token-goat 2.9.30 → 2.9.31

package/dist/token-goat-chunk-FDSREWLX.mjs

@@ -0,0 +1,692 @@
+import { createRequire as __cjsRequire } from 'node:module';
+const require = __cjsRequire(import.meta.url);
+import {
+  errorPrefix
+} from "./token-goat-chunk-JVFSHVFJ.mjs";
+import {
+  stripLeadingAssignments
+} from "./token-goat-chunk-DGS2LVNA.mjs";
+import "./token-goat-chunk-INNPTRUX.mjs";
+import {
+  applyHintTracking,
+  uncorrelatedHint
+} from "./token-goat-chunk-4SMRO4TO.mjs";
+import {
+  sessionSidecarPath
+} from "./token-goat-chunk-WBA5SKT4.mjs";
+import "./token-goat-chunk-MNWKPRAL.mjs";
+import {
+  sessionStateKey
+} from "./token-goat-chunk-C75NA7PL.mjs";
+import "./token-goat-chunk-P6VGNTQT.mjs";
+import {
+  contextOutput,
+  getCwd
+} from "./token-goat-chunk-76FGDLRO.mjs";
+import "./token-goat-chunk-GL3ETKSC.mjs";
+import "./token-goat-chunk-U4WHMG6Y.mjs";
+import "./token-goat-chunk-GVB2MUST.mjs";
+import "./token-goat-chunk-XB5KKOCG.mjs";
+import "./token-goat-chunk-OUKDTVNU.mjs";
+import "./token-goat-chunk-4GILLLWY.mjs";
+import "./token-goat-chunk-BFCWY73P.mjs";
+import "./token-goat-chunk-KGEFFSHD.mjs";
+import "./token-goat-chunk-XX6O25RN.mjs";
+import "./token-goat-chunk-HAVAOB3S.mjs";
+import {
+  hasPreciseSecret,
+  redactSecrets
+} from "./token-goat-chunk-T5P5ACNQ.mjs";
+import "./token-goat-chunk-7EZTZOMC.mjs";
+import "./token-goat-chunk-QYHO5CPH.mjs";
+import {
+  projectHash,
+  resolveProjectRoot
+} from "./token-goat-chunk-4GBVPH3D.mjs";
+import {
+  registerReset
+} from "./token-goat-chunk-YZAAZU2S.mjs";
+import "./token-goat-chunk-IVE6U7KV.mjs";
+import {
+  atomicWriteText,
+  ensureDirSync
+} from "./token-goat-chunk-HU4TORC5.mjs";
+import {
+  fencedCommand
+} from "./token-goat-chunk-GGGG7RWB.mjs";
+import "./token-goat-chunk-AM5V6GSX.mjs";
+import {
+  displaySafeText
+} from "./token-goat-chunk-FNFBKLRD.mjs";
+import {
+  dataDir
+} from "./token-goat-chunk-CO3UYX6G.mjs";
+import {
+  init_define_import_meta_env
+} from "./token-goat-chunk-A37V4PBF.mjs";
+
+// src/recovery_pairs.ts
+init_define_import_meta_env();
+import { createHash, createHmac, randomBytes } from "node:crypto";
+import { linkSync, lstatSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join, posix, relative, sep } from "node:path";
+
+// src/recovery_fix_policy.ts
+init_define_import_meta_env();
+var SAFE_FLAG_NAMES = [
+  "--ci",
+  "--ignore-scripts",
+  "--frozen-lockfile",
+  "--immutable",
+  "--no-audit",
+  "--no-fund",
+  "--silent",
+  "--quiet",
+  "--verbose",
+  "--offline",
+  "--prefer-offline",
+  "--production",
+  "--legacy-peer-deps",
+  "--if-present",
+  "--release",
+  "--locked",
+  "--frozen",
+  "--all-features",
+  "--all-targets",
+  "--no-default-features",
+  "--workspace",
+  "--lib",
+  "--bins",
+  "--tests",
+  "--dev",
+  "--no-dev",
+  "--all-extras",
+  "--upgrade",
+  "--no-cache-dir",
+  "--no-cache",
+  "--no-deps",
+  "--no-build-isolation",
+  "--no-install-project",
+  "--no-fail-fast",
+  "--fail-fast",
+  "--info",
+  "--stacktrace",
+  "--no-daemon",
+  "--batch-mode",
+  "--no-restore",
+  "--no-build",
+  "--nologo",
+  "-q",
+  "-vvv",
+  "-vv",
+  "-v",
+  "-B",
+  "-U",
+  "-o",
+  "-e",
+  "-race",
+  "-short",
+  "-json",
+  "-DskipTests"
+];
+var SAFE_FLAG_VALUES = ["-count", "-parallel", "--jobs", "--concurrency", "--maxsockets"];
+var FLAG = String.raw`(?:\s+(?:(?:${SAFE_FLAG_NAMES.join("|")})(?:=(?:true|false|\d{1,5}))?|(?:${SAFE_FLAG_VALUES.join("|")})=\d{1,5}|-j\d{1,3}|--console=plain)(?=\s|$))`;
+var NO_DOTDOT = String.raw`(?![\w./-]*?(?<![\w.-])\.\.(?![\w.-]))`;
