// (c) Anthropic PBC. All rights reserved. Use is subject to the Legal Agreements outlined here: https://code.claude.com/docs/en/legal-and-compliance.

// Version: 0.3.325

//! symbol-dispose-prelude: defines Symbol.dispose and Symbol.asyncDispose if missing, for this bundle's `using`.
if (typeof Symbol.dispose !== 'symbol') {
  try {
    Symbol.dispose = Symbol.for('Symbol.dispose')
  } catch {}
}
if (typeof Symbol.asyncDispose !== 'symbol') {
  try {
    Symbol.asyncDispose = Symbol.for('Symbol.asyncDispose')
  } catch {}
}
import{F,wn,E,y,l,Y,p,Ae,u,f,i,Wt,zt,ht,de,d,O,q,$t,S,n,h,ce,P,ue,_,Ne,X,J,qt,G,j,L,Oe,Z,Je,Ue,Fe,pe,Xt,b,W,Jt,Zt,Qt,en,m,At,Rt,tn,z,He,Q,Ot,he,Te,nn,Be,Qe,on,et,k,wt,Ke,ee,kt,we,tt,H,C,ke,an,ot,Ge,R,o,A,M,st,Dt,B,je,xt,De,it,fe,We,a,at,vt,dn,cn,K,un,xe,te,ve,ze,pn,t,x,Se,ne,r,Ee,Lt,hn,N,ie,Ft,bn,Cn,Ht}from"./core-msnqqcc2.mjs";import{me,Xe,Ce,g,ae}from"./core-ds2jqcef.mjs";import{Gt}from"./core-gbbw9cgm.mjs";import{e,Pe}from"./core-x20yarwf.mjs";import{Rn,On,ge,ft,Bt,be,V,Tn,D,Ye,gt,mt}from"./core-x3hc9abc.mjs";var Yi={};F(Yi,{default:()=>uo});var Ji={};F(Ji,{default:()=>po});var ic={};F(ic,{AGENT_PROXY_AUTH_TOKEN:()=>pD,ANTHROPIC_API_KEY:()=>QT,ANTHROPIC_AUTH_TOKEN:()=>eD,ANTHROPIC_AWS_API_KEY:()=>oD,ANTHROPIC_FEDERATION_RULE_ID:()=>eL,ANTHROPIC_FOUNDRY_API_KEY:()=>rD,ANTHROPIC_FOUNDRY_AUTH_TOKEN:()=>sD,ANTHROPIC_ORGANIZATION_ID:()=>nL,ANTHROPIC_PROFILE:()=>rL,ANTHROPIC_WORKSPACE_ID:()=>oL,AWS_BEARER_TOKEN_BEDROCK:()=>nD,AWS_CONTAINER_CREDENTIALS_FULL_URI:()=>cD,AWS_CONTAINER_CREDENTIALS_RELATIVE_URI:()=>lD,AWS_ROLE_ARN:()=>aD,AWS_WEB_IDENTITY_TOKEN_FILE:()=>iD,CLAUDE_CODE_ACCOUNT_TAGGED_ID:()=>iL,CLAUDE_CODE_ACCOUNT_UUID:()=>sL,CLAUDE_CODE_API_KEY_FILE_DESCRIPTOR:()=>_D,CLAUDE_CODE_API_KEY_HELPER_TTL_MS:()=>WD,CLAUDE_CODE_AUTH_FAIL_EXIT_MS:()=>GD,CLAUDE_CODE_AWS_CHAIN_RESOLVE_TIMEOUT_MS:()=>QD,CLAUDE_CODE_CUSTOM_OAUTH_URL:()=>RD,CLAUDE_CODE_DESIGN_OAUTH_CLIENT_ID:()=>CD,CLAUDE_CODE_DISABLE_LAUNCHER_SIGN_IN:()=>ID,CLAUDE_CODE_ENABLE_PROXY_AUTH_HELPER:()=>KD,CLAUDE_CODE_FEDERATION_CACHE_DIR:()=>tL,CLAUDE_CODE_GATEWAY_TOKEN_FILE_DESCRIPTOR:()=>hD,CLAUDE_CODE_HFI_BEARER_TOKEN:()=>uD,CLAUDE_CODE_HOST_AUTH_ENV_VAR:()=>ND,CLAUDE_CODE_HOST_AUTH_REFRESH_TIMEOUT_MS:()=>PD,CLAUDE_CODE_HOST_CREDS_FILE:()=>xD,CLAUDE_CODE_OAUTH_401_WAIT_MS:()=>zD,CLAUDE_CODE_OAUTH_CLIENT_ID:()=>AD,CLAUDE_CODE_OAUTH_REFRESH_TOKEN:()=>OD,CLAUDE_CODE_OAUTH_SCOPES:()=>bD,CLAUDE_CODE_OAUTH_TOKEN:()=>tD,CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR:()=>ED,CLAUDE_CODE_ORGANIZATION_UUID:()=>aL,CLAUDE_CODE_PROXY_AUTH_HELPER_TTL_MS:()=>jD,CLAUDE_CODE_RATE_LIMIT_TIER:()=>dL,CLAUDE_CODE_SDK_HAS_HOST_AUTH_REFRESH:()=>wD,CLAUDE_CODE_SDK_HAS_OAUTH_REFRESH:()=>TD,CLAUDE_CODE_SDK_HAS_SESSIONS_OAUTH_REFRESH:()=>DD,CLAUDE_CODE_SESSIONS_OAUTH_TOKEN:()=>LD,CLAUDE_CODE_SESSION_ACCESS_TOKEN:()=>kD,CLAUDE_CODE_SKIP_ANTHROPIC_AWS_AUTH:()=>XD,CLAUDE_CODE_SKIP_ANTHROPIC_GOOGLE_CLOUD_AUTH:()=>JD,CLAUDE_CODE_SKIP_AWS_CRED_CACHE:()=>qD,CLAUDE_CODE_SKIP_BEDROCK_AUTH:()=>$D,CLAUDE_CODE_SKIP_FOUNDRY_AUTH:()=>YD,CLAUDE_CODE_SKIP_MANTLE_AUTH:()=>ZD,CLAUDE_CODE_SKIP_VERTEX_AUTH:()=>VD,CLAUDE_CODE_SUBSCRIPTION_TYPE:()=>cL,CLAUDE_CODE_USER_EMAIL:()=>lL,CLAUDE_CODE_WEBSOCKET_AUTH_FILE_DESCRIPTOR:()=>SD,CLAUDE_LOCAL_OAUTH_API_BASE:()=>HD,CLAUDE_LOCAL_OAUTH_APPS_BASE:()=>FD,CLAUDE_LOCAL_OAUTH_CONSOLE_BASE:()=>BD,CLAUDE_SESSION_INGRESS_TOKEN_FILE:()=>yD,CLAUDE_TRUSTED_DEVICE_TOKEN:()=>vD,CLOUDSDK_AUTH_ACCESS_TOKEN:()=>dD,ENVIRONMENT_SERVICE_KEY:()=>fD,MCP_CLIENT_SECRET:()=>mD,MCP_XAA_IDP_CLIENT_SECRET:()=>gD,USE_LOCAL_OAUTH:()=>MD,USE_STAGING_OAUTH:()=>UD});var ac={};F(ac,{ANT_CLAUDE_CODE_METRICS_ENDPOINT:()=>RI,ANT_OTEL_EXPORTER_OTLP_ENDPOINT:()=>hI,ANT_OTEL_EXPORTER_OTLP_HEADERS:()=>SI,ANT_OTEL_EXPORTER_OTLP_PROTOCOL:()=>yI,ANT_OTEL_LOGS_EXPORTER:()=>OI,ANT_OTEL_METRICS_EXPORTER:()=>AI,ANT_OTEL_RESOURCE_ATTRIBUTES:()=>bI,ANT_OTEL_TRACES_EXPORTER:()=>CI,BETA_TRACING_ENDPOINT:()=>TI,CLAUDE_CODE_BENCH_LIVE_COUNTS:()=>LL,CLAUDE_CODE_BYOC_ENABLE_DATADOG:()=>ML,CLAUDE_CODE_DATADOG_FLUSH_INTERVAL_MS:()=>kL,CLAUDE_CODE_DD_ERROR_TRACKING_FLUSH_INTERVAL_MS:()=>vL,CLAUDE_CODE_DEBUG_LOGS_DIR:()=>mL,CLAUDE_CODE_DEBUG_LOG_LEVEL:()=>fL,CLAUDE_CODE_DEBUG_REPAINTS:()=>gL,CLAUDE_CODE_DIAGNOSTICS_FILE:()=>_L,CLAUDE_CODE_ENHANCED_TELEMETRY_BETA:()=>wL,CLAUDE_CODE_FRAME_TIMING_LOG:()=>AL,CLAUDE_CODE_FRAME_TIMING_SAMPLE_EVERY:()=>CL,CLAUDE_CODE_NORMALIZE_PREFIX_CACHE_VERIFY:()=>IL,CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH:()=>uI,CLAUDE_CODE_OTEL_DIAG_STDERR:()=>UL,CLAUDE_CODE_OTEL_FLUSH_TIMEOUT_MS:()=>PL,CLAUDE_CODE_OTEL_HEADERS_HELPER_DEBOUNCE_MS:()=>xL,CLAUDE_CODE_OTEL_SHUTDOWN_TIMEOUT_MS:()=>NL,CLAUDE_CODE_PERFETTO_TRACE:()=>yL,CLAUDE_CODE_PERFETTO_WRITE_INTERVAL_S:()=>OL,CLAUDE_CODE_PROFILE_STARTUP:()=>SL,CLAUDE_CODE_SESSION_LOG:()=>bL,CLAUDE_CODE_TEE_SDK_STDOUT:()=>DL,CLAUDE_CODE_TERMINAL_RECORDING:()=>TL,CLAUDE_DEBUG:()=>uL,CLAUDE_PTY_RECORD:()=>RL,DEBUG:()=>pL,DEBUG_CLAUDE_AGENT_SDK:()=>EL,DEBUG_SDK:()=>hL,OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT:()=>lI,OTEL_EXPORTER_OTLP_ENDPOINT:()=>zL,OTEL_EXPORTER_OTLP_HEADERS:()=>GL,OTEL_EXPORTER_OTLP_LOGS_ENDPOINT:()=>YL,OTEL_EXPORTER_OTLP_LOGS_HEADERS:()=>XL,OTEL_EXPORTER_OTLP_LOGS_PROTOCOL:()=>JL,OTEL_EXPORTER_OTLP_LOGS_TIMEOUT:()=>jL,OTEL_EXPORTER_OTLP_METRICS_ENDPOINT:()=>ZL,OTEL_EXPORTER_OTLP_METRICS_HEADERS:()=>qL,OTEL_EXPORTER_OTLP_METRICS_PROTOCOL:()=>QL,OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE:()=>eI,OTEL_EXPORTER_OTLP_METRICS_TIMEOUT:()=>$L,OTEL_EXPORTER_OTLP_PROTOCOL:()=>WL,OTEL_EXPORTER_OTLP_TIMEOUT:()=>KL,OTEL_EXPORTER_OTLP_TRACES_ENDPOINT:()=>tI,OTEL_EXPORTER_OTLP_TRACES_HEADERS:()=>nI,OTEL_EXPORTER_OTLP_TRACES_PROTOCOL:()=>oI,OTEL_EXPORTER_OTLP_TRACES_TIMEOUT:()=>VL,OTEL_LOGRECORD_ATTRIBUTE_VALUE_LENGTH_LIMIT:()=>cI,OTEL_LOGS_EXPORTER:()=>FL,OTEL_LOGS_EXPORT_INTERVAL:()=>sI,OTEL_LOG_ASSISTANT_RESPONSES:()=>fI,OTEL_LOG_MANAGED_SETTINGS:()=>_I,OTEL_LOG_RAW_API_BODIES:()=>EI,OTEL_LOG_TOOL_CONTENT:()=>mI,OTEL_LOG_TOOL_DETAILS:()=>gI,OTEL_LOG_USER_PROMPTS:()=>pI,OTEL_METRICS_EXPORTER:()=>HL,OTEL_METRIC_EXPORT_INTERVAL:()=>rI,OTEL_RESOURCE_ATTRIBUTES:()=>aI,OTEL_SPAN_ATTRIBUTE_VALUE_LENGTH_LIMIT:()=>dI,OTEL_TRACES_EXPORTER:()=>BL,OTEL_TRACES_EXPORT_INTERVAL:()=>iI});var cc={};F(cc,{CLAUDE_AX_ANNOUNCEMENT_HOLD_MS:()=>ow,CLAUDE_AX_PREPARK_MS:()=>nw,CLAUDE_AX_REWRITE_HELD_ANNOUNCEMENT:()=>rw,CLAUDE_AX_SCREEN_READER:()=>ew,CLAUDE_AX_STARTUP_QUIET_MS:()=>tw,CLAUDE_CHROME_CLASSIFIER_FLOOR:()=>sw,CLAUDE_CODE_ACCESSIBILITY:()=>mx,CLAUDE_CODE_ACT_DONT_REDERIVE:()=>gx,CLAUDE_CODE_ALT_SCREEN_FULL_REPAINT:()=>aw,CLAUDE_CODE_AMBER_ASTROLABE:()=>vN,CLAUDE_CODE_ARTIFACT_ASK_FIRST:()=>nk,CLAUDE_CODE_ARTIFACT_ASSETS:()=>Kx,CLAUDE_CODE_ARTIFACT_COMMENTS:()=>Rx,CLAUDE_CODE_ARTIFACT_COMMENTS_AUTOREACT:()=>Tx,CLAUDE_CODE_ARTIFACT_COMMENT_FAST_ACK:()=>Lx,CLAUDE_CODE_ARTIFACT_COMMENT_FAST_ACK_FIXED:()=>Ix,CLAUDE_CODE_ARTIFACT_COMMENT_RESPONDER:()=>Dx,CLAUDE_CODE_ARTIFACT_DB:()=>wx,CLAUDE_CODE_ARTIFACT_DB_STR_REPLACE:()=>Px,CLAUDE_CODE_ARTIFACT_DELETE:()=>xx,CLAUDE_CODE_ARTIFACT_FRESH_READ:()=>Qx,CLAUDE_CODE_ARTIFACT_HOT:()=>$x,CLAUDE_CODE_ARTIFACT_MULTI_FILE:()=>jx,CLAUDE_CODE_ARTIFACT_OPENING_PREFETCH:()=>ek,CLAUDE_CODE_ARTIFACT_OPEN_ACTION:()=>Mx,CLAUDE_CODE_ARTIFACT_PATH_PIN:()=>Vx,CLAUDE_CODE_ARTIFACT_PIN:()=>Ux,CLAUDE_CODE_ARTIFACT_PRESENCE:()=>Wx,CLAUDE_CODE_ARTIFACT_PREVIEW:()=>kx,CLAUDE_CODE_ARTIFACT_PREVIEW_EMULATOR:()=>vx,CLAUDE_CODE_ARTIFACT_PUBLISH_EDITS:()=>Yx,CLAUDE_CODE_ARTIFACT_QUICKSTART:()=>qx,CLAUDE_CODE_ARTIFACT_REPL:()=>Nx,CLAUDE_CODE_ARTIFACT_ROOM:()=>Gx,CLAUDE_CODE_ARTIFACT_SHARE:()=>Hx,CLAUDE_CODE_ARTIFACT_SHARE_PROBE_REUSE_MS:()=>Fx,CLAUDE_CODE_ARTIFACT_START_KIT:()=>tk,CLAUDE_CODE_ARTIFACT_TOOLSET:()=>Xx,CLAUDE_CODE_ARTIFACT_TYPES:()=>Jx,CLAUDE_CODE_ARTIFACT_TYPE_CATALOG:()=>Zx,CLAUDE_CODE_ARTIFACT_TYPE_CLOUD_CREATE:()=>ok,CLAUDE_CODE_ARTIFACT_VERIFY:()=>rk,CLAUDE_CODE_ARTIFACT_VERSIONS:()=>zx,CLAUDE_CODE_ATTACHMENTS_IN_USER_DATA:()=>Ik,CLAUDE_CODE_ATTRIBUTION_ANNOUNCEMENT:()=>_x,CLAUDE_CODE_AUTOUPDATER_DISABLED_BY_HOST:()=>ZM,CLAUDE_CODE_AUTO_CONNECT_IDE:()=>sk,CLAUDE_CODE_AUTO_MODE_FULL_CONTEXT:()=>ik,CLAUDE_CODE_AUTO_MODE_SERVER:()=>ak,CLAUDE_CODE_BASALT_COVE:()=>Ew,CLAUDE_CODE_BASH_EDIT_DIFF:()=>mw,CLAUDE_CODE_BASH_OUTPUT_AUDIENCE_NOTE:()=>Cx,CLAUDE_CODE_BASH_SANDBOX_SHOW_INDICATOR:()=>lk,CLAUDE_CODE_BG_TASKS_REPORT_RUNNING:()=>xw,CLAUDE_CODE_BISON_CAIRN:()=>MN,CLAUDE_CODE_BREEZY_HORIZON:()=>hw,CLAUDE_CODE_BUBBLEWRAP:()=>ck,CLAUDE_CODE_CALM_MOCHI:()=>ax,CLAUDE_CODE_CCR_EARLY_HYDRATE_PREFETCH:()=>dk,CLAUDE_CODE_CCR_EARLY_PLUGINS_SYNC:()=>yk,CLAUDE_CODE_CCR_EARLY_REMOTE_CONNECT:()=>uk,CLAUDE_CODE_CCR_EARLY_SKILLS_SYNC:()=>Ok,CLAUDE_CODE_CCR_EARLY_SYNC_AFTER_SETTINGS_REFUSAL:()=>Ak,CLAUDE_CODE_CCR_FOLD_FIRST_TURN_RESCAN:()=>Ck,CLAUDE_CODE_CCR_LONG_POLL:()=>gk,CLAUDE_CODE_CCR_ONE_PLUGIN_LOAD_PER_RELOAD:()=>bk,CLAUDE_CODE_CCR_OWN_CONNECTION_POOL:()=>mk,CLAUDE_CODE_CCR_SKIP_FRESH_MIGRATIONS:()=>Lk,CLAUDE_CODE_CCR_SKIP_HYDRATE_ON_CURRENT_TIP:()=>pk,CLAUDE_CODE_CCR_SKIP_NEEDLESS_STARTUP_READS:()=>Rk,CLAUDE_CODE_CCR_SLOW_SKILLS_WATCH:()=>Tk,CLAUDE_CODE_CCR_WORKER_SOCKET:()=>fk,CLAUDE_CODE_CHILD_SESSION:()=>Pk,CLAUDE_CODE_CHROME_MCP_ORG_DENIED:()=>vk,CLAUDE_CODE_COLD_COMPACT:()=>Mk,CLAUDE_CODE_CONSENT_POINTERLESS:()=>lw,CLAUDE_CODE_COORDINATOR_FORCE_WORKER_INHERIT_MODEL:()=>kw,CLAUDE_CODE_COWORK_FRAME_ARTIFACTS:()=>Uw,CLAUDE_CODE_COWORK_PLUGIN_SKILL:()=>Uk,CLAUDE_CODE_COZY_TEAPOT:()=>gw,CLAUDE_CODE_CRYPTIC_HORIZON:()=>ww,CLAUDE_CODE_CURRIED_TRINKET:()=>_w,CLAUDE_CODE_DAPPER_CUPCAKE:()=>Pw,CLAUDE_CODE_DEEP_TWILIGHT:()=>Lw,CLAUDE_CODE_DESKTOP_CONNECTOR_NAMES:()=>Bw,CLAUDE_CODE_DESKTOP_MESSAGE_CARD:()=>Ww,CLAUDE_CODE_DESKTOP_MODE_FROM_RECORD:()=>Gw,CLAUDE_CODE_DESKTOP_PLUGIN_INSTALL_FRAMES:()=>Kw,CLAUDE_CODE_DESKTOP_SKILL_SWITCHES:()=>Fw,CLAUDE_CODE_DESKTOP_WORKFLOW_LIMIT_WAIT:()=>zw,CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING:()=>Jw,CLAUDE_CODE_DISABLE_ADMIN_ENV_UNION