devflow-kit 1.8.2 → 2.0.0

package/dist/core/proxy-log.js

@@ -0,0 +1,165 @@
+import { promises as fs } from 'fs';
+import * as path from 'path';
+/**
+ * @file proxy-log.ts
+ *
+ * SEC-2: Proxy log hardening and child-env scoping helpers.
+ *
+ * Exports:
+ *   - scrubChildEnv     — literal allowlist env for relay/doctor children (SEC-2)
+ *   - openProxyLog      — 0700-parent + 0600-file open with best-effort chmod (SEC-2)
+ *   - rotateProxyLogIfLarge — pre-spawn-only 2MB→1MB rotation that preserves 0600 mode
+ *
+ * avoids PF-009: every failure path is non-fatal (wrapped in try/catch); one bad
+ *   chmod or rotation error must never abort the enable flow.
+ */
+/** 2 MB max log size before rotation (mirrors ensure-proxy _LOG_MAX_BYTES). */
+export const PROXY_LOG_MAX_BYTES = 2_097_152;
+/** 1 MB tail to retain after rotation (mirrors ensure-proxy _LOG_TAIL_BYTES). */
+export const PROXY_LOG_TAIL_BYTES = 1_048_576;
+/**
+ * Build a scrubbed child process environment for relay/doctor subprocesses.
+ *
+ * Returns a literal allowlist copied from process.env:
+ *   posix: PATH, HOME, TMPDIR, LANG, LC_ALL, NODE_EXTRA_CA_CERTS (when set)
+ *   win32: additionally SystemRoot, APPDATA, USERPROFILE, ComSpec
+ *
+ * Variables absent from process.env are omitted rather than set to undefined.
+ * Call sites compose on top of this result to add process-specific vars
+ * (e.g. SUBSWITCH_CONFIG for the relay spawn and doctor spawn).
+ *
+ * applies ADR-003: the prior denylist rationale is gone — the routing runtime
+ * reads exactly three env vars (ANTHROPIC_API_KEY, FORCE_COLOR, SUBSWITCH_CONFIG).
+ * Verified by whole-dist grep of the 0.2.0 package. An allowlist is the correct
+ * shape: 61 inherited vars → 6.
+ *
+ * HOME is retained: the runtime's loadConfig resolves ~ paths via homedir().
+ *
+ * NODE_EXTRA_CA_CERTS is included so corporate-TLS deployments can supply a CA
+ * bundle; it is omitted when unset (the absent-→-omit loop handles this).
+ * NODE_OPTIONS is deliberately excluded: it permits arbitrary code execution via
+ * --require/--import. Mirrored in the ensure-proxy bash hook's _RELAY_ENV array
+ * (avoids PF-017); both allowlists must be kept in sync.
+ */
+export function scrubChildEnv() {
+    const POSIX_ALLOWLIST = ['PATH', 'HOME', 'TMPDIR', 'LANG', 'LC_ALL', 'NODE_EXTRA_CA_CERTS'];
+    const WIN32_ALLOWLIST = ['SystemRoot', 'APPDATA', 'USERPROFILE', 'ComSpec'];
+    const keys = process.platform === 'win32'
+        ? [...POSIX_ALLOWLIST, ...WIN32_ALLOWLIST]
+        : [...POSIX_ALLOWLIST];
+    const env = {};
+    for (const key of keys) {
+        const val = process.env[key];
+        if (val !== undefined) {
+            env[key] = val;
+        }
+    }
+    return env;
+}
+/**
+ * Open proxy.log for appending, ensuring the parent directory and the file
+ * itself are created with restricted permissions:
+ *
+ *   1. mkdir parent with { recursive: true, mode: 0o700 } — new directories
+ *      land at 0700; already-existing directories are unaffected by mkdir.
+ *   2. fs.open(logPath, 'a', 0o600) — mode 0600 applies on creation only;
+ *      a pre-existing file retains its current mode at this step.
+ *   3. best-effort fs.chmod(logPath, 0o600) — widens a pre-existing file
+ *      that was created before this guard existed (e.g. mode 0644 on disk).
+ *      Non-fatal: a chmod failure (EPERM, ENOENT race) must never prevent the
+ *      handle from being returned — avoids PF-009 failure-isolation principle.
