@xelauvas/xela-cli 0.1.0

package/src/utils/powershell/staticPrefix.ts

@@ -0,0 +1,316 @@
+/**
+ * PowerShell static command prefix extraction.
+ *
+ * Mirrors bash's getCommandPrefixStatic / getCompoundCommandPrefixesStatic
+ * (src/utils/bash/prefix.ts) but uses the PowerShell AST parser instead of
+ * tree-sitter. The AST gives us cmd.name and cmd.args already split; for
+ * external commands we feed those into the same fig-spec walker bash uses
+ * (src/utils/shell/specPrefix.ts) — git/npm/kubectl CLIs are shell-agnostic.
+ *
+ * Feeds the "Yes, and don't ask again for: ___" editable input in the
+ * permission dialog — static extractor provides a best-guess prefix, user
+ * edits it down if needed.
+ */
+
+import { getCommandSpec } from '../bash/registry.js'
+import { buildPrefix, DEPTH_RULES } from '../shell/specPrefix.js'
+import { countCharInString } from '../stringUtils.js'
+import { NEVER_SUGGEST } from './dangerousCmdlets.js'
+import {
+  getAllCommands,
+  type ParsedCommandElement,
+  parsePowerShellCommand,
+} from './parser.js'
+
+/**
+ * Extract a static prefix from a single parsed command element.
+ * Returns null for commands we won't suggest (shells, eval cmdlets, path-like
+ * invocations) or can't extract a meaningful prefix from.
+ */
+async function extractPrefixFromElement(
+  cmd: ParsedCommandElement,
+): Promise<string | null> {
+  // nameType === 'application' means the raw name had path chars (./x, x\y,
+  // x.exe) — PowerShell will run a file, not a named cmdlet. Don't suggest.
+  // Same reasoning as the permission engine's nameType gate (PR #20096).
+  if (cmd.nameType === 'application') {
+    return null
+  }
+
+  const name = cmd.name
+  if (!name) {
+    return null
+  }
+
+  if (NEVER_SUGGEST.has(name.toLowerCase())) {
+    return null
+  }
+
+  // Cmdlets (Verb-Noun): the name alone is the right prefix granularity.
+  // Get-Process -Name pwsh → Get-Process. There's no subcommand concept.
+  if (cmd.nameType === 'cmdlet') {
+    return name
+  }
+
+  // External command. Guard the argv before feeding it to buildPrefix.
+  //
+  // elementTypes[0] (command name) must be a literal. `& $cmd status` has
+  // elementTypes[0]='Variable', name='$cmd' — classifies as 'unknown' (no path
+  // chars), passes NEVER_SUGGEST, getCommandSpec('$cmd')=null → returns bare
+  // '$cmd' → dead rule. Cheap to gate here.
+  //
+  // elementTypes[1..] (args) must all be StringConstant or Parameter. Anything
+  // dynamic (Variable/SubExpression/ScriptBlock/ExpandableString) would embed
+  // `$foo`/`$(...)` in the prefix → dead rule.
+  if (cmd.elementTypes?.[0] !== 'StringConstant') {
+    return null
+  }
+  for (let i = 0; i < cmd.args.length; i++) {
+    const t = cmd.elementTypes[i + 1]
+    if (t !== 'StringConstant' && t !== 'Parameter') {
+      return null
+    }
+  }
+
+  // Consult the fig spec — same oracle bash uses. If git's spec says -C takes
+  // a value, buildPrefix skips -C /repo and finds `status` as a subcommand.
+  // Lowercase for lookup: fig specs are filesystem paths (git.js), case-
+  // sensitive on Linux. PowerShell is case-insensitive (Git === git) so `Git`
+  // must resolve to the git spec. macOS hides this bug (case-insensitive fs).
+  // Call buildPrefix unconditionally — calculateDepth consults DEPTH_RULES
+  // before its own `if (!spec) return 2` fallback, so gcloud/aws/kubectl/az
+  // get depth-aware prefixes even without a loaded spec. The old
+  // `if (!spec) return name` short-circuit produced bare `gcloud:*` which
+  // auto-allows every gcloud subcommand.
+  const nameLower = name.toLowerCase()
+  const spec = await getCommandSpec(nameLower)
+  const prefix = await buildPrefix(name, cmd.args, spec)
+
+  // Post-buildPrefix word integrity: buildPrefix space-joins consumed args
+  // into the prefix string. parser.ts:685 stores .value (quote-stripped) for
+  // single-quoted literals: git 'push origin' → args=['push origin']. If
+  // that arg is consumed, buildPrefix emits 'git push origin' — silently
+  // promoting 1 argv element to 3 prefix words. Rule PowerShell(git push
+  // origin:*) then matches `git push origin --force` (3-element argv) — not
+  // what the user approved.
+  //
+  // The old set-membership check (`!cmd.args.includes(word)`) was defeated
+  // by decoy args: `git 'push origin' push origin` → args=['push origin',
+  // 'push', 'origin'], prefix='git push origin'. Each word ∈ args (decoys at
+  // indices 1,2 satisfy .includes()) → passed. Now POSITIONAL: walk args in
+  // order; each prefix word must exactly match the next non-flag arg. A
+  // positional that doesn't match means buildPrefix split it. Flags and
+  // their values are skipped (buildPrefix skips them too) so
+  // `git -C '/my repo' status` and `git commit -m 'fix typo'` still pass.
+  // Backslash (C:\repo) rejected: dead over-specific rule.
+  let argIdx = 0
+  for (const word of prefix.split(' ').slice(1)) {
+    if (word.includes('\\')) return null
+    while (argIdx < cmd.args.length) {
+      const a = cmd.args[argIdx]!
+      if (a === word) break
+      if (a.startsWith('-')) {
+        argIdx++
+        // Only skip the flag's value if the spec says this flag takes a
+        // value argument. Without spec info, treat as a switch (no value)
+        // — fail-safe avoids over-skipping positional args. (bug #16)
+        if (
+          spec?.options &&
+          argIdx < cmd.args.length &&
+          cmd.args[argIdx] !== word &&
+          !cmd.args[argIdx]!.startsWith('-')
+        ) {
+          const flagLower = a.toLowerCase()
+          const opt = spec.options.find(o =>
+            Array.isArray(o.name)
+              ? o.name.includes(flagLower)
+              : o.name === flagLower,
+          )
+          if (opt?.args) {
+            argIdx++
+          }
+        }
+        continue
+      }
+      // Positional arg that isn't the expected word → arg was split.
+      return null
+    }
+    if (argIdx >= cmd.args.length) return null
+    argIdx++
+  }
+
+  // Bare-root guard: buildPrefix returns 'git' for `git` with no subcommand
+  // found (empty args, or only global flags). That's too broad — would
+  // auto-allow `git push --force` forever. Bash's extractor doesn't gate this
+  // (bash/prefix.ts:363, separate fix). Reject single-word results for
+  // commands whose spec declares subcommands OR that have DEPTH_RULES entries
+  // (gcloud, aws, kubectl, etc.) which implies subcommand structure even
+  // without a loaded spec. (bug #17)
+  if (
+    !prefix.includes(' ') &&
+    (spec?.subcommands?.length || DEPTH_RULES[nameLower])
+  ) {
+    return null
+  }
+  return prefix
+}
+
+/**
+ * Extract a prefix suggestion for a PowerShell command.
