apex-code 0.0.1-alpha.8 → 0.0.4

package/dist/core/tools/lsp.js

@@ -1,24 +1,46 @@
+import { isAbsolute, relative } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Type } from "typebox";
 import { formatPathRelativeToCwdOrAbsolute } from "../../utils/paths.js";
+import { toolUnion } from "./contract.js";
 import { createPathPermissionSpec } from "./path-permission.js";
 import { resolveToCwd } from "./path-utils.js";
 import { wrapToolDefinition } from "./tool-definition-wrapper.js";
 const MAX_LOCATIONS = 1_000;
 const MAX_SYMBOLS = 2_000;
+/** Cap on the serialized symbol details so a result can never grow unbounded (spec § 4). */
+const MAX_DETAILS_BYTES = 256 * 1024;
 const lspNavigationSchema = Type.Object({
-    operation: Type.Union([Type.Literal("definition"), Type.Literal("references")], {
-        description: "Which navigation query to run.",
-    }),
-    path: Type.String({ description: "Path to the file (relative or absolute)." }),
-    line: Type.Number({ description: "One-based line number." }),
-    character: Type.Number({ description: "One-based UTF-16 character offset within the line." }),
+    operation: Type.Union([Type.Literal("definition"), Type.Literal("references")]),
+    path: Type.String(),
+    line: Type.Number(),
+    character: Type.Number(),
 });
 const lspDocumentSymbolsSchema = Type.Object({
-    operation: Type.Literal("document_symbols", { description: "List the symbols declared in a file." }),
-    path: Type.String({ description: "Path to the file (relative or absolute)." }),
+    operation: Type.Literal("document_symbols"),
+    path: Type.String(),
+});
+const lspWorkspaceSymbolsSchema = Type.Object({
+    operation: Type.Literal("workspace_symbol"),
+    query: Type.String(),
 });
-const lspSchema = Type.Union([lspNavigationSchema, lspDocumentSymbolsSchema]);
+const lspSchemaProperties = {
+    operation: Type.Union([
+        Type.Literal("definition"),
+        Type.Literal("references"),
+        Type.Literal("document_symbols"),
+        Type.Literal("workspace_symbol"),
+    ], { description: "Which query to run." }),
+    path: Type.String({
+        description: "Path to the file (relative or absolute). Required by every operation but workspace_symbol.",
+    }),
+    line: Type.Number({ description: "One-based line number. Required by definition and references." }),
+    character: Type.Number({
+        description: "One-based UTF-16 character offset within the line. Required by definition and references.",
+    }),
+    query: Type.String({ description: "The symbol name to search for. Required by workspace_symbol." }),
+};
+const lspSchema = toolUnion([lspNavigationSchema, lspDocumentSymbolsSchema, lspWorkspaceSymbolsSchema], lspSchemaProperties);
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -138,6 +160,96 @@ function capSymbols(symbols, max) {
     const capped = sorted.slice(0, max);
     return { symbols: capped, truncated: sorted.length - capped.length };
 }
+function isInsideRoot(absolutePath, root) {
+    const rel = relative(root, absolutePath);
+    return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+function rawWorkspaceSymbol(value) {
+    if (!isRecord(value) || typeof value.name !== "string")
+        return undefined;
+    return {
+        name: value.name,
+        kind: typeof value.kind === "number" ? value.kind : 0,
+        ...(typeof value.containerName === "string" ? { containerName: value.containerName } : {}),
+    };
+}
+/**
+ * Normalize `workspace/symbol` SymbolInformation results: file URIs to
+ * workspace-relative paths, zero-based ranges to one-based, and every result
+ * outside the authorized root dropped with an honest count (spec § 4: the
+ * root is never widened because a result points outside it).
+ */
+function normalizeWorkspaceSymbols(raw, cwd) {
+    const items = Array.isArray(raw) ? raw : raw === undefined || raw === null ? [] : [raw];
+    const symbols = [];
+    let omitted = 0;
+    let outsideRoot = 0;
+    for (const item of items) {
+        const parsed = rawLocationUriAndRange(isRecord(item) ? (item.location ?? item) : undefined);
+        const absolutePath = parsed ? fileUriToAbsolutePath(parsed.uri) : undefined;
+        const info = rawWorkspaceSymbol(item);
+        if (!parsed || !absolutePath || !info) {
+            omitted++;
+            continue;
+        }
+        if (!isInsideRoot(absolutePath, cwd)) {
+            outsideRoot++;
+            continue;
+        }
+        symbols.push({
+            ...info,
+            path: formatPathRelativeToCwdOrAbsolute(absolutePath, cwd),
+            range: toOneBasedRange(parsed.range),
+        });
+    }
+    return { symbols, omitted, outsideRoot };
+}
+function compareWorkspaceSymbols(a, b) {
+    if (a.path !== b.path)
+        return a.path < b.path ? -1 : 1;
+    if (a.range.start.line !== b.range.start.line)
+        return a.range.start.line - b.range.start.line;
+    return a.name === b.name ? 0 : a.name < b.name ? -1 : 1;
+}
+function capWorkspaceSymbolsByCount(symbols, max) {
+    const sorted = [...symbols].sort(compareWorkspaceSymbols);
+    const capped = sorted.slice(0, max);
+    return { symbols: capped, truncated: sorted.length - capped.length };
+}
+function capWorkspaceSymbolsByBytes(symbols, maxBytes) {
+    let used = 2; // "[]"
+    for (let i = 0; i < symbols.length; i++) {
+        const cost = Buffer.byteLength(JSON.stringify(symbols[i]), "utf-8") + 1;
+        if (used + cost > maxBytes) {
+            return { symbols: symbols.slice(0, i), truncated: symbols.length - i };
+        }
+        used += cost;
+    }
+    return { symbols, truncated: 0 };
+}
+function isUnsupportedMethodError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.includes("-32601") || /method not found/i.test(message);
+}
+function formatWorkspaceSymbolsNotices(omitted, truncated, outsideRoot) {
+    const notices = [];
+    if (omitted > 0)
+        notices.push(`${omitted} non-file result(s) omitted`);
+    if (outsideRoot > 0)
+        notices.push(`${outsideRoot} result(s) outside the workspace root omitted`);
+    if (truncated > 0)
+        notices.push(`${truncated} result(s) truncated`);
+    return notices.length > 0 ? `\n\n[${notices.join(", ")}]` : "";
+}
+function formatWorkspaceSymbolsText(symbols, omitted, truncated, outsideRoot) {
+    if (symbols.length === 0) {
+        const base = "No symbols found.";
+        const notices = formatWorkspaceSymbolsNotices(omitted, truncated, outsideRoot);
+        return notices ? `${base}${notices}` : base;
+    }
+    const lines = symbols.map((symbol) => `${symbol.path}:${symbol.range.start.line}:${symbol.range.start.character} ${symbol.name}`);
+    return `${lines.join("\n")}${formatWorkspaceSymbolsNotices(omitted, truncated, outsideRoot)}`;
+}
 function formatNotices(omitted, truncated) {
     const notices = [];
     if (omitted > 0)
@@ -177,12 +289,53 @@ export function createLspToolDefinition(cwd, options) {
                 cwd,
                 defaultBehavior: "allow",
                 verb: "Query",
-                getPath: (params) => params.path,
+                // A workspace_symbol call has no path; returning undefined normalizes to
+                // the workspace root, so the same gate authorizes the root before the
+                // request is sent and `ruleForCall` stays inside one grammar.
+                getPath: (params) => ("path" in params ? params.path : undefined),
             }),
             context: { resultRecoverable: true, deferSchema: true },
             evidence: { emits: new Set(), capture: () => [] },
         },
         async execute(_toolCallId, input, signal) {
+            if (input.operation === "workspace_symbol") {
+                // The permission gate has already authorized the workspace root by the
+                // time execute runs; only now does the request go out.
+                try {
+                    const raw = await operations.request(cwd, "workspace/symbol", { query: input.query }, signal);
+                    const { symbols, omitted, outsideRoot } = normalizeWorkspaceSymbols(raw, cwd);
+                    const { symbols: countCapped, truncated: countTruncated } = capWorkspaceSymbolsByCount(symbols, MAX_SYMBOLS);
+                    const { symbols: capped, truncated: byteTruncated } = capWorkspaceSymbolsByBytes(countCapped, MAX_DETAILS_BYTES);
+                    const truncated = countTruncated + byteTruncated;
+                    return {
+                        content: [
+                            { type: "text", text: formatWorkspaceSymbolsText(capped, omitted, truncated, outsideRoot) },
+                        ],
+                        details: { operation: "workspace_symbol", symbols: capped, omitted, truncated, outsideRoot },
+                    };
+                }
+                catch (error) {
+                    if (isUnsupportedMethodError(error)) {
+                        return {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: "workspace_symbol is not supported by the configured language server.",
+                                },
+                            ],
+                            details: {
+                                operation: "workspace_symbol",
+                                symbols: [],
+                                omitted: 0,
+                                truncated: 0,
+                                outsideRoot: 0,
+                                unsupported: true,
+                            },
+                        };
+                    }
+                    throw error;
+                }
+            }
             const absolutePath = resolveToCwd(input.path, cwd);
             const uri = pathToFileURL(absolutePath).href;
             if (input.operation === "document_symbols") {

package/dist/core/tools/lsp.js.map

@@ -1 +1 @@
-{"version":3,"file":"lsp.js","sourceRoot":"","sources":["../../../src/core/tools/lsp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,MAAM,WAAW,GAAG,KAAK,CAAC;AAE1B,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE;QAC/E,WAAW,EAAE,gCAAgC;KAC7C,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;IAC9E,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;IAC5D,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,oDAAoD,EAAE,CAAC;CAC7F,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACpG,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;CAC9E,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAgD9E,SAAS,QAAQ,CAAC,KAAc,EAAoC;IACnE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAAA,CAC5E;AAED,SAAS,UAAU,CAAC,KAAc,EAAwB;IACzD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC;AAAA,CAChG;AAED,SAAS,OAAO,CAAC,KAAc,EAAqB;IACnD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAAA,CAC3E;AAED,SAAS,kBAAkB,CAAC,QAAqB,EAAe;IAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;AAAA,CACtE;AAED,SAAS,eAAe,CAAC,KAAe,EAAY;IACnD,OAAO,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAAA,CACtF;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAsB;IAC/D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACJ,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAgD;IAC7F,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACzG,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,kBAAkB,CAAC,GAAY,EAAE,GAAW,EAAiD;IACrG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxF,MAAM,SAAS,GAAkB,EAAE,CAAC;IACpC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QACD,SAAS,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,iCAAiC,CAAC,YAAY,EAAE,GAAG,CAAC;YAC1D,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC;SACpC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAAA,CAC9B;AAED,SAAS,gBAAgB,CAAC,CAAc,EAAE,CAAc,EAAU;IACjE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;IAC9F,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;IAClH,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;IACtF,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;AAAA,CACrD