@wrongstack/tools 1.0.8 → 1.0.9

package/dist/{chunk-SEONDNLN.js → chunk-G7CYW5EP.js}

@@ -1,6 +1,6 @@
 import {
   spawnStream
-} from "./chunk-EMA2XENR.js";
+} from "./chunk-UVYRQKPZ.js";
 import {
   normalizeCommandOutput,
   safeResolveReal
@@ -3515,4 +3515,4 @@ export {
   languagePackageTool,
   languageInfoTool
 };
-//# sourceMappingURL=chunk-SEONDNLN.js.map
+//# sourceMappingURL=chunk-G7CYW5EP.js.map

package/dist/{chunk-MF6ZUBI7.js → chunk-HV7RWDCL.js}

@@ -1,10 +1,10 @@
 import {
   builtinToolsPack
-} from "./chunk-YUK3WLHJ.js";
+} from "./chunk-WEUEU53R.js";
 import {
   TIER1_TOOLS,
   TIER2_TOOLS
-} from "./chunk-GNLHBDFO.js";
+} from "./chunk-OXO773CW.js";
 
 // src/tool-tier.ts
 function toolNameSet(tools) {
@@ -54,4 +54,4 @@ export {
   selectBuiltinToolsForTier,
   registerBuiltinToolTier
 };
-//# sourceMappingURL=chunk-MF6ZUBI7.js.map
+//# sourceMappingURL=chunk-HV7RWDCL.js.map

package/dist/{chunk-TU6UVATU.js → chunk-HYHE4VNA.js}

@@ -13,7 +13,7 @@ import {
   projectIndexServerMetadataPath,
   projectIndexServerStderrPath,
   readProjectIndexServerStderrTail
-} from "./chunk-ZOUG3KKS.js";
+} from "./chunk-XPVYZ2S6.js";
 import {
   CircuitOpenError,
   IndexTimeoutError,
@@ -28,7 +28,7 @@ import {
   searchService,
   statsService,
   symbolGraphService
-} from "./chunk-C4DSQBTT.js";
+} from "./chunk-NEYUPZL6.js";
 import {
   recordIpcPending
 } from "./chunk-ZKC5UNGD.js";
@@ -1352,4 +1352,4 @@ export {
   checkCodebaseIndexServerHealth,
   ensureCodebaseIndexServer
 };
-//# sourceMappingURL=chunk-TU6UVATU.js.map
+//# sourceMappingURL=chunk-HYHE4VNA.js.map

package/dist/{chunk-HIRVCXLP.js → chunk-IE4KDAOB.js}

@@ -1,10 +1,10 @@
 import {
   getIndexState,
   searchCodebaseIndex
-} from "./chunk-TU6UVATU.js";
+} from "./chunk-HYHE4VNA.js";
 import {
   codebaseIndexDirOverride
-} from "./chunk-C4DSQBTT.js";
+} from "./chunk-NEYUPZL6.js";
 import {
   isBinaryBuffer,
   safeResolveReal,
@@ -340,4 +340,4 @@ ${interesting.join("\n")}` : "symbols/imports: (none detected)"
 export {
   readTool
 };
-//# sourceMappingURL=chunk-HIRVCXLP.js.map
+//# sourceMappingURL=chunk-IE4KDAOB.js.map

package/dist/{chunk-YA2ZYCJY.js → chunk-JPK2HHBK.js}

@@ -82,4 +82,4 @@ var toolSearchTool = {
 export {
   toolSearchTool
 };
-//# sourceMappingURL=chunk-YA2ZYCJY.js.map
+//# sourceMappingURL=chunk-JPK2HHBK.js.map

package/dist/{chunk-7E55DAFW.js → chunk-KHUCKLOR.js}

@@ -1,6 +1,6 @@
 import {
   resolvePythonBinary
-} from "./chunk-M2W36JT7.js";
+} from "./chunk-4CE3RKEP.js";
 import {
   parseParserBatchOutput,
   recordParserSubprocess,
@@ -8,7 +8,7 @@ import {
 } from "./chunk-ZKC5UNGD.js";
 import {
   resolveWin32Command
-} from "./chunk-5U5ULQX2.js";
+} from "./chunk-XZLVJD56.js";
 
