mu-agent 0.2.9 → 0.2.11

package/judge/mu/index.js

@@ -2687,9 +2687,9 @@ var require_dispatcher_base = __commonJS({
       }
       close(callback) {
         if (callback === void 0) {
-          return new Promise((resolve15, reject) => {
+          return new Promise((resolve16, reject) => {
             this.close((err, data) => {
-              return err ? reject(err) : resolve15(data);
+              return err ? reject(err) : resolve16(data);
             });
           });
         }
@@ -2727,9 +2727,9 @@ var require_dispatcher_base = __commonJS({
           err = null;
         }
         if (callback === void 0) {
-          return new Promise((resolve15, reject) => {
+          return new Promise((resolve16, reject) => {
             this.destroy(err, (err2, data) => {
-              return err2 ? reject(err2) : resolve15(data);
+              return err2 ? reject(err2) : resolve16(data);
             });
           });
         }
@@ -7686,12 +7686,12 @@ upgrade: ${upgrade}\r
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve15, reject) => {
+      const waitForDrain = () => new Promise((resolve16, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve15;
+          callback = resolve16;
         }
       });
       socket.on("close", onDrain).on("drain", onDrain);
@@ -9074,12 +9074,12 @@ var require_client_h2 = __commonJS({
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve15, reject) => {
+      const waitForDrain = () => new Promise((resolve16, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve15;
+          callback = resolve16;
         }
       });
       h2stream.on("close", onDrain).on("drain", onDrain);
@@ -9448,16 +9448,16 @@ var require_client = __commonJS({
         return this[kNeedDrain] < 2;
       }
       [kClose]() {
-        return new Promise((resolve15) => {
+        return new Promise((resolve16) => {
           if (this[kSize]) {
-            this[kClosedResolve] = resolve15;
+            this[kClosedResolve] = resolve16;
           } else {
-            resolve15(null);
+            resolve16(null);
           }
         });
       }
       [kDestroy](err) {
-        return new Promise((resolve15) => {
+        return new Promise((resolve16) => {
           const requests = this[kQueue].splice(this[kPendingIdx]);
           for (let i = 0; i < requests.length; i++) {
             const request = requests[i];
@@ -9470,7 +9470,7 @@ var require_client = __commonJS({
               this[kClosedResolve]();
               this[kClosedResolve] = null;
             }
-            resolve15(null);
+            resolve16(null);
           };
           if (this[kHTTPContext]) {
             this[kHTTPContext].destroy(err, callback);
@@ -9883,8 +9883,8 @@ var require_pool_base = __commonJS({
           }
           return Promise.all(closeAll);
         } else {
-          return new Promise((resolve15) => {
-            this[kClosedResolve] = resolve15;
+          return new Promise((resolve16) => {
+            this[kClosedResolve] = resolve16;
           });
         }
       }
@@ -12547,7 +12547,7 @@ var require_readable = __commonJS({
         if (this._readableState.closeEmitted) {
           return Promise.resolve(null);
         }
-        return new Promise((resolve15, reject) => {
+        return new Promise((resolve16, reject) => {
           if (this[kContentLength] && this[kContentLength] > limit || this[kBytesRead] > limit) {
             this.destroy(new AbortError());
           }
@@ -12561,11 +12561,11 @@ var require_readable = __commonJS({
               if (signal.aborted) {
                 reject(signal.reason ?? new AbortError());
               } else {
-                resolve15(null);
+                resolve16(null);
               }
             });
           } else {
-            this.on("close", resolve15);
+            this.on("close", resolve16);
           }
           this.on("error", noop).on("data", () => {
             if (this[kBytesRead] > limit) {
@@ -12593,7 +12593,7 @@ var require_readable = __commonJS({
     }
     function consume(stream, type) {
       assert(!stream[kConsume]);
-      return new Promise((resolve15, reject) => {
+      return new Promise((resolve16, reject) => {
         if (isUnusable(stream)) {
           const rState = stream._readableState;
           if (rState.destroyed && rState.closeEmitted === false) {
@@ -12608,7 +12608,7 @@ var require_readable = __commonJS({
             stream[kConsume] = {
               type,
               stream,
-              resolve: resolve15,
+              resolve: resolve16,
               reject,
               length: 0,
               body: []
@@ -12686,18 +12686,18 @@ var require_readable = __commonJS({
       return buffer;
     }
     function consumeEnd(consume2, encoding) {
-      const { type, body, resolve: resolve15, stream, length } = consume2;
+      const { type, body, resolve: resolve16, stream, length } = consume2;
       try {
         if (type === "text") {
-          resolve15(chunksDecode(body, length, encoding));
+          resolve16(chunksDecode(body, length, encoding));
         } else if (type === "json") {
-          resolve15(JSON.parse(chunksDecode(body, length, encoding)));
+          resolve16(JSON.parse(chunksDecode(body, length, encoding)));
         } else if (type === "arrayBuffer") {
-          resolve15(chunksConcat(body, length).buffer);
+          resolve16(chunksConcat(body, length).buffer);
         } else if (type === "blob") {
-          resolve15(new Blob(body, { type: stream[kContentType] }));
+          resolve16(new Blob(body, { type: stream[kContentType] }));
         } else if (type === "bytes") {
-          resolve15(chunksConcat(body, length));
+          resolve16(chunksConcat(body, length));
         }
         consumeFinish(consume2);
       } catch (err) {
@@ -12916,9 +12916,9 @@ var require_api_request = __commonJS({
     };
     function request(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve15, reject) => {
+        return new Promise((resolve16, reject) => {
           request.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve15(data);
+            return err ? reject(err) : resolve16(data);
           });
         });
       }
@@ -13179,9 +13179,9 @@ var require_api_stream = __commonJS({
     };
     function stream(opts, factory, callback) {
       if (callback === void 0) {
-        return new Promise((resolve15, reject) => {
+        return new Promise((resolve16, reject) => {
           stream.call(this, opts, factory, (err, data) => {
-            return err ? reject(err) : resolve15(data);
+            return err ? reject(err) : resolve16(data);
           });
         });
       }
@@ -13481,9 +13481,9 @@ var require_api_upgrade = __commonJS({
     };
     function upgrade(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve15, reject) => {
+        return new Promise((resolve16, reject) => {
           upgrade.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve15(data);
+            return err ? reject(err) : resolve16(data);
           });
         });
       }
@@ -13577,9 +13577,9 @@ var require_api_connect = __commonJS({
     };
     function connect2(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve15, reject) => {
+        return new Promise((resolve16, reject) => {
           connect2.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve15(data);
+            return err ? reject(err) : resolve16(data);
           });
         });
       }
@@ -15046,7 +15046,7 @@ var require_snapshot_recorder = __commonJS({
   "node_modules/undici/lib/mock/snapshot-recorder.js"(exports, module) {
     "use strict";
     var { writeFile: writeFile7, readFile: readFile8, mkdir: mkdir2 } = __require("node:fs/promises");
-    var { dirname: dirname13, resolve: resolve15 } = __require("node:path");
+    var { dirname: dirname13, resolve: resolve16 } = __require("node:path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("node:timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -15262,7 +15262,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         try {
-          const data = await readFile8(resolve15(path), "utf8");
+          const data = await readFile8(resolve16(path), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -15291,7 +15291,7 @@ var require_snapshot_recorder = __commonJS({
         if (!path) {
           throw new InvalidArgumentError("Snapshot path is required");
         }
-        const resolvedPath = resolve15(path);
+        const resolvedPath = resolve16(path);
         await mkdir2(dirname13(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash, snapshot2]) => ({
           hash,
@@ -22955,7 +22955,7 @@ var require_fetch = __commonJS({
         const hasTrailingQuestionMark = url.search.length === 0 && url.href[url.href.length - url.hash.length - 1] === "?";
         return dispatchWithProtocolPreference(body);
         function dispatchWithProtocolPreference(body2, allowH2) {
-          return new Promise((resolve15, reject) => agent.dispatch(
+          return new Promise((resolve16, reject) => agent.dispatch(
             {
               path: hasTrailingQuestionMark ? `${path}?` : path,
               origin: url.origin,
@@ -23038,7 +23038,7 @@ var require_fetch = __commonJS({
                   }
                 }
                 const onError = (err) => this.onResponseError(controller, err);
-                resolve15({
+                resolve16({
                   status,
                   statusText,
                   headersList,
@@ -23071,7 +23071,7 @@ var require_fetch = __commonJS({
                   fetchParams.controller.off("terminated", this.abort);
                 }
                 if (request.mode === "websocket" && allowH2 !== false && error?.code === "UND_ERR_INFO" && error?.message === "HTTP/2: Extended CONNECT protocol not supported by server") {
-                  resolve15(dispatchWithProtocolPreference(body2, false));
+                  resolve16(dispatchWithProtocolPreference(body2, false));
                   return;
                 }
                 this.body?.destroy(error);
@@ -23088,7 +23088,7 @@ var require_fetch = __commonJS({
                 const rawHeaders = controller?.rawHeaders ?? [];
                 const headersList = new HeadersList();
                 appendHeadersListFromResponseHeaders(headersList, headers, rawHeaders);
-                resolve15({
+                resolve16({
                   status,
                   statusText: STATUS_CODES[status],
                   headersList,
@@ -31157,8 +31157,8 @@ var KyrnRuntime = class {
     let timer;
     return Promise.race([
       work,
-      new Promise((resolve15) => {
-        timer = setTimeout(() => resolve15(void 0), left);
+      new Promise((resolve16) => {
+        timer = setTimeout(() => resolve16(void 0), left);
       })
     ]).finally(() => {
       if (timer) clearTimeout(timer);
@@ -31276,8 +31276,8 @@ function within(work, waitMs) {
   let timer;
   return Promise.race([
     work,
-    new Promise((resolve15) => {
-      timer = setTimeout(() => resolve15(void 0), waitMs);
+    new Promise((resolve16) => {
+      timer = setTimeout(() => resolve16(void 0), waitMs);
     })
   ]).finally(() => {
     if (timer) clearTimeout(timer);
@@ -31924,14 +31924,14 @@ var JobManager = class {
       scanFrom = offset;
       return void 0;
     };
-    return new Promise((resolve15) => {
+    return new Promise((resolve16) => {
       let timer;
       const settle = (result) => {
         if (timer) clearTimeout(timer);
         job.listeners.delete(check);
         request.signal?.removeEventListener("abort", onAbort);
         job.waiting--;
-        resolve15(result);
+        resolve16(result);
       };
       const check = () => {
         const line3 = scan2();
@@ -31969,13 +31969,13 @@ var JobManager = class {
   }
   /** Polls a condition that a job's end may change; resolves to whether it came true in time. */
   until(job, condition, timeoutMs) {
-    return new Promise((resolve15) => {
-      if (condition()) return resolve15(true);
+    return new Promise((resolve16) => {
+      if (condition()) return resolve16(true);
       const startedAt = Date.now();
       const done = (result) => {
         clearInterval(poll);
         job.listeners.delete(check);
-        resolve15(result);
+        resolve16(result);
       };
       const check = () => {
         if (condition()) done(true);
@@ -33000,6 +33000,10 @@ var BoardProjects = class {
   }
 };
 
