zelari-code 0.1.0

package/dist/cli/providerConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerConfig.js","sourceRoot":"","sources":["../../src/cli/providerConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7F,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAwC,MAAM,eAAe,CAAC;AAiBhF,MAAM,QAAQ,GAAmB;IAC/B,gBAAgB,EAAE,mBAAmB;IACrC,eAAe,EAAE;QACf,mBAAmB,EAAE,QAAQ;QAC7B,SAAS,EAAE,cAAc;QACzB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,EAAE;KACb;IACD,eAAe,EAAE,EAAE;CACpB,CAAC;AAEF,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC,GAAG,CAAC,6BAA6B;WAC3C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB;IAC/B,yDAAyD;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC1C,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,IAAI,MAAM,GAA0B,IAAI,CAAC;IACzC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;YAC1D,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ;mBAClF,MAAM,CAAC,eAAe,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;gBAC1E,MAAM,GAAG;oBACP,gBAAgB,EAAE,MAAM,CAAC,gBAAgC;oBACzD,eAAe,EAAE,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE;oBAC3E,eAAe,EAAE,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC;iBAC9D,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAmB,MAAM,IAAI;QACrC,GAAG,QAAQ;QACX,eAAe,EAAE,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE;QAChD,eAAe,EAAE,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE;KACjD,CAAC;IACF,+CAA+C;IAC/C,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,gBAAgB,GAAG,SAAyB,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,QAAQ,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAsB;IACjD,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,GAAsD;IAEtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,MAAM,GAA0C,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,MAAM,CAAC,GAAmB,CAAC,GAAG,OAAO,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,EAAgB;IAChD,OAAO,iBAAiB,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAgB,EAAE,GAAW;IAC7D,MAAM,IAAI,GAA6B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,iBAAiB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC;QACH,kCAAkC;QAClC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC;IACrC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mBAAmB,CAAC,EAAgB;IAClD,MAAM,IAAI,GAA6B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,iBAAiB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,IAAI,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,eAAe,CAAC;QAAE,OAAO,CAAC,QAAQ;IACrD,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAClC,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAgB;IAClD,MAAM,IAAI,GAA6B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,iBAAiB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,MAAM,CAAC,gBAAgB,GAAG,EAAE,CAAC;IAC7B,sDAAsD;IACtD,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAgB,EAAE,KAAa;IACjE,MAAM,IAAI,GAA6B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,iBAAiB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1C,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAgB;IAClD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACrE,0EAA0E;IAC1E,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;AACpH,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ;eAClF,MAAM,CAAC,eAAe,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;YAC1E,OAAO;gBACL,gBAAgB,EAAE,MAAM,CAAC,gBAAgC;gBACzD,eAAe,EAAE,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE;gBAC3E,eAAe,EAAE,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC;aAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,OAAO;QACL,GAAG,QAAQ;QACX,eAAe,EAAE,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE;QAChD,eAAe,EAAE,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE;KACjD,CAAC;AACJ,CAAC"}