+var PATH_ARG = String.raw`(?![/-])${NO_DOTDOT}[\w./-]+`;
+var PIP_ARGS = String.raw`(?:${FLAG}|\s+-r\s+${PATH_ARG}|\s+-e\s+(?=\.)${PATH_ARG}|\s+\.)*`;
+var FIX_TASK_VERBS = ["build", "tests?", "lint", "typecheck", "check", "setup", "install", "bootstrap", "generate", "gen", "codegen", "compile"];
+var UNSAFE_TASK_WORDS = ["deploy", "publish", "release", "reset", "drop", "migrat", "seed", "push", "upload", "prune", "wipe", "destroy", "clean", "purge", "delete", "rollback"];
+var TASK = String.raw`(?!\S*(?:${UNSAFE_TASK_WORDS.join("|")}))(?:${FIX_TASK_VERBS.join("|")})(?:[:_-][\w:.-]*)?(?=\s|$)`;
+var FIX_VERB_ALLOWLIST = [
+  { name: "js package manager install, build or test", pattern: new RegExp(String.raw`^(?:npm|pnpm|yarn|bun)\s+(?:ci|install|i|test|t|build|rebuild)${FLAG}*$`), example: "npm ci" },
+  { name: "js package manager script", pattern: new RegExp(String.raw`^(?:npm|pnpm|yarn|bun)\s+run\s+${TASK}${FLAG}*$`), example: "npm run build" },
+  { name: "pip install from a manifest", pattern: new RegExp(String.raw`^(?:python3?\s+-m\s+)?pip3?\s+install${PIP_ARGS}$`), example: "pip install -r requirements.txt" },
+  { name: "uv pip install from a manifest", pattern: new RegExp(String.raw`^uv\s+pip\s+install${PIP_ARGS}$`), example: "uv pip install -e ." },
+  { name: "python environment sync", pattern: new RegExp(String.raw`^(?:uv\s+sync|poetry\s+install|pipenv\s+(?:install|sync))${FLAG}*$`), example: "uv sync" },
+  { name: "cargo", pattern: new RegExp(String.raw`^cargo\s+(?:build|test|fetch|check)${FLAG}*$`), example: "cargo fetch" },
+  { name: "go build and test", pattern: new RegExp(String.raw`^go\s+(?:build|test|vet)(?:${FLAG}|\s+(?=\./)${PATH_ARG})*$`), example: "go test ./..." },
+  { name: "go modules", pattern: new RegExp(String.raw`^go\s+mod\s+(?:download|tidy|vendor)${FLAG}*$`), example: "go mod download" },
+  { name: "make target", pattern: new RegExp(String.raw`^make(?:\s+${TASK}|${FLAG})*$`), example: "make setup" },
+  { name: "virtualenv activation", pattern: new RegExp(String.raw`^(?:source|\.)\s+(?=${PATH_ARG}$)[\w./-]*activate(?:\.\w+)?$`), example: "source .venv/bin/activate" },
+  { name: "bundler", pattern: new RegExp(String.raw`^bundle\s+install${FLAG}*$`), example: "bundle install" },
+  { name: "dotnet", pattern: new RegExp(String.raw`^dotnet\s+(?:restore|build|test)${FLAG}*$`), example: "dotnet restore" },
+  { name: "maven and gradle", pattern: new RegExp(String.raw`^(?:\./)?(?:mvnw?|gradlew?)(?:\s+(?:clean|install|compile|test|package|verify|build|assemble)|${FLAG})+$`), example: "mvn clean install" },
+  { name: "cd into a directory", pattern: new RegExp(String.raw`^cd\s+${PATH_ARG}$`), example: "cd services/api" }
+];
+var RERUN_COMMAND = /^(?:python3?\s+-m\s+)?(?:pytest|vitest|jest|mocha|tsc|eslint|ruff|mypy|flake8)(?:\s+\S.*)?$|^ls(?:\s+[\w./-]+)*$/;
+var CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+var FORBIDDEN_IN_PART = /[|;<>&$`]|\b(?:curl|wget|sudo|iex|eval|base64)\b|Invoke-Expression/i;
+var SOURCE_FLAG = /(?:^|\s)(?:--?(?:index-url|extra-index-url|default-index|index|find-links|registry|trusted-host|proxy|repository|repository-url|file|makefile)|-[ifc])(?:=|\s|$)/i;
+var SAFE_ENV_NAMES = /* @__PURE__ */ new Set(["CI", "NODE_ENV", "FORCE_COLOR", "NO_COLOR", "TZ", "LANG", "LC_ALL", "RUST_BACKTRACE", "DEBUG"]);
+var SAFE_ENV_VALUE = /^[\w.,:-]{0,32}$/;
+function setsUnsafeVariable(word) {
+  if (!word.includes("=")) return false;
+  const assign = /^([A-Za-z_]\w*)=(.*)$/.exec(word);
+  return assign === null || !SAFE_ENV_NAMES.has(assign[1] ?? "") || !SAFE_ENV_VALUE.test(assign[2] ?? "");
+}
+var SAFE_WRAPPER_FLAGS = /* @__PURE__ */ new Set(["-y", "--yes", "--no-install"]);