+ *
+ * Parses the command, takes the first CommandAst, returns a prefix suitable
+ * for the permission dialog's "don't ask again for: ___" editable input.
+ * Returns null when no safe prefix can be extracted (parse failure, shell
+ * invocation, path-like name, bare subcommand-aware command).
+ */
+export async function getCommandPrefixStatic(
+  command: string,
+): Promise<{ commandPrefix: string | null } | null> {
+  const parsed = await parsePowerShellCommand(command)
+  if (!parsed.valid) {
+    return null
+  }
+
+  // Find the first actual command (CommandAst). getAllCommands iterates
+  // both statement.commands and statement.nestedCommands (for &&/||/if/for).
+  // Skip synthetic CommandExpressionAst entries (expression pipeline sources,
+  // non-PipelineAst statement placeholders).
+  const firstCommand = getAllCommands(parsed).find(
+    cmd => cmd.elementType === 'CommandAst',
+  )
+  if (!firstCommand) {
+    return { commandPrefix: null }
+  }
+
+  return { commandPrefix: await extractPrefixFromElement(firstCommand) }
+}
+
+/**
+ * Extract prefixes for all subcommands in a compound PowerShell command.
+ *
+ * For `Get-Process; git status && npm test`, returns per-subcommand prefixes.
+ * Subcommands for which `excludeSubcommand` returns true (e.g. already
+ * read-only/auto-allowed) are skipped — no point suggesting a rule for them.
+ * Prefixes sharing a root are collapsed via word-aligned LCP:
+ * `npm run test && npm run lint` → `npm run`.
+ *
+ * The filter receives the ParsedCommandElement (not cmd.text) because
+ * PowerShell's read-only check (isAllowlistedCommand) needs the element's
+ * structured fields (nameType, args). Passing text would require reparsing,
+ * which spawns pwsh.exe per subcommand — expensive and wasteful since we
+ * already have the parsed elements here. Bash's equivalent passes text
+ * because BashTool.isReadOnly works from regex/patterns, not parsed AST.
+ */
+export async function getCompoundCommandPrefixesStatic(
+  command: string,
+  excludeSubcommand?: (element: ParsedCommandElement) => boolean,
+): Promise<string[]> {
+  const parsed = await parsePowerShellCommand(command)
+  if (!parsed.valid) {
+    return []
+  }
+
+  const commands = getAllCommands(parsed).filter(
+    cmd => cmd.elementType === 'CommandAst',
+  )
+
+  // Single command — no compound collapse needed.
+  if (commands.length <= 1) {
+    const prefix = commands[0]
+      ? await extractPrefixFromElement(commands[0])
+      : null
+    return prefix ? [prefix] : []
+  }
+
+  const prefixes: string[] = []
+  for (const cmd of commands) {
+    if (excludeSubcommand?.(cmd)) {
+      continue
+    }
+    const prefix = await extractPrefixFromElement(cmd)
+    if (prefix) {
+      prefixes.push(prefix)
+    }
+  }
+
+  if (prefixes.length === 0) {
+    return []
+  }
+
+  // Group by root command (first word) and collapse each group via
+  // word-aligned longest common prefix. `npm run test` + `npm run lint`
+  // → `npm run`. But NEVER collapse down to a bare subcommand-aware root:
+  // `git add` + `git commit` would LCP to `git`, which extractPrefixFromElement
+  // explicitly refuses as too broad (line ~119). Collapsing through that gate
+  // would suggest PowerShell(git:*) → auto-allows git push --force forever.
+  // When LCP yields a bare subcommand-aware root, drop the group entirely
+  // rather than suggest either the too-broad root or N un-collapsed rules.
+  //
+  // Bash's getCompoundCommandPrefixesStatic has this same collapse without
+  // the guard (src/utils/bash/prefix.ts:360-365) — that's a separate fix.
+  //
+  // Grouping and word-comparison are case-insensitive (PowerShell is
+  // case-insensitive: Git === git, Get-Process === get-process). The Map key
+  // is lowercased; the emitted prefix keeps the first-seen casing.
+  const groups = new Map<string, string[]>()
+  for (const prefix of prefixes) {
+    const root = prefix.split(' ')[0]!
+    const key = root.toLowerCase()
+    const group = groups.get(key)
+    if (group) {
+      group.push(prefix)
+    } else {
+      groups.set(key, [prefix])
+    }
+  }
+
+  const collapsed: string[] = []
+  for (const [rootLower, group] of groups) {
+    const lcp = wordAlignedLCP(group)
+    const lcpWordCount = lcp === '' ? 0 : countCharInString(lcp, ' ') + 1
+    if (lcpWordCount <= 1) {
+      // LCP collapsed to a single word. If that root's fig spec declares
+      // subcommands, this is the same too-broad case extractPrefixFromElement
+      // rejects (bare `git` → allows `git push --force`). Drop the group.
+      // getCommandSpec is LRU-memoized; one lookup per distinct root.
+      const rootSpec = await getCommandSpec(rootLower)
+      if (rootSpec?.subcommands?.length || DEPTH_RULES[rootLower]) {
+        continue
+      }
+    }
+    collapsed.push(lcp)
+  }
+  return collapsed
+}
+
+/**
+ * Word-aligned longest common prefix. Doesn't chop mid-word.
+ * Case-insensitive comparison (PowerShell: Git === git), emits first
+ * string's casing.
+ * ["npm run test", "npm run lint"] → "npm run"
+ * ["Git status", "git log"] → "Git" (first-seen casing)
+ * ["Get-Process"] → "Get-Process"
+ */
+function wordAlignedLCP(strings: string[]): string {
+  if (strings.length === 0) return ''
+  if (strings.length === 1) return strings[0]!