package/dist/cli/providerFailover.js

@@ -0,0 +1,90 @@
+/**
+ * providerFailover — wraps two OpenAI-compatible providers so the second
+ * is tried when the first yields transient errors (Task B.4).
+ *
+ * Behavior:
+ *   - Stream events from `primary` first
+ *   - On the FIRST transient failure (network error OR HTTP 5xx),
+ *     close the primary stream and switch to `fallback`
+ *   - On a 4xx error (auth, bad request) do NOT failover — surface the
+ *     error to the caller; these are programming/auth issues that won't
+ *     be fixed by retrying against a different provider
+ *   - On a normal `finish` event, the fallback is NEVER tried
+ *
+ * "First failure" means we DON'T keep retrying the primary. If you want
+ * N retries, write your own retry loop outside.
+ *
+ * @see docs/plans/2026-06-29-anathema-coder-v3-B.md
+ */
+const DEFAULT_IS_TRANSIENT = (delta) => delta.kind === 'error';
+/**
+ * Wraps two ProviderStreamFn instances with first-failure failover.
+ * Returns a new ProviderStreamFn — pass this to AgentHarness.
+ */
+export function providerFailover(options) {
+    const isTransient = options.isTransientFailure ?? DEFAULT_IS_TRANSIENT;
+    // Task J.1 (v3-J) — when a label is provided, the [failover] messages
+    // include it so the user can see which provider the system switched to.
+    // When absent, messages are byte-identical to v3-G (backward-compat).
+    const primaryFailedMsg = options.fallbackLabel
+        ? `[failover] primary failed, switching to ${options.fallbackLabel}`
+        : '[failover] primary failed, switching to fallback';
+    const primaryThrewMsg = options.fallbackLabel
+        ? `[failover] primary threw, switching to ${options.fallbackLabel}: `
+        : '[failover] primary threw: ';
+    const fallbackFailedMsg = options.fallbackLabel
+        ? `[failover] fallback (${options.fallbackLabel}) also failed: `
+        : '[failover] fallback also failed: ';
+    return async function* (params) {
+        const triedFallback = { value: false };
+        try {
+            for await (const delta of options.primary(params)) {
+                if (isTransient(delta)) {
+                    // Forward the original error to the caller so they see what
+                    // happened, then announce the failover and bail out.
+                    yield delta;
+                    triedFallback.value = true;
+                    yield {
+                        kind: 'error',
+                        message: primaryFailedMsg,
+                    };
+                    break;
+                }
+                yield delta;
+            }
+        }
+        catch (err) {
+            // Network-level throw (fetch rejection, etc.) → also failover.
+            triedFallback.value = true;
+            yield {
+                kind: 'error',
+                message: `${primaryThrewMsg}${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+        if (triedFallback.value) {
+            try {
+                for await (const delta of options.fallback(params)) {
+                    yield delta;
+                }
+            }
+            catch (err) {
+                yield {
+                    kind: 'error',
+                    message: `${fallbackFailedMsg}${err instanceof Error ? err.message : String(err)}`,
+                };
+                return;
+            }
+        }
+    };
+}
+/**
+ * Convenience: filter a ProviderStreamFn's deltas to check what kinds it
+ * emits. Useful for tests / debugging.
+ */
+export async function collectDeltas(fn, params) {
+    const out = [];
+    for await (const d of fn(params))
+        out.push(d);
+    return out;
+}
+//# sourceMappingURL=providerFailover.js.map

package/dist/cli/providerFailover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerFailover.js","sourceRoot":"","sources":["../../src/cli/providerFailover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAwBH,MAAM,oBAAoB,GAAG,CAAC,KAAoB,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;AAEvF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACvD,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,IAAI,oBAAoB,CAAC;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,OAAO,CAAC,aAAa;QAC5C,CAAC,CAAC,2CAA2C,OAAO,CAAC,aAAa,EAAE;QACpE,CAAC,CAAC,kDAAkD,CAAC;IACvD,MAAM,eAAe,GAAG,OAAO,CAAC,aAAa;QAC3C,CAAC,CAAC,0CAA0C,OAAO,CAAC,aAAa,IAAI;QACrE,CAAC,CAAC,4BAA4B,CAAC;IACjC,MAAM,iBAAiB,GAAG,OAAO,CAAC,aAAa;QAC7C,CAAC,CAAC,wBAAwB,OAAO,CAAC,aAAa,iBAAiB;QAChE,CAAC,CAAC,mCAAmC,CAAC;IACxC,OAAO,KAAK,SAAS,CAAC,EAAE,MAAM;QAC5B,MAAM,aAAa,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;oBACvB,4DAA4D;oBAC5D,qDAAqD;oBACrD,MAAM,KAAK,CAAC;oBACZ,aAAa,CAAC,KAAK,GAAG,IAAI,CAAC;oBAC3B,MAAM;wBACJ,IAAI,EAAE,OAAO;wBACb,OAAO,EAAE,gBAAgB;qBAC1B,CAAC;oBACF,MAAM;gBACR,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+DAA+D;YAC/D,aAAa,CAAC,KAAK,GAAG,IAAI,CAAC;YAC3B,MAAM;gBACJ,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,GAAG,eAAe,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACjF,CAAC;QACJ,CAAC;QACD,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM;oBACJ,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,GAAG,iBAAiB,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBACnF,CAAC;gBACF,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAoB,EACpB,MAAuC;IAEvC,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cli/refreshRegistry.js