+var WRAPPER_WORDS = /* @__PURE__ */ new Set(["env", "npx", "bunx", "uv", "run", "poetry", "pipenv", "pnpm", "exec"]);
+function peeledWordIsSafe(word) {
+  if (word === "" || SAFE_WRAPPER_FLAGS.has(word) || WRAPPER_WORDS.has(word)) return true;
+  return /^[A-Za-z_]\w*=/.test(word) && !setsUnsafeVariable(word);
+}
+function peelPart(segment, wrappers) {
+  const squeezed = segment.replace(/\s+/g, " ").trim();
+  let core = segment;
+  for (let peel = 0; peel < 4; peel++) {
+    const next = stripLeadingAssignments(core).replace(/\s+/g, " ").trim().replace(wrappers, "");
+    if (next === core) break;
+    core = next;
+  }
+  core = core.replace(/\s+/g, " ").trim();
+  if (!squeezed.endsWith(core)) return { core, envIsSafe: false };
+  return { core, envIsSafe: squeezed.slice(0, squeezed.length - core.length).split(" ").every(peeledWordIsSafe) };
+}
+var RERUN_PLACEHOLDER = "(the same command)";
+var SAFE_LEAD = /^(?:(?:npx\s+(?:(?:-y|--yes|--no-install)\s+)*|bunx\s+|uv\s+run\s+|poetry\s+run\s+|pipenv\s+run\s+|pnpm\s+exec\s+))?$/;
+var JS_RUNNER_CORE = /^(?:vitest|jest|mocha|tsc|eslint)(?:\s|$)/;
+function leadFitsCore(lead, core) {
+  return !/(?:^|\s)(?:npx|bunx|pnpm\s+exec)(?:\s|$)/.test(lead) || JS_RUNNER_CORE.test(core);
+}
+function rerunIsAllowed(core) {
+  if (FORBIDDEN_IN_PART.test(core) || SOURCE_FLAG.test(core)) return false;
+  return RERUN_COMMAND.test(core) || FIX_VERB_ALLOWLIST.some((verb) => verb.pattern.test(core));
+}
+var MAKE_ENV_OVERRIDE = /^make\b.*\s(?:-e|--environment-overrides)(?=\s|$)/;
+function fixIsAllowed(fix, wrappers) {
+  if (CONTROL_CHARS.test(fix)) return false;
+  for (const part of fix.split(" && ")) {
+    if (part === "" || FORBIDDEN_IN_PART.test(part) || SOURCE_FLAG.test(part)) return false;
+    if (part.endsWith(RERUN_PLACEHOLDER)) {
+      if (!SAFE_LEAD.test(part.slice(0, part.length - RERUN_PLACEHOLDER.length))) return false;
+      continue;
+    }
+    const { core, envIsSafe } = peelPart(part, wrappers);
+    if (!envIsSafe || MAKE_ENV_OVERRIDE.test(core) || !FIX_VERB_ALLOWLIST.some((verb) => verb.pattern.test(core))) return false;
+  }
+  return true;
+}
+var CREDENTIAL_PATTERNS = [
+  /(?:^|\s)--?(?:password|passwd|passphrase|pass|pwd|pw|token|api[-_]?key|secret|access[-_]?key|client[-_]?secret|auth|cookie|credentials?)(?:=|\s+)\S/i,
+  /(?:^|\s)(?:-u|--user)\s+\S*:\S/,
+  /\b(?:mysql|mysqldump|mysqladmin|psql|pg_dump|pg_restore|mongo\w*|redis-cli|sqlcmd)\b[^|;&]*\s-(?:p\S|W\s+\S)/i,
+  /(?:^|[\s;&|])(?:[A-Za-z_]\w*)?(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|PASSPHRASE|PASS|PWD|PAT|CRED|CREDENTIALS?|AUTH)=/i,
+  /\bsshpass\b/i,
+  /\bopenssl\b[^|;&]*\s-(?:k|kfile|pass|passin|passout)\s+\S/i,
+  /(?:^|\s)(?:-H|--header)[\s=]+["']?[\w-]*(?:auth|token|key|secret|cookie|session|passw)[\w-]*\s*:\s*\S/i,
+  /:\/\/[^\s/:@]+:[^\s/@]+@/,
+  /\b(?:authorization|bearer)\b/i
+];
+function carriesCredential(text) {
+  return redactSecrets(text).text !== text || hasPreciseSecret(text) || CREDENTIAL_PATTERNS.some((pattern) => pattern.test(text));
+}
+
+// src/recovery_pairs.ts
+var RECOVERY_WINDOW = 6;
+var MAX_OPEN = 4;
+var MAX_PAIRS = 50;
+var PAIR_TTL_MS = 90 * 24 * 60 * 60 * 1e3;
+var MAX_FIX_CHARS = 200;
+var MAX_COMMAND_CHARS = 400;
+var MAX_FIX_COMMANDS = 2;
+var PENDING_SUFFIX = ".recovery-pending";
+var STORE_VERSION = 4;
+var PENDING_VERSION = 4;
+var OTHER_STEP = "<other>";
+var MIN_SESSIONS = 2;
+var MAX_SESSIONS = 8;
+var DIAGNOSTIC_WORDS = /* @__PURE__ */ new Set(["ls", "dir", "cat", "pwd", "which", "where", "echo", "head", "tail", "grep", "rg", "find", "type", "wc", "stat", "file", "cd", "test", "true", "date", "whoami", "env", "printenv"]);