;AAED,SAAS,gBAAgB,CAAC,SAAwB,EAAE,GAAW,EAAmD;IACjH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;AAAA,CACvE;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAoC;IAC9E,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;AAAA,CAClH;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,IAAY,EAA6C;IAC9F,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,CAAC,KAAc,EAAQ,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,CAAC;gBACV,SAAS;YACV,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,IAAI,CAAC,IAAc;gBACzB,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACnD,IAAI;gBACJ,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,KAAiB,CAAC;gBAC9C,cAAc,EAAE,eAAe,CAAC,IAAI,CAAC,cAA0B,CAAC;gBAChE,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;IAAA,CACD,CAAC;IACF,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,CAC5B;AAED,SAAS,cAAc,CAAC,CAAY,EAAE,CAAY,EAAU;IAC3D,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;IAC9F,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;IAClH,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CACxD;AAED,SAAS,UAAU,CAAC,OAAoB,EAAE,GAAW,EAA+C;IACnG,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;AAAA,CACrE;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,SAAiB,EAAU;IAClE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,6BAA6B,CAAC,CAAC;IACvE,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,sBAAsB,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAAA,CAC/D;AAED,SAAS,mBAAmB,CAC3B,SAAsC,EACtC,SAAwB,EACxB,OAAe,EACf,SAAiB,EACR;IACT,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACrF,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAC1B,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAC/F,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;AAAA,CACjE;AAED,SAAS,iBAAiB,CAAC,OAAoB,EAAE,OAAe,EAAE,SAAiB,EAAU;IAC5F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CACxB,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,CACtG,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;AAAA,CACjE;AAED,MAAM,UAAU,uBAAuB,CACtC,GAAW,EACX,OAAuB,EACgC;IACvD,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,OAAO;QACN,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,+EAA+E;QAC5F,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE;YACT,4EAA4E;YAC5E,uEAAuE;YACvE,sEAAsE;YACtE,0EAA0E;YAC1E,6DAA6D;YAC7D,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;YAClC,UAAU,EAAE,wBAAwB,CAAC;gBACpC,GAAG;gBACH,eAAe,EAAE,OAAO;gBACxB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI;aAChC,CAAC;YACF,OAAO,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YACvD,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;SACjD;QACD,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAmB,EAAE,MAAoB,EAAE;YACrE,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC;YAE7C,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CACnC,YAAY,EACZ,6BAA6B,EAC7B,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,EAAE,EACzB,MAAM,CACN,CAAC;gBACF,MAAM,YAAY,GAAG,iCAAiC,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;gBAC1E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBAC/D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACxE,OAAO;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;oBAChF,OAAO,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE;iBAC/E,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;YAC1E,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,yBAAyB,CAAC;YACxG,MAAM,MAAM,GAA4B,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC;YAC5E,IAAI,KAAK,CAAC,SAAS,KAAK,YAAY;gBAAE,MAAM,CAAC,OAAO,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;YACpF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3E,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5D,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YACpF,OAAO;gBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;gBACnG,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE;aAC9E,CAAC;QAAA,CACF;KACD,CAAC;AAAA,CACF;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,OAAuB,EAA+B;IAChG,OAAO,kBAAkB,CAAC,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAAA,CACjE","sourcesContent":["import { fileURLToPath, pathToFileURL } from \"node:url\";\nimport type { AgentTool } from \"apex-code-agent-core\";\nimport { type Static, Type } from \"typebox\";\nimport { formatPathRelativeToCwdOrAbsolute } from \"../../utils/paths.ts\";\nimport type { ApexToolDefinition } from \"./contract.ts\";\nimport { createPathPermissionSpec } from \"./path-permission.ts\";\nimport { resolveToCwd } from \"./path-utils.ts\";\nimport { wrapToolDefinition } from \"./tool-definition-wrapper.ts\";\n\nconst MAX_LOCATIONS = 1_000;\nconst MAX_SYMBOLS = 2_000;\n\nconst lspNavigationSchema = Type.Object({\n\toperation: Type.Union([Type.Literal(\"definition\"), Type.Literal(\"references\")], {\n\t\tdescription: \"Which navigation query to run.\",\n\t}),\n\tpath: Type.String({ description: \"Path to the file (relative or absolute).\" }),\n\tline: Type.Number({ description: \"One-based line number.\" }),\n\tcharacter: Type.Number({ description: \"One-based UTF-16 character offset within the line.\" }),\n});\n\nconst lspDocumentSymbolsSchema = Type.Object({\n\toperation: Type.Literal(\"document_symbols\", { description: \"List the symbols declared in a file.\" }),\n\tpath: Type.String({ description: \"Path to the file (relative or absolute).\" }),\n});\n\nconst lspSchema = Type.Union([lspNavigationSchema, lspDocumentSymbolsSchema]);\n\nexport type LspToolInput = Static<typeof lspSchema>;\n\nexport interface LspPosition {\n\treadonly line: number;\n\treadonly character: number;\n}\n\nexport interface LspRange {\n\treadonly start: LspPosition;\n\treadonly end: LspPosition;\n}\n\n/** A navigation result normalized to a workspace-relative path and one-based range. */\nexport interface LspLocation {\n\treadonly path: string;\n\treadonly range: LspRange;\n}\n\n/** A flattened document symbol normalized to a workspace-relative path and one-based ranges. */\nexport interface LspSymbol {\n\treadonly name: string;\n\treadonly kind: number;\n\treadonly path: string;\n\treadonly range: LspRange;\n\treadonly selectionRange: LspRange;\n\treadonly detail?: string;\n}\n\nexport type LspToolDetails =\n\t| { operation: \"definition\" | \"references\"; locations: LspLocation[]; omitted: number; truncated: number }\n\t| { operation: \"document_symbols\"; symbols: LspSymbol[]; omitted: number; truncated: number };\n\n/**\n * Pluggable transport for the `lsp` tool. The executable, its arguments, and the\n * closed JSON-RPC method set are all fixed by configuration the tool never chooses\n * itself -- see contract.capabilities below for why that keeps this `{fs.read}`\n * rather than `{exec}`.\n */\nexport interface LspOperations {\n\trequest(absolutePath: string, method: string, params: unknown, signal?: AbortSignal): Promise<unknown>;\n}\n\nexport interface LspToolOptions {\n\toperations: LspOperations;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isPosition(value: unknown): value is LspPosition {\n\treturn isRecord(value) && typeof value.line === \"number\" && typeof value.character === \"number\";\n}\n\nfunction isRange(value: unknown): value is LspRange {\n\treturn isRecord(value) && isPosition(value.start) && isPosition(value.end);\n}\n\nfunction toOneBasedPosition(position: LspPosition): LspPosition {\n\treturn { line: position.line + 1, character: position.character + 1 };\n}\n\nfunction toOneBasedRange(range: LspRange): LspRange {\n\treturn { start: toOneBasedPosition(range.start), end: toOneBasedPosition(range.end) };\n}\n\nfunction fileUriToAbsolutePath(uri: string): string | undefined {\n\tif (!uri.startsWith(\"file:\")) return undefined;\n\ttry {\n\t\treturn fileURLToPath(uri);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction rawLocationUriAndRange(value: unknown): { uri: string; range: LspRange } | undefined {\n\tif (!isRecord(value)) return undefined;\n\tif (typeof value.uri === \"string\" && isRange(value.range)) return { uri: value.uri, range: value.range };\n\tif (typeof value.targetUri === \"string\" && isRange(value.targetRange)) {\n\t\treturn { uri: value.targetUri, range: value.targetRange };\n\t}\n\treturn undefined;\n}\n\nfunction normalizeLocations(raw: unknown, cwd: string): { locations: LspLocation[]; omitted: number } {\n\tconst items = Array.isArray(raw) ? raw : raw === undefined || raw === null ? [] : [raw];\n\tconst locations: LspLocation[] = [];\n\tlet omitted = 0;\n\tfor (const item of items) {\n\t\tconst parsed = rawLocationUriAndRange(item);\n\t\tconst absolutePath = parsed ? fileUriToAbsolutePath(parsed.uri) : undefined;\n\t\tif (!parsed || !absolutePath) {\n\t\t\tomitted++;\n\t\t\tcontinue;\n\t\t}\n\t\tlocations.push({\n\t\t\tpath: formatPathRelativeToCwdOrAbsolute(absolutePath, cwd),\n\t\t\trange: toOneBasedRange(parsed.range),\n\t\t});\n\t}\n\treturn { locations, omitted };\n}\n\nfunction compareLocations(a: LspLocation, b: LspLocation): number {\n\tif (a.path !== b.path) return a.path < b.path ? -1 : 1;\n\tif (a.range.start.line !== b.range.start.line) return a.range.start.line - b.range.start.line;\n\tif (a.range.start.character !== b.range.start.character) return a.range.start.character - b.range.start.character;\n\tif (a.range.end.line !== b.range.end.line) return a.range.end.line - b.range.end.line;\n\treturn a.range.end.character - b.range.end.character;\n}\n\nfunction dedupeSortAndCap(locations: LspLocation[], max: number): { locations: LspLocation[]; truncated: number } {\n\tconst seen = new Set<string>();\n\tconst unique: LspLocation[] = [];\n\tfor (const location of locations) {\n\t\tconst key = JSON.stringify(location);\n\t\tif (seen.has(key)) continue;\n\t\tseen.add(key);\n\t\tunique.push(location);\n\t}\n\tunique.sort(compareLocations);\n\tconst capped = unique.slice(0, max);\n\treturn { locations: capped, truncated: unique.length - capped.length };\n}\n\nfunction isRawDocumentSymbol(value: unknown): value is Record<string, unknown> {\n\treturn isRecord(value) && typeof value.name === \"string\" && isRange(value.range) && isRange(value.selectionRange);\n}\n\nfunction flattenSymbols(raw: unknown, path: string): { symbols: LspSymbol[]; omitted: number } {\n\tconst symbols: LspSymbol[] = [];\n\tlet omitted = 0;\n\tconst visit = (value: unknown): void => {\n\t\tif (!Array.isArray(value)) return;\n\t\tfor (const item of value) {\n\t\t\tif (!isRawDocumentSymbol(item)) {\n\t\t\t\tomitted++;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tsymbols.push({\n\t\t\t\tname: item.name as string,\n\t\t\t\tkind: typeof item.kind === \"number\" ? item.kind : 0,\n\t\t\t\tpath,\n\t\t\t\trange: toOneBasedRange(item.range as LspRange),\n\t\t\t\tselectionRange: toOneBasedRange(item.selectionRange as LspRange),\n\t\t\t\t...(typeof item.detail === \"string\" ? { detail: item.detail } : {}),\n\t\t\t});\n\t\t\tif (Array.isArray(item.children)) visit(item.children);\n\t\t}\n\t};\n\tvisit(Array.isArray(raw) ? raw : []);\n\treturn { symbols, omitted };\n}\n\nfunction compareSymbols(a: LspSymbol, b: LspSymbol): number {\n\tif (a.range.start.line !== b.range.start.line) return a.range.start.line - b.range.start.line;\n\tif (a.range.start.character !== b.range.start.character) return a.range.start.character - b.range.start.character;\n\treturn a.name === b.name ? 0 : a.name < b.name ? -1 : 1;\n}\n\nfunction capSymbols(symbols: LspSymbol[], max: number): { symbols: LspSymbol[]; truncated: number } {\n\tconst sorted = [...symbols].sort(compareSymbols);\n\tconst capped = sorted.slice(0, max);\n\treturn { symbols: capped, truncated: sorted.length - capped.length };\n}\n\nfunction formatNotices(omitted: number, truncated: number): string {\n\tconst notices: string[] = [];\n\tif (omitted > 0) notices.push(`${omitted} non-file result(s) omitted`);\n\tif (truncated > 0) notices.push(`${truncated} result(s) truncated`);\n\treturn notices.length > 0 ? `\\n\\n[${notices.join(\", \")}]` : \"\";\n}\n\nfunction formatLocationsText(\n\toperation: \"definition\" | \"references\",\n\tlocations: LspLocation[],\n\tomitted: number,\n\ttruncated: number,\n): string {\n\tif (locations.length === 0) {\n\t\treturn operation === \"definition\" ? \"No definition found.