@xortex/xcode 3.0.0

package/utils/bufferedWriter.ts

@@ -0,0 +1,100 @@
+type WriteFn = (content: string) => void
+
+export type BufferedWriter = {
+  write: (content: string) => void
+  flush: () => void
+  dispose: () => void
+}
+
+export function createBufferedWriter({
+  writeFn,
+  flushIntervalMs = 1000,
+  maxBufferSize = 100,
+  maxBufferBytes = Infinity,
+  immediateMode = false,
+}: {
+  writeFn: WriteFn
+  flushIntervalMs?: number
+  maxBufferSize?: number
+  maxBufferBytes?: number
+  immediateMode?: boolean
+}): BufferedWriter {
+  let buffer: string[] = []
+  let bufferBytes = 0
+  let flushTimer: NodeJS.Timeout | null = null
+  // Batch detached by overflow that hasn't been written yet. Tracked so
+  // flush()/dispose() can drain it synchronously if the process exits
+  // before the setImmediate fires.
+  let pendingOverflow: string[] | null = null
+
+  function clearTimer(): void {
+    if (flushTimer) {
+      clearTimeout(flushTimer)
+      flushTimer = null
+    }
+  }
+
+  function flush(): void {
+    if (pendingOverflow) {
+      writeFn(pendingOverflow.join(''))
+      pendingOverflow = null
+    }
+    if (buffer.length === 0) return
+    writeFn(buffer.join(''))
+    buffer = []
+    bufferBytes = 0
+    clearTimer()
+  }
+
+  function scheduleFlush(): void {
+    if (!flushTimer) {
+      flushTimer = setTimeout(flush, flushIntervalMs)
+    }
+  }
+
+  // Detach the buffer synchronously so the caller never waits on writeFn.
+  // writeFn may block (e.g. errorLogSink.ts appendFileSync) — if overflow fires
+  // mid-render or mid-keystroke, deferring the write keeps the current tick
+  // short. Timer-based flushes already run outside user code paths so they
+  // stay synchronous.
+  function flushDeferred(): void {
+    if (pendingOverflow) {
+      // A previous overflow write is still queued. Coalesce into it to
+      // preserve ordering — writes land in a single setImmediate-ordered batch.
+      pendingOverflow.push(...buffer)
+      buffer = []
+      bufferBytes = 0
+      clearTimer()
+      return
+    }
+    const detached = buffer
+    buffer = []
+    bufferBytes = 0
+    clearTimer()
+    pendingOverflow = detached
+    setImmediate(() => {
+      const toWrite = pendingOverflow
+      pendingOverflow = null
+      if (toWrite) writeFn(toWrite.join(''))
+    })
+  }
+
+  return {
+    write(content: string): void {
+      if (immediateMode) {
+        writeFn(content)
+        return
+      }
+      buffer.push(content)
+      bufferBytes += content.length
+      scheduleFlush()
+      if (buffer.length >= maxBufferSize || bufferBytes >= maxBufferBytes) {
+        flushDeferred()
+      }
+    },
+    flush,
+    dispose(): void {
+      flush()
+    },
+  }
+}

package/utils/bundledMode.ts

@@ -0,0 +1,22 @@
+/**
+ * Detects if the current runtime is Bun.
+ * Returns true when:
+ * - Running a JS file via the `bun` command
+ * - Running a Bun-compiled standalone executable
+ */
+export function isRunningWithBun(): boolean {
+  // https://bun.com/guides/util/detect-bun
+  return process.versions.bun !== undefined
+}
+
+/**
+ * Detects if running as a Bun-compiled standalone executable.
+ * This checks for embedded files which are present in compiled binaries.
+ */
+export function isInBundledMode(): boolean {
+  return (
+    typeof Bun !== 'undefined' &&
+    Array.isArray(Bun.embeddedFiles) &&
+    Bun.embeddedFiles.length > 0
+  )
+}