+var DIAGNOSTIC_GIT = /^git\s+(?:status|log|diff|show|branch|remote|rev-parse)\b/;
+var VERSION_PROBE = /\s(?:--version|-v|-V|version)\s*$/;
+var DESTRUCTIVE = /\brm\s+-[a-z]*[rf]|\bgit\s+reset\s+--hard\b|\bgit\s+clean\s+-[a-z]*f|\bgit\s+push\b[^|;&]*(?:--force|\s-f\b)|\b(?:drop|truncate)\s+(?:table|database|schema)\b|\bRemove-Item\b[^|;&]*-Recurse|\bdel\s+\/[sq]|\bformat\s+[a-z]:|\bmkfs\b|\bdd\s+if=/i;
+var UNFENCEABLE = /[`\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+var WRAPPER = /^(?:env\s+(?:(?:-i|--ignore-environment)\s+)*|npx\s+(?:(?:-y|--yes|--no-install)\s+)*|bunx\s+|uv\s+run\s+|poetry\s+run\s+|pipenv\s+run\s+|pnpm\s+exec\s+)/;
+function squeeze(text) {
+  return text.replace(/\s+/g, " ").trim();
+}
+function isLearnableCommand(command) {
+  const text = command.trim();
+  if (text === "" || text.length > MAX_COMMAND_CHARS) return false;
+  if (UNFENCEABLE.test(text)) return false;
+  if (/token-goat/i.test(text) || DESTRUCTIVE.test(text)) return false;
+  return !carriesCredential(text);
+}
+function splitCommandPrefix(command) {
+  const text = squeeze(command);
+  let quote = null;
+  let cut = 0;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i] ?? "";
+    if (quote !== null) {
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") quote = ch;
+    else if (ch === ";") cut = i + 1;
+    else if (ch === "&" && text[i + 1] === "&" && text[i - 1] !== "&") {
+      cut = i + 2;
+      i += 1;
+    }
+  }
+  const prefix = text.slice(0, cut).trim();
+  const run = text.slice(cut).trim();
+  let core = run;
+  for (let peel = 0; peel < 4; peel++) {
+    const stripped = squeeze(stripLeadingAssignments(core));
+    const next = stripped.replace(WRAPPER, "");
+    if (next === core) break;
+    core = next;
+  }
+  return { prefix, run, core };
+}
+function isDiagnostic(command) {
+  const { core } = splitCommandPrefix(command);
+  if (DIAGNOSTIC_GIT.test(core) || VERSION_PROBE.test(` ${core}`)) return true;
+  const word = core.split(" ")[0] ?? "";
+  return DIAGNOSTIC_WORDS.has(word) && !/[>|]/.test(core);
+}
+function learnableFix(failed, success, between) {
+  if (![failed, ...between].every(isLearnableCommand)) return null;
+  const steps = between.flatMap((command) => {
+    const step = betweenStep(command);
+    return step === null ? [] : [step];
+  });
+  return learnFromDigest(digestFailed(failed), success, steps);
+}
+function digestKeyPath() {
+  return join(dataDir(), "recovery_pairs", "install.key");
+}
+var DIGEST_KEY_HEX = /^[0-9a-f]{64}$/;
+var digestKeyCache;
+registerReset(() => {
+  digestKeyCache = void 0;
+});
+function digestKey() {
+  const path = digestKeyPath();
+  if (digestKeyCache?.path === path) return digestKeyCache.key;
+  let key = readRegularKey(path);
+  if (key === null) {
+    const fresh = randomBytes(32).toString("hex");
+    key = installKey(path, fresh) ?? readRegularKey(path) ?? fresh;
+  }
+  digestKeyCache = { path, key };
+  return key;
+}
+function readRegularKey(path) {
+  try {
+    if (!lstatSync(path).isFile()) return null;
+    const key = readFileSync(path, "utf8").trim();
+    return DIGEST_KEY_HEX.test(key) ? key : null;
+  } catch {
+    return null;
+  }
+}
+function writeTempKey(path, key) {
+  for (let attempt = 0; ; attempt++) {
+    const temp = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+    try {
+      writeFileSync(temp, key, { flag: "wx", mode: 384 });
+      return temp;
+    } catch (error) {
+      if (error.code !== "EEXIST" || attempt >= 3) throw error;
+    }
+  }
+}