\" : \"No references found.\";\n\t}\n\tconst lines = locations.map(\n\t\t(location) => `${location.path}:${location.range.start.line}:${location.range.start.character}`,\n\t);\n\treturn `${lines.join(\"\\n\")}${formatNotices(omitted, truncated)}`;\n}\n\nfunction formatSymbolsText(symbols: LspSymbol[], omitted: number, truncated: number): string {\n\tif (symbols.length === 0) return \"No symbols found.\";\n\tconst lines = symbols.map(\n\t\t(symbol) => `${symbol.path}:${symbol.range.start.line}:${symbol.range.start.character} ${symbol.name}`,\n\t);\n\treturn `${lines.join(\"\\n\")}${formatNotices(omitted, truncated)}`;\n}\n\nexport function createLspToolDefinition(\n\tcwd: string,\n\toptions: LspToolOptions,\n): ApexToolDefinition<typeof lspSchema, LspToolDetails> {\n\tconst { operations } = options;\n\treturn {\n\t\tname: \"lsp\",\n\t\tlabel: \"lsp\",\n\t\tdescription: \"Query the configured language server for definitions, references, or symbols.\",\n\t\tparameters: lspSchema,\n\t\tcontract: {\n\t\t\t// `grep` spawns `rg` and declares {fs.read}, not {exec}, because the caller\n\t\t\t// never chooses what runs -- the executable, args, and closed JSON-RPC\n\t\t\t// method set all come from settings.json / this tool's own code. Same\n\t\t\t// reasoning here: {exec} would silently widen a delegation ceiling for no\n\t\t\t// capability the model can actually reach through this tool.\n\t\t\tcapabilities: new Set([\"fs.read\"]),\n\t\t\tpermission: createPathPermissionSpec({\n\t\t\t\tcwd,\n\t\t\t\tdefaultBehavior: \"allow\",\n\t\t\t\tverb: \"Query\",\n\t\t\t\tgetPath: (params) => params.path,\n\t\t\t}),\n\t\t\tcontext: { resultRecoverable: true, deferSchema: true },\n\t\t\tevidence: { emits: new Set(), capture: () => [] },\n\t\t},\n\t\tasync execute(_toolCallId, input: LspToolInput, signal?: AbortSignal) {\n\t\t\tconst absolutePath = resolveToCwd(input.path, cwd);\n\t\t\tconst uri = pathToFileURL(absolutePath).href;\n\n\t\t\tif (input.operation === \"document_symbols\") {\n\t\t\t\tconst raw = await operations.request(\n\t\t\t\t\tabsolutePath,\n\t\t\t\t\t\"textDocument/documentSymbol\",\n\t\t\t\t\t{ textDocument: { uri } },\n\t\t\t\t\tsignal,\n\t\t\t\t);\n\t\t\t\tconst relativePath = formatPathRelativeToCwdOrAbsolute(absolutePath, cwd);\n\t\t\t\tconst { symbols, omitted } = flattenSymbols(raw, relativePath);\n\t\t\t\tconst { symbols: capped, truncated } = capSymbols(symbols, MAX_SYMBOLS);\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\", text: formatSymbolsText(capped, omitted, truncated) }],\n\t\t\t\t\tdetails: { operation: \"document_symbols\", symbols: capped, omitted, truncated },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst position = { line: input.line - 1, character: input.character - 1 };\n\t\t\tconst method = input.operation === \"definition\" ? \"textDocument/definition\" : \"textDocument/references\";\n\t\t\tconst params: Record<string, unknown> = { textDocument: { uri }, position };\n\t\t\tif (input.operation === \"references\") params.context = { includeDeclaration: true };\n\t\t\tconst raw = await operations.request(absolutePath, method, params, signal);\n\t\t\tconst { locations, omitted } = normalizeLocations(raw, cwd);\n\t\t\tconst { locations: capped, truncated } = dedupeSortAndCap(locations, MAX_LOCATIONS);\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\", text: formatLocationsText(input.operation, capped, omitted, truncated) }],\n\t\t\t\tdetails: { operation: input.operation, locations: capped, omitted, truncated },\n\t\t\t};\n\t\t},\n\t};\n}\n\nexport function createLspTool(cwd: string, options: LspToolOptions): AgentTool<typeof lspSchema> {\n\treturn wrapToolDefinition(createLspToolDefinition(cwd, options));\n}\n"]}
+{"version":3,"file":"lsp.js","sourceRoot":"","sources":["../../../src/core/tools/lsp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAA2B,SAAS,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,6FAA4F;AAC5F,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AAErC,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/E,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC3C,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC3C,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG;IAC3B,SAAS,EAAE,IAAI,CAAC,KAAK,CACpB;QACC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;KAChC,EACD,EAAE,WAAW,EAAE,qBAAqB,EAAE,CACtC;IACD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,4FAA4F;KACzG,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;IACnG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC;QACtB,WAAW,EAAE,2FAA2F;KACxG,CAAC;IACF,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;CACnG,CAAC;AAEF,MAAM,SAAS,GAAG,SAAS,CAC1B,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC,EAC1E,mBAAmB,CACnB,CAAC;AAiEF,SAAS,QAAQ,CAAC,KAAc,EAAoC;IACnE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAAA,CAC5E;AAED,SAAS,UAAU,CAAC,KAAc,EAAwB;IACzD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC;AAAA,CAChG;AAED,SAAS,OAAO,CAAC,KAAc,EAAqB;IACnD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAAA,CAC3E;AAED,SAAS,kBAAkB,CAAC,QAAqB,EAAe;IAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;AAAA,CACtE;AAED,SAAS,eAAe,CAAC,KAAe,EAAY;IACnD,OAAO,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAAA,CACtF;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAsB;IAC/D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACJ,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAgD;IAC7F,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACzG,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,kBAAkB,CAAC,GAAY,EAAE,GAAW,EAAiD;IACrG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxF,MAAM,SAAS,GAAkB,EAAE,CAAC;IACpC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QACD,SAAS,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,iCAAiC,CAAC,YAAY,EAAE,GAAG,CAAC;YAC1D,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC;SACpC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAAA,CAC9B;AAED,SAAS,gBAAgB,CAAC,CAAc,EAAE,CAAc,EAAU;IACjE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;IAC9F,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;IAClH,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;IACtF,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;AAAA,CACrD;AAED,SAAS,gBAAgB,CAAC,SAAwB,EAAE,GAAW,EAAmD;IACjH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;AAAA,CACvE;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAoC;IAC9E,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;AAAA,CAClH;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,IAAY,EAA6C;IAC9F,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,CAAC,KAAc,EAAQ,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,CAAC;gBACV,SAAS;YACV,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,IAAI,CAAC,IAAc;gBACzB,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACnD,IAAI;gBACJ,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,KAAiB,CAAC;gBAC9C,cAAc,EAAE,eAAe,CAAC,IAAI,CAAC,cAA0B,CAAC;gBAChE,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;IAAA,CACD,CAAC;IACF,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,CAC5B;AAED,SAAS,cAAc,CAAC,CAAY,EAAE,CAAY,EAAU;IAC3D,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;IAC9F,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;IAClH,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CACxD;AAED,SAAS,UAAU,CAAC,OAAoB,EAAE,GAAW,EAA+C;IACnG,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;AAAA,CACrE;AAED,SAAS,YAAY,CAAC,YAAoB,EAAE,IAAY,EAAW;IAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACzC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAAA,CACjE;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAsE;IAC/G,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACzE,OAAO;QACN,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,GAAG,CAAC,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC;AAAA,CACF;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CACjC,GAAY,EACZ,GAAW,EAC+D;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxF,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5F,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,EAAE,CAAC;YACvC,OAAO,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;YACtC,WAAW,EAAE,CAAC;YACd,SAAS;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACZ,GAAG,IAAI;YACP,IAAI,EAAE,iCAAiC,CAAC,YAAY,EAAE,GAAG,CAAC;YAC1D,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC;SACpC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAAA,CACzC;AAED,SAAS,uBAAuB,CAAC,CAAqB,EAAE,CAAqB,EAAU;IACtF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;IAC9F,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CACxD;AAED,SAAS,0BAA0B,CAClC,OAA6B,EAC7B,GAAW,EAC4C;IACvD,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;AAAA,CACrE;AAED,SAAS,0BAA0B,CAClC,OAA6B,EAC7B,QAAgB,EACuC;IACvD,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACxE,IAAI,IAAI,GAAG,IAAI,GAAG,QAAQ,EAAE,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,IAAI,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAAA,CACjC;AAED,SAAS,wBAAwB,CAAC,KAAc,EAAW;IAC1D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAAA,CACvE;AAED,SAAS,6BAA6B,CAAC,OAAe,EAAE,SAAiB,EAAE,WAAmB,EAAU;IACvG,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,6BAA6B,CAAC,CAAC;IACvE,IAAI,WAAW,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,+CAA+C,CAAC,CAAC;IACjG,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,sBAAsB,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAAA,CAC/D;AAED,SAAS,0BAA0B,CAClC,OAA6B,EAC7B,OAAe,EACf,SAAiB,EACjB,WAAmB,EACV;IACT,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,mBAAmB,CAAC;QACjC,MAAM,OAAO,GAAG,6BAA6B,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAC/E,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CACxB,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,CACtG,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,6BAA6B,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;AAAA,CAC9F;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,SAAiB,EAAU;IAClE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,6BAA6B,CAAC,CAAC;IACvE,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,sBAAsB,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAAA,CAC/D;AAED,SAAS,mBAAmB,CAC3B,SAAsC,EACtC,SAAwB,EACxB,OAAe,EACf,SAAiB,EACR;IACT,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACrF,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAC1B,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAC/F,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;AAAA,CACjE;AAED,SAAS,iBAAiB,CAAC,OAAoB,EAAE,OAAe,EAAE,SAAiB,EAAU;IAC5F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CACxB,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,CACtG,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;AAAA,CACjE;AAED,MAAM,UAAU,uBAAuB,CACtC,GAAW,EACX,OAAuB,EACgC;IACvD,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,OAAO;QACN,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,+EAA+E;QAC5F,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE;YACT,4EAA4E;YAC5E,uEAAuE;YACvE,sEAAsE;YACtE,0EAA0E;YAC1E,6DAA6D;YAC7D,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;YAClC,UAAU,EAAE,wBAAwB,CAAC;gBACpC,GAAG;gBACH,eAAe,EAAE,OAAO;gBACxB,IAAI,EAAE,OAAO;gBACb,yEAAyE;gBACzE,sEAAsE;gBACtE,8DAA8D;gBAC9D,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;aACjE,CAAC;YACF,OAAO,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YACvD,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;SACjD;QACD,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAmB,EAAE,MAAoB,EAAE;YACrE,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,EAAE,CAAC;gBAC5C,uEAAuE;gBACvE,uDAAuD;gBACvD,IAAI,CAAC;oBACJ,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;oBAC9F,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC9E,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,0BAA0B,CACrF,OAAO,EACP,WAAW,CACX,CAAC;oBACF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,0BAA0B,CAC/E,WAAW,EACX,iBAAiB,CACjB,CAAC;oBACF,MAAM,SAAS,GAAG,cAAc,GAAG,aAAa,CAAC;oBACjD,OAAO;wBACN,OAAO,EAAE;4BACR,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE;yBAC3F;wBACD,OAAO,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE;qBAC5F,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;wBACrC,OAAO;4BACN,OAAO,EAAE;gCACR;oCACC,IAAI,EAAE,MAAM;oCACZ,IAAI,EAAE,sEAAsE;iCAC5E;6BACD;4BACD,OAAO,EAAE;gCACR,SAAS,EAAE,kBAAkB;gCAC7B,OAAO,EAAE,EAAE;gCACX,OAAO,EAAE,CAAC;gCACV,SAAS,EAAE,CAAC;gCACZ,WAAW,EAAE,CAAC;gCACd,WAAW,EAAE,IAAI;6BACjB;yBACD,CAAC;oBACH,CAAC;oBACD,MAAM,KAAK,CAAC;gBACb,CAAC;YACF,CAAC;YAED,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC;YAE7C,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CACnC,YAAY,EACZ,6BAA6B,EAC7B,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,EAAE,EACzB,MAAM,CACN,CAAC;gBACF,MAAM,YAAY,GAAG,iCAAiC,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;gBAC1E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBAC/D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACxE,OAAO;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;oBAChF,OAAO,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE;iBAC/E,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;YAC1E,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,yBAAyB,CAAC;YACxG,MAAM,MAAM,GAA4B,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC;YAC5E,IAAI,KAAK,CAAC,SAAS,KAAK,YAAY;gBAAE,MAAM,CAAC,OAAO,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;YACpF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3E,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5D,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YACpF,OAAO;gBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;gBACnG,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE;aAC9E,CAAC;QAAA,CACF;KACD,CAAC;AAAA,CACF;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,OAAuB,EAA+B;IAChG,OAAO,kBAAkB,CAAC,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAAA,CACjE","sourcesContent":["import { isAbsolute, relative } from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport type { AgentTool } from \"apex-code-agent-core\";\nimport { type Static, Type } from \"typebox\";\nimport { formatPathRelativeToCwdOrAbsolute } from \"../../utils/paths.ts\";\nimport { type ApexToolDefinition, toolUnion } from \"./contract.ts\";\nimport { createPathPermissionSpec } from \"./path-permission.ts\";\nimport { resolveToCwd } from \"./path-utils.ts\";\nimport { wrapToolDefinition } from \"./tool-definition-wrapper.ts\";\n\nconst MAX_LOCATIONS = 1_000;\nconst MAX_SYMBOLS = 2_000;\n/** Cap on the serialized symbol details so a result can never grow unbounded (spec § 4). */\nconst MAX_DETAILS_BYTES = 256 * 1024;\n\nconst lspNavigationSchema = Type.Object({\n\toperation: Type.Union([Type.Literal(\"definition\"), Type.Literal(\"references\")]),\n\tpath: Type.String(),\n\tline: Type.Number(),\n\tcharacter: Type.Number(),\n});\n\nconst lspDocumentSymbolsSchema = Type.Object({\n\toperation: Type.Literal(\"document_symbols\"),\n\tpath: Type.String(),\n});\n\nconst lspWorkspaceSymbolsSchema = Type.Object({\n\toperation: Type.Literal(\"workspace_symbol\"),\n\tquery: Type.String(),\n});\n\nconst lspSchemaProperties = {\n\toperation: Type.Union(\n\t\t[\n\t\t\tType.Literal(\"definition\"),\n\t\t\tType.Literal(\"references\"),\n\t\t\tType.Literal(\"document_symbols\"),\n\t\t\tType.Literal(\"workspace_symbol\"),\n\t\t],\n\t\t{ description: \"Which query to run.\" },\n\t),\n\tpath: Type.String({\n\t\tdescription: \"Path to the file (relative or absolute). Required by every operation but workspace_symbol.\",\n\t}),\n\tline: Type.Number({ description: \"One-based line number. Required by definition and references.\" }),\n\tcharacter: Type.Number({\n\t\tdescription: \"One-based UTF-16 character offset within the line. Required by definition and references.\",\n\t}),\n\tquery: Type.String({ description: \"The symbol name to search for. Required by workspace_symbol.\" }),\n};\n\nconst lspSchema = toolUnion(\n\t[lspNavigationSchema, lspDocumentSymbolsSchema, lspWorkspaceSymbolsSchema],\n\tlspSchemaProperties,\n);\n\nexport type LspToolInput = Static<typeof lspSchema>;\n\nexport interface LspPosition {\n\treadonly line: number;\n\treadonly character: number;\n}\n\nexport interface LspRange {\n\treadonly start: LspPosition;\n\treadonly end: LspPosition;\n}\n\n/** A navigation result normalized to a workspace-relative path and one-based range. */\nexport interface LspLocation {\n\treadonly path: string;\n\treadonly range: LspRange;\n}\n\n/** A flattened document symbol normalized to a workspace-relative path and one-based ranges. */\nexport interface LspSymbol {\n\treadonly name: string;\n\treadonly kind: number;\n\treadonly path: string;\n\treadonly range: LspRange;\n\treadonly selectionRange: LspRange;\n\treadonly detail?: string;\n}\n\n/** A workspace-wide symbol (LSP SymbolInformation) normalized like {@link LspSymbol} without a selection range. */\nexport interface LspWorkspaceSymbol {\n\treadonly name: string;\n\treadonly kind: number;\n\treadonly path: string;\n\treadonly range: LspRange;\n\treadonly containerName?: string;\n}\n\nexport type LspToolDetails =\n\t| { operation: \"definition\" | \"references\"; locations: LspLocation[]; omitted: number; truncated: number }\n\t| { operation: \"document_symbols\"; symbols: LspSymbol[]; omitted: number; truncated: number }\n\t| {\n\t\t\toperation: \"workspace_symbol\";\n\t\t\tsymbols: LspWorkspaceSymbol[];\n\t\t\tomitted: number;\n\t\t\ttruncated: number;\n\t\t\toutsideRoot: number;\n\t\t\tunsupported?: boolean;\n\t  };\n\n/**\n * Pluggable transport for the `lsp` tool. The executable, its arguments, and the\n * closed JSON-RPC method set are all fixed by configuration the tool never chooses\n * itself -- see contract.capabilities below for why that keeps this `{fs.read}`\n * rather than `{exec}`.\n */\nexport interface LspOperations {\n\trequest(absolutePath: string, method: string, params: unknown, signal?: AbortSignal): Promise<unknown>;\n}\n\nexport interface LspToolOptions {\n\toperations: LspOperations;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isPosition(value: unknown): value is LspPosition {\n\treturn isRecord(value) && typeof value.line === \"number\" && typeof value.character === \"number\";\n}\n\nfunction isRange(value: unknown): value is LspRange {\n\treturn isRecord(value) && isPosition(value.start) && isPosition(value.end);\n}\n\nfunction toOneBasedPosition(position: LspPosition): LspPosition {\n\treturn { line: position.line + 1, character: position.character + 1 };\n}\n\nfunction toOneBasedRange(range: LspRange): LspRange {\n\treturn { start: toOneBasedPosition(range.start), end: toOneBasedPosition(range.end) };\n}\n\nfunction fileUriToAbsolutePath(uri: string): string | undefined {\n\tif (!uri.startsWith(\"file:\")) return undefined;\n\ttry {\n\t\treturn fileURLToPath(uri);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction rawLocationUriAndRange(value: unknown): { uri: string; range: LspRange } | undefined {\n\tif (!isRecord(value)) return undefined;\n\tif (typeof value.uri === \"string\" && isRange(value.range)) return { uri: value.uri, range: value.range };\n\tif (typeof value.targetUri === \"string\" && isRange(value.targetRange)) {\n\t\treturn { uri: value.targetUri, range: value.targetRange };\n\t}\n\treturn undefined;\n}\n\nfunction normalizeLocations(raw: unknown, cwd: string): { locations: LspLocation[]; omitted: number } {\n\tconst items = Array.isArray(raw) ? raw : raw === undefined || raw === null ? [] : [raw];\n\tconst locations: LspLocation[] = [];\n\tlet omitted = 0;\n\tfor (const item of items) {\n\t\tconst parsed = rawLocationUriAndRange(item);\n\t\tconst absolutePath = parsed ? fileUriToAbsolutePath(parsed.uri) : undefined;\n\t\tif (!parsed || !absolutePath) {\n\t\t\tomitted++;\n\t\t\tcontinue;\n\t\t}\n\t\tlocations.push({\n\t\t\tpath: formatPathRelativeToCwdOrAbsolute(absolutePath, cwd),\n\t\t\trange: toOneBasedRange(parsed.range),\n\t\t});\n\t}\n\treturn { locations, omitted };\n}\n\nfunction compareLocations(a: LspLocation, b: LspLocation): number {\n\tif (a.path !== b.path) return a.path < b.path ? -1 : 1;\n\tif (a.range.start.line !== b.range.start.line) return a.range.start.line - b.range.start.line;\n\tif (a.range.start.character !== b.range.start.character) return a.range.start.character - b.range.start.character;\n\tif (a.range.end.line !== b.range.end.line) return a.range.end.line - b.range.end.line;\n\treturn a.range.end.character - b.range.end.character;\n}\n\nfunction dedupeSortAndCap(locations: LspLocation[], max: number): { locations: LspLocation[]; truncated: number } {\n\tconst seen = new Set<string>();\n\tconst unique: LspLocation[] = [];\n\tfor (const location of locations) {\n\t\tconst key = JSON.stringify(location);\n\t\tif (seen.has(key)) continue;\n\t\tseen.add(key);\n\t\tunique.push(location);\n\t}\n\tunique.sort(compareLocations);\n\tconst capped = unique.slice(0, max);\n\treturn { locations: capped, truncated: unique.length - capped.length };\n}\n\nfunction isRawDocumentSymbol(value: unknown): value is Record<string, unknown> {\n\treturn isRecord(value) && typeof value.name === \"string\" && isRange(value.range) && isRange(value.selectionRange);\n}\n\nfunction flattenSymbols(raw: unknown, path: string): { symbols: LspSymbol[]; omitted: number } {\n\tconst symbols: LspSymbol[] = [];\n\tlet omitted = 0;\n\tconst visit = (value: unknown): void => {\n\t\tif (!Array.isArray(value)) return;\n\t\tfor (const item of value) {\n\t\t\tif (!isRawDocumentSymbol(item)) {\n\t\t\t\tomitted++;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tsymbols.push({\n\t\t\t\tname: item.name as string,\n\t\t\t\tkind: typeof item.kind === \"number\" ? item.kind : 0,\n\t\t\t\tpath,\n\t\t\t\trange: toOneBasedRange(item.range as LspRange),\n\t\t\t\tselectionRange: toOneBasedRange(item.selectionRange as LspRange),\n\t\t\t\t...(typeof item.detail === \"string\" ? { detail: item.detail } : {}),\n\t\t\t});\n\t\t\tif (Array.isArray(item.children)) visit(item.children);\n\t\t}\n\t};\n\tvisit(Array.isArray(raw) ? raw : []);\n\treturn { symbols, omitted };\n}\n\nfunction compareSymbols(a: LspSymbol, b: LspSymbol): number {\n\tif (a.range.start.line !== b.range.start.line) return a.range.start.line - b.range.start.line;\n\tif (a.range.start.character !== b.range.start.character) return a.range.start.character - b.range.start.character;\n\treturn a.name === b.name ? 0 : a.name < b.name ? -1 : 1;\n}\n\nfunction capSymbols(symbols: LspSymbol[], max: number): { symbols: LspSymbol[]; truncated: number } {\n\tconst sorted = [...symbols].sort(compareSymbols);\n\tconst capped = sorted.slice(0, max);\n\treturn { symbols: capped, truncated: sorted.length - capped.length };\n}\n\nfunction isInsideRoot(absolutePath: string, root: string): boolean {\n\tconst rel = relative(root, absolutePath);\n\treturn rel === \"\" || (!rel.startsWith(\"..\") && !isAbsolute(rel));\n}\n\nfunction rawWorkspaceSymbol(value: unknown): { name: string; kind: number; containerName?: string } | undefined {\n\tif (!isRecord(value) || typeof value.name !== \"string\") return undefined;\n\treturn {\n\t\tname: value.name,\n\t\tkind: typeof value.kind === \"number\" ? value.kind : 0,\n\t\t...(typeof value.containerName === \"string\" ? { containerName: value.containerName } : {}),\n\t};\n}\n\n/**\n * Normalize `workspace/symbol` SymbolInformation results: file URIs to\n * workspace-relative paths, zero-based ranges to one-based, and every result\n * outside the authorized root dropped with an honest count (spec § 4: the\n * root is never widened because a result points outside it).