so a non-git project doesn't drift\n    // into a parent repo (e.g. ~/repos/.git) and operate on the wrong tree.\n    const gitDir = findGitDir(ctx.cwd, ctx.projectRoot);\n    if (!gitDir) {\n      return {\n        command: input.command,\n        stdout: '',\n        stderr: 'Not in a git repository (within project root)',\n        exitCode: 128,\n        truncated: false,\n      };\n    }\n\n    const args = buildArgs(input);\n    return await runGit(args, gitDir, opts.signal);\n  },\n};\n\nfunction findGitDir(cwd: string, projectRoot: string): string | null {\n  const root = projectRoot;\n  let dir = cwd;\n  for (let i = 0; i < 20; i++) {\n    try {\n      const stat = statSync(`${dir}/.git`);\n      if (stat.isDirectory()) return dir;\n    } catch {\n      // continue\n    }\n    if (dir === root) break;\n    const parent = dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\nfunction buildArgs(input: GitInput): string[] {\n  const limit = input.limit ?? 20;\n  const files = input.files\n    ? (Array.isArray(input.files) ? input.files : input.files.split(','))\n        .map((s: string) => s.trim())\n        .filter(Boolean)\n    : [];\n\n  switch (input.command) {\n    case 'status':\n      return ['status', ...(files.length ? ['--', ...files] : [])];\n    case 'log':\n      return [\n        'log',\n        `--max-count=${limit}`,\n        ...(input.format === 'oneline' ? ['--oneline'] : []),\n        ...(input.format === 'stat' ? ['--stat'] : []),\n        ...(input.format === 'graph' ? ['--oneline', '--graph', '--decorate'] : []),\n        ...(input.format === 'short' || !input.format ? [] : []),\n      ];\n    case 'diff':\n      return ['diff', '--no-color', ...(files.length ? ['--', ...files] : [])];\n    case 'commit':\n      return [\n        'commit',\n        ...(input.dry_run ? ['--dry-run', '--porcelain'] : []),\n        ...(input.message ? ['-m', input.message] : []),\n        ...(files.length ? ['--', ...files] : []),\n      ];\n    case 'branch':\n      // Validate branch name: reject names starting with '-' (flag injection).\n      return input.branch\n        ? ['branch', ...(input.branch.startsWith('-') ? [] : [input.branch])]\n        : ['branch'];\n    case 'checkout':\n      return [\n        'checkout',\n        ...(input.branch ? ['--', input.branch] : []),\n        ...(files.length ? ['--', ...files] : []),\n      ];\n    case 'stash':\n      return input.message ? ['stash', 'push', '-m', input.message] : ['stash', 'push'];\n    case 'push':\n      return ['push'];\n    case 'pull':\n      return ['pull'];\n    case 'fetch':\n      return ['fetch', ...(input.branch ? [input.branch] : ['--all'])];\n    case 'reset':\n      return ['reset'];\n    case 'worktree':\n      switch (input.worktreeAction) {\n        case 'list':\n          return ['worktree', 'list'];\n        case 'add':\n          return [\n            'worktree',\n            'add',\n            ...(input.newBranch ? ['-b'] : []),\n            ...(input.branch ? [input.branch] : []),\n            input.worktreePath ?? '',\n          ].filter(Boolean);\n        case 'remove':\n          return [\n            'worktree',\n            'remove',\n            ...(input.force ? ['--force'] : []),\n            input.worktreePath ?? '',\n          ].filter(Boolean);\n        case 'prune':\n          return ['worktree', 'prune'];\n        default:\n          return ['worktree', 'list'];\n      }\n    default:\n      return [input.command];\n  }\n}\n\nfunction runGit(args: string[], cwd: string, signal: AbortSignal): Promise<GitOutput> {\n  return new Promise((resolve) => {\n    let stdout = '';\n    let stderr = '';\n\n    const child = spawn('git', args, {\n      cwd,\n      signal,\n      env: buildChildEnv(),\n      stdio: ['ignore', 'pipe', 'pipe'],\n    });\n\n    child.stdout?.on('data', (chunk: Buffer) => {\n      if (stdout.length < MAX_OUTPUT) {\n        stdout += chunk.toString();\n      }\n    });\n\n    child.stderr?.on('data', (chunk: Buffer) => {\n      if (stderr.length < MAX_OUTPUT) {\n        stderr += chunk.toString();\n      }\n    });\n\n    child.on('error', (err) => {\n      resolve({\n        command: args[0] as GitSubcommand,\n        stdout,\n        stderr: err.message,\n        exitCode: 1,\n        truncated: stdout.length >= MAX_OUTPUT,\n      });\n    });\n\n    child.on('close', (code) => {\n      resolve({\n        command: args[0] as GitSubcommand,\n        stdout: stdout.slice(0, MAX_OUTPUT),\n        stderr: stderr.slice(0, MAX_OUTPUT),\n        exitCode: code ?? 1,\n        truncated: stdout.length >= MAX_OUTPUT || stderr.length >= MAX_OUTPUT,\n      });\n    });\n  });\n}\n"]}