 // src/codebase-index/import-extractor.ts
 var IMPORT_MAX_FILE_CHARS = 512 * 1024;
@@ -140,6 +140,7 @@ import * as fsSync from "node:fs";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import { StringDecoder } from "node:string_decoder";
 var MAX_BATCH_FILES = 100;
 var MAX_BATCH_BYTES = 8 * 1024 * 1024;
 function chunkBatchFiles(files) {
@@ -665,15 +666,19 @@ function runToolchainChild(binary, args, stdinPayload, timeoutMs) {
     }, timeoutMs);
     timer.unref?.();
     proc.on("error", () => finish(null));
+    const stdoutDecoder = new StringDecoder("utf8");
     proc.stdout?.on("data", (chunk) => {
-      stdout += chunk.toString();
+      stdout += stdoutDecoder.write(chunk);
     });
     proc.stderr?.resume();
     proc.stdin?.on("error", () => {
     });
     proc.stdin?.write(stdinPayload);
     proc.stdin?.end();
-    proc.on("close", (code) => finish({ code, stdout }));
+    proc.on("close", (code) => {
+      stdout += stdoutDecoder.end();
+      finish({ code, stdout });
+    });
   });
 }
 async function runGoBatch(files, goBinary) {
@@ -830,11 +835,11 @@ async function dispatch(file, content, lang) {
       return parseSymbols({ file, content, lang });
     }
     case "go": {
-      const { parseSymbols } = await import("./go-parser-VDPRQEGM.js");
+      const { parseSymbols } = await import("./go-parser-Z4H6SR3R.js");
       return parseSymbols({ file, content, lang: "go" });
     }
     case "py": {
-      const { parseSymbols } = await import("./py-parser-MAW6DHFE.js");
+      const { parseSymbols } = await import("./py-parser-4PFZYAJ7.js");
       return parseSymbols({ file, content, lang: "py" });
     }
     case "rs": {
@@ -891,4 +896,4 @@ export {
   parseFileContent,
   parseFilesContent
 };
-//# sourceMappingURL=chunk-7E55DAFW.js.map
+//# sourceMappingURL=chunk-KHUCKLOR.js.map

package/dist/{chunk-R3HIZVFS.js → chunk-KPDCKSN5.js}

@@ -1,15 +1,17 @@
 import {
   tryLegacyCodeOperation
-} from "./chunk-3LQJXJDM.js";
+} from "./chunk-E7A4SLKR.js";
 import {
   spawnStream
-} from "./chunk-EMA2XENR.js";
+} from "./chunk-UVYRQKPZ.js";
 import {
+  ensureInsideRoot,
   normalizeCommandOutput,
   safeResolveReal
 } from "./chunk-2IAEJRLT.js";
 
 // src/lint.ts
+import * as path from "node:path";
 import { ToolValidationError } from "@wrongstack/core/types";
 var lintTool = {
   name: "lint",
@@ -67,6 +69,11 @@ var lintTool = {
       });
       if (bridge?.run) {
         const run = bridge.run;
+        if (run.status === "unavailable" || run.status === "cancelled" || run.status === "timed_out") {
+          throw new Error(
+            `lint: ${bridge.language} lint did not run (${run.status})${run.error ? `: ${run.error}` : ""}`
+          );
+        }
         yield {
           type: "final",
           output: {
@@ -108,6 +115,16 @@ var lintTool = {
         });
       }
     }
+    for (const f of files) {
+      try {
+        ensureInsideRoot(path.resolve(cwd, f), ctx);
+      } catch (err) {
+        throw new ToolValidationError({
+          message: `lint: file "${f}" ${err.message}`,
+          field: "files"
+        });
+      }
+    }
     const args = [];
     if (detected === "eslint") {
       if (input.fix) args.push("--fix");
@@ -119,6 +136,9 @@ var lintTool = {
     }
     const cmd = detected === "biome" ? "biome" : detected;
     const result = yield* spawnStream({ cmd, args, cwd, signal, maxBytes: 1e5 });
+    if (result.error) {
+      throw new Error(`lint: could not run ${cmd}: ${result.error}`);
+    }
     const combined = `${result.stdout}
 ${result.stderr}`;
     let errors = 0;
@@ -189,4 +209,4 @@ async function detectLinter(cwd) {
 export {
   lintTool
 };
-//# sourceMappingURL=chunk-R3HIZVFS.js.map
+//# sourceMappingURL=chunk-KPDCKSN5.js.map