+
+  const firstWords = strings[0]!.split(' ')
+  let commonWordCount = firstWords.length
+
+  for (let i = 1; i < strings.length; i++) {
+    const words = strings[i]!.split(' ')
+    let matchCount = 0
+    while (
+      matchCount < commonWordCount &&
+      matchCount < words.length &&
+      words[matchCount]!.toLowerCase() === firstWords[matchCount]!.toLowerCase()
+    ) {
+      matchCount++
+    }
+    commonWordCount = matchCount
+    if (commonWordCount === 0) break
+  }
+
+  return firstWords.slice(0, commonWordCount).join(' ')
+}

package/src/utils/preflightChecks.tsx

@@ -0,0 +1,151 @@
+import { c as _c } from "react/compiler-runtime";
+import axios from 'axios';
+import React, { useEffect, useState } from 'react';
+import { logEvent } from 'src/services/analytics/index.js';
+import { Spinner } from '../components/Spinner.js';
+import { getOauthConfig } from '../constants/oauth.js';
+import { useTimeout } from '../hooks/useTimeout.js';
+import { Box, Text } from '../ink.js';
+import { getSSLErrorHint } from '../services/api/errorUtils.js';
+import { getUserAgent } from './http.js';
+import { logError } from './log.js';
+export interface PreflightCheckResult {
+  success: boolean;
+  error?: string;
+  sslHint?: string;
+}
+async function checkEndpoints(): Promise<PreflightCheckResult> {
+  try {
+    const oauthConfig = getOauthConfig();
+    const tokenUrl = new URL(oauthConfig.TOKEN_URL);
+    const endpoints = [`${oauthConfig.BASE_API_URL}/api/hello`, `${tokenUrl.origin}/v1/oauth/hello`];
+    const checkEndpoint = async (url: string): Promise<PreflightCheckResult> => {
+      try {
+        const response = await axios.get(url, {
+          headers: {
+            'User-Agent': getUserAgent()
+          }
+        });
+        if (response.status !== 200) {
+          const hostname = new URL(url).hostname;
+          return {
+            success: false,
+            error: `Failed to connect to ${hostname}: Status ${response.status}`
+          };
+        }
+        return {
+          success: true
+        };
+      } catch (error) {
+        const hostname = new URL(url).hostname;
+        const sslHint = getSSLErrorHint(error);
+        return {
+          success: false,
+          error: `Failed to connect to ${hostname}: ${error instanceof Error ? (error as ErrnoException).code || error.message : String(error)}`,
+          sslHint: sslHint ?? undefined
+        };
+      }
+    };
+    const results = await Promise.all(endpoints.map(checkEndpoint));
+    const failedResult = results.find(result => !result.success);
+    if (failedResult) {
+      // Log failure to Statsig
+      logEvent('tengu_preflight_check_failed', {
+        isConnectivityError: false,
+        hasErrorMessage: !!failedResult.error,
+        isSSLError: !!failedResult.sslHint
+      });
+    }
+    return failedResult || {
+      success: true
+    };
+  } catch (error) {
+    logError(error as Error);
+
+    // Log to Statsig
+    logEvent('tengu_preflight_check_failed', {
+      isConnectivityError: true
+    });
+    return {
+      success: false,
+      error: `Connectivity check error: ${error instanceof Error ? (error as ErrnoException).code || error.message : String(error)}`
+    };
+  }
+}
+interface PreflightStepProps {
+  onSuccess: () => void;
+}
+export function PreflightStep(t0) {
+  const $ = _c(12);
+  const {
+    onSuccess
+  } = t0;
+  const [result, setResult] = useState(null);
+  const [isChecking, setIsChecking] = useState(true);
+  const showSpinner = useTimeout(1000) && isChecking;
+  let t1;
+  let t2;
+  if ($[0] === Symbol.for("react.memo_cache_sentinel")) {
+    t1 = () => {
+      const run = async function run() {
+        const checkResult = await checkEndpoints();
+        setResult(checkResult);
+        setIsChecking(false);
+      };
+      run();
+    };
+    t2 = [];
+    $[0] = t1;
+    $[1] = t2;
+  } else {
+    t1 = $[0];
+    t2 = $[1];
+  }
+  useEffect(t1, t2);
+  let t3;
+  let t4;
+  if ($[2] !== onSuccess || $[3] !== result) {
+    t3 = () => {
+      if (result?.success) {
