commandmate 0.19.0 → 0.21.0

package/dist/server/src/lib/tasks/contract-parser.js

@@ -69,7 +69,12 @@ const TOP_LEVEL_KEYS = ['version', 'title', 'goal', 'scope', 'verify', 'autoYes'
 const SCOPE_KEYS = ['allow', 'deny'];
 const VERIFY_KEYS = ['gates'];
 const AUTO_YES_KEYS = ['mode', 'allowPromptTypes', 'denyPatterns'];
-const SUCCESS_KEYS = ['requireWorkEvidence', 'requireScopeClean', 'autoVerifyOnStop'];
+const SUCCESS_KEYS = [
+    'requireWorkEvidence',
+    'requireScopeClean',
+    'requireCommit',
+    'autoVerifyOnStop',
+];
 /** Mirrors GATE_ID_PATTERN in verify-config.ts: a contract can only name ids that could exist. */
 const GATE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,31}$/;
 class TaskContractError extends Error {
@@ -276,6 +281,7 @@ function validateSuccess(value, issues) {
     const success = {
         requireWorkEvidence: true,
         requireScopeClean: true,
+        requireCommit: false,
         autoVerifyOnStop: false,
     };
     if (value === undefined || value === null)
@@ -348,6 +354,16 @@ function parseTaskContract(raw, sourceLabel) {
     if (success.requireScopeClean && scope.allow.length === 0) {
         issues.push('scope.allow: at least one pattern is required while success.requireScopeClean is true');
     }
+    // Same discipline, and the same failure it prevents: the commit requirement is
+    // judged by the work-evidence gate, and `requireWorkEvidence: false` keeps that
+    // gate out of the contract's selection entirely. Accepting the pair would put
+    // "必ず commit" in the preamble with nothing behind it — the exact D-4 defect
+    // this field exists to close.
+    if (success.requireCommit && !success.requireWorkEvidence) {
+        issues.push('success.requireCommit: requires success.requireWorkEvidence to be true ' +
+            '(the commit requirement is judged by the work-evidence gate, which ' +
+            'requireWorkEvidence: false switches off)');
+    }
     if (issues.length > 0)
         throw new TaskContractError(issues);
     return { version: 1, title, goal, scope, verify, autoYes, success };

package/dist/server/src/lib/tasks/task-state-machine.js

@@ -54,8 +54,30 @@ function transitionTask(current, event) {
             switch (event) {
                 case 'message_sent':
                     return 'running';
+                // Issue #1637: a contract whose very first send never landed is
+                // `cancelled`, not `failed`. The row stays — the audit trail is the
+                // `task_events` entry recording `send_failed` from `pending`, which
+                // says precisely what happened — but the status has to keep the row out
+                // of later contract resolution, and `failed` cannot do that.
+                //
+                // `failed` is deliberately re-openable: VERIFIABLE_TASK_STATUSES
+                // (src/lib/db/tasks-db.ts) includes it so an agent that retries after a
+                // red gate finds its contract again (#1620). A task nothing was ever
+                // sent for has no work to re-judge, yet it is the *most recently
+                // updated* verifiable row, so `getVerifiableTask` hands it to any later
+                // run that has to discover its own task. In #1623 that is exactly what
+                // happened: a send that failed on a cold start left `cbb7fe71`, the
+                // re-send created `88280de0` which finished `succeeded` — and
+                // `succeeded` is excluded from resolution while the orphan was not, so
+                // the orchestrator's `wait --verify` judged the worktree against the
+                // orphan's *older* scope snapshot and returned exit 20 for paths the
+                // current contract allows.
+                //
+                // `cancelled` is in neither ACTIVE_TASK_STATUSES nor
+                // VERIFIABLE_TASK_STATUSES, so it closes that path at the only point
+                // this layer controls: the status the event writes.
                 case 'send_failed':
-                    return 'failed';
+                    return 'cancelled';
                 case 'cancel':
                     return 'cancelled';
                 case 'prompt_detected':