@@ -0,0 +1,77 @@
+/**
+ * refreshRegistry — pluggable per-provider token refresh impls (v3-F).
+ *
+ * Why: v3-D hard-wired refresh support for Grok only. Other providers (MiniMax,
+ * GLM) ship static API keys today and have no public OAuth endpoint. When that
+ * changes, callers want to add a refresh impl without touching keyStore or the
+ * auto-refresh path in `resolveApiKeyWithMeta`.
+ *
+ * Design:
+ * - A simple `Map<ProviderName, RefreshImpl>` plus helpers.
+ * - The default impl for `grok` is registered at module import time via
+ *   `registerDefaultRefreshImpls()` (idempotent — safe to call multiple times).
+ * - `getRefreshImpl(id)` returns the registered impl OR `null`. Callers are
+ *   responsible for the "no impl" branch — typically log + return stale token.
+ * - `registerRefreshImpl(id, impl)` lets tests and future providers inject
+ *   custom impls without depending on this module's internals.
+ *
+ * The adapter for Grok (`grokRefreshAdapter`) bridges the
+ * `(providerId, refreshToken) => Promise<{...}>` shape required by `RefreshImpl`
+ * with `refreshGrokToken`'s `{clientId, refreshToken}` shape. It pulls
+ * `GROK_OAUTH_CLIENT_ID` from env at call time (so tests can mutate it).
+ *
+ * @see electron/cli/keyStore.ts (RefreshImpl type, resolveApiKeyWithMeta)
+ * @see docs/plans/2026-06-29-anathema-coder-v3-F.md
+ */
+import { refreshGrokToken } from './grokOAuth.js';
+const registry = new Map();
+/**
+ * Register a refresh impl for a provider. Overwrites any previous impl.
+ * Pass `null` or use `unregisterRefreshImpl` to remove.
+ */
+export function registerRefreshImpl(id, impl) {
+    if (impl === null) {
+        registry.delete(id);
+    }
+    else {
+        registry.set(id, impl);
+    }
+}
+/** Remove a refresh impl. No-op if not registered. */
+export function unregisterRefreshImpl(id) {
+    registry.delete(id);
+}
+/** Look up a refresh impl. Returns `null` if no impl is registered. */
+export function getRefreshImpl(id) {
+    return registry.get(id) ?? null;
+}
+/** Return all registered provider ids (useful for /provider status). */
+export function listRefreshImpls() {
+    return Array.from(registry.keys());
+}
+/** Test-only helper: wipe the registry. Production code should not call this. */
+export function clearRefreshRegistry() {
+    registry.clear();
+}
+/**
+ * Adapter from `refreshGrokToken({clientId, refreshToken})` to the generic
+ * `RefreshImpl(providerId, refreshToken)` shape. Reads GROK_OAUTH_CLIENT_ID
+ * from env at call time so tests can override.
+ */
+export const grokRefreshAdapter = async (_providerId, refreshToken) => {
+    const clientId = process.env.GROK_OAUTH_CLIENT_ID;
+    if (!clientId || clientId.trim().length === 0) {
+        throw new Error('Missing GROK_OAUTH_CLIENT_ID env var');
+    }
+    return refreshGrokToken({ clientId, refreshToken });
+};
+/**
+ * Register the built-in default impls. Idempotent — calling multiple times
+ * is a no-op once registered. Called at module init from keyStore.
+ */
+export function registerDefaultRefreshImpls() {
+    if (!registry.has('grok')) {
+        registry.set('grok', grokRefreshAdapter);
+    }
+}
+//# sourceMappingURL=refreshRegistry.js.map