+ *      Follows the SEC-1 precedent in src/core/fs-atomic.ts (commit 5755d56):
+ *      chmod in try/catch, never fatal, with a comment citing the rationale.
+ *
+ * @param logPath - Absolute path to proxy.log.
+ * @returns A FileHandle open in append mode (0600 or best-effort).
+ */
+export async function openProxyLog(logPath) {
+    // Step 1: ensure parent directory exists at 0700.
+    // mode: 0o700 applies to newly created directories only; pre-existing
+    // directories at 0755 are not narrowed — chmod the dir if needed separately.
+    await fs.mkdir(path.dirname(logPath), { recursive: true, mode: 0o700 });
+    // Step 2: open (or create) file for appending.
+    // 0o600 mode applies on creation only — does not change a pre-existing mode.
+    const handle = await fs.open(logPath, 'a', 0o600);
+    // Step 3: best-effort chmod for a pre-existing file that has a wider mode.
+    // Non-fatal: chmod failure must not prevent the handle from being returned.
+    // avoids PF-009: failure-isolation — one bad chmod must never abort the enable flow.
+    try {
+        await fs.chmod(logPath, 0o600);
+    }
+    catch {
+        // EPERM, ENOENT race, or unsupported platform — use the mode already on disk.
+        // The open() in step 2 already succeeded; the file is usable regardless.
+    }
+    return handle;
+}
+/**
+ * Rotate proxy.log in-place when it exceeds PROXY_LOG_MAX_BYTES.
+ *
+ * Writes the last PROXY_LOG_TAIL_BYTES to a sibling .tmp.$PID file under
+ * mode 0o600 (written directly, not via chmod-after-rename), then atomically
+ * replaces the original with a rename. The rename replaces the inode, so the
+ * replacement carries the tmp file's 0o600 mode — this is the stronger
+ * guarantee (no race window between rename and chmod).
+ *
+ * This mirrors the ensure-proxy shell hook which creates the rotation tmp
+ * under `umask 077` for the same reason.
+ *
+ * SAFETY INVARIANT — MUST BE CALLED PRE-SPAWN ONLY:
+ *   rename() replaces the inode at the log path. If the detached relay process
+ *   already holds an append fd on the old inode, all subsequent relay output
+ *   goes to an unlinked inode (orphaned fd). This function is therefore called
+ *   ONLY from the runEnable path BEFORE spawnRelayAndWaitForPort — at that
+ *   point no relay process exists and no fd is open on proxy.log.
+ *   Never call this function from realSpawnDoctor or any post-spawn context.
+ *
+ * Non-fatal: rotation failure (disk full, EPERM, read error) leaves the
+ * original log untouched and the enable proceeds with an oversized log.
+ * avoids PF-009: one rotation error must never abort the enable flow.
+ *
+ * @param logPath - Absolute path to proxy.log.
+ */
+export async function rotateProxyLogIfLarge(logPath) {
+    let stat;
+    try {
+        stat = await fs.stat(logPath);
+    }
+    catch {
+        // File does not exist yet — nothing to rotate.
+        return;
+    }
+    if (stat.size <= PROXY_LOG_MAX_BYTES)
+        return;
+    const tmpPath = `${logPath}.tmp.${process.pid}`;
+    try {
+        // Read the tail portion (last PROXY_LOG_TAIL_BYTES).
+        const srcHandle = await fs.open(logPath, 'r');
+        let tail;
+        try {
+            const offset = Math.max(0, stat.size - PROXY_LOG_TAIL_BYTES);
+            const readLen = stat.size - offset;
+            const buf = Buffer.allocUnsafe(readLen);
+            const { bytesRead } = await srcHandle.read(buf, 0, readLen, offset);
+            tail = buf.subarray(0, bytesRead);
+        }
+        finally {
+            await srcHandle.close();
+        }
+        // Write tail to tmp with mode 0o600 at open time — the post-rename inode
+        // carries this mode without needing a subsequent chmod (no race window).
+        await fs.writeFile(tmpPath, tail, { mode: 0o600 });
+        // Atomic replace — readers and writers see old-or-new, never absent.