package/dist/server/src/lib/tmux/control-mode-tmux-transport.js

@@ -69,6 +69,13 @@ class ControlModeTmuxTransport {
     getSubscriberCount(sessionName) {
         return this.registry.getSubscriberCount(sessionName);
     }
+    /**
+     * Re-file a live control-mode attach after the tmux session was renamed
+     * (Issue #1621 Phase 3). See TmuxControlRegistry.renameSession.
+     */
+    renameSession(oldName, newName) {
+        return this.registry.renameSession(oldName, newName);
+    }
     async killSession(sessionName) {
         return (0, tmux_1.killSession)(sessionName);
     }

package/dist/server/src/lib/tmux/read-mode.js

@@ -24,6 +24,11 @@
  *    already bound to something that is not ours is left ALONE. The Issue's claim
  *    that `prefix+g` is unbound on stock tmux 3.5a is true here, but says nothing
  *    about a user's own `.tmux.conf`.
+ *    ORDER IS LOAD-BEARING: guard 1 runs first, and must keep doing so. On tmux
+ *    3.0 and older `list-keys` takes no key argument either (`usage: list-keys
+ *    [-T key-table]`, measured in #1641), so this check degrades to "the key is
+ *    always free" there. It is harmless only because those versions never reach
+ *    it — guard 1 has already returned `unsupported-tmux`.
  * 3. **Session-name guard.** The binding fires `if-shell -F '#{m:mcbd-*,...}'`, so
  *    pressing the key in a non-CommandMate session does nothing (measured: the
  *    format yields 1 for `mcbd-*` sessions and 0 for everything else).
@@ -142,8 +147,23 @@ function buildBindKeyArgs(key, quotedScriptPath) {
 /**
  * Whether this tmux understands `display-popup` (3.2+).
  *
- * Probes on OUTPUT, not exit status: measured on 3.5a, `list-commands` exits 0
- * for an unknown command name and simply prints nothing.
+ * Probes on OUTPUT, not exit status. Measured against real binaries in
+ * containers (Issue #1641; harness: `scripts/verify-legacy-tmux-readmode.sh`):
+ *
+ * | tmux | `list-commands display-popup` | verdict |
+ * |---|---|---|
+ * | 2.8 / 3.0a | exit 1, `usage: list-commands [-F format]` | false |
+ * | 3.1c | exit 0, EMPTY stdout | false |
+ * | 3.3a / 3.5a | exit 0, the command's help line | true |
+ *
+ * Two different reasons produce the same right answer, and only the output test
+ * covers both: an exit-code probe calls 3.1c capable, and a stderr probe calls
+ * 3.3a incapable.
+ *
+ * NOT a general-purpose capability prober. On tmux 3.0 and older `list-commands`
+ * takes no command argument at all, so it answers `usage:` for names that tmux
+ * DOES support — reusing this shape for a command that predates 3.1 would report
+ * a false negative on every old tmux.
  */
 async function supportsDisplayPopup() {
     try {