\n */\nfunction normalizeWorkspaceSymbols(\n\traw: unknown,\n\tcwd: string,\n): { symbols: LspWorkspaceSymbol[]; omitted: number; outsideRoot: number } {\n\tconst items = Array.isArray(raw) ? raw : raw === undefined || raw === null ? [] : [raw];\n\tconst symbols: LspWorkspaceSymbol[] = [];\n\tlet omitted = 0;\n\tlet outsideRoot = 0;\n\tfor (const item of items) {\n\t\tconst parsed = rawLocationUriAndRange(isRecord(item) ? (item.location ?? item) : undefined);\n\t\tconst absolutePath = parsed ? fileUriToAbsolutePath(parsed.uri) : undefined;\n\t\tconst info = rawWorkspaceSymbol(item);\n\t\tif (!parsed || !absolutePath || !info) {\n\t\t\tomitted++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!isInsideRoot(absolutePath, cwd)) {\n\t\t\toutsideRoot++;\n\t\t\tcontinue;\n\t\t}\n\t\tsymbols.push({\n\t\t\t...info,\n\t\t\tpath: formatPathRelativeToCwdOrAbsolute(absolutePath, cwd),\n\t\t\trange: toOneBasedRange(parsed.range),\n\t\t});\n\t}\n\treturn { symbols, omitted, outsideRoot };\n}\n\nfunction compareWorkspaceSymbols(a: LspWorkspaceSymbol, b: LspWorkspaceSymbol): number {\n\tif (a.path !== b.path) return a.path < b.path ? -1 : 1;\n\tif (a.range.start.line !== b.range.start.line) return a.range.start.line - b.range.start.line;\n\treturn a.name === b.name ? 0 : a.name < b.name ? -1 : 1;\n}\n\nfunction capWorkspaceSymbolsByCount(\n\tsymbols: LspWorkspaceSymbol[],\n\tmax: number,\n): { symbols: LspWorkspaceSymbol[]; truncated: number } {\n\tconst sorted = [...symbols].sort(compareWorkspaceSymbols);\n\tconst capped = sorted.slice(0, max);\n\treturn { symbols: capped, truncated: sorted.length - capped.length };\n}\n\nfunction capWorkspaceSymbolsByBytes(\n\tsymbols: LspWorkspaceSymbol[],\n\tmaxBytes: number,\n): { symbols: LspWorkspaceSymbol[]; truncated: number } {\n\tlet used = 2; // \"[]\"\n\tfor (let i = 0; i < symbols.length; i++) {\n\t\tconst cost = Buffer.byteLength(JSON.stringify(symbols[i]), \"utf-8\") + 1;\n\t\tif (used + cost > maxBytes) {\n\t\t\treturn { symbols: symbols.slice(0, i), truncated: symbols.length - i };\n\t\t}\n\t\tused += cost;\n\t}\n\treturn { symbols, truncated: 0 };\n}\n\nfunction isUnsupportedMethodError(error: unknown): boolean {\n\tconst message = error instanceof Error ? error.message : String(error);\n\treturn message.includes(\"-32601\") || /method not found/i.test(message);\n}\n\nfunction formatWorkspaceSymbolsNotices(omitted: number, truncated: number, outsideRoot: number): string {\n\tconst notices: string[] = [];\n\tif (omitted > 0) notices.push(`${omitted} non-file result(s) omitted`);\n\tif (outsideRoot > 0) notices.push(`${outsideRoot} result(s) outside the workspace root omitted`);\n\tif (truncated > 0) notices.push(`${truncated} result(s) truncated`);\n\treturn notices.length > 0 ? `\\n\\n[${notices.join(\", \")}]` : \"\";\n}\n\nfunction formatWorkspaceSymbolsText(\n\tsymbols: LspWorkspaceSymbol[],\n\tomitted: number,\n\ttruncated: number,\n\toutsideRoot: number,\n): string {\n\tif (symbols.length === 0) {\n\t\tconst base = \"No symbols found.\";\n\t\tconst notices = formatWorkspaceSymbolsNotices(omitted, truncated, outsideRoot);\n\t\treturn notices ? `${base}${notices}` : base;\n\t}\n\tconst lines = symbols.map(\n\t\t(symbol) => `${symbol.path}:${symbol.range.start.line}:${symbol.range.start.character} ${symbol.name}`,\n\t);\n\treturn `${lines.join(\"\\n\")}${formatWorkspaceSymbolsNotices(omitted, truncated, outsideRoot)}`;\n}\n\nfunction formatNotices(omitted: number, truncated: number): string {\n\tconst notices: string[] = [];\n\tif (omitted > 0) notices.push(`${omitted} non-file result(s) omitted`);\n\tif (truncated > 0) notices.push(`${truncated} result(s) truncated`);\n\treturn notices.length > 0 ? `\\n\\n[${notices.join(\", \")}]` : \"\";\n}\n\nfunction formatLocationsText(\n\toperation: \"definition\" | \"references\",\n\tlocations: LspLocation[],\n\tomitted: number,\n\ttruncated: number,\n): string {\n\tif (locations.length === 0) {\n\t\treturn operation === \"definition\" ? \"No definition found.\" : \"No references found.\";\n\t}\n\tconst lines = locations.map(\n\t\t(location) => `${location.path}:${location.range.start.line}:${location.range.start.character}`,\n\t);\n\treturn `${lines.join(\"\\n\")}${formatNotices(omitted, truncated)}`;\n}\n\nfunction formatSymbolsText(symbols: LspSymbol[], omitted: number, truncated: number): string {\n\tif (symbols.length === 0) return \"No symbols found.\";\n\tconst lines = symbols.map(\n\t\t(symbol) => `${symbol.path}:${symbol.range.start.line}:${symbol.range.start.character} ${symbol.name}`,\n\t);\n\treturn `${lines.join(\"\\n\")}${formatNotices(omitted, truncated)}`;\n}\n\nexport function createLspToolDefinition(\n\tcwd: string,\n\toptions: LspToolOptions,\n): ApexToolDefinition<typeof lspSchema, LspToolDetails> {\n\tconst { operations } = options;\n\treturn {\n\t\tname: \"lsp\",\n\t\tlabel: \"lsp\",\n\t\tdescription: \"Query the configured language server for definitions, references, or symbols.\",\n\t\tparameters: lspSchema,\n\t\tcontract: {\n\t\t\t// `grep` spawns `rg` and declares {fs.read}, not {exec}, because the caller\n\t\t\t// never chooses what runs -- the executable, args, and closed JSON-RPC\n\t\t\t// method set all come from settings.json / this tool's own code. Same\n\t\t\t// reasoning here: {exec} would silently widen a delegation ceiling for no\n\t\t\t// capability the model can actually reach through this tool.\n\t\t\tcapabilities: new Set([\"fs.read\"]),\n\t\t\tpermission: createPathPermissionSpec({\n\t\t\t\tcwd,\n\t\t\t\tdefaultBehavior: \"allow\",\n\t\t\t\tverb: \"Query\",\n\t\t\t\t// A workspace_symbol call has no path; returning undefined normalizes to\n\t\t\t\t// the workspace root, so the same gate authorizes the root before the\n\t\t\t\t// request is sent and `ruleForCall` stays inside one grammar.\n\t\t\t\tgetPath: (params) => (\"path\" in params ? params.path : undefined),\n\t\t\t}),\n\t\t\tcontext: { resultRecoverable: true, deferSchema: true },\n\t\t\tevidence: { emits: new Set(), capture: () => [] },\n\t\t},\n\t\tasync execute(_toolCallId, input: LspToolInput, signal?: AbortSignal) {\n\t\t\tif (input.operation === \"workspace_symbol\") {\n\t\t\t\t// The permission gate has already authorized the workspace root by the\n\t\t\t\t// time execute runs; only now does the request go out.\n\t\t\t\ttry {\n\t\t\t\t\tconst raw = await operations.request(cwd, \"workspace/symbol\", { query: input.query }, signal);\n\t\t\t\t\tconst { symbols, omitted, outsideRoot } = normalizeWorkspaceSymbols(raw, cwd);\n\t\t\t\t\tconst { symbols: countCapped, truncated: countTruncated } = capWorkspaceSymbolsByCount(\n\t\t\t\t\t\tsymbols,\n\t\t\t\t\t\tMAX_SYMBOLS,\n\t\t\t\t\t);\n\t\t\t\t\tconst { symbols: capped, truncated: byteTruncated } = capWorkspaceSymbolsByBytes(\n\t\t\t\t\t\tcountCapped,\n\t\t\t\t\t\tMAX_DETAILS_BYTES,\n\t\t\t\t\t);\n\t\t\t\t\tconst truncated = countTruncated + byteTruncated;\n\t\t\t\t\treturn {\n\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t{ type: \"text\", text: formatWorkspaceSymbolsText(capped, omitted, truncated, outsideRoot) },\n\t\t\t\t\t\t],\n\t\t\t\t\t\tdetails: { operation: \"workspace_symbol\", symbols: capped, omitted, truncated, outsideRoot },\n\t\t\t\t\t};\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (isUnsupportedMethodError(error)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\ttext: \"workspace_symbol is not supported by the configured language server.\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\tdetails: {\n\t\t\t\t\t\t\t\toperation: \"workspace_symbol\",\n\t\t\t\t\t\t\t\tsymbols: [],\n\t\t\t\t\t\t\t\tomitted: 0,\n\t\t\t\t\t\t\t\ttruncated: 0,\n\t\t\t\t\t\t\t\toutsideRoot: 0,\n\t\t\t\t\t\t\t\tunsupported: true,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst absolutePath = resolveToCwd(input.path, cwd);\n\t\t\tconst uri = pathToFileURL(absolutePath).href;\n\n\t\t\tif (input.operation === \"document_symbols\") {\n\t\t\t\tconst raw = await operations.request(\n\t\t\t\t\tabsolutePath,\n\t\t\t\t\t\"textDocument/documentSymbol\",\n\t\t\t\t\t{ textDocument: { uri } },\n\t\t\t\t\tsignal,\n\t\t\t\t);\n\t\t\t\tconst relativePath = formatPathRelativeToCwdOrAbsolute(absolutePath, cwd);\n\t\t\t\tconst { symbols, omitted } = flattenSymbols(raw, relativePath);\n\t\t\t\tconst { symbols: capped, truncated } = capSymbols(symbols, MAX_SYMBOLS);\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\", text: formatSymbolsText(capped, omitted, truncated) }],\n\t\t\t\t\tdetails: { operation: \"document_symbols\", symbols: capped, omitted, truncated },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst position = { line: input.line - 1, character: input.character - 1 };\n\t\t\tconst method = input.operation === \"definition\" ? \"textDocument/definition\" : \"textDocument/references\";\n\t\t\tconst params: Record<string, unknown> = { textDocument: { uri }, position };\n\t\t\tif (input.operation === \"references\") params.context = { includeDeclaration: true };\n\t\t\tconst raw = await operations.request(absolutePath, method, params, signal);\n\t\t\tconst { locations, omitted } = normalizeLocations(raw, cwd);\n\t\t\tconst { locations: capped, truncated } = dedupeSortAndCap(locations, MAX_LOCATIONS);\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\", text: formatLocationsText(input.operation, capped, omitted, truncated) }],\n\t\t\t\tdetails: { operation: input.operation, locations: capped, omitted, truncated },\n\t\t\t};\n\t\t},\n\t};\n}\n\nexport function createLspTool(cwd: string, options: LspToolOptions): AgentTool<typeof lspSchema> {\n\treturn wrapToolDefinition(createLspToolDefinition(cwd, options));\n}\n"]}

package/dist/core/tools/path-permission.d.ts

@@ -1,5 +1,6 @@
 /** Shared PermissionSpec construction for the path-shaped tools (read, grep, find, ls, write, edit). */
 import type { Static, TSchema } from "typebox";
+import type { PermissionPreview } from "../permissions/responder.ts";
 import type { PermissionBehavior, PermissionSpec } from "./contract.ts";
 /**
  * Builds a glob-based PermissionSpec over a single path field. `getPath` extracts
@@ -14,5 +15,7 @@ export declare function createPathPermissionSpec<TParams extends TSchema>(option
     defaultBehavior: PermissionBehavior;
     verb: string;
     getPath: (params: Static<TParams>) => string | undefined;
+    /** Describes the change for a human about to approve it. See PermissionSpec.previewCall. */
+    previewCall?: (params: Static<TParams>) => PermissionPreview;
 }): PermissionSpec<TParams>;
 //# sourceMappingURL=path-permission.d.ts.map

package/dist/core/tools/path-permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-permission.d.ts","sourceRoot":"","sources":["../../../src/core/tools/path-permission.ts"],"names":[],"mappings":"AAAA,wGAAwG;AAGxG,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAExE;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,SAAS,OAAO,EAAE,OAAO,EAAE;IAC1E,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,kBAAkB,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;CACzD,GAAG,cAAc,CAAC,OAAO,CAAC,CAkB1B","sourcesContent":["/** Shared PermissionSpec construction for the path-shaped tools (read, grep, find, ls, write, edit). */\n\nimport { minimatch } from \"minimatch\";\nimport type { Static, TSchema } from \"typebox\";\nimport { formatPathRelativeToCwdOrAbsolute } from \"../../utils/paths.ts\";\nimport type { PermissionBehavior, PermissionSpec } from \"./contract.ts\";\n\n/**\n * Builds a glob-based PermissionSpec over a single path field. `getPath` extracts\n * the workspace path a call touches (returning undefined defaults to the tool's own\n * cwd-relative root, e.g. `ls` with no `path` argument). Rule content is a\n * cwd-relative glob; `ruleForCall` returns the exact normalized path of the call, so\n * \"always allow this\" authorizes only that path — never a pattern the tool did not\n * generate itself.\n */\nexport function createPathPermissionSpec<TParams extends TSchema>(options: {\n\tcwd: string;\n\tdefaultBehavior: PermissionBehavior;\n\tverb: string;\n\tgetPath: (params: Static<TParams>) => string | undefined;\n}): PermissionSpec<TParams> {\n\tconst { cwd, defaultBehavior, verb, getPath } = options;\n\n\tconst normalize = (path: string | undefined): string =>\n\t\tformatPathRelativeToCwdOrAbsolute(path?.trim() ? path : \".\", cwd);\n\n\treturn {\n\t\tdefaultBehavior,\n\t\tmatches(ruleContent, params) {\n\t\t\treturn minimatch(normalize(getPath(params)), ruleContent, { dot: true });\n\t\t},\n\t\tdescribe(ruleContent) {\n\t\t\treturn `${verb} paths matching \"${ruleContent}\"`;\n\t\t},\n\t\truleForCall(params) {\n\t\t\treturn normalize(getPath(params));\n\t\t},\n\t};\n}\n"]}
