howtofixcli 0.7.7 → 0.7.9

package/dist/settings.js

@@ -1,148 +0,0 @@
-import { existsSync, mkdirSync, readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { writeFileAtomicSync } from "./fs-atomic.js";
-export const DEFAULT_WORKBENCH_SETTINGS = {
-    skipPermissions: false,
-    autoUpdate: true,
-    rightClickPaste: "auto",
-    welcomeSeen: false,
-    compressToolOutput: false,
-};
-function workbenchSettingsPath(agentDir) {
-    return join(agentDir, "settings.json");
-}
-/**
- * The stored preferences, with anything missing filled from the defaults.
- *
- * A non-boolean `skipPermissions` is ignored rather than coerced: `"false"` is
- * truthy, and a value that did not come from this file is not a decision the
- * user made here. `rightClickPaste` is read the same way — only the three
- * spellings this CLI writes are accepted, because an unrecognised one is not a
- * preference and guessing at it would be inventing a setting.
- */
-export function readWorkbenchSettings(agentDir) {
-    try {
-        const parsed = JSON.parse(readFileSync(workbenchSettingsPath(agentDir), "utf8"));
-        const boolean = (key) => {
-            const value = parsed[key];
-            return typeof value === "boolean" ? value : DEFAULT_WORKBENCH_SETTINGS[key];
-        };
-        const rightClick = parsed.rightClickPaste;
-        return {
-            skipPermissions: boolean("skipPermissions"),
-            autoUpdate: boolean("autoUpdate"),
-            rightClickPaste: rightClick === "on" || rightClick === "off" || rightClick === "auto" ? rightClick : DEFAULT_WORKBENCH_SETTINGS.rightClickPaste,
-            welcomeSeen: boolean("welcomeSeen"),
-            compressToolOutput: boolean("compressToolOutput"),
-            // Only a positive integer is a preference. Anything else is an
-            // unrecognised value, and guessing at it would be inventing a setting.
-            ...(typeof parsed.agents === "number" && Number.isInteger(parsed.agents) && parsed.agents > 0 ? { agents: parsed.agents } : {}),
-        };
-    }
-    catch {
-        return { ...DEFAULT_WORKBENCH_SETTINGS };
-    }
-}
-/**
- * Store one preference, leaving every other key in the file untouched.
- *
- * Returns false when the file exists but cannot be parsed, so the caller can
- * report it instead of silently discarding the change.
- */
-export function writeWorkbenchSetting(agentDir, key, value) {
-    return writeSetting(agentDir, key, value);
-}
-/**
- * Record that the first-run greeting has been shown.
- *
- * Takes no value: the only writer is the welcome screen, which sets this once
- * and never clears it, so "already seen" has a single spelling and there is no
- * parameter through which it could ever be un-set.
- */
-export function markWelcomeSeen(agentDir) {
-    return writeSetting(agentDir, "welcomeSeen", true);
-}
-/**
- * Store the right-click-paste preference.
- *
- * `"auto"` is stored by *removing* the key, so a file that never mentions it and
- * a file that says `"auto"` mean the same thing and there is one spelling of the
- * default rather than two.
- */
-export function writeRightClickPasteSetting(agentDir, value) {
-    return writeSetting(agentDir, "rightClickPaste", value === "auto" ? undefined : value);
-}
-/**
- * Whether the CLI should paste on a right click.
- *
- * On Windows it must not: Windows Terminal and the legacy console both paste on
- * a right click themselves, and the SDK's own mouse handler passes the click
- * through to them, so handling it here as well pasted the clipboard twice. That
- * is the bug this setting exists for — the CLI used to answer this question with
- * a bare `process.platform !== "win32"` and the SDK with `platform === "win32"`,
- * so between the two of them nothing handled it.
- *
- * Elsewhere it must: mouse tracking has already stopped the terminal from
- * pasting, so the click reaches the app and a right click would do nothing at
- * all without this.
- *
- * `"on"` and `"off"` are the user overruling that, for a terminal configured
- * unlike its platform's default.