+        await fs.rename(tmpPath, logPath);
+    }
+    catch {
+        // Rotation failed (ENOSPC, EPERM, read error, etc.) — clean up tmp and
+        // continue. The original log is untouched; an oversized log is preferable
+        // to a broken enable.
+        try {
+            await fs.unlink(tmpPath);
+        }
+        catch { /* already gone or never written */ }
+    }
+}
+//# sourceMappingURL=proxy-log.js.map

package/dist/core/proxy-state.js

@@ -0,0 +1,305 @@
+/**
+ * Proxy state persistence and routing config helpers for the Devflow external
+ * model routing feature.
+ *
+ * applies ADR-013: pure core-layer module — no Claude Code adapter concerns.
+ * avoids PF-014: never call process.exit() inside finally-guarded scopes; all
+ *   fallible operations return Result instead of throwing.
+ *
+ * State file: ~/.devflow/proxy.json
+ * Routing config: ~/.devflow/proxy-routing.json (written by proxy CLI command)
+ *
+ * NOTE: the internal routing runtime package name ("subswitch") must NEVER appear
+ * in user-visible strings or error messages. User-facing vocabulary:
+ * "external model routing" / "Devflow proxy".
+ */
+import { createRequire } from 'module';
+import { join } from 'path';
+import { promises as fs } from 'fs';
+import { writeFileAtomicExclusive } from './fs-atomic.js';
+function Ok(value) {
+    return { ok: true, value };
+}
+function Err(error) {
+    return { ok: false, error };
+}
+// ---------------------------------------------------------------------------
+// Proxy state schema
+// ---------------------------------------------------------------------------
+/** Default port for the Devflow proxy. */
+export const DEFAULT_PROXY_PORT = 4141;
+// ---------------------------------------------------------------------------
+// Read / write
+// ---------------------------------------------------------------------------
+/**
+ * Read proxy state from ~/.devflow/proxy.json with tolerant parsing.
+ * Returns a default disabled state when the file is missing.
+ */
+export async function readProxyState(devflowDir) {
+    const statePath = join(devflowDir, 'proxy.json');
+    try {
+        const content = await fs.readFile(statePath, 'utf-8');
+        const data = JSON.parse(content);
+        // Tolerant parse: provide safe defaults for missing/invalid fields.
+        const state = {
+            version: 1,
+            enabled: typeof data.enabled === 'boolean' ? data.enabled : false,
+            port: typeof data.port === 'number' && data.port > 0 ? data.port : DEFAULT_PROXY_PORT,
+            binPath: typeof data.binPath === 'string' ? data.binPath : null,
+            configPath: typeof data.configPath === 'string' ? data.configPath : null,
+            resolvedAt: typeof data.resolvedAt === 'string' ? data.resolvedAt : null,
+            devflowVersion: typeof data.devflowVersion === 'string' ? data.devflowVersion : null,
+        };
+        return Ok(state);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === 'ENOENT') {
+            // File missing → return a default disabled state (not an error).
+            return Ok({
+                version: 1,
+                enabled: false,
+                port: DEFAULT_PROXY_PORT,
+                binPath: null,
+                configPath: null,
+                resolvedAt: null,
+                devflowVersion: null,
+            });
+        }
+        return Err(`Failed to read proxy state: ${err.message}`);
+    }
+}
+/**
+ * Atomically write proxy state to ~/.devflow/proxy.json.
+ * Creates the parent directory if needed.
+ */
+export async function writeProxyState(devflowDir, state) {
+    const statePath = join(devflowDir, 'proxy.json');
+    try {
+        await fs.mkdir(devflowDir, { recursive: true });
+        await writeFileAtomicExclusive(statePath, JSON.stringify(state, null, 2) + '\n');
+        return Ok(undefined);
+    }
+    catch (err) {
+        return Err(`Failed to write proxy state: ${err.message}`);
+    }
+}
+// ---------------------------------------------------------------------------
+// Pure helpers
+// ---------------------------------------------------------------------------
+/**
+ * Accepted top-level keys for the subswitch 0.2.0 FileConfigSchema (z.strictObject).
+ * Unknown top-level keys cause a hard relay startup error — never emit them.
