squidclaw 3.0.25 → 3.0.26

package/dist/{exec-approvals-cli-homtziYt.js → exec-approvals-cli-BmM4RpVn.js}

@@ -2,10 +2,10 @@ import { f as isRich, p as theme } from "./globals-BrhVUl-N.js";
 import "./paths-CHIu6D1E.js";
 import { d as defaultRuntime } from "./subsystem-Bw5n50gj.js";
 import "./boolean-DtWR5bt3.js";
-import "./auth-profiles-9T4j6jMy.js";
-import "./agent-scope-nEVgVklg.js";
+import "./auth-profiles-CX4YYu7Z.js";
+import "./agent-scope-Cq4vDGrK.js";
 import "./utils-D6vohX1h.js";
-import "./squidclaw-root-JXyRbQLJ.js";
+import "./squidclaw-root-BQfLymzj.js";
 import "./logger-DL3N22PJ.js";
 import "./exec-TSiqsZw1.js";
 import "./registry-BXcl3IkC.js";
@@ -13,26 +13,26 @@ import "./github-copilot-token-CxitgiZA.js";
 import "./host-env-security-lcjXF83D.js";
 import "./version-3so140Zi.js";
 import "./env-vars-mSSOl7Rv.js";
-import "./manifest-registry-1ACGW3OR.js";
+import "./manifest-registry-7kwtbCH-.js";
 import "./message-channel-DqvtYF2o.js";
-import "./client-COy24r9W.js";
-import "./call-D7jOWSFr.js";
+import "./client-G9E5HGM2.js";
+import "./call-BlWEBz99.js";
 import "./pairing-token-B_ig96RO.js";
-import "./net-CIh5ellr.js";
-import "./tailnet-DJq7Mi1o.js";
-import "./exec-approvals-allowlist-B9bcJkGP.js";
+import "./net-CCnbGop3.js";
+import "./tailnet-CZANZjq6.js";
+import "./exec-approvals-allowlist-CtSREgYh.js";
 import { n as formatTimeAgo } from "./format-relative-Czf5fUjn.js";
 import { c as readExecApprovalsSnapshot, p as saveExecApprovals } from "./exec-approvals-Db6myg-N.js";
 import { t as formatDocsLink } from "./links-Dye6HsRG.js";
 import "./progress-DuhDspl6.js";
-import { n as callGatewayFromCli } from "./gateway-rpc-BBBN9ZJk.js";
-import "./systemd-B86VePXs.js";
-import "./service-B5T42CWZ.js";
+import { n as callGatewayFromCli } from "./gateway-rpc-D0AmaBzR.js";
+import "./systemd-Cj2cX_ZP.js";
+import "./service-DSqxS6_D.js";
 import { t as renderTable } from "./table-DbDCX_6t.js";
-import { t as describeUnknownError } from "./shared-By6_qr_R.js";
-import { a as resolveNodeId, r as nodesCallOpts } from "./rpc-mau2U4RG.js";
+import { t as describeUnknownError } from "./shared-D5DTxBPH.js";
+import { a as resolveNodeId, r as nodesCallOpts } from "./rpc-DA9IhLVG.js";
 import JSON5 from "json5";
-import fsPromises from "node:fs/promises";
+import fs from "node:fs/promises";
 
 //#region src/cli/exec-approvals-cli.ts
 async function readStdin() {
@@ -329,7 +329,7 @@ function registerExecApprovalsCli(program) {
 			if (!opts.file && !opts.stdin) exitWithError("Provide --file or --stdin.");
 			if (opts.file && opts.stdin) exitWithError("Use either --file or --stdin (not both).");
 			const { source, nodeId, targetLabel, baseHash } = await loadWritableSnapshotTarget(opts);
-			const raw = opts.stdin ? await readStdin() : await fsPromises.readFile(String(opts.file), "utf8");
+			const raw = opts.stdin ? await readStdin() : await fs.readFile(String(opts.file), "utf8");
 			let file;
 			try {
 				file = JSON5.parse(raw);

package/dist/{exec-safe-bin-runtime-policy-DECo77U6.js → exec-safe-bin-runtime-policy-CfQeDABF.js}