- */
-export function rightClickPastesHere(preference) {
-    if (preference === "on")
-        return true;
-    if (preference === "off")
-        return false;
-    return process.platform !== "win32";
-}
-/**
- * Store a string preference, or clear it when the value is empty.
- *
- * A separate entry point from the boolean one because the two are not the same
- * kind of change: a cleared string is a key that should stop existing, so
- * `/proxy off` removes it rather than writing `""` — a file that says
- * `"httpsProxy": ""` invites the reader to wonder whether an empty proxy is a
- * proxy.
- */
-/**
- * Store the agent-concurrency preference.
- *
- * `undefined` (or anything that is not a positive integer) means "size it to the
- * machine", so the key is removed — one spelling of the default rather than two.
- */
-export function writeAgentsSetting(agentDir, value) {
-    const wanted = typeof value === "number" && Number.isInteger(value) && value > 0 ? value : undefined;
-    return writeSetting(agentDir, "agents", wanted);
-}
-export function writeStringSetting(agentDir, key, value) {
-    const trimmed = value.trim();
-    return writeSetting(agentDir, key, trimmed === "" ? undefined : trimmed);
-}
-function writeSetting(agentDir, key, value) {
-    const path = workbenchSettingsPath(agentDir);
-    let parsed = {};
-    try {
-        const candidate = JSON.parse(readFileSync(path, "utf8"));
-        if (candidate && typeof candidate === "object" && !Array.isArray(candidate))
-            parsed = candidate;
-    }
-    catch {
-        // A file that exists but does not parse is the user's, and is not ours to
-        // overwrite. A missing file is the normal first write.
-        if (existsSync(path))
-            return false;
-    }
-    if (value === undefined)
-        delete parsed[key];
-    else
-        parsed[key] = value;
-    try {
-        mkdirSync(dirname(path), { recursive: true });
-        writeFileAtomicSync(path, `${JSON.stringify(parsed, null, 2)}\n`);
-    }
-    catch {
-        return false;
-    }
-    return true;
-}

package/dist/skills.js

@@ -1,35 +0,0 @@
-import { USER_SKILLS_DIR, projectSkillsDir } from "./paths.js";
-export function skillSearchPaths(cwd) {
-    return [USER_SKILLS_DIR, projectSkillsDir(cwd)];
-}
-/**
- * Recognise a skill invocation and normalise it to `/skill:<name> [args]`.
- *
- * Accepts both `/skill:name` and the friendlier `/skill name`. The SDK's
- * expander only looks for `/skill:`, so the space form has to be rewritten
- * before it reaches `session.prompt`. Returns `undefined` for an unknown
- * skill name or any other leading slash — those stay with `runSlash`.
- */
-export function skillInvocation(text, names) {
-    const trimmed = text.trim();
-    const match = /^\/skill:([^\s]+)(?:\s+([\s\S]*))?$/.exec(trimmed) ?? /^\/skill\s+([^\s]+)(?:\s+([\s\S]*))?$/.exec(trimmed);
-    if (!match)
-        return undefined;
-    const name = match[1] ?? "";
-    if (!names.includes(name))
-        return undefined;
-    const args = (match[2] ?? "").trim();
-    return args ? `/skill:${name} ${args}` : `/skill:${name}`;
-}
-export function formatSkillList(skills) {
-    if (skills.length === 0) {
-        const [userDir, projectDir] = skillSearchPaths(process.cwd());
-        return ["no skills loaded.", `put a SKILL.md in ${userDir}`, `or in ${projectDir}`, "invoke with /skill:<name>"].join("\n");
-    }
-    return skills
-        .map((skill) => {
-        const flag = skill.disableModelInvocation ? " (invoke only)" : "";
-        return `${skill.name}${flag}\n  ${skill.description}\n  ${skill.filePath}`;
-    })
-        .join("\n");
-}

package/dist/slop-tool.js

@@ -1,96 +0,0 @@
-/**
- * The `slop` tool — the gate, callable by the agent on itself.