package/dist/{chunk-B3MGJBFI.js → chunk-KS2OEZWV.js}

@@ -1,6 +1,7 @@
 // src/tool-use.ts
 import {
-  GOVERNED_TOOL_EXECUTOR_META_KEY
+  GOVERNED_TOOL_EXECUTOR_META_KEY,
+  ToolValidationError
 } from "@wrongstack/core/types";
 var toolUseTool = {
   name: "tool_use",
@@ -33,67 +34,42 @@ var toolUseTool = {
   async execute(input, ctx) {
     const start = Date.now();
     if (!input?.tool) {
-      return {
-        tool: "unknown",
-        success: false,
-        error: "tool_use: tool name is required",
-        executionMs: 0
-      };
+      throw new ToolValidationError({ message: "tool_use: tool name is required", field: "tool" });
     }
     const tool = (ctx.catalogTools ?? ctx.tools).find((t) => t.name === input.tool);
     if (!tool) {
-      return {
-        tool: input.tool,
-        success: false,
-        error: `tool_use: tool "${input.tool}" not found`,
-        executionMs: Date.now() - start
-      };
+      throw new ToolValidationError({
+        message: `tool_use: tool "${input.tool}" not found`,
+        field: "tool"
+      });
     }
     if (tool.name === toolUseTool.name) {
-      return {
-        tool: input.tool,
-        success: false,
-        error: "tool_use: recursive meta-tool execution is not allowed",
-        executionMs: Date.now() - start
-      };
+      throw new ToolValidationError({
+        message: "tool_use: recursive meta-tool execution is not allowed",
+        field: "tool"
+      });
     }
     if (tool.permission === "deny") {
-      return {
-        tool: input.tool,
-        success: false,
-        error: `tool_use: tool "${input.tool}" is denied by policy`,
-        executionMs: Date.now() - start
-      };
+      throw new Error(`tool_use: tool "${input.tool}" is denied by policy`);
     }
     const governedExecute = ctx.meta?.[GOVERNED_TOOL_EXECUTOR_META_KEY];
     if (typeof governedExecute !== "function") {
-      return {
-        tool: input.tool,
-        success: false,
-        error: "tool_use: governed nested execution is unavailable; call the tool directly",
-        executionMs: Date.now() - start
-      };
+      throw new Error("tool_use: governed nested execution is unavailable; call the tool directly");
     }
-    try {
-      const result = await governedExecute(input.tool, input.input ?? {});
-      return {
-        tool: input.tool,
-        success: result.success,
-        ...result.success ? { result: result.result } : { error: result.error ?? "nested tool failed" },
-        executionMs: Date.now() - start
-      };
-    } catch (e) {
-      return {
-        tool: input.tool,
-        success: false,
-        error: e instanceof Error ? e.message : String(e),
-        executionMs: Date.now() - start
-      };
+    const result = await governedExecute(input.tool, input.input ?? {});
+    if (!result.success) {
+      throw new Error(`tool_use: "${input.tool}" failed: ${result.error ?? "nested tool failed"}`);
     }
+    return {
+      tool: input.tool,
+      success: true,
+      result: result.result,
+      executionMs: Date.now() - start
+    };
   }
 };
 
 export {
   toolUseTool
 };
-//# sourceMappingURL=chunk-B3MGJBFI.js.map
+//# sourceMappingURL=chunk-KS2OEZWV.js.map