package/dist/cli/refreshRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshRegistry.js","sourceRoot":"","sources":["../../src/cli/refreshRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAmBlD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;AAEtD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAgB,EAAE,IAAwB;IAC5E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,qBAAqB,CAAC,EAAgB;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,EAAgB;IAC7C,OAAO,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB;IAClC,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAgB,KAAK,EAClD,WAAW,EACX,YAAY,EACZ,EAAE;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAClD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,gBAAgB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC"}

package/dist/cli/safety/auditLogger.js

@@ -0,0 +1,111 @@
+/**
+ * auditLogger — append-only JSONL log of every tool invocation.
+ *
+ * Task A2 of AnathemaCoder v3-A. Persists to
+ * `~/.tmp/anathema-coder/audit.jsonl` by default (override via
+ * ANATHEMA_AUDIT_LOG env). Each entry is one line of JSON with:
+ *   ts, sessionId, tool, args (summary), ok, resultSummary, durationMs, error?
+ *
+ * @see docs/plans/2026-06-29-anathema-coder-v3.md (Task A2)
+ */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+export class AuditLogger {
+    logPath;
+    writeQueue = Promise.resolve();
+    constructor(logPath) {
+        this.logPath = logPath ?? defaultAuditPath();
+    }
+    /** Path to the JSONL file. */
+    get path() {
+        return this.logPath;
+    }
+    /**
+     * Append one entry to the log. Serialized through a queue so concurrent
+     * invocations do not interleave their writes.
+     */
+    async append(entry) {
+        const line = JSON.stringify(entry) + '\n';
+        this.writeQueue = this.writeQueue.then(async () => {
+            await fs.mkdir(path.dirname(this.logPath), { recursive: true });
+            await fs.appendFile(this.logPath, line, 'utf-8');
+        });
+        return this.writeQueue;
+    }
+    /**
+     * Run a tool invocation and write an audit entry capturing the result.
+     * Returns the tool result unchanged so callers can compose it as
+     * `const r = await audit.runTool({ tool: 'bash', args: {...}, sessionId, fn })`.
+     */
+    async runTool(params) {
+        const start = Date.now();
+        let ok = true;
+        let error;
+        let resultSummary = '';
+        try {
+            const result = await params.fn();
+            resultSummary = (params.summarize?.(result) ?? safeStringify(result)).slice(0, 200);
+            return result;
+        }
+        catch (err) {
+            ok = false;
+            error = err instanceof Error ? err.message : String(err);
+            resultSummary = (params.summarizeError?.(err) ?? error).slice(0, 200);
+            throw err;
+        }
+        finally {
+            const entry = {
+                ts: new Date(start).toISOString(),
+                sessionId: params.sessionId,
+                tool: params.tool,
+                args: redactArgs(params.args),
+                ok,
+                resultSummary,
+                durationMs: Date.now() - start,
+                ...(error !== undefined ? { error } : {}),
+            };
+            // Fire-and-forget: do not block the caller on disk I/O, but still
+            // serialize writes through the queue.
+            void this.append(entry).catch((err) => {
+                // Best-effort logging — never throw from inside the finally.
+                console.error('[auditLogger] failed to append entry:', err);
+            });
+        }
+    }
+}
+function defaultAuditPath() {
+    const override = process.env.ANATHEMA_AUDIT_LOG;
+    if (override && override.trim().length > 0)
+        return override;
+    return path.join(os.tmpdir(), 'zelari-code', 'audit.jsonl');
+}
+/**
+ * Redact sensitive args (anything that looks like an API key or secret)
+ * before writing to the audit log. Conservative: replaces long random
+ * strings and env-var-style 'key' / 'apiKey' fields.
+ */
+function redactArgs(args) {
+    const redacted = {};
+    for (const [k, v] of Object.entries(args)) {
+        if (/(api[_-]?key|secret|token|password)/i.test(k) && typeof v === 'string') {
+            redacted[k] = '***';
+        }
+        else if (typeof v === 'string' && v.length > 64) {
+            redacted[k] = v.slice(0, 60) + '…';
+        }
+        else {
+            redacted[k] = v;
+        }
+    }
+    return redacted;
+}
+function safeStringify(value) {
+    try {
+        return typeof value === 'string' ? value : JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+//# sourceMappingURL=auditLogger.js.map