- *
- * Read-only by construction: it analyses and reports, it never edits. That is
- * what makes it worth offering. A run that ends with "done" can be checked
- * against a list instead of a claim, and the list names a rule and a line, so
- * the agent can act on it before reporting rather than after being asked.
- *
- * It runs `scripts/slop.mjs` as a child process rather than importing it. The
- * script is the gate: it is what pre-commit runs and what CI would run, and a
- * second in-process implementation would be a different checker wearing the
- * same name. The contract is the CLI's own `--json` output.
- *
- * Defaults to the changed files. A whole-project scan takes a few seconds and
- * buries the one line the agent just wrote under 66 accepted findings, which is
- * the opposite of useful when the question is "did I introduce something".
- */
-import { spawnSync } from "node:child_process";
-import { join } from "node:path";
-import { defineTool } from "@netrodev/hxf-coding-agent";
-import { Type } from "typebox";
-/** Longest report handed back, so one call cannot flood the context. */
-const MAX_REPORT_CHARS = 6000;
-export const slopTool = defineTool({
-    name: "slop",
-    label: "slop",
-    description: "Check code against the project's slop gate: naming, comments, placeholder values, swallowed errors, and the LLM tells that appear in model-written code. Read-only. Use it before reporting a task finished; it returns each finding as a rule id, a line, and what is wrong, so a claim of clean code becomes something the user can verify. Defaults to the changed files; pass a path to narrow it.",
-    promptSnippet: "slop: naming, comment and placeholder findings for changed code",
-    parameters: Type.Object({
-        path: Type.Optional(Type.String({ description: "One file or directory, relative to the project root. Omit to scan the changed set." })),
-        changes: Type.Optional(Type.Boolean({ description: "Scan only files changed against the base ref. Default true when path is omitted." })),
-        base: Type.Optional(Type.String({ description: "Git ref for `changes`. Defaults to HEAD." })),
-    }),
-    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
-        const cwd = ctx.cwd ?? process.cwd();
-        const script = join(cwd, "scripts", "slop.mjs");
-        const args = [script, "--json"];
-        if (params.path !== undefined)
-            args.push(params.path);
-        else if (params.changes ?? true)
-            args.push("--changes");
-        if (params.base !== undefined)
-            args.push("--base", params.base);
-        const run = spawnSync("node", args, { cwd, encoding: "utf8", timeout: 120_000 });
-        // The gate reports "off" through its own switch, and its exit code carries
-        // meaning: 0 is advisory, 1 would be a strict failure this mode never asks
-        // for. An unparseable body is the failure to report, not the exit code.
-        let parsed;
-        try {
-            parsed = JSON.parse(run.stdout);
-        }
-        catch {
-            parsed = undefined;
-        }
-        if (!parsed) {
-            // A spawn that never started, or one the timeout killed, leaves `stdout`
-            // and `stderr` null and puts the reason in `error`/`signal` instead. Reading
-            // only the streams reported "no output" for both — the one message that
-            // tells the reader nothing, while the cause (`spawnSync node ENOENT`, a
-            // 120 s timeout) was right there and discarded.