package/dist/server/src/lib/tmux/tmux-capture-cache.js

@@ -20,6 +20,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CACHE_MAX_CAPTURE_LINES = exports.CACHE_MAX_ENTRIES = exports.CACHE_TTL_MS = void 0;
+exports.isCaptureWindowSaturated = isCaptureWindowSaturated;
 exports.sliceOutput = sliceOutput;
 exports.getCachedCapture = getCachedCapture;
 exports.setCachedCapture = setCachedCapture;
@@ -45,6 +46,38 @@ exports.CACHE_TTL_MS = 5000;
 exports.CACHE_MAX_ENTRIES = 100;
 /** Maximum capture lines for cache storage */
 exports.CACHE_MAX_CAPTURE_LINES = 10000;
+// =========================================================================
+// isCaptureWindowSaturated()
+// =========================================================================
+/**
+ * Whether a capture came back clipped by the capture window (Issue #1670).
+ *
+ * Every capture in this app is a SLIDING WINDOW over the tail of the pane, not a
+ * view of the whole buffer: `captureSessionOutput()` asks tmux for
+ * `-S -CACHE_MAX_CAPTURE_LINES` and `sliceOutput()` then keeps only the last
+ * `requestedLines` rows. So the returned line count is
+ * `min(pane_scrollback + pane_height, windowLines)`.
+ *
+ * While the pane holds fewer rows than the window, that count GROWS with the
+ * transcript, which is what makes `session_states.last_captured_line` usable as a
+ * "how far have I read" cursor. Once the pane outgrows the window the count is
+ * pinned at `windowLines` forever and the window merely slides: a line index
+ * recorded earlier no longer denotes the same line, and no later capture can ever
+ * report a larger count. Callers must stop trusting the cursor at that point —
+ * see `usesAlternateScreen` in lib/cli-tools/types.ts for the sibling condition
+ * (#1268), where the same thing happens at `pane_height` instead.
+ *
+ * Raising `windowLines` does not avoid this; it only moves where it happens
+ * (`TMUX_HISTORY_LIMIT` is the hard ceiling), which is why the check is written
+ * against the window in use rather than against a specific constant.
+ *
+ * @param capturedLineCount - Number of lines the capture actually returned
+ * @param windowLines - Size of the capture window that produced it
+ * @returns True when the capture was clipped, i.e. the line count is no longer a cursor
+ */
+function isCaptureWindowSaturated(capturedLineCount, windowLines = exports.CACHE_MAX_CAPTURE_LINES) {
+    return windowLines > 0 && capturedLineCount >= windowLines;
+}
 function getCache() {
     return (globalThis.__tmuxCaptureCache ??= new Map());
 }

package/dist/server/src/lib/tmux/tmux-control-client.js

@@ -101,6 +101,18 @@ class TmuxControlClient {
     isStarted() {
         return this.started;
     }
+    /**
+     * Point this client's bookkeeping at a session that has been renamed
+     * underneath it (Issue #1621 Phase 3).
+     *
+     * The attach itself needs no repair: `attach-session` binds to the session
+     * object, not to its name, so a `rename-session` leaves the child process,
+     * its pipe and its scrollback untouched (measured in #1621). Only the name
+     * this client reports in its logs would otherwise go stale.
+     */
+    setSessionName(sessionName) {
+        this.sessionName = sessionName;
+    }
     emit(event) {
         for (const handler of this.handlers) {
             handler(event);