package/dist/{chunk-UI3ZJIG3.js → chunk-LKLIQUCW.js}

@@ -1,4 +1,5 @@
 // src/mode.ts
+import { ToolValidationError } from "@wrongstack/core/types";
 function modeFamily(mode) {
   if (mode.tags?.includes("lite")) return "lite";
   if (mode.tags?.includes("deep")) return "deep";
@@ -63,11 +64,17 @@ function createModeTool(modeStore) {
         }
         case "set": {
           if (!input.mode) {
-            return { action: "set", success: false, message: "mode is required for action=set" };
+            throw new ToolValidationError({
+              message: "mode: mode is required for action=set",
+              field: "mode"
+            });
           }
           const mode = await modeStore.getMode(input.mode);
           if (!mode) {
-            return { action: "set", success: false, message: `Mode "${input.mode}" not found` };
+            throw new ToolValidationError({
+              message: `mode: Mode "${input.mode}" not found \u2014 use action=list to see available modes`,
+              field: "mode"
+            });
           }
           await modeStore.setActiveMode(input.mode);
           return {
@@ -88,11 +95,10 @@ ${mode.description}`
           };
         }
         default:
-          return {
-            action: input.action,
-            success: false,
-            message: `Unknown action "${input.action}"`
-          };
+          throw new ToolValidationError({
+            message: `mode: Unknown action "${input?.action}". Allowed: get, list, set, clear`,
+            field: "action"
+          });
       }
     }
   };
@@ -101,4 +107,4 @@ ${mode.description}`
 export {
   createModeTool
 };
-//# sourceMappingURL=chunk-UI3ZJIG3.js.map
+//# sourceMappingURL=chunk-LKLIQUCW.js.map

package/dist/{chunk-62OAECEQ.js → chunk-LLSFOUZF.js}

@@ -150,14 +150,15 @@ var searchTool = {
       engineError = fallback.error;
       effectiveSource = "duckduckgo";
     }
-    const finalResults = ranked.slice(0, num);
-    if (!engineError) {
-      cache.set(cacheKey, { results: ranked, source: effectiveSource, timestamp: Date.now() });
-      pruneCacheEntries();
+    if (engineError) {
+      throw new Error(`search: ${engineError}`);
     }
+    const finalResults = ranked.slice(0, num);
+    cache.set(cacheKey, { results: ranked, source: effectiveSource, timestamp: Date.now() });
+    pruneCacheEntries();
     yield {
       type: "partial_output",
-      text: engineError ? `search failed: ${engineError}` : `${finalResults.length} results from ${effectiveSource}`,
+      text: `${finalResults.length} results from ${effectiveSource}`,
       data: { count: finalResults.length, cached: false, source: effectiveSource }
     };
     yield {
@@ -171,8 +172,7 @@ var searchTool = {
         })),
         source: effectiveSource,
         truncated: ranked.length > num,
-        cached: false,
-        ...engineError ? { error: engineError } : {}
+        cached: false
       }
     };
   }
@@ -469,4 +469,4 @@ export {
   __setSearchCacheForTest,
   __getSearchCacheSizeForTest
 };
-//# sourceMappingURL=chunk-62OAECEQ.js.map
+//# sourceMappingURL=chunk-LLSFOUZF.js.map