-            const detail = (run.stderr || run.stdout || "").trim() || run.error?.message || (run.signal ? `killed by ${run.signal} (timed out after 120 s?)` : "no output");
-            return {
-                content: [{ type: "text", text: `slop gate produced no report: ${detail.slice(0, 400)}` }],
-                details: { error: detail.slice(0, 400) },
-            };
-        }
-        if (parsed.off) {
-            return {
-                content: [{ type: "text", text: "slop gate is off" }],
-                details: { off: true },
-            };
-        }
-        const files = parsed.files ?? {};
-        const lines = [];
-        let findings = 0;
-        for (const [file, list] of Object.entries(files)) {
-            lines.push(`${file}`);
-            for (const finding of list) {
-                findings += 1;
-                lines.push(`  ${finding.rule}  L${finding.line}  ${finding.message}`);
-            }
-        }
-        if (findings === 0) {
-            return {
-                content: [{ type: "text", text: "slop gate: no findings in the scanned files" }],
-                details: { files: Object.keys(files).length, findings: 0 },
-            };
-        }
-        const report = lines.join("\n").slice(0, MAX_REPORT_CHARS);
-        const tail = report.length < lines.join("\n").length ? "\n… truncated" : "";
-        return {
-            content: [{ type: "text", text: `${findings} finding${findings === 1 ? "" : "s"}:\n\n${report}${tail}` }],
-            details: { files: Object.keys(files).length, findings },
-        };
-    },
-});

package/dist/spend-cap.js

@@ -1,43 +0,0 @@
-export function createSpendCap(limit) {
-    let carried = 0;
-    let hit;
-    return {
-        limit,
-        close(cost) {
-            carried += cost;
-        },
-        total(liveCost) {
-            return carried + liveCost;
-        },
-        check(liveCost) {
-            if (limit === undefined || hit !== undefined)
-                return hit;
-            const spent = carried + liveCost;
-            // A carried total is a sum of doubles, so a session meant to land exactly
-            // on the limit can come out a few ulps over it (0.9 + 0.05 is already
-            // 0.9500000000000001) and fire a budget the user never overspent. A tenth
-            // of a nano-dollar is far below any charge the gateway reports, and it is
-            // what keeps "spent exactly the budget" from counting as over.
-            if (spent - limit > 1e-9)
-                hit = { spent, limit };
-            return hit;
-        },
-    };
-}
-/**
- * The sentence both modes say, so `--print` and the TUI cannot drift into two
- * different descriptions of the same stop.
- */
-export function spendCapMessage(spent, limit) {
-    return `stopped — spent $${spent.toFixed(4)} of a $${limit.toFixed(2)} budget.`;
-}
-/**
- * The refusal for a cap pointed at a model that declares no prices: every turn
- * reports $0, so the cap can never fire and only *looks* enforced. Refusing up
- * front is the honest version. Shared by both modes for the same reason.
- */
-export function unpricedBudgetMessage(modelLabel, stateDir) {
-    return (`--max-budget-usd needs a model with prices, and ${modelLabel} declares none ` +
-        `(its rates are zero, so every turn costs $0 and the budget would never fire). ` +
-        `Add a cost to that model in ${stateDir}/models.json, or drop the flag.`);
-}

package/dist/subagent.js

@@ -1,171 +0,0 @@
-import { Type } from "@netrodev/hxf-ai";
-import { defineTool } from "@netrodev/hxf-coding-agent";
-import { agents, MAX_TASKS_PER_CALL, drain, modelRef, spawn, startBackgroundDrain, summarizeRun } from "./agents.js";
-import { createAgentWorktree } from "./git.js";
-export { listRuns, runs, showRun } from "./agents.js";
-/** The agents a caller can name, as one clause. */
-function describeAgents() {
-    return [...agents.values()].map((agent) => `${agent.name} (${agent.description})`).join(", ");
-}
-/**
- * Build the `task` tool.
- *
- * A factory rather than a constant because the description has to list the
- * agents, and definition files are read after this module is imported. A
- * constant would advertise the four built-ins for the life of the process, so a
- * user's own agent would exist while the model was never told it is there —
- * which is the same as it not existing.
- */
-export function createTaskTool() {
-    return defineTool({
-        name: "task",
-        label: "task",
-        description: `Spawn subagents. Available: ${describeAgents()}. One call can carry tasks[]; each item may set agent, model, effort and isolation. Agents run concurrently, park when done, and can be resumed or messaged with /agents. Pass background: true to return as soon as they start instead of waiting for them. Use architect to design an approach before a large change. Set isolation: "worktree" on every task that writes files.`,
-        promptSnippet: "task: spawn background agents",
-        parameters: Type.Object({
-            agent: Type.Optional(Type.String()),
-            effort: Type.Optional(Type.String()),
-            model: Type.Optional(Type.String()),
-            task: Type.Optional(Type.String()),
-            /**
-             * `"worktree"` gives the tasks in this call their own checkouts. Off by
-             * default: a copy costs a directory and a `git worktree add`, which buys
-             * nothing for a read-only lookup.