package/dist/server/src/lib/tmux/tmux-control-registry.js

@@ -70,6 +70,45 @@ class TmuxControlRegistry {
         this.handlers.clear();
         this.updateMetrics();
     }
+    /**
+     * Re-file a live control-mode attach under a session's new name
+     * (Issue #1621 Phase 3).
+     *
+     * `rename-session` does not disturb an attached control client, so the child
+     * process, its pipe and its scrollback all survive — what breaks is this
+     * registry, which is keyed by name. Without re-keying, `sendInput(newName)`
+     * throws "No control client registered" while a perfectly healthy attach sits
+     * under the old key: the session is alive but input no longer reaches it.
+     * Re-keying is therefore strictly better than tearing the attach down and
+     * re-establishing it, and it keeps every subscriber connected.
+     *
+     * @returns true when an entry was moved; false when nothing was registered
+     *          under `oldName`, or when `newName` is already registered (the
+     *          existing attach wins — clobbering it would strand a live child
+     *          process with no way to stop it)
+     */
+    renameSession(oldName, newName) {
+        if (oldName === newName)
+            return false;
+        const entry = this.entries.get(oldName);
+        if (!entry)
+            return false;
+        if (this.entries.has(newName)) {
+            logger.warn('rename:destination-occupied', { oldName, newName });
+            return false;
+        }
+        this.entries.delete(oldName);
+        entry.sessionName = newName;
+        this.entries.set(newName, entry);
+        entry.client.setSessionName(newName);
+        const handlers = this.handlers.get(oldName);
+        if (handlers) {
+            this.handlers.delete(oldName);
+            this.handlers.set(newName, handlers);
+        }
+        logger.debug('rename', { oldName, newName });
+        return true;
+    }
     ensureEntry(sessionName) {
         const existing = this.entries.get(sessionName);
         if (existing) {
@@ -77,23 +116,26 @@ class TmuxControlRegistry {
         }
         const client = this.createClient(sessionName);
         client.start(sessionName);
-        const unsubscribeClientEvent = client.onEvent((event) => {
-            const handlers = this.handlers.get(sessionName);
+        const entry = {
+            client,
+            subscribers: new Set(),
+            // Replaced immediately below; the entry has to exist first so the event
+            // handler can read its current name rather than capture the old one.
+            unsubscribeClientEvent: () => { },
+            idleTimer: null,
+            sessionName,
+        };
+        entry.unsubscribeClientEvent = client.onEvent((event) => {
+            const handlers = this.handlers.get(entry.sessionName);
             if (handlers) {
                 for (const handler of handlers) {
                     handler(event);
                 }
             }
             if (event.type === 'exit' || event.type === 'error') {
-                this.deleteEntry(sessionName);
+                this.deleteEntry(entry.sessionName);
             }
         });
-        const entry = {
-            client,
-            subscribers: new Set(),
-            unsubscribeClientEvent,
-            idleTimer: null,
-        };
         this.entries.set(sessionName, entry);
         this.updateMetrics();
         return entry;
@@ -116,8 +158,10 @@ class TmuxControlRegistry {
         }
         this.cancelIdleCleanup(entry);
         entry.idleTimer = setTimeout(() => {
-            logger.debug('idle-cleanup', { sessionName });
-            this.deleteEntry(sessionName);
+            // entry.sessionName, not the captured `sessionName`: the session may have
+            // been renamed while this timer was pending (see renameSession).
+            logger.debug('idle-cleanup', { sessionName: entry.sessionName });
+            this.deleteEntry(entry.sessionName);
         }, this.idleTimeoutMs);
     }
     cancelIdleCleanup(entry) {