package/dist/{chunk-YZQSUL5G.js → chunk-M4ZHHCCW.js}

@@ -5,7 +5,12 @@ import {
 // src/tree.ts
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { compileGlob, DEFAULT_WALK_IGNORE_DIRS, expectDefined } from "@wrongstack/core/utils";
+import {
+  compileGlob,
+  DEFAULT_WALK_IGNORE_DIRS,
+  expectDefined,
+  toErrorMessage
+} from "@wrongstack/core/utils";
 var DEFAULT_IGNORE = /* @__PURE__ */ new Set([
   ...DEFAULT_WALK_IGNORE_DIRS,
   ".wrongstack",
@@ -88,9 +93,7 @@ var treeTool = {
     const rawExclude = Array.isArray(input.exclude) ? input.exclude : typeof input.exclude === "string" ? [input.exclude] : [];
     const exclude = /* @__PURE__ */ new Set([
       ...DEFAULT_IGNORE,
-      ...rawExclude.filter((s) => typeof s === "string").map(
-        (s) => s.trim().replace(/\\/g, "/").replace(/\/+$/, "").replace(/^\.\//, "")
-      ).filter(Boolean)
+      ...rawExclude.filter((s) => typeof s === "string").map((s) => s.trim().replace(/\\/g, "/").replace(/\/+$/, "").replace(/^\.\//, "")).filter(Boolean)
     ]);
     const globRe = input.glob ? compileGlob(input.glob) : void 0;
     const maxEntries = typeof input.max_entries === "number" && Number.isFinite(input.max_entries) && input.max_entries > 0 ? Math.floor(input.max_entries) : DEFAULT_MAX_ENTRIES;
@@ -184,7 +187,12 @@ function matchesTreeGlob(globRe, fileName, absPath, basePath) {
 async function walkDir(dir, depth, opts) {
   opts.signal.throwIfAborted();
   if (opts.retention.truncated) return;
-  const entries = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
+  const entries = await fs.readdir(dir, { withFileTypes: true }).catch((err) => {
+    if (depth === 0) {
+      throw new Error(`tree: cannot list "${dir}": ${toErrorMessage(err)}`, { cause: err });
+    }
+    return [];
+  });
   const filtered = entries.filter((e) => {
     if (!opts.showHidden && e.name.startsWith(".")) return false;
     if (opts.exclude.has(e.name)) return false;
@@ -248,4 +256,4 @@ export {
   MAX_TREE_OUTPUT_BYTES,
   treeTool
 };
-//# sourceMappingURL=chunk-YZQSUL5G.js.map
+//# sourceMappingURL=chunk-M4ZHHCCW.js.map

package/dist/{chunk-IXIS7RSG.js → chunk-MRXWOOOR.js}

@@ -16,6 +16,7 @@ import {
 } from "@wrongstack/core/design";
 import { ToolValidationError } from "@wrongstack/core/types";
 import { atomicWrite } from "@wrongstack/core/utils";
+var NO_ACTIVE_KIT = 'design: no active kit. Pick one first: `design {action:"use", kit:"<id>"}`.';
 async function resolveReal(p) {
   const resolved = path.resolve(p);
   let probe = resolved;
@@ -139,16 +140,22 @@ var designTool = {
       const kitId = input.kit?.trim();
       if (!kitId) {
         const menu2 = await loader.menuText();
-        return { action, output: `No kit id provided.
+        throw new ToolValidationError({
+          message: `design: "use" requires a kit id.
 
-${menu2}` };
+${menu2}`,
+          field: "kit"
+        });
       }
       const manifest = await loader.find(kitId);
       if (!manifest) {
         const menu2 = await loader.menuText();
-        return { action, kit: kitId, output: `Kit "${kitId}" not found.
+        throw new ToolValidationError({
+          message: `design: kit "${kitId}" not found.
 