@@ -1,5 +1,5 @@
-import { En as resolveSafeBinProfiles, Qt as normalizeTrustedSafeBinDirs, Tn as normalizeSafeBinProfileFixtures, Yt as getTrustedSafeBinDirs, Zt as listWritableExplicitTrustedSafeBinDirs } from "./auth-profiles-9T4j6jMy.js";
-import { i as resolveSafeBins } from "./exec-approvals-allowlist-B9bcJkGP.js";
+import { En as resolveSafeBinProfiles, Qt as normalizeTrustedSafeBinDirs, Tn as normalizeSafeBinProfileFixtures, Yt as getTrustedSafeBinDirs, Zt as listWritableExplicitTrustedSafeBinDirs } from "./auth-profiles-CX4YYu7Z.js";
+import { i as resolveSafeBins } from "./exec-approvals-allowlist-CtSREgYh.js";
 
 //#region src/infra/exec-safe-bin-runtime-policy.ts
 const INTERPRETER_LIKE_SAFE_BINS = new Set([

package/dist/extensionAPI.js

@@ -2,7 +2,7 @@ import { S as ensureAgentWorkspace, a as resolveAgentDir, c as resolveAgentWorks
 import "./paths-Bxnm7jO8.js";
 import "./logger-RMqzbo8v.js";
 import { Tr as DEFAULT_PROVIDER, m as resolveThinkingDefault, wr as DEFAULT_MODEL } from "./model-selection-BREqRzjS.js";
-import { G as resolveAgentIdentity, W as resolveAgentTimeoutMs, t as runEmbeddedPiAgent } from "./pi-embedded-BN8fghaF.js";
+import { G as resolveAgentIdentity, W as resolveAgentTimeoutMs, t as runEmbeddedPiAgent } from "./pi-embedded-BR5y0dLa.js";
 import "./github-copilot-token-BI4jINAR.js";
 import "./thinking-Um9vuzkV.js";
 import "./tokens-DXTW31In.js";
@@ -10,14 +10,14 @@ import "./plugins-BxlUqxlx.js";
 import "./accounts-DpFVWw4d.js";
 import "./send-B1S2o3_t.js";
 import "./send-WA7QCsM4.js";
-import "./deliver-6zfT7daI.js";
+import "./deliver-B4WWPQvt.js";
 import "./diagnostic-DKZWH846.js";
 import "./accounts-BVDcCQsz.js";
 import "./image-ops-Co3B94Bx.js";
 import "./send-Dv1Xtf-W.js";
 import "./pi-model-discovery-BEIYBmq-.js";
-import { W as loadSessionStore, q as saveSessionStore } from "./pi-embedded-helpers-A9VYPVCH.js";
-import "./chrome-CuBHInKC.js";
+import { W as loadSessionStore, q as saveSessionStore } from "./pi-embedded-helpers-CEHpGDRs.js";
+import "./chrome-CZQnp4VH.js";
 import "./skills-CjGoSoba.js";
 import "./path-alias-guards-DLHloUkx.js";
 import "./redact-kK-uDSQK.js";
@@ -28,8 +28,8 @@ import "./store-CSh2TRFG.js";
 import "./accounts-B5aNbLs5.js";
 import { n as resolveSessionFilePath, s as resolveStorePath } from "./paths-BeCJt7wC.js";
 import "./tool-images-ZB2Mu1HF.js";
-import "./image-VgwN31FZ.js";
-import "./audio-transcription-runner-YiR1ym3a.js";
+import "./image-DKkuLtZ4.js";
+import "./audio-transcription-runner-Cp_lkLCv.js";
 import "./fetch-VXOrovPC.js";
 import "./fetch-guard-DU7jYYlW.js";
 import "./api-key-rotation-DAwwDa1O.js";