+{"version":3,"sources":["../src/git.ts"],"names":["resolve"],"mappings":";;;;;;AAkDA,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,UAAA,GAAa,GAAA;AAEZ,IAAM,OAAA,GAAqC;AAAA,EAChD,IAAA,EAAM,KAAA;AAAA,EACN,QAAA,EAAU,KAAA;AAAA,EACV,WAAA,EACE,oIAAA;AAAA,EACF,SAAA,EACE,mKAAA;AAAA,EACF,UAAA,EAAY,SAAA;AAAA;AAAA;AAAA;AAAA,EAIZ,QAAA,EAAU,IAAA;AAAA,EACV,SAAA,EAAW,UAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM;AAAA,UACJ,QAAA;AAAA,UACA,KAAA;AAAA,UACA,MAAA;AAAA,UACA,QAAA;AAAA,UACA,QAAA;AAAA,UACA,UAAA;AAAA,UACA,OAAA;AAAA,UACA,MAAA;AAAA,UACA,MAAA;AAAA,UACA,OAAA;AAAA,UACA,OAAA;AAAA,UACA;AAAA,SACF;AAAA,QACA,WAAA,EAAa;AAAA,OACf;AAAA,MACA,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EACE;AAAA,OACJ;AAAA,MACA,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,sCAAA,EAAuC;AAAA,MAC/E,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,iCAAA,EAAkC;AAAA,MACzE,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,OAAA,EAAS,SAAA,EAAW,QAAQ,OAAO,CAAA;AAAA,QAC1C,WAAA,EAAa;AAAA,OACf;AAAA,MACA,KAAA,EAAO,EAAE,IAAA,EAAM,SAAA,EAAW,aAAa,6BAAA,EAA8B;AAAA,MACrE,OAAA,EAAS,EAAE,IAAA,EAAM,SAAA,EAAW,aAAa,0CAAA,EAA2C;AAAA,MACpF,cAAA,EAAgB;AAAA,QACd,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,MAAA,EAAQ,KAAA,EAAO,UAAU,OAAO,CAAA;AAAA,QACvC,WAAA,EAAa;AAAA,OACf;AAAA,MACA,YAAA,EAAc;AAAA,QACZ,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,SAAA,EAAW;AAAA,QACT,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,KAAA,EAAO;AAAA,QACL,IAAA,EAAM,SAAA;AAAA,QACN,WAAA,EAAa;AAAA;AACf,KACF;AAAA,IACA,QAAA,EAAU,CAAC,SAAS;AAAA,GACtB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,CAAC,KAAA,EAAO,OAAA,EAAS,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAE/D,IAAA,IAAI,KAAA,CAAM,OAAA,KAAY,QAAA,IAAY,CAAC,MAAM,OAAA,EAAS;AAChD,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,QAAA;AAAA,QACT,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,yCAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW;AAAA,OACb;AAAA,IACF;AAIA,IAAA,IAAI,KAAA,CAAM,YAAY,UAAA,EAAY;AAChC,MAAA,MAAM,KAAA,GAAQ,qBAAA,CAAsB,KAAA,EAAO,GAAA,CAAI,WAAW,CAAA;AAC1D,MAAA,IAAI,OAAO,OAAO,KAAA;AAAA,IACpB;AAIA,IAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,GAAA,EAAK,IAAI,WAAW,CAAA;AAClD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO;AAAA,QACL,SAAS,KAAA,CAAM,OAAA;AAAA,QACf,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,+CAAA;AAAA,QACR,QAAA,EAAU,GAAA;AAAA,QACV,SAAA,EAAW;AAAA,OACb;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,UAAU,KAAK,CAAA;AAC5B,IAAA,OAAO,MAAM,MAAA,CAAO,IAAA,EAAM,MAAA,EAAQ,KAAK,MAAM,CAAA;AAAA,EAC/C;AACF;AAMA,SAAS,qBAAA,CAAsB,OAAiB,WAAA,EAAuC;AACrF,EAAA,MAAM,MAAA,GAAS,CAAC,MAAA,MAA+B;AAAA,IAC7C,OAAA,EAAS,UAAA;AAAA,IACT,MAAA,EAAQ,EAAA;AAAA,IACR,MAAA;AAAA,IACA,QAAA,EAAU,CAAA;AAAA,IACV,SAAA,EAAW;AAAA,GACb,CAAA;AAGA,EAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,UAAA,CAAW,GAAG,CAAA,SAAU,MAAA,CAAO,CAAA,oBAAA,EAAuB,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA;AACtF,EAAA,IAAI,KAAA,CAAM,YAAA,EAAc,UAAA,CAAW,GAAG,CAAA,EAAG;AACvC,IAAA,OAAO,MAAA,CAAO,CAAA,sBAAA,EAAyB,KAAA,CAAM,YAAY,CAAA,CAAE,CAAA;AAAA,EAC7D;AAGA,EAAA,IAAA,CACG,MAAM,cAAA,KAAmB,KAAA,IAAS,MAAM,cAAA,KAAmB,QAAA,KAC5D,MAAM,YAAA,EACN;AACA,IAAA,MAAM,IAAA,GAAO,QAAQ,WAAW,CAAA;AAChC,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,IAAA,EAAM,KAAA,CAAM,YAAY,CAAA;AAC5C,IAAA,IAAI,QAAQ,IAAA,IAAQ,CAAC,IAAI,UAAA,CAAW,IAAA,GAAO,GAAG,CAAA,EAAG;AAC/C,MAAA,OAAO,MAAA,CAAO,CAAA,6CAAA,EAAgD,KAAA,CAAM,YAAY,CAAA,CAAE,CAAA;AAAA,IACpF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,UAAA,CAAW,KAAa,WAAA,EAAoC;AACnE,EAAA,MAAM,IAAA,GAAO,WAAA;AACb,EAAA,IAAI,GAAA,GAAM,GAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA,KAAA,CAAO,CAAA;AAInC,MAAA,IAAI,KAAK,WAAA,EAAY,IAAK,IAAA,CAAK,MAAA,IAAU,OAAO,GAAA;AAAA,IAClD,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAI,QAAQ,IAAA,EAAM;AAClB,IAAA,MAAM,MAAA,GAAS,QAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,WAAW,GAAA,EAAK;AACpB,IAAA,GAAA,GAAM,MAAA;AAAA,EACR;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,UAAU,KAAA,EAA2B;AAC5C,EAAA,MAAM,KAAA,GAAQ,MAAM,KAAA,IAAS,EAAA;AAC7B,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,GAAA,CACf,KAAA,CAAM,OAAA,CAAQ,MAAM,KAAK,CAAA,GAAI,KAAA,CAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,MAAM,GAAG,CAAA,EAC9D,GAAA,CAAI,CAAC,CAAA,KAAc,CAAA,CAAE,IAAA,EAAM,CAAA,CAC3B,MAAA,CAAO,OAAO,CAAA,GACjB,EAAC;AAEL,EAAA,QAAQ,MAAM,OAAA;AAAS,IACrB,KAAK,QAAA;AACH,MAAA,OAAO,CAAC,QAAA,EAAU,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,IAAA,EAAM,GAAG,KAAK,CAAA,GAAI,EAAG,CAAA;AAAA,IAC7D,KAAK,KAAA;AACH,MAAA,OAAO;AAAA,QACL,KAAA;AAAA,QACA,eAAe,KAAK,CAAA,CAAA;AAAA,QACpB,GAAI,KAAA,CAAM,MAAA,KAAW,YAAY,CAAC,WAAW,IAAI,EAAC;AAAA,QAClD,GAAI,KAAA,CAAM,MAAA