+// packages/kyrn-judge/src/checkpoint/mutating.ts
+import { realpathSync } from "node:fs";
+import { isAbsolute as isAbsolute2, resolve as resolve3 } from "node:path";
+
 // packages/kyrn-judge/src/extension/shell-tools.ts
 var SHELL_TOOLS = /* @__PURE__ */ new Set(["bash", "powershell"]);
 function isShellTool(toolName) {
@@ -33023,7 +33027,7 @@ var READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
 ]);
 var SHELL_TRICKS = /[<>;&`\n\r]|\$\(|\$\{/;
 var POWERSHELL_TRICKS = /[(){}]/;
-var READ_ONLY_PROGRAM = /^(?:ls|pwd|cat|head|tail|wc|which|file|stat|du|df|date|whoami|uname|echo|printf|rg|grep|sort|uniq|cut|nl|tree|git\s+(?:status|log|diff|show|blame|rev-parse|ls-files|describe)|Get-ChildItem|gci|dir|Get-Content|gc|type|Get-Location|Select-String|sls|Get-Item|gi|Get-Date|Write-Output|Write-Host)(?:\s|$)/i;
+var READ_ONLY_PROGRAM = /^(?:ls|pwd|cat|head|tail|wc|which|file|stat|du|df|date|whoami|uname|echo|printf|rg|grep|sort|uniq|cut|nl|tree|git|Get-ChildItem|gci|dir|Get-Content|gc|type|Get-Location|Select-String|sls|Get-Item|gi|Get-Date|Write-Output|Write-Host)(?:\s|$)/i;
 var WRITES_OR_RUNS = /* @__PURE__ */ new Map([
   // ripgrep runs `--pre` on every file it searches, and `--hostname-bin` for its links.
   ["rg", /(?:^|\s)--(?:pre|hostname-bin)(?:[\s=]|$)/],
@@ -33048,21 +33052,145 @@ function longOption(words2, option, shortest = 1) {
     return name.length >= shortest && option.startsWith(name);
   });
 }
-function readOnlyProgram(piece) {
+var GIT_READS = /* @__PURE__ */ new Set([
+  "status",
+  "log",
+  "diff",
+  "show",
+  "blame",
+  "rev-parse",
+  "ls-files",
+  "describe",
+  "shortlog",
+  "rev-list",
+  "ls-tree",
+  "cat-file",
+  "merge-base",
+  "name-rev",
+  "for-each-ref",
+  "show-ref",
+  "diff-tree",
+  "diff-index",
+  "diff-files",
+  "grep",
+  "version"
+]);
+var GIT_LISTS = /* @__PURE__ */ new Map([
+  [
+    "branch",
+    {
+      long: /* @__PURE__ */ new Set([
+        "show-current",
+        "list",
+        "all",
+        "remotes",
+        "verbose",
+        "contains",
+        "no-contains",
+        "merged",
+        "no-merged",
+        "points-at",
+        "sort",
+        "format",
+        "color",
+        "no-color",
+        "column",
+        "no-column",
+        "abbrev",
+        "no-abbrev",
+        "ignore-case",
+        "omit-empty"
+      ]),
+      short: /^-[ailrv]+$/,
+      listing: /^(?:--(?:list|contains|no-contains|merged|no-merged|points-at)(?:=|$)|-[ailrv]*l)/
+    }
+  ],
+  [
+    "tag",
+    {
+      long: /* @__PURE__ */ new Set([
+        "list",
+        "contains",
+        "no-contains",
+        "merged",
+        "no-merged",
+        "points-at",
+        "sort",
+        "format",
+        "color",
+        "no-color",
+        "column",
+        "no-column",
+        "ignore-case",
+        "omit-empty"
+      ]),
+      // `-v` is not here: it verifies a tag with the program the config names.
+      short: /^-(?:[il]+|n\d*)$/,
+      listing: /^(?:--(?:list|contains|no-contains|merged|no-merged|points-at)(?:=|$)|-i*l|-n)/
+    }
+  ]
+]);
+var CONFIG_SHOWS = /^(?:--(?:global|system|local|worktree|file|blob|show-origin|show-scope|name-only|null|includes|no-includes|type|bool|int|bool-or-int|path|expiry-date|default)(?:=|$)|-z$)/;
+var CONFIG_GETS = /^(?:--(?:get|get-all|get-regexp|get-urlmatch|list)|-l)$/;
+function readOnlyGit(args) {
+  let at = 0;
+  while (/^(?:-P|--no-pager|--no-optional-locks)$/.test(args[at] ?? "")) at++;
+  const [command, ...rest] = args.slice(at);
+  if (command === "--version") return rest.length === 0;
+  if (command === "grep") {
+    return !rest.some((arg) => /^-[a-zA-Z]*O/.test(arg)) && !longOption(rest, "open-files-in-pager");
+  }
+  if (command !== void 0 && GIT_READS.has(command)) return true;
+  const list4 = command === void 0 ? void 0 : GIT_LISTS.get(command);
+  if (list4) {
+    let named = false;
+    for (const arg of rest) {
+      if (arg.startsWith("--")) {
+        if (!list4.long.has(arg.slice(2).split("=")[0])) return false;
+      } else if (arg.startsWith("-")) {
+        if (!list4.short.test(arg)) return false;
+      } else named = true;
+    }
+    return !named || rest.some((arg) => list4.listing.test(arg));
+  }
+  if (command === "stash") return rest[0] === "list" || rest[0] === "show";
+  if (command === "worktree") return rest[0] === "list";
+  if (command === "remote") return rest[0] === "get-url" || rest.every((arg) => arg === "-v" || arg === "--verbose");
+  if (command === "config") {
+    if (rest[0] === "get" || rest[0] === "list") return true;
+    const names = rest.filter((arg) => !arg.startsWith("-")).length;
+    return rest.every((arg) => !arg.startsWith("-") || CONFIG_GETS.test(arg) || CONFIG_SHOWS.test(arg)) && (rest.some((arg) => CONFIG_GETS.test(arg)) || names === 1);
+  }
+  return false;
+}
+function readOnlyProgram(piece, elsewhere = false) {
   if (!READ_ONLY_PROGRAM.test(piece)) return false;
   const words2 = piece.split(/\s+/);
   if (longOption(words2, "output")) return false;
   const program = words2[0].toLowerCase();
+  if (program === "git") return !elsewhere && readOnlyGit(words2.slice(1));
   if (program === "uniq") return !uniqWrites(words2);
   if (program === "sort" && longOption(words2, "compress-program", 2)) return false;
   if (program === "file" && longOption(words2, "compile", 2)) return false;
   return !WRITES_OR_RUNS.get(program)?.test(piece);
 }
-function isReadOnlyCommand(command, powershell = false) {
+function samePlace(dir, cwd) {
+  if (resolve3(dir) === resolve3(cwd)) return true;
+  try {
+    return realpathSync.native(dir) === realpathSync.native(cwd);
+  } catch {
+    return false;
+  }
+}
+function startsElsewhere(cwd, start) {
+  return cwd !== void 0 && start !== void 0 && !samePlace(start, cwd);
+}
+function isReadOnlyCommand(command, powershell = false, cwd, start = cwd) {
   const text9 = command.trim();
   if (!text9 || SHELL_TRICKS.test(text9) || /--output\b/.test(text9)) return false;
   if (powershell && POWERSHELL_TRICKS.test(text9)) return false;
-  return text9.split("|").every((part) => readOnlyProgram(part.trim()));
+  const elsewhere = startsElsewhere(cwd, start);
+  return text9.split("|").every((part) => readOnlyProgram(part.trim(), elsewhere));
 }
 var FIND_ACTS = /^-(?:delete|exec|ok|fprint|fls)/;
 function harmlessRedirect(text9, at, both) {
@@ -33158,28 +33286,31 @@ function simpleCommands(text9) {
   endCommand();
   return commands;
 }
-function isReadOnlyChain(command, powershell = false) {
-  if (powershell) return isReadOnlyCommand(command, true);
+function isReadOnlyChain(command, powershell = false, cwd, start = cwd) {
+  if (powershell) return isReadOnlyCommand(command, true, cwd, start);
   const commands = simpleCommands(command.trim());
   if (!commands?.some((words2) => words2.length > 0)) return false;
-  let moved = false;
+  let elsewhere = startsElsewhere(cwd, start);
   return commands.every((words2) => {
     const [program] = words2;
     if (program === void 0 || program === "true" || program === "false" || program === ":") return true;
     if (program === "cd") {
-      moved = true;
+      const [, to, ...more] = words2;
+      elsewhere = cwd === void 0 || to === void 0 || more.length > 0 || !isAbsolute2(to) || /[$*?[~]/.test(to) || to.split(/[\\/]/).includes("..") || !samePlace(to, cwd);
       return true;
     }
     if (program === "find") return !words2.some((word) => FIND_ACTS.test(word));
-    if (moved && program.toLowerCase() === "git") return false;
-    return readOnlyProgram(words2.join(" "));
+    return readOnlyProgram(words2.join(" "), elsewhere);
   });
 }
-function isMutatingCall(toolName, input) {
+function isMutatingCall(toolName, input, cwd) {
   if (READ_ONLY_TOOLS.has(toolName)) return false;
-  if (isShellTool(toolName)) return !isReadOnlyChain(String(input.command ?? ""), toolName === "powershell");
+  if (isShellTool(toolName)) return !isReadOnlyChain(String(input.command ?? ""), toolName === "powershell", cwd);
   return true;
 }
+function shellStart(toolName, input, cwd) {
+  return toolName === "bg_start" && typeof input.cwd === "string" && input.cwd ? resolve3(cwd, input.cwd) : cwd;
+}
 var CHECK_COMMAND = /\b(?:vitest|jest|pytest|mocha|ava|tsc|eslint|biome|ruff|mypy|rspec|phpunit|ctest|tox|nox|gradle|mvn)\b|\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|build|check|lint|typecheck)\b|\b(?:cargo|go|dotnet|swift|make|deno)\s+(?:test|build|check|vet|clippy)\b|\bnode\b[^\n]*--test\b|\btest\.sh\b/;
 function isCheckCommand(command) {
   return CHECK_COMMAND.test(command);
@@ -34169,11 +34300,10 @@ function describeCall2(toolName, input) {
   const body = text9(record4.content) || text9(record4.newText) || text9(record4.new_string) || text9(record4.rewrite);
   return clip(`${path}${body ? ` <- ${body}` : ""}` || JSON.stringify(record4), 500);
 }
-function readOnlyShell(toolName, input) {
+function readOnlyShell(toolName, input, cwd) {
   if (!isShellTool(toolName) && toolName !== "bg_start") return false;
-  const command = input?.command;
   const powershell = toolName === "powershell" || toolName === "bg_start" && process.platform === "win32";
-  return typeof command === "string" && isReadOnlyChain(command, powershell);
+  return typeof input.command === "string" && isReadOnlyChain(input.command, powershell, cwd, shellStart(toolName, input, cwd));
 }
 function registerConstraints(runtime) {
   const options = runtime.options("constraints", {
@@ -34189,7 +34319,7 @@ function registerConstraints(runtime) {
     failOpen(async (event, ctx) => {
       runtime.touch(ctx);
       if (!MUTATING.has(event.toolName)) return void 0;
-      if (options.skipReadOnly && readOnlyShell(event.toolName, event.input)) return void 0;
+      if (options.skipReadOnly && readOnlyShell(event.toolName, event.input, ctx.cwd)) return void 0;
       const constraints = (runtime.frame?.constraints ?? []).slice(-options.maxConstraints).map((entry) => entry.text);
       const mode = runtime.mode(toolConstraint.id);
       if (constraints.length === 0 || mode === "off") return void 0;
@@ -34201,7 +34331,7 @@ function registerConstraints(runtime) {
       }
       const decision = await Promise.race([
         runtime.engine.decide(toolConstraint, input, { signal: ctx.signal }),
-        new Promise((resolve15) => setTimeout(() => resolve15(void 0), options.waitMs))
+        new Promise((resolve16) => setTimeout(() => resolve16(void 0), options.waitMs))
       ]);
       if (!decision || decision.mode !== "active" || decision.source !== "judge") return void 0;
       const broken = decision.outcome.broken.map((index) => constraints[index]).filter(Boolean);
@@ -35688,9 +35818,9 @@ function isLoopbackUrl(url) {
   if (host2 === "localhost" || host2.endsWith(".localhost")) return true;
   return isIP(host2) !== 0 && classifyAddress(host2) === "loopback";
 }
-function checkedLookup(policy, resolve15 = dnsLookup) {
+function checkedLookup(policy, resolve16 = dnsLookup) {
   return (hostname, options, callback) => {
-    resolve15(hostname, { ...options, all: true }, (error, answer) => {
+    resolve16(hostname, { ...options, all: true }, (error, answer) => {
       if (error) return callback(error);
       const addresses = Array.isArray(answer) ? answer : [];
       if (addresses.length === 0) return callback(new FetchRefusal("dns", `${hostname} has no address`));
@@ -35734,8 +35864,8 @@ var Bounds = class {
   start;
   resolve;
   places = /* @__PURE__ */ new Map();
-  constructor(start, resolve15 = systemResolve) {
-    this.resolve = resolve15;
+  constructor(start, resolve16 = systemResolve) {
+    this.resolve = resolve16;
     let parsed;
     try {
       parsed = new URL(start);
@@ -35928,7 +36058,7 @@ var SNAPSHOT_SCRIPT = String.raw`(() => {
 // packages/kyrn-judge/src/browser/session.ts
 var StalePage = class extends Error {
 };
-var sleep = (ms) => new Promise((resolve15) => setTimeout(resolve15, ms));
+var sleep = (ms) => new Promise((resolve16) => setTimeout(resolve16, ms));
 var same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 var BrowserSession = class _BrowserSession {
   /** The address this tab was opened on: where the run was asked to go, before any page sent it elsewhere. */
@@ -36313,7 +36443,7 @@ var CdpConnection = class _CdpConnection {
     socket.addEventListener("error", () => this.failAll("The browser connection failed"));
   }
   static connect(url, timeoutMs = 5e3) {
-    return new Promise((resolve15, reject) => {