+ *
+ * @D-EFR-4 Subswitch 0.2.0 routing config contract:
+ *   FileConfigSchema is a z.strictObject with exactly 5 accepted top-level keys:
+ *   port, logLevel, anthropic, providers, limits. Unknown keys cause a hard startup
+ *   error — the relay refuses to start. anthropic and limits are themselves
+ *   strictObject + prefault({}), so they may be partially specified.
+ *
+ *   connectTimeoutMs default: subswitch 0.2.0 applies anthropic.connectTimeoutMs
+ *   as upstream.setTimeout() at anthropic-passthrough.js:86 — a socket *inactivity*
+ *   timeout, not a connect timeout. The 10s default kills any Anthropic request
+ *   whose upstream takes >10s to emit the first response byte — routine for long
+ *   opus requests (confirmed: 99 spurious 504s clustered at 10004-10098ms while
+ *   successful requests ran 25s-99s). Default overridden to 120 000ms; a
+ *   user-specified value always wins.
+ *
+ *   limits.connectTimeoutMs is a registered LEGACY KEY that causes a hard startup
+ *   error. Strip it from the limits block when preserving existing config.
+ */
+const ROUTING_CONFIG_ALLOWED_TOP_KEYS = new Set([
+    'port', 'logLevel', 'anthropic', 'providers', 'limits',
+]);
+/** Default anthropic.connectTimeoutMs injected when not specified by the user (ms). */
+export const DEFAULT_ANTHROPIC_CONNECT_TIMEOUT_MS = 120_000;
+/**
+ * Build the routing config JSON for ~/.devflow/proxy-routing.json.
+ *
+ * Authoritatively sets `port`. Preserves any existing valid `anthropic`,
+ * `limits`, `logLevel`, and `providers` blocks from `existingContent`,
+ * filtering out unknown top-level keys and the legacy `limits.connectTimeoutMs`
+ * field (which causes a hard relay startup error in 0.2.0).
+ *
+ * Injects a default `anthropic.connectTimeoutMs` of 120 000ms when the user
+ * has not set one — see @D-EFR-4 for the rationale.
+ *
+ * If `existingContent` is missing or malformed, falls back to a clean config
+ * with only `port` and `anthropic.connectTimeoutMs`.
+ *
+ * applies ADR-013: pure core-layer function — no I/O.
+ * @D-EFR-4: see note above for the strict top-key constraint and timeout rationale.
+ */
+export function buildRoutingConfigJson(port, existingContent) {
+    // Parse existing config tolerantly; a malformed file falls back to clean defaults.
+    const preserved = {};
+    if (existingContent !== undefined) {
+        try {
+            const parsed = JSON.parse(existingContent);
+            if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+                for (const [k, v] of Object.entries(parsed)) {
+                    // Only preserve the 5 accepted top-level keys; port is always ours.
+                    if (ROUTING_CONFIG_ALLOWED_TOP_KEYS.has(k) && k !== 'port') {
+                        preserved[k] = v;
+                    }
+                }
+            }
+        }
+        catch {
+            // Malformed existing config — fall through to clean defaults.
+        }
+    }
+    const config = { port };
+    // Preserve logLevel if present in existing config.
+    if (preserved.logLevel !== undefined) {
+        config.logLevel = preserved.logLevel;
+    }
+    // Anthropic block: preserve user settings; inject connectTimeoutMs default when absent.
+    // @D-EFR-4: the 10s upstream inactivity timeout kills long opus requests.
+    const existingAnthropic = typeof preserved.anthropic === 'object' &&
+        preserved.anthropic !== null &&
+        !Array.isArray(preserved.anthropic)
+        ? { ...preserved.anthropic }
+        : {};
+    if (!Object.prototype.hasOwnProperty.call(existingAnthropic, 'connectTimeoutMs')) {
+        existingAnthropic.connectTimeoutMs = DEFAULT_ANTHROPIC_CONNECT_TIMEOUT_MS;
+    }
+    config.anthropic = existingAnthropic;
+    // Preserve providers block if present.
+    if (preserved.providers !== undefined) {
+        config.providers = preserved.providers;
+    }
+    // Preserve limits block if present; strip legacy limits.connectTimeoutMs that
+    // causes a hard startup error in 0.2.0 (use anthropic.connectTimeoutMs instead).