:()=>Yw,CLAUDE_CODE_DISABLE_ADVISOR_TOOL:()=>Zw,CLAUDE_CODE_DISABLE_AGENT_PROGRESS_SUMMARIES:()=>qw,CLAUDE_CODE_DISABLE_AGENT_VIEW:()=>Qw,CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN:()=>eP,CLAUDE_CODE_DISABLE_ARTIFACT:()=>tP,CLAUDE_CODE_DISABLE_ATTACHMENTS:()=>nP,CLAUDE_CODE_DISABLE_ATTRIBUTION_CROSS_REPO:()=>oP,CLAUDE_CODE_DISABLE_AUTH_REFRESH_LOCK:()=>rP,CLAUDE_CODE_DISABLE_AUTO_MEMORY:()=>sP,CLAUDE_CODE_DISABLE_AWAITING_USER_IDLE:()=>iP,CLAUDE_CODE_DISABLE_BACKGROUND_TASKS:()=>aP,CLAUDE_CODE_DISABLE_BEDROCK_CONTENT_TYPE_DEFAULT:()=>dP,CLAUDE_CODE_DISABLE_BEDROCK_CONTENT_TYPE_GUARD:()=>uP,CLAUDE_CODE_DISABLE_BG_EXIT_HANDOFF:()=>pP,CLAUDE_CODE_DISABLE_BG_STABLE_PATH:()=>fP,CLAUDE_CODE_DISABLE_BUNDLED_SKILLS:()=>mP,CLAUDE_CODE_DISABLE_CFC_PROMPT:()=>gP,CLAUDE_CODE_DISABLE_CLAUDE_API_SKILL:()=>_P,CLAUDE_CODE_DISABLE_CLAUDE_CODE_SKILL:()=>EP,CLAUDE_CODE_DISABLE_CLAUDE_MDS:()=>hP,CLAUDE_CODE_DISABLE_CRON:()=>SP,CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT:()=>yP,CLAUDE_CODE_DISABLE_EMPTY_CLASSIC_DISPATCH_SKIP:()=>CP,CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS:()=>OP,CLAUDE_CODE_DISABLE_EXPLORE_PLAN_AGENTS:()=>bP,CLAUDE_CODE_DISABLE_EXPORTED_VARIABLE_PROMPT:()=>cN,CLAUDE_CODE_DISABLE_FEATURE_FLAGS:()=>RP,CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY:()=>TP,CLAUDE_CODE_DISABLE_FILE_CHECKPOINTING:()=>LP,CLAUDE_CODE_DISABLE_FILE_MENTIONS:()=>IP,CLAUDE_CODE_DISABLE_GIT_INSTRUCTIONS:()=>wP,CLAUDE_CODE_DISABLE_INLINE_SHELL_RM_PROMPT:()=>iN,CLAUDE_CODE_DISABLE_LAUNCH_COMPOSER:()=>PP,CLAUDE_CODE_DISABLE_LONE_SEC_DEFAULT_SHORTCUT:()=>NP,CLAUDE_CODE_DISABLE_MCP_TASKS:()=>cP,CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND:()=>lP,CLAUDE_CODE_DISABLE_MEMORY_BULK_INFLATE:()=>xP,CLAUDE_CODE_DISABLE_MEMORY_MASS_DELETE_HOLD:()=>kP,CLAUDE_CODE_DISABLE_MEMORY_PERIODIC_RESYNC:()=>vP,CLAUDE_CODE_DISABLE_MEMORY_RO_UNSAVED_NOTICE:()=>MP,CLAUDE_CODE_DISABLE_MEMORY_STREAM_LIST:()=>UP,CLAUDE_CODE_DISABLE_MOUNTED_DRIVE_RM_PROMPT:()=>lN,CLAUDE_CODE_DISABLE_MOUSE:()=>BP,CLAUDE_CODE_DISABLE_MOUSE_CLICKS:()=>zP,CLAUDE_CODE_DISABLE_NESTED_CHAIN_IDLE:()=>GP,CLAUDE_CODE_DISABLE_NESTED_SESSION_ID:()=>Nk,CLAUDE_CODE_DISABLE_NESTED_USER_REPAIR:()=>WP,CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC:()=>KP,CLAUDE_CODE_DISABLE_NONSTREAMING_FALLBACK:()=>jP,CLAUDE_CODE_DISABLE_NOTIFICATION_PRESENCE_CHECK:()=>$P,CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL:()=>VP,CLAUDE_CODE_DISABLE_ORG_MEMORY:()=>YP,CLAUDE_CODE_DISABLE_OTEL_EVENT_SKIP:()=>XP,CLAUDE_CODE_DISABLE_PERMISSION_PROMPT_NOTIFY_HOOKS:()=>HP,CLAUDE_CODE_DISABLE_POLICY_SKILLS:()=>JP,CLAUDE_CODE_DISABLE_POWERSHELL_CMD_RM_DENY:()=>ZP,CLAUDE_CODE_DISABLE_PRECOMPACT_SKIP:()=>qP,CLAUDE_CODE_DISABLE_PROACTIVITY:()=>QP,CLAUDE_CODE_DISABLE_REFUSAL_FALLBACK:()=>eN,CLAUDE_CODE_DISABLE_REFUSAL_RETRY:()=>tN,CLAUDE_CODE_DISABLE_RESPONSE_COMPARISON:()=>DP,CLAUDE_CODE_DISABLE_RESUME_LOAD_GOODBYE_SKIP:()=>nN,CLAUDE_CODE_DISABLE_STARTUP_WORK_GATE:()=>pN,CLAUDE_CODE_DISABLE_STRUCTURED_OUTPUTS:()=>AP,CLAUDE_CODE_DISABLE_SUBAGENT_HANDBACK:()=>Fk,CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT:()=>sN,CLAUDE_CODE_DISABLE_TERMINAL_TITLE:()=>fN,CLAUDE_CODE_DISABLE_THINKING:()=>gN,CLAUDE_CODE_DISABLE_TRANSCRIPT_READ_AHEAD:()=>_N,CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK:()=>uN,CLAUDE_CODE_DISABLE_ULTRATHINK:()=>EN,CLAUDE_CODE_DISABLE_VIRTUAL_SCROLL:()=>hN,CLAUDE_CODE_DISABLE_WEB_FETCH:()=>SN,CLAUDE_CODE_DISABLE_WINDOWS_SHELL_LAUNCHER:()=>Zv,CLAUDE_CODE_DISABLE_WORKFLOWS:()=>yN,CLAUDE_CODE_EDITOR_CODELIVERY:()=>vw,CLAUDE_CODE_ELEGANT_MEADOW:()=>Nw,CLAUDE_CODE_ENABLE_APPEND_SUBAGENT_PROMPT:()=>AN,CLAUDE_CODE_ENABLE_AWAY_SUMMARY:()=>CN,CLAUDE_CODE_ENABLE_BACKGROUND_PLUGIN_REFRESH:()=>bN,CLAUDE_CODE_ENABLE_CFC:()=>RN,CLAUDE_CODE_ENABLE_DESIGN_SYNC:()=>TN,CLAUDE_CODE_ENABLE_EXPERIMENTAL_ADVISOR_TOOL:()=>DN,CLAUDE_CODE_ENABLE_FEEDBACK_SURVEY_FOR_OTEL:()=>LN,CLAUDE_CODE_ENABLE_FINE_GRAINED_TOOL_STREAMING:()=>IN,CLAUDE_CODE_ENABLE_LAUNCH_COMPOSER:()=>wN,CLAUDE_CODE_ENABLE_MENU_KIND_LANES:()=>PN,CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION:()=>GN,CLAUDE_CODE_ENABLE_REFRESH_MCP_TOOLS:()=>WN,CLAUDE_CODE_ENABLE_REMOTE_RECAP:()=>KN,CLAUDE_CODE_ENABLE_SDK_FILE_CHECKPOINTING:()=>jN,CLAUDE_CODE_ENABLE_SHARE_BUNDLE:()=>$N,CLAUDE_CODE_ENABLE_TASKS:()=>VN,CLAUDE_CODE_ENABLE_TODO_TOOLS:()=>YN,CLAUDE_CODE_ENABLE_TOKEN_USAGE_ATTACHMENT:()=>XN,CLAUDE_CODE_ENABLE_WRAP_UP:()=>JN,CLAUDE_CODE_ENABLE_XAA:()=>ZN,CLAUDE_CODE_EVAL_INTERVIEW_SESSION:()=>Uv,CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS:()=>dN,CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS:()=>Bk,CLAUDE_CODE_EXPERIMENTAL_OBSERVER_AGENTS:()=>zk,CLAUDE_CODE_FEATURE_FLAGS_KICK_FROM_INIT:()=>_k,CLAUDE_CODE_FEATURE_FLAGS_KICK_ON_WARM_CACHE:()=>Ek,CLAUDE_CODE_FIZZY_GROVE:()=>Ow,CLAUDE_CODE_FLEETVIEW_SIMPLE:()=>NN,CLAUDE_CODE_FORCE_MID_CONVERSATION_SYSTEM:()=>Xk,CLAUDE_CODE_FORCE_SESSION_PERSISTENCE:()=>$k,CLAUDE_CODE_FORCE_STRIKETHROUGH:()=>Vk,CLAUDE_CODE_FORCE_TERMINAL_IMAGES:()=>Yk,CLAUDE_CODE_FORCE_WINDOWS_CREDMAN:()=>Zk,CLAUDE_CODE_FORK_SUBAGENT:()=>Gk,CLAUDE_CODE_FORWARD_SUBAGENT_TEXT:()=>qk,CLAUDE_CODE_FORWARD_USER_INTENT:()=>Mw,CLAUDE_CODE_GATEWAY_HINT_HEADERS:()=>Qv,CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF:()=>xN,CLAUDE_CODE_GENTLE_PARASOL:()=>pw,CLAUDE_CODE_GLOB_HIDDEN:()=>Wk,CLAUDE_CODE_GLOB_NO_IGNORE:()=>Kk,CLAUDE_CODE_GORSE_PLOVER:()=>HN,CLAUDE_CODE_GROWTHBOOK_KICK_FROM_INIT:()=>hk,CLAUDE_CODE_GROWTHBOOK_KICK_ON_WARM_CACHE:()=>Sk,CLAUDE_CODE_HARBOR_KITE:()=>qN,CLAUDE_CODE_HARBOR_KITE_CLOUD:()=>ex,CLAUDE_CODE_HARBOR_KITE_PACING_OFF:()=>QN,CLAUDE_CODE_HARMONIC_RIDDLE:()=>ix,CLAUDE_CODE_HIDE_CWD:()=>jk,CLAUDE_CODE_HOOKS_SAME_THREAD:()=>oU,CLAUDE_CODE_HOST_ARTIFACT_TYPE_COMMANDS:()=>Hk,CLAUDE_CODE_HOST_GUARDS_ARTIFACTS_MCP:()=>Bx,CLAUDE_CODE_HOST_SCHEDULED_RUN:()=>Hw,CLAUDE_CODE_HOVER_REST:()=>kN,CLAUDE_CODE_HUMBLE_HAMMOCK:()=>bw,CLAUDE_CODE_IDE_SKIP_AUTO_INSTALL:()=>Qk,CLAUDE_CODE_IDE_SKIP_VALID_CHECK:()=>ev,CLAUDE_CODE_INCLUDE_PARTIAL_MESSAGES:()=>tv,CLAUDE_CODE_INLINE_TOOLS:()=>Jk,CLAUDE_CODE_JUNIPER_SUNDIAL:()=>zN,CLAUDE_CODE_KB_COHESION_FIXES:()=>fx,CLAUDE_CODE_LANTERN_PRISM:()=>tx,CLAUDE_CODE_LARCH_CISTERN:()=>UN,CLAUDE_CODE_MANAGED_CONFIG_PREFETCH:()=>wk,CLAUDE_CODE_MCP_REGISTRY_FETCH_AT_STARTUP:()=>Dk,CLAUDE_CODE_MEMORY_PUSH_DELETE_MODE:()=>FP,CLAUDE_CODE_MESSAGES_PROMPT_CACHE_TTL:()=>$M,CLAUDE_CODE_MODEL_CAPABILITIES:()=>Ex,CLAUDE_CODE_NANKEEN_KESTREL:()=>Xw,CLAUDE_CODE_NATIVE_APP_BUNDLE:()=>nv,CLAUDE_CODE_NATIVE_CURSOR:()=>ov,CLAUDE_CODE_NEW_INIT:()=>rv,CLAUDE_CODE_NONBLOCKING_STDOUT:()=>iv,CLAUDE_CODE_NORMALIZE_PREFIX_CACHE:()=>av,CLAUDE_CODE_NO_FLICKER:()=>sv,CLAUDE_CODE_PACKAGE_MANAGER_AUTO_UPDATE:()=>lv,CLAUDE_CODE_PARSED_WILLOW:()=>Dw,CLAUDE_CODE_PEWTER_OWL:()=>eM,CLAUDE_CODE_PEWTER_OWL_TOOL:()=>tM,CLAUDE_CODE_PLAN_MODE_REQUIRED:()=>cv,CLAUDE_CODE_PLUGIN_BINARY_ASSETS:()=>Vv,CLAUDE_CODE_PLUGIN_DIRS:()=>sU,CLAUDE_CODE_PLUGIN_DIR_WATCH:()=>rU,CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE:()=>$v,CLAUDE_CODE_PLUGIN_PREFER_HTTPS:()=>Xv,CLAUDE_CODE_PLUGIN_REMOTE_MCP_REACHABLE_HOSTS_HINT:()=>Ov,CLAUDE_CODE_PLUGIN_USE_ZIP_CACHE:()=>Yv,CLAUDE_CODE_POLISHED_DEWDROP:()=>Aw,CLAUDE_CODE_POLL_EVENTS:()=>dv,CLAUDE_CODE_POLL_EVENT_DECLARATIONS:()=>uv,CLAUDE_CODE_POWERSHELL_RESPECT_EXECUTION_POLICY:()=>Jv,CLAUDE_CODE_PROACTIVE:()=>fv,CLAUDE_CODE_PROJECTS_SESSION:()=>jv,CLAUDE_CODE_PROMPT_CACHE_TTL:()=>KM,CLAUDE_CODE_PROPAGATE_TRACEPARENT:()=>qv,CLAUDE_CODE_REFUSAL_FALLBACK_CATCH_ALL:()=>oN,CLAUDE_CODE_REMOTE_TOOLS_FORWARD:()=>iU,CLAUDE_CODE_REMOTE_TOOLS_HOST_ALLOWS_UNATTENDED:()=>$w,CLAUDE_CODE_REMOTE_TOOLS_HOST_IDLE_RELEASE_MINUTES:()=>Vw,CLAUDE_CODE_REMOTE_TOOLS_PIN_STORED_LOGIN:()=>jw,CLAUDE_CODE_REMOVE_PROMPT_STRINGS:()=>FN,CLAUDE_CODE_REPLY_GATE_POLICY:()=>pv,CLAUDE_CODE_REPORT_FINDINGS:()=>rN,CLAUDE_CODE_RIPPLING_TULIP:()=>sx,CLAUDE_CODE_RUSTLING_PIXEL:()=>Cw,CLAUDE_CODE_SANDBOX_LEAVE_DENIES_TO_SRT_WIN:()=>mv,CLAUDE_CODE_SANDBOX_LEAVE_PARENT_FOLDERS_ALONE:()=>gv,CLAUDE_CODE_SEND_FEEDBACK:()=>mN,CLAUDE_CODE_SESSION_ATTENDED:()=>kk,CLAUDE_CODE_SILENT_TURN_REMINDER:()=>Sx,CLAUDE_CODE_SILENT_TURN_REMINDER_SECONDS:()=>Ox,CLAUDE_CODE_SILENT_TURN_REMINDER_TEXT:()=>Ax,CLAUDE_CODE_SILENT_TURN_REMINDER_TURNS:()=>yx,CLAUDE_CODE_SKILL_PROPOSALS:()=>_v,CLAUDE_CODE_SKIP_PLUGIN_LOCAL_MCP_SERVERS:()=>Ev,CLAUDE_CODE_SKIP_PLUGIN_MCP_BUNDLES:()=>hv,CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS:()=>Sv,CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS_EXCEPT:()=>yv,CLAUDE_CODE_SKIP_PROJECT_BACKFILL:()=>Av,CLAUDE_CODE_SKIP_PROMPT_HISTORY:()=>Cv,CLAUDE_CODE_SKIP_REPO_UPLOAD:()=>bv,CLAUDE_CODE_SNAPPY_PELICAN:()=>Sw,CLAUDE_CODE_SORTED_OTTER:()=>yw,CLAUDE_CODE_SPARE_KEEPS_BOOT_SESSION_ID:()=>xk,CLAUDE_CODE_STELLAR_DRIFT:()=>Rw,CLAUDE_CODE_STREAMED_BUMBLEBEE:()=>lx,CLAUDE_CODE_STREAMED_BUMBLEBEE_TEXT:()=>cx,CLAUDE_CODE_STRICT_INLINE_SHELL_RM_PROMPT:()=>aN,CLAUDE_CODE_SUBAGENT_CACHE_EVICT:()=>Rv,CLAUDE_CODE_SUBAGENT_CONFIG_WARNING:()=>dx,CLAUDE_CODE_SUBAGENT_HISTORY:()=>ux,CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL:()=>jM,CLAUDE_CODE_SUBAGENT_PROMPT_SNAPSHOT:()=>Tv,CLAUDE_CODE_SUPPRESS_SESSION_ATTRIBUTION:()=>Dv,CLAUDE_CODE_SYNC_PLUGINS:()=>Iv,CLAUDE_CODE_SYNC_PLUGIN_INSTALL:()=>Lv,CLAUDE_CODE_SYNC_SKILLS:()=>wv,CLAUDE_CODE_TAG_ISMETA_MESSAGES:()=>Pv,CLAUDE_CODE_THINKING_DISPLAY_UPDATES:()=>bx,CLAUDE_CODE_THISTLE_GREBE:()=>cw,CLAUDE_CODE_THRIFTY_SONIC:()=>fw,CLAUDE_CODE_TOASTY_THIMBLE:()=>uw,CLAUDE_CODE_TODO_REMINDER_MODE:()=>nx,CLAUDE_CODE_TOTAL_TOKENS_REMINDER:()=>ox,CLAUDE_CODE_TOTAL_TOKENS_REMINDER_AFTER_USER_TURN:()=>px,CLAUDE_CODE_TOTAL_TOKENS_REMINDER_BUDGET:()=>rx,CLAUDE_CODE_TRANSCRIPT_LOCAL_GC:()=>Nv,CLAUDE_CODE_TURN_UPDATES:()=>hx,CLAUDE_CODE_TWO_STAGE_CLASSIFIER:()=>xv,CLAUDE_CODE_USE_COWORK_PLUGINS:()=>kv,CLAUDE_CODE_USE_NATIVE_FILE_SEARCH:()=>vv,CLAUDE_CODE_USE_POWERSHELL_TOOL:()=>Mv,CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS:()=>Fv,CLAUDE_CODE_WEBFETCH_DEADLINE_MS:()=>Bv,CLAUDE_CODE_WEBFETCH_USE_CCR_PROXY:()=>zv,CLAUDE_CODE_WEBSEARCH_CITATIONS:()=>Wv,CLAUDE_CODE_WEBSEARCH_USE_CCR_PROXY:()=>Gv,CLAUDE_CODE_WEB_FETCH_AGENT:()=>Hv,CLAUDE_CODE_WEB_SEARCH_FAST_ARG:()=>Kv,CLAUDE_CODE_WHIMSICAL_ELEPHANT:()=>Iw,CLAUDE_CODE_WILLOW_TERN:()=>BN,CLAUDE_CODE_WISE_COMET:()=>Tw,CLAUDE_CODE_WITTY_DEWDROP:()=>dw,CLAUDE_CODE_WORKFLOWS:()=>ON,CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS:()=>uM,CLAUDE_CODE_WORKFLOW_PREFIX_STAGGER_MS:()=>dM,CLAUDE_CODE_WORKFLOW_SIZE_WARNING_AGENTS:()=>lM,CLAUDE_CODE_WORKFLOW_SIZE_WARNING_TOKENS:()=>cM,CLAUDE_DISABLE_ADOPT:()=>nM,CLAUDE_IMPORT_CONVERSATIONS:()=>oM,CLAUDE_RUNNER_DISABLE_AWAITING_ACTION_OVERRIDE:()=>rM,CLAUDE_RUNNER_DISABLE_RENEWAL_WARNING:()=>sM,CLAUDE_RUNNER_DISABLE_TURN_BEGAN_BEFORE_INIT:()=>iM,CLAUDE_WORKFLOW_NAME_ONLY:()=>aM,DISABLE_AUTOUPDATER:()=>fM,DISABLE_AUTO_COMPACT:()=>pM,DISABLE_BRIEF_MODE_STOP_HOOK:()=>mM,DISABLE_BUG_COMMAND:()=>gM,DISABLE_COST_WARNINGS:()=>_M,DISABLE_DOCTOR_COMMAND:()=>EM,DISABLE_ERROR_REPORTING:()=>hM,DISABLE_EXTRA_USAGE_COMMAND:()=>SM,DISABLE_FEEDBACK_COMMAND:()=>yM,DISABLE_GROWTHBOOK:()=>OM,DISABLE_INSTALL_GITHUB_APP_COMMAND:()=>AM,DISABLE_INTERLEAVED_THINKING:()=>CM,DISABLE_LOGIN_COMMAND:()=>bM,DISABLE_LOGOUT_COMMAND:()=>RM,DISABLE_PROMPT_CACHING:()=>TM,DISABLE_PROMPT_CACHING_FABLE:()=>wM,DISABLE_PROMPT_CACHING_HAIKU:()=>DM,DISABLE_PROMPT_CACHING_MYTHOS:()=>PM,DISABLE_PROMPT_CACHING_OPUS:()=>LM,DISABLE_PROMPT_CACHING_SONNET:()=>IM,DISABLE_TELEMETRY:()=>NM,DISABLE_UPDATES:()=>xM,DISABLE_UPGRADE_COMMAND:()=>kM,EMBEDDED_SEARCH_TOOLS:()=>tU,ENABLE_BETA_TRACING_DETAILED:()=>vM,ENABLE_CLAUDEAI_MCP_SERVERS:()=>MM,ENABLE_ENHANCED_TELEMETRY_BETA:()=>UM,ENABLE_LOCKLESS_UPDATES:()=>HM,ENABLE_LSP_TOOL:()=>FM,ENABLE_MCP_LARGE_OUTPUT_FILES:()=>BM,ENABLE_PID_BASED_VERSION_LOCKING:()=>zM,ENABLE_PROMPT_CACHING_1H:()=>GM,ENABLE_PROMPT_CACHING_1H_BEDROCK:()=>WM,ENABLE_SESSION_BACKGROUNDING:()=>VM,ENABLE_SESSION_PERSISTENCE:()=>YM,ENABLE_TOOL_SEARCH:()=>XM,FORCE_AUTOUPDATE_PLUGINS:()=>JM,FORCE_CODE_TERMINAL:()=>qM,FORCE_PROMPT_CACHING_5M:()=>QM,FORCE_VCR:()=>eU,INK_SCREEN_READER:()=>iw,USE_API_CONTEXT_MANAGEMENT:()=>nU});var dc={};F(dc,{ALACRITTY_LOG:()=>VH,ALACRITTY_WINDOW_ID:()=>YH,ALLUSERSPROFILE:()=>XU,ANDROID_HOME:()=>RH,ANDROID_SDK_ROOT:()=>TH,APPDATA:()=>FU,APP_URL:()=>DB,AWS_CA_BUNDLE:()=>pH,AWS_EXECUTION_ENV:()=>mB,AWS_LAMBDA_FUNCTION_NAME:()=>fB,AZURE_FUNCTIONS_ENVIRONMENT:()=>TB,BAT_THEME:()=>NB,BROWSER:()=>RU,BUILDKITE:()=>YF,BUN_CHROME_PATH:()=>PB,BUN_INSTALL:()=>wB,CARGO_HTTP_CAINFO:()=>mH,CDPATH:()=>cU,CF_PAGES:()=>uB,CIRCLECI:()=>VF,CLOUDSDK_ACTIVE_CONFIG_NAME:()=>CB,CLOUDSDK_CONFIG:()=>AB,CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE:()=>dH,CODER:()=>QF,CODER_WORKSPACE_NAME:()=>eB,CODESPACES:()=>qF,COLORFGBG:()=>wH,COLORTERM:()=>IH,COMPUTERNAME:()=>MU,COMSPEC:()=>_U,CONTAINER_SANDBOX_MOUNT_POINT:()=>UU,CURL_CA_BUNDLE:()=>cH,CURSOR_TRACE_ID:()=>fF,ComSpec:()=>hU,ConEmuANSI:()=>iF,ConEmuPID:()=>aF,ConEmuTask:()=>lF,DAYTONA_WS_ID:()=>oB,DEMO_VERSION:()=>HB,DENO_CERT:()=>fH,DENO_DEPLOYMENT_ID:()=>pB,DISPLAY:()=>TU,DO_NOT_TRACK:()=>PH,DYNO:()=>dB,EDITOR:()=>CU,FORCE_COLOR:()=>LH,GCLOUD_PROJECT:()=>EB,GCM_INTERACTIVE:()=>OF,GH_CONFIG_DIR:()=>RF,GH_ENTERPRISE_TOKEN:()=>PF,GH_HOST:()=>IF,GH_REPO:()=>wF,GH_TOKEN:()=>LF,GITHUB_ACTIONS:()=>MF,GITHUB_ACTION_INPUTS:()=>UF,GITHUB_ACTION_PATH:()=>HF,GITHUB_ACTOR:()=>FF,GITHUB_ACTOR_ID:()=>BF,GITHUB_ENTERPRISE_TOKEN:()=>xF,GITHUB_ENV:()=>kF,GITHUB_EVENT_NAME:()=>zF,GITHUB_EVENT_PATH:()=>GF,GITHUB_REPOSITORY:()=>WF,GITHUB_REPOSITORY_ID:()=>KF,GITHUB_REPOSITORY_OWNER:()=>jF,GITHUB_REPOSITORY_OWNER_ID:()=>$F,GITHUB_TOKEN:()=>NF,GITHUB_WORKSPACE:()=>vF,GITLAB_CI:()=>XF,GITPOD_WORKSPACE_ID:()=>tB,GIT_ASKPASS:()=>yF,GIT_CONFIG_COUNT:()=>AF,GIT_CONFIG_GLOBAL:()=>CF,GIT_CONFIG_NOSYSTEM:()=>yH,GIT_DIR:()=>bF,GIT_SSH_COMMAND:()=>hF,GIT_SSL_CAINFO:()=>SH,GIT_SSL_CAPATH:()=>OH,GIT_TERMINAL_PROMPT:()=>SF,GNOME_TERMINAL_SERVICE:()=>jH,GOOGLE_APPLICATION_CREDENTIALS:()=>hB,GOOGLE_CLOUD_PROJECT:()=>_B,GOOGLE_CLOUD_WORKSTATIONS:()=>nB,GRPC_DEFAULT_SSL_ROOTS_FILE_PATH:()=>_H,HEX_CACERTS_PATH:()=>hH,HISTFILE:()=>nH,HOME:()=>aU,HOMEDRIVE:()=>KU,HOMEPATH:()=>jU,HOMESHARE:()=>$U,HTTPLIB2_CA_CERTS:()=>uH,HUB_CONFIG:()=>TF,INTELLIJ_TERMINAL_COMMAND_BLOCKS:()=>cF,INTELLIJ_TERMINAL_COMMAND_BLOCKS_REWORKED:()=>dF,IS_DEMO:()=>UB,IS_SANDBOX:()=>MB,ITERM_SESSION_ID:()=>zH,JAVA_HOME:()=>CH,JAVA_TOOL_OPTIONS:()=>bH,KITTY_WINDOW_ID:()=>GH,KONSOLE_VERSION:()=>WH,KUBERNETES_SERVICE_HOST:()=>IB,K_SERVICE:()=>gB,LANG:()=>LU,LC_ALL:()=>IU,LC_TERMINAL:()=>vH,LC_TIME:()=>wU,LOCALAPPDATA:()=>BU,MSYSTEM:()=>sF,NETLIFY:()=>cB,NIX_SSL_CERT_FILE:()=>EH,NODE_EXTRA_CA_CERTS:()=>sH,NODE_OPTIONS:()=>oH,NODE_PATH:()=>rH,NO_COLOR:()=>DH,NoDefaultCurrentDirectoryInExePath:()=>AU,OneDrive:()=>zU,OneDriveCommercial:()=>WU,OneDriveConsumer:()=>GU,P4PORT:()=>xB,PATH:()=>lU,PATHEXT:()=>OU,PIP_CERT:()=>gH,PLAYWRIGHT_BROWSERS_PATH:()=>kB,PREFIX:()=>uU,PROGRAMDATA:()=>YU,PROJECT_DOMAIN:()=>iB,PWD:()=>dU,ProgramData:()=>VU,ProgramFiles:()=>yU,RENDER:()=>lB,REPL_ID:()=>rB,REPL_SLUG:()=>sB,REQUESTS_CA_BUNDLE:()=>lH,RUNNER_ENVIRONMENT:()=>ZF,RUNNER_OS:()=>JF,SAFEUSER:()=>JU,SESSIONNAME:()=>ZH,SHELL:()=>gU,SPACE_CREATOR_USER_ID:()=>LB,SSH_AUTH_SOCK:()=>EF,SSH_CLIENT:()=>mF,SSH_CONNECTION:()=>gF,SSH_TTY:()=>_F,SSL_CERT_DIR:()=>aH,SSL_CERT_FILE:()=>iH,STY:()=>qH,SUDO_GID:()=>xU,SUDO_UID:()=>NU,SUDO_USER:()=>kU,SYSTEMROOT:()=>EU,SystemRoot:()=>SU,TEMP:()=>mU,TERM:()=>NH,TERMINAL:()=>MH,TERMINAL_EMULATOR:()=>UH,TERMINATOR_UUID:()=>HH,TERMUX_VERSION:()=>FH,TERM_PROGRAM:()=>xH,TERM_PROGRAM_VERSION:()=>kH,TILIX_ID:()=>BH,TMP:()=>fU,TMPDIR:()=>pU,TMUX:()=>QH,TMUX_PANE:()=>eF,TRACEPARENT:()=>FB,TRACESTATE:()=>BB,USER:()=>PU,USERNAME:()=>vU,USERPROFILE:()=>HU,USE_BUILTIN_RIPGREP:()=>vB,UV_THREADPOOL_SIZE:()=>AH,VERCEL:()=>aB,VISUAL:()=>bU,VSCODE_GIT_ASKPASS_MAIN:()=>pF,VTE_VERSION:()=>$H,WAYLAND_DISPLAY:()=>DU,WEBSITE_SITE_NAME:()=>bB,WEBSITE_SKU:()=>RB,WEZTERM_PANE:()=>XH,WSL_DISTRO_NAME:()=>oF,WSL_INTEROP:()=>rF,WT_SESSION:()=>JH,XDG_CACHE_HOME:()=>eH,XDG_CONFIG_HOME:()=>qU,XDG_DATA_HOME:()=>QU,XDG_RUNTIME_DIR:()=>ZU,XDG_STATE_HOME:()=>tH,XTERM_VERSION:()=>KH,ZDOTDIR:()=>DF,ZED_TERM:()=>nF,ZELLIJ:()=>tF,__CFBundleIdentifier:()=>uF,gcloud_project:()=>SB,google_application_credentials:()=>OB,google_cloud_project:()=>yB});var uc={};F(uc,{AI_AGENT:()=>sK,ALLOW_ANT_COMPUTER_USE_MCP:()=>iK,ANTHROPIC_CONFIG_DIR:()=>zB,BASH_MAX_OUTPUT_LENGTH:()=>o$,CCR_BYOC_RESOURCE_WATCHDOG_TELEMETRY:()=>B$,CCR_SESSION_PROFILE:()=>aK,CLAUBBIT:()=>lK,CLAUDECODE:()=>cK,CLAUDE_AFK_COUNTDOWN_MS:()=>r$,CLAUDE_AFK_TIMEOUT_MS:()=>s$,CLAUDE_AFTER_LAST_COMPACT:()=>GB,CLAUDE_AGENTS_SELECT:()=>WB,CLAUDE_AGENT_SDK_CLIENT_APP:()=>KB,CLAUDE_AGENT_SDK_DISABLE_BUILTIN_AGENTS:()=>dK,CLAUDE_AGENT_SDK_DISABLE_MCP_MANIFESTS:()=>uK,CLAUDE_AGENT_SDK_MCP_NO_PREFIX:()=>pK,CLAUDE_AGENT_SDK_VERSION:()=>jB,CLAUDE_ARTIFACT_HOST_GRANT:()=>$B,CLAUDE_ASYNC_AGENT_STALL_TIMEOUT_MS:()=>i$,CLAUDE_AUTOCOMPACT_PCT_OVERRIDE:()=>VB,CLAUDE_AUTO_BACKGROUND_TASKS:()=>fK,CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR:()=>mK,CLAUDE_BG_AUTH_SNAPSHOT_PATH:()=>YB,CLAUDE_BG_AUTO_MEMORY_OFF:()=>o0,CLAUDE_BG_BACKEND:()=>XB,CLAUDE_BG_CARRIED_PROMPTS_SHA256:()=>_0,CLAUDE_BG_CLAIM_AUTH:()=>JB,CLAUDE_BG_DISPATCHER_RATE_LIMIT_TIER:()=>ZB,CLAUDE_BG_DISPATCHER_SUBSCRIPTION_TYPE:()=>qB,CLAUDE_BG_DISPATCH_ENTRYPOINT:()=>QB,CLAUDE_BG_GATEWAY_WITHHELD:()=>t0,CLAUDE_BG_ISOLATION:()=>e0,CLAUDE_BG_MEMORY_TOGGLED_OFF:()=>n0,CLAUDE_BG_POST_CLEAR_RESPAWN:()=>r0,CLAUDE_BG_PTY_AUTH:()=>s0,CLAUDE_BG_RENDEZVOUS_SOCK:()=>i0,CLAUDE_BG_RV_AUTH:()=>a0,CLAUDE_BG_SESSION_CREDENTIAL:()=>l0,CLAUDE_BG_SESSION_PERMISSION_RULES:()=>c0,CLAUDE_BG_SILENT_PEER_TIMEOUT_MS:()=>d0,CLAUDE_BG_SOCKET_TOKENS_PATH:()=>p0,CLAUDE_BG_SOCK_ADMIT_SILENT_PEERS:()=>u0,CLAUDE_BG_SOURCE:()=>f0,CLAUDE_BG_STARTUP_WEDGE_MS:()=>a$,CLAUDE_BG_TCC_DISCLAIMED:()=>m0,CLAUDE_BG_WORKSPACE_TRUSTED:()=>g0,CLAUDE_BRIDGE_BASE_URL:()=>E0,CLAUDE_BRIDGE_OAUTH_TOKEN:()=>h0,CLAUDE_BRIDGE_REATTACH_GROUPING:()=>S0,CLAUDE_BRIDGE_REATTACH_NO_BACKFILL:()=>gK,CLAUDE_BRIDGE_REATTACH_OUTBOUND_ONLY:()=>_K,CLAUDE_BRIDGE_REATTACH_OWNER_ACCT:()=>y0,CLAUDE_BRIDGE_REATTACH_OWNER_ORG:()=>O0,CLAUDE_BRIDGE_REATTACH_SEQ:()=>l$,CLAUDE_BRIDGE_REATTACH_SESSION:()=>A0,CLAUDE_BRIDGE_SESSION_INGRESS_URL:()=>C0,CLAUDE_CHROME_PAIRED_DEVICE_ID:()=>b0,CLAUDE_CHROME_PERMISSION_MODE:()=>R0,CLAUDE_CHROME_TAB_GROUP_KEY:()=>T0,CLAUDE_CLIENT_PRESENCE_FILE:()=>D0,CLAUDE_CODE_ACTION:()=>L0,CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD:()=>I0,CLAUDE_CODE_ADDITIONAL_PROTECTION:()=>EK,CLAUDE_CODE_AGENT:()=>w0,CLAUDE_CODE_AGENT_PROGRESS_SUMMARIES:()=>N0,CLAUDE_CODE_APPEND_PROMPT_HEAD:()=>x0,CLAUDE_CODE_ARTIFACT:()=>k0,CLAUDE_CODE_ARTIFACTS_API_BASE_URL:()=>M0,CLAUDE_CODE_ARTIFACTS_API_TOKEN:()=>U0,CLAUDE_CODE_ARTIFACT_ASSET_BASE_URL:()=>H0,CLAUDE_CODE_ARTIFACT_AUTO_OPEN:()=>v0,CLAUDE_CODE_ARTIFACT_LIVE_BASE_URL:()=>F0,CLAUDE_CODE_ARTIFACT_SYNC_BASE_URL:()=>B0,CLAUDE_CODE_ARTIFACT_VIEWER_BASE_URL:()=>z0,CLAUDE_CODE_ATTACHMENTS_BY_PATH:()=>G0,CLAUDE_CODE_ATTRIBUTION_PROJECT:()=>W0,CLAUDE_CODE_ATTRIBUTION_STATUS_TIMEOUT_MS:()=>K0,CLAUDE_CODE_AUTOMOUNT_ROOTS:()=>P0,CLAUDE_CODE_AUTO_COMPACT_WINDOW:()=>$0,CLAUDE_CODE_AUTO_MODE_EXTERNAL_PERMISSIONS:()=>hK,CLAUDE_CODE_AUTO_MODE_TIER:()=>SK,CLAUDE_CODE_BASE_REF:()=>V0,CLAUDE_CODE_BASE_REFS:()=>Y0,CLAUDE_CODE_BLOCKING_LIMIT_OVERRIDE:()=>X0,CLAUDE_CODE_BRIDGE_CHILD_ARTIFACT:()=>Rz,CLAUDE_CODE_BRIDGE_CHILD_AUTO_DEFAULT:()=>bz,CLAUDE_CODE_BRIDGE_CHILD_CLI_ENTRYPOINT:()=>Iz,CLAUDE_CODE_BRIDGE_CHILD_MACHINE_SETTINGS:()=>Tz,CLAUDE_CODE_BRIDGE_CHILD_PROJECTS_ENTRYPOINT:()=>Dz,CLAUDE_CODE_BRIDGE_CHILD_START_DIR:()=>Lz,CLAUDE_CODE_BRIDGE_MCP_CARRIER:()=>J0,CLAUDE_CODE_BRIDGE_OWNER_ACCOUNT_UUID:()=>Z0,CLAUDE_CODE_BRIDGE_OWNER_ORG_UUID:()=>q0,CLAUDE_CODE_BRIDGE_PROMPT_SHA256:()=>ez,CLAUDE_CODE_BRIDGE_SESSION_ID:()=>nz,CLAUDE_CODE_BRIDGE_SETTINGS_BINDING:()=>tz,CLAUDE_CODE_BRIDGE_SOURCE_DIR:()=>Q0,CLAUDE_CODE_BRIEF:()=>yK,CLAUDE_CODE_BRIEF_UPLOAD:()=>OK,CLAUDE_CODE_CCR_EVENT_FLUSH_POLICY:()=>yj,CLAUDE_CODE_CCR_SURFACE:()=>Oj,CLAUDE_CODE_CHROME_LATE_MCP_SERVER:()=>h1,CLAUDE_CODE_CLASSIFIER_SUMMARY:()=>rz,CLAUDE_CODE_CONFIG_LOCK_WAIT_MS:()=>Nz,CLAUDE_CODE_CONFIG_PROBE:()=>wz,CLAUDE_CODE_CONFIG_WATCH_EVENTS:()=>Pz,CLAUDE_CODE_CONTAINER_ID:()=>sz,CLAUDE_CODE_COORDINATOR_SKILL_GUIDANCE:()=>AK,CLAUDE_CODE_DAEMON_COLD_START:()=>CK,CLAUDE_CODE_DECSTBM:()=>iz,CLAUDE_CODE_DESKTOP_APP_VERSION:()=>az,CLAUDE_CODE_DESKTOP_SKILLS_PLUGIN_DIR:()=>lG,CLAUDE_CODE_DEV_RAW_CHANGELOG_URL:()=>lz,CLAUDE_CODE_DIFF_COPY_ROOT:()=>cz,CLAUDE_CODE_DISABLE_ATTRIBUTION_BASELINE_REUSE:()=>j0,CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP:()=>bK,CLAUDE_CODE_DISABLE_HELD_MESSAGE_RECOGNITION:()=>vj,CLAUDE_CODE_DISABLE_HOOK_FORWARDING:()=>uz,CLAUDE_CODE_DISABLE_HTTPS_AGENT_KEEPING:()=>fz,CLAUDE_CODE_DISABLE_PLUGIN_FORWARDING:()=>pz,CLAUDE_CODE_DISABLE_POOLED_CONNECTION_IDLE_LIMIT:()=>mz,CLAUDE_CODE_DISABLE_QUIET_BACKGROUND_WAIT:()=>gz,CLAUDE_CODE_DISABLE_STOP_OF_HELD_MESSAGES:()=>Nj,CLAUDE_CODE_DISABLE_TURN_HANDOFF:()=>_z,CLAUDE_CODE_DISABLE_VITALS_EMITTER:()=>Ez,CLAUDE_CODE_DISABLE_WORKING_SYNC:()=>hz,CLAUDE_CODE_DISABLE_WORKING_SYNC_WATCH:()=>Sz,CLAUDE_CODE_DONT_INHERIT_ENV:()=>RK,CLAUDE_CODE_DOWNLOAD_DEADLINE_MS_FOR_TESTING:()=>yz,CLAUDE_CODE_DROP_UNAVAILABLE_DEFERRED_TOOL:()=>Pj,CLAUDE_CODE_EMIT_SESSION_STATE_EVENTS:()=>TK,CLAUDE_CODE_EMIT_STARTUP_TIMING:()=>IK,CLAUDE_CODE_EMIT_TOOL_USE_SUMMARIES:()=>wK,CLAUDE_CODE_EMIT_USER_PROMPT_SUBMIT_HOOK_EVENTS:()=>PK,CLAUDE_CODE_ENTRYPOINT:()=>Oz,CLAUDE_CODE_ENTRYPOINT_ON_REQUESTS:()=>Az,CLAUDE_CODE_ENVIRONMENT_KIND:()=>Cz,CLAUDE_CODE_ENVIRONMENT_RUNNER_VERSION:()=>xz,CLAUDE_CODE_EVAL_CONFINED:()=>mj,CLAUDE_CODE_EXIT_AFTER_FIRST_RENDER:()=>xK,CLAUDE_CODE_EXIT_AFTER_STOP_DELAY:()=>c$,CLAUDE_CODE_FLAG_FETCH_WAIT_MS:()=>kK,CLAUDE_CODE_FOOTER_INDICATOR:()=>kz,CLAUDE_CODE_FORCE_BRIDGE:()=>vK,CLAUDE_CODE_FORCE_EVALUATE_MEMORY:()=>MK,CLAUDE_CODE_FORCE_FULLSCREEN_UPSELL:()=>UK,CLAUDE_CODE_FORCE_MEMORY_SURVEY:()=>HK,CLAUDE_CODE_FORCE_TIP_ID:()=>Uz,CLAUDE_CODE_GIT_BASH_PATH:()=>Hz,CLAUDE_CODE_GIT_CHECK_ONLY_IN_REPOSITORY:()=>NK,CLAUDE_CODE_GLOB_TIMEOUT_SECONDS:()=>d$,CLAUDE_CODE_GOAL_CHECKIN_MINUTES:()=>u$,CLAUDE_CODE_HIDE_REPLY_SERVER_NAME:()=>Fz,CLAUDE_CODE_HIDE_SETTINGS_HINT:()=>zz,CLAUDE_CODE_HOLD_REPORT_PARK_AT_INIT:()=>Mj,CLAUDE_CODE_HOME_SEED_HOLD_TIMEOUT_MS:()=>Gz,CLAUDE_CODE_HOME_SEED_VERDICT_TIMEOUT_MS:()=>Wz,CLAUDE_CODE_HOOK_HEARTBEAT_INTERVAL_MS:()=>Rj,CLAUDE_CODE_HOSTED_DESKTOP:()=>BK,CLAUDE_CODE_HOST_OWNED_CONFIG_DIR:()=>Kz,CLAUDE_CODE_HOST_PLATFORM:()=>jz,CLAUDE_CODE_HOST_PROMPT_SUPERSEDES_RECORD:()=>FK,CLAUDE_CODE_HOST_SESSION_ID:()=>$z,CLAUDE_CODE_HOST_SHORT_TEMP_DIRS:()=>Vz,CLAUDE_CODE_HOST_SKILL_CATALOG:()=>Yz,CLAUDE_CODE_HOST_WORKTREE:()=>Jz,CLAUDE_CODE_HOST_WORKTREE_FENCE:()=>Zz,CLAUDE_CODE_IDE_HOST_OVERRIDE:()=>qz,CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS:()=>Qz,CLAUDE_CODE_IDLE_THRESHOLD_MINUTES:()=>p$,CLAUDE_CODE_IDLE_TOKEN_THRESHOLD:()=>f$,CLAUDE_CODE_IGNORE_PERSISTED_TRUST:()=>Bz,CLAUDE_CODE_IS_COWORK:()=>zK,CLAUDE_CODE_JIT_POLICY_AFTER_STARTUP:()=>lj,CLAUDE_CODE_LEGACY_BUNDLE:()=>dz,CLAUDE_CODE_LOOP_KEEPALIVE:()=>GK,CLAUDE_CODE_LOOP_PERSISTENT:()=>WK,CLAUDE_CODE_MANAGED_SETTINGS_PATH:()=>eG,CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS:()=>m$,CLAUDE_CODE_MAX_MCP_DESCRIPTION_LENGTH:()=>A1,CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH:()=>g$,CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION:()=>_$,CLAUDE_CODE_MCP_ALLOWLIST_ENV:()=>tG,CLAUDE_CODE_MCP_ALWAYS_LOAD_JOIN_BEFORE_INPUT:()=>E1,CLAUDE_CODE_MCP_APPS_HOST:()=>S1,CLAUDE_CODE_MCP_APPS_NO_TOOL_ROUTE:()=>y1,CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS:()=>c1,CLAUDE_CODE_MCP_CONNECTOR_PREWAIT_MS:()=>d1,CLAUDE_CODE_MCP_MEMORY_CGROUP:()=>Vj,CLAUDE_CODE_MCP_NO_REDIAL_AFTER_POLICY_REFUSAL:()=>_1,CLAUDE_CODE_MCP_PREWAIT_SERVERS:()=>p1,CLAUDE_CODE_MCP_PREWAIT_SERVERS_MS:()=>f1,CLAUDE_CODE_MCP_SERVE_MEMORY_WALKS_DEADLINE_MS:()=>Dj,CLAUDE_CODE_MCP_STARTUP_WAIT_MS:()=>u1,CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT:()=>a1,CLAUDE_CODE_MEMORY_CONTEXT_NO_WAIT:()=>eK,CLAUDE_CODE_MEMORY_SUBAGENT_APPEND:()=>tK,CLAUDE_CODE_MOCK_REMOTE_SETTINGS:()=>KK,CLAUDE_CODE_MOCK_TRIAL:()=>jK,CLAUDE_CODE_NOTIFICATIONS_HOST:()=>O1,CLAUDE_CODE_OVERRIDE_DATE:()=>nG,CLAUDE_CODE_PARKED_PERMISSION_WAIT_MS:()=>Tj,CLAUDE_CODE_PARKED_RUN_BEFORE_CLEAR:()=>kj,CLAUDE_CODE_PARKED_STOP_RETIRES:()=>xj,CLAUDE_CODE_PERFORCE_MODE:()=>rG,CLAUDE_CODE_PERSONAL_CONFIG_FIX:()=>sG,CLAUDE_CODE_PERSONAL_HOOKS_OFF:()=>iG,CLAUDE_CODE_PLAIN_DELTA_DIRECT_WRITE:()=>dj,CLAUDE_CODE_PLAIN_DELTA_FAST_PATH:()=>cj,CLAUDE_CODE_PLAIN_DELTA_TAKE_AT_SOURCE:()=>uj,CLAUDE_CODE_PLAN_V2_AGENT_COUNT:()=>h$,CLAUDE_CODE_PLAN_V2_EXPLORE_AGENT_COUNT:()=>S$,CLAUDE_CODE_PLUGIN_ATTRIBUTION:()=>aG,CLAUDE_CODE_PLUGIN_CACHE_DIR:()=>cG,CLAUDE_CODE_PLUGIN_GIT_TIMEOUT_MS:()=>y$,CLAUDE_CODE_PLUGIN_MCPB_DIR:()=>dG,CLAUDE_CODE_PLUGIN_SEED_DIR:()=>uG,CLAUDE_CODE_POST_TURN_MEMORY:()=>$K,CLAUDE_CODE_POST_TURN_MEMORY_CONFIG:()=>pG,CLAUDE_CODE_POST_TURN_MEMORY_SYNC:()=>VK,CLAUDE_CODE_POWERUP_ONBOARDING:()=>fG,CLAUDE_CODE_PROGRAM_USE_CASE_ID:()=>vz,CLAUDE_CODE_PROGRAM_USE_CASE_STAMPED:()=>Mz,CLAUDE_CODE_PROJECT_DIR_NAME:()=>mG,CLAUDE_CODE_PWSH_PARSE_TIMEOUT_MS:()=>O$,CLAUDE_CODE_QUESTION_EXTENDED:()=>_G,CLAUDE_CODE_QUESTION_OPTIONAL_DESCRIPTIONS:()=>EG,CLAUDE_CODE_QUESTION_PREVIEW_FORMAT:()=>gG,CLAUDE_CODE_RELAUNCH_HOME_TRUST:()=>hG,CLAUDE_CODE_RELAUNCH_PROACTIVITY_BASELINE:()=>SG,CLAUDE_CODE_RELAUNCH_PROACTIVITY_DECIDED:()=>yG,CLAUDE_CODE_RELAUNCH_PROACTIVITY_EVER_ON:()=>OG,CLAUDE_CODE_RELAUNCH_PROACTIVITY_LEVEL:()=>AG,CLAUDE_CODE_RELAUNCH_RESUME_HINT_FLAGS:()=>CG,CLAUDE_CODE_RELAUNCH_TERMINAL_SIZE:()=>bG,CLAUDE_CODE_REMOTE:()=>YK,CLAUDE_CODE_REMOTE_ENVIRONMENT_TYPE:()=>RG,CLAUDE_CODE_REMOTE_HERMETIC_MODE:()=>XK,CLAUDE_CODE_REMOTE_MCP_CONFIG:()=>TG,CLAUDE_CODE_REMOTE_MEMORY_DIR:()=>DG,CLAUDE_CODE_REMOTE_RAW_EVENTS_FILE:()=>LG,CLAUDE_CODE_REMOTE_SDK_URL:()=>IG,CLAUDE_CODE_REMOTE_SEND_KEEPALIVES:()=>JK,CLAUDE_CODE_REMOTE_SESSION_ID:()=>wG,CLAUDE_CODE_REMOTE_SESSION_ORIGIN:()=>PG,CLAUDE_CODE_REMOTE_SETTINGS_PATH:()=>NG,CLAUDE_CODE_REMOTE_SETTINGS_POLL_MS:()=>A$,CLAUDE_CODE_REMOTE_STALL_CHECK_INTERVAL_MS:()=>ZK,CLAUDE_CODE_REPL:()=>qK,CLAUDE_CODE_REPO_CHECKOUTS:()=>xG,CLAUDE_CODE_RESTRICTED:()=>QK,CLAUDE_CODE_RESTRICT_PERSONAL_CONFIG:()=>ej,CLAUDE_CODE_RESULT_NONCE:()=>oz,CLAUDE_CODE_RESUME_CACHE_WARM:()=>tj,CLAUDE_CODE_RESUME_FROM_SESSION:()=>kG,CLAUDE_CODE_RESUME_HINT_COMMAND:()=>vG,CLAUDE_CODE_RESUME_INTERRUPTED_TURN:()=>nj,CLAUDE_CODE_RESUME_INTERRUPTED_TURN_MAX_AGE_MS:()=>ij,CLAUDE_CODE_RESUME_PROMPT:()=>MG,CLAUDE_CODE_RESUME_REASON:()=>pj,CLAUDE_CODE_RESUME_SESSIONSTART_HOOKS_WAIT_MS:()=>aj,CLAUDE_CODE_RESUME_SHOWS_CUT_OFF_CALLS:()=>Ij,CLAUDE_CODE_RESUME_SOURCE_ALIVE:()=>oj,CLAUDE_CODE_RESUME_THRESHOLD_MINUTES:()=>C$,CLAUDE_CODE_RESUME_TOKEN_THRESHOLD:()=>b$,CLAUDE_CODE_RESUME_TOLERATES_CONTEXT_APPENDS:()=>Lj,CLAUDE_CODE_RESUME_TOLERATES_CONTEXT_SEEDS:()=>wj,CLAUDE_CODE_SAFE_MODE:()=>fj,CLAUDE_CODE_SANDBOXED:()=>gj,CLAUDE_CODE_SCRIPT_CAPS:()=>R$,CLAUDE_CODE_SCROLL_SPEED:()=>UG,CLAUDE_CODE_SDK_MCP_TOOL_IDLE_TIMEOUT:()=>l1,CLAUDE_CODE_SDK_READS_SESSION_STATE:()=>DK,CLAUDE_CODE_SDK_READS_STARTUP_MARKS:()=>LK,CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS:()=>T$,CLAUDE_CODE_SESSION_BEGAN_AS_COPY:()=>HG,CLAUDE_CODE_SESSION_CREATED_AT_MS:()=>WG,CLAUDE_CODE_SESSION_ID:()=>FG,CLAUDE_CODE_SESSION_KIND:()=>BG,CLAUDE_CODE_SESSION_NAME:()=>zG,CLAUDE_CODE_SESSION_ORIGIN:()=>GG,CLAUDE_CODE_SESSION_START_ANNOUNCEMENTS_BEFORE_PROMPT:()=>_j,CLAUDE_CODE_SHELL:()=>KG,CLAUDE_CODE_SHELL_PREFIX:()=>jG,CLAUDE_CODE_SHOWN_PLUGINS_DIR:()=>Xz,CLAUDE_CODE_SIMPLE:()=>Ej,CLAUDE_CODE_SIMPLE_SYSTEM_PROMPT:()=>$G,CLAUDE_CODE_SKILL_ATTRIBUTION:()=>VG,CLAUDE_CODE_SKIP_MCP_DEBUG_LOG_FILES:()=>g1,CLAUDE_CODE_SLEEP_COMPACT:()=>YG,CLAUDE_CODE_SLEEP_COMPACT_AFTER_MS:()=>XG,CLAUDE_CODE_SPAWNED_BY_SERVER:()=>jW,CLAUDE_CODE_SPAWN_TIMESTAMP_MS:()=>D$,CLAUDE_CODE_SSE_PORT:()=>L$,CLAUDE_CODE_STALL_TIMEOUT_MS_FOR_TESTING:()=>JG,CLAUDE_CODE_STARTUP_FAILURE_RESULTS:()=>oG,CLAUDE_CODE_STOP_HOOK_BLOCK_CAP:()=>I$,CLAUDE_CODE_SUBPROCESS_ENV_SCRUB:()=>hj,CLAUDE_CODE_SUPERVISED:()=>Sj,CLAUDE_CODE_SYNC_PLUGINS_BUFFERED_DOWNLOAD:()=>Aj,CLAUDE_CODE_SYNC_PLUGINS_DOWNLOAD_CONCURRENCY:()=>Cj,CLAUDE_CODE_SYNC_PLUGINS_DOWNLOAD_STALL_MS:()=>bj,CLAUDE_CODE_SYNC_PLUGINS_INSTALL_TIMEOUT_MS:()=>P$,CLAUDE_CODE_SYNC_PLUGINS_MCP_TIMEOUT_MS:()=>N$,CLAUDE_CODE_SYNC_PLUGIN_INSTALL_TIMEOUT_MS:()=>w$,CLAUDE_CODE_SYNC_REUSE_WITHIN_MS:()=>x$,CLAUDE_CODE_SYNC_SESSION_REFS:()=>Uj,CLAUDE_CODE_SYNC_SKILLS_INSTALL_TIMEOUT_MS:()=>k$,CLAUDE_CODE_SYNC_SKILLS_WAIT_TIMEOUT_MS:()=>v$,CLAUDE_CODE_SYNTAX_HIGHLIGHT:()=>Hj,CLAUDE_CODE_SYSTEM_PROMPT_FEATURE_FLAG:()=>ZG,CLAUDE_CODE_SYSTEM_PROMPT_GB_FEATURE:()=>qG,CLAUDE_CODE_TAGS:()=>QG,CLAUDE_CODE_TASK_LIST_ID:()=>tW,CLAUDE_CODE_TEAM_TEARDOWN_PARK_TIMEOUT_MS:()=>M$,CLAUDE_CODE_TELEPORT_MOVE:()=>Yj,CLAUDE_CODE_TERMINAL_MCP_TOOLS:()=>eW,CLAUDE_CODE_TEST_ALLOW_REAL_NETWORK:()=>Fj,CLAUDE_CODE_TEST_FIXTURES_ROOT:()=>nW,CLAUDE_CODE_TEST_FORCE_DENY:()=>Bj,CLAUDE_CODE_TEST_NO_GIT_BASH:()=>zj,CLAUDE_CODE_TEST_NO_PWSH:()=>Gj,CLAUDE_CODE_TMPDIR:()=>oW,CLAUDE_CODE_TMUX_PREFIX:()=>rW,CLAUDE_CODE_TMUX_PREFIX_CONFLICTS:()=>Wj,CLAUDE_CODE_TMUX_SESSION:()=>sW,CLAUDE_CODE_TMUX_TRUECOLOR:()=>Kj,CLAUDE_CODE_TOOL_MEMORY_CGROUP_EXCLUDE:()=>jj,CLAUDE_CODE_TOOL_MEMORY_LIMIT:()=>$j,CLAUDE_CODE_TOOL_PICTURE_SERVERS:()=>iW,CLAUDE_CODE_TRANSCRIPT_SLIM_TOOL_RESULTS:()=>rj,CLAUDE_CODE_TRANSCRIPT_TAIL_LOAD:()=>sj,CLAUDE_CODE_TRIGGER_ID:()=>aW,CLAUDE_CODE_TUI_JUST_SWITCHED:()=>Xj,CLAUDE_CODE_TUI_TRIAL:()=>Jj,CLAUDE_CODE_ULTRAREVIEW_LAUNCH_RECORD:()=>lW,CLAUDE_CODE_ULTRAREVIEW_PREFLIGHT_FIXTURE:()=>dW,CLAUDE_CODE_ULTRAREVIEW_PR_AS_MERGED:()=>cW,