-${menu2}` };
+${menu2}`,
+          field: "kit"
+        });
       }
       const resolvedStack = stack ?? manifest.stacks[0] ?? "web";
       const body = await loader.readBody(manifest.id, resolvedStack);
@@ -192,15 +199,13 @@ ${body}`
     if (action === "set") {
       const patch = normalizeOverrides(input.set);
       if (Object.keys(patch).length === 0) {
-        return { action, output: 'No overrides given. Pass set:{ "primary": "oklch(\u2026)" }.' };
+        throw new ToolValidationError({
+          message: 'design: no overrides given. Pass set:{ "primary": "oklch(\u2026)" }.',
+          field: "set"
+        });
       }
       const merged = await recordOverrides(ctx.projectRoot, patch, (/* @__PURE__ */ new Date()).toISOString());
-      if (!merged) {
-        return {
-          action,
-          output: 'No active kit. Pick one first: `design {action:"use", kit:"<id>"}`.'
-        };
-      }
+      if (!merged) throw new Error(NO_ACTIVE_KIT);
       setDesignOverrides(ctx, merged);
       return {
         action,
@@ -211,18 +216,13 @@ These win over kit tokens. Run \`design {action:"materialize"}\` to write them t
     if (action === "tune") {
       const patch = resolveSemanticTune(input.tune ?? {});
       if (Object.keys(patch).length === 0) {
-        return {
-          action,
-          output: 'No recognized knobs. Pass tune:{ radius:"lg", density:"compact", font:"\u2026", motion:"snappy" }.'
-        };
+        throw new ToolValidationError({
+          message: 'design: no recognized knobs. Pass tune:{ radius:"lg", density:"compact", font:"\u2026", motion:"snappy" }.',
+          field: "tune"
+        });
       }
       const merged = await recordOverrides(ctx.projectRoot, patch, (/* @__PURE__ */ new Date()).toISOString());
-      if (!merged) {
-        return {
-          action,
-          output: 'No active kit. Pick one first: `design {action:"use", kit:"<id>"}`.'
-        };
-      }
+      if (!merged) throw new Error(NO_ACTIVE_KIT);
       setDesignOverrides(ctx, merged);
       return {
         action,
@@ -232,17 +232,10 @@ Run \`design {action:"materialize"}\` to write the tuned tokens to your theme fi
     }
     if (action === "materialize") {
       const active = await loadActiveKit(ctx.projectRoot);
-      if (!active) {
-        return {
-          action,
-          output: 'No active kit. Pick one first: `design {action:"use", kit:"<id>"}`.'
-        };
-      }
+      if (!active) throw new Error(NO_ACTIVE_KIT);
       const resolvedStack = stack ?? (active.stack && isDesignStack(active.stack) ? active.stack : "web");
       const rawTokens = await loader.readTokens(active.kit);
-      if (!rawTokens) {
-        return { action, kit: active.kit, output: `Kit "${active.kit}" has no tokens.json.` };
-      }
+      if (!rawTokens) throw new Error(`design: kit "${active.kit}" has no tokens.json.`);
       const tokens = applyTokenOverrides(rawTokens, active.overrides);
       const result = materializeTokens({
         tokens,
@@ -268,17 +261,13 @@ Run \`design {action:"materialize"}\` to write the tuned tokens to your theme fi
       } catch {
       }
       if (exists && !input.force) {
-        return {
-          action,
-          kit: active.kit,
-          stack: resolvedStack,
-          path: result.path,
-          output: `${result.path} already exists. Re-run with force:true to overwrite, or write this ${result.format} yourself:
+        throw new Error(
+          `design: ${result.path} already exists \u2014 nothing was written. Re-run with force:true to overwrite, or write this ${result.format} yourself:
 
 \`\`\`
 ${result.content}
 \`\`\``
-        };
+        );
       }
       await fs.mkdir(path.dirname(abs), { recursive: true });
       await atomicWrite(abs, result.content);
@@ -293,17 +282,10 @@ ${result.content}
     if (action === "verify") {
       signal?.throwIfAborted();
       const active = await loadActiveKit(ctx.projectRoot);
-      if (!active) {
-        return {
-          action,
-          output: 'No active kit to verify against. Pick one: `design {action:"use", kit:"<id>"}`.'
-        };
-      }
+      if (!active) throw new Error(NO_ACTIVE_KIT);
       signal?.throwIfAborted();
       const rawTokens = await loader.readTokens(active.kit);
-      if (!rawTokens) {
-        return { action, kit: active.kit, output: `Kit "${active.kit}" has no tokens.json.` };
-      }
+      if (!rawTokens) throw new Error(`design: kit "${active.kit}" has no tokens.json.`);
       signal?.throwIfAborted();
       const tokens = applyTokenOverrides(rawTokens, active.overrides);
       const normalizedFiles = input.files ? (Array.isArray(input.files) ? input.files : String(input.files).split(",")).filter((f) => typeof f === "string").map((f) => f.trim().replace(/\\/g, "/")).filter(Boolean) : void 0;
@@ -334,4 +316,4 @@ Replace off-palette colors with kit tokens (or the materialized CSS vars / token
 export {
   designTool
 };
-//# sourceMappingURL=chunk-IXIS7RSG.js.map
+//# sourceMappingURL=chunk-MRXWOOOR.js.map