,KAAW,SAAS,CAAC,QAAQ,IAAI,EAAC;AAAA,QAC5C,GAAI,MAAM,MAAA,KAAW,OAAA,GAAU,CAAC,WAAA,EAAa,SAAA,EAAW,YAAY,CAAA,GAAI,EAAC;AAAA,QACzE,GAAI,MAAM,MAAA,KAAW,OAAA,IAAW,CAAC,KAAA,CAAM,MAAA,GAAS,EAAC,GAAI;AAAC,OACxD;AAAA,IACF,KAAK,MAAA;AACH,MAAA,OAAO,CAAC,MAAA,EAAQ,YAAA,EAAc,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,IAAA,EAAM,GAAG,KAAK,CAAA,GAAI,EAAG,CAAA;AAAA,IACzE,KAAK,QAAA;AACH,MAAA,OAAO;AAAA,QACL,QAAA;AAAA,QACA,GAAI,KAAA,CAAM,OAAA,GAAU,CAAC,WAAA,EAAa,aAAa,IAAI,EAAC;AAAA,QACpD,GAAI,MAAM,OAAA,GAAU,CAAC,MAAM,KAAA,CAAM,OAAO,IAAI,EAAC;AAAA,QAC7C,GAAI,MAAM,MAAA,GAAS,CAAC,MAAM,GAAG,KAAK,IAAI;AAAC,OACzC;AAAA,IACF,KAAK,QAAA;AAEH,MAAA,OAAO,MAAM,MAAA,GACT,CAAC,UAAU,GAAI,KAAA,CAAM,OAAO,UAAA,CAAW,GAAG,CAAA,GAAI,KAAK,CAAC,KAAA,CAAM,MAAM,CAAE,CAAA,GAClE,CAAC,QAAQ,CAAA;AAAA,IACf,KAAK,UAAA;AACH,MAAA,OAAO;AAAA,QACL,UAAA;AAAA,QACA,GAAI,MAAM,MAAA,GAAS,CAAC,MAAM,KAAA,CAAM,MAAM,IAAI,EAAC;AAAA,QAC3C,GAAI,MAAM,MAAA,GAAS,CAAC,MAAM,GAAG,KAAK,IAAI;AAAC,OACzC;AAAA,IACF,KAAK,OAAA;AACH,MAAA,OAAO,KAAA,CAAM,OAAA,GAAU,CAAC,OAAA,EAAS,MAAA,EAAQ,IAAA,EAAM,KAAA,CAAM,OAAO,CAAA,GAAI,CAAC,OAAA,EAAS,MAAM,CAAA;AAAA,IAClF,KAAK,MAAA;AACH,MAAA,OAAO,CAAC,MAAM,CAAA;AAAA,IAChB,KAAK,MAAA;AACH,MAAA,OAAO,CAAC,MAAM,CAAA;AAAA,IAChB,KAAK,OAAA;AACH,MAAA,OAAO,CAAC,OAAA,EAAS,GAAI,KAAA,CAAM,MAAA,GAAS,CAAC,KAAA,CAAM,MAAM,CAAA,GAAI,CAAC,OAAO,CAAE,CAAA;AAAA,IACjE,KAAK,OAAA;AACH,MAAA,OAAO,CAAC,OAAO,CAAA;AAAA,IACjB,KAAK,UAAA;AACH,MAAA,QAAQ,MAAM,cAAA;AAAgB,QAC5B,KAAK,MAAA;AACH,UAAA,OAAO,CAAC,YAAY,MAAM,CAAA;AAAA,QAC5B,KAAK,KAAA,EAAO;AAKV,UAAA,IAAI,CAAC,KAAA,CAAM,YAAA,EAAc,OAAO,CAAC,YAAY,MAAM,CAAA;AACnD,UAAA,MAAM,GAAA,GAAM,CAAC,UAAA,EAAY,KAAK,CAAA;AAC9B,UAAA,IAAI,KAAA,CAAM,aAAa,KAAA,CAAM,MAAA,MAAY,IAAA,CAAK,IAAA,EAAM,MAAM,MAAM,CAAA;AAChE,UAAA,GAAA,CAAI,IAAA,CAAK,MAAM,YAAY,CAAA;AAC3B,UAAA,IAAI,CAAC,MAAM,SAAA,IAAa,KAAA,CAAM,QAAQ,GAAA,CAAI,IAAA,CAAK,MAAM,MAAM,CAAA;AAC3D,UAAA,OAAO,GAAA;AAAA,QACT;AAAA,QACA,KAAK,QAAA;AACH,UAAA,OAAO;AAAA,YACL,UAAA;AAAA,YACA,QAAA;AAAA,YACA,GAAI,KAAA,CAAM,KAAA,GAAQ,CAAC,SAAS,IAAI,EAAC;AAAA,YACjC,MAAM,YAAA,IAAgB;AAAA,WACxB,CAAE,OAAO,OAAO,CAAA;AAAA,QAClB,KAAK,OAAA;AACH,UAAA,OAAO,CAAC,YAAY,OAAO,CAAA;AAAA,QAC7B;AACE,UAAA,OAAO,CAAC,YAAY,MAAM,CAAA;AAAA;AAC9B,IACF;AACE,MAAA,OAAO,CAAC,MAAM,OAAO,CAAA;AAAA;AAE3B;AAEA,SAAS,MAAA,CAAO,IAAA,EAAgB,GAAA,EAAa,MAAA,EAAyC;AACpF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACA,QAAAA,KAAY;AAC9B,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,EAAA;AAEb,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,EAAO,IAAA,EAAM;AAAA,MAC/B,GAAA;AAAA,MACA,MAAA;AAAA,MACA,KAAK,aAAA,EAAc;AAAA,MACnB,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,KACjC,CAAA;AAED,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,IAAI,MAAA,CAAO,SAAS,UAAA,EAAY;AAC9B,QAAA,MAAA,IAAU,MAAM,QAAA,EAAS;AAAA,MAC3B;AAAA,IACF,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,IAAI,MAAA,CAAO,SAAS,UAAA,EAAY;AAC9B,QAAA,MAAA,IAAU,MAAM,QAAA,EAAS;AAAA,MAC3B;AAAA,IACF,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAAA,QAAAA,CAAQ;AAAA,QACN,OAAA,EAAS,KAAK,CAAC,CAAA;AAAA,QACf,MAAA;AAAA,QACA,QAAQ,GAAA,CAAI,OAAA;AAAA,QACZ,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,OAAO,MAAA,IAAU;AAAA,OAC7B,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,MAAAA,QAAAA,CAAQ;AAAA,QACN,OAAA,EAAS,KAAK,CAAC,CAAA;AAAA,QACf,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,UAAU,IAAA,IAAQ,CAAA;AAAA,QAClB,SAAA,EAAW,MAAA,CAAO,MAAA,IAAU,UAAA,IAAc,OAAO,MAAA,IAAU;AAAA,OAC5D,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH","file":"git.js","sourcesContent":["import { spawn } from 'node:child_process';\nimport { statSync } from 'node:fs';\nimport { dirname, resolve, sep } from 'node:path';\nimport { buildChildEnv } from '@wrongstack/core';\nimport type { Tool } from '@wrongstack/core';\n\ntype GitSubcommand =\n  | 'status'\n  | 'log'\n  | 'diff'\n  | 'commit'\n  | 'branch'\n  | 'checkout'\n  | 'stash'\n  | 'push'\n  | 'pull'\n  | 'fetch'\n  | 'reset'\n  | 'worktree';\n\ninterface GitInput {\n  command: GitSubcommand;\n  files?: string | string[];\n  dry_run?: boolean;\n  /** commit message for `commit` subcommand */\n  message?: string;\n  /** branch name for `checkout` / `branch` */\n  branch?: string;\n  /** pass --graph, --oneline, --stat for `log` */\n  format?: 'short' | 'oneline' | 'stat' | 'graph';\n  /** limit for `log` */\n  limit?: number;\n  /** worktree action: list, add, remove, prune */\n  worktreeAction?: 'list' | 'add' | 'remove' | 'prune';\n  /** path for worktree add/remove (e.g. \"../wt-feature-xyz\") */\n  worktreePath?: string;\n  /** create new branch when adding worktree */\n  newBranch?: boolean;\n  /** force operation (e.g. worktree remove --force) */\n  force?: boolean;\n}\n\ninterface GitOutput {\n  