CLAUDE_CODE_ULTRAREVIEW_QUOTA_FIXTURE:()=>uW,CLAUDE_CODE_ULTRAREVIEW_REVIEW_MD_FILE:()=>pW,CLAUDE_CODE_UPFRONT_TOOLS:()=>m1,CLAUDE_CODE_USER_DELEGATED_SESSION:()=>fW,CLAUDE_CODE_USER_DELEGATED_SESSION_ALLOWED_CHECK_MODELS:()=>mW,CLAUDE_CODE_USER_DELEGATED_SESSION_ANY_CHECK_MODEL:()=>gW,CLAUDE_CODE_USER_DELEGATED_SESSION_DIRECT_API:()=>_W,CLAUDE_CODE_USER_DIALOG_TIMEOUT_MS:()=>U$,CLAUDE_CODE_VOICE_FORWARD_INTERIMS_TYPED:()=>Zj,CLAUDE_CODE_WARN_DISK_FREE_GIB:()=>H$,CLAUDE_CODE_WARN_MEMORY_FREE_GIB:()=>F$,CLAUDE_CODE_WEB_SEARCH_REFILLS_PER_HOUR:()=>E$,CLAUDE_CODE_WORKER_CHECKIN_SCHEDULE:()=>EW,CLAUDE_CODE_WORKER_EPOCH:()=>z$,CLAUDE_CODE_WORKSPACE_HOST_PATHS:()=>hW,CLAUDE_CONFIG_DIR:()=>SW,CLAUDE_COWORK_MEMORY_EXTRA_GUIDELINES:()=>yW,CLAUDE_COWORK_MEMORY_GUIDELINES:()=>OW,CLAUDE_COWORK_MEMORY_INDEX_CONTENT:()=>AW,CLAUDE_COWORK_MEMORY_PATH_OVERRIDE:()=>CW,CLAUDE_ENV_FILE:()=>bW,CLAUDE_FORCE_DISPLAY_SURVEY:()=>qj,CLAUDE_INTERNAL_ASSISTANT_TEAM_NAME:()=>RW,CLAUDE_INTERNAL_FC_OVERRIDES:()=>TW,CLAUDE_INTERNAL_SESSION_TASK_LIST_ID:()=>DW,CLAUDE_JOB_DIR:()=>LW,CLAUDE_MEMORY_STORES:()=>IW,CLAUDE_PROJECT_UUID:()=>wW,CLAUDE_PTY_HEARTBEAT_MS:()=>G$,CLAUDE_PTY_HOST_EXEC:()=>PW,CLAUDE_PTY_HOST_NO_STABLE_PATH:()=>NW,CLAUDE_PTY_ORPHAN_CHECK_MS:()=>W$,CLAUDE_RELAUNCH_SESSION_ADD_DIRS:()=>xW,CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX:()=>kW,CLAUDE_REMOTE_WORKFLOW_ARGS:()=>vW,CLAUDE_REMOTE_WORKFLOW_SCRIPT:()=>MW,CLAUDE_RUNNER_ACTIVITY_FD:()=>K$,CLAUDE_RUNNER_ALIVE_EVERY_MS:()=>j$,CLAUDE_RUNNER_CLIENT_PLATFORM:()=>UW,CLAUDE_RUNNER_FETCH_DEPTH:()=>HW,CLAUDE_RUNNER_FETCH_SERVER_PROGRESS_CAP_MS:()=>FW,CLAUDE_RUNNER_OFFERS_NEW_MACHINE:()=>V$,CLAUDE_RUNNER_UPDATE_BIN:()=>$$,CLAUDE_SECURESTORAGE_CONFIG_DIR:()=>BW,CLAUDE_SERVE_DRAIN_TIMEOUT_MS:()=>Y$,CLAUDE_SNIP:()=>zW,CLAUDE_SSH_DAEMON_CHILD:()=>WW,CLAUDE_SSH_LOCAL_BINARY:()=>GW,CLAUDE_SSH_RUN_DIR:()=>KW,CLAUDE_SSH_VERSION:()=>$W,CLAUDE_STAGE_FILE_ROOT:()=>VW,CLAUDE_TMPDIR:()=>YW,LOCAL_BRIDGE:()=>Qj,MCP_CONNECTION_NONBLOCKING:()=>e$,MCP_CONNECT_TIMEOUT_MS:()=>X$,MCP_DISCOVERY_CACHE:()=>J$,MCP_DISCOVERY_CACHE_MAX_STALE_S:()=>Z$,MCP_DISCOVERY_CACHE_STRIKES:()=>q$,MCP_DISCOVERY_CACHE_TTL_S:()=>Q$,MCP_OAUTH_CALLBACK_PORT:()=>e1,MCP_OAUTH_CLIENT_METADATA_URL:()=>XW,MCP_PROTOCOL_NEGOTIATION:()=>t1,MCP_REMOTE_SERVER_CONNECTION_BATCH_SIZE:()=>n1,MCP_SDK_GENERATION:()=>r1,MCP_SERVER_CONNECTION_BATCH_SIZE:()=>o1,MCP_TIMEOUT:()=>s1,MCP_TOOL_TIMEOUT:()=>i1,MCP_TRUNCATION_PROMPT_OVERRIDE:()=>JW,SDK_NATIVE_BIN:()=>ZW,SESSION_INGRESS_URL:()=>qW,SLASH_COMMAND_TOOL_CHAR_BUDGET:()=>C1,SYSTEM_REMINDER_MEMORY_CONTEXT:()=>QW,TEST_ENABLE_SESSION_PERSISTENCE:()=>t$,ULTRAPLAN_PROMPT_FILE:()=>nK,VCR_RECORD:()=>n$,VITALS_EMITTER_BIN:()=>oK,VOICE_STREAM_BASE_URL:()=>rK});var pc={};F(pc,{ANTHROPIC_CUSTOM_MODEL_OPTION:()=>j1,ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION:()=>V1,ANTHROPIC_CUSTOM_MODEL_OPTION_NAME:()=>$1,ANTHROPIC_DEFAULT_FABLE_MODEL:()=>D1,ANTHROPIC_DEFAULT_FABLE_MODEL_DESCRIPTION:()=>I1,ANTHROPIC_DEFAULT_FABLE_MODEL_NAME:()=>L1,ANTHROPIC_DEFAULT_HAIKU_MODEL:()=>M1,ANTHROPIC_DEFAULT_HAIKU_MODEL_DESCRIPTION:()=>H1,ANTHROPIC_DEFAULT_HAIKU_MODEL_NAME:()=>U1,ANTHROPIC_DEFAULT_MODEL:()=>R1,ANTHROPIC_DEFAULT_OPUS_MODEL:()=>w1,ANTHROPIC_DEFAULT_OPUS_MODEL_DESCRIPTION:()=>N1,ANTHROPIC_DEFAULT_OPUS_MODEL_NAME:()=>P1,ANTHROPIC_DEFAULT_SONNET_MODEL:()=>x1,ANTHROPIC_DEFAULT_SONNET_MODEL_DESCRIPTION:()=>v1,ANTHROPIC_DEFAULT_SONNET_MODEL_NAME:()=>k1,ANTHROPIC_MODEL:()=>b1,ANTHROPIC_SMALL_FAST_MODEL:()=>T1,CLAUDE_CODE_3P_PROBE_WROTE_HAIKU_DEFAULT:()=>z1,CLAUDE_CODE_3P_PROBE_WROTE_OPUS_DEFAULT:()=>B1,CLAUDE_CODE_3P_PROBE_WROTE_SONNET_DEFAULT:()=>F1,CLAUDE_CODE_3P_SEEDED_OPUS_DEFAULT:()=>W1,CLAUDE_CODE_3P_SEEDED_SONNET_DEFAULT:()=>G1,CLAUDE_CODE_ALLOW_OTHER_MODELS:()=>_V,CLAUDE_CODE_ALWAYS_ENABLE_EFFORT:()=>iV,CLAUDE_CODE_AUTO_MODE_MODEL:()=>q1,CLAUDE_CODE_BG_CLASSIFIER_MODEL:()=>Q1,CLAUDE_CODE_CLIENT_DATA_URL:()=>gV,CLAUDE_CODE_DISABLE_1M_CONTEXT:()=>uV,CLAUDE_CODE_DISABLE_EXPLORE_INHERIT_CAP:()=>oV,CLAUDE_CODE_DISABLE_FAST_MODE:()=>lV,CLAUDE_CODE_DISABLE_LEGACY_MODEL_REMAP:()=>rV,CLAUDE_CODE_DISABLE_MODEL_ACCESS_FALLBACK:()=>nV,CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT:()=>pV,CLAUDE_CODE_EFFORT_LEVEL:()=>sV,CLAUDE_CODE_MAX_EFFORT_REMINDER:()=>aV,CLAUDE_CODE_MODEL_CATALOG:()=>fV,CLAUDE_CODE_MODEL_CATALOG_URL:()=>mV,CLAUDE_CODE_NO_MODEL_FALLBACK:()=>tV,CLAUDE_CODE_SKIP_FAST_MODE_NETWORK_ERRORS:()=>cV,CLAUDE_CODE_SKIP_FAST_MODE_ORG_CHECK:()=>dV,CLAUDE_CODE_SKIP_MODEL_ACCESS_MEMORY:()=>K1,CLAUDE_CODE_SUBAGENT_EFFORT:()=>X1,CLAUDE_CODE_SUBAGENT_MODEL:()=>Y1,CLAUDE_CODE_SUBAGENT_MODEL_FORCE:()=>J1,CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL:()=>Z1,FALLBACK_FOR_ALL_PRIMARY_MODELS:()=>eV});var fc={};F(fc,{ALL_PROXY:()=>CV,ANTHROPIC_BETAS:()=>NV,ANTHROPIC_CUSTOM_HEADERS:()=>xV,API_FORCE_IDLE_TIMEOUT:()=>QV,API_TIMEOUT_MS:()=>YV,CLAUDE_BYTE_STREAM_IDLE_TIMEOUT_MS:()=>_Y,CLAUDE_CODE_ATTRIBUTION_HEADER:()=>MV,CLAUDE_CODE_CERT_STORE:()=>IV,CLAUDE_CODE_CLIENT_CERT:()=>RV,CLAUDE_CODE_CLIENT_KEY:()=>TV,CLAUDE_CODE_CLIENT_KEY_PASSPHRASE:()=>DV,CLAUDE_CODE_DISABLE_LOOPED_CROSS_CERT_DROP:()=>wV,CLAUDE_CODE_DISABLE_MTLS_RELOAD_ON_STALE_CONNECTION:()=>LV,CLAUDE_CODE_DISABLE_SELF_NAMED_CERT_DROP:()=>PV,CLAUDE_CODE_EAGER_FLUSH:()=>bY,CLAUDE_CODE_EXTRA_BODY:()=>kV,CLAUDE_CODE_EXTRA_METADATA:()=>vV,CLAUDE_CODE_FILE_READ_MAX_OUTPUT_TOKENS:()=>BV,CLAUDE_CODE_FILE_READ_MAX_PDF_PAGES_PER_MESSAGE:()=>zV,CLAUDE_CODE_FILE_READ_MAX_PDF_PAGES_PER_TURN:()=>GV,CLAUDE_CODE_FORCE_SYNC_OUTPUT:()=>RY,CLAUDE_CODE_GZIP_CCR_REQUEST_BODIES:()=>rY,CLAUDE_CODE_GZIP_DATADOG_LOGS:()=>sY,CLAUDE_CODE_GZIP_REQUEST_BODIES:()=>oY,CLAUDE_CODE_GZIP_REQUEST_BODY_BLOCKS:()=>aY,CLAUDE_CODE_GZIP_REQUEST_BODY_LEVEL:()=>iY,CLAUDE_CODE_INCREMENTAL_REQUEST_BODY:()=>lY,CLAUDE_CODE_MAIN_REPLY_HOLD_MS:()=>uY,CLAUDE_CODE_MAX_CONTEXT_TOKENS:()=>FV,CLAUDE_CODE_MAX_OUTPUT_TOKENS:()=>HV,CLAUDE_CODE_MAX_RETRIES:()=>UV,CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY:()=>WV,CLAUDE_CODE_MAX_TURNS:()=>KV,CLAUDE_CODE_NONSTREAMING_TIMEOUT_RETRIES:()=>XV,CLAUDE_CODE_OVERLOADED_RETRY_BASE_DELAY_MS:()=>JV,CLAUDE_CODE_OVERLOADED_RETRY_MAX_DELAY_MS:()=>ZV,CLAUDE_CODE_OVERLOADED_RETRY_MAX_WAIT_MS:()=>qV,CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS:()=>LY,CLAUDE_CODE_RETRY_WATCHDOG:()=>SY,CLAUDE_CODE_RETRY_WATCHDOG_MAX_USAGE_LIMIT_WAIT_MS:()=>OY,CLAUDE_CODE_RETRY_WATCHDOG_MAX_WAIT_MS:()=>yY,CLAUDE_CODE_RETRY_WATCHDOG_SCOPE:()=>CY,CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS:()=>AY,CLAUDE_CODE_SLOW_OPERATION_THRESHOLD_MS:()=>DY,CLAUDE_CODE_STREAM_EVENT_HOLD_MS:()=>pY,CLAUDE_CODE_STREAM_EVENT_MAX_LINE_BYTES:()=>fY,CLAUDE_CODE_STREAM_EVENT_NO_SUBSCRIBER_HOLD_MS:()=>mY,CLAUDE_CODE_STREAM_TIMER_SLACK_MS:()=>cY,CLAUDE_CODE_UNWATCHED_REPLY_HOLD_MS:()=>dY,CLAUDE_ENABLE_BYTE_WATCHDOG:()=>eY,CLAUDE_ENABLE_BYTE_WATCHDOG_BEDROCK:()=>tY,CLAUDE_ENABLE_STREAM_WATCHDOG:()=>nY,CLAUDE_MOCK_HEADERLESS_429:()=>TY,CLAUDE_SLOW_FIRST_BYTE_MS:()=>hY,CLAUDE_STREAM_FIRST_BYTE_TIMEOUT_MS:()=>EY,CLAUDE_STREAM_IDLE_TIMEOUT_MS:()=>gY,HTTPS_PROXY:()=>hV,HTTP_PROXY:()=>EV,MAX_MCP_OUTPUT_TOKENS:()=>VV,MAX_STRUCTURED_OUTPUT_RETRIES:()=>$V,MAX_THINKING_TOKENS:()=>jV,NO_PROXY:()=>SV,all_proxy:()=>bV,http_proxy:()=>yV,https_proxy:()=>OV,no_proxy:()=>AV});var mc={};F(mc,{AGENT_PROXY_URL:()=>Z2,ANTHROPIC_AWS_BASE_URL:()=>GY,ANTHROPIC_AWS_WORKSPACE_ID:()=>WY,ANTHROPIC_BASE_URL:()=>vY,ANTHROPIC_BEDROCK_BASE_URL:()=>HY,ANTHROPIC_BEDROCK_MANTLE_BASE_URL:()=>zY,ANTHROPIC_BEDROCK_REGION_PREFIX:()=>FY,ANTHROPIC_BEDROCK_SERVICE_TIER:()=>BY,ANTHROPIC_FOUNDRY_BASE_URL:()=>ZY,ANTHROPIC_FOUNDRY_RESOURCE:()=>qY,ANTHROPIC_GOOGLE_CLOUD_BASE_URL:()=>VY,ANTHROPIC_GOOGLE_CLOUD_LOCATION:()=>jY,ANTHROPIC_GOOGLE_CLOUD_PROJECT:()=>KY,ANTHROPIC_GOOGLE_CLOUD_WORKSPACE_ID:()=>$Y,ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION:()=>p2,ANTHROPIC_UNIX_SOCKET:()=>f2,ANTHROPIC_VERTEX_BASE_URL:()=>YY,ANTHROPIC_VERTEX_PROJECT_ID:()=>XY,AWS_ACCESS_KEY_ID:()=>r2,AWS_CONFIG_FILE:()=>n2,AWS_DEFAULT_REGION:()=>e2,AWS_ENDPOINT_URL:()=>a2,AWS_ENDPOINT_URL_BEDROCK:()=>l2,AWS_ENDPOINT_URL_BEDROCK_RUNTIME:()=>c2,AWS_ENDPOINT_URL_STS:()=>d2,AWS_PROFILE:()=>t2,AWS_REGION:()=>QY,AWS_SECRET_ACCESS_KEY:()=>s2,AWS_SESSION_TOKEN:()=>i2,AWS_SHARED_CREDENTIALS_FILE:()=>o2,AWS_USE_FIPS_ENDPOINT:()=>u2,CACERT_UPDATES:()=>F2,CCR_AGENT_PROXY_CA_CERT_B64:()=>K2,CCR_AGENT_PROXY_CA_WATCH_ENABLED:()=>j2,CCR_AGENT_PROXY_ENABLED:()=>L2,CCR_AGENT_PROXY_FRAME_HOSTS:()=>V2,CCR_AGENT_PROXY_INCLUDE_HOSTS:()=>k2,CCR_AGENT_PROXY_JAVA_STORE_DIRECT_DISABLED:()=>H2,CCR_AGENT_PROXY_MAX_BUSY_TUNNELS:()=>U2,CCR_AGENT_PROXY_NO_PROXY_LOCAL_ONLY:()=>W2,CCR_AGENT_PROXY_NSS_RECORDS_DISABLED:()=>$2,CCR_AGENT_PROXY_RECEIVE_GATE_DISABLED:()=>v2,CCR_AGENT_PROXY_RELAY_MODE:()=>N2,CCR_AGENT_PROXY_UPLOAD_GATE_DISABLED:()=>M2,CCR_ENABLE_BUNDLE:()=>Y2,CCR_FORCE_BUNDLE:()=>X2,CCR_ON_BRANCH_DEFAULT_GUARD:()=>J2,CLAUDE_CODE_AGENT_PROXY_GH_SHIM:()=>w2,CLAUDE_CODE_AGENT_PROXY_GIT_CONFIG:()=>I2,CLAUDE_CODE_AGENT_PROXY_GIT_HOSTS:()=>P2,CLAUDE_CODE_API_BASE_URL:()=>UY,CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY:()=>b2,CLAUDE_CODE_FEATURE_FLAGS_REFRESH_INTERVAL_MS:()=>D2,CLAUDE_CODE_GATEWAY_MODEL_DISCOVERY_TIMEOUT_MS:()=>R2,CLAUDE_CODE_GB_BASE_URL:()=>T2,CLAUDE_CODE_HOST_GATEWAY_LINEAGE:()=>g2,CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST:()=>m2,CLAUDE_CODE_PROXY_RESOLVES_HOSTS:()=>E2,CLAUDE_CODE_SIMULATE_PROXY_USAGE:()=>_2,CLAUDE_CODE_SKIP_HFI_VERSION_CHECK:()=>q2,CLAUDE_CODE_USE_ANTHROPIC_AWS:()=>NY,CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD:()=>xY,CLAUDE_CODE_USE_BEDROCK:()=>IY,CLAUDE_CODE_USE_FOUNDRY:()=>PY,CLAUDE_CODE_USE_GATEWAY:()=>h2,CLAUDE_CODE_USE_MANTLE:()=>kY,CLAUDE_CODE_USE_VERTEX:()=>wY,CLAUDE_GATEWAY_ALLOW_LOOPBACK:()=>S2,CLAUDE_GATEWAY_DRAIN_TIMEOUT_MS:()=>C2,CLAUDE_GATEWAY_LOG_FORMAT:()=>A2,CLAUDE_GATEWAY_LOG_LEVEL:()=>O2,CLAUDE_GATEWAY_PROXY_IS_EGRESS_BOUNDARY:()=>y2,CLOUD_ML_REGION:()=>JY,DPKG_ADMINDIR:()=>z2,DPKG_MAINTSCRIPT_PACKAGE:()=>B2,DPKG_ROOT:()=>G2,SELF_HOSTED_RUNNER_AGENT_PROXY_URL:()=>x2,_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL:()=>MY});var Aa={};F(Aa,{default:()=>$s});import{resolve as Iee}from"path";import{execFile as hA}from"child_process";import{accessSync as SA,closeSync as yA,constants as OA,openSync as AA,readSync as CA}from"fs";import{userInfo as EA}from"os";var Ls=["remote_cowork","remote_cowork_trigger"];var $u="com.anthropic.claudecode",ki="HKLM\\SOFTWARE\\Policies\\ClaudeCode",vi="HKCU\\SOFTWARE\\Policies\\ClaudeCode",Is="Settings",Xl="/usr/bin/plutil",Vu=["-convert","json","-o","-","--"],Yu=["-lint","-s","--"],Jl=5000,Xu=60000,Mi=2097152,Po="/mnt/c/Windows/System32/reg.exe",Ju="unable to find the specified registry key or value",Hn="/mnt/c/Program Files/ClaudeCode",Yl=d({isCoworkCloud:void 0},(s)=>{s.isCoworkCloud=void 0});function Zl(){if(Yl.isCoworkCloud===void 0){let s=process.env.CLAUDE_CODE_ENTRYPOINT;Yl.isCoworkCloud=Ls.some((c)=>c===s)}return Yl.isCoworkCloud}function hr(){if(process.platform!