package/dist/cli/safety/auditLogger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditLogger.js","sourceRoot":"","sources":["../../../src/cli/safety/auditLogger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAqBzB,MAAM,OAAO,WAAW;IACL,OAAO,CAAS;IACzB,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEtD,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,gBAAgB,EAAE,CAAC;IAC/C,CAAC;IAED,8BAA8B;IAC9B,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAAiB;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAChD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAI,MAShB;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,EAAE,GAAG,IAAI,CAAC;QACd,IAAI,KAAyB,CAAC;QAC9B,IAAI,aAAa,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC;YACjC,aAAa,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACpF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,GAAG,KAAK,CAAC;YACX,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzD,aAAa,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,MAAM,KAAK,GAAe;gBACxB,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;gBACjC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC7B,EAAE;gBACF,aAAa;gBACb,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC;YACF,kEAAkE;YAClE,sCAAsC;YACtC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACpC,6DAA6D;gBAC7D,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED,SAAS,gBAAgB;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAChD,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAA6B;IAC/C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC5E,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;aAAM,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAClD,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC;QACH,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/cli/safety/sandboxPath.js

@@ -0,0 +1,62 @@
+/**
+ * sandboxPath — enforce that filesystem tool paths stay inside an allowed
+ * root directory (default: process.cwd()).
+ *
+ * Prevents the agent from escaping its working directory by using
+ * `..` segments or absolute paths outside the sandbox.
+ *
+ * Task A2 of AnathemaCoder v3-A.
+ *
+ * @see docs/plans/2026-06-29-anathema-coder-v3.md (Task A2)
+ */
+import path from 'node:path';
+export class SandboxViolationError extends Error {
+    attemptedPath;
+    resolvedPath;
+    constructor(message, attemptedPath, resolvedPath) {
+        super(message);
+        this.attemptedPath = attemptedPath;
+        this.resolvedPath = resolvedPath;
+        this.name = 'SandboxViolationError';
+    }
+}
+/**
+ * Resolve a user-supplied path against an allowed root, throwing
+ * SandboxViolationError if the result escapes the root.
+ *
+ * - Absolute paths are taken as-is but must be inside the root.
+ * - Relative paths are joined to the root.
+ * - Symlink resolution is the caller's responsibility (the FS tool
+ *   resolves on read/write); this function only checks textual containment
+ *   after normalization.
+ */
+export function resolveSandboxedPath(userPath, options = {}) {
+    if (typeof userPath !== 'string' || userPath.length === 0) {
+        throw new SandboxViolationError('Empty path', userPath, '');
+    }
+    const root = path.resolve(options.root ?? process.cwd());
+    const resolved = path.isAbsolute(userPath)
+        ? path.resolve(userPath)
+        : path.resolve(root, userPath);
+    // Normalize for comparison: ensure trailing separator for prefix check
+    // so `/foo/bar` does not match `/foo/barbaz`.
+    const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;
+    if (resolved !== root && !resolved.startsWith(rootWithSep)) {
+        throw new SandboxViolationError(`Path escapes sandbox root: ${userPath} → ${resolved} (root: ${root})`, userPath, resolved);
+    }
+    return resolved;
+}
+/**
+ * Lightweight check that does NOT throw — returns true if the path
+ * would be allowed by resolveSandboxedPath.
+ */
+export function isPathInsideSandbox(userPath, options = {}) {
+    try {
+        resolveSandboxedPath(userPath, options);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=sandboxPath.js.map