+    return new Promise((resolve16, reject) => {
       const socket = new WebSocket(url);
       const timer = setTimeout(() => {
         socket.close();
@@ -36321,7 +36451,7 @@ var CdpConnection = class _CdpConnection {
       }, timeoutMs);
       socket.addEventListener("open", () => {
         clearTimeout(timer);
-        resolve15(new _CdpConnection(socket));
+        resolve16(new _CdpConnection(socket));
       });
       socket.addEventListener("error", () => {
         clearTimeout(timer);
@@ -36356,7 +36486,7 @@ var CdpConnection = class _CdpConnection {
   send(method, params = {}, sessionId, timeoutMs = 3e4) {
     if (this.closed) return Promise.reject(new CdpError("The browser connection is closed"));
     const id = this.nextId++;
-    return new Promise((resolve15, reject) => {
+    return new Promise((resolve16, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         reject(new CdpError(`The browser did not answer ${method} within ${Math.round(timeoutMs / 1e3)}s`));
@@ -36364,7 +36494,7 @@ var CdpConnection = class _CdpConnection {
       this.pending.set(id, {
         resolve: (value) => {
           clearTimeout(timer);
-          resolve15(value);
+          resolve16(value);
         },
         reject: (error) => {
           clearTimeout(timer);
@@ -36638,11 +36768,11 @@ async function isAlive(endpoint) {
 }
 function exitOf(child, ms) {
   if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve();
-  return new Promise((resolve15) => {
-    const timer = setTimeout(resolve15, ms);
+  return new Promise((resolve16) => {
+    const timer = setTimeout(resolve16, ms);
     child.once("exit", () => {
       clearTimeout(timer);
-      resolve15();
+      resolve16();
     });
   });
 }
@@ -36684,7 +36814,7 @@ async function launchChrome(options = {}) {
         code: "browser_exited_on_start",
         params: { exitCode: child.exitCode }
       });
-    await new Promise((resolve15) => setTimeout(resolve15, 100));
+    await new Promise((resolve16) => setTimeout(resolve16, 100));
   }
   child.kill();
   await exitOf(child, 5e3);
@@ -36787,7 +36917,7 @@ var EmbeddedBrowser = class _EmbeddedBrowser {
       const state = await this.control();
       if (state.stop) return false;
       if (!state.paused) return true;
-      await new Promise((resolve15) => setTimeout(resolve15, pollMs));
+      await new Promise((resolve16) => setTimeout(resolve16, pollMs));
     }
   }
 };
@@ -37527,7 +37657,7 @@ ${result.stdout}`))
   };
 }
 function spawnOnce(binary, timeoutMs, args, env, input, limit) {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     let child;
     try {
       child = spawn4(binary, [...args], { env: { ...env }, windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
@@ -37563,10 +37693,10 @@ function spawnOnce(binary, timeoutMs, args, env, input, limit) {
     child.on("close", (code) => {
       clearTimeout(timer);
       if (truncated) {
-        resolve15({ code: 0, stdout: Buffer.concat(out).toString("utf8"), stderr: "", truncated: true });
+        resolve16({ code: 0, stdout: Buffer.concat(out).toString("utf8"), stderr: "", truncated: true });
         return;
       }
-      resolve15({
+      resolve16({
         code: timedOut ? TIMED_OUT : code ?? 1,
         stdout: Buffer.concat(out).toString("utf8"),
         stderr: timedOut ? `timed out after ${timeoutMs} ms` : Buffer.concat(err).toString("utf8")
@@ -37611,14 +37741,14 @@ import {
   mkdirSync as mkdirSync8,
   readdirSync as readdirSync2,
   readFileSync as readFileSync9,
-  realpathSync,
+  realpathSync as realpathSync2,
   rmdirSync,
   rmSync as rmSync5,
   statSync as statSync6,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { basename as basename3, dirname as dirname4, isAbsolute as isAbsolute2, join as join17, relative, resolve as resolve3, sep } from "node:path";
+import { basename as basename3, dirname as dirname4, isAbsolute as isAbsolute3, join as join17, relative, resolve as resolve4, sep } from "node:path";
 var BUILT_IN_IGNORES = [
   "node_modules/",
   "bower_components/",
@@ -37696,7 +37826,7 @@ var SnapshotTooLarge = class extends Error {
 function projectKey(root) {
   let real2 = root;
   try {
-    real2 = realpathSync.native(root);
+    real2 = realpathSync2.native(root);
   } catch {
   }
   return createHash3("sha256").update(real2).digest("hex").slice(0, 16);
@@ -37715,9 +37845,9 @@ function isSafePath(path) {
 }
 var onDisk = (store, path) => join17(store.root, ...path.split("/"));
 function realPath(path) {
-  const absolute3 = resolve3(path);
+  const absolute3 = resolve4(path);
   try {
-    return realpathSync.native(absolute3);
+    return realpathSync2.native(absolute3);
   } catch {
     const parent = dirname4(absolute3);
     return parent === absolute3 ? absolute3 : join17(realPath(parent), basename3(absolute3));
@@ -37725,7 +37855,7 @@ function realPath(path) {
 }
 function inside(outer, inner) {
   const rel = relative(realPath(outer), realPath(inner));
-  return rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute2(rel) ? void 0 : rel;
+  return rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute3(rel) ? void 0 : rel;
 }
 function isWithin(outer, inner) {
   return inside(outer, inner) !== void 0;
@@ -38314,7 +38444,7 @@ function registerCheckpoint(runtime, roots, deps = {}) {
         };
       }
       pending = void 0;
-      const mutating = isMutatingCall(event.toolName, event.input);
+      const mutating = isMutatingCall(event.toolName, event.input, ctx.cwd);
       calls.set(event.toolCallId, { name: event.toolName, input: event.input, mutating });
       if (mutating) turn.changed = true;
       if (!mutating || off || turn.checkpoint || turn.snapshotFailed) return void 0;
@@ -38407,8 +38537,8 @@ function registerCheckpoint(runtime, roots, deps = {}) {
     let body = `Abandoned because: ${reason}`;
     const writer = runtime.writer();
     if (writer && turn.steps.length > 0) {
-      const timeout = new Promise((resolve15) => {
-        setTimeout(() => resolve15(void 0), 8e3).unref?.();
+      const timeout = new Promise((resolve16) => {
+        setTimeout(() => resolve16(void 0), 8e3).unref?.();
       });
       const reply = await Promise.race([
         writer({
@@ -38752,8 +38882,8 @@ The agent will then start over from your request, with a note about what didn't
       const wasBusy = busy > 0;
       await Promise.race([
         chain,
-        new Promise((resolve15) => {
-          setTimeout(resolve15, 3e3).unref?.();
+        new Promise((resolve16) => {
+          setTimeout(resolve16, 3e3).unref?.();
         })
       ]);
       if (store) releaseLocks(store, wasBusy && busy > 0 ? 0 : 12e4);
@@ -41038,8 +41168,8 @@ function registerFrame(runtime) {
       let timer;
       const late = await Promise.race([
         ask.pending.then(() => false),
-        new Promise((resolve15) => {
-          timer = setTimeout(() => resolve15(true), Math.max(0, options.waitMs - (Date.now() - ask.startedAt)));
+        new Promise((resolve16) => {
+          timer = setTimeout(() => resolve16(true), Math.max(0, options.waitMs - (Date.now() - ask.startedAt)));
         })
       ]);
       if (timer) clearTimeout(timer);
@@ -41891,7 +42021,7 @@ async function pkce() {
   return { verifier, challenge: base64url(new Uint8Array(digest2)) };
 }
 function listen(config, state) {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     let settle = () => {
     };
     const wait = new Promise((done) => {
@@ -41938,7 +42068,7 @@ function listen(config, state) {
     server.listen(
       config.callbackPort,
       config.callbackHost,
-      () => resolve15({ server, wait, cancel: () => settle(void 0) })
+      () => resolve16({ server, wait, cancel: () => settle(void 0) })
     );
   });
 }
@@ -42031,7 +42161,7 @@ async function geminiProject(config, token, interaction) {
   if (!started.ok) throw new Error(`onboardUser failed (${started.status}): ${(await started.text()).slice(0, 300)}`);
   let operation = await started.json();
   for (let attempt = 0; !operation.done && operation.name && attempt < 60; attempt++) {
-    await new Promise((resolve15) => setTimeout(resolve15, attempt === 0 ? 1e3 : 5e3));
+    await new Promise((resolve16) => setTimeout(resolve16, attempt === 0 ? 1e3 : 5e3));
     const polled = await fetch(`${endpoint}/v1internal/${operation.name}`, { headers, signal: interaction.signal });
     if (!polled.ok) throw new Error(`Setting up the project failed (${polled.status})`);
     operation = await polled.json();
@@ -42911,7 +43041,7 @@ function gitArgs(args, platform = process.platform) {
   ];
 }
 var INHERITED = ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_COMMON_DIR", "GIT_PREFIX"];
-var spawnGit2 = (args, options) => new Promise((resolve15) => {
+var spawnGit2 = (args, options) => new Promise((resolve16) => {
   const env = { ...process.env };
   for (const name of INHERITED) delete env[name];
   Object.assign(env, { LC_ALL: "C", LANGUAGE: "C", GIT_TERMINAL_PROMPT: "0" }, options.env);
@@ -42928,7 +43058,7 @@ var spawnGit2 = (args, options) => new Promise((resolve15) => {
       signal: options.signal
     });
   } catch (error) {
-    resolve15({ code: -1, stdout: Buffer.alloc(0), stderr: String(error), missing: true });
+    resolve16({ code: -1, stdout: Buffer.alloc(0), stderr: String(error), missing: true });
     return;
   }
   child.stdout?.on("data", (chunk) => out.push(chunk));
@@ -42936,9 +43066,9 @@ var spawnGit2 = (args, options) => new Promise((resolve15) => {
     stderr = (stderr + chunk.toString("utf8")).slice(-8e3);
   });
   child.on("error", (error) => {
-    resolve15({ code: -1, stdout: Buffer.concat(out), stderr: error.message, missing: error.code === "ENOENT" });
+    resolve16({ code: -1, stdout: Buffer.concat(out), stderr: error.message, missing: error.code === "ENOENT" });
   });
-  child.on("close", (code) => resolve15({ code: code ?? -1, stdout: Buffer.concat(out), stderr }));
+  child.on("close", (code) => resolve16({ code: code ?? -1, stdout: Buffer.concat(out), stderr }));
   child.stdin?.on("error", () => void 0);
   child.stdin?.end(options.input);
 });
@@ -43982,7 +44112,7 @@ var spawnRunner = async (task, assignment, signal, env, observer) => {
     await writeFile2(promptPath, assignment.agent.systemPrompt, { encoding: "utf8", mode: 384 });
   }
   try {
-    return await new Promise((resolve15, reject) => {
+    return await new Promise((resolve16, reject) => {
       const invocation = piInvocation(childArgs(task, assignment, promptPath));
       const child = spawn6(invocation.command, invocation.args, {
         // An isolated sub-agent works in its own checkout; everyone else where the parent is.
@@ -44019,7 +44149,7 @@ var spawnRunner = async (task, assignment, signal, env, observer) => {
         finished = true;
         signal?.removeEventListener("abort", onAbort);
         if (error) reject(error);
-        else resolve15(lastText.trim());
+        else resolve16(lastText.trim());
       };
       const onAbort = () => {
         terminate();
@@ -44766,7 +44896,7 @@ ${lines3.join("\n")}`);
         return void 0;
       }
       if (lastCalled || !options.lastCall) return void 0;
-      await Promise.race([queue, new Promise((resolve15) => setTimeout(resolve15, LAST_CALL_WAIT_MS))]);
+      await Promise.race([queue, new Promise((resolve16) => setTimeout(resolve16, LAST_CALL_WAIT_MS))]);
       if (inbox.length === 0) return void 0;
       const lines2 = takeInbox();
       if (lines2.length === 0) return void 0;
@@ -44778,7 +44908,7 @@ ${lines3.join("\n")}`);
   runtime.pi.on(
     "agent_end",
     failOpen(async () => {
-      await Promise.race([queue, new Promise((resolve15) => setTimeout(resolve15, 6e3))]);
+      await Promise.race([queue, new Promise((resolve16) => setTimeout(resolve16, 6e3))]);
       return void 0;
     })
   );
@@ -45077,12 +45207,12 @@ function registerHiveCommand(runtime) {
       return void 0;
     })
   );
-  const untilTurnEnds = () => new Promise((resolve15) => {
+  const untilTurnEnds = () => new Promise((resolve16) => {
     let timer;
     const over = () => {
       clearTimeout(timer);
       waiting = void 0;
-      resolve15();
+      resolve16();
     };
     waiting = { started: false, over };
     timer = setTimeout(() => {
@@ -45174,7 +45304,7 @@ var import_pi_coding_agent9 = __toESM(require_pi_coding_agent(), 1);
 var import_pi_tui4 = __toESM(require_pi_tui(), 1);
 