=="linux")return!1;let s=Zl();if(process.env.WSL_DISTRO_NAME&&!s)return!0;try{let c=wn("fs").readFileSync("/proc/version","utf8").toLowerCase();return Ce(c)}catch{return!1}}var ql="per-user managed preferences";function Zu(){let s="";try{s=EA().username}catch{}let c=[];if(s)c.push({path:`/Library/Managed Preferences/${s}/${$u}.plist`,label:ql});return c.push({path:`/Library/Managed Preferences/${$u}.plist`,label:"device-level managed preferences"}),c}var np=new Set(["EAGAIN","EMFILE","ENFILE","ENOMEM"]);class op{promise=null;start(){if(this.promise)return;this.promise=Hi()}reset(){this.promise=null}}var bA=new op;function RA(s){if(!s)return{status:"ok",exitCode:0,errno:null,signal:null};let c=s,T=typeof c.signal==="string"&&c.signal?c.signal:null;if(typeof c.code==="string")return{status:"spawn_error",exitCode:null,errno:c.code,signal:null};if(c.killed===!0)return{status:"timeout",exitCode:null,errno:null,signal:T};if(T)return{status:"killed",exitCode:null,errno:null,signal:T};return{status:"exited",exitCode:typeof c.code==="number"?c.code:null,errno:null,signal:null}}function Ql(s,c,T){let I=Date.now();return new Promise((v)=>{try{hA(s,c,{encoding:"utf-8",timeout:Jl,windowsHide:!0,...T!==void 0&&{maxBuffer:T}},(U,oe,re)=>{v({stdout:oe??"",stderr:re??"",...RA(U),durationMs:Date.now()-I})})}catch(U){let oe=U.code;v({stdout:"",stderr:"",status:"spawn_error",exitCode:null,errno:typeof oe==="string"?oe:null,signal:null,durationMs:Date.now()-I})}})}function qu(s){return{status:s.status,exitCode:s.exitCode,errno:s.errno,signal:s.signal,durationMs:s.durationMs,answered:s.status==="ok"||s.status==="exited"&&s.exitCode===1&&s.stderr.includes(Ju)}}function Ui(s){return!s.answered&&!(s.status==="exited"&&s.exitCode===1)&&!(s.status==="spawn_error"&&(s.errno===null||!np.has(s.errno)))}function Qu(s){return s.status==="ok"||s.status==="exited"&&s.exitCode!==null}function rp(s){return s.status==="spawn_error"&&s.errno==="ERR_CHILD_PROCESS_STDIO_MAXBUFFER"}function ep(s){if(rp(s))return{unreadReason:"plutil's output exceeded the size limit",unreadCause:"oversize"};switch(s.status){case"timeout":return{unreadReason:`plutil timed out after ${Jl/1000} seconds`,unreadCause:"timeout"};case"killed":return{unreadReason:"plutil was stopped by a signal",unreadCause:"killed"};case"spawn_error":return{unreadReason:"plutil could not be run",unreadCause:s.errno!==null&&np.has(s.errno)?"spawn_busy":"spawn_error"};case"ok":case"exited":return{unreadReason:"plutil did not finish"}}}function TA(s){let c;try{return c=AA(s,"r"),CA(c,Buffer.alloc(1),0,1,0),null}catch(T){return{code:T&&typeof T==="object"&&"code"in T?T.code:void 0,message:T instanceof Error?T.message:String(T)}}finally{if(c!==void 0)try{yA(c)}catch{}}}function Hi(s=!1){return(async()=>{if(process.platform==="darwin"){let c=Zu(),I=(await Promise.all(c.map(async({path:U,...oe})=>{try{SA(U,OA.R_OK)}catch(Re){let Ie=Re&&typeof Re==="object"&&"code"in Re?Re.code:void 0;if(Ie==="ENOENT"||Ie==="ENOTDIR")return null;return{stdout:null,unreadReason:Re instanceof Error?Re.message:String(Re),...typeof Ie==="string"&&{unreadErrno:Ie},...oe}}let re=await Ql(Xl,[...Vu,U],Mi);if(!Qu(re))return{stdout:null,...ep(re),...oe};if(re.status==="ok")return{stdout:re.stdout,...oe};let le=await Ql(Xl,[...Yu,U]);if(!Qu(le)){let{unreadReason:Re,unreadCause:Ie}=ep(le),Ze=Ie==="timeout"||Ie==="killed"||Ie==="spawn_busy"?"lint_unfinished":Ie;return{stdout:null,unreadReason:`plutil rejected the conversion, and in the check that follows ${Re}`,unreadCause:Ze,...oe}}if(le.status==="ok")return{stdout:null,unreadReason:"it holds a value plutil cannot convert to JSON (a date or data value)",unreadCause:"unconvertible",...oe};let ye=TA(U);if(ye!==null){if(ye.code==="ENOENT"||ye.code==="ENOTDIR")return null;return{stdout:null,unreadReason:ye.message,...typeof ye.code==="string"&&{unreadErrno:ye.code},...oe}}return{stdout:"",...oe}}))).filter((U)=>U!==null),v=I.findIndex((U)=>U.stdout!==null);return{plistStdouts:v===-1?I:I.slice(0,v+1),hklmStdout:null,hkcuStdout:null,outcomes:{hklm:null,hkcu:null}}}if(process.platform==="win32"){let T=`${process.env.SYSTEMROOT||"C:\\Windows"}\\System32\\reg.exe`;return tp(T,s)}if(hr())return tp(Po,s);return{plistStdouts:null,hklmStdout:null,hkcuStdout:null,outcomes:{hklm:null,hkcu:null}}})()}async function tp(s,c){let T=(oe)=>Ql(s,["query",oe,"/v",Is],Mi),[I,v]=await Promise.all([T(ki),T(vi)]),U=qu(I);return{plistStdouts:null,hklmStdout:I.status==="ok"?I.stdout:null,...rp(I)&&{hklmUnreadReason:`the value exceeds ${Mi/1048576} MiB`},hkcuStdout:v.status==="ok"?v.stdout:null,outcomes:{hklm:U,hkcu:qu(v)}}}function sp(){return bA.promise}function DA(){this.__data__=[],this.size=0}var ip=DA;function LA(s,c){return s===c||s!==s&&c!==c}var lo=LA;function IA(s,c){var T=s.length;while(T--)if(lo(s[T][0],c))return T;return-1}var No=IA;var wA=Array.prototype,PA=wA.splice;function NA(s){var c=this.__data__,T=No(c,s);if(T<0)return!1;var I=c.length-1;if(T==I)c.pop();else PA.call(c,T,1);return--this.size,!0}var ap=NA;function xA(s){var c=this.__data__,T=No(c,s);return T<0?void 0:c[T][1]}var lp=xA;function kA(s){return No(this.__data__,s)>-1}var cp=kA;function vA(s,c){var T=this.__data__,I=No(T,s);if(I<0)++this.size,T.push([s,c]);else T[I][1]=c;return this}var dp=vA;function Sr(s){var c=-1,T=s==null?0:s.length;this.clear();while(++c<T){var I=s[c];this.set(I[0],I[1])}}Sr.prototype.clear=ip;Sr.prototype.delete=ap;Sr.prototype.get=lp;Sr.prototype.has=cp;Sr.prototype.set=dp;var xo=Sr;function MA(){this.__data__=new xo,this.size=0}var up=MA;function UA(s){var c=this.__data__,T=c.delete(s);return this.size=c.size,T}var pp=UA;function HA(s){return this.__data__.get(s)}var fp=HA;function FA(s){return this.__data__.has(s)}var mp=FA;var BA=typeof global=="object"&&global&&global.Object===Object&&global,Fi=BA;var zA=typeof self=="object"&&self&&self.Object===Object&&self,GA=Fi||zA||Function("return this")(),Sn=GA;var WA=Sn.Symbol,Nn=WA;var gp=Object.prototype,{hasOwnProperty:KA,toString:jA}=gp,ws=Nn?Nn.toStringTag:void 0;function $A(s){var c=KA.call(s,ws),T=s[ws];try{s[ws]=void 0;var I=!0}catch(U){}var v=jA.call(s);if(I)if(c)s[ws]=T;else delete s[ws];return v}var _p=$A;var VA=Object.prototype,YA=VA.toString;function XA(s){return YA.call(s)}var Ep=XA;var JA="[object Null]",ZA="[object Undefined]",hp=Nn?Nn.toStringTag:void 0;function qA(s){if(s==null)return s===void 0?ZA:JA;return hp&&hp in Object(s)?_p(s):Ep(s)}var $n=qA;function QA(s){var c=typeof s;return s!=null&&(c=="object"||c=="function")}var _n=QA;var eC="[object AsyncFunction]",tC="[object Function]",nC="[object GeneratorFunction]",oC="[object Proxy]";function rC(s){if(!_n(s))return!1;var c=$n(s);return c==tC||c==nC||c==eC||c==oC}var yr=rC;var sC=Sn["__core-js_shared__"],Bi=sC;var Sp=function(){var s=/[^.]+$/.exec(Bi&&Bi.keys&&Bi.keys.IE_PROTO||"");return s?"Symbol(src)_1."+s:""}();function iC(s){return!!Sp&&Sp in s}var yp=iC;var aC=Function.prototype,lC=aC.toString;function cC(s){if(s!=null){try{return lC.call(s)}catch(c){}try{return s+""}catch(c){}}return""}var yo=cC;var dC=/[\\^$.*+?()[\]{}|]/g,uC=/^\[object .+?Constructor\]$/,pC=Function.prototype,fC=Object.prototype,mC=pC.toString,gC=fC.hasOwnProperty,_C=RegExp("^"+mC.call(gC).replace(dC,"\\$&").replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g,"$1.*?")+"$");function EC(s){if(!_n(s)||yp(s))return!1;var c=yr(s)?_C:uC;return c.test(yo(s))}var Op=EC;function hC(s,c){return s==null?void 0:s[c]}var Ap=hC;function SC(s,c){var T=Ap(s,c);return Op(T)?T:void 0}var Kn=SC;var yC=Kn(Sn,"Map"),ko=yC;var OC=Kn(Object,"create"),Oo=OC;function AC(){this.__data__=Oo?Oo(null):{},this.size=0}var Cp=AC;function CC(s){var c=this.has(s)&&delete this.__data__[s];return this.size-=c?1:0,c}var bp=CC;var bC="__lodash_hash_undefined__",RC=Object.prototype,TC=RC.hasOwnProperty;function DC(s){var c=this.__data__;if(Oo){var T=c[s];return T===bC?void 0:T}return TC.call(c,s)?c[s]:void 0}var Rp=DC;var LC=Object.prototype,IC=LC.hasOwnProperty;function wC(s){var c=this.__data__;return Oo?c[s]!==void 0:IC.call(c,s)}var Tp=wC;var PC="__lodash_hash_undefined__";function NC(s,c){var T=this.__data__;return this.size+=this.has(s)?0:1,T[s]=Oo&&c===void 0?PC:c,this}var Dp=NC;function Or(s){var c=-1,T=s==null?0:s.length;this.clear();while(++c<T){var I=s[c];this.set(I[0],I[1])}}Or.prototype.clear=Cp;Or.prototype.delete=bp;Or.prototype.get=Rp;Or.prototype.has=Tp;Or.prototype.set=Dp;var ec=Or;function xC(){this.size=0,this.__data__={hash:new ec,map:new(ko||xo),string:new ec}}var Lp=xC;function kC(s){var c=typeof s;return c=="string"||c=="number"||c=="symbol"||c=="boolean"?s!=="__proto__":s===null}var Ip=kC;function vC(s,c){var T=s.