command: GitSubcommand;\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  truncated: boolean;\n}\n\nconst TIMEOUT_MS = 30_000;\nconst MAX_OUTPUT = 100_000;\n\nexport const gitTool: Tool<GitInput, GitOutput> = {\n  name: 'git',\n  category: 'Git',\n  description:\n    'Run git commands. Wraps common operations: status, log, diff, commit, branch, checkout, stash, push, pull, fetch, reset, worktree.',\n  usageHint:\n    'Prefer built-in subcommands over raw args. `command` is required. `message` for commits. `branch` for checkout/branch. `files` for status/diff. `format` for log.',\n  permission: 'confirm',\n  // Conservative: any of these may mutate. The non-mutating commands\n  // (status/log/diff/branch/fetch) are still gated on `permission: 'confirm'`\n  // and `MUTATING_SUBCOMMANDS` is consulted at runtime for per-call checks.\n  mutating: true,\n  timeoutMs: TIMEOUT_MS,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      command: {\n        type: 'string',\n        enum: [\n          'status',\n          'log',\n          'diff',\n          'commit',\n          'branch',\n          'checkout',\n          'stash',\n          'push',\n          'pull',\n          'fetch',\n          'reset',\n          'worktree',\n        ],\n        description: 'Git subcommand',\n      },\n      files: {\n        type: 'string',\n        description:\n          'File(s) for status/diff: single path, comma-separated list, or \"**/*.ts\" glob',\n      },\n      message: { type: 'string', description: 'Commit message (required for commit)' },\n      branch: { type: 'string', description: 'Branch name for checkout/branch' },\n      format: {\n        type: 'string',\n        enum: ['short', 'oneline', 'stat', 'graph'],\n        description: 'Log format (default: short)',\n      },\n      limit: { type: 'integer', description: 'Limit for log (default: 20)' },\n      dry_run: { type: 'boolean', description: 'For commit: show what would be committed' },\n      worktreeAction: {\n        type: 'string',\n        enum: ['list', 'add', 'remove', 'prune'],\n        description: 'Worktree action: list, add, remove, prune',\n      },\n      worktreePath: {\n        type: 'string',\n        description: 'Path for worktree add/remove (e.g. \"../wt-feature-xyz\")',\n      },\n      newBranch: {\n        type: 'boolean',\n        description: 'Create new branch when adding worktree',\n      },\n      force: {\n        type: 'boolean',\n        description: 'Force operation (e.g. worktree remove --force)',\n      },\n    },\n    required: ['command'],\n  },\n  async execute(input, ctx, opts) {\n    if (!input?.command) throw new Error('git: command is required');\n\n    if (input.command === 'commit' && !input.message) {\n      return {\n        command: 'commit',\n        stdout: '',\n        stderr: 'git commit requires a message (-m flag)',\n        exitCode: 1,\n        truncated: false,\n      };\n    }\n\n    // Validate worktree paths/branches before touching the filesystem: reject\n    // flag injection and any path that escapes the project root.\n    if (input.command === 'worktree') {\n      const guard = validateWorktreeInput(input, ctx.projectRoot);\n      if (guard) return guard;\n    }\n\n    // Bound the search at projectRoot so a non-git project doesn't drift\n    // into a parent repo (e.g. ~/repos/.git) and operate on the wrong tree.\n    const gitDir = findGitDir(ctx.cwd, ctx.projectRoot);\n    if (!gitDir) {\n      return {\n        command: input.command,\n        stdout: '',\n        stderr: 'Not in a git repository (within project root)',\n        exitCode: 128,\n        truncated: false,\n      };\n    }\n\n    const args = buildArgs(input);\n    return await runGit(args, gitDir, opts.signal);\n  },\n};\n\n/**\n * Reject worktree inputs that could inject git flags or escape the project\n * root. Returns a `GitOutput` describing the rejection, or `null` if safe.\n */\nfunction validateWorktreeInput(input: GitInput, projectRoot: string): GitOutput | null {\n  const reject = (stderr: string): GitOutput => ({\n    command: 'worktree',\n    stdout: '',\n    stderr,\n    exitCode: 1,\n    truncated: false,\n  });\n\n  // Flag injection: a leading '-' would be parsed as a git option.\n  if (input.branch?.startsWith('-')) return reject(`unsafe branch name: ${input.branch}`);\n  if (input.worktreePath?.startsWith('-')) {\n    return reject(`unsafe worktree path: ${input.worktreePath}`);\n  }\n\n  // Path escape: add/remove targets must resolve inside the project root.\n  if (\n    (input.worktreeAction === 'add' || input.worktreeAction === 'remove') &&\n    input.worktreePath\n  ) {\n    const root = resolve(projectRoot);\n    const abs = resolve(root, input.worktreePath);\n    if (abs !