+        onSuccess();
+      } else {
+        if (result && !result.success) {
+          const timer = setTimeout(_temp, 100);
+          return () => clearTimeout(timer);
+        }
+      }
+    };
+    t4 = [result, onSuccess];
+    $[2] = onSuccess;
+    $[3] = result;
+    $[4] = t3;
+    $[5] = t4;
+  } else {
+    t3 = $[4];
+    t4 = $[5];
+  }
+  useEffect(t3, t4);
+  let t5;
+  if ($[6] !== isChecking || $[7] !== result || $[8] !== showSpinner) {
+    t5 = isChecking && showSpinner ? <Box paddingLeft={1}><Spinner /><Text>Checking connectivity...</Text></Box> : !result?.success && !isChecking && <Box flexDirection="column" gap={1}><Text color="error">Unable to connect to Anthropic services</Text><Text color="error">{result?.error}</Text>{result?.sslHint ? <Box flexDirection="column" gap={1}><Text>{result.sslHint}</Text><Text color="suggestion">See https://code.claude.com/docs/en/network-config</Text></Box> : <Box flexDirection="column" gap={1}><Text>Please check your internet connection and network settings.</Text><Text>Note: Claude Code might not be available in your country. Check supported countries at{" "}<Text color="suggestion">https://anthropic.com/supported-countries</Text></Text></Box>}</Box>;
+    $[6] = isChecking;
+    $[7] = result;
+    $[8] = showSpinner;
+    $[9] = t5;
+  } else {
+    t5 = $[9];
+  }
+  let t6;
+  if ($[10] !== t5) {
+    t6 = <Box flexDirection="column" gap={1} paddingLeft={1}>{t5}</Box>;
+    $[10] = t5;
+    $[11] = t6;
+  } else {
+    t6 = $[11];
+  }
+  return t6;
+}
+function _temp() {
+  return process.exit(1);
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJheGlvcyIsIlJlYWN0IiwidXNlRWZmZWN0IiwidXNlU3RhdGUiLCJsb2dFdmVudCIsIlNwaW5uZXIiLCJnZXRPYXV0aENvbmZpZyIsInVzZVRpbWVvdXQiLCJCb3giLCJUZXh0IiwiZ2V0U1NMRXJyb3JIaW50IiwiZ2V0VXNlckFnZW50IiwibG9nRXJyb3IiLCJQcmVmbGlnaHRDaGVja1Jlc3VsdCIsInN1Y2Nlc3MiLCJlcnJvciIsInNzbEhpbnQiLCJjaGVja0VuZHBvaW50cyIsIlByb21pc2UiLCJvYXV0aENvbmZpZyIsInRva2VuVXJsIiwiVVJMIiwiVE9LRU5fVVJMIiwiZW5kcG9pbnRzIiwiQkFTRV9BUElfVVJMIiwib3JpZ2luIiwiY2hlY2tFbmRwb2ludCIsInVybCIsInJlc3BvbnNlIiwiZ2V0IiwiaGVhZGVycyIsInN0YXR1cyIsImhvc3RuYW1lIiwiRXJyb3IiLCJFcnJub0V4Y2VwdGlvbiIsImNvZGUiLCJtZXNzYWdlIiwiU3RyaW5nIiwidW5kZWZpbmVkIiwicmVzdWx0cyIsImFsbCIsIm1hcCIsImZhaWxlZFJlc3VsdCIsImZpbmQiLCJyZXN1bHQiLCJpc0Nvbm5lY3Rpdml0eUVycm9yIiwiaGFzRXJyb3JNZXNzYWdlIiwiaXNTU0xFcnJvciIsIlByZWZsaWdodFN0ZXBQcm9wcyIsIm9uU3VjY2VzcyIsIlByZWZsaWdodFN0ZXAiLCJ0MCIsIiQiLCJfYyIsInNldFJlc3VsdCIsImlzQ2hlY2tpbmciLCJzZXRJc0NoZWNraW5nIiwic2hvd1NwaW5uZXIiLCJ0MSIsInQyIiwiU3ltYm9sIiwiZm9yIiwicnVuIiwiY2hlY2tSZXN1bHQiLCJ0MyIsInQ0IiwidGltZXIiLCJzZXRUaW1lb3V0IiwiX3RlbXAiLCJjbGVhclRpbWVvdXQiLCJ0NSIsInQ2IiwicHJvY2VzcyIsImV4aXQiXSwic291cmNlcyI6WyJwcmVmbGlnaHRDaGVja3MudHN4Il0sInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBheGlvcyBmcm9tICdheGlvcydcbmltcG9ydCBSZWFjdCwgeyB1c2VFZmZlY3QsIHVzZVN0YXRlIH0gZnJvbSAncmVhY3QnXG5pbXBvcnQgeyBsb2dFdmVudCB9IGZyb20gJ3NyYy9zZXJ2aWNlcy9hbmFseXRpY3MvaW5kZXguanMnXG5pbXBvcnQgeyBTcGlubmVyIH0gZnJvbSAnLi4vY29tcG9uZW50cy9TcGlubmVyLmpzJ1xuaW1wb3J0IHsgZ2V0T2F1dGhDb25maWcgfSBmcm9tICcuLi9jb25zdGFudHMvb2F1dGguanMnXG5pbXBvcnQgeyB1c2VUaW1lb3V0IH0gZnJvbSAnLi4vaG9va3MvdXNlVGltZW91dC5qcydcbmltcG9ydCB7IEJveCwgVGV4dCB9IGZyb20gJy4uL2luay5qcydcbmltcG9ydCB7IGdldFNTTEVycm9ySGludCB9IGZyb20gJy4uL3NlcnZpY2VzL2FwaS9lcnJvclV0aWxzLmpzJ1xuaW1wb3J0IHsgZ2V0VXNlckFnZW50IH0gZnJvbSAnLi9odHRwLmpzJ1xuaW1wb3J0IHsgbG9nRXJyb3IgfSBmcm9tICcuL2xvZy5qcydcblxuZXhwb3J0IGludGVyZmFjZSBQcmVmbGlnaHRDaGVja1Jlc3VsdCB7XG4gIHN1Y2Nlc3M6IGJvb2xlYW5cbiAgZXJyb3I/OiBzdHJpbmdcbiAgc3NsSGludD86IHN0cmluZ1xufVxuXG5hc3luYyBmdW5jdGlvbiBjaGVja0VuZHBvaW50cygpOiBQcm9taXNlPFByZWZsaWdodENoZWNrUmVzdWx0PiB7XG4gIHRyeSB7XG4gICAgY29uc3Qgb2F1dGhDb25maWcgPSBnZXRPYXV0aENvbmZpZygpXG4gICAgY29uc3QgdG9rZW5VcmwgPSBuZXcgVVJMKG9hdXRoQ29uZmlnLlRPS0VOX1VSTClcbiAgICBjb25zdCBlbmRwb2ludHMgPSBbXG4gICAgICBgJHtvYXV0aENvbmZpZy5CQVNFX0FQSV9VUkx9L2FwaS9oZWxsb2AsXG4gICAgICBgJHt0b2tlblVybC5vcmlnaW59L3YxL29hdXRoL2hlbGxvYCxcbiAgICBdXG5cbiAgICBjb25zdCBjaGVja0VuZHBvaW50ID0gYXN5bmMgKFxuICAgICAgdXJsOiBzdHJpbmcsXG4gICAgKTogUHJvbWlzZTxQcmVmbGlnaHRDaGVja1Jlc3VsdD4gPT4ge1xuICAgICAgdHJ5IHtcbiAgICAgICAgY29uc3QgcmVzcG9uc2UgPSBhd2FpdCBheGlvcy5nZXQodXJsLCB7XG4gICAgICAgICAgaGVhZGVyczogeyAnVXNlci1BZ2VudCc6IGdldFVzZXJBZ2VudCgpIH0sXG4gICAgICAgIH0pXG4gICAgICAgIGlmIChyZXNwb25zZS5zdGF0dXMgIT09IDIwMCkge1xuICAgICAgICAgIGNvbnN0IGhvc3RuYW1lID0gbmV3IFVSTCh1cmwpLmhvc3RuYW1lXG4gICAgICAgICAgcmV0dXJuIHtcbiAgICAgICAgICAgIHN1Y2Nlc3M6IGZhbHNlLFxuICAgICAgICAgICAgZXJyb3I6IGBGYWlsZWQgdG8gY29ubmVjdCB0byAke2hvc3RuYW1lfTogU3RhdHVzICR7cmVzcG9uc2Uuc3RhdHVzfWAsXG4gICAgICAgICAgfVxuICAgICAgICB9XG4gICAgICAgIHJldHVybiB7IHN1Y2Nlc3M6IHRydWUgfVxuICAgICAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAgICAgY29uc3QgaG9zdG5hbWUgPSBuZXcgVVJMKHVybCkuaG9zdG5hbWVcbiAgICAgICAgY29uc3Qgc3NsSGludCA9IGdldFNTTEVycm9ySGludChlcnJvcilcbiAgICAgICAgcmV0dXJuIHtcbiAgICAgICAgICBzdWNjZXNzOiBmYWxzZSxcbiAgICAgICAgICBlcnJvcjogYEZhaWxlZCB0byBjb25uZWN0IHRvICR7aG9zdG5hbWV9OiAke2Vycm9yIGluc3RhbmNlb2YgRXJyb3IgPyAoZXJyb3IgYXMgRXJybm9FeGNlcHRpb24pLmNvZGUgfHwgZXJyb3IubWVzc2FnZSA6IFN0cmluZyhlcnJvcil9YCxcbiAgICAgICAgICBzc2xIaW50OiBzc2xIaW50ID8/IHVuZGVmaW5lZCxcbiAgICAgICAgfVxuICAgICAgfVxuICAgIH1cblxuICAgIGNvbnN0IHJlc3VsdHMgPSBhd2FpdCBQcm9taXNlLmFsbChlbmRwb2ludHMubWFwKGNoZWNrRW5kcG9pbnQpKVxuICAgIGNvbnN0IGZhaWxlZFJlc3VsdCA9IHJlc3VsdHMuZmluZChyZXN1bHQgPT4gIXJlc3VsdC5zdWNjZXNzKVxuXG4gICAgaWYgKGZhaWxlZFJlc3VsdCkge1xuICAgICAgLy8gTG9nIGZhaWx1cmUgdG8gU3RhdHNpZ1xuICAgICAgbG9nRXZlbnQoJ3Rlbmd1X3ByZWZsaWdodF9jaGVja19mYWlsZWQnLCB7XG4gICAgICAgIGlzQ29ubmVjdGl2aXR5RXJyb3I6IGZhbHNlLFxuICAgICAgICBoYXNFcnJvck1lc3NhZ2U6ICEhZmFpbGVkUmVzdWx0LmVycm9yLFxuICAgICAgICBpc1NTTEVycm9yOiAhIWZhaWxlZFJlc3VsdC5zc2xIaW50LFxuICAgICAgfSlcbiAgICB9XG5cbiAgICByZXR1cm4gZmFpbGVkUmVzdWx0IHx8IHsgc3VjY2VzczogdHJ1ZSB9XG4gIH0gY2F0Y2ggKGVycm9yKSB7XG4gICAgbG9nRXJyb3IoZXJyb3IgYXMgRXJyb3IpXG5cbiAgICAvLyBMb2cgdG8gU3RhdHNpZ1xuICAgIGxvZ0V2ZW50KCd0ZW5ndV9wcmVmbGlnaHRfY2hlY2tfZmFpbGVkJywge1xuICAgICAgaXNDb25uZWN0aXZpdHlFcnJvcjogdHJ1ZSxcbiAgICB9KVxuXG4gICAgcmV0dXJuIHtcbiAgICAgIHN1Y2Nlc3M6IGZhbHNlLFxuICAgICAgZXJyb3I6IGBDb25uZWN0aXZpdHkgY2hlY2sgZXJyb3I6ICR7ZXJyb3IgaW5zdGFuY2VvZiBFcnJvciA/IChlcnJvciBhcyBFcnJub0V4Y2VwdGlvbikuY29kZSB8fCBlcnJvci5tZXNzYWdlIDogU3RyaW5nKGVycm9yKX1gLFxuICAgIH1cbiAgfVxufVxuXG5pbnRlcmZhY2UgUHJlZmxpZ2h0U3RlcFByb3BzIHtcbiAgb25TdWNjZXNzOiAoKSA9PiB2b2lkXG59XG5cbmV4cG9ydCBmdW5jdGlvbiBQcmVmbGlnaHRTdGVwKHtcbiAgb25TdWNjZXNzLFxufTogUHJlZmxpZ2h0U3RlcFByb3BzKTogUmVhY3QuUmVhY3ROb2RlIHtcbiAgY29uc3QgW3Jlc3VsdCwgc2V0UmVzdWx0XSA9IHVzZVN0YXRlPFByZWZsaWdodENoZWNrUmVzdWx0IHwgbnVsbD4obnVsbClcbiAgY29uc3QgW2lzQ2hlY2tpbmcsIHNldElzQ2hlY2tpbmddID0gdXNlU3RhdGUodHJ1ZSlcblxuICAvLyBkZWxheSBzaG93aW5nIHRoZSBjaGVjayBzaW5jZSBpdCdzIHNvIGZhc3QgdGhhdCB3ZSBub3JtYWxseVxuICAvLyB3YW50IHRvIGp1c3QgaW1tZWRpYXRlbHkgc2hvdyB0aGUgbmV4dCBzdGVwIHdpdGhvdXQgYSBmbGFzaFxuICBjb25zdCBzaG93U3Bpbm5lciA9IHVzZVRpbWVvdXQoMTAwMCkgJiYgaXNDaGVja2luZ1xuXG4gIHVzZUVmZmVjdCgoKSA9PiB7XG4gICAgYXN5bmMgZnVuY3Rpb24gcnVuKCkge1xuICAgICAgY29uc3QgY2hlY2tSZXN1bHQgPSBhd2FpdCBjaGVja0VuZHBvaW50cygpXG4gICAgICBzZXRSZXN1bHQoY2hlY2tSZXN1bHQpXG4gICAgICBzZXRJc0NoZWNraW5nKGZhbHNlKVxuICAgIH1cbiAgICB2b2lkIHJ1bigpXG4gIH0sIFtdKVxuXG4gIHVzZUVmZmVjdCgoKSA9PiB7XG4gICAgaWYgKHJlc3VsdD8uc3VjY2Vzcykge1xuICAgICAgb25TdWNjZXNzKClcbiAgICB9IGVsc2UgaWYgKHJlc3VsdCAmJiAhcmVzdWx0LnN1Y2Nlc3MpIHtcbiAgICAgIGNvbnN0IHRpbWVyID0gc2V0VGltZW91dCgoKSA9PiBwcm9jZXNzLmV4aXQoMSksIDEwMClcbiAgICAgIHJldHVybiAoKSA9PiBjbGVhclRpbWVvdXQodGltZXIpXG4gICAgfVxuICB9LCBbcmVzdWx0LCBvblN1Y2Nlc3NdKVxuXG4gIHJldHVybiAoXG4gICAgPEJveCBmbGV4RGlyZWN0aW9uPVwiY29sdW1uXCIgZ2FwPXsxfSBwYWRkaW5nTGVmdD17MX0+XG4gICAgICB7aXNDaGVja2luZyAmJiBzaG93U3Bpbm5lciA/IChcbiAgICAgICAgPEJveCBwYWRkaW5nTGVmdD17MX0+XG4gICAgICAgICAgPFNwaW5uZXIgLz5cbiAgICAgICAgICA8VGV4dD5DaGVja2luZyBjb25uZWN0aXZpdHkuLi48L1RleHQ+XG4gICAgICAgIDwvQm94PlxuICAgICAgKSA6IChcbiAgICAgICAgIXJlc3VsdD8uc3VjY2VzcyAmJlxuICAgICAgICAhaXNDaGVja2luZyAmJiAoXG4gICAgICAgICAgPEJveCBmbGV4RGlyZWN0aW9uPVwiY29sdW1uXCIgZ2FwPXsxfT5cbiAgICAgICAgICAgIDxUZXh0IGNvbG9yPVwiZXJyb3JcIj5VbmFibGUgdG8gY29ubmVjdCB0byBBbnRocm9waWMgc2VydmljZXM8L1RleHQ+XG4gICAgICAgICAgICA8VGV4dCBjb2xvcj1cImVycm9yXCI+e3Jlc3VsdD8uZXJyb3J9PC9UZXh0PlxuICAgICAgICAgICAge3Jlc3VsdD8uc3NsSGludCA/IChcbiAgICAgICAgICAgICAgPEJveCBmbGV4RGlyZWN0aW9uPVwiY29sdW1uXCIgZ2FwPXsxfT5cbiAgICAgICAgICAgICAgICA8VGV4dD57cmVzdWx0LnNzbEhpbnR9PC9UZXh0PlxuICAgICAgICAgICAgICAgIDxUZXh0IGNvbG9yPVwic3VnZ2VzdGlvblwiPlxuICAgICAgICAgICAgICAgICAgU2VlIGh0dHBzOi8vY29kZS5jbGF1ZGUuY29tL2RvY3MvZW4vbmV0d29yay1jb25maWdcbiAgICAgICAgICAgICAgICA8L1RleHQ+XG4gICAgICAgICAgICAgIDwvQm94PlxuICAgICAgICAgICAgKSA6IChcbiAgICAgICAgICAgICAgPEJveCBmbGV4RGlyZWN0aW9uPVwiY29sdW1uXCIgZ2FwPXsxfT5cbiAgICAgICAgICAgICAgICA8VGV4dD5cbiAgICAgICAgICAgICAgICAgIFBsZWFzZSBjaGVjayB5b3VyIGludGVybmV0IGNvbm5lY3Rpb24gYW5kIG5ldHdvcmsgc2V0dGluZ3MuXG4gICAgICAgICAgICAgICAgPC9UZXh0PlxuICAgICAgICAgICAgICAgIDxUZXh0PlxuICAgICAgICAgICAgICAgICAgTm90ZTogQ2xhdWRlIENvZGUgbWlnaHQgbm90IGJlIGF2YWlsYWJsZSBpbiB5b3VyIGNvdW50cnkuXG4gICAgICAgICAgICAgICAgICBDaGVjayBzdXBwb3J0ZWQgY291bnRyaWVzIGF0eycgJ31cbiAgICAgICAgICAgICAgICAgIDxUZXh0IGNvbG9yPVwic3VnZ2VzdGlvblwiPlxuICAgICAgICAgICAgICAgICAgICBodHRwczovL2FudGhyb3BpYy5jb20vc3VwcG9ydGVkLWNvdW50cmllc1xuICAgICAgICAgICAgICAgICAgPC9UZXh0PlxuICAgICAgICAgICAgICAgIDwvVGV4dD5cbiAgICAgICAgICAgICAgPC9Cb3g+XG4gICAgICAgICAgICApfVxuICAgICAgICAgIDwvQm94PlxuICAgICAgICApXG4gICAgICApfVxuICAgIDwvQm94PlxuICApXG59XG4iXSwibWFwcGluZ3MiOiI7QUFBQSxPQUFPQSxLQUFLLE1BQU0sT0FBTztBQUN6QixPQUFPQyxLQUFLLElBQUlDLFNBQVMsRUFBRUMsUUFBUSxRQUFRLE9BQU87QUFDbEQsU0FBU0MsUUFBUSxRQUFRLGlDQUFpQztBQUMxRCxTQUFTQyxPQUFPLFFBQVEsMEJBQTBCO0FBQ2xELFNBQVNDLGNBQWMsUUFBUSx1QkFBdUI7QUFDdEQsU0FBU0MsVUFBVSxRQUFRLHdCQUF3QjtBQUNuRCxTQUFTQyxHQUFHLEVBQUVDLElBQUksUUFBUSxXQUFXO0FBQ3JDLFNBQVNDLGVBQWUsUUFBUSwrQkFBK0I7QUFDL0QsU0FBU0MsWUFBWSxRQUFRLFdBQVc7QUFDeEMsU0FBU0MsUUFBUSxRQUFRLFVBQVU7QUFFbkMsT0FBTyxVQUFVQyxvQkFBb0IsQ0FBQztFQUNwQ0MsT0FBTyxFQUFFLE9BQU87RUFDaEJDLEtBQUssQ0FBQyxFQUFFLE1BQU07RUFDZEMsT0FBTyxDQUFDLEVBQUUsTUFBTTtBQUNsQjtBQUVBLGVBQWVDLGNBQWNBLENBQUEsQ0FBRSxFQUFFQyxPQUFPLENBQUNMLG9CQUFvQixDQUFDLENBQUM7RUFDN0QsSUFBSTtJQUNGLE1BQU1NLFdBQVcsR0FBR2IsY0FBYyxDQUFDLENBQUM7SUFDcEMsTUFBTWMsUUFBUSxHQUFHLElBQUlDLEdBQUcsQ0FBQ0YsV0FBVyxDQUFDRyxTQUFTLENBQUM7SUFDL0MsTUFBTUMsU0FBUyxHQUFHLENBQ2hCLEdBQUdKLFdBQVcsQ0FBQ0ssWUFBWSxZQUFZLEVBQ3ZDLEdBQUdKLFFBQVEsQ0FBQ0ssTUFBTSxpQkFBaUIsQ0FDcEM7SUFFRCxNQUFNQyxhQUFhLEdBQUcsTUFBQUEsQ0FDcEJDLEdBQUcsRUFBRSxNQUFNLENBQ1osRUFBRVQsT0FBTyxDQUFDTCxvQkFBb0IsQ0FBQyxJQUFJO01BQ2xDLElBQUk7UUFDRixNQUFNZSxRQUFRLEdBQUcsTUFBTTVCLEtBQUssQ0FBQzZCLEdBQUcsQ0FBQ0YsR0FBRyxFQUFFO1VBQ3BDRyxPQUFPLEVBQUU7WUFBRSxZQUFZLEVBQUVuQixZQUFZLENBQUM7VUFBRTtRQUMxQyxDQUFDLENBQUM7UUFDRixJQUFJaUIsUUFBUSxDQUFDRyxNQUFNLEtBQUssR0FBRyxFQUFFO1VBQzNCLE1BQU1DLFFBQVEsR0FBRyxJQUFJWCxHQUFHLENBQUNNLEdBQUcsQ0FBQyxDQUFDSyxRQUFRO1VBQ3RDLE9BQU87WUFDTGxCLE9BQU8sRUFBRSxLQUFLO1lBQ2RDLEtBQUssRUFBRSx3QkFBd0JpQixRQUFRLFlBQVlKLFFBQVEsQ0FBQ0csTUFBTTtVQUNwRSxDQUFDO1FBQ0g7UUFDQSxPQUFPO1VBQUVqQixPQUFPLEVBQUU7UUFBSyxDQUFDO01BQzFCLENBQUMsQ0FBQyxPQUFPQyxLQUFLLEVBQUU7UUFDZCxNQUFNaUIsUUFBUSxHQUFHLElBQUlYLEdBQUcsQ0FBQ00sR0FBRyxDQUFDLENBQUNLLFFBQVE7UUFDdEMsTUFBTWhCLE9BQU8sR0FBR04sZUFBZSxDQUFDSyxLQUFLLENBQUM7UUFDdEMsT0FBTztVQUNMRCxPQUFPLEVBQUUsS0FBSztVQUNkQyxLQUFLLEVBQUUsd0JBQXdCaUIsUUFBUSxLQUFLakIsS0FBSyxZQUFZa0IsS0FBSyxHQUFHLENBQUNsQixLQUFLLElBQUltQixjQUFjLEVBQUVDLElBQUksSUFBSXBCLEtBQUssQ0FBQ3FCLE9BQU8sR0FBR0MsTUFBTSxDQUFDdEIsS0FBSyxDQUFDLEVBQUU7VUFDdElDLE9BQU8sRUFBRUEsT0FBTyxJQUFJc0I7UUFDdEIsQ0FBQztNQUNIO0lBQ0YsQ0FBQztJQUVELE1BQU1DLE9BQU8sR0FBRyxNQUFNckIsT0FBTyxDQUFDc0IsR0FBRyxDQUFDakIsU0FBUyxDQUFDa0IsR0FBRyxDQUFDZixhQUFhLENBQUMsQ0FBQztJQUMvRCxNQUFNZ0IsWUFBWSxHQUFHSCxPQUFPLENBQUNJLElBQUksQ0FBQ0MsTUFBTSxJQUFJLENBQUNBLE1BQU0sQ0FBQzlCLE9BQU8sQ0FBQztJQUU1RCxJQUFJNEIsWUFBWSxFQUFFO01BQ2hCO01BQ0F0QyxRQUFRLENBQUMsOEJBQThCLEVBQUU7UUFDdkN5QyxtQkFBbUIsRUFBRSxLQUFLO1FBQzFCQyxlQUFlLEVBQUUsQ0FBQyxDQUFDSixZQUFZLENBQUMzQixLQUFLO1FBQ3JDZ0MsVUFBVSxFQUFFLENBQUMsQ0FBQ0wsWUFBWSxDQUFDMUI7TUFDN0IsQ0FBQyxDQUFDO0lBQ0o7SUFFQSxPQUFPMEIsWUFBWSxJQUFJO01BQUU1QixPQUFPLEVBQUU7SUFBSyxDQUFDO0VBQzFDLENBQUMsQ0FBQyxPQUFPQyxLQUFLLEVBQUU7SUFDZEgsUUFBUSxDQUFDRyxLQUFLLElBQUlrQixLQUFLLENBQUM7O0lBRXhCO0lBQ0E3QixRQUFRLENBQUMsOEJBQThCLEVBQUU7TUFDdkN5QyxtQkFBbUIsRUFBRTtJQUN2QixDQUFDLENBQUM7SUFFRixPQUFPO01BQ0wvQixPQUFPLEVBQUUsS0FBSztNQUNkQyxLQUFLLEVBQUUsNkJBQTZCQSxLQUFLLFlBQVlrQixLQUFLLEdBQUcsQ0FBQ2xCLEtBQUssSUFBSW1CLGNBQWMsRUFBRUMsSUFBSSxJQUFJcEIsS0FBSyxDQUFDcUIsT0FBTyxHQUFHQyxNQUFNLENBQUN0QixLQUFLLENBQUM7SUFDOUgsQ0FBQztFQUNIO0FBQ0Y7QUFFQSxVQUFVaUMsa0JBQWtCLENBQUM7RUFDM0JDLFNBQVMsRUFBRSxHQUFHLEdBQUcsSUFBSTtBQUN2QjtBQUVBLE9BQU8sU0FBQUMsY0FBQUMsRUFBQTtFQUFBLE1BQUFDLENBQUEsR0FBQUMsRUFBQTtFQUF1QjtJQUFBSjtFQUFBLElBQUFFLEVBRVQ7RUFDbkIsT0FBQVAsTUFBQSxFQUFBVSxTQUFBLElBQTRCbkQsUUFBUSxDQUE4QixJQUFJLENBQUM7RUFDdkUsT0FBQW9ELFVBQUEsRUFBQUMsYUFBQSxJQUFvQ3JELFFBQVEsQ0FBQyxJQUFJLENBQUM7RUFJbEQsTUFBQXNELFdBQUEsR0FBb0JsRCxVQUFVLENBQUMsSUFBa0IsQ0FBQyxJQUE5QmdELFVBQThCO0VBQUEsSUFBQUcsRUFBQTtFQUFBLElBQUFDLEVBQUE7RUFBQSxJQUFBUCxDQUFBLFFBQUFRLE1BQUEsQ0FBQUMsR0FBQTtJQUV4Q0gsRUFBQSxHQUFBQSxDQUFBO01BQ1IsTUFBQUksR0FBQSxrQkFBQUEsSUFBQTtRQUNFLE1BQUFDLFdBQUEsR0FBb0IsTUFBTTlDLGNBQWMsQ0FBQyxDQUFDO1FBQzFDcUMsU0FBUyxDQUFDUyxXQUFXLENBQUM7UUFDdEJQLGFBQWEsQ0FBQyxLQUFLLENBQUM7TUFBQSxDQUNyQjtNQUNJTSxHQUFHLENBQUMsQ0FBQztJQUFBLENBQ1g7SUFBRUgsRUFBQSxLQUFFO0lBQUFQLENBQUEsTUFBQU0sRUFBQTtJQUFBTixDQUFBLE1BQUFPLEVBQUE7RUFBQTtJQUFBRCxFQUFBLEdBQUFOLENBQUE7SUFBQU8sRUFBQSxHQUFBUCxDQUFBO0VBQUE7RUFQTGxELFNBQVMsQ0FBQ3dELEVBT1QsRUFBRUMsRUFBRSxDQUFDO0VBQUEsSUFBQUssRUFBQTtFQUFBLElBQUFDLEVBQUE7RUFBQSxJQUFBYixDQUFBLFFBQUFILFNBQUEsSUFBQUcsQ0FBQSxRQUFBUixNQUFBO0lBRUlvQixFQUFBLEdBQUFBLENBQUE7TUFDUixJQUFJcEIsTUFBTSxFQUFBOUIsT0FBUztRQUNqQm1DLFNBQVMsQ0FBQyxDQUFDO01BQUE7UUFDTixJQUFJTCxNQUF5QixJQUF6QixDQUFXQSxNQUFNLENBQUE5QixPQUFRO1VBQ2xDLE1BQUFvRCxLQUFBLEdBQWNDLFVBQVUsQ0FBQ0MsS0FBcUIsRUFBRSxHQUFHLENBQUM7VUFBQSxPQUM3QyxNQUFNQyxZQUFZLENBQUNILEtBQUssQ0FBQztRQUFBO01BQ2pDO0lBQUEsQ0FDRjtJQUFFRCxFQUFBLElBQUNyQixNQUFNLEVBQUVLLFNBQVMsQ0FBQztJQUFBRyxDQUFBLE1BQUFILFNBQUE7SUFBQUcsQ0FBQSxNQUFBUixNQUFBO0lBQUFRLENBQUEsTUFBQVksRUFBQTtJQUFBWixDQUFBLE1BQUFhLEVBQUE7RUFBQTtJQUFBRCxFQUFBLEdBQUFaLENBQUE7SUFBQWEsRUFBQSxHQUFBYixDQUFBO0VBQUE7RUFQdEJsRCxTQUFTLENBQUM4RCxFQU9ULEVBQUVDLEVBQW1CLENBQUM7RUFBQSxJQUFBSyxFQUFBO0VBQUEsSUFBQWxCLENBQUEsUUFBQUcsVUFBQSxJQUFBSCxDQUFBLFFBQUFSLE1BQUEsSUFBQVEsQ0FBQSxRQUFBSyxXQUFBO0lBSWxCYSxFQUFBLEdBQUFmLFVBQXlCLElBQXpCRSxXQWtDQSxHQWpDQyxDQUFDLEdBQUcsQ0FBYyxXQUFDLENBQUQsR0FBQyxDQUNqQixDQUFDLE9BQU8sR0FDUixDQUFDLElBQUksQ0FBQyx3QkFBd0IsRUFBN0IsSUFBSSxDQUNQLEVBSEMsR0FBRyxDQWlDTCxHQTVCQyxDQUFDYixNQUFNLEVBQUE5QixPQUNJLElBRFgsQ0FDQ3lDLFVBMEJBLElBekJDLENBQUMsR0FBRyxDQUFlLGFBQVEsQ0FBUixRQUFRLENBQU0sR0FBQyxDQUFELEdBQUMsQ0FDaEMsQ0FBQyxJQUFJLENBQU8sS0FBTyxDQUFQLE9BQU8sQ0FBQyx1Q0FBdUMsRUFBMUQsSUFBSSxDQUNMLENBQUMsSUFBSSxDQUFPLEtBQU8sQ0FBUCxPQUFPLENBQUUsQ0FBQVgsTUFBTSxFQUFBN0IsS0FBTSxDQUFFLEVBQWxDLElBQUksQ0FDSixDQUFBNkIsTUFBTSxFQUFBNUIsT0FvQk4sR0FuQkMsQ0FBQyxHQUFHLENBQWUsYUFBUSxDQUFSLFFBQVEsQ0FBTSxHQUFDLENBQUQsR0FBQyxDQUNoQyxDQUFDLElBQUksQ0FBRSxDQUFBNEIsTUFBTSxDQUFBNUIsT0FBTyxDQUFFLEVBQXJCLElBQUksQ0FDTCxDQUFDLElBQUksQ0FBTyxLQUFZLENBQVosWUFBWSxDQUFDLGtEQUV6QixFQUZDLElBQUksQ0FHUCxFQUxDLEdBQUcsQ0FtQkwsR0FaQyxDQUFDLEdBQUcsQ0FBZSxhQUFRLENBQVIsUUFBUSxDQUFNLEdBQUMsQ0FBRCxHQUFDLENBQ2hDLENBQUMsSUFBSSxDQUFDLDJEQUVOLEVBRkMsSUFBSSxDQUdMLENBQUMsSUFBSSxDQUFDLHNGQUV5QixJQUFFLENBQy9CLENBQUMsSUFBSSxDQUFPLEtBQVksQ0FBWixZQUFZLENBQUMseUNBRXpCLEVBRkMsSUFBSSxDQUdQLEVBTkMsSUFBSSxDQU9QLEVBWEMsR0FBRyxDQVlOLENBQ0YsRUF4QkMsR0FBRyxDQTBCUDtJQUFBb0MsQ0FBQSxNQUFBRyxVQUFBO0lBQUFILENBQUEsTUFBQVIsTUFBQTtJQUFBUSxDQUFBLE1BQUFLLFdBQUE7SUFBQUwsQ0FBQSxNQUFBa0IsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQWxCLENBQUE7RUFBQTtFQUFBLElBQUFtQixFQUFBO0VBQUEsSUFBQW5CLENBQUEsU0FBQWtCLEVBQUE7SUFuQ0hDLEVBQUEsSUFBQyxHQUFHLENBQWUsYUFBUSxDQUFSLFFBQVEsQ0FBTSxHQUFDLENBQUQsR0FBQyxDQUFlLFdBQUMsQ0FBRCxHQUFDLENBQy9DLENBQUFELEVBa0NELENBQ0YsRUFwQ0MsR0FBRyxDQW9DRTtJQUFBbEIsQ0FBQSxPQUFBa0IsRUFBQTtJQUFBbEIsQ0FBQSxPQUFBbUIsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQW5CLENBQUE7RUFBQTtFQUFBLE9BcENObUIsRUFvQ007QUFBQTtBQWpFSCxTQUFBSCxNQUFBO0VBQUEsT0F1QjhCSSxPQUFPLENBQUFDLElBQUssQ0FBQyxDQUFDLENBQUM7QUFBQSIsImlnbm9yZUxpc3QiOltdfQ==

package/src/utils/privacyLevel.ts

@@ -0,0 +1,55 @@
+/**
+ * Privacy level controls how much nonessential network traffic and telemetry
+ * Claude Code generates.
+ *
+ * Levels are ordered by restrictiveness:
+ *   default < no-telemetry < essential-traffic
+ *
+ * - default:            Everything enabled.
+ * - no-telemetry:       Analytics/telemetry disabled (Datadog, 1P events, feedback survey).