package/dist/cli/safety/sandboxPath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxPath.js","sourceRoot":"","sources":["../../../src/cli/safety/sandboxPath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAG5B;IACA;IAHlB,YACE,OAAe,EACC,aAAqB,EACrB,YAAoB;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,kBAAa,GAAb,aAAa,CAAQ;QACrB,iBAAY,GAAZ,YAAY,CAAQ;QAGpC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,UAA6B,EAAE;IAE/B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,qBAAqB,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEjC,uEAAuE;IACvE,8CAA8C;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;IACrE,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,qBAAqB,CAC7B,8BAA8B,QAAQ,MAAM,QAAQ,WAAW,IAAI,GAAG,EACtE,QAAQ,EACR,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,UAA6B,EAAE;IAE/B,IAAI,CAAC;QACH,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/cli/safety/shellBlocklist.js

@@ -0,0 +1,71 @@
+/**
+ * shellBlocklist — reject shell commands that look destructive or that
+ * exfiltrate data.
+ *
+ * Task A2 of AnathemaCoder v3-A.
+ *
+ * @see docs/plans/2026-06-29-anathema-coder-v3.md (Task A2)
+ */
+export class ShellBlockedError extends Error {
+    reason;
+    pattern;
+    constructor(message, reason, pattern) {
+        super(message);
+        this.reason = reason;
+        this.pattern = pattern;
+        this.name = 'ShellBlockedError';
+    }
+}
+/**
+ * Default blocklist. Conservative: prefers false positives over letting
+ * the agent destroy the user's machine.
+ */
+const DEFAULT_RULES = [
+    // Recursive destructive on root-ish paths. Match `rm` followed by 1-3
+    // single-letter flag clusters (e.g. -rf, -fr, -r, -f) and a root path.
+    { pattern: /\brm\s+(?:-[a-z]+\s+){1,3}\/\s*$/, reason: 'rm -rf /' },
+    { pattern: /\brm\s+(?:-[a-z]+\s+){1,3}\/etc\b/, reason: 'rm -rf /etc' },
+    { pattern: /\brm\s+(?:-[a-z]+\s+){1,3}\/boot\b/, reason: 'rm -rf /boot' },
+    { pattern: /\brm\s+(?:-[a-z]+\s+){1,3}\/usr\b/, reason: 'rm -rf /usr' },
+    // Disk wipe
+    { pattern: /\bmkfs(?:\.[a-z0-9]+)?\s+\/dev\//, reason: 'mkfs on device' },
+    { pattern: /\bdd\s+.*of=\/dev\//, reason: 'dd to device' },
+    // Fork bomb
+    { pattern: /:\(\)\s*\{\s*:\|:&\s*\}/, reason: 'fork bomb' },
+    // Network exfiltration / arbitrary download
+    { pattern: /\bcurl\s+[^|]*\|\s*(?:sudo\s+)?(?:ba)?sh/, reason: 'curl | sh' },
+    { pattern: /\bwget\s+[^|]*\|\s*(?:sudo\s+)?(?:ba)?sh/, reason: 'wget | sh' },
+    // Privilege escalation without explicit user intent
+    { pattern: /\bsudo\s+/, reason: 'sudo without explicit consent' },
+    // System file overwrites
+    { pattern: />\s*\/etc\//, reason: 'redirect to /etc' },
+    { pattern: />\s*\/boot\//, reason: 'redirect to /boot' },
+    { pattern: />\s*\/usr\//, reason: 'redirect to /usr' },
+];
+/**
+ * Test a shell command against the blocklist.
+ * Returns null if allowed, or a BlockRule describing why it was blocked.
+ */
+export function findBlockedReason(command, rules = DEFAULT_RULES) {
+    if (typeof command !== 'string' || command.length === 0)
+        return null;
+    for (const rule of rules) {
+        if (rule.pattern.test(command)) {
+            return rule;
+        }
+    }
+    return null;
+}
+/**
+ * Throw ShellBlockedError if the command matches any blocklist pattern.
+ * Otherwise return normally.
+ */
+export function assertShellAllowed(command) {
+    const blocked = findBlockedReason(command);
+    if (blocked) {
+        throw new ShellBlockedError(`Shell command blocked: ${blocked.reason}`, blocked.reason, blocked.pattern.source);
+    }
+}
+/** Expose the default rules for testing/introspection. */
+export const DEFAULT_BLOCK_RULES = DEFAULT_RULES;
+//# sourceMappingURL=shellBlocklist.js.map