+function installKey(path, key) {
+  let temp;
+  try {
+    ensureDirSync(dirname(path));
+    temp = writeTempKey(path, key);
+    for (let attempt = 0; attempt < 3; attempt++) {
+      const present = readRegularKey(path);
+      if (present !== null) return present;
+      rmSync(path, { recursive: true, force: true });
+      try {
+        linkSync(temp, path);
+        return readRegularKey(path);
+      } catch (error) {
+        const code = error.code;
+        if (code === "EEXIST") continue;
+        renameSync(temp, path);
+        return readRegularKey(path);
+      }
+    }
+    return readRegularKey(path);
+  } catch {
+    return null;
+  } finally {
+    if (temp !== void 0) rmSync(temp, { force: true });
+  }
+}
+function digestOf(text) {
+  return createHmac("sha256", digestKey()).update(text).digest("hex");
+}
+function digestFailed(command) {
+  const { prefix, run, core } = splitCommandPrefix(command);
+  return { core: digestOf(core), prefix: digestOf(prefix), run: digestOf(run) };
+}
+function betweenStep(command) {
+  if (isDiagnostic(command)) return null;
+  const text = squeeze(command);
+  return text.length <= MAX_FIX_CHARS && !carriesCredential(text) && fixIsAllowed(text, WRAPPER) ? text : OTHER_STEP;
+}
+function rerunPart(success) {
+  if (!rerunIsAllowed(success.core) || !success.run.endsWith(success.core)) return null;
+  const lead = success.run.slice(0, success.run.length - success.core.length);
+  if (success.prefix === "" && lead === "") return null;
+  if (!leadFitsCore(lead, success.core)) return null;
+  return squeeze(`${success.prefix} ${lead}${RERUN_PLACEHOLDER}`);
+}
+function learnFromDigest(failed, success, steps) {
+  const s = splitCommandPrefix(success);
+  if (s.core === "" || digestOf(s.core) !== failed.core || !isLearnableCommand(success)) return null;
+  const wrapperDelta = digestOf(s.prefix) !== failed.prefix || digestOf(s.run) !== failed.run;
+  const parts = steps.slice(-MAX_FIX_COMMANDS);
+  if (wrapperDelta) {
+    const rerun = rerunPart(s);
+    if (rerun === null) return null;
+    parts.push(rerun);
+  }
+  if (parts.length === 0) return null;
+  const fix = parts.join(" && ");
+  return isReplayable(fix) ? fix : null;
+}
+function storePath(key) {
+  return join(dataDir(), "recovery_pairs", `${key}.json`);
+}
+function recoveryStorePath(key) {
+  return storePath(key);
+}
+function dropStore(key) {
+  try {
+    rmSync(storePath(key), { force: true });
+  } catch {
+  }
+}
+function loadStore(key, now) {
+  try {
+    const parsed = JSON.parse(readFileSync(storePath(key), "utf8"));
+    if (parsed.version !== STORE_VERSION) {
+      dropStore(key);
+      return [];
+    }
+    const pairs = parsed.pairs;
+    if (!Array.isArray(pairs)) return [];
+    const kept = pairs.filter((p) => {
+      const o = p;
+      return o !== null && typeof o === "object" && typeof o.signature === "string" && typeof o.commandShape === "string" && typeof o.fix === "string" && typeof o.count === "number" && typeof o.lastSeen === "number" && typeof o.helped === "number" && typeof o.hurt === "number" && now - o.lastSeen <= PAIR_TTL_MS;
+    }).map((p) => ({ ...p, sessions: Array.isArray(p.sessions) ? p.sessions.filter((s) => typeof s === "string") : [] }));
+    if (kept.length === 0) dropStore(key);
+    return kept;
+  } catch {
+    return [];
+  }
+}
+function saveStore(key, pairs) {
+  try {
+    const kept = [...pairs].sort((a, b) => b.lastSeen - a.lastSeen).slice(0, MAX_PAIRS);
+    if (kept.length === 0) {
+      dropStore(key);
+      return;
+    }
+    const target = storePath(key);
+    ensureDirSync(dirname(target));