== root && !abs.startsWith(root + sep)) {\n      return reject(`unsafe worktree path (escapes project root): ${input.worktreePath}`);\n    }\n  }\n\n  return null;\n}\n\nfunction findGitDir(cwd: string, projectRoot: string): string | null {\n  const root = projectRoot;\n  let dir = cwd;\n  for (let i = 0; i < 20; i++) {\n    try {\n      const stat = statSync(`${dir}/.git`);\n      // A normal repo has a `.git` directory; a linked worktree has a `.git`\n      // *file* (gitlink pointing at the main repo). Accept both so the tool\n      // operates inside a worktree when a subagent's cwd is a worktree dir.\n      if (stat.isDirectory() || stat.isFile()) return dir;\n    } catch {\n      // continue\n    }\n    if (dir === root) break;\n    const parent = dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\nfunction buildArgs(input: GitInput): string[] {\n  const limit = input.limit ?? 20;\n  const files = input.files\n    ? (Array.isArray(input.files) ? input.files : input.files.split(','))\n        .map((s: string) => s.trim())\n        .filter(Boolean)\n    : [];\n\n  switch (input.command) {\n    case 'status':\n      return ['status', ...(files.length ? ['--', ...files] : [])];\n    case 'log':\n      return [\n        'log',\n        `--max-count=${limit}`,\n        ...(input.format === 'oneline' ? ['--oneline'] : []),\n        ...(input.format === 'stat' ? ['--stat'] : []),\n        ...(input.format === 'graph' ? ['--oneline', '--graph', '--decorate'] : []),\n        ...(input.format === 'short' || !input.format ? [] : []),\n      ];\n    case 'diff':\n      return ['diff', '--no-color', ...(files.length ? ['--', ...files] : [])];\n    case 'commit':\n      return [\n        'commit',\n        ...(input.dry_run ? ['--dry-run', '--porcelain'] : []),\n        ...(input.message ? ['-m', input.message] : []),\n        ...(files.length ? ['--', ...files] : []),\n      ];\n    case 'branch':\n      // Validate branch name: reject names starting with '-' (flag injection).\n      return input.branch\n        ? ['branch', ...(input.branch.startsWith('-') ? [] : [input.branch])]\n        : ['branch'];\n    case 'checkout':\n      return [\n        'checkout',\n        ...(input.branch ? ['--', input.branch] : []),\n        ...(files.length ? ['--', ...files] : []),\n      ];\n    case 'stash':\n      return input.message ? ['stash', 'push', '-m', input.message] : ['stash', 'push'];\n    case 'push':\n      return ['push'];\n    case 'pull':\n      return ['pull'];\n    case 'fetch':\n      return ['fetch', ...(input.branch ? [input.branch] : ['--all'])];\n    case 'reset':\n      return ['reset'];\n    case 'worktree':\n      switch (input.worktreeAction) {\n        case 'list':\n          return ['worktree', 'list'];\n        case 'add': {\n          // git worktree add [-b <new-branch>] <path> [<commit-ish>]\n          // The path comes BEFORE the branch/commit-ish. With --newBranch the\n          // branch is the name to create (`-b <branch> <path>`); without it the\n          // branch is an existing branch/commit to check out (`<path> <branch>`).\n          if (!input.worktreePath) return ['worktree', 'list'];\n          const add = ['worktree', 'add'];\n          if (input.newBranch && input.branch) add.push('-b', input.branch);\n          add.push(input.worktreePath);\n          if (!input.newBranch && input.branch) add.push(input.branch);\n          return add;\n        }\n        case 'remove':\n          return [\n            'worktree',\n            'remove',\n            ...(input.force ? ['--force'] : []),\n            input.worktreePath ?? '',\n          ].filter(Boolean);\n        case 'prune':\n          return ['worktree', 'prune'];\n        default:\n          return ['worktree', 'list'];\n      }\n    default:\n      return [input.command];\n  }\n}\n\nfunction runGit(args: string[], cwd: string, signal: AbortSignal): Promise<GitOutput> {\n  return new Promise((resolve) => {\n    let stdout = '';\n    let stderr = '';\n\n    const child = spawn('git', args, {\n      cwd,\n      signal,\n      env: buildChildEnv(),\n      stdio: ['ignore', 'pipe', 'pipe'],\n    });\n\n    child.stdout?.on('data', (chunk: Buffer) => {\n      if (stdout.length < MAX_OUTPUT) {\n        stdout += chunk.toString();\n      }\n    });\n\n    child.stderr?.on('data', (chunk: Buffer) => {\n      if (stderr.length < MAX_OUTPUT) {\n        stderr += chunk.toString();\n      }\n    });\n\n    child.on('error', (err) => {\n      resolve({\n        command: args[0] as GitSubcommand,\n        stdout,\n        stderr: err.message,\n        exitCode: 1,\n        truncated: stdout.length >= MAX_OUTPUT,\n      });\n    });\n\n    child.on('close', (code) => {\n      resolve({\n        command: args[0] as GitSubcommand,\n        stdout: stdout.slice(0, MAX_OUTPUT),\n        stderr: stderr.slice(0, MAX_OUTPUT),\n        exitCode: code ?? 1,\n        truncated: stdout.length >= MAX_OUTPUT || stderr.length >= MAX_OUTPUT,\n      });\n    });\n  });\n}\n"]}