package/dist/server/src/lib/tmux/tmux.js

@@ -15,6 +15,7 @@ exports.sendKeys = sendKeys;
 exports.sendSpecialKeys = sendSpecialKeys;
 exports.capturePane = capturePane;
 exports.killSession = killSession;
+exports.renameSession = renameSession;
 exports.ensureSession = ensureSession;
 exports.sendSpecialKey = sendSpecialKey;
 exports.clearInputLine = clearInputLine;
@@ -23,6 +24,7 @@ exports.sendSpecialKeysAndInvalidate = sendSpecialKeysAndInvalidate;
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const tmux_capture_cache_1 = require("./tmux-capture-cache");
+const validation_1 = require("../../lib/cli-tools/validation");
 const tmux_pane_config_1 = require("../../config/tmux-pane-config");
 const logger_1 = require("../../lib/logger");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
@@ -451,6 +453,65 @@ async function killSession(sessionName) {
         throw new Error(`Failed to kill tmux session: ${errorMessage}`);
     }
 }
+/**
+ * Rename a running tmux session, keeping its processes and scrollback intact.
+ *
+ * This is what lets a worktree ID move without killing the agent underneath it.
+ * Session names are a *derived* value (`mcbd-{cli}-{worktreeId}[-{suffix}]`), so
+ * the moment the ID behind a directory changes, every session named after the
+ * old ID becomes unreachable through the app while the process keeps running —
+ * the UI shows nothing and a second agent can be started on the same directory
+ * (Issue #1621 (a)). Renaming re-attaches the name to the process instead.
+ *
+ * Measured on a throwaway session (Issue #1621): the pane PID is unchanged
+ * across the rename, scrollback survives, an attached client follows the
+ * session, and the old name stops resolving immediately.
+ *
+ * Both names are validated: `oldName` because it is interpolated into a tmux
+ * target, `newName` because tmux would otherwise happily create a session whose
+ * name contains `:` or `.` — characters tmux itself uses as target separators,
+ * which would make the session permanently unaddressable.
+ *
+ * The `-t` target goes through {@link exactTarget} like every other target in
+ * this module: `mcbd-claude-<wt>` is a prefix of `mcbd-claude-<wt>-2`, and a
+ * fuzzy match here would rename the wrong instance's session (Issue #1156).
+ *
+ * @param oldName - Current session name (exact)
+ * @param newName - New session name
+ * @returns true when the session was renamed; false when `oldName` does not
+ *          exist (or tmux is not running), which is not an error for a
+ *          reconciliation pass over sessions that may or may not be up
+ * @throws Error when the rename fails for any other reason — notably when
+ *         `newName` is already taken, which the caller must not silently ignore
+ */
+async function renameSession(oldName, newName) {
+    (0, validation_1.validateSessionName)(oldName);
+    (0, validation_1.validateSessionName)(newName);
+    if (oldName === newName)
+        return false;
+    try {
+        await execFileAsync('tmux', ['rename-session', '-t', exactTarget(oldName), newName], {
+            timeout: DEFAULT_TIMEOUT,
+        });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        if (errorMessage?.includes('no server running') ||
+            errorMessage?.includes("can't find session")) {
+            return false;
+        }
+        throw new Error(`Failed to rename tmux session: ${errorMessage}`);
+    }
+    // Capture output is cached per session NAME (TTL 5s). Both keys are now lies:
+    // the old one names a session that no longer exists, and the new one may hold
+    // a stale entry from a session that used to have this name. Dropping them is
+    // enough — the next capture repopulates (Issue #1621 says the capture cache
+    // may simply be discarded).
+    (0, tmux_capture_cache_1.invalidateCache)(oldName);
+    (0, tmux_capture_cache_1.invalidateCache)(newName);
+    logger.info('session:renamed', { oldName, newName });
+    return true;
+}
 /**
  * Ensure a tmux session exists, creating it if necessary
  *