+    atomicWriteText(target, JSON.stringify({ version: STORE_VERSION, pairs: kept }));
+  } catch {
+  }
+}
+function isRetired(pair) {
+  return pair.hurt >= 2 && pair.hurt > pair.helped;
+}
+function matches(pair, signature, shape) {
+  return pair.signature === signature && pair.commandShape === shape;
+}
+function isReplayable(fix) {
+  return fix.length <= MAX_FIX_CHARS && !carriesCredential(fix) && fixIsAllowed(fix, WRAPPER);
+}
+function placeholderLeadFits(fix, core) {
+  const last = fix.split(" && ").pop() ?? "";
+  return !last.endsWith(RERUN_PLACEHOLDER) || leadFitsCore(last.slice(0, last.length - RERUN_PLACEHOLDER.length), core);
+}
+function isOffered(pair, offered, signature, shape) {
+  return pair.fix === offered.fix && matches(pair, signature, shape);
+}
+function sessionTag(event) {
+  return createHash("sha256").update(sessionStateKey(event)).digest("hex").slice(0, 12);
+}
+function addSession(pair, tag) {
+  if (!pair.sessions.includes(tag)) pair.sessions = [...pair.sessions, tag].slice(-MAX_SESSIONS);
+}
+function recoveryProjectKey(cwd) {
+  try {
+    return projectHash(resolveProjectRoot(cwd === void 0 ? void 0 : { project: cwd }));
+  } catch {
+    return null;
+  }
+}
+function loadRecoveryPairs(cwd) {
+  const key = recoveryProjectKey(cwd);
+  return key === null ? [] : loadStore(key, Date.now());
+}
+function pendingPath(event) {
+  return event.sessionId ? sessionSidecarPath(sessionStateKey(event), PENDING_SUFFIX) : null;
+}
+function isOpenPair(value) {
+  const o = value;
+  return o !== null && typeof o === "object" && typeof o.key === "string" && typeof o.shape === "string" && typeof o.failedPrefix === "string" && typeof o.failedRun === "string" && typeof o.signature === "string" && typeof o.calls === "number" && Array.isArray(o.between) && o.between.every((step) => typeof step === "string");
+}
+function readPending(target) {
+  try {
+    const parsed = JSON.parse(readFileSync(target, "utf8"));
+    if (parsed.version !== PENDING_VERSION) {
+      const fresh = { open: [], shown: [] };
+      writePending(target, fresh);
+      return fresh;
+    }
+    const state = { open: Array.isArray(parsed.open) ? parsed.open.filter(isOpenPair) : [], shown: Array.isArray(parsed.shown) ? parsed.shown : [] };
+    if (parsed.projectKey !== void 0) state.projectKey = typeof parsed.projectKey === "string" ? parsed.projectKey : null;
+    if (parsed.root !== void 0) state.root = typeof parsed.root === "string" ? parsed.root : null;
+    if (typeof parsed.cwd === "string") state.cwd = parsed.cwd;
+    return state;
+  } catch {
+    return { open: [], shown: [] };
+  }
+}
+function projectFor(state, event) {
+  const cwd = getCwd(event);
+  if (state.projectKey !== void 0 && state.root !== void 0 && state.cwd === cwd) return { key: state.projectKey, root: state.root };
+  let root = null;
+  let key = null;
+  try {
+    root = resolveProjectRoot(cwd === void 0 ? void 0 : { project: cwd });
+    key = projectHash(root);
+  } catch {
+  }
+  state.projectKey = key;
+  state.root = root;
+  if (cwd === void 0) delete state.cwd;
+  else state.cwd = cwd;
+  return { key, root };
+}
+function writePending(target, state) {
+  try {
+    ensureDirSync(dirname(target));
+    atomicWriteText(target, JSON.stringify({ ...state, version: PENDING_VERSION }));
+  } catch {
+  }
+}
+function toPosix(path) {
+  return path.split(sep).join("/");
+}
+var LEADING_CD = /^cd\s+("[^"]+"|'[^']+'|[^\s;&|]+)\s*(?:&&|;)/;
+function scopeOf(root, cwd, command) {
+  if (root === null || cwd === void 0) return "";
+  let dir = toPosix(relative(root, cwd)) || ".";