package/dist/{fetch-lq0SDLLE.js → fetch-CtoC2wgs.js}

@@ -1,8 +1,8 @@
 import { k as resolvePreferredSquidClawTmpDir } from "./globals-BrhVUl-N.js";
 import { g as resolveStateDir } from "./paths-CHIu6D1E.js";
-import { u as resolveAgentWorkspaceDir } from "./agent-scope-nEVgVklg.js";
-import { c as detectMime, l as extensionForMime } from "./image-ops-LFsSCTyI.js";
-import { n as withStrictGuardedFetchMode, t as fetchWithSsrFGuard } from "./fetch-guard-CbtWqa1E.js";
+import { u as resolveAgentWorkspaceDir } from "./agent-scope-Cq4vDGrK.js";
+import { c as detectMime, l as extensionForMime } from "./image-ops-B2uuLIGD.js";
+import { n as withStrictGuardedFetchMode, t as fetchWithSsrFGuard } from "./fetch-guard-Dvzi3MjK.js";
 import path from "node:path";
 
 //#region src/media/local-roots.ts

package/dist/{fetch-b8tSR7_e.js → fetch-DP-JjB6Z.js}

@@ -1,8 +1,8 @@
-import { c as resolveAgentWorkspaceDir } from "./run-with-concurrency-FczpX8ng.js";
-import { c as resolveStateDir } from "./paths-CSdAWKDO.js";
-import { w as resolvePreferredSquidClawTmpDir } from "./subsystem-BaLYRf7D.js";
-import { b as detectMime, x as extensionForMime } from "./image-ops-BoN1E_WZ.js";
-import { n as withStrictGuardedFetchMode, t as fetchWithSsrFGuard } from "./fetch-guard-D16tjNsZ.js";
+import { c as resolveAgentWorkspaceDir } from "./run-with-concurrency-BFR3ReeF.js";
+import { c as resolveStateDir } from "./paths-DA5srn0U.js";
+import { w as resolvePreferredSquidClawTmpDir } from "./subsystem-6v7sWnAD.js";
+import { b as detectMime, x as extensionForMime } from "./image-ops-Dg8iraUV.js";
+import { n as withStrictGuardedFetchMode, t as fetchWithSsrFGuard } from "./fetch-guard-BDy975wP.js";
 import path from "node:path";
 
 //#region src/media/local-roots.ts

package/dist/{fetch-guard-D16tjNsZ.js → fetch-guard-BDy975wP.js}

@@ -1,5 +1,5 @@
-import { i as logWarn } from "./logger-oGKcCLZ5.js";
-import { i as createPinnedDispatcher, n as SsrFBlockedError, r as closeDispatcher, s as resolvePinnedHostnameWithPolicy, t as hasProxyEnvConfigured } from "./proxy-env-DXXfs2WL.js";
+import { i as logWarn } from "./logger-CnTSBL7T.js";
+import { i as createPinnedDispatcher, n as SsrFBlockedError, r as closeDispatcher, s as resolvePinnedHostnameWithPolicy, t as hasProxyEnvConfigured } from "./proxy-env-D-fike7s.js";
 import { t as bindAbortRelay } from "./fetch-timeout-Wgx3OXYj.js";
 import { EnvHttpProxyAgent } from "undici";
 

package/dist/{fetch-guard-CbtWqa1E.js → fetch-guard-Dvzi3MjK.js}

@@ -1,5 +1,5 @@
 import { i as logWarn } from "./logger-DL3N22PJ.js";
-import { i as createPinnedDispatcher, n as SsrFBlockedError, r as closeDispatcher, s as resolvePinnedHostnameWithPolicy, t as hasProxyEnvConfigured } from "./proxy-env-BiKHVg2h.js";
+import { i as createPinnedDispatcher, n as SsrFBlockedError, r as closeDispatcher, s as resolvePinnedHostnameWithPolicy, t as hasProxyEnvConfigured } from "./proxy-env-CQTuxZoS.js";
 import { t as bindAbortRelay } from "./fetch-timeout-Mawkd1Br.js";
 import { EnvHttpProxyAgent } from "undici";
 

package/dist/{frontmatter-CjKtFduT.js → frontmatter-Cq1TcIQ2.js}

@@ -1,6 +1,6 @@
-import { c as parseBooleanValue, n as MANIFEST_KEY, t as LEGACY_MANIFEST_KEYS } from "./legacy-names-B0wgIP0Q.js";
+import { c as parseBooleanValue, n as MANIFEST_KEY, t as LEGACY_MANIFEST_KEYS } from "./legacy-names-aGJJuzM_.js";
 import path from "node:path";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import JSON5 from "json5";
 import YAML from "yaml";
 