package/dist/server/src/lib/ws-server.js

@@ -5,12 +5,13 @@
  * Issue #331: WebSocket authentication via Cookie header
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.__internal = void 0;
+exports.__internal = exports.WORKTREE_RENAMED_EVENT_TYPE = void 0;
 exports.handleProxyUpgrade = handleProxyUpgrade;
 exports.setupWebSocket = setupWebSocket;
 exports.broadcast = broadcast;
 exports.hasRoomSubscribers = hasRoomSubscribers;
 exports.broadcastMessage = broadcastMessage;
+exports.migrateWorktreeRooms = migrateWorktreeRooms;
 exports.cleanupRooms = cleanupRooms;
 exports.closeWebSocket = closeWebSocket;
 const ws_1 = require("ws");
@@ -745,6 +746,108 @@ function broadcastMessage(type, data) {
         logger.warn('broadcast:missing-worktree-id');
     }
 }
+/**
+ * Message type sent to a room whose worktree ID has been renamed
+ * (Issue #1621 Phase 3).
+ *
+ * Clients that do not understand it ignore it (`parseRealtimeEvent` drops
+ * unknown types), so it is safe to emit to every subscriber; the point is that
+ * a browser holding the old ID can learn the new one without a reload.
+ */
+exports.WORKTREE_RENAMED_EVENT_TYPE = 'worktree_renamed';
+/**
+ * Move every WebSocket subscription from a renamed worktree ID to the new one
+ * (Issue #1621 Phase 3).
+ *
+ * Two things are keyed on the worktree ID here, and both have to move together
+ * because they are the write side and the read side of the same pair:
+ *
+ * 1. the **room** (`rooms`, plus each client's `worktreeIds` set) — every
+ *    server-side `broadcast(worktreeId, …)` after the rename uses the NEW ID,
+ *    so a room left under the old key goes silent while its clients still
+ *    believe they are subscribed;
+ * 2. the **terminal subscription's session name** — derived from the worktree ID
+ *    (`mcbd-<cli>-<id>`) and cached on the subscription, so `terminal_input` /
+ *    `terminal_resize` would keep addressing a tmux session that no longer
+ *    answers to that name.
+ *
+ * Every affected subscriber is then notified, so a client can re-point its own
+ * state instead of waiting for a reload.
+ *
+ * Takes the whole batch because IDs can swap (A→B, B→A): all source rooms are
+ * detached before any destination room is written. Where a destination room
+ * already exists the two sets are merged rather than replaced — dropping the
+ * incumbent subscribers would silence clients that did nothing wrong.
+ *
+ * @param renames - Worktree ID pairs being applied
+ * @returns The pairs that actually had room subscribers to move
+ */
+function migrateWorktreeRooms(renames) {
+    const targets = new Map();
+    for (const { oldId, newId } of renames) {
+        if (!oldId || !newId || oldId === newId)
+            continue;
+        targets.set(oldId, newId);
+    }
+    if (targets.size === 0)
+        return [];
+    // Detach first, write second — a swap must not have one half clobber the other.
+    const detached = [];
+    for (const [oldId, newId] of targets) {
+        const room = rooms.get(oldId);
+        if (!room || room.size === 0)
+            continue;
+        rooms.delete(oldId);
+        detached.push({ oldId, newId, sockets: room });
+    }
+    const moved = [];
+    for (const { oldId, newId, sockets } of detached) {
+        const destination = rooms.get(newId) ?? new Set();
+        for (const ws of sockets) {
+            destination.add(ws);
+            const clientInfo = clients.get(ws);
+            if (clientInfo) {
+                clientInfo.worktreeIds.delete(oldId);
+                clientInfo.worktreeIds.add(newId);
+            }
+            sendTerminalEvent(ws, {
+                type: exports.WORKTREE_RENAMED_EVENT_TYPE,
+                worktreeId: newId,
+                previousWorktreeId: oldId,
+            });
+        }
+        rooms.set(newId, destination);
+        moved.push({ oldId, newId, subscribers: sockets.size });
+    }
+    // Terminal subscriptions live on the client, not in the room, so they are
+    // swept separately: a client can stream a terminal without joining the room.
+    for (const clientInfo of clients.values()) {
+        const subscription = clientInfo.terminalSubscription;
+        if (!subscription)
+            continue;
+        const newId = targets.get(subscription.worktreeId);
+        if (!newId)
+            continue;
+        try {
+            if (!(0, types_1.isCliToolType)(subscription.cliToolId))
+                continue;
+            const cliTool = manager_1.CLIToolManager.getInstance().getTool(subscription.cliToolId);
+            subscription.sessionName = cliTool.getSessionName(newId);
+            subscription.worktreeId = newId;
+        }
+        catch (error) {
+            logger.warn('terminal:rename-failed', {
+                worktreeId: subscription.worktreeId,
+                newId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    if (moved.length > 0) {
+        logger.info('rooms:migrated', { count: moved.length });
+    }
+    return moved;
+}
 /**
  * Clean up WebSocket rooms for deleted worktrees
  * Removes rooms from the rooms map (clients will naturally disconnect or resubscribe)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "commandmate",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "A local control plane for agent CLIs — orchestration and visibility for Claude Code, Codex, Gemini CLI, and more across Git worktrees",
   "keywords": [
     "claude-code",