 // packages/kyrn-judge/src/import/index.ts
-import { mkdirSync as mkdirSync13, readdirSync as readdirSync6, readFileSync as readFileSync16, realpathSync as realpathSync2, renameSync as renameSync7, statSync as statSync11, writeFileSync as writeFileSync11 } from "node:fs";
+import { mkdirSync as mkdirSync13, readdirSync as readdirSync6, readFileSync as readFileSync16, realpathSync as realpathSync3, renameSync as renameSync7, statSync as statSync11, writeFileSync as writeFileSync11 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
 import { join as join32 } from "node:path";
 
@@ -45300,7 +45430,7 @@ function list2(value) {
 import { createHash as createHash5, randomBytes as randomBytes2, randomUUID as randomUUID7 } from "node:crypto";
 import { closeSync as closeSync4, openSync as openSync4, readdirSync as readdirSync5, renameSync as renameSync6, rmSync as rmSync7, statSync as statSync7, writeSync } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { isAbsolute as isAbsolute3, join as join30, resolve as resolve4 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join30, resolve as resolve5 } from "node:path";
 var TOOL_NAMES = {
   "claude-code": "Claude Code",
   codex: "Codex",
@@ -45353,7 +45483,7 @@ function expand(path) {
 }
 function absolute(path, base = process.cwd()) {
   const expanded = expand(path);
-  return isAbsolute3(expanded) ? resolve4(expanded) : resolve4(base, expanded);
+  return isAbsolute4(expanded) ? resolve5(expanded) : resolve5(base, expanded);
 }
 function defaultSessionDir(cwd, agentDir) {
   const safe = `--${absolute(cwd).replace(/^[/\\]/, "").replace(/[/\\:]/g, "-")}--`;
@@ -47180,7 +47310,7 @@ function sameFolder(a, b) {
   const canonical2 = (dir) => {
     const path = absolute(dir);
     try {
-      return realpathSync2.native(path);
+      return realpathSync3.native(path);
     } catch {
       return path;
     }
@@ -47599,15 +47729,15 @@ ${theme.fg("dim", detail)}`, 0, 0));
 }
 