+    if (preserved.limits !== undefined) {
+        if (typeof preserved.limits === 'object' &&
+            preserved.limits !== null &&
+            !Array.isArray(preserved.limits)) {
+            const limitsObj = { ...preserved.limits };
+            delete limitsObj['connectTimeoutMs'];
+            config.limits = limitsObj;
+        }
+        else {
+            config.limits = preserved.limits;
+        }
+    }
+    return JSON.stringify(config, null, 2) + '\n';
+}
+/**
+ * Build a complete ProxyState object with the current timestamp.
+ * Pure constructor helper — no I/O.
+ */
+export function buildProxyState(opts) {
+    return {
+        version: 1,
+        enabled: opts.enabled,
+        port: opts.port,
+        binPath: opts.binPath,
+        configPath: opts.configPath,
+        resolvedAt: new Date().toISOString(),
+        devflowVersion: opts.devflowVersion,
+    };
+}
+/**
+ * Returns the proxy base URL for the given port.
+ * Pure function.
+ */
+export function proxyBaseUrl(port) {
+    return `http://127.0.0.1:${port}`;
+}
+// ---------------------------------------------------------------------------
+// isProxyEnabled — the primary contract other modules consume
+// ---------------------------------------------------------------------------
+/**
+ * Check whether the Devflow proxy is currently enabled.
+ * Returns false when the proxy state file is missing, unreadable, or malformed.
+ * This is the SOLE export that agent-models and cli commands use to check proxy state.
+ *
+ * @param devflowDir - Path to the ~/.devflow directory (injected for testability).
+ */
+export async function isProxyEnabled(devflowDir) {
+    const result = await readProxyState(devflowDir);
+    if (!result.ok)
+        return false;
+    return result.value.enabled;
+}
+// ---------------------------------------------------------------------------
+// resolveProxyBin — locate the routing runtime entry point
+// ---------------------------------------------------------------------------
+/**
+ * Regex for acceptable routing runtime version strings used as cache-key
+ * path components. Rejects path-traversal attempts (e.g. '../../etc/x'),
+ * excessively long strings, and empty strings.
+ *
+ * SECURITY: version is used as a path component in cache keys.
+ * path.join normalises '..', so an unvalidated version string is an
+ * arbitrary-file-overwrite primitive through writeFileAtomicExclusive.
+ * This is the second, independent layer; Phase A's path-containment
+ * assertion in cache.ts is the first.
+ */
+export const RUNTIME_VERSION_RE = /^[A-Za-z0-9.+-]{1,32}$/;
+/**
+ * Resolve the routing runtime binary from devflow's own node_modules.
+ *
+ * Uses createRequire(import.meta.url).resolve('subswitch/package.json') to find
+ * the package, then reads its `bin` field to locate the JS entry point.
+ *
+ * Returns the absolute path so callers can spawn as `node <path>`.
+ * (npm does not guarantee exec bits on installed package binaries.)
+ *
+ * Returns a Result error whose user-facing message is:
+ *   "routing runtime missing — reinstall devflow-kit"
+ * when the routing runtime is not found (MODULE_NOT_FOUND). The internal package
+ * name MUST NOT appear in user-visible strings per the branding constraint.
+ *
+ * Includes `npxWarning: true` when the resolved path contains `/_npx/` —
+ * npx-cached installs are not guaranteed to persist across machine restarts.
+ *
+ * Includes `version` when the package.json version passes RUNTIME_VERSION_RE.
+ * When validation fails the field is absent — the bin is still usable but
+ * callers that need the version for cache keys must treat it as unavailable.
+ */
+export async function resolveProxyBin() {
+    // createRequire is the ESM-safe way to resolve CommonJS/package paths.
+    const require = createRequire(import.meta.url);
+    let pkgJsonPath;
+    try {
+        pkgJsonPath = require.resolve('subswitch/package.json');
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === 'MODULE_NOT_FOUND') {
+            return Err('routing runtime missing — reinstall devflow-kit');
+        }
+        return Err(`Failed to resolve routing runtime: ${err.message}`);
+    }
+    try {
+        const pkgJson = JSON.parse(await fs.readFile(pkgJsonPath, 'utf-8'));
+        const bin = pkgJson.bin;
+        let binRelPath;
+        if (typeof bin === 'string') {
+            binRelPath = bin;
+        }
+        else if (typeof bin === 'object' && bin !== null) {
+            // bin is a { name: relPath } map — prefer the 'subswitch' key, fall back to first entry.