__data__;return Ip(c)?T[typeof c=="string"?"string":"hash"]:T.map}var vo=vC;function MC(s){var c=vo(this,s).delete(s);return this.size-=c?1:0,c}var wp=MC;function UC(s){return vo(this,s).get(s)}var Pp=UC;function HC(s){return vo(this,s).has(s)}var Np=HC;function FC(s,c){var T=vo(this,s),I=T.size;return T.set(s,c),this.size+=T.size==I?0:1,this}var xp=FC;function Ar(s){var c=-1,T=s==null?0:s.length;this.clear();while(++c<T){var I=s[c];this.set(I[0],I[1])}}Ar.prototype.clear=Lp;Ar.prototype.delete=wp;Ar.prototype.get=Pp;Ar.prototype.has=Np;Ar.prototype.set=xp;var Zo=Ar;var BC=200;function zC(s,c){var T=this.__data__;if(T instanceof xo){var I=T.__data__;if(!ko||I.length<BC-1)return I.push([s,c]),this.size=++T.size,this;T=this.__data__=new Zo(I)}return T.set(s,c),this.size=T.size,this}var kp=zC;function Cr(s){var c=this.__data__=new xo(s);this.size=c.size}Cr.prototype.clear=up;Cr.prototype.delete=pp;Cr.prototype.get=fp;Cr.prototype.has=mp;Cr.prototype.set=kp;var co=Cr;var GC="__lodash_hash_undefined__";function WC(s){return this.__data__.set(s,GC),this}var vp=WC;function KC(s){return this.__data__.has(s)}var Mp=KC;function zi(s){var c=-1,T=s==null?0:s.length;this.__data__=new Zo;while(++c<T)this.add(s[c])}zi.prototype.add=zi.prototype.push=vp;zi.prototype.has=Mp;var Gi=zi;function jC(s,c){var T=-1,I=s==null?0:s.length;while(++T<I)if(c(s[T],T,s))return!0;return!1}var Up=jC;function $C(s,c){return s.has(c)}var Wi=$C;var VC=1,YC=2;function XC(s,c,T,I,v,U){var oe=T&VC,re=s.length,le=c.length;if(re!=le&&!(oe&&le>re))return!1;var ye=U.get(s),Re=U.get(c);if(ye&&Re)return ye==c&&Re==s;var Ie=-1,Le=!0,Ze=T&YC?new Gi:void 0;U.set(s,c),U.set(c,s);while(++Ie<re){var $e=s[Ie],dt=c[Ie];if(I)var Me=oe?I(dt,$e,Ie,c,s,U):I($e,dt,Ie,s,c,U);if(Me!==void 0){if(Me)continue;Le=!1;break}if(Ze){if(!Up(c,function(nt,rt){if(!Wi(Ze,rt)&&($e===nt||v($e,nt,T,I,U)))return Ze.push(rt)})){Le=!1;break}}else if(!($e===dt||v($e,dt,T,I,U))){Le=!1;break}}return U.delete(s),U.delete(c),Le}var Ki=XC;var JC=Sn.Uint8Array,br=JC;function ZC(s){var c=-1,T=Array(s.size);return s.forEach(function(I,v){T[++c]=[v,I]}),T}var Hp=ZC;function qC(s){var c=-1,T=Array(s.size);return s.forEach(function(I){T[++c]=I}),T}var Rr=qC;var QC=1,eb=2,tb="[object Boolean]",nb="[object Date]",ob="[object Error]",rb="[object Map]",sb="[object Number]",ib="[object RegExp]",ab="[object Set]",lb="[object String]",cb="[object Symbol]",db="[object ArrayBuffer]",ub="[object DataView]",Fp=Nn?Nn.prototype:void 0,tc=Fp?Fp.valueOf:void 0;function pb(s,c,T,I,v,U,oe){switch(T){case ub:if(s.byteLength!=c.byteLength||s.byteOffset!=c.byteOffset)return!1;s=s.buffer,c=c.buffer;case db:if(s.byteLength!=c.byteLength||!U(new br(s),new br(c)))return!1;return!0;case tb:case nb:case sb:return lo(+s,+c);case ob:return s.name==c.name&&s.message==c.message;case ib:case lb:return s==c+"";case rb:var re=Hp;case ab:var le=I&QC;if(re||(re=Rr),s.size!=c.size&&!le)return!1;var ye=oe.get(s);if(ye)return ye==c;I|=eb,oe.set(s,c);var Re=Ki(re(s),re(c),I,v,U,oe);return oe.delete(s),Re;case cb:if(tc)return tc.call(s)==tc.call(c)}return!1}var Bp=pb;function fb(s,c){var T=-1,I=c.length,v=s.length;while(++T<I)s[v+T]=c[T];return s}var Tr=fb;var mb=Array.isArray,Vt=mb;function gb(s,c,T){var I=c(s);return Vt(s)?I:Tr(I,T(s))}var ji=gb;function _b(s,c){var T=-1,I=s==null?0:s.length,v=0,U=[];while(++T<I){var oe=s[T];if(c(oe,T,s))U[v++]=oe}return U}var zp=_b;function Eb(){return[]}var $i=Eb;var hb=Object.prototype,Sb=hb.propertyIsEnumerable,Gp=Object.getOwnPropertySymbols,yb=!Gp?$i:function(s){if(s==null)return[];return s=Object(s),zp(Gp(s),function(c){return Sb.call(s,c)})},Dr=yb;function Ob(s,c){var T=-1,I=Array(s);while(++T<s)I[T]=c(T);return I}var Wp=Ob;function Ab(s){return s!=null&&typeof s=="object"}var Ln=Ab;var Cb="[object Arguments]";function bb(s){return Ln(s)&&$n(s)==Cb}var nc=bb;var Kp=Object.prototype,{hasOwnProperty:Rb,propertyIsEnumerable:Tb}=Kp,Db=nc(function(){return arguments}())?nc:function(s){return Ln(s)&&Rb.call(s,"callee")&&!Tb.call(s,"callee")},Ao=Db;function Lb(){return!1}var jp=Lb;var Yp=typeof Yi=="object"&&Yi&&!Yi.nodeType&&Yi,$p=Yp&&typeof Vi=="object"&&Vi&&!Vi.nodeType&&Vi,Ib=$p&&$p.exports===Yp,Vp=Ib?Sn.Buffer:void 0,wb=Vp?Vp.isBuffer:void 0,Pb=wb||jp,uo=Pb;var Nb=9007199254740991,xb=/^(?:0|[1-9]\d*)$/;function kb(s,c){var T=typeof s;return c=c==null?Nb:c,!!c&&(T=="number"||T!="symbol"&&xb.test(s))&&(s>-1&&s%1==0&&s<c)}var Mo=kb;var vb=9007199254740991;function Mb(s){return typeof s=="number"&&s>-1&&s%1==0&&s<=vb}var Lr=Mb;var Ub="[object Arguments]",Hb="[object Array]",Fb="[object Boolean]",Bb="[object Date]",zb="[object Error]",Gb="[object Function]",Wb="[object Map]",Kb="[object Number]",jb="[object Object]",$b="[object RegExp]",Vb="[object Set]",Yb="[object String]",Xb="[object WeakMap]",Jb="[object ArrayBuffer]",Zb="[object DataView]",qb="[object Float32Array]",Qb="[object Float64Array]",eR="[object Int8Array]",tR="[object Int16Array]",nR="[object Int32Array]",oR="[object Uint8Array]",rR="[object Uint8ClampedArray]",sR="[object Uint16Array]",iR="[object Uint32Array]",ln={};ln[qb]=ln[Qb]=ln[eR]=ln[tR]=ln[nR]=ln[oR]=ln[rR]=ln[sR]=ln[iR]=!0;ln[Ub]=ln[Hb]=ln[Jb]=ln[Fb]=ln[Zb]=ln[Bb]=ln[zb]=ln[Gb]=ln[Wb]=ln[Kb]=ln[jb]=ln[$b]=ln[Vb]=ln[Yb]=ln[Xb]=!1;function aR(s){return Ln(s)&&Lr(s.length)&&!!ln[$n(s)]}var Xp=aR;function lR(s){return function(c){return s(c)}}var Ir=lR;var Jp=typeof Ji=="object"&&Ji&&!Ji.nodeType&&Ji,Ps=Jp&&typeof Xi=="object"&&Xi&&!Xi.nodeType&&Xi,cR=Ps&&Ps.exports===Jp,oc=cR&&Fi.process,dR=function(){try{var s=Ps&&Ps.require&&Ps.require("util").types;if(s)return s;return oc&&oc.binding&&oc.binding("util")}catch(c){}}(),po=dR;var Zp=po&&po.isTypedArray,uR=Zp?Ir(Zp):Xp,wr=uR;var pR=Object.prototype,fR=pR.hasOwnProperty;function mR(s,c){var T=Vt(s),I=!T&&Ao(s),v=!T&&!I&&uo(s),U=!T&&!I&&!v&&wr(s),oe=T||I||v||U,re=oe?Wp(s.length,String):[],le=re.length;for(var ye in s)if((c||fR.call(s,ye))&&!(oe&&(ye=="length"||v&&(ye=="offset"||ye=="parent")||U&&(ye=="buffer"||ye=="byteLength"||ye=="byteOffset")||Mo(ye,le))))re.push(ye);return re}var Zi=mR;var gR=Object.prototype;function _R(s){var c=s&&s.constructor,T=typeof c=="function"&&c.prototype||gR;return s===T}var Pr=_R;function ER(s,c){return function(T){return s(c(T))}}var qi=ER;var hR=qi(Object.keys,Object),qp=hR;var SR=Object.prototype,yR=SR.hasOwnProperty;function OR(s){if(!Pr(s))return qp(s);var c=[];for(var T in Object(s))if(yR.call(s,T)&&T!="constructor")c.push(T);return c}var Qp=OR;function AR(s){return s!=null&&Lr(s.length)&&!yr(s)}var fo=AR;function CR(s){return fo(s)?Zi(s):Qp(s)}var mo=CR;function bR(s){return ji(s,mo,Dr)}var Ns=bR;var RR=1,TR=Object.prototype,DR=TR.hasOwnProperty;function LR(s,c,T,I,v,U){var oe=T&RR,re=Ns(s),le=re.length,ye=Ns(c),Re=ye.length;if(le!=Re&&!oe)return!1;var Ie=le;while(Ie--){var Le=re[Ie];if(!(oe?Le in c:DR.call(c,Le)))return!1}var Ze=U.get(s),$e=U.get(c);if(Ze&&$e)return Ze==c&&$e==s;var dt=!0;U.set(s,c),U.set(c,s);var Me=oe;while(++Ie<le){Le=re[Ie];var nt=s[Le],rt=c[Le];if(I)var ct=oe?I(rt,nt,Le,c,s,U):I(nt,rt,Le,s,c,U);if(!(ct===void 0?nt===rt||v(nt,rt,T,I,U):ct)){dt=!1;break}Me||(Me=Le=="constructor")}if(dt&&!Me){var pt=s.constructor,bt=c.constructor;if(pt!=bt&&(("constructor"in s)&&("constructor"in c))&&!(typeof pt=="function"&&pt instanceof pt&&typeof bt=="function"&&bt instanceof bt))dt=!1}return U.delete(s),U.delete(c),dt}var ef=LR;var IR=Kn(Sn,"DataView"),Qi=IR;var wR=Kn(Sn,"Promise"),ea=wR;var PR=Kn(Sn,"Set"),Uo=PR;var NR=Kn(Sn,"WeakMap"),ta=NR;var tf="[object Map]",xR="[object Object]",nf="[object Promise]",of="[object Set]",rf="[object WeakMap]",sf="[object DataView]",kR=yo(Qi),vR=yo(ko),MR=yo(ea),UR=yo(Uo),HR=yo(ta),qo=$n;if(Qi&&qo(new Qi(new ArrayBuffer(1)))!=sf||ko&&qo(new ko)!=tf||ea&&qo(ea.resolve())!=nf||Uo&&qo(new Uo)!=of||ta&&qo(new ta)!=rf)qo=function(s){var c=$n(s),T=c==xR?s.constructor:void 0,I=T?yo(T):"";if(I)switch(I){case kR:return sf;case vR:return tf;case MR:return nf;case UR:return of;case HR:return rf}return c};var Co=qo;var FR=1,af="[object Arguments]",lf="[object Array]",na="[object Object]",BR=Object.prototype,cf=BR.hasOwnProperty;function zR(s,c,T,I,v,U){var oe=Vt(s),re=Vt(c),le=oe?lf:Co(s),ye=re?lf:Co(c);le=le==af?na:le,ye=ye==af?na:ye;var Re=le==na,Ie=ye==na,Le=le==ye;if(Le&&uo(s)){if(!uo(c))return!1;oe=!0,Re=!1}if(Le&&!Re)return U||(U=new co),oe||wr(s)?Ki(s,c,T,I,v,U):Bp(s,c,le,T,I,v,U);if(!(T&FR)){var Ze=Re&&cf.call(s,"__wrapped__"),$e=Ie&&cf.call(c,"__wrapped__");if(Ze||$e){var dt=Ze?s.value():s,Me=$e?c.value():c;return U||(U=new co),v(dt,Me,T,I,U)}}if(!Le)return!1;return U||(U=new co),ef(s,c,T,I,v,U)}var df=zR;function uf(s,c,T,I,v){if(s===c)return!0;if(s==null||c==null||!Ln(s)&&!Ln(c))return s!==s&&c!==c;return df(s,c,T,I,uf,v)}var Nr=uf;function GR(s,c){return Nr(s,c)}var Qn=GR;function WR(s,c){var T=-1,I=s==null?0:s.length,v=Array(I);while(++T<I)v[T]=c(s[T],T,s);return v}var xr=WR;var KR=1,jR=2;function $R(s,c,T,I){var v=T.length,U=v,oe=!I;if(s==null)return!U;s=Object(s);while(v--){var re=T[v];if(oe&&re[2]?re[1]!==s[re[0]]:!(re[0]in s))return!1}while(++v<U){re=T[v];var le=re[0],ye=s[le],Re=re[1];if(oe&&re[2]){if(ye===void 0&&!(le in s))return!1}else{var Ie=new co;if(I)var Le=I(ye,Re,le,s,c,Ie);if(!(Le===void 0?Nr(Re,ye,KR|jR,I,Ie):Le))return!1}}return!0}var pf=$R;function VR(s){return s===s&&!_n(s)}var oa=VR;function YR(s){var c=mo(s),T=c.length;while(T--){var I=c[T],v=s[I];c[T]=[I,v,oa(v)]}return c}var ff=YR;function XR(s,c){return function(T){if(T==null)return!1;return T[s]===c&&(c!==void 0||(s in Object(T)))}}var ra=XR;function JR(s){var c=ff(s);if(c.length==1&&c[0][2])return ra(c[0][0],c[0][1]);return function(T){return T===s||pf(T,s,c)}}var mf=JR;var ZR="[object Symbol]";function qR(s){return typeof s=="symbol"||Ln(s)&&$n(s)==ZR}var kr=qR;var QR=/\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\\]|\\.)*?\1)\]/,eT=/^\w*$/;function tT(s,c){if(Vt(s))return!1;var T=typeof s;if(T=="number"||T=="symbol"||T=="boolean"||s==null||kr(s))return!0;return eT.test(s)||!QR.test(s)||c!=null&&s in Object(c)}var vr=tT;var nT="Expected a function";function rc(s,c){if(typeof s!