package/.next/server/chunks/1117.js

@@ -1 +0,0 @@
-"use strict";exports.id=1117,exports.ids=[1117],exports.modules={39333:(a,b,c)=>{c.d(b,{$Y:()=>g,Bg:()=>i,HB:()=>f,df:()=>h,f9:()=>d});let d=[".png",".jpg",".jpeg",".gif",".webp",".svg"],e=[{extension:".png",mimeType:"image/png",magicBytes:[137,80,78,71]},{extension:".jpg",mimeType:"image/jpeg",magicBytes:[255,216,255]},{extension:".jpeg",mimeType:"image/jpeg",magicBytes:[255,216,255]},{extension:".gif",mimeType:"image/gif",magicBytes:[71,73,70,56]},{extension:".webp",mimeType:"image/webp",magicBytes:[82,73,70,70]},{extension:".svg",mimeType:"image/svg+xml"}];function f(a){return a?a.startsWith(".")?a.toLowerCase():"."+a.toLowerCase():""}function g(a){let b=f(a),c=e.find(a=>a.extension===b);return c?.mimeType||"application/octet-stream"}function h(a){if(!a)return!1;let b=f(a);return d.includes(b)}function i(a,b){if(b.length>0x1400000)return{valid:!1,error:"File size exceeds 20MB limit"};if(".svg"===f(a)){var c;return(c=b.toString("utf-8")).includes("<svg")||c.startsWith("<?xml")?/<script[\s>]/i.test(c)?{valid:!1,error:"SVG contains script tags"}:/\s+on\w+\s*=/i.test(c)?{valid:!1,error:"SVG contains event handler attributes"}:/(?:xlink:)?href\s*=\s*["']?\s*(?:javascript|data|vbscript):/i.test(c)?{valid:!1,error:"SVG contains dangerous URI scheme"}:/<foreignObject[\s>]/i.test(c)?{valid:!1,error:"SVG contains foreignObject element"}:{valid:!0}:{valid:!1,error:"Invalid SVG format"}}return!function(a,b){let c=f(a),d=e.find(a=>a.extension===c);if(!d?.magicBytes)return".svg"===c;let g=d.magicBytesOffset||0;return!(b.length<g+d.magicBytes.length)&&d.magicBytes.every((a,c)=>b[g+c]===a)}(a,b)?{valid:!1,error:"Invalid image magic bytes"}:{valid:!0}}d.filter(a=>".svg"!==a).map(a=>g(a)).filter(a=>"application/octet-stream"!==a).join(",")},56791:(a,b,c)=>{c.d(b,{ACU:()=>d.AC,Tu1:()=>d.Tu,ug3:()=>d.ug,ePp:()=>d.eP,mgu:()=>d.mg,lmQ:()=>d.lm,afR:()=>d.af,KG7:()=>d.KG,cDg:()=>d.cD,Jj_:()=>d.Jj,YXK:()=>d.YX,G4M:()=>d.G4,hLV:()=>d.hL,qpu:()=>d.qp,hlF:()=>d.hl,ToT:()=>d.To,oHS:()=>d.oH,UTO:()=>d.UT,pyp:()=>d.py,rYZ:()=>d.rY,yyF:()=>d.yy,pEA:()=>d.pE,z2r:()=>d.z2,cPO:()=>d.cP,DFh:()=>d.DF,lAn:()=>d.lA,QpU:()=>d.Qp,thF:()=>d.th,oZb:()=>d.oZ,ZPM:()=>d.ZP,YsC:()=>d.Ys,vgV:()=>d.vg,Rm5:()=>d.Rm,C81:()=>d.C8,u$7:()=>d.u$,MHq:()=>d.MH,BN2:()=>d.BN,m0H:()=>d.m0,TkM:()=>d.Tk,iTB:()=>d.iT,gpF:()=>d.gp,yEE:()=>d.yE,BEB:()=>d.BE,qKv:()=>d.qK,p41:()=>d.p4,r8U:()=>d.r8