-             */
-            isolation: Type.Optional(Type.String()),
-            /** Start them and return, instead of waiting for the results. */
-            background: Type.Optional(Type.Boolean()),
-            tasks: Type.Optional(Type.Array(Type.Object({
-                agent: Type.Optional(Type.String()),
-                effort: Type.Optional(Type.String()),
-                model: Type.Optional(Type.String()),
-                task: Type.String(),
-                isolation: Type.Optional(Type.String()),
-            }))),
-        }),
-        executionMode: "parallel",
-        async execute(_toolCallId, params, signal, onUpdate, ctx) {
-            const asked = params.tasks && params.tasks.length > 0
-                ? params.tasks.map((item) => ({
-                    agent: item.agent ?? params.agent ?? "task",
-                    task: item.task,
-                    effort: item.effort ?? params.effort,
-                    model: item.model ?? params.model,
-                    isolation: item.isolation ?? params.isolation,
-                }))
-                : [
-                    {
-                        agent: params.agent ?? "task",
-                        task: params.task ?? "",
-                        effort: params.effort,
-                        model: params.model,
-                        isolation: params.isolation,
-                    },
-                ];
-            // One call cannot queue more than the host can carry. Saying so beats
-            // silently dropping the extras, which would read as children that never ran.
-            const items = asked.slice(0, MAX_TASKS_PER_CALL);
-            const dropped = asked.length - items.length;
-            const background = Boolean(params.background);
-            const mine = [];
-            // One checkout per task, created before the run exists so `spawn` can be
-            // pointed at it. `openAgentSession` resolves `run.worktree || run.cwd`, so a
-            // run that never gets one behaves exactly as it did before this option.
-            //
-            // A task that asked for isolation and did not get it (not a git repository, or
-            // `worktree add` refused) still runs, in the shared tree. It has to: refusing
-            // would turn an unavailable optimisation into a failed task. The note says so,
-            // because a silent fallback to the shared tree is the collision this option
-            // exists to prevent, and the caller is the only one who can decide to retry.
-            const created = [];
-            const unisolated = [];
-            // Directories too large to copy into a worktree. Reported rather than left
-            // implicit: an agent that cannot install or build will otherwise report a pass it
-            // never checked, and the caller would have no way to know why.
-            const unshared = [];
-            try {
-                for (const item of items) {
-                    if (!item.task.trim())
-                        continue;
-                    let worktree;
-                    if (item.isolation === "worktree") {
-                        const made = await createAgentWorktree(ctx?.cwd ?? process.cwd(), item.agent);
-                        if (made) {
-                            created.push(made);
-                            worktree = made.path;
-                            for (const name of made.skipped)
-                                unshared.push(`${item.agent}:${name}`);
-                        }
-                        else {
-                            unisolated.push(item.agent);
-                        }
-                    }
-                    // The workspace the tool call runs in, so the child writes into the
-                    // session's project rather than the CLI process's own directory. The
-                    // parent's model rides along so a child that names none runs the model
-                    // the user is actually paying for, not the runtime's default.
-                    mine.push(await spawn({ ...item, cwd: ctx?.cwd, background, parentModel: modelRef(ctx?.model), worktree }));
-                    onUpdate?.({
-                        content: [],
-                        details: { agents: mine.map((run) => ({ id: run.id, agent: run.agent, status: run.status })) },
-                    });
-                }
-                if (mine.length === 0)
-                    throw new Error("task or tasks is required");
-                const overflow = dropped > 0 ? `(only the first ${MAX_TASKS_PER_CALL} of ${asked.length} tasks ran)` : "";
-                const isolated = mine.filter((run) => run.worktree).length;
-                const notes = [
-                    overflow,
-                    unisolated.length > 0 ? `isolation: "worktree" was requested but not available for: ${unisolated.join(", ")}. Those agents ran in the shared working tree — check their edits for collisions before trusting them.` : "",
-                    unshared.length > 0 ? `too large to copy into the isolated worktree, so it was left out: ${unshared.join(", ")}. An agent that needs it cannot install or build — treat any "done" from those runs as unverified.` : "",
-                ].filter(Boolean);
-                const details = {
-                    agents: mine.map((run) => ({ id: run.id, status: run.status, isolated: Boolean(run.worktree) })),
-                };
-                if (background) {
-                    // The pump is started, not awaited: this turn ends here and the session
-                    // is free for the next one. Each run announces itself through the
-                    // finished-run handler as it settles.