+  const cd = LEADING_CD.exec(squeeze(command));
+  if (cd !== null) {
+    const target = (cd[1] ?? "").replace(/^["']|["']$/g, "");
+    dir = isAbsolute(target) ? toPosix(relative(root, target)) || "." : posix.join(dir, target);
+  }
+  const scope = posix.normalize(dir);
+  return scope === "." ? "" : scope.replace(/\/$/, "");
+}
+function shapeOf(scope, core) {
+  return scope === "" ? core : `${scope}::${core}`;
+}
+function isGenericHeader(line) {
+  return /^>\s/.test(line) || /^[=\-*#~_\s]*$/.test(line) || /^[=\-*#~_]{2}/.test(line) && /[=\-*#~_]{2}$/.test(line) || !/[A-Za-z0-9]/.test(line);
+}
+var ERROR_LINE = /error|fail|cannot|not found|exception|denied|no such|traceback/i;
+function signatureOf(errorText) {
+  const lines = redactSecrets(errorText).text.split("\n").map((line) => line.trim()).filter((line) => line !== "" && !/^Exit code \d+$/.test(line));
+  const exit = /^Exit code (\d+)/.exec(redactSecrets(errorText).text.trim());
+  const informative = lines.filter((line) => !isGenericHeader(line));
+  if (informative.length === 0) return null;
+  const chosen = informative.find((line) => ERROR_LINE.test(line));
+  const picked = chosen === void 0 ? informative.slice(0, 3) : [chosen];
+  const text = `${exit === null ? "" : `exit ${exit[1] ?? ""}: `}${picked.map((line) => errorPrefix(line)).join(" | ")}`;
+  const signature = text.slice(0, MAX_FIX_CHARS);
+  return carriesCredential(signature) ? null : digestOf(signature);
+}
+function recoveryAfterFailure(event, failure) {
+  try {
+    const target = pendingPath(event);
+    if (target === null || !isLearnableCommand(failure.command)) return null;
+    const { core } = splitCommandPrefix(failure.command);
+    if (core === "") return null;
+    const signature = signatureOf(failure.errorText);
+    if (signature === null) return null;
+    const state = readPending(target);
+    const { key, root } = projectFor(state, event);
+    const failed = digestFailed(failure.command);
+    const shape = digestOf(shapeOf(scopeOf(root, getCwd(event), failure.command), core));
+    const now = Date.now();
+    const pairs = key === null ? [] : loadStore(key, now);
+    const prior = state.open.find((o) => o.key === failed.core);
+    if (prior?.offered !== void 0 && prior.fixRan === true) {
+      const pair = pairs.find((p) => prior.offered !== void 0 && isOffered(p, prior.offered, prior.signature, prior.shape));
+      if (pair !== void 0 && key !== null) {
+        pair.hurt += 1;
+        saveStore(key, pairs);
+      }
+    }
+    const candidates = pairs.filter((p) => matches(p, signature, shape) && !isRetired(p) && p.sessions.length >= MIN_SESSIONS && isReplayable(p.fix) && placeholderLeadFits(p.fix, core)).sort((a, b) => b.helped - b.hurt - (a.helped - a.hurt) || b.count - a.count || b.lastSeen - a.lastSeen);
+    const best = candidates[0];
+    const open = { key: failed.core, shape, failedPrefix: failed.prefix, failedRun: failed.run, signature, calls: 0, between: [], ...best === void 0 ? {} : { offered: { fix: best.fix } } };
+    state.open = [...state.open.filter((o) => o.key !== failed.core), open].slice(-MAX_OPEN);
+    const id = `${signature}
+${shape}`;
+    const speak = best !== void 0 && !state.shown.includes(id);
+    if (speak) state.shown = [...state.shown, id].slice(-64);
+    writePending(target, state);
+    if (!speak || best === void 0) return null;
+    const text = `&#91;token-goat] In an earlier session this same failure was followed by: ${fencedCommand(displaySafeText(best.fix))} (seen ${best.count} ${best.count === 1 ? "time" : "times"}, not verified)`;