package/dist/index.js

@@ -1,12 +1,13 @@
 import * as fs4 from 'node:fs/promises';
 import { stat } from 'node:fs/promises';
 import * as path from 'node:path';
-import { dirname } from 'node:path';
+import { resolve, sep, dirname } from 'node:path';
 import { atomicWrite, unifiedDiff, detectNewlineStyle, normalizeToLf, toStyle, compileGlob, buildChildEnv, stripAnsi, loadPlan, emptyPlan, clearPlan, savePlan, getPlanTemplate, addPlanItem, deriveTodosFromPlanItem, removePlanItem, setPlanItemStatus, formatPlan } from '@wrongstack/core';
-import { spawn, execSync, spawnSync } from 'node:child_process';
+import { spawn, execFileSync, spawnSync } from 'node:child_process';
 import * as os from 'node:os';
 import * as dns from 'node:dns/promises';
 import * as net from 'node:net';
+import { Agent } from 'undici';
 import * as fs13 from 'node:fs';
 import { statSync, mkdirSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
@@ -371,6 +372,7 @@ var replaceTool = {
     const dryRun = input.dry_run ?? false;
     const filesInput = Array.isArray(input.files) ? input.files.join(",") : input.files;
     const fileList = await resolveFiles(filesInput, ctx, globRe);
+    const realRoot = await fs4.realpath(ctx.projectRoot).catch(() => ctx.projectRoot);
     const results = [];
     let totalReplacements = 0;
     for (const absPath of fileList) {
@@ -386,7 +388,7 @@ var replaceTool = {
       } catch {
         continue;
       }
-      const rel = path.relative(ctx.projectRoot, realPath);
+      const rel = path.relative(realRoot, realPath);
       if (rel.startsWith("..") || path.isAbsolute(rel)) continue;
       const stat11 = await fs4.stat(realPath).catch(() => null);
       if (!stat11 || !stat11.isFile()) continue;
@@ -464,13 +466,13 @@ async function globFiles(pattern, base, extraGlob) {
   return await globNative(pattern, base, extraGlob);
 }
 function checkRg() {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     try {
       const p = spawn("rg", ["--version"], { env: buildChildEnv(), stdio: "ignore" });
-      p.on("error", () => resolve6(false));
-      p.on("close", (code) => resolve6(code === 0));
+      p.on("error", () => resolve7(false));
+      p.on("close", (code) => resolve7(code === 0));
     } catch {
-      resolve6(false);
+      resolve7(false);
     }
   });
 }
@@ -482,10 +484,10 @@ function spawnRgFind(pattern, base) {
     buf += chunk.toString();
   });
   return {
-    promise: new Promise((resolve6, reject) => {
+    promise: new Promise((resolve7, reject) => {
       child.on("error", reject);
       child.on("close", () => {
-        resolve6(buf.split("\n").filter(Boolean));
+        resolve7(buf.split("\n").filter(Boolean));
       });
     })
   };
@@ -654,13 +656,13 @@ var grepTool = {
   }
 };
 async function detectRg(signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     try {
       const p = spawn("rg", ["--version"], { env: buildChildEnv(), stdio: "ignore", signal });
-      p.on("error", () => resolve6(false));
-      p.on("close", (code) => resolve6(code === 0));
+      p.on("error", () => resolve7(false));
+      p.on("close", (code) => resolve7(code === 0));
     } catch {
-      resolve6(false);
+      resolve7(false);
     }
   });
 }
@@ -1371,10 +1373,10 @@ var bashTool = {
         queue.push(c);
       }
     };
-    const next = () => new Promise((resolve6) => {
+    const next = () => new Promise((resolve7) => {
       const c = queue.shift();
-      if (c) resolve6(c);
-      else resolveNext = resolve6;
+      if (c) resolve7(c);
+      else resolveNext = resolve7;
     });
     let lastFlush = Date.now();
     const flush = () => {
@@ -1488,8 +1490,20 @@ var BLOCKED_ARG_PATTERNS = {
   // python -c/--command executes arbitrary code; python -m runs modules
   python: [/-c$/, /^--command$/, /^-m$/, /^--module$/],
   // git --exec=<cmd> runs arbitrary commands via upload-pack/receive-pack;
-  // -C <dir> changes working directory, bypassing cwd sandbox
-  git: [/^--exec=/, /^--upload-pack=/, /^--receive-pack=/, /^-C$/],
+  // -C <dir> changes working directory, bypassing cwd sandbox;
+  // -c/--config <k>=<v> injects config that runs commands
+  // (e.g. core.sshCommand, core.pager, http.proxy, alias.x=!cmd).