@@ -92,7 +92,7 @@ function hasBinary(bin) {
 	for (const part of parts) for (const ext of extensions) {
 		const candidate = path.join(part, bin + ext);
 		try {
-			fs.accessSync(candidate, fs.constants.X_OK);
+			syncFs.accessSync(candidate, syncFs.constants.X_OK);
 			hasBinaryCache.set(bin, true);
 			return true;
 		} catch {}

package/dist/{fs-safe-CwHbZdFH.js → fs-safe-BoB4X3GD.js}

@@ -1,7 +1,7 @@
-import { l as expandHomePrefix } from "./paths-CSdAWKDO.js";
-import { D as isNotFoundPathError, E as hasNodeErrorCode, O as isPathInside, S as sameFileIdentity, k as isSymlinkOpenError } from "./workspace-TqfVSQuO.js";
-import { i as logWarn } from "./logger-oGKcCLZ5.js";
-import { n as assertNoPathAliasEscape } from "./path-alias-guards-Cpsiv2KL.js";
+import { l as expandHomePrefix } from "./paths-DA5srn0U.js";
+import { D as isNotFoundPathError, E as hasNodeErrorCode, O as isPathInside, S as sameFileIdentity, k as isSymlinkOpenError } from "./workspace-kVMIaBrV.js";
+import { i as logWarn } from "./logger-CnTSBL7T.js";
+import { n as assertNoPathAliasEscape } from "./path-alias-guards-DORgbZ1w.js";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";

package/dist/{fs-safe-BPQ-per2.js → fs-safe-DPYj7h8A.js}

@@ -1,11 +1,11 @@
 import { _ as expandHomePrefix } from "./paths-CHIu6D1E.js";
-import { d as hasNodeErrorCode, f as isNotFoundPathError, m as isSymlinkOpenError, p as isPathInside, s as sameFileIdentity } from "./squidclaw-root-JXyRbQLJ.js";
+import { d as hasNodeErrorCode, f as isNotFoundPathError, m as isSymlinkOpenError, p as isPathInside, s as sameFileIdentity } from "./squidclaw-root-BQfLymzj.js";
 import { i as logWarn } from "./logger-DL3N22PJ.js";
-import { n as assertNoPathAliasEscape } from "./path-alias-guards-DeOVetT7.js";
+import { n as assertNoPathAliasEscape } from "./path-alias-guards-vfYYQFIg.js";
 import os from "node:os";
 import path from "node:path";
 import { constants } from "node:fs";
-import fsPromises from "node:fs/promises";
+import fs$1 from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { pipeline } from "node:stream/promises";
 