+{"version":3,"file":"path-permission.d.ts","sourceRoot":"","sources":["../../../src/core/tools/path-permission.ts"],"names":[],"mappings":"AAAA,wGAAwG;AAGxG,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAG/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGxE;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,SAAS,OAAO,EAAE,OAAO,EAAE;IAC1E,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,kBAAkB,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;IACzD,4FAA4F;IAC5F,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,iBAAiB,CAAC;CAC7D,GAAG,cAAc,CAAC,OAAO,CAAC,CA2B1B","sourcesContent":["/** Shared PermissionSpec construction for the path-shaped tools (read, grep, find, ls, write, edit). */\n\nimport { minimatch } from \"minimatch\";\nimport type { Static, TSchema } from \"typebox\";\nimport { formatPathRelativeToCwdOrAbsolute } from \"../../utils/paths.ts\";\nimport { setPreparedPathOperation } from \"../permissions/operations.ts\";\nimport type { PermissionPreview } from \"../permissions/responder.ts\";\nimport type { PermissionBehavior, PermissionSpec } from \"./contract.ts\";\nimport { preparePathOperation, resolveToCwd } from \"./path-utils.ts\";\n\n/**\n * Builds a glob-based PermissionSpec over a single path field. `getPath` extracts\n * the workspace path a call touches (returning undefined defaults to the tool's own\n * cwd-relative root, e.g. `ls` with no `path` argument). Rule content is a\n * cwd-relative glob; `ruleForCall` returns the exact normalized path of the call, so\n * \"always allow this\" authorizes only that path — never a pattern the tool did not\n * generate itself.\n */\nexport function createPathPermissionSpec<TParams extends TSchema>(options: {\n\tcwd: string;\n\tdefaultBehavior: PermissionBehavior;\n\tverb: string;\n\tgetPath: (params: Static<TParams>) => string | undefined;\n\t/** Describes the change for a human about to approve it. See PermissionSpec.previewCall. */\n\tpreviewCall?: (params: Static<TParams>) => PermissionPreview;\n}): PermissionSpec<TParams> {\n\tconst { cwd, defaultBehavior, verb, getPath, previewCall } = options;\n\n\tconst normalize = (path: string | undefined): string => {\n\t\tconst canonical = resolveToCwd(path?.trim() ? path : \".\", cwd);\n\t\treturn formatPathRelativeToCwdOrAbsolute(canonical, cwd);\n\t};\n\tconst escapeExact = (value: string): string => `exact:${value}`;\n\n\treturn {\n\t\tdefaultBehavior,\n\t\tprepareCall(params) {\n\t\t\tsetPreparedPathOperation(params as object, preparePathOperation(getPath(params) ?? \".\", cwd));\n\t\t},\n\t\t...(previewCall ? { previewCall } : {}),\n\t\tmatches(ruleContent, params) {\n\t\t\treturn ruleContent.startsWith(\"exact:\")\n\t\t\t\t? normalize(getPath(params)) === ruleContent.slice(\"exact:\".length)\n\t\t\t\t: minimatch(normalize(getPath(params)), ruleContent, { dot: true });\n\t\t},\n\t\tdescribe(ruleContent) {\n\t\t\treturn `${verb} paths matching \"${ruleContent}\"`;\n\t\t},\n\t\truleForCall(params) {\n\t\t\treturn escapeExact(normalize(getPath(params)));\n\t\t},\n\t};\n}\n"]}

package/dist/core/tools/path-permission.js

@@ -1,6 +1,8 @@
 /** Shared PermissionSpec construction for the path-shaped tools (read, grep, find, ls, write, edit). */
 import { minimatch } from "minimatch";
 import { formatPathRelativeToCwdOrAbsolute } from "../../utils/paths.js";
+import { setPreparedPathOperation } from "../permissions/operations.js";
+import { preparePathOperation, resolveToCwd } from "./path-utils.js";
 /**
  * Builds a glob-based PermissionSpec over a single path field. `getPath` extracts
  * the workspace path a call touches (returning undefined defaults to the tool's own
@@ -10,18 +12,28 @@ import { formatPathRelativeToCwdOrAbsolute } from "../../utils/paths.js";
  * generate itself.
  */
 export function createPathPermissionSpec(options) {
-    const { cwd, defaultBehavior, verb, getPath } = options;
-    const normalize = (path) => formatPathRelativeToCwdOrAbsolute(path?.trim() ? path : ".", cwd);
+    const { cwd, defaultBehavior, verb, getPath, previewCall } = options;
+    const normalize = (path) => {
+        const canonical = resolveToCwd(path?.trim() ? path : ".", cwd);
+        return formatPathRelativeToCwdOrAbsolute(canonical, cwd);
+    };
+    const escapeExact = (value) => `exact:${value}`;
     return {
         defaultBehavior,
+        prepareCall(params) {
+            setPreparedPathOperation(params, preparePathOperation(getPath(params) ?? ".", cwd));
+        },
+        ...(previewCall ? { previewCall } : {}),
         matches(ruleContent, params) {
-            return minimatch(normalize(getPath(params)), ruleContent, { dot: true });
+            return ruleContent.startsWith("exact:")
+                ? normalize(getPath(params)) === ruleContent.slice("exact:".length)
+                : minimatch(normalize(getPath(params)), ruleContent, { dot: true });
         },
         describe(ruleContent) {
             return `${verb} paths matching "${ruleContent}"`;
         },
         ruleForCall(params) {
-            return normalize(getPath(params));
+            return escapeExact(normalize(getPath(params)));
         },
     };
 }

package/dist/core/tools/path-permission.js.map

@@ -1 +1 @@
-{"version":3,"file":"path-permission.js","sourceRoot":"","sources":["../../../src/core/tools/path-permission.ts"],"names":[],"mappings":"AAAA,wGAAwG;AAExG,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAC;AAGzE;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAA0B,OAKjE,EAA2B;IAC3B,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAExD,MAAM,SAAS,GAAG,CAAC,IAAwB,EAAU,EAAE,CACtD,iCAAiC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEnE,OAAO;QACN,eAAe;QACf,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE;YAC5B,OAAO,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAAA,CACzE;QACD,QAAQ,CAAC,WAAW,EAAE;YACrB,OAAO,GAAG,IAAI,oBAAoB,WAAW,GAAG,CAAC;QAAA,CACjD;QACD,WAAW,CAAC,MAAM,EAAE;YACnB,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAAA,CAClC;KACD,CAAC;AAAA,CACF","sourcesContent":["/** Shared PermissionSpec construction for the path-shaped tools (read, grep, find, ls, write, edit). */\n\nimport { minimatch } from \"minimatch\";\nimport type { Static, TSchema } from \"typebox\";\nimport { formatPathRelativeToCwdOrAbsolute } from \"../../utils/paths.ts\";\nimport type { PermissionBehavior, PermissionSpec } from \"./contract.ts\";\n\n/**\n * Builds a glob-based PermissionSpec over a single path field. `getPath` extracts\n * the workspace path a call touches (returning undefined defaults to the tool's own\n * cwd-relative root, e.g. `ls` with no `path` argument). Rule content is a\n * cwd-relative glob; `ruleForCall` returns the exact normalized path of the call, so\n * \"always allow this\" authorizes only that path — never a pattern the tool did not\n * generate itself.\n */\nexport function createPathPermissionSpec<TParams extends TSchema>(options: {\n\tcwd: string;\n\tdefaultBehavior: PermissionBehavior;\n\tverb: string;\n\tgetPath: (params: Static<TParams>) => string | undefined;\n}): PermissionSpec<TParams> {\n\tconst { cwd, defaultBehavior, verb, getPath } = options;\n\n\tconst normalize = (path: string | undefined): string =>\n\t\tformatPathRelativeToCwdOrAbsolute(path?.trim() ? path : \".\", cwd);\n\n\treturn {\n\t\tdefaultBehavior,\n\t\tmatches(ruleContent, params) {\n\t\t\treturn minimatch(normalize(getPath(params)), ruleContent, { dot: true });\n\t\t},\n\t\tdescribe(ruleContent) {\n\t\t\treturn `${verb} paths matching \"${ruleContent}\"`;\n\t\t},\n\t\truleForCall(params) {\n\t\t\treturn normalize(getPath(params));\n\t\t},\n\t};\n}\n"]}
+{"version":3,"file":"path-permission.js","sourceRoot":"","sources":["../../../src/core/tools/path-permission.ts"],"names":[],"mappings":"AAAA,wGAAwG;AAExG,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAGxE,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAErE;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAA0B,OAOjE,EAA2B;IAC3B,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAErE,MAAM,SAAS,GAAG,CAAC,IAAwB,EAAU,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAAA,CACzD,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,SAAS,KAAK,EAAE,CAAC;IAEhE,OAAO;QACN,eAAe;QACf,WAAW,CAAC,MAAM,EAAE;YACnB,wBAAwB,CAAC,MAAgB,EAAE,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAAA,CAC9F;QACD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE;YAC5B,OAAO,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACtC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAAA,CACrE;QACD,QAAQ,CAAC,WAAW,EAAE;YACrB,OAAO,GAAG,IAAI,oBAAoB,WAAW,GAAG,CAAC;QAAA,CACjD;QACD,WAAW,CAAC,MAAM,EAAE;YACnB,OAAO,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAAA,CAC/C;KACD,CAAC;AAAA,CACF","sourcesContent":["/** Shared PermissionSpec construction for the path-shaped tools (read, grep, find, ls, write, edit). */\n\nimport { minimatch } from \"minimatch\";\nimport type { Static, TSchema } from \"typebox\";\nimport { formatPathRelativeToCwdOrAbsolute } from \"../../utils/paths.ts\";\nimport { setPreparedPathOperation } from \"../permissions/operations.ts\";\nimport type { PermissionPreview } from \"../permissions/responder.ts\";\nimport type { PermissionBehavior, PermissionSpec } from \"./contract.ts\";\nimport { preparePathOperation, resolveToCwd } from \"./path-utils.ts\";\n\n/**\n * Builds a glob-based PermissionSpec over a single path field. `getPath` extracts\n * the workspace path a call touches (returning undefined defaults to the tool's own\n * cwd-relative root, e.g. `ls` with no `path` argument). Rule content is a\n * cwd-relative glob; `ruleForCall` returns the exact normalized path of the call, so\n * \"always allow this\" authorizes only that path — never a pattern the tool did not\n * generate itself.\n */\nexport function createPathPermissionSpec<TParams extends TSchema>(options: {\n\tcwd: string;\n\tdefaultBehavior: PermissionBehavior;\n\tverb: string;\n\tgetPath: (params: Static<TParams>) => string | undefined;\n\t/** Describes the change for a human about to approve it. See PermissionSpec.previewCall. */\n\tpreviewCall?: (params: Static<TParams>) => PermissionPreview;\n}): PermissionSpec<TParams> {\n\tconst { cwd, defaultBehavior, verb, getPath, previewCall } = options;\n\n\tconst normalize = (path: string | undefined): string => {\n\t\tconst canonical = resolveToCwd(path?.trim() ? path : \".\", cwd);\n\t\treturn formatPathRelativeToCwdOrAbsolute(canonical, cwd);\n\t};\n\tconst escapeExact = (value: string): string => `exact:${value}`;\n\n\treturn {\n\t\tdefaultBehavior,\n\t\tprepareCall(params) {\n\t\t\tsetPreparedPathOperation(params as object, preparePathOperation(getPath(params) ?? \".\", cwd));\n\t\t},\n\t\t...(previewCall ? { previewCall } : {}),\n\t\tmatches(ruleContent, params) {\n\t\t\treturn ruleContent.startsWith(\"exact:\")\n\t\t\t\t? normalize(getPath(params)) === ruleContent.slice(\"exact:\".length)\n\t\t\t\t: minimatch(normalize(getPath(params)), ruleContent, { dot: true });\n\t\t},\n\t\tdescribe(ruleContent) {\n\t\t\treturn `${verb} paths matching \"${ruleContent}\"`;\n\t\t},\n\t\truleForCall(params) {\n\t\t\treturn escapeExact(normalize(getPath(params)));\n\t\t},\n\t};\n}\n"]}

package/dist/core/tools/path-utils.d.ts

@@ -1,8 +1,33 @@
+import type { PreparedPathOperation } from "../permissions/operations.ts";
+export declare function preparePathOperation(filePath: string, cwd: string): PreparedPathOperation;
+/**
+ * Read the authorized target through a no-follow final-component open, verifying
+ * the descriptor identity captured at authorization before any byte is returned.