package/dist/cli/safety/shellBlocklist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shellBlocklist.js","sourceRoot":"","sources":["../../../src/cli/safety/shellBlocklist.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAGxB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,OAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAQ;QAG/B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AASD;;;GAGG;AACH,MAAM,aAAa,GAAgB;IACjC,sEAAsE;IACtE,uEAAuE;IACvE,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,UAAU,EAAE;IACnE,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,aAAa,EAAE;IACvE,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,cAAc,EAAE;IACzE,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,aAAa,EAAE;IACvE,YAAY;IACZ,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,gBAAgB,EAAE;IACzE,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,cAAc,EAAE;IAC1D,YAAY;IACZ,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,WAAW,EAAE;IAC3D,4CAA4C;IAC5C,EAAE,OAAO,EAAE,0CAA0C,EAAE,MAAM,EAAE,WAAW,EAAE;IAC5E,EAAE,OAAO,EAAE,0CAA0C,EAAE,MAAM,EAAE,WAAW,EAAE;IAC5E,oDAAoD;IACpD,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,+BAA+B,EAAE;IACjE,yBAAyB;IACzB,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACtD,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,mBAAmB,EAAE;IACxD,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE;CACvD,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,QAAqB,aAAa;IAElC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,OAAO,CAAC,MAAM,EAAE,EAC1C,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,OAAO,CAAC,MAAM,CACvB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC"}