,of8:()=>d.of,DNF:()=>d.DN,pZp:()=>d.pZ,kAO:()=>d.kA,VLK:()=>d.VL,CFc:()=>d.CF,NVZ:()=>d.NV,ceo:()=>d.ce,WZv:()=>d.WZ,y1O:()=>d.y1,ggW:()=>d.gg,NrL:()=>d.Nr,obI:()=>d.ob,frO:()=>d.fr,J6l:()=>d.J6,Uim:()=>d.Ui,P99:()=>d.P9,eNI:()=>d.eN,vil:()=>d.vi,uJp:()=>d.uJ,yTo:()=>d.yT,VkA:()=>d.Vk,Mt$:()=>d.Mt,UE1:()=>d.UE,PLg:()=>d.PL,jpM:()=>d.jp,nQM:()=>d.nQ,ybN:()=>d.yb,GAi:()=>d.GA,Cs6:()=>d.Cs,xRr:()=>d.xR,azd:()=>d.az,nZD:()=>d.nZ,PPl:()=>d.PP,DxD:()=>d.Dx,OaR:()=>d.O,EU4:()=>d.EU,HZx:()=>d.HZ,UYU:()=>d.UY,cwY:()=>d.cw,jJB:()=>d.jJ,DCX:()=>d.DC,PPx:()=>d.gb,yBd:()=>d.yB,uy0:()=>d.uy,sal:()=>d.s,ium:()=>d.iu,hqe:()=>d.hq,z1g:()=>d.z1,blx:()=>d.bl,jAi:()=>d.jA,ZL2:()=>d.ZL});var d=c(90444);c(88807),c(14520),c(20416),c(10406),c(29021),c(33873),c(21820),c(7956),(0,c(72626).h)("db-migration-path")},66007:(a,b,c)=>{c.d(b,{B9:()=>m,Px:()=>o,Uc:()=>l,b$:()=>n,h6:()=>k});var d=c(33873),e=c.n(d),f=c(29021),g=c(72626),h=c(80438);let i=(0,g.h)("path-validator"),j=/^[a-zA-Z0-9_-]+$/;function k(a){return!!a&&0!==a.length&&j.test(a)}function l(a,b){return a===b||a.startsWith(b+e().sep)}function m(a,b){if(!a||""===a.trim()||a.includes("\0"))return!1;let c=a;try{c=decodeURIComponent(a)}catch{c=a}if(c.includes("\0"))return!1;let d=e().resolve(b),f=e().resolve(b,c),g=e().relative(d,f);return!(g.startsWith("..")||e().isAbsolute(g))}function n(a,b){if(!a||""===a.trim())throw Error("Invalid path: Path cannot be empty");if(a.includes("\0"))throw Error("Invalid path: Null bytes not allowed");if(!m(a,b))throw Error(`Path is outside allowed directory: ${a} (allowed root: ${b})`);let c=a;try{c=decodeURIComponent(a)}catch{c=a}return e().resolve(b,c)}function o(a,b){let c;try{c=(0,f.realpathSync)(b)}catch{return!1}let d=e().resolve(b,a);if((0,f.existsSync)(d))try{let b=(0,f.realpathSync)(d),e=l(b,c);return e||(0,h.h)(i,"symlink-rejected",{targetPath:a,resolvedTarget:b}),e}catch{return!1}try{if((0,f.lstatSync)(d).isSymbolicLink())try{let b=(0,f.readlinkSync)(d),g=e().resolve(e().dirname(d),b),j=l(g,c);return j||(0,h.h)(i,"dangling-symlink-rejected",{targetPath:a,resolvedLinkTarget:g}),j}catch{return!1}}catch{}let g=e().dirname(d);for(;g!==e().dirname(g);){if((0,f.existsSync)(g))try{let a=(0,f.realpathSync)(g),b=l(a,c);return b||(0,h.h)(i,"symlink-ancestor-rejected",{currentPath:g,resolvedAncestor:a}),b}catch{break}g=e().dirname(g)}return!1}},80438:(a,b,c)=>{c.d(b,{h:()=>d});function d(a,b,c){a.warn(`security:${b}`,c)}}};