+ * A replaced alias or an injected symlink never matches and the read aborts.
+ */
+export declare function readPreparedPath(operation: PreparedPathOperation, maxBytes?: number): Buffer;
+/** The authorized target changed between permission evaluation and execution. */
+export declare class PreparedTargetChangedError extends Error {
+}
+/**
+ * Execute an authorized write against the prepared target.
+ *
+ * - `path-existing`: the final component is opened `O_NOFOLLOW`, its descriptor
+ *   identity is compared with the identity captured at authorization, and only
+ *   then is the file truncated and written through that descriptor. A swapped
+ *   alias, an injected symlink, or a redirected parent never matches and the
+ *   write aborts before any byte changes.
+ * - `path-new`: missing parents are created no-follow under the walked directory
+ *   descriptor, and the file is created `O_CREAT | O_EXCL | O_NOFOLLOW`, so a
+ *   replaced parent or a pre-placed symlink is never followed.
+ */
+export declare function writePreparedPath(operation: PreparedPathOperation, content: string | Buffer): void;
 export declare function pathExists(filePath: string): Promise<boolean>;
 export declare function expandPath(filePath: string): string;
 /**
- * Resolve a path relative to the given cwd.
- * Handles ~ expansion and absolute paths.
+ * Resolve a path relative to the given cwd, handling ~ expansion and absolute
+ * paths. The result is the single target used by both permission matching and
+ * filesystem execution.
  */
 export declare function resolveToCwd(filePath: string, cwd: string): string;
 export declare function resolveReadPath(filePath: string, cwd: string): string;

package/dist/core/tools/path-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../../../src/core/tools/path-utils.ts"],"names":[],"mappings":"AA8BA,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOnE;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAgCrE;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgCzF","sourcesContent":["import { accessSync, constants } from \"node:fs\";\nimport { access } from \"node:fs/promises\";\nimport { normalizePath, resolvePath } from \"../../utils/paths.ts\";\n\nconst NARROW_NO_BREAK_SPACE = \"\\u202F\";\n\nfunction tryMacOSScreenshotPath(filePath: string): string {\n\treturn filePath.replace(/ (AM|PM)\\./gi, `${NARROW_NO_BREAK_SPACE}$1.`);\n}\n\nfunction tryNFDVariant(filePath: string): string {\n\t// macOS stores filenames in NFD (decomposed) form, try converting user input to NFD\n\treturn filePath.normalize(\"NFD\");\n}\n\nfunction tryCurlyQuoteVariant(filePath: string): string {\n\t// macOS uses U+2019 (right single quotation mark) in screenshot names like \"Capture d'écran\"\n\t// Users typically type U+0027 (straight apostrophe)\n\treturn filePath.replace(/'/g, \"\\u2019\");\n}\n\nfunction fileExists(filePath: string): boolean {\n\ttry {\n\t\taccessSync(filePath, constants.F_OK);\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nexport async function pathExists(filePath: string): Promise<boolean> {\n\ttry {\n\t\tawait access(filePath, constants.F_OK);\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nexport function expandPath(filePath: string): string {\n\treturn normalizePath(filePath, { normalizeUnicodeSpaces: true, stripAtPrefix: true });\n}\n\n/**\n * Resolve a path relative to the given cwd.\n * Handles ~ expansion and absolute paths.\n */\nexport function resolveToCwd(filePath: string, cwd: string): string {\n\treturn resolvePath(filePath, cwd, { normalizeUnicodeSpaces: true, stripAtPrefix: true });\n}\n\nexport function resolveReadPath(filePath: string, cwd: string): string {\n\tconst resolved = resolveToCwd(filePath, cwd);\n\n\tif (fileExists(resolved)) {\n\t\treturn resolved;\n\t}\n\n\t// Try macOS AM/PM variant (narrow no-break space before AM/PM)\n\tconst amPmVariant = tryMacOSScreenshotPath(resolved);\n\tif (amPmVariant !== resolved && fileExists(amPmVariant)) {\n\t\treturn amPmVariant;\n\t}\n\n\t// Try NFD variant (macOS stores filenames in NFD form)\n\tconst nfdVariant = tryNFDVariant(resolved);\n\tif (nfdVariant !== resolved && fileExists(nfdVariant)) {\n\t\treturn nfdVariant;\n\t}\n\n\t// Try curly quote variant (macOS uses U+2019 in screenshot names)\n\tconst curlyVariant = tryCurlyQuoteVariant(resolved);\n\tif (curlyVariant !== resolved && fileExists(curlyVariant)) {\n\t\treturn curlyVariant;\n\t}\n\n\t// Try combined NFD + curly quote (for French macOS screenshots like \"Capture d'écran\")\n\tconst nfdCurlyVariant = tryCurlyQuoteVariant(nfdVariant);\n\tif (nfdCurlyVariant !== resolved && fileExists(nfdCurlyVariant)) {\n\t\treturn nfdCurlyVariant;\n\t}\n\n\treturn resolved;\n}\n\nexport async function resolveReadPathAsync(filePath: string, cwd: string): Promise<string> {\n\tconst resolved = resolveToCwd(filePath, cwd);\n\n\tif (await pathExists(resolved)) {\n\t\treturn resolved;\n\t}\n\n\t// Try macOS AM/PM variant (narrow no-break space before AM/PM)\n\tconst amPmVariant = tryMacOSScreenshotPath(resolved);\n\tif (amPmVariant !== resolved && (await pathExists(amPmVariant))) {\n\t\treturn amPmVariant;\n\t}\n\n\t// Try NFD variant (macOS stores filenames in NFD form)\n\tconst nfdVariant = tryNFDVariant(resolved);\n\tif (nfdVariant !== resolved && (await pathExists(nfdVariant))) {\n\t\treturn nfdVariant;\n\t}\n\n\t// Try curly quote variant (macOS uses U+2019 in screenshot names)\n\tconst curlyVariant = tryCurlyQuoteVariant(resolved);\n\tif (curlyVariant !== resolved && (await pathExists(curlyVariant))) {\n\t\treturn curlyVariant;\n\t}\n\n\t// Try combined NFD + curly quote (for French macOS screenshots like \"Capture d'écran\")\n\tconst nfdCurlyVariant = tryCurlyQuoteVariant(nfdVariant);\n\tif (nfdCurlyVariant !== resolved && (await pathExists(nfdCurlyVariant))) {\n\t\treturn nfdCurlyVariant;\n\t}\n\n\treturn resolved;\n}\n"]}
+{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../../../src/core/tools/path-utils.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAI1E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,qBAAqB,CAazF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,qBAAqB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CA6B5F;AAED,iFAAiF;AACjF,qBAAa,0BAA2B,SAAQ,KAAK;CAAG;AA2GxD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsClG;AA0BD,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOnE;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAWlE;AAMD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAgCrE;AAED,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgCzF","sourcesContent":["import {\n\taccessSync,\n\tcloseSync,\n\tconstants,\n\texistsSync,\n\tfstatSync,\n\tftruncateSync,\n\tmkdirSync,\n\topenSync,\n\treadSync,\n\trealpathSync,\n\tstatSync,\n\twriteSync,\n} from \"node:fs\";\nimport { access } from \"node:fs/promises\";\nimport { basename, dirname, isAbsolute, join, parse, sep } from \"node:path\";\nimport { normalizePath, resolvePath } from \"../../utils/paths.ts\";\nimport type { PreparedPathOperation } from \"../permissions/operations.ts\";\n\nconst NARROW_NO_BREAK_SPACE = \"\\u202F\";\n\nexport function preparePathOperation(filePath: string, cwd: string): PreparedPathOperation {\n\tconst canonicalPath = resolveToCwd(filePath, cwd);\n\tif (!isAbsolute(canonicalPath)) throw new Error(\"Canonical path must be absolute\");\n\ttry {\n\t\tconst stats = statSync(canonicalPath);\n\t\treturn {\n\t\t\tkind: \"path-existing\",\n\t\t\tpath: { kind: \"canonical-path\", value: canonicalPath },\n\t\t\tidentity: { device: stats.dev, inode: stats.ino },\n\t\t};\n\t} catch {\n\t\treturn { kind: \"path-new\", path: { kind: \"canonical-path\", value: canonicalPath } };\n\t}\n}\n\n/**\n * Read the authorized target through a no-follow final-component open, verifying\n * the descriptor identity captured at authorization before any byte is returned.\n * A replaced alias or an injected symlink never matches and the read aborts.\n */\nexport function readPreparedPath(operation: PreparedPathOperation, maxBytes?: number): Buffer {\n\tif (operation.kind !== \"path-existing\") {\n\t\tthrow new PreparedTargetChangedError(\"Authorized read target did not exist when permission was checked\");\n\t}\n\treturn withTargetDirectory(operation, { createMissingDirectories: false }, (parent, name) => {\n\t\tlet fd: number;\n\t\ttry {\n\t\t\tfd = openUnder(parent, name, constants.O_RDONLY | constants.O_NOFOLLOW);\n\t\t} catch (error) {\n\t\t\tthrow new PreparedTargetChangedError(\"Authorized read target changed before execution\", { cause: error });\n\t\t}\n\t\ttry {\n\t\t\tconst stats = fstatSync(fd);\n\t\t\tif (stats.dev !== operation.identity.device || stats.ino !