package/dist/cli/sessionManager.js

@@ -0,0 +1,149 @@
+/**
+ * sessionManager — CLI session lifecycle helpers.
+ *
+ * Wraps the JSONL sidecar writer (`electron/main/core/sessionJsonl.ts`) with
+ * filesystem helpers for the CLI:
+ *
+ *   - resolve base directory (`~/.tmp/anathema-coder/sessions/`, overridable
+ *     via `ANATHEMA_SESSIONS_DIR`)
+ *   - track the "current" session via a small text file (`current.txt`,
+ *     overridable via `ANATHEMA_CURRENT_SESSION_FILE`)
+ *   - list past sessions sorted by mtime desc
+ *   - load a session's events from JSONL
+ *
+ * Pure node:fs — no Electron deps, browser-importable for jsdom tests.
+ *
+ * @see docs/plans/2026-06-28-zelari-code.md (Task 14.10)
+ */
+import { promises as fs, existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync, statSync } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { readSession } from '../main/core/sessionJsonl.js';
+/** Resolve the base directory where session JSONL files live. */
+export function getSessionBaseDir() {
+    return process.env.ANATHEMA_SESSIONS_DIR
+        ?? path.join(os.homedir(), '.tmp', 'zelari-code', 'sessions');
+}
+/** Resolve the file used to track the current session id. */
+export function getCurrentSessionFile() {
+    return process.env.ANATHEMA_CURRENT_SESSION_FILE
+        ?? path.join(os.homedir(), '.tmp', 'zelari-code', 'current.txt');
+}
+/** Ensure the base directory exists. Creates parent dirs as needed. */
+export async function ensureSessionDir() {
+    await fs.mkdir(getSessionBaseDir(), { recursive: true });
+}
+/** Read the current session id from disk. Returns null if missing/empty. */
+export function getCurrentSessionId() {
+    const file = getCurrentSessionFile();
+    if (!existsSync(file))
+        return null;
+    try {
+        const content = readFileSync(file, 'utf-8').trim();
+        return content.length > 0 ? content : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Write the current session id to disk. Creates parent dirs as needed. */
+export function setCurrentSessionId(id) {
+    const file = getCurrentSessionFile();
+    mkdirSync(path.dirname(file), { recursive: true });
+    writeFileSync(file, id, 'utf-8');
+}
+/** Remove the current session marker (does not delete the JSONL file). */
+export function clearCurrentSessionId() {
+    const file = getCurrentSessionFile();
+    try {
+        unlinkSync(file);
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+    }
+}
+/** File used to track the currently active branch (Task 17.2). */
+export function getCurrentBranchFile() {
+    return process.env.ANATHEMA_CURRENT_BRANCH_FILE
+        ?? path.join(path.dirname(getCurrentSessionFile()), 'currentBranch.txt');
+}
+/** Read the current branch name. Returns null if no branch is active. */
+export function getCurrentBranch() {
+    const file = getCurrentBranchFile();
+    if (!existsSync(file))
+        return null;
+    try {
+        const content = readFileSync(file, 'utf-8').trim();
+        return content.length > 0 ? content : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Set the current branch name (used after `/checkout <name>`). */
+export function setCurrentBranch(name) {
+    const file = getCurrentBranchFile();
+    mkdirSync(path.dirname(file), { recursive: true });
+    writeFileSync(file, name, 'utf-8');
+}
+/** Clear the current branch marker (used after `/branch <name>` on main). */
+export function clearCurrentBranch() {
+    const file = getCurrentBranchFile();
+    try {
+        unlinkSync(file);
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+    }
+}
+/** Generate a new session UUID. */
+export function newSessionId() {
+    return randomUUID();
+}
+/** List all sessions in the base directory, sorted by mtime desc. */
+export async function listSessions() {
+    const baseDir = getSessionBaseDir();
+    let entries;
+    try {
+        entries = await fs.readdir(baseDir);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return [];
+        throw err;
+    }
+    const results = [];
+    for (const entry of entries) {
+        if (!entry.endsWith('.jsonl'))
+            continue;
+        const id = entry.replace(/\.jsonl$/, '');
+        const filePath = path.join(baseDir, entry);
+        try {
+            const events = await readSession(filePath);
+            let firstTs = 0;
+            let lastTs = 0;
+            for (const e of events) {
+                if (firstTs === 0 || e.ts < firstTs)
+                    firstTs = e.ts;
+                if (e.ts > lastTs)
+                    lastTs = e.ts;
+            }
+            const mtimeMs = statSync(filePath).mtimeMs;
+            results.push({ id, eventCount: events.length, firstTs, lastTs, mtimeMs, filePath });
+        }
+        catch {
+            // Skip unreadable sessions.
+        }
+    }
+    results.sort((a, b) => b.mtimeMs - a.mtimeMs);
+    return results;
+}
+/** Load all events from a session's JSONL file by id. */
+export async function loadSessionEvents(id) {
+    const filePath = path.join(getSessionBaseDir(), `${id}.jsonl`);
+    return readSession(filePath);
+}
+//# sourceMappingURL=sessionManager.js.map

package/dist/cli/sessionManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionManager.js","sourceRoot":"","sources":["../../src/cli/sessionManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAiB3D,iEAAiE;AACjE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB;WACnC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;AAClE,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC,GAAG,CAAC,6BAA6B;WAC3C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;AACrE,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB;IACjC,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,EAAU;IAC5C,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB;IACnC,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B;WAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAC7E,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB;IAC9B,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;IACpC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB;IAChC,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,YAAY;IAC1B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QACxC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,OAAO;oBAAE,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;gBACpD,IAAI,CAAC,CAAC,EAAE,GAAG,MAAM;oBAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YACnC,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAU;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/D,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC"}