package/utils/caCerts.ts

@@ -0,0 +1,115 @@
+import memoize from 'lodash-es/memoize.js'
+import { logForDebugging } from './debug.js'
+import { hasNodeOption } from './envUtils.js'
+import { getFsImplementation } from './fsOperations.js'
+
+/**
+ * Load CA certificates for TLS connections.
+ *
+ * Since setting `ca` on an HTTPS agent replaces the default certificate store,
+ * we must always include base CAs (either system or bundled Mozilla) when returning.
+ *
+ * Returns undefined when no custom CA configuration is needed, allowing the
+ * runtime's default certificate handling to apply.
+ *
+ * Behavior:
+ * - Neither NODE_EXTRA_CA_CERTS nor --use-system-ca/--use-openssl-ca set: undefined (runtime defaults)
+ * - NODE_EXTRA_CA_CERTS only: bundled Mozilla CAs + extra cert file contents
+ * - --use-system-ca or --use-openssl-ca only: system CAs
+ * - --use-system-ca + NODE_EXTRA_CA_CERTS: system CAs + extra cert file contents
+ *
+ * Memoized for performance. Call clearCACertsCache() to invalidate after
+ * environment variable changes (e.g., after trust dialog applies settings.json).
+ *
+ * Reads ONLY `process.env.NODE_EXTRA_CA_CERTS`. `caCertsConfig.ts` populates
+ * that env var from settings.json at CLI init; this module stays config-free
+ * so `proxy.ts`/`mtls.ts` don't transitively pull in the command registry.
+ */
+export const getCACertificates = memoize((): string[] | undefined => {
+  const useSystemCA =
+    hasNodeOption('--use-system-ca') || hasNodeOption('--use-openssl-ca')
+
+  const extraCertsPath = process.env.NODE_EXTRA_CA_CERTS
+
+  logForDebugging(
+    `CA certs: useSystemCA=${useSystemCA}, extraCertsPath=${extraCertsPath}`,
+  )
+
+  // If neither is set, return undefined (use runtime defaults, no override)
+  if (!useSystemCA && !extraCertsPath) {
+    return undefined
+  }
+
+  // Deferred load: Bun's node:tls module eagerly materializes ~150 Mozilla
+  // root certificates (~750KB heap) on import, even if tls.rootCertificates
+  // is never accessed. Most users hit the early return above, so we only
+  // pay this cost when custom CA handling is actually needed.
+  /* eslint-disable @typescript-eslint/no-require-imports */
+  const tls = require('tls') as typeof import('tls')
+  /* eslint-enable @typescript-eslint/no-require-imports */
+
+  const certs: string[] = []
+
+  if (useSystemCA) {
+    // Load system CA store (Bun API)
+    const getCACerts = (
+      tls as typeof tls & { getCACertificates?: (type: string) => string[] }
+    ).getCACertificates
+    const systemCAs = getCACerts?.('system')
+    if (systemCAs && systemCAs.length > 0) {
+      certs.push(...systemCAs)
+      logForDebugging(
+        `CA certs: Loaded ${certs.length} system CA certificates (--use-system-ca)`,
+      )
+    } else if (!getCACerts && !extraCertsPath) {
+      // Under Node.js where getCACertificates doesn't exist and no extra certs,
+      // return undefined to let Node.js handle --use-system-ca natively.
+      logForDebugging(
+        'CA certs: --use-system-ca set but system CA API unavailable, deferring to runtime',
+      )
+      return undefined
+    } else {
+      // System CA API returned empty or unavailable; fall back to bundled root certs
+      certs.push(...tls.rootCertificates)
+      logForDebugging(
+        `CA certs: Loaded ${certs.length} bundled root certificates as base (--use-system-ca fallback)`,
+      )
+    }
+  } else {
+    // Must include bundled Mozilla CAs as base since ca replaces defaults
+    certs.push(...tls.rootCertificates)
+    logForDebugging(
+      `CA certs: Loaded ${certs.length} bundled root certificates as base`,
+    )
+  }
+
+  // Append extra certs from file
+  if (extraCertsPath) {
+    try {
+      const extraCert = getFsImplementation().readFileSync(extraCertsPath, {
+        encoding: 'utf8',
+      })
+      certs.push(extraCert)
+      logForDebugging(
+        `CA certs: Appended extra certificates from NODE_EXTRA_CA_CERTS (${extraCertsPath})`,
+      )
+    } catch (error) {
+      logForDebugging(
+        `CA certs: Failed to read NODE_EXTRA_CA_CERTS file (${extraCertsPath}): ${error}`,
+        { level: 'error' },
+      )
+    }
+  }
+
+  return certs.length > 0 ? certs : undefined
+})
+
+/**
+ * Clear the CA certificates cache.
+ * Call this when environment variables that affect CA certs may have changed
+ * (e.g., NODE_EXTRA_CA_CERTS, NODE_OPTIONS).
+ */
+export function clearCACertsCache(): void {
+  getCACertificates.cache.clear?.()
+  logForDebugging('Cleared CA certificates cache')
+}