-                    startBackgroundDrain();
-                    const ids = mine.map((run) => `${run.agent}#${run.id}`).join(", ");
-                    return {
-                        content: [
-                            {
-                                type: "text",
-                                text: `started ${mine.length} agent${mine.length === 1 ? "" : "s"} in the background: ${ids}.` +
-                                    (isolated > 0 ? ` ${isolated} of them in their own worktree.` : "") +
-                                    "\nTheir results are not part of this turn — keep working. Read them with /agents, or message one with /agents <id> <text>." +
-                                    (notes.length > 0 ? `\n${notes.join("\n")}` : ""),
-                            },
-                        ],
-                        details,
-                    };
-                }
-                await drain(signal);
-                const parts = mine.map((run) => `${summarizeRun(run)}${run.worktree ? " [isolated]" : ""}\n${run.result ?? ""}`);
-                if (notes.length > 0)
-                    parts.push(notes.join("\n"));
-                return { content: [{ type: "text", text: parts.join("\n\n") }], details };
-            }
-            finally {
-                // The checkouts go when the call is done with them, successes and failures
-                // alike. A worktree left behind is invisible to the project's own
-                // `git status` (it lives in the temp dir) and would accumulate silently.
-                //
-                // Removal is safe here even though it looks like it discards work: a
-                // detached worktree holds no branch, so the only edits that exist are
-                // uncommitted ones, and they were made by an agent whose result is
-                // already in `run.result`. `createAgentWorktree` places the tree at HEAD,
-                // and the run's output — not the directory — is the deliverable.
-                for (const worktree of created) {
-                    try {
-                        await worktree.remove();
-                    }
-                    catch {
-                        // Never throws by contract, but a throw here must not mask the result.
-                    }
-                }
-            }
-        },
-    });
-}

package/dist/tar.js

@@ -1,146 +0,0 @@
-/**
- * A minimal tar reader.
- *
- * Presets are installed from a GitHub tarball, and Node ships `zlib` but not a
- * tar parser. Adding a dependency for this would put a third-party package on
- * the path that runs whenever a user installs a preset — a large amount of
- * trust for reading a format that has not changed since 1988. The subset below
- * is the whole of what GitHub emits: ustar headers, pax extended headers for
- * long paths, and GNU long-name entries.
- *
- * Nothing here writes to disk. `parseTar` returns entries and the caller decides
- * what to do with them, so the path rules are in one place and testable without
- * a filesystem.
- */
-import { gunzipSync } from "node:zlib";
-const BLOCK = 512;
-function readCString(buf, start, length) {
-    const slice = buf.subarray(start, start + length);
-    const end = slice.indexOf(0);
-    return slice
-        .subarray(0, end === -1 ? slice.length : end)
-        .toString("utf8")
-        .trim();
-}
-function readOctal(buf, start, length) {
-    const text = readCString(buf, start, length);
-    if (!text)
-        return 0;
-    const value = Number.parseInt(text, 8);
-    return Number.isFinite(value) ? value : 0;
-}
-/** Apply a pax extended header's records to the next entry. */
-function paxOverrides(data) {
-    const out = {};
-    let offset = 0;
-    while (offset < data.length) {
-        const space = data.indexOf(0x20, offset);
-        if (space === -1)
-            break;
-        const length = Number.parseInt(data.toString("utf8", offset, space), 10);
-        if (!Number.isFinite(length) || length <= 0)
-            break;
-        const record = data.toString("utf8", space + 1, offset + length - 1);
-        const eq = record.indexOf("=");
-        if (eq > 0)
-            out[record.slice(0, eq)] = record.slice(eq + 1);
-        offset += length;
-    }
-    return out;
-}
-/**
- * Parse a gzipped tar. Returns entries in archive order.