+    const out = applyHintTracking(event, contextOutput(text), uncorrelatedHint("recovery_pair"));
+    return out.hookType === "context" ? out.context : null;
+  } catch {
+    return null;
+  }
+}
+function advanceOfferedFix(open, command) {
+  const offered = open.offered;
+  if (offered === void 0 || open.fixRan === true) return;
+  const ran = squeeze(command);
+  const parts = offered.fix.split(" && ");
+  if (ran === offered.fix) {
+    open.fixRan = true;
+    return;
+  }
+  const next = open.progress ?? 0;
+  if (ran !== parts[next]) return;
+  open.progress = next + 1;
+  if (open.progress === parts.length) open.fixRan = true;
+}
+function recoveryAfterSuccess(event, command) {
+  try {
+    const target = pendingPath(event);
+    if (target === null) return;
+    const state = readPending(target);
+    if (state.open.length === 0) return;
+    const clean = isLearnableCommand(command);
+    const now = Date.now();
+    const { key } = projectFor(state, event);
+    const tag = sessionTag(event);
+    const keep = [];
+    const coreDigest = digestOf(splitCommandPrefix(command).core);
+    const step = clean ? betweenStep(command) : null;
+    let store = null;
+    let changed = false;
+    for (const open of state.open) {
+      open.calls += 1;
+      if (open.calls > RECOVERY_WINDOW) continue;
+      if (!clean) continue;
+      if (coreDigest === open.key) {
+        store ??= key === null ? [] : loadStore(key, now);
+        const offered = open.offered;
+        if (offered !== void 0 && open.fixRan === true) {
+          const pair = store.find((p) => isOffered(p, offered, open.signature, open.shape));
+          if (pair !== void 0) {
+            pair.helped += 1;
+            pair.count += 1;
+            pair.lastSeen = now;
+            addSession(pair, tag);
+            changed = true;
+          }
+          continue;
+        }
+        const fix = learnFromDigest({ core: open.key, prefix: open.failedPrefix, run: open.failedRun }, command, open.between);
+        if (fix !== null) {
+          const sameShape = store.filter((p) => matches(p, open.signature, open.shape));
+          const same = sameShape.find((p) => p.fix === fix);
+          if (same !== void 0) {
+            same.count += 1;
+            same.lastSeen = now;
+            addSession(same, tag);
+            changed = true;
+          } else if (!sameShape.some((p) => p.helped > 0)) {
+            store = [...store.filter((p) => !matches(p, open.signature, open.shape)), { signature: open.signature, commandShape: open.shape, fix, count: 1, lastSeen: now, helped: 0, hurt: 0, sessions: [tag] }];
+            changed = true;
+          }
+        }
+        continue;
+      }
+      advanceOfferedFix(open, command);
+      if (step !== null) open.between = [...open.between, step].slice(-RECOVERY_WINDOW);
+      keep.push(open);
+    }
+    if (changed && store !== null && key !== null) saveStore(key, store);
+    state.open = keep;
+    writePending(target, state);
+  } catch {
+  }
+}
+function recoveryAfterEdit(event) {
+  try {
+    const target = pendingPath(event);
+    if (target === null) return;
+    const state = readPending(target);
+    if (state.open.length === 0) return;
+    state.open = [];
+    writePending(target, state);
+  } catch {
+  }
+}
+export {
+  MAX_FIX_CHARS,
+  MAX_PAIRS,
+  OTHER_STEP,
+  PAIR_TTL_MS,
+  RECOVERY_WINDOW,
+  WRAPPER,
+  installKey,
+  isLearnableCommand,
+  isRetired,
+  learnableFix,
+  loadRecoveryPairs,
+  recoveryAfterEdit,
+  recoveryAfterFailure,
+  recoveryAfterSuccess,
+  recoveryProjectKey,
+  recoveryStorePath,
+  splitCommandPrefix
+};