+  git: [
+    /^--exec=/,
+    /^--upload-pack=/,
+    /^--receive-pack=/,
+    /^-C$/,
+    /^-c$/,
+    /^--config$/,
+    /^-c=/,
+    /^--config=/,
+    /^--config-env=/
+  ],
   // node -r/--require preloads arbitrary modules; --eval executes code
   node: [/^-r$/, /^--require$/, /^-e$/, /^--eval$/, /^--prof-process$/],
   // go run could execute arbitrary .go files; -ldflags could inject build-time code
@@ -1612,7 +1626,7 @@ var execTool = {
   }
 };
 function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     let killed = false;
@@ -1646,7 +1660,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
       const durationMs = Date.now() - startedAt;
       const exitCode = killed ? 124 : code ?? 1;
       registry.afterCall(durationMs, exitCode !== 0);
-      resolve6({
+      resolve7({
         command: cmd,
         args,
         stdout: stdout.slice(0, MAX_OUTPUT2),
@@ -1660,7 +1674,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
       clearTimeout(timer);
       if (typeof pid === "number") registry.unregister(pid);
       registry.afterCall(Date.now() - startedAt, true);
-      resolve6({
+      resolve7({
         command: cmd,
         args,
         stdout: stdout.slice(0, MAX_OUTPUT2),
@@ -1675,6 +1689,48 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
 var MAX_BYTES2 = 131072;
 var TIMEOUT_MS2 = 2e4;
 var ALLOW_PRIVATE = process.env["WRONGSTACK_FETCH_ALLOW_PRIVATE"] === "1";
+function guardedLookup(hostname, options, callback) {
+  dns.lookup(hostname, { all: true }).then((records) => {
+    const family = options?.family;
+    const byFamily = family === 4 || family === 6 ? records.filter((r) => r.family === family) : records;
+    const list = byFamily.length > 0 ? byFamily : records;
+    if (!ALLOW_PRIVATE) {
+      for (const r of list) {
+        const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);
+        if (bad) {
+          callback(
+            Object.assign(new Error(`fetch: resolved to private address ${r.address}`), {
+              code: "EAI_FAIL"
+            })
+          );
+          return;
+        }
+      }
+    }
+    if (options?.all) {
+      callback(
+        null,
+        list.map((r) => ({ address: r.address, family: r.family }))
+      );
+      return;
+    }
+    const first = list[0];
+    if (!first) {
+      callback(
+        Object.assign(new Error(`fetch: no address for ${hostname}`), { code: "ENOTFOUND" })
+      );
+      return;
+    }
+    callback(null, first.address, first.family);
+  }).catch((err) => callback(err));
+}
+var pinnedAgent;
+function getPinnedDispatcher() {
+  if (!pinnedAgent) {
+    pinnedAgent = new Agent({ connect: { lookup: guardedLookup } });
+  }
+  return pinnedAgent;
+}
 async function fetchWithRedirectLimit(url, maxRedirects, signal) {
   const headers = {
     "user-agent": "WrongStack/1.0 (+https://wrongstack.com)",
@@ -1691,11 +1747,13 @@ async function fetchWithRedirectLimit(url, maxRedirects, signal) {
       throw new Error("fetch: redirect to http:// blocked (HTTPS required by default)");
     }
     await assertNotPrivate(parsed.hostname);
-    const res = await fetch(currentUrl, {
+    const init = {
       redirect: "manual",
       signal,
-      headers
-    });
+      headers,
+      dispatcher: getPinnedDispatcher()
+    };
+    const res = await fetch(currentUrl, init);
     if (res.status < 300 || res.status > 399) {
       return res;
     }
@@ -2440,6 +2498,10 @@ var gitTool = {
         truncated: false
       };
     }
+    if (input.command === "worktree") {
+      const guard = validateWorktreeInput(input, ctx.projectRoot);
+      if (guard) return guard;
+    }
     const gitDir = findGitDir(ctx.cwd, ctx.projectRoot);
     if (!gitDir) {
       return {
@@ -2454,13 +2516,34 @@ var gitTool = {
     return await runGit(args, gitDir, opts.signal);
   }
 };
+function validateWorktreeInput(input, projectRoot) {
+  const reject = (stderr) => ({
+    command: "worktree",
+    stdout: "",
+    stderr,
+    exitCode: 1,
+    truncated: false
+  });
+  if (input.branch?.startsWith("-")) return reject(`unsafe branch name: ${input.branch}`);
+  if (input.worktreePath?.startsWith("-")) {
+    return reject(`unsafe worktree path: ${input.worktreePath}`);
+  }
+  if ((input.worktreeAction === "add" || input.worktreeAction === "remove") && input.worktreePath) {
+    const root = resolve(projectRoot);
+    const abs = resolve(root, input.worktreePath);
+    if (abs !== root && !abs.startsWith(root + sep)) {
+      return reject(`unsafe worktree path (escapes project root): ${input.worktreePath}`);
+    }
+  }
+  return null;
+}
 function findGitDir(cwd, projectRoot) {
   const root = projectRoot;
   let dir = cwd;
   for (let i = 0; i < 20; i++) {
     try {
       const stat11 = statSync(`${dir}/.git`);
-      if (stat11.isDirectory()) return dir;
+      if (stat11.isDirectory() || stat11.isFile()) return dir;
     } catch {
     }
     if (dir === root) break;
@@ -2516,14 +2599,14 @@ function buildArgs(input) {
       switch (input.worktreeAction) {
         case "list":
           return ["worktree", "list"];
-        case "add":
-          return [
-            "worktree",
-            "add",
-            ...input.newBranch ? ["-b"] : [],
-            ...input.branch ? [input.branch] : [],
-            input.worktreePath ?? ""
-          ].filter(Boolean);
+        case "add": {
+          if (!input.worktreePath) return ["worktree", "list"];
+          const add = ["worktree", "add"];
+          if (input.newBranch && input.branch) add.push("-b", input.branch);
+          add.push(input.worktreePath);
+          if (!input.newBranch && input.branch) add.push(input.branch);
+          return add;
+        }
         case "remove":
           return [
             "worktree",
@@ -2541,7 +2624,7 @@ function buildArgs(input) {
   }
 }
 function runGit(args, cwd, signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const child = spawn("git", args, {
@@ -2561,7 +2644,7 @@ function runGit(args, cwd, signal) {