package/utils/caCertsConfig.ts

@@ -0,0 +1,88 @@
+/**
+ * Config/settings-backed NODE_EXTRA_CA_CERTS population for `caCerts.ts`.
+ *
+ * Split from `caCerts.ts` because `config.ts` → `file.ts` →
+ * `permissions/filesystem.ts` → `commands.ts` transitively pulls in ~5300
+ * modules (REPL, React, every slash command). `proxy.ts`/`mtls.ts` (and
+ * therefore anything using HTTPS through our proxy agent — WebSocketTransport,
+ * CCRClient, telemetry) must NOT depend on that graph, or the Agent SDK
+ * bundle (`connectRemoteControl` path) bloats from ~0.4 MB to ~10.8 MB.
+ *
+ * `getCACertificates()` only reads `process.env.NODE_EXTRA_CA_CERTS`. This
+ * module is the one place allowed to import `config.ts` to *populate* that
+ * env var at CLI startup. Only `init.ts` imports this file.
+ */
+
+import { getGlobalConfig } from './config.js'
+import { logForDebugging } from './debug.js'
+import { getSettingsForSource } from './settings/settings.js'
+
+/**
+ * Apply NODE_EXTRA_CA_CERTS from settings.json to process.env early in init,
+ * BEFORE any TLS connections are made.
+ *
+ * Bun caches the TLS certificate store at process boot via BoringSSL.
+ * If NODE_EXTRA_CA_CERTS isn't set in the environment at boot, Bun won't
+ * include the custom CA cert. By setting it on process.env before any
+ * TLS connections, we give Bun a chance to pick it up (if the cert store
+ * is lazy-initialized) and ensure Node.js compatibility.
+ *
+ * This is safe to call before the trust dialog because we only read from
+ * user-controlled files (~/.claude/settings.json and ~/.claude.json),
+ * not from project-level settings.
+ */
+export function applyExtraCACertsFromConfig(): void {
+  if (process.env.NODE_EXTRA_CA_CERTS) {
+    return // Already set in environment, nothing to do
+  }
+  const configPath = getExtraCertsPathFromConfig()
+  if (configPath) {
+    process.env.NODE_EXTRA_CA_CERTS = configPath
+    logForDebugging(
+      `CA certs: Applied NODE_EXTRA_CA_CERTS from config to process.env: ${configPath}`,
+    )
+  }
+}
+
+/**
+ * Read NODE_EXTRA_CA_CERTS from settings/config as a fallback.
+ *
+ * NODE_EXTRA_CA_CERTS is categorized as a non-safe env var (it allows
+ * trusting attacker-controlled servers), so it's only applied to process.env
+ * after the trust dialog. But we need the CA cert early to establish the TLS
+ * connection to an HTTPS proxy during init().
+ *
+ * We read from global config (~/.claude.json) and user settings
+ * (~/.claude/settings.json). These are user-controlled files that don't
+ * require trust approval.
+ */
+function getExtraCertsPathFromConfig(): string | undefined {
+  try {
+    const globalConfig = getGlobalConfig()
+    const globalEnv = globalConfig?.env
+    // Only read from user-controlled settings (~/.claude/settings.json),
+    // not project-level settings, to prevent malicious projects from
+    // injecting CA certs before the trust dialog.
+    const settings = getSettingsForSource('userSettings')
+    const settingsEnv = settings?.env
+
+    logForDebugging(
+      `CA certs: Config fallback - globalEnv keys: ${globalEnv ? Object.keys(globalEnv).join(',') : 'none'}, settingsEnv keys: ${settingsEnv ? Object.keys(settingsEnv).join(',') : 'none'}`,
+    )
+
+    // Settings override global config (same precedence as applyConfigEnvironmentVariables)
+    const path =
+      settingsEnv?.NODE_EXTRA_CA_CERTS || globalEnv?.NODE_EXTRA_CA_CERTS
+    if (path) {
+      logForDebugging(
+        `CA certs: Found NODE_EXTRA_CA_CERTS in config/settings: ${path}`,
+      )
+    }
+    return path
+  } catch (error) {
+    logForDebugging(`CA certs: Config fallback failed: ${error}`, {
+      level: 'error',
+    })
+    return undefined
+  }
+}