 // packages/kyrn-judge/src/extension/features/inherit.ts
-import { isAbsolute as isAbsolute4, join as join38, resolve as resolve7 } from "node:path";
+import { isAbsolute as isAbsolute5, join as join38, resolve as resolve8 } from "node:path";
 
 // packages/kyrn-judge/src/inherit/files.ts
-import { existsSync as existsSync13, readdirSync as readdirSync7, readFileSync as readFileSync17, realpathSync as realpathSync3, statSync as statSync12 } from "node:fs";
-import { dirname as dirname7, join as join33, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync13, readdirSync as readdirSync7, readFileSync as readFileSync17, realpathSync as realpathSync4, statSync as statSync12 } from "node:fs";
+import { dirname as dirname7, join as join33, resolve as resolve6 } from "node:path";
 var MAX_FILE_BYTES = 2 * 1024 * 1024;
 function projectChain(projectDir, home) {
-  const start = resolve5(projectDir);
-  const homeDir = resolve5(home);
+  const start = resolve6(projectDir);
+  const homeDir = resolve6(home);
   const chain = [];
   let current = start;
   for (let depth = 0; depth < 32; depth++) {
@@ -47666,9 +47796,9 @@ function listFiles(dir, extensions, depth = 4) {
 }
 function canonical(path) {
   try {
-    return realpathSync3(path);
+    return realpathSync4(path);
   } catch {
-    return resolve5(path);
+    return resolve6(path);
   }
 }
 
@@ -47931,7 +48061,7 @@ import { mkdirSync as mkdirSync14, readFileSync as readFileSync18, writeFileSync
 import { dirname as dirname8, join as join37 } from "node:path";
 
 // packages/kyrn-judge/src/inherit/mcp-config.ts
-import { join as join35, resolve as resolve6 } from "node:path";
+import { join as join35, resolve as resolve7 } from "node:path";
 
 // packages/kyrn-judge/src/inherit/json-members.ts
 var QUOTE = 34;
@@ -48374,7 +48504,7 @@ function discoverMcpServers(options, problems) {
   let disabledInClaude = /* @__PURE__ */ new Set();
   if (inherit && switches.claude) {
     const path = join35(roots.home, ".claude.json");
-    const dirs = [resolve6(roots.projectDir), ...chain.slice(1)];
+    const dirs = [resolve7(roots.projectDir), ...chain.slice(1)];
     const wanted = new Set(dirs.map((dir) => pathKey(dir, platform)));
     const config = parseJson(path, problems, {
       mcpServers: true,
@@ -48414,14 +48544,14 @@ function discoverMcpServers(options, problems) {
     }
   }
   if (inherit) {
-    const userFiles = /* @__PURE__ */ new Set([resolve6(join35(roots.home, ".cursor", "mcp.json"))]);
+    const userFiles = /* @__PURE__ */ new Set([resolve7(join35(roots.home, ".cursor", "mcp.json"))]);
     for (const dir of chain) {
       const files = [
         { path: join35(dir, ".mcp.json"), tool: "claude", on: switches.claude },
         { path: join35(dir, ".cursor", "mcp.json"), tool: "cursor", on: switches.cursor }
       ];
       for (const file of files) {
-        if (!file.on || userFiles.has(resolve6(file.path))) continue;
+        if (!file.on || userFiles.has(resolve7(file.path))) continue;
         if (!roots.projectTrusted) {
           if (readText(file.path, []) !== void 0) {
             skipped.push({ name: "*", source: file.path, reason: "the project is not trusted" });
@@ -48753,7 +48883,7 @@ ${lines2.join("\n")}`
       if (!scan2 || event.isError || !TOUCHING_TOOLS.includes(event.toolName)) return void 0;
       const path = event.input.path;
       if (typeof path !== "string" || !path) return void 0;
-      const file = isAbsolute4(path) ? path : resolve7(ctx.cwd, path);
+      const file = isAbsolute5(path) ? path : resolve8(ctx.cwd, path);
       const matching = rulesForFile(scan2.rules, file).filter((rule) => !delivered.has(rule.path));
       if (matching.length === 0) return void 0;
       const notes = matching.map((rule) => {
@@ -49472,7 +49602,7 @@ function decompressed(response) {
   return response.pipe(through);
 }
 function once(url, limits, policy, signal) {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const send = url.protocol === "https:" ? httpsRequest : httpRequest;
     const request = send(
       url,
@@ -49488,7 +49618,7 @@ function once(url, limits, policy, signal) {
           ...limits.headers
         }
       },
-      resolve15
+      resolve16
     );
     request.on("error", reject);
     request.end();
@@ -50198,7 +50328,7 @@ ${lines2.join("\n\n")}`
     id: "tool:web",
     kind: "tool",
     title: "Web reading and search",
-    description: "Read a web page as text and search the web from mainland China without a key, or through Tavily with TAVILY_API_KEY set.",
+    description: "Read a web page as text, and search the web with no key or through Tavily with TAVILY_API_KEY set. The default search source also works from mainland China.",
     tools: ["web_fetch", "web_search"],
     exposure: "always"
   });
@@ -50450,8 +50580,8 @@ function registerInterjection(runtime) {
       const earlier = previous;
       let release = () => {
       };
-      previous = new Promise((resolve15) => {
-        release = () => setTimeout(resolve15, 0);
+      previous = new Promise((resolve16) => {
+        release = () => setTimeout(resolve16, 0);
       });
       try {
         const other = await otherWay(event, sent).catch(() => void 0);
@@ -50682,7 +50812,7 @@ function registerLayaNotice(runtime, skipped, roots, muHome2) {
 var import_pi_coding_agent12 = __toESM(require_pi_coding_agent(), 1);
 import { readFileSync as readFileSync20, statSync as statSync15 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { join as join40, relative as relative4, resolve as resolve8 } from "node:path";
+import { join as join40, relative as relative4, resolve as resolve9 } from "node:path";
 