+            const binObj = bin;
+            binRelPath = binObj['subswitch'] ?? Object.values(binObj)[0];
+        }
+        if (!binRelPath) {
+            return Err('routing runtime missing — reinstall devflow-kit');
+        }
+        const pkgDir = join(pkgJsonPath, '..');
+        const binPath = join(pkgDir, binRelPath);
+        const npxWarning = binPath.includes('/_npx/');
+        // Validate version for safe use as a cache-key path component (AC-S4).
+        const rawVersion = pkgJson.version;
+        const version = typeof rawVersion === 'string' && RUNTIME_VERSION_RE.test(rawVersion)
+            ? rawVersion
+            : undefined;
+        return Ok({ binPath, npxWarning, version });
+    }
+    catch (err) {
+        return Err(`Failed to read routing runtime package info: ${err.message}`);
+    }
+}
+//# sourceMappingURL=proxy-state.js.map

package/dist/core/safe-delete-install.js

@@ -0,0 +1,191 @@
+import { promises as fs } from 'fs';
+import * as path from 'path';
+const START_MARKER = '# >>> Devflow safe-delete >>>';
+const END_MARKER = '# <<< Devflow safe-delete <<<';
+/** Bump this when the safe-delete block changes. */
+export const SAFE_DELETE_BLOCK_VERSION = 2;
+/**
+ * Generate the safe-delete shell function block with markers.
+ * Returns null for unsupported shells.
+ */
+export function generateSafeDeleteBlock(shell, platform, trashCommand) {
+    if (shell === 'unknown')
+        return null;
+    if (shell === 'bash' || shell === 'zsh') {
+        const cmd = trashCommand ?? 'trash';
+        return [
+            START_MARKER,
+            `# v${SAFE_DELETE_BLOCK_VERSION}`,
+            `rm() {`,
+            `  local files=()`,
+            `  for arg in "$@"; do`,
+            `    [[ "$arg" =~ ^- ]] || files+=("$arg")`,
+            `  done`,
+            `  local existing=()`,
+            `  for f in "\${files[@]}"; do`,
+            `    [ -e "$f" ] || [ -L "$f" ] && existing+=("$f")`,
+            `  done`,
+            `  if (( \${#existing[@]} > 0 )); then`,
+            `    ${cmd} "\${existing[@]}"`,
+            `  fi`,
+            `}`,
+            `command() {`,
+            `  if [[ "$1" == "rm" ]]; then`,
+            `    shift; rm "$@"`,
+            `  else`,
+            `    builtin command "$@"`,
+            `  fi`,
+            `}`,
+            END_MARKER,
+        ].join('\n');
+    }
+    if (shell === 'fish') {
+        const cmd = trashCommand ?? 'trash';
+        return [
+            START_MARKER,
+            `# v${SAFE_DELETE_BLOCK_VERSION}`,
+            `function rm --description "Safe delete via trash"`,
+            `  set -l files`,
+            `  for arg in $argv`,
+            `    if not string match -q -- '-*' $arg`,
+            `      set files $files $arg`,
+            `    end`,
+            `  end`,
+            `  set -l existing`,
+            `  for f in $files`,
+            `    if test -e $f; or test -L $f`,
+            `      set existing $existing $f`,
+            `    end`,
+            `  end`,
+            `  if test (count $existing) -gt 0`,
+            `    ${cmd} $existing`,
+            `  end`,
+            `end`,
+            END_MARKER,
+        ].join('\n');
+    }
+    if (shell === 'powershell') {
+        if (platform === 'win32') {
+            return [
+                START_MARKER,
+                `# v${SAFE_DELETE_BLOCK_VERSION}`,
+                `if (Get-Alias rm -ErrorAction SilentlyContinue) {`,
+                `  Remove-Alias rm -Force -Scope Global`,
+                `}`,
+                `function rm {`,
+                `  $files = $args | Where-Object { $_ -notlike '-*' }`,
+                `  if ($files) {`,
+                `    Add-Type -AssemblyName Microsoft.VisualBasic`,
+                `    foreach ($f in $files) {`,
+                `      $p = Resolve-Path $f -ErrorAction SilentlyContinue`,
+                `      if ($p) {`,
+                `        if (Test-Path $p -PathType Container) {`,