@@ -25,19 +25,19 @@ const ensureTrailingSep = (value) => value.endsWith(path.sep) ? value : value +
 async function expandRelativePathWithHome(relativePath) {
 	let home = process.env.HOME || process.env.USERPROFILE || os.homedir();
 	try {
-		home = await fsPromises.realpath(home);
+		home = await fs$1.realpath(home);
 	} catch {}
 	return expandHomePrefix(relativePath, { home });
 }
 async function openVerifiedLocalFile(filePath, options) {
 	try {
-		if ((await fsPromises.lstat(filePath)).isDirectory()) throw new SafeOpenError("not-file", "not a file");
+		if ((await fs$1.lstat(filePath)).isDirectory()) throw new SafeOpenError("not-file", "not a file");
 	} catch (err) {
 		if (err instanceof SafeOpenError) throw err;
 	}
 	let handle;
 	try {
-		handle = await fsPromises.open(filePath, OPEN_READ_FLAGS);
+		handle = await fs$1.open(filePath, OPEN_READ_FLAGS);
 	} catch (err) {
 		if (isNotFoundPathError(err)) throw new SafeOpenError("not-found", "file not found");
 		if (isSymlinkOpenError(err)) throw new SafeOpenError("symlink", "symlink open blocked", { cause: err });
@@ -45,13 +45,13 @@ async function openVerifiedLocalFile(filePath, options) {
 		throw err;
 	}
 	try {
-		const [stat, lstat] = await Promise.all([handle.stat(), fsPromises.lstat(filePath)]);
+		const [stat, lstat] = await Promise.all([handle.stat(), fs$1.lstat(filePath)]);
 		if (lstat.isSymbolicLink()) throw new SafeOpenError("symlink", "symlink not allowed");
 		if (!stat.isFile()) throw new SafeOpenError("not-file", "not a file");
 		if (options?.rejectHardlinks && stat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
 		if (!sameFileIdentity(stat, lstat)) throw new SafeOpenError("path-mismatch", "path changed during read");
-		const realPath = await fsPromises.realpath(filePath);
-		const realStat = await fsPromises.stat(realPath);
+		const realPath = await fs$1.realpath(filePath);
+		const realStat = await fs$1.stat(realPath);
 		if (options?.rejectHardlinks && realStat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
 		if (!sameFileIdentity(stat, realStat)) throw new SafeOpenError("path-mismatch", "path mismatch");
 		return {
@@ -69,7 +69,7 @@ async function openVerifiedLocalFile(filePath, options) {
 async function resolvePathWithinRoot(params) {
 	let rootReal;
 	try {
-		rootReal = await fsPromises.realpath(params.rootDir);
+		rootReal = await fs$1.realpath(params.rootDir);
 	} catch (err) {
 		if (isNotFoundPathError(err)) throw new SafeOpenError("not-found", "root dir not found");
 		throw err;
@@ -170,7 +170,7 @@ function buildAtomicWriteTempPath(targetPath) {
 	return path.join(dir, `.${base}.${process.pid}.${randomUUID()}.tmp`);
 }
 async function writeTempFileForAtomicReplace(params) {
-	const tempHandle = await fsPromises.open(params.tempPath, OPEN_WRITE_CREATE_FLAGS, params.mode);
+	const tempHandle = await fs$1.open(params.tempPath, OPEN_WRITE_CREATE_FLAGS, params.mode);
 	try {
 		if (typeof params.data === "string") await tempHandle.writeFile(params.data, params.encoding ?? "utf8");
 		else await tempHandle.writeFile(params.data);
@@ -180,7 +180,7 @@ async function writeTempFileForAtomicReplace(params) {
 	}
 }
 async function verifyAtomicWriteResult(params) {
-	const rootWithSep = ensureTrailingSep(await fsPromises.realpath(params.rootDir));
+	const rootWithSep = ensureTrailingSep(await fs$1.realpath(params.rootDir));
 	const opened = await openVerifiedLocalFile(params.targetPath, { rejectHardlinks: true });
 	try {
 		if (!sameFileIdentity(opened.stat, params.expectedStat)) throw new SafeOpenError("path-mismatch", "path changed during write");
@@ -191,13 +191,13 @@ async function verifyAtomicWriteResult(params) {
 }
 async function resolveOpenedFileRealPathForHandle(handle, ioPath) {
 	try {
-		return await fsPromises.realpath(ioPath);
+		return await fs$1.realpath(ioPath);
 	} catch (err) {
 		if (!isNotFoundPathError(err)) throw err;
 	}
 	const fdCandidates = process.platform === "linux" ? [`/proc/self/fd/${handle.fd}`, `/dev/fd/${handle.fd}`] : process.platform === "win32" ? [] : [`/dev/fd/${handle.fd}`];
 	for (const fdPath of fdCandidates) try {