 // packages/kyrn-judge/src/decisions/diagnostics-delivery.ts
 var diagnosticsDelivery = defineDecision({
@@ -51134,12 +51264,12 @@ var LspClient = class {
     this.state = "stopping";
     this.clearTimers();
     if (child && child.exitCode === null && child.signalCode === null) {
-      const gone = new Promise((resolve15) => child.once("exit", () => resolve15()));
+      const gone = new Promise((resolve16) => child.once("exit", () => resolve16()));
       if (wasRunning) {
         await this.request("shutdown", void 0, 2e3).catch(() => void 0);
         this.notify("exit", void 0);
       }
-      await Promise.race([gone, new Promise((resolve15) => setTimeout(resolve15, wasRunning ? 1e3 : 0))]);
+      await Promise.race([gone, new Promise((resolve16) => setTimeout(resolve16, wasRunning ? 1e3 : 0))]);
       killTree(child, this.platform);
     }
     this.state = "stopped";
@@ -51244,16 +51374,16 @@ var LspClient = class {
       return true;
     };
     if (settled()) return Promise.resolve(true);
-    return new Promise((resolve15) => {
+    return new Promise((resolve16) => {
       const check = () => {
         if (!settled()) return;
         clearTimeout(timer);
         this.waiters.delete(check);
-        resolve15(true);
+        resolve16(true);
       };
       const timer = setTimeout(() => {
         this.waiters.delete(check);
-        resolve15(false);
+        resolve16(false);
       }, budgetMs);
       this.waiters.add(check);
     });
@@ -51445,7 +51575,7 @@ var LspClient = class {
   }
   request(method, params, timeoutMs) {
     const id = this.nextId++;
-    return new Promise((resolve15, reject) => {
+    return new Promise((resolve16, reject) => {
       const timer = setTimeout(
         () => {
           this.pending.delete(id);
@@ -51454,7 +51584,7 @@ var LspClient = class {
         },
         timeoutMs ?? this.options.requestTimeoutMs ?? 1e4
       );
-      this.pending.set(id, { resolve: resolve15, reject, timer });
+      this.pending.set(id, { resolve: resolve16, reject, timer });
       this.send({ id, method, params });
     });
   }
@@ -52149,7 +52279,7 @@ function registerLsp(runtime) {
       const raw = event.input.path;
       if (typeof raw !== "string" || !raw.trim()) return void 0;
       const named = raw.startsWith("@") ? raw.slice(1) : raw;
-      const file = resolve8(
+      const file = resolve9(
         ctx.cwd,
         named === "~" || named.startsWith("~/") ? join40(homedir8(), named.slice(1)) : named
       );
@@ -52395,7 +52525,7 @@ function capabilityId(serverName) {
 // packages/kyrn-judge/src/mcp/store.ts
 import { createHash as createHash7 } from "node:crypto";
 import { mkdirSync as mkdirSync16, readFileSync as readFileSync21, renameSync as renameSync9, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join41, resolve as resolve9 } from "node:path";
+import { join as join41, resolve as resolve10 } from "node:path";
 var DESCRIPTION_LENGTH2 = 200;
 function sorted(map) {
   return Object.entries(map).sort(([left], [right]) => left.localeCompare(right));
@@ -52426,7 +52556,7 @@ function readJson(path, empty) {
 function writeJson(path, value) {
   if (!path) return;
   try {
-    mkdirSync16(resolve9(path, ".."), { recursive: true });
+    mkdirSync16(resolve10(path, ".."), { recursive: true });
     const temporary = `${path}.${process.pid}.tmp`;
     writeFileSync14(temporary, `${JSON.stringify(value, null, "	")}
 `);
@@ -52464,11 +52594,11 @@ var McpStore = class {
     writeJson(this.cachePath, this.cache);
   }
   isApproved(projectDir, server) {
-    return this.approvals.projects?.[resolve9(projectDir)]?.[server.name] === definitionHash(server);
+    return this.approvals.projects?.[resolve10(projectDir)]?.[server.name] === definitionHash(server);
   }
   approve(projectDir, server) {
     this.approvals = readJson(this.approvalPath, this.approvals);
-    const project = resolve9(projectDir);
+    const project = resolve10(projectDir);
     this.approvals.projects = {
       ...this.approvals.projects,
       [project]: { ...this.approvals.projects?.[project], [server.name]: definitionHash(server) }
@@ -52620,9 +52750,9 @@ function registerMcp(runtime, roots) {
     if (!ctx) throw new Error("no session is running");
     unregister(entry);
     let timer;
-    const settled = new Promise((resolve15) => {
-      timer = setTimeout(() => resolve15(void 0), options.startTimeoutMs);
-      entry.waiter = resolve15;
+    const settled = new Promise((resolve16) => {
+      timer = setTimeout(() => resolve16(void 0), options.startTimeoutMs);
+      entry.waiter = resolve16;
     });
     let event;
     try {
@@ -54460,12 +54590,12 @@ import { posix as posix3, win32 as win323 } from "node:path";
 var STDERR_LIMIT = 64 * 1024;
 var KILL_GRACE_MS2 = 2e3;
 var PIPE_GRACE_MS = 500;
-var run = (command, args, options = {}) => new Promise((resolve15) => {
+var run = (command, args, options = {}) => new Promise((resolve16) => {
   const platform = options.platform ?? process.platform;
   const env = { ...process.env, ...options.env };
   const invocation = invocationFor(command, args, { platform, env });
   if (!invocation) {
-    resolve15({ code: 127, stdout: "", stderr: "", missing: true, stopped: false });
+    resolve16({ code: 127, stdout: "", stderr: "", missing: true, stopped: false });
     return;
   }
   const encoding = options.encoding ?? "utf8";
@@ -54511,7 +54641,7 @@ var run = (command, args, options = {}) => new Promise((resolve15) => {
     if (late) clearTimeout(late);
     options.signal?.removeEventListener("abort", stop);
     if (options.onLine && carry && !stopped) options.onLine(carry);
-    resolve15({ code, stdout: Buffer.concat(chunks).toString(encoding), stderr, missing, stopped });
+    resolve16({ code, stdout: Buffer.concat(chunks).toString(encoding), stderr, missing, stopped });
   };
   if (options.onLine) {
     child.stdout?.setEncoding(encoding);
@@ -54612,7 +54742,7 @@ function installHint(binary, platform) {
 var import_pi_coding_agent14 = __toESM(require_pi_coding_agent(), 1);
 var import_typebox11 = __toESM(require_typebox(), 1);
 import { readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { resolve as resolve10 } from "node:path";
+import { resolve as resolve11 } from "node:path";
 
 // packages/kyrn-judge/src/packs/ast-grep.ts
 function sgArgs(query) {
@@ -54910,7 +55040,7 @@ function astGrepPack(shared, options) {
               read: (path) => readFile3(path),
               write: (path, data) => writeFile3(path, data),
               locked: import_pi_coding_agent14.withFileMutationQueue,
-              resolve: (file) => resolve10(ctx.cwd, file)
+              resolve: (file) => resolve11(ctx.cwd, file)
             },
             { apply: params.apply === true, maxDiffChars: options.maxDiffChars }
           );
@@ -55602,9 +55732,9 @@ function report2(outcome) {
 