       }
     });
     child.on("error", (err) => {
-      resolve6({
+      resolve7({
         command: args[0],
         stdout,
         stderr: err.message,
@@ -2570,7 +2653,7 @@ function runGit(args, cwd, signal) {
       });
     });
     child.on("close", (code) => {
-      resolve6({
+      resolve7({
         command: args[0],
         stdout: stdout.slice(0, MAX_OUTPUT3),
         stderr: stderr.slice(0, MAX_OUTPUT3),
@@ -2666,7 +2749,7 @@ function stripPathComponents(p, strip) {
   return parts.slice(strip).join("/");
 }
 function runPatch(args, cwd, signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const env = { ...buildChildEnv(), LANG: "C", LC_ALL: "C" };
@@ -2677,8 +2760,8 @@ function runPatch(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve6({ exitCode: code ?? 1, stdout, stderr }));
-    child.on("error", (e) => resolve6({ exitCode: 1, stdout: "", stderr: e.message }));
+    child.on("close", (code) => resolve7({ exitCode: code ?? 1, stdout, stderr }));
+    child.on("error", (e) => resolve7({ exitCode: 1, stdout: "", stderr: e.message }));
   });
 }
 function extractPatchedFiles(output) {
@@ -2880,7 +2963,7 @@ function findGitDir2(cwd) {
   return null;
 }
 function runGit2(args, cwd, signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const child = spawn("git", args, { cwd, signal, env: buildChildEnv(), stdio: ["ignore", "pipe", "pipe"] });
@@ -2890,8 +2973,8 @@ function runGit2(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve6({ stdout, stderr, exitCode: code ?? 0 }));
-    child.on("error", (e) => resolve6({ stdout: "", stderr: e.message, exitCode: 1 }));
+    child.on("close", (code) => resolve7({ stdout, stderr, exitCode: code ?? 0 }));
+    child.on("error", (e) => resolve7({ stdout: "", stderr: e.message, exitCode: 1 }));
   });
 }
 async function fileDiff(input, ctx, signal) {
@@ -3142,8 +3225,8 @@ async function* spawnStream(opts) {
   let spawnFailed = false;
   for (; ; ) {
     while (queue.length === 0) {
-      await new Promise((resolve6) => {
-        waiter = resolve6;
+      await new Promise((resolve7) => {
+        waiter = resolve7;
       });
     }
     const chunk = queue.shift();
@@ -3862,7 +3945,7 @@ async function detectManager2(cwd) {
   return "npm";
 }
 function runOutdated(manager, args, cwd, signal) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const MAX = 1e5;
@@ -3875,10 +3958,10 @@ function runOutdated(manager, args, cwd, signal) {
     });
     child.on("close", (code) => {
       const result = parseOutdatedOutput(stdout, code ?? 0);
-      resolve6(result);
+      resolve7(result);
     });
     child.on("error", (e) => {
-      resolve6({
+      resolve7({
         exit_code: 1,
         packages: [],
         total: 0,
@@ -4002,21 +4085,39 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
     };
   }
   args.push("--timestamps", service);
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
     const MAX = 2e5;
+    let settled = false;
+    const empty = () => ({
+      source: `docker:${service}`,
+      entries: [],
+      total: 0,
+      truncated: false,
+      stream_mode: false
+    });
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve7(result);
+    };
     const child = spawn("docker", args, { cwd, signal, env: buildChildEnv(), stdio: ["ignore", "pipe", "pipe"] });
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      finish(empty());
+    }, DOCKER_LOGS_TIMEOUT_MS);
     child.stdout?.on("data", (c) => {
       if (stdout.length < MAX) stdout += c.toString();
     });
     child.stderr?.on("data", (c) => {
       if (stderr.length < MAX) stderr += c.toString();
     });
-    child.on("close", (code) => {
+    child.on("close", () => {
       const output = stdout + stderr;
       const entries = parseLogLines(output, filterRe);
-      resolve6({
+      finish({
         source: `docker:${service}`,
         entries,
         total: entries.length,
@@ -4024,17 +4125,10 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
         stream_mode: false
       });
     });
-    child.on("error", (e) => {
-      resolve6({
-        source: `docker:${service}`,
-        entries: [],
-        total: 0,
-        truncated: false,
-        stream_mode: false
-      });
-    });
+    child.on("error", () => finish(empty()));
   });
 }
+var DOCKER_LOGS_TIMEOUT_MS = 3e3;
 var MAX_TAIL_LINES = 1e5;
 async function fileLogs(path18, lines, filterRe, stream) {
   const { createInterface } = await import('node:readline');
@@ -5747,7 +5841,7 @@ function syncGoParse(filePath, content, lang) {
     mkdirSync(tmpDir, { recursive: true });
     const scriptPath = path.join(tmpDir, "parse.go");
     writeFileSync(scriptPath, GO_PARSE_SCRIPT, "utf8");
-    const stdout = execSync(`go run "${scriptPath}"`, {
+    const stdout = execFileSync("go", ["run", scriptPath], {
       input: content,
       timeout: 15e3,
       encoding: "utf8",
@@ -5993,7 +6087,7 @@ function syncPyParse(filePath, lang) {
     mkdirSync(tmpDir, { recursive: true });
     const scriptPath = path.join(tmpDir, "parse.py");
     writeFileSync(scriptPath, PY_PARSE_SCRIPT, "utf8");
-    const stdout = execSync(`python "${scriptPath}" "${filePath}"`, {
+    const stdout = execFileSync("python", [scriptPath, filePath], {
       timeout: 15e3,
       encoding: "utf8",
       windowsHide: true
@@ -6031,11 +6125,19 @@ function parseSymbols4(opts) {
 }
 function checkNativeParser() {
   try {
-    execSync("rustc --version", { stdio: "pipe" });
+    execFileSync("rustc", ["--version"], { stdio: "pipe" });
     const toolsDir = path.join(process.cwd(), "tools");
     try {
-      execSync(
-        "cargo metadata --no-deps --format-version 1 --manifest-path " + path.join(toolsDir, "Cargo.toml"),
+      execFileSync(
+        "cargo",
+        [
+          "metadata",
+          "--no-deps",
+          "--format-version",
+          "1",
+          "--manifest-path",
+          path.join(toolsDir, "Cargo.toml")
+        ],
         { stdio: "pipe" }
       );
       return true;