-		return await fsPromises.realpath(fdPath);
+		return await fs$1.realpath(fdPath);
 	} catch {}
 	throw new SafeOpenError("path-mismatch", "unable to resolve opened file path");
 }
@@ -212,10 +212,10 @@ async function openWritableFileWithinRoot(params) {
 	} catch (err) {
 		throw new SafeOpenError("invalid-path", "path alias escape blocked", { cause: err });
 	}
-	if (params.mkdir !== false) await fsPromises.mkdir(path.dirname(resolved), { recursive: true });
+	if (params.mkdir !== false) await fs$1.mkdir(path.dirname(resolved), { recursive: true });
 	let ioPath = resolved;
 	try {
-		const resolvedRealPath = await fsPromises.realpath(resolved);
+		const resolvedRealPath = await fs$1.realpath(resolved);
 		if (!isPathInside(rootWithSep, resolvedRealPath)) throw new SafeOpenError("outside-workspace", "file is outside workspace root");
 		ioPath = resolvedRealPath;
 	} catch (err) {
@@ -227,10 +227,10 @@ async function openWritableFileWithinRoot(params) {
 	let createdForWrite = false;
 	try {
 		try {
-			handle = await fsPromises.open(ioPath, OPEN_WRITE_EXISTING_FLAGS, fileMode);
+			handle = await fs$1.open(ioPath, OPEN_WRITE_EXISTING_FLAGS, fileMode);
 		} catch (err) {
 			if (!isNotFoundPathError(err)) throw err;
-			handle = await fsPromises.open(ioPath, OPEN_WRITE_CREATE_FLAGS, fileMode);
+			handle = await fs$1.open(ioPath, OPEN_WRITE_CREATE_FLAGS, fileMode);
 			createdForWrite = true;
 		}
 	} catch (err) {
@@ -244,7 +244,7 @@ async function openWritableFileWithinRoot(params) {
 		if (!stat.isFile()) throw new SafeOpenError("invalid-path", "path is not a regular file under root");
 		if (stat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
 		try {
-			const lstat = await fsPromises.lstat(ioPath);
+			const lstat = await fs$1.lstat(ioPath);
 			if (lstat.isSymbolicLink() || !lstat.isFile()) throw new SafeOpenError("invalid-path", "path is not a regular file under root");
 			if (!sameFileIdentity(stat, lstat)) throw new SafeOpenError("path-mismatch", "path changed during write");
 		} catch (err) {
@@ -252,7 +252,7 @@ async function openWritableFileWithinRoot(params) {
 		}
 		const realPath = await resolveOpenedFileRealPathForHandle(handle, ioPath);
 		openedRealPath = realPath;
-		const realStat = await fsPromises.stat(realPath);
+		const realStat = await fs$1.stat(realPath);
 		if (!sameFileIdentity(stat, realStat)) throw new SafeOpenError("path-mismatch", "path mismatch");
 		if (realStat.nlink > 1) throw new SafeOpenError("invalid-path", "hardlinked path not allowed");
 		if (!isPathInside(rootWithSep, realPath)) throw new SafeOpenError("outside-workspace", "file is outside workspace root");
@@ -267,7 +267,7 @@ async function openWritableFileWithinRoot(params) {
 		const cleanupCreatedPath = createdForWrite && err instanceof SafeOpenError;
 		const cleanupPath = openedRealPath ?? ioPath;
 		await handle.close().catch(() => {});
-		if (cleanupCreatedPath) await fsPromises.rm(cleanupPath, { force: true }).catch(() => {});
+		if (cleanupCreatedPath) await fs$1.rm(cleanupPath, { force: true }).catch(() => {});
 		throw err;
 	}
 }
@@ -290,7 +290,7 @@ async function writeFileWithinRoot(params) {
 			encoding: params.encoding,
 			mode: targetMode || 384
 		});
-		await fsPromises.rename(tempPath, destinationPath);
+		await fs$1.rename(tempPath, destinationPath);
 		tempPath = null;
 		try {
 			await verifyAtomicWriteResult({
@@ -303,7 +303,7 @@ async function writeFileWithinRoot(params) {
 			throw err;
 		}
 	} finally {
-		if (tempPath) await fsPromises.rm(tempPath, { force: true }).catch(() => {});
+		if (tempPath) await fs$1.rm(tempPath, { force: true }).catch(() => {});
 	}
 }
 async function copyFileWithinRoot(params) {
@@ -331,7 +331,7 @@ async function copyFileWithinRoot(params) {
 		});
 		await pipeline(sourceStream, targetStream);
 	} catch (err) {
-		if (target?.createdForWrite) await fsPromises.rm(target.openedRealPath, { force: true }).catch(() => {});
+		if (target?.createdForWrite) await fs$1.rm(target.openedRealPath, { force: true }).catch(() => {});
 		throw err;
 	} finally {
 		if (!sourceClosedByStream) await source.handle.close().catch(() => {});