 // packages/kyrn-judge/src/extension/features/packs/conflicts.ts
 var import_typebox12 = __toESM(require_typebox(), 1);
-import { realpathSync as realpathSync4 } from "node:fs";
+import { realpathSync as realpathSync5 } from "node:fs";
 import { readFile as readFile5, writeFile as writeFile6 } from "node:fs/promises";
-import { basename as basename13, dirname as dirname11, isAbsolute as isAbsolute5, join as join46, relative as relative5 } from "node:path";
+import { basename as basename13, dirname as dirname11, isAbsolute as isAbsolute6, join as join46, relative as relative5 } from "node:path";
 
 // packages/kyrn-judge/src/packs/conflicts.ts
 import { mkdtemp as mkdtemp2, rm as rm5, writeFile as writeFile5 } from "node:fs/promises";
@@ -55739,7 +55869,7 @@ function looksBinary(content) {
 // packages/kyrn-judge/src/extension/features/packs/conflicts.ts
 function real(path) {
   try {
-    return realpathSync4.native(path);
+    return realpathSync5.native(path);
   } catch {
     const parent = dirname11(path);
     return parent === path ? path : join46(real(parent), basename13(path));
@@ -55759,7 +55889,7 @@ function conflictsPack(shared, options) {
     return { repo, files };
   };
   const inRepo = (root, cwd, path) => {
-    const inside2 = relative5(real(root), real(isAbsolute5(path) ? path : join46(cwd, path))).replaceAll("\\", "/");
+    const inside2 = relative5(real(root), real(isAbsolute6(path) ? path : join46(cwd, path))).replaceAll("\\", "/");
     if (inside2.startsWith("../") || inside2 === "..") throw new Error(`${path} is outside the repository`);
     return inside2;
   };
@@ -55944,7 +56074,7 @@ function conflictsPack(shared, options) {
 
 // packages/kyrn-judge/src/extension/features/packs/debugger.ts
 var import_typebox13 = __toESM(require_typebox(), 1);
-import { isAbsolute as isAbsolute6, relative as relative6, resolve as resolve11 } from "node:path";
+import { isAbsolute as isAbsolute7, relative as relative6, resolve as resolve12 } from "node:path";
 
 // packages/kyrn-judge/src/dap/adapters.ts
 import { extname, posix as posix4, win32 as win324 } from "node:path";
@@ -56052,15 +56182,15 @@ import { spawn as spawn9, spawnSync as spawnSync2 } from "node:child_process";
 import { connect, createServer as createServer2 } from "node:net";
 var DapError = class extends Error {
 };
-var sleep2 = (ms) => new Promise((resolve15) => setTimeout(resolve15, ms));
+var sleep2 = (ms) => new Promise((resolve16) => setTimeout(resolve16, ms));
 async function freePort() {
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const server = createServer2();
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       const address = server.address();
       const port = typeof address === "object" && address ? address.port : 0;
-      server.close(() => resolve15(port));
+      server.close(() => resolve16(port));
     });
   });
 }
@@ -56118,8 +56248,8 @@ var DapClient = class {
     while (true) {
       if (this.ended) throw new DapError(this.why());
       try {
-        const socket = await new Promise((resolve15, reject) => {
-          const attempt = connect(port, "127.0.0.1", () => resolve15(attempt));
+        const socket = await new Promise((resolve16, reject) => {
+          const attempt = connect(port, "127.0.0.1", () => resolve16(attempt));
           attempt.once("error", reject);
         });
         socket.on("close", () => this.fail("the debug adapter closed the connection"));
@@ -56195,7 +56325,7 @@ var DapClient = class {
   request(command, args = {}, timeoutMs) {
     if (this.ended) return Promise.reject(new DapError(`${command}: ${this.why()}`));
     const seq = this.seq++;
-    return new Promise((resolve15, reject) => {
+    return new Promise((resolve16, reject) => {
       const timer = setTimeout(
         () => {
           this.pending.delete(seq);
@@ -56203,7 +56333,7 @@ var DapClient = class {
         },
         timeoutMs ?? this.options.requestTimeoutMs ?? 3e4
       );
-      this.pending.set(seq, { command, resolve: resolve15, reject, timer });
+      this.pending.set(seq, { command, resolve: resolve16, reject, timer });
       this.write({ seq, type: "request", command, arguments: args });
     });
   }
@@ -56219,12 +56349,12 @@ var DapClient = class {
         if (names.includes(this.received[at].event)) return this.received[at];
       }
       if (this.ended || signal?.aborted || Date.now() >= deadline) return void 0;
-      await new Promise((resolve15) => {
+      await new Promise((resolve16) => {
         const wake = () => {
           this.waiters.delete(wake);
           signal?.removeEventListener("abort", wake);
           clearTimeout(timer);
-          resolve15();
+          resolve16();
         };
         const timer = setTimeout(wake, Math.max(1, deadline - Date.now()));
         this.waiters.add(wake);
@@ -56508,7 +56638,7 @@ var UNTRUSTED5 = "Values and output below come from the program being debugged:
 function shown(path, cwd) {
   if (!path) return "?";
   const inside2 = relative6(cwd, path);
-  return inside2 && !inside2.startsWith("..") && !isAbsolute6(inside2) ? inside2 : path;
+  return inside2 && !inside2.startsWith("..") && !isAbsolute7(inside2) ? inside2 : path;
 }
 function variableLine(variable) {
   const type = variable.type ? ` (${variable.type})` : "";
@@ -56683,8 +56813,8 @@ function debuggerPack(shared, options) {
         }),
         execute: async (_toolCallId, params, signal, _onUpdate, ctx) => {
           runtime.touch(ctx);
-          const cwd = params.cwd ? resolve11(ctx.cwd, params.cwd) : ctx.cwd;
-          const program = params.program ? resolve11(cwd, params.program) : void 0;
+          const cwd = params.cwd ? resolve12(ctx.cwd, params.cwd) : ctx.cwd;
+          const program = params.program ? resolve12(cwd, params.program) : void 0;
           const extra = launchExtra(params.launch);
           const module = typeof extra.module === "string" ? extra.module : void 0;
           if (!program && !module) throw new Error("Name the program to run (or, for Python, launch.module).");
@@ -56723,7 +56853,7 @@ function debuggerPack(shared, options) {
               spec.id,
               launch,
               params.breakpoints.map((point) => ({
-                file: resolve11(cwd, point.file),
+                file: resolve12(cwd, point.file),
                 line: Math.max(1, Math.floor(point.line)),
                 condition: point.condition?.trim() || void 0
               })),
@@ -57147,7 +57277,7 @@ function registerPacks(runtime) {
 // packages/kyrn-judge/src/extension/features/permissions.ts
 var import_pi_coding_agent15 = __toESM(require_pi_coding_agent(), 1);
 import { homedir as homedir11 } from "node:os";
-import { join as join48, resolve as resolve13, sep as sep3 } from "node:path";
+import { join as join48, resolve as resolve14, sep as sep3 } from "node:path";
 
 // packages/kyrn-judge/src/decisions/tool-approval.ts
 var APPROVE_AT = 0.8;
@@ -57187,9 +57317,9 @@ var toolApproval = defineDecision({
 });
 