+                `          [Microsoft.VisualBasic.FileIO.FileSystem]::DeleteDirectory(`,
+                `            $p, 'OnlyErrorDialogs', 'SendToRecycleBin')`,
+                `        } else {`,
+                `          [Microsoft.VisualBasic.FileIO.FileSystem]::DeleteFile(`,
+                `            $p, 'OnlyErrorDialogs', 'SendToRecycleBin')`,
+                `        }`,
+                `      }`,
+                `    }`,
+                `  }`,
+                `}`,
+                END_MARKER,
+            ].join('\n');
+        }
+        // macOS/Linux PowerShell
+        const cmd = trashCommand ?? 'trash';
+        return [
+            START_MARKER,
+            `# v${SAFE_DELETE_BLOCK_VERSION}`,
+            `if (Get-Alias rm -ErrorAction SilentlyContinue) {`,
+            `  Remove-Alias rm -Force -Scope Global`,
+            `}`,
+            `function rm {`,
+            `  $files = $args | Where-Object { $_ -notlike '-*' }`,
+            `  $existing = $files | Where-Object { Test-Path $_ }`,
+            `  if ($existing) { & ${cmd} @existing }`,
+            `}`,
+            END_MARKER,
+        ].join('\n');
+    }
+    return null;
+}
+/**
+ * Check if the safe-delete block is already installed in a profile file.
+ */
+export async function isAlreadyInstalled(profilePath) {
+    try {
+        const content = await fs.readFile(profilePath, 'utf-8');
+        return content.includes(START_MARKER) && content.includes(END_MARKER);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Append the safe-delete block to a profile file.
+ * Creates parent directories and the file if they don't exist.
+ */
+export async function installToProfile(profilePath, block) {
+    await fs.mkdir(path.dirname(profilePath), { recursive: true });
+    let existing = '';
+    try {
+        existing = await fs.readFile(profilePath, 'utf-8');
+    }
+    catch {
+        // File doesn't exist yet — will be created
+    }
+    const separator = existing.length > 0 && !existing.endsWith('\n') ? '\n\n' : '\n';
+    const content = existing.length > 0 ? existing + separator + block + '\n' : block + '\n';
+    await fs.writeFile(profilePath, content, 'utf-8');
+}
+/**
+ * Extract the installed safe-delete block version from a profile file.
+ * Returns 0 (not installed), 1 (legacy block without version stamp), or N (versioned block).
+ */
+export async function getInstalledVersion(profilePath) {
+    try {
+        const content = await fs.readFile(profilePath, 'utf-8');
+        const startIdx = content.indexOf(START_MARKER);
+        if (startIdx === -1)
+            return 0;
+        const afterMarker = content.slice(startIdx + START_MARKER.length);
+        const match = afterMarker.match(/^\n# v(\d+)/);
+        return match ? parseInt(match[1], 10) : 1;
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * Remove the safe-delete block from a profile file.
+ * Returns true if the block was found and removed, false otherwise.
+ * For fish function files, deletes the file if it becomes empty.
+ */
+export async function removeFromProfile(profilePath) {
+    let content;
+    try {
+        content = await fs.readFile(profilePath, 'utf-8');
+    }
+    catch {
+        return false;
+    }
+    const startIdx = content.indexOf(START_MARKER);
+    const endIdx = content.indexOf(END_MARKER);
+    if (startIdx === -1 || endIdx === -1)
+        return false;
+    const before = content.slice(0, startIdx);
+    const after = content.slice(endIdx + END_MARKER.length);
+    // Clean up surrounding whitespace
+    const cleaned = (before.trimEnd() + after.trimStart()).trim();
+    if (cleaned.length === 0) {
+        // File is empty after removal — delete it (fish function files)
+        await fs.unlink(profilePath);
+    }
+    else {
+        await fs.writeFile(profilePath, cleaned + '\n', 'utf-8');
+    }
+    return true;
+}
+//# sourceMappingURL=safe-delete-install.js.map