package/utils/cachePaths.ts

@@ -0,0 +1,38 @@
+import envPaths from 'env-paths'
+import { join } from 'path'
+import { getFsImplementation } from './fsOperations.js'
+import { djb2Hash } from './hash.js'
+
+const paths = envPaths('claude-cli')
+
+// Local sanitizePath using djb2Hash — NOT the shared version from
+// sessionStoragePortable.ts which uses Bun.hash (wyhash) when available.
+// Cache directory names must remain stable across upgrades so existing cache
+// data (error logs, MCP logs) is not orphaned.
+const MAX_SANITIZED_LENGTH = 200
+function sanitizePath(name: string): string {
+  const sanitized = name.replace(/[^a-zA-Z0-9]/g, '-')
+  if (sanitized.length <= MAX_SANITIZED_LENGTH) {
+    return sanitized
+  }
+  return `${sanitized.slice(0, MAX_SANITIZED_LENGTH)}-${Math.abs(djb2Hash(name)).toString(36)}`
+}
+
+function getProjectDir(cwd: string): string {
+  return sanitizePath(cwd)
+}
+
+export const CACHE_PATHS = {
+  baseLogs: () => join(paths.cache, getProjectDir(getFsImplementation().cwd())),
+  errors: () =>
+    join(paths.cache, getProjectDir(getFsImplementation().cwd()), 'errors'),
+  messages: () =>
+    join(paths.cache, getProjectDir(getFsImplementation().cwd()), 'messages'),
+  mcpLogs: (serverName: string) =>
+    join(
+      paths.cache,
+      getProjectDir(getFsImplementation().cwd()),
+      // Sanitize server name for Windows compatibility (colons are reserved for drive letters)
+      `mcp-logs-${sanitizePath(serverName)}`,
+    ),
+}

package/utils/classifierApprovals.ts

@@ -0,0 +1,88 @@
+/**
+ * Tracks which tool uses were auto-approved by classifiers.
+ * Populated from useCanUseTool.ts and permissions.ts, read from UserToolSuccessMessage.tsx.
+ */
+
+import { feature } from 'bun:bundle'
+import { createSignal } from './signal.js'
+
+type ClassifierApproval = {
+  classifier: 'bash' | 'auto-mode'
+  matchedRule?: string
+  reason?: string
+}
+
+const CLASSIFIER_APPROVALS = new Map<string, ClassifierApproval>()
+const CLASSIFIER_CHECKING = new Set<string>()
+const classifierChecking = createSignal()
+
+export function setClassifierApproval(
+  toolUseID: string,
+  matchedRule: string,
+): void {
+  if (!feature('BASH_CLASSIFIER')) {
+    return
+  }
+  CLASSIFIER_APPROVALS.set(toolUseID, {
+    classifier: 'bash',
+    matchedRule,
+  })
+}
+
+export function getClassifierApproval(toolUseID: string): string | undefined {
+  if (!feature('BASH_CLASSIFIER')) {
+    return undefined
+  }
+  const approval = CLASSIFIER_APPROVALS.get(toolUseID)
+  if (!approval || approval.classifier !== 'bash') return undefined
+  return approval.matchedRule
+}
+
+export function setYoloClassifierApproval(
+  toolUseID: string,
+  reason: string,
+): void {
+  if (!feature('TRANSCRIPT_CLASSIFIER')) {
+    return
+  }
+  CLASSIFIER_APPROVALS.set(toolUseID, { classifier: 'auto-mode', reason })
+}
+
+export function getYoloClassifierApproval(
+  toolUseID: string,
+): string | undefined {
+  if (!feature('TRANSCRIPT_CLASSIFIER')) {
+    return undefined
+  }
+  const approval = CLASSIFIER_APPROVALS.get(toolUseID)
+  if (!approval || approval.classifier !== 'auto-mode') return undefined
+  return approval.reason
+}
+
+export function setClassifierChecking(toolUseID: string): void {
+  if (!feature('BASH_CLASSIFIER') && !feature('TRANSCRIPT_CLASSIFIER')) return
+  CLASSIFIER_CHECKING.add(toolUseID)
+  classifierChecking.emit()
+}
+
+export function clearClassifierChecking(toolUseID: string): void {
+  if (!feature('BASH_CLASSIFIER') && !feature('TRANSCRIPT_CLASSIFIER')) return
+  CLASSIFIER_CHECKING.delete(toolUseID)
+  classifierChecking.emit()
+}
+
+export const subscribeClassifierChecking = classifierChecking.subscribe
+
+export function isClassifierChecking(toolUseID: string): boolean {
+  return CLASSIFIER_CHECKING.has(toolUseID)
+}
+
+export function deleteClassifierApproval(toolUseID: string): void {
+  CLASSIFIER_APPROVALS.delete(toolUseID)
+}
+
+export function clearClassifierApprovals(): void {
+  CLASSIFIER_APPROVALS.clear()
+  CLASSIFIER_CHECKING.clear()
+  classifierChecking.emit()
+}