== operation.identity.inode) {\n\t\t\t\tthrow new PreparedTargetChangedError(\"Authorized read target changed before execution\");\n\t\t\t}\n\t\t\tconst length = maxBytes === undefined ? stats.size : Math.min(stats.size, maxBytes);\n\t\t\tconst buffer = Buffer.alloc(length);\n\t\t\tlet offset = 0;\n\t\t\twhile (offset < buffer.length) {\n\t\t\t\tconst read = readSync(fd, buffer, offset, buffer.length - offset, null);\n\t\t\t\tif (read === 0) break;\n\t\t\t\toffset += read;\n\t\t\t}\n\t\t\treturn offset === buffer.length ? buffer : buffer.subarray(0, offset);\n\t\t} finally {\n\t\t\tcloseSync(fd);\n\t\t}\n\t});\n}\n\n/** The authorized target changed between permission evaluation and execution. */\nexport class PreparedTargetChangedError extends Error {}\n\nconst PROC_FD = \"/proc/self/fd\";\nlet procFdAvailable: boolean | undefined;\n\n/** /proc lets an already-open directory fd act as the parent of the next open, so a swapped intermediate directory cannot be traversed. */\nfunction useProcFd(): boolean {\n\tif (procFdAvailable === undefined) {\n\t\ttry {\n\t\t\tprocFdAvailable = existsSync(`${PROC_FD}/self`);\n\t\t} catch {\n\t\t\tprocFdAvailable = false;\n\t\t}\n\t}\n\treturn procFdAvailable;\n}\n\ninterface OpenDirectory {\n\tfd: number;\n\t/** Fallback parent path for platforms without /proc/self/fd. */\n\tpath: string;\n}\n\nfunction openUnder(parent: OpenDirectory, name: string, flags: number, mode?: number): number {\n\tif (useProcFd()) return openSync(`${PROC_FD}/${parent.fd}/${name}`, flags, mode);\n\treturn openSync(join(parent.path, name), flags, mode);\n}\n\nfunction mkdirUnder(parent: OpenDirectory, name: string): void {\n\tif (useProcFd()) mkdirSync(`${PROC_FD}/${parent.fd}/${name}`);\n\telse mkdirSync(join(parent.path, name));\n}\n\nfunction openChildDirectory(parent: OpenDirectory, name: string): OpenDirectory {\n\tconst flags = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;\n\tconst fd = openUnder(parent, name, flags);\n\tcloseSync(parent.fd);\n\treturn { fd, path: join(parent.path, name) };\n}\n\nfunction writeAll(fd: number, content: string | Buffer): void {\n\tconst buffer = typeof content === \"string\" ? Buffer.from(content, \"utf-8\") : content;\n\tlet written = 0;\n\twhile (written < buffer.length) {\n\t\twritten += writeSync(fd, buffer, written, buffer.length - written);\n\t}\n}\n\nfunction isMissingEntryError(error: unknown): boolean {\n\treturn (\n\t\ttypeof error === \"object\" && error !== null && \"code\" in error && (error as { code?: unknown }).code === \"ENOENT\"\n\t);\n}\n\n/**\n * Walk every directory component of the authorized path no-follow, holding one\n * directory fd across the walk, then run the caller's final-component step against\n * that walked parent. Any intermediate that is not a real directory — a swapped\n * symlink, a removed component — aborts before the target is touched.\n */\nfunction withTargetDirectory<T>(\n\toperation: PreparedPathOperation,\n\toptions: { createMissingDirectories: boolean },\n\trun: (parent: OpenDirectory, name: string) => T,\n): T {\n\tconst root = parse(operation.path.value).root;\n\tconst components = operation.path.value\n\t\t.slice(root.length)\n\t\t.split(sep)\n\t\t.filter((component) => component.length > 0);\n\tconst name = components[components.length - 1];\n\tif (name === undefined) throw new PreparedTargetChangedError(\"Authorized path has no final component\");\n\tlet parent: OpenDirectory = { fd: openSync(root, constants.O_RDONLY | constants.O_DIRECTORY), path: root };\n\tconst closeParent = (): void => {\n\t\ttry {\n\t\t\tcloseSync(parent.fd);\n\t\t} catch {}\n\t};\n\tfor (const component of components.slice(0, -1)) {\n\t\ttry {\n\t\t\tparent = openChildDirectory(parent, component);\n\t\t} catch (error) {\n\t\t\tif (options.createMissingDirectories && isMissingEntryError(error)) {\n\t\t\t\ttry {\n\t\t\t\t\tmkdirUnder(parent, component);\n\t\t\t\t\tparent = openChildDirectory(parent, component);\n\t\t\t\t\tcontinue;\n\t\t\t\t} catch (mkdirError) {\n\t\t\t\t\tcloseParent();\n\t\t\t\t\tthrow new PreparedTargetChangedError(`Authorized write parent \"${component}\" changed before execution`, {\n\t\t\t\t\t\tcause: mkdirError,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t\tcloseParent();\n\t\t\tthrow new PreparedTargetChangedError(`Authorized path component \"${component}\" changed before execution`, {\n\t\t\t\tcause: error,\n\t\t\t});\n\t\t}\n\t}\n\ttry {\n\t\treturn run(parent, name);\n\t} finally {\n\t\tcloseParent();\n\t}\n}\n\n/**\n * Execute an authorized write against the prepared target.\n *\n * - `path-existing`: the final component is opened `O_NOFOLLOW`, its descriptor\n *   identity is compared with the identity captured at authorization, and only\n *   then is the file truncated and written through that descriptor. A swapped\n *   alias, an injected symlink, or a redirected parent never matches and the\n *   write aborts before any byte changes.\n * - `path-new`: missing parents are created no-follow under the walked directory\n *   descriptor, and the file is created `O_CREAT | O_EXCL | O_NOFOLLOW`, so a\n *   replaced parent or a pre-placed symlink is never followed.\n */\nexport function writePreparedPath(operation: PreparedPathOperation, content: string | Buffer): void {\n\twithTargetDirectory(operation, { createMissingDirectories: operation.kind === \"path-new\" }, (parent, name) => {\n\t\tif (operation.kind === \"path-existing\") {\n\t\t\tlet fd: number;\n\t\t\ttry {\n\t\t\t\tfd = openUnder(parent, name, constants.O_WRONLY | constants.O_NOFOLLOW);\n\t\t\t} catch (error) {\n\t\t\t\tthrow new PreparedTargetChangedError(\"Authorized write target changed before execution\", { cause: error });\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst stats = fstatSync(fd);\n\t\t\t\tif (stats.dev !== operation.identity.device || stats.ino !== operation.identity.inode) {\n\t\t\t\t\tthrow new PreparedTargetChangedError(\"Authorized write target changed before execution\");\n\t\t\t\t}\n\t\t\t\tftruncateSync(fd, 0);\n\t\t\t\twriteAll(fd, content);\n\t\t\t} finally {\n\t\t\t\tcloseSync(fd);\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tlet fd: number;\n\t\ttry {\n\t\t\tfd = openUnder(\n\t\t\t\tparent,\n\t\t\t\tname,\n\t\t\t\tconstants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,\n\t\t\t\t0o600,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tthrow new PreparedTargetChangedError(\"Authorized new-file target changed before execution\", { cause: error });\n\t\t}\n\t\ttry {\n\t\t\twriteAll(fd, content);\n\t\t} finally {\n\t\t\tcloseSync(fd);\n\t\t}\n\t});\n}\n\nfunction tryMacOSScreenshotPath(filePath: string): string {\n\treturn filePath.replace(/ (AM|PM)\\./gi, `${NARROW_NO_BREAK_SPACE}$1.`);\n}\n\nfunction tryNFDVariant(filePath: string): string {\n\t// macOS stores filenames in NFD (decomposed) form, try converting user input to NFD\n\treturn filePath.normalize(\"NFD\");\n}\n\nfunction tryCurlyQuoteVariant(filePath: string): string {\n\t// macOS uses U+2019 (right single quotation mark) in screenshot names like \"Capture d'écran\"\n\t// Users typically type U+0027 (straight apostrophe)\n\treturn filePath.replace(/'/g, \"\\u2019\");\n}\n\nfunction fileExists(filePath: string): boolean {\n\ttry {\n\t\taccessSync(filePath, constants.F_OK);\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nexport async function pathExists(filePath: string): Promise<boolean> {\n\ttry {\n\t\tawait access(filePath, constants.F_OK);\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nexport function expandPath(filePath: string): string {\n\treturn normalizePath(filePath, { normalizeUnicodeSpaces: true, stripAtPrefix: true });\n}\n\n/**\n * Resolve a path relative to the given cwd, handling ~ expansion and absolute\n * paths. The result is the single target used by both permission matching and\n * filesystem execution.\n */\nexport function resolveToCwd(filePath: string, cwd: string): string {\n\tconst requested = resolvePath(filePath, cwd, { normalizeUnicodeSpaces: true, stripAtPrefix: true });\n\ttry {\n\t\treturn realpathSync(requested);\n\t} catch {\n\t\ttry {\n\t\t\treturn joinCanonicalParent(requested);\n\t\t} catch {\n\t\t\treturn requested;\n\t\t}\n\t}\n}\n\nfunction joinCanonicalParent(requested: string): string {\n\treturn join(realpathSync(dirname(requested)), basename(requested));\n}\n\nexport function resolveReadPath(filePath: string, cwd: string): string {\n\tconst resolved = resolveToCwd(filePath, cwd);\n\n\tif (fileExists(resolved)) {\n\t\treturn resolved;\n\t}\n\n\t// Try macOS AM/PM variant (narrow no-break space before AM/PM)\n\tconst amPmVariant = tryMacOSScreenshotPath(resolved);\n\tif (amPmVariant !== resolved && fileExists(amPmVariant)) {\n\t\treturn amPmVariant;\n\t}\n\n\t// Try NFD variant (macOS stores filenames in NFD form)\n\tconst nfdVariant = tryNFDVariant(resolved);\n\tif (nfdVariant !== resolved && fileExists(nfdVariant)) {\n\t\treturn nfdVariant;\n\t}\n\n\t// Try curly quote variant (macOS uses U+2019 in screenshot names)\n\tconst curlyVariant = tryCurlyQuoteVariant(resolved);\n\tif (curlyVariant !== resolved && fileExists(curlyVariant)) {\n\t\treturn curlyVariant;\n\t}\n\n\t// Try combined NFD + curly quote (for French macOS screenshots like \"Capture d'écran\")\n\tconst nfdCurlyVariant = tryCurlyQuoteVariant(nfdVariant);\n\tif (nfdCurlyVariant !== resolved && fileExists(nfdCurlyVariant)) {\n\t\treturn nfdCurlyVariant;\n\t}\n\n\treturn resolved;\n}\n\nexport async function resolveReadPathAsync(filePath: string, cwd: string): Promise<string> {\n\tconst resolved = resolveToCwd(filePath, cwd);\n\n\tif (await pathExists(resolved)) {\n\t\treturn resolved;\n\t}\n\n\t// Try macOS AM/PM variant (narrow no-break space before AM/PM)\n\tconst amPmVariant = tryMacOSScreenshotPath(resolved);\n\tif (amPmVariant !== resolved && (await pathExists(amPmVariant))) {\n\t\treturn amPmVariant;\n\t}\n\n\t// Try NFD variant (macOS stores filenames in NFD form)\n\tconst nfdVariant = tryNFDVariant(resolved);\n\tif (nfdVariant !== resolved && (await pathExists(nfdVariant))) {\n\t\treturn nfdVariant;\n\t}\n\n\t// Try curly quote variant (macOS uses U+2019 in screenshot names)\n\tconst curlyVariant = tryCurlyQuoteVariant(resolved);\n\tif (curlyVariant !== resolved && (await pathExists(curlyVariant))) {\n\t\treturn curlyVariant;\n\t}\n\n\t// Try combined NFD + curly quote (for French macOS screenshots like \"Capture d'écran\")\n\tconst nfdCurlyVariant = tryCurlyQuoteVariant(nfdVariant);\n\tif (nfdCurlyVariant !== resolved && (await pathExists(nfdCurlyVariant))) {\n\t\treturn nfdCurlyVariant;\n\t}\n\n\treturn resolved;\n}\n"]}