+ * - essential-traffic:  ALL nonessential network traffic disabled
+ *                       (telemetry + auto-updates, grove, release notes, model capabilities, etc.).
+ *
+ * The resolved level is the most restrictive signal from:
+ *   CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC  →  essential-traffic
+ *   DISABLE_TELEMETRY                         →  no-telemetry
+ */
+
+type PrivacyLevel = 'default' | 'no-telemetry' | 'essential-traffic'
+
+export function getPrivacyLevel(): PrivacyLevel {
+  if (process.env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC) {
+    return 'essential-traffic'
+  }
+  if (process.env.DISABLE_TELEMETRY) {
+    return 'no-telemetry'
+  }
+  return 'default'
+}
+
+/**
+ * True when all nonessential network traffic should be suppressed.
+ * Equivalent to the old `process.env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` check.
+ */
+export function isEssentialTrafficOnly(): boolean {
+  return getPrivacyLevel() === 'essential-traffic'
+}
+
+/**
+ * True when telemetry/analytics should be suppressed.
+ * True at both `no-telemetry` and `essential-traffic` levels.
+ */
+export function isTelemetryDisabled(): boolean {
+  return getPrivacyLevel() !== 'default'
+}
+
+/**
+ * Returns the env var name responsible for the current essential-traffic restriction,
+ * or null if unrestricted. Used for user-facing "unset X to re-enable" messages.
+ */
+export function getEssentialTrafficOnlyReason(): string | null {
+  if (process.env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC) {
+    return 'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC'
+  }
+  return null
+}

package/src/utils/process.ts

@@ -0,0 +1,68 @@
+function handleEPIPE(
+  stream: NodeJS.WriteStream,
+): (err: NodeJS.ErrnoException) => void {
+  return (err: NodeJS.ErrnoException) => {
+    if (err.code === 'EPIPE') {
+      stream.destroy()
+    }
+  }
+}
+
+// Prevents memory leak when pipe is broken (e.g., `claude -p | head -1`)
+export function registerProcessOutputErrorHandlers(): void {
+  process.stdout.on('error', handleEPIPE(process.stdout))
+  process.stderr.on('error', handleEPIPE(process.stderr))
+}
+
+function writeOut(stream: NodeJS.WriteStream, data: string): void {
+  if (stream.destroyed) {
+    return
+  }
+
+  // Note: we don't handle backpressure (write() returning false).
+  //
+  // We should consider handling the callback to ensure we wait for data to flush.
+  stream.write(data /* callback to handle here */)
+}
+
+export function writeToStdout(data: string): void {
+  writeOut(process.stdout, data)
+}
+
+export function writeToStderr(data: string): void {
+  writeOut(process.stderr, data)
+}
+
+// Write error to stderr and exit with code 1. Consolidates the
+// console.error + process.exit(1) pattern used in entrypoint fast-paths.
+export function exitWithError(message: string): never {
+  // biome-ignore lint/suspicious/noConsole:: intentional console output
+  console.error(message)
+  // eslint-disable-next-line custom-rules/no-process-exit
+  process.exit(1)
+}
+
+// Wait for a stdin-like stream to close, but give up after ms if no data ever
+// arrives. First data chunk cancels the timeout — after that, wait for end
+// unconditionally (caller's accumulator needs all chunks, not just the first).
+// Returns true on timeout, false on end. Used by -p mode to distinguish a
+// real pipe producer from an inherited-but-idle parent stdin.
+export function peekForStdinData(
+  stream: NodeJS.EventEmitter,
+  ms: number,
+): Promise<boolean> {
+  return new Promise<boolean>(resolve => {
+    const done = (timedOut: boolean) => {
+      clearTimeout(peek)
+      stream.off('end', onEnd)
+      stream.off('data', onFirstData)
+      void resolve(timedOut)
+    }
+    const onEnd = () => done(false)
+    const onFirstData = () => clearTimeout(peek)
+    // eslint-disable-next-line no-restricted-syntax -- not a sleep: races timeout against stream end/data events
+    const peek = setTimeout(done, ms, true)
+    stream.once('end', onEnd)
+    stream.once('data', onFirstData)
+  })
+}