package/utils/classifierApprovalsHook.ts

@@ -0,0 +1,17 @@
+/**
+ * React hook for classifierApprovals store.
+ * Split from classifierApprovals.ts so pure-state importers (permissions.ts,
+ * toolExecution.ts, postCompactCleanup.ts) do not pull React into print.ts.
+ */
+
+import { useSyncExternalStore } from 'react'
+import {
+  isClassifierChecking,
+  subscribeClassifierChecking,
+} from './classifierApprovals.js'
+
+export function useIsClassifierChecking(toolUseID: string): boolean {
+  return useSyncExternalStore(subscribeClassifierChecking, () =>
+    isClassifierChecking(toolUseID),
+  )
+}

package/utils/claudeCodeHints.ts

@@ -0,0 +1,193 @@
+/**
+ * Claude Code hints protocol.
+ *
+ * CLIs and SDKs running under Claude Code can emit a self-closing
+ * `<claude-code-hint />` tag to stderr (merged into stdout by the shell
+ * tools). The harness scans tool output for these tags, strips them before
+ * the output reaches the model, and surfaces an install prompt to the
+ * user — no inference, no proactive execution.
+ *
+ * This file provides both the parser and a small module-level store for
+ * the pending hint. The store is a single slot (not a queue) — we surface
+ * at most one prompt per session, so there's no reason to accumulate.
+ * React subscribes via useSyncExternalStore.
+ *
+ * See docs/claude-code-hints.md for the vendor-facing spec.
+ */
+
+import { logForDebugging } from './debug.js'
+import { createSignal } from './signal.js'
+
+export type ClaudeCodeHintType = 'plugin'
+
+export type ClaudeCodeHint = {
+  /** Spec version declared by the emitter. Unknown versions are dropped. */
+  v: number
+  /** Hint discriminator. v1 defines only `plugin`. */
+  type: ClaudeCodeHintType
+  /**
+   * Hint payload. For `type: 'plugin'`: a `name@marketplace` slug
+   * matching the form accepted by `parsePluginIdentifier`.
+   */
+  value: string
+  /**
+   * First token of the shell command that produced this hint. Shown in the
+   * install prompt so the user can spot a mismatch between the tool that
+   * emitted the hint and the plugin it recommends.
+   */
+  sourceCommand: string
+}
+
+/** Spec versions this harness understands. */
+const SUPPORTED_VERSIONS = new Set([1])
+
+/** Hint types this harness understands at the supported versions. */
+const SUPPORTED_TYPES = new Set<string>(['plugin'])
+
+/**
+ * Outer tag match. Anchored to whole lines (multiline mode) so that a
+ * hint marker buried in a larger line — e.g. a log statement quoting the
+ * tag — is ignored. Leading and trailing whitespace on the line is
+ * tolerated since some SDKs pad stderr.
+ */
+const HINT_TAG_RE = /^[ \t]*<claude-code-hint\s+([^>]*?)\s*\/>[ \t]*$/gm
+
+/**
+ * Attribute matcher. Accepts `key="value"` and `key=value` (terminated by
+ * whitespace or `/>` closing sequence). Values containing whitespace or `"` must use the quoted
+ * form. The quoted form does not support escape sequences; raise the spec
+ * version if that becomes necessary.
+ */
+const ATTR_RE = /(\w+)=(?:"([^"]*)"|([^\s/>]+))/g
+
+/**
+ * Scan shell tool output for hint tags, returning the parsed hints and
+ * the output with hint lines removed. The stripped output is what the
+ * model sees — hints are a harness-only side channel.
+ *
+ * @param output - Raw command output (stdout with stderr interleaved).
+ * @param command - The command that produced the output; its first
+ *   whitespace-separated token is recorded as `sourceCommand`.
+ */
+export function extractClaudeCodeHints(
+  output: string,
+  command: string,
+): { hints: ClaudeCodeHint[]; stripped: string } {
+  // Fast path: no tag open sequence → no work, no allocation.