 // packages/kyrn-judge/src/permissions/modes.ts
-import { lstatSync as lstatSync2, mkdirSync as mkdirSync18, readFileSync as readFileSync23, readlinkSync, realpathSync as realpathSync5, renameSync as renameSync10, writeFileSync as writeFileSync15 } from "node:fs";
+import { lstatSync as lstatSync2, mkdirSync as mkdirSync18, readFileSync as readFileSync23, readlinkSync, realpathSync as realpathSync6, renameSync as renameSync10, writeFileSync as writeFileSync15 } from "node:fs";
 import { homedir as homedir10 } from "node:os";
-import { basename as basename14, dirname as dirname12, isAbsolute as isAbsolute7, join as join47, relative as relative7, resolve as resolve12, sep as sep2 } from "node:path";
+import { basename as basename14, dirname as dirname12, isAbsolute as isAbsolute8, join as join47, relative as relative7, resolve as resolve13, sep as sep2 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 var PERMISSION_MODES = ["full", "judge", "ask"];
 var MODE_TEXT = {
@@ -57272,12 +57402,12 @@ function pathOf2(input) {
 }
 function realPath2(path, depth = 0) {
   try {
-    return realpathSync5.native(path);
+    return realpathSync6.native(path);
   } catch {
     if (depth < 40) {
       try {
         if (lstatSync2(path).isSymbolicLink())
-          return realPath2(resolve12(dirname12(path), readlinkSync(path)), depth + 1);
+          return realPath2(resolve13(dirname12(path), readlinkSync(path)), depth + 1);
       } catch {
       }
     }
@@ -57305,12 +57435,12 @@ function toolPath(cwd, raw, home = homedir10()) {
       return void 0;
     }
   }
-  return realPath2(isAbsolute7(path) ? resolve12(path) : resolve12(cwd, path));
+  return realPath2(isAbsolute8(path) ? resolve13(path) : resolve13(cwd, path));
 }
 function inProject(cwd, target) {
   if (target === void 0) return void 0;
-  const rel = relative7(realPath2(resolve12(cwd)), target);
-  return rel === ".." || rel.startsWith(`..${sep2}`) || isAbsolute7(rel) ? void 0 : rel;
+  const rel = relative7(realPath2(resolve13(cwd)), target);
+  return rel === ".." || rel.startsWith(`..${sep2}`) || isAbsolute8(rel) ? void 0 : rel;
 }
 function projectFile(cwd, target) {
   const rel = inProject(cwd, target);
@@ -57345,7 +57475,9 @@ function permissionNeed(toolName, input, cwd, protectedPaths2 = [], chains = tru
   if (isShellTool(toolName) || toolName === "bg_start") {
     const command = text8(input.command);
     const powershell = toolName === "powershell" || toolName === "bg_start" && process.platform === "win32";
-    if (chains ? isReadOnlyChain(command, powershell) : isReadOnlyCommand(command, powershell)) return void 0;
+    const start = shellStart(toolName, input, cwd);
+    if (chains ? isReadOnlyChain(command, powershell, cwd, start) : isReadOnlyCommand(command, powershell, cwd, start))
+      return void 0;
     const guarded = touches(command);
     const prefix = commandPrefix(command);
     return {
@@ -57361,7 +57493,7 @@ function permissionNeed(toolName, input, cwd, protectedPaths2 = [], chains = tru
     const paths = [...path ? [path] : [], ...listed2];
     const targets = paths.map((each) => ({ said: each, target: toolPath(cwd, each) }));
     const summary = clip5(`${toolName} ${path || listed2.join(" ") || text8(input.id) || text8(input.pattern)}`, 300);
-    const guarded = targets.flatMap(({ said, target }) => [resolve12(cwd, said), ...target ? [target] : []]).map(touches).find(Boolean);
+    const guarded = targets.flatMap(({ said, target }) => [resolve13(cwd, said), ...target ? [target] : []]).map(touches).find(Boolean);
     if (guarded) return { kind: "edit", summary, protected: guarded };
     const away = targets.find(({ target }) => !projectFile(cwd, target));
     return away ? {
@@ -57482,7 +57614,7 @@ function protectedPaths(roots) {
   return real2 && real2 !== roots.agentDir ? [...spelled, real2] : spelled;
 }
 function projectSettings(cwd) {
-  const spelled = join48(resolve13(cwd), import_pi_coding_agent15.CONFIG_DIR_NAME);
+  const spelled = join48(resolve14(cwd), import_pi_coding_agent15.CONFIG_DIR_NAME);
   const real2 = toolPath(cwd, import_pi_coding_agent15.CONFIG_DIR_NAME) ?? spelled;
   return [.../* @__PURE__ */ new Set([spelled, real2])].map((path) => `${path}${sep3}`);
 }
@@ -58276,8 +58408,8 @@ function registerPreflight(runtime) {
       }
       let skip = () => {
       };
-      const skipped = new Promise((resolve15) => {
-        skip = () => resolve15("skipped");
+      const skipped = new Promise((resolve16) => {
+        skip = () => resolve16("skipped");
       });
       const unsubscribe = panel ? ctx.ui.onTerminalInput((keys) => {
         if (!(0, import_pi_tui6.matchesKey)(keys, "escape")) return void 0;
@@ -58285,8 +58417,8 @@ function registerPreflight(runtime) {
         return { consume: true };
       }) : void 0;
       let timer;
-      const timeout = new Promise((resolve15) => {
-        timer = setTimeout(() => resolve15("timeout"), options.waitMs);
+      const timeout = new Promise((resolve16) => {
+        timer = setTimeout(() => resolve16("timeout"), options.waitMs);
       });
       try {
         current.waitEndedBy = await Promise.race([pending.then(() => "verdict"), timeout, skipped]);
@@ -58752,11 +58884,11 @@ var SandboxApiError = class extends Error {
     this.status = status;
   }
 };
-var sleep3 = (ms, signal) => new Promise((resolve15, reject) => {
+var sleep3 = (ms, signal) => new Promise((resolve16, reject) => {
   if (signal?.aborted) return reject(new Error("aborted"));
   const timer = setTimeout(() => {
     signal?.removeEventListener("abort", onAbort);
-    resolve15();
+    resolve16();
   }, ms);
   const onAbort = () => {
     clearTimeout(timer);
@@ -59000,7 +59132,7 @@ function errorDetail(text9) {
 
 // packages/kyrn-judge/src/sandbox/operations.ts
 import { readFile as readFile7 } from "node:fs/promises";
-import { extname as extname2, isAbsolute as isAbsolute8, posix as posix6, relative as relative9, sep as sep5 } from "node:path";
+import { extname as extname2, isAbsolute as isAbsolute9, posix as posix6, relative as relative9, sep as sep5 } from "node:path";
 
 // packages/kyrn-judge/src/sandbox/session.ts
 import { posix as posix5 } from "node:path";
@@ -59091,7 +59223,7 @@ function createTar(entries) {
 // packages/kyrn-judge/src/sandbox/project.ts
 var gzipAsync = promisify(gzip);
 function runGit2(args, cwd, input) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     const child = spawn10("git", args, {
       cwd,
       stdio: [input ? "pipe" : "ignore", "pipe", "pipe"],
@@ -59102,10 +59234,10 @@ function runGit2(args, cwd, input) {
     const err = [];
     child.stdout?.on("data", (chunk) => out.push(chunk));
     child.stderr?.on("data", (chunk) => err.push(chunk));
-    child.on("error", (error) => resolve15({ code: 127, stdout: Buffer.alloc(0), stderr: error.message }));
+    child.on("error", (error) => resolve16({ code: 127, stdout: Buffer.alloc(0), stderr: error.message }));
     child.on(
       "close",
-      (code) => resolve15({ code: code ?? 1, stdout: Buffer.concat(out), stderr: Buffer.concat(err).toString("utf8") })
+      (code) => resolve16({ code: code ?? 1, stdout: Buffer.concat(out), stderr: Buffer.concat(err).toString("utf8") })
     );
     if (input) {
       child.stdin?.on("error", () => void 0);
@@ -59275,13 +59407,13 @@ function tail(buffer, chars = 600) {
 function untilAborted(work, signal) {
   if (!signal) return work;
   if (signal.aborted) return Promise.reject(new Error("aborted"));
-  return new Promise((resolve15, reject) => {
+  return new Promise((resolve16, reject) => {
     const onAbort = () => reject(new Error("aborted"));
     signal.addEventListener("abort", onAbort, { once: true });
     work.then(
       (value) => {
         signal.removeEventListener("abort", onAbort);
-        resolve15(value);
+        resolve16(value);
       },
       (error) => {
         signal.removeEventListener("abort", onAbort);
@@ -59533,14 +59665,14 @@ var SandboxSession = class {
 function toSandboxPath(localPath, root, workdir) {
   const inside2 = relative9(root, localPath);
   if (inside2 === "") return workdir;
-  if (inside2 !== ".." && !inside2.startsWith(`..${sep5}`) && !isAbsolute8(inside2)) {
+  if (inside2 !== ".." && !inside2.startsWith(`..${sep5}`) && !isAbsolute9(inside2)) {
     return posix6.join(workdir, inside2.split(sep5).join("/"));
   }
   return localPath.split(sep5).join("/");
 }
 function insideProject(localPath, root) {
   const inside2 = relative9(root, localPath);
-  return inside2 === "" || inside2 !== ".." && !inside2.startsWith(`..${sep5}`) && !isAbsolute8(inside2);
+  return inside2 === "" || inside2 !== ".." && !inside2.startsWith(`..${sep5}`) && !isAbsolute9(inside2);
 }
 var IMAGE_TYPES2 = {
   ".png": "image/png",
@@ -60590,7 +60722,7 @@ import { join as join52 } from "node:path";
 
 // packages/kyrn-judge/src/auth/exit.ts
 import { mkdirSync as mkdirSync20, rmdirSync as rmdirSync2 } from "node:fs";
-import { resolve as resolve14 } from "node:path";
+import { resolve as resolve15 } from "node:path";
 import { setTimeout as sleep4 } from "node:timers/promises";
 async function holdLocksUntilExit(files, {
   limitMs = 3e3,
@@ -60617,7 +60749,7 @@ async function holdLocksUntilExit(files, {
   return release;
 }
 function lockFolders(files) {
-  return [...new Set(files.map((file) => `${resolve14(file)}.lock`))];
+  return [...new Set(files.map((file) => `${resolve15(file)}.lock`))];
 }
 function takeAll(locks) {
   const taken = [];