package/dist/{chunk-C4DSQBTT.js → chunk-NEYUPZL6.js}

@@ -1,6 +1,6 @@
 import {
   parseFilesContent
-} from "./chunk-7E55DAFW.js";
+} from "./chunk-KHUCKLOR.js";
 import {
   recordFilesystemRead
 } from "./chunk-ZKC5UNGD.js";
@@ -4993,7 +4993,7 @@ var ParserWorkerPool = class {
    */
   async reparseInline(batch, orphaned, workerId) {
     try {
-      const { parseFileContent } = await import("./parser-dispatch-4E2SDQUO.js");
+      const { parseFileContent } = await import("./parser-dispatch-WG4DNBHH.js");
       for (const item of orphaned) {
         if (batch.settled) return;
         try {
@@ -5856,4 +5856,4 @@ export {
   incomingCallsService,
   outgoingCallsService
 };
-//# sourceMappingURL=chunk-C4DSQBTT.js.map
+//# sourceMappingURL=chunk-NEYUPZL6.js.map

package/dist/{chunk-6XYFYLN7.js → chunk-O2MHULBO.js}

@@ -133,6 +133,10 @@ async function assertBrowserUrlAllowed(rawUrl, opts) {
   const url = parseBrowserUrl(rawUrl, opts.navigation ?? true);
   if (!opts.navigation && SAFE_SUBRESOURCE_PROTOCOLS.has(url.protocol)) return url;
   if (!opts.allowPrivateHosts && !isAllowedPrivateOrigin(url, opts.allowedPrivateOrigins)) {
+    const normalizedHost = unbracket(url.hostname).replace(/\.+$/, "").toLowerCase();
+    if (normalizedHost === "localhost" || normalizedHost.endsWith(".localhost")) {
+      throw new Error("browser: blocked localhost target");
+    }
     await assertNotPrivateHost(url.hostname);
   }
   return url;
@@ -148,7 +152,8 @@ async function resolvePinnedBrowserTarget(rawUrl, opts = {}) {
     }
     return { url, address: hostname, family: literalFamily };
   }
-  if ((hostname === "localhost" || hostname.endsWith(".localhost")) && !allowPrivate) {
+  const normalizedHost = hostname.replace(/\.+$/, "").toLowerCase();
+  if ((normalizedHost === "localhost" || normalizedHost.endsWith(".localhost")) && !allowPrivate) {
     throw new Error("browser: blocked localhost target");
   }
   const lookup2 = opts.lookup ?? ((host) => dns.lookup(host, { all: true }));
@@ -225,12 +230,12 @@ function safeBrowserUrl(rawUrl) {
   }
 }
 function redactBrowserText(text) {
-  return text.replace(/\bauthorization\b\s*[:=]\s*[^\r\n]+/gi, "Authorization=[REDACTED]").replace(
-    /\bauthorization\b\s*[:=]\s*(?:Basic|Bearer)\s+[^\s,;]+/gi,
-    "Authorization=[REDACTED]"
-  ).replace(/\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi, "Bearer [REDACTED]").replace(
-    /\b(authorization|set[-_ ]?cookie|cookie|api[-_ ]?key|private[-_ ]?key|client[-_ ]?secret|access[-_ ]?token|refresh[-_ ]?token|session[-_ ]?token|auth[-_ ]?token|token|password|secret)\b\s*[:=]\s*[^\s,;]+/gi,
-    "$1=[REDACTED]"
+  return text.replace(/\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi, "Bearer [REDACTED]").replace(
+    /(["']?)\b(authorization|set[-_ ]?cookie|cookie|api[-_ ]?key|private[-_ ]?key|client[-_ ]?secret|access[-_ ]?token|refresh[-_ ]?token|session[-_ ]?token|auth[-_ ]?token|token|password|secret)\b\1(\s*[:=]\s*)((?:"[^"\r\n]*"|'[^'\r\n]*'|(?:Basic|Bearer)\s+[^\s,;]+|[^\s,;]+))/gi,
+    (_match, q1, key, sep, val) => {
+      const quote = val.startsWith('"') ? '"' : val.startsWith("'") ? "'" : "";
+      return `${q1}${key}${q1}${sep}${quote}[REDACTED]${quote}`;
+    }
   );
 }
 
@@ -1420,4 +1425,4 @@ export {
   isBrowserSuiteEnabled,
   shutdownBrowserTools
 };
-//# sourceMappingURL=chunk-6XYFYLN7.js.map
+//# sourceMappingURL=chunk-O2MHULBO.js.map