+  if (!output.includes('<claude-code-hint')) {
+    return { hints: [], stripped: output }
+  }
+
+  const sourceCommand = firstCommandToken(command)
+  const hints: ClaudeCodeHint[] = []
+
+  const stripped = output.replace(HINT_TAG_RE, rawLine => {
+    const attrs = parseAttrs(rawLine)
+    const v = Number(attrs.v)
+    const type = attrs.type
+    const value = attrs.value
+
+    if (!SUPPORTED_VERSIONS.has(v)) {
+      logForDebugging(
+        `[claudeCodeHints] dropped hint with unsupported v=${attrs.v}`,
+      )
+      return ''
+    }
+    if (!type || !SUPPORTED_TYPES.has(type)) {
+      logForDebugging(
+        `[claudeCodeHints] dropped hint with unsupported type=${type}`,
+      )
+      return ''
+    }
+    if (!value) {
+      logForDebugging('[claudeCodeHints] dropped hint with empty value')
+      return ''
+    }
+
+    hints.push({ v, type: type as ClaudeCodeHintType, value, sourceCommand })
+    return ''
+  })
+
+  // Dropping a matched line leaves a blank line (the surrounding newlines
+  // remain). Collapse runs of blank lines introduced by the replace so the
+  // model-visible output doesn't grow vertical whitespace.
+  const collapsed =
+    hints.length > 0 || stripped !== output
+      ? stripped.replace(/\n{3,}/g, '\n\n')
+      : stripped
+
+  return { hints, stripped: collapsed }
+}
+
+function parseAttrs(tagBody: string): Record<string, string> {
+  const attrs: Record<string, string> = {}
+  for (const m of tagBody.matchAll(ATTR_RE)) {
+    attrs[m[1]!] = m[2] ?? m[3] ?? ''
+  }
+  return attrs
+}
+
+function firstCommandToken(command: string): string {
+  const trimmed = command.trim()
+  const spaceIdx = trimmed.search(/\s/)
+  return spaceIdx === -1 ? trimmed : trimmed.slice(0, spaceIdx)
+}
+
+// ============================================================================
+// Pending-hint store (useSyncExternalStore interface)
+//
+// Single-slot: write wins if the slot is already full (a CLI that emits on
+// every invocation would otherwise pile up). The dialog is shown at most
+// once per session; after that, setPendingHint becomes a no-op.
+//
+// Callers should gate before writing (installed? already shown? cap hit?) —
+// see maybeRecordPluginHint in hintRecommendation.ts for the plugin-type
+// gate. This module stays plugin-agnostic so future hint types can reuse
+// the same store.
+// ============================================================================
+
+let pendingHint: ClaudeCodeHint | null = null
+let shownThisSession = false
+const pendingHintChanged = createSignal()
+const notify = pendingHintChanged.emit
+
+/** Raw store write. Callers should gate first (see module comment). */
+export function setPendingHint(hint: ClaudeCodeHint): void {
+  if (shownThisSession) return
+  pendingHint = hint
+  notify()
+}
+
+/** Clear the slot without flipping the session flag — for rejected hints. */
+export function clearPendingHint(): void {
+  if (pendingHint !== null) {
+    pendingHint = null
+    notify()
+  }
+}
+
+/** Flip the once-per-session flag. Call only when a dialog is actually shown. */
+export function markShownThisSession(): void {
+  shownThisSession = true
+}
+
+export const subscribeToPendingHint = pendingHintChanged.subscribe
+
+export function getPendingHintSnapshot(): ClaudeCodeHint | null {
+  return pendingHint
+}
+
+export function hasShownHintThisSession(): boolean {
+  return shownThisSession
+}
+
+/** Test-only reset. */
+export function _resetClaudeCodeHintStore(): void {
+  pendingHint = null
+  shownThisSession = false
+}
+
+export const _test = {
+  parseAttrs,
+  firstCommandToken,
+}