- *
- * The leading directory component is dropped, so paths are relative to the
- * repository root. GitHub names that component `<repo>-<sha>`, which would
- * otherwise have to be guessed by every caller.
- */
-export function parseTarGz(archive) {
-    const tar = gunzipSync(archive);
-    const entries = [];
-    let offset = 0;
-    let pendingName;
-    let pendingPax = {};
-    while (offset + BLOCK <= tar.length) {
-        const header = tar.subarray(offset, offset + BLOCK);
-        // Two zero blocks end the archive; a single one is enough to stop reading.
-        if (header.every((b) => b === 0))
-            break;
-        const name = readCString(header, 0, 100);
-        const prefix = readCString(header, 345, 155);
-        const size = readOctal(header, 124, 12);
-        const mode = readOctal(header, 100, 8);
-        const typeFlag = String.fromCharCode(header[156] ?? 0x30);
-        const linkName = readCString(header, 157, 100);
-        const data = size > 0 ? tar.subarray(offset + BLOCK, offset + BLOCK + size) : Buffer.alloc(0);
-        offset += BLOCK + Math.ceil(size / BLOCK) * BLOCK;
-        if (typeFlag === "x" || typeFlag === "g") {
-            pendingPax = paxOverrides(data);
-            continue;
-        }
-        if (typeFlag === "L") {
-            pendingName = data.toString("utf8").replace(/\0.*$/s, "").trim();
-            continue;
-        }
-        let full = pendingPax.path ?? pendingName ?? (prefix ? `${prefix}/${name}` : name);
-        pendingName = undefined;
-        pendingPax = {};
-        // Drop the archive's own root component: `<repo>-<sha>/…` → `…`
-        const slash = full.indexOf("/");
-        if (slash === -1)
-            continue;
-        full = full.slice(slash + 1);
-        // Tar marks a directory with a trailing slash. Normalising here means every
-        // consumer sees one spelling of a path: without this, a directory entry and a
-        // path comparison disagree (`reference/` vs `reference`), and `subtreeEntries`
-        // prefix matching has to guess which form it was given.
-        full = full.replace(/\/+$/, "");
-        if (!full)
-            continue;
-        const kind = typeFlag === "5" ? "directory" : typeFlag === "2" ? "symlink" : typeFlag === "0" || typeFlag === "\0" || typeFlag === "" ? "file" : "other";
-        entries.push({
-            path: full,
-            kind,
-            size,
-            mode: mode & 0o777,
-            ...(kind === "file" ? { data: Buffer.from(data) } : {}),
-            ...(kind === "symlink" ? { link: linkName } : {}),
-        });
-    }
-    return entries;
-}
-/**
- * True when a path from an archive may be written under a destination.
- *
- * A tarball is attacker-controlled once a preset points at someone else's
- * repository, and `../../.ssh/authorized_keys` is a valid tar path. Absolute
- * paths, any `..` component, and drive letters are all refused.
- */
-export function isSafeRelativePath(path) {
-    if (!path || path.startsWith("/") || path.startsWith("\\"))
-        return false;
-    if (/^[a-zA-Z]:/.test(path))
-        return false;
-    // A trailing slash marks a directory entry in tar; it is not an empty
-    // component. Dropping it is what makes `reference/` (which every archive
-    // contains) pass, while `a//b` still fails below.
-    const trimmed = path.replace(/\/+$/, "");
-    if (!trimmed)
-        return false;
-    const parts = trimmed.split("/");
-    return parts.every((part) => part !== "" && part !== "." && part !== "..");
-}
-/** Every entry under `subtree` (a repo-relative directory), with the prefix removed. */
-export function subtreeEntries(entries, subtree) {
-    const prefix = `${subtree.replace(/\/+$/, "")}/`;
-    const out = [];
-    for (const entry of entries) {
-        if (!entry.path.startsWith(prefix))
-            continue;
-        const path = entry.path.slice(prefix.length);
-        if (!path)
-            continue;
-        out.push({ ...entry, path });
-    }
-    return out;
-}