="function"||c!=null&&typeof c!="function")throw TypeError(nT);var T=function(){var I=arguments,v=c?c.apply(this,I):I[0],U=T.cache;if(U.has(v))return U.get(v);var oe=s.apply(this,I);return T.cache=U.set(v,oe)||U,oe};return T.cache=new(rc.Cache||Zo),T}rc.Cache=Zo;var gf=rc;var oT=500;function rT(s){var c=gf(s,function(I){if(T.size===oT)T.clear();return I}),T=c.cache;return c}var _f=rT;var sT=/[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\\]|\\.)*?)\2)\]|(?=(?:\.|\[\])(?:\.|\[\]|$))/g,iT=/\\(\\)?/g,aT=_f(function(s){var c=[];if(s.charCodeAt(0)===46)c.push("");return s.replace(sT,function(T,I,v,U){c.push(v?U.replace(iT,"$1"):I||T)}),c}),Ef=aT;var lT=1/0,hf=Nn?Nn.prototype:void 0,Sf=hf?hf.toString:void 0;function yf(s){if(typeof s=="string")return s;if(Vt(s))return xr(s,yf)+"";if(kr(s))return Sf?Sf.call(s):"";var c=s+"";return c=="0"&&1/s==-lT?"-0":c}var Of=yf;function cT(s){return s==null?"":Of(s)}var Af=cT;function dT(s,c){if(Vt(s))return s;return vr(s,c)?[s]:Ef(Af(s))}var Zn=dT;var uT=1/0;function pT(s){if(typeof s=="string"||kr(s))return s;var c=s+"";return c=="0"&&1/s==-uT?"-0":c}var Vn=pT;function fT(s,c){c=Zn(c,s);var T=0,I=c.length;while(s!=null&&T<I)s=s[Vn(c[T++])];return T&&T==I?s:void 0}var Ho=fT;function mT(s,c,T){var I=s==null?void 0:Ho(s,c);return I===void 0?T:I}var Cf=mT;function gT(s,c){return s!=null&&c in Object(s)}var bf=gT;function _T(s,c,T){c=Zn(c,s);var I=-1,v=c.length,U=!1;while(++I<v){var oe=Vn(c[I]);if(!(U=s!=null&&T(s,oe)))break;s=s[oe]}if(U||++I!=v)return U;return v=s==null?0:s.length,!!v&&Lr(v)&&Mo(oe,v)&&(Vt(s)||Ao(s))}var Rf=_T;function ET(s,c){return s!=null&&Rf(s,c,bf)}var sa=ET;var hT=1,ST=2;function yT(s,c){if(vr(s)&&oa(c))return ra(Vn(s),c);return function(T){var I=Cf(T,s);return I===void 0&&I===c?sa(T,s):Nr(c,I,hT|ST)}}var Tf=yT;function OT(s){return s}var Mr=OT;function AT(s){return function(c){return c==null?void 0:c[s]}}var Df=AT;function CT(s){return function(c){return Ho(c,s)}}var Lf=CT;function bT(s){return vr(s)?Df(Vn(s)):Lf(s)}var If=bT;function RT(s){if(typeof s=="function")return s;if(s==null)return Mr;if(typeof s=="object")return Vt(s)?Tf(s[0],s[1]):mf(s);return If(s)}var go=RT;var TT=function(){try{var s=Kn(Object,"defineProperty");return s({},"",{}),s}catch(c){}}(),Ur=TT;function DT(s,c,T){if(c=="__proto__"&&Ur)Ur(s,c,{configurable:!0,enumerable:!0,value:T,writable:!0});else s[c]=T}var Fo=DT;var LT=Object.prototype,IT=LT.hasOwnProperty;function wT(s,c,T){var I=s[c];if(!(IT.call(s,c)&&lo(I,T))||T===void 0&&!(c in s))Fo(s,c,T)}var Hr=wT;function PT(s,c,T,I){if(!_n(s))return s;c=Zn(c,s);var v=-1,U=c.length,oe=U-1,re=s;while(re!=null&&++v<U){var le=Vn(c[v]),ye=T;if(le==="__proto__"||le==="constructor"||le==="prototype")return s;if(v!=oe){var Re=re[le];if(ye=I?I(Re,le,re):void 0,ye===void 0)ye=_n(Re)?Re:Mo(c[v+1])?[]:{}}Hr(re,le,ye),re=re[le]}return s}var wf=PT;function NT(s,c,T){var I=-1,v=c.length,U={};while(++I<v){var oe=c[I],re=Ho(s,oe);if(T(re,oe))wf(U,Zn(oe,s),re)}return U}var ia=NT;var xT=qi(Object.getPrototypeOf,Object),Fr=xT;var kT=Object.getOwnPropertySymbols,vT=!kT?$i:function(s){var c=[];while(s)Tr(c,Dr(s)),s=Fr(s);return c},aa=vT;function MT(s){var c=[];if(s!=null)for(var T in Object(s))c.push(T);return c}var Pf=MT;var UT=Object.prototype,HT=UT.hasOwnProperty;function FT(s){if(!_n(s))return Pf(s);var c=Pr(s),T=[];for(var I in s)if(!(I=="constructor"&&(c||!HT.call(s,I))))T.push(I);return T}var Nf=FT;function BT(s){return fo(s)?Zi(s,!0):Nf(s)}var _o=BT;function zT(s){return ji(s,_o,aa)}var Br=zT;function GT(s,c){if(s==null)return{};var T=xr(Br(s),function(I){return[I]});return c=go(c),ia(s,T,function(I,v){return c(I,v[0])})}var zr=GT;import{lstat as iee}from"fs/promises";import{dirname as aee,join as mr}from"path";function sc(){return!1}function la(s){return!1}import{dirname as sX}from"path";import{AsyncLocalStorage as KT}from"async_hooks";var jT=new KT;function xf(){return jT.getStore()!==void 0}var Lae=new i(()=>new Set),Iae=new i(()=>({hasEntered:!1}));function Qo(s){return{parse:(c)=>s(VT(c))}}function $T(s){let c=s?.trim();return c?c:void 0}function VT(s){return s===void 0?void 0:String(s)}var YT=Qo($T),XT=Qo((s)=>s),JT=Qo((s)=>l(s)),ZT=Qo((s)=>{if(l(s))return!0;if(Y(s))return!1;return}),qT=vf();function kf(s){if(typeof s==="boolean")return s?"1":"0";return String(s)}var w={str:()=>YT,rawStr:()=>XT,bool:()=>JT,triBool:()=>ZT,int:(s)=>s?vf(s):qT,names:(s)=>Qo((c)=>{let T=new Set;for(let I of c?.split(",")??[]){let v=I.trim();if(v.length>0)T.add(v);if(T.size===s)break}return T.size>0?Object.freeze([...T]):void 0}),enum:(s)=>Qo((c)=>c!==void 0&&s.includes(c.trim())?c.trim():void 0)};function vf(s){return Qo((c)=>{if(c===void 0)return;if(s?.digitsOnly&&!/^[+-]?\d+$/.test(c.trim()))return;if(s?.wholeValue&&!/^[+-]?\d+$/.test(c.trim())&&kt(c.trim())===void 0)return;let T=we(c);if(!Number.isFinite(T))return;if(s?.min!==void 0&&T<s.min)return;if(s?.max!==void 0&&T>s.max)return;return T})}var QT=w.str(),eD=w.str(),tD=w.str(),nD=w.str(),oD=w.str(),rD=w.str(),sD=w.str(),iD=w.str(),aD=w.str(),lD=w.str(),cD=w.str(),dD=w.str(),uD=w.str(),pD=w.str(),fD=w.str(),mD=w.str(),gD=w.str(),_D=w.str(),ED=w.str(),hD=w.str(),SD=w.str(),yD=w.str(),OD=w.str(),AD=w.str(),CD=w.str(),bD=w.str(),RD=w.str(),TD=w.bool(),DD=w.bool(),LD=w.str(),ID=w.bool(),wD=w.bool(),PD=w.int({min:1}),ND=w.str(),xD=w.str(),kD=w.str(),vD=w.str(),MD=w.bool(),UD=w.bool(),HD=w.str(),FD=w.str(),BD=w.str(),zD=w.int({min:0}),GD=w.int({min:0}),WD=w.int(),KD=w.bool(),jD=w.int(),$D=w.bool(),VD=w.bool(),YD=w.bool(),XD=w.bool(),JD=w.bool(),ZD=w.bool(),qD=w.bool(),QD=w.int({min:1,max:2147483647}),eL=w.str(),tL=w.str(),nL=w.str(),oL=w.str(),rL=w.str(),sL=w.str(),iL=w.str(),aL=w.str(),lL=w.str(),cL=w.str(),dL=w.str();var uL=w.bool(),pL=w.str(),fL=w.str(),mL=w.str(),gL=w.bool(),_L=w.str(),EL=w.bool(),hL=w.bool(),SL=w.bool(),yL=w.str(),OL=w.int(),AL=w.str(),CL=w.int(),bL=w.str(),RL=w.str(),TL=w.str(),DL=w.bool(),LL=w.bool(),IL=w.bool(),wL=w.bool(),PL=w.int(),NL=w.int(),xL=w.int(),kL=w.int({min:1}),vL=w.int({min:1}),ML=w.bool(),UL=w.bool(),HL=w.str(),FL=w.str(),BL=w.str(),zL=w.str(),GL=w.str(),WL=w.str(),KL=w.str(),jL=w.str(),$L=w.str(),VL=w.str(),YL=w.str(),XL=w.str(),JL=w.str(),ZL=w.str(),qL=w.str(),QL=w.str(),eI=w.str(),tI=w.str(),nI=w.str(),oI=w.str(),rI=w.int(),sI=w.int(),iI=w.int(),aI=w.str(),lI=w.int({min:0}),cI=w.int({min:0}),dI=w.int({min:0}),uI=w.int({min:1,digitsOnly:!0}),pI=w.bool(),fI=w.triBool(),mI=w.bool(),gI=w.bool(),_I=w.bool(),EI=w.bool(),hI=w.str(),SI=w.str(),yI=w.str(),OI=w.str(),AI=w.str(),CI=w.str(),bI=w.str(),RI=w.str(),TI=w.str();import{constants as II}from"fs";import{access as lc,readdir as wI,readFile as PI,readlink as NI}from"fs/promises";import{homedir as xI}from"os";import{basename as kI,delimiter as vI,dirname as MI,join as ca,resolve as jf}from"path";function Mf(s){return!s.isDirectory()&&!s.isFile()&&!s.isSymbolicLink()&&!s.isFIFO()&&!s.isSocket()&&!s.isBlockDevice()&&!s.isCharacterDevice()}import{delimiter as Xae,isAbsolute as DI}from"path";function Uf(s){if(process.platform!=="win32")return Bun.which(s);return LI(s,H("PATH")??"")}var Hf=async(s)=>Uf(s),Ff=Uf;function LI(s,c){if(process.platform!=="win32")return Bun.which(s,{PATH:c});if(/[\\/]/.test(s))return DI(s)&&!j(s)?Bun.which(s,{PATH:c}):null;return Gt(s,c)}function xs(){return process.platform!=="linux"||m()}function Bf(){if(xs())return!1;return a().existsSync("/proc/sys/fs/binfmt_misc/WSLInterop")}function zf(){if(xs())return;try{return a().readFileSync("/sys/hypervisor/uuid",{encoding:"utf8"}).trim().toLowerCase()}catch{return}}function Gf(){if(xs())return!1;return a().existsSync("/.dockerenv")}function UI(){if(m())return{file:Wf()};let s=ca(C(),".config.json"),c=Wf();try{let T=a().statSync(s);if(T.isFile()&&(T.size>0||(T.mode&146)!==0)){let I;try{I=a().statSync(c)}catch(v){if(h(v))return{file:s,legacy:s};if(t(`Could not look at ${c}: ${n(v)}`,{level:"warn"}),T.size===0)return{file:s,legacy:s}}if(T.size===0&&I!==void 0&&HI(I))return{file:s,legacy:s};if(T.size>0){if(I!==void 0&&(!I.isFile()||I.size===0))return{file:s,legacy:s};try{if(!a().readdirSync(MI(s)).some((U)=>U.name===kI(s)))return{file:c,legacy:s}}catch(v){if(h(v))return{file:c,legacy:s}}if(I===void 0||g()!=="windows"&&I.dev===T.dev&&I.ino===T.ino)return{file:s,legacy:s};return{file:s,unused:c,legacy:s}}}}catch{}return{file:c,legacy:s}}function HI(s){let c=g();return(c==="linux"||c==="wsl")&&s.isFile()&&s.size===0&&(s.mode&146)===0&&s.nlink===1}function Wf(){let s=`.claude${Lt()}.json`;return ca(process.env.CLAUDE_CONFIG_DIR||xI(),s)}async function FI(){return null}async function Gr(s){try{return!!await Hf(s)}catch{return!1}}async function BI(){let s=[];if(await Gr("npm"))s.push("npm");if(await Gr("yarn"))s.push("yarn");if(await Gr("pnpm"))s.push("pnpm");return s}async function zI(){let s=[];if(await Gr("bun"))s.push("bun");if(await Gr("deno"))s.push("deno");if(await Gr("node"))s.push("node");return s}var Kf=["git","node","npm","npx","yarn","pnpm","bun","deno","tsc","python","python3","py","pip","uv","poetry","ruby","gem","bundle","rake","dotnet","msbuild","nuget","cl","nmake","cmake","ninja","make","gcc","g++","clang","cargo","rustc","go","java","javac","mvn","gradle","docker"],GI=1000;async function WI(s){try{return/appinstaller/i.test(await NI(s))}catch{return!1}}async function KI(s){if(s===""||j(s)||Ne(s))return!1;return!await xt(jf(s))}async function jI(s,c){let T=g()==="windows",I=new Set(s),v=T?(process.env.PATHEXT??".COM;.EXE;.BAT;.CMD").toLowerCase().split(";").filter(Boolean):[],U=u((process.env.PATH??"").split(vI).map((oe)=>oe.replace(/^"|"$/g,"")).filter(Boolean));await Promise.all(U.map(async(oe)=>{if(!await KI(oe))return;let re;try{re=await wI(oe,{withFileTypes:!0})}catch{return}let le=T&&/[\\/]microsoft[\\/]windowsapps[\\/]?$/i.test(oe);for(let ye of re){if(ye.isDirectory())continue;let Re=ye.name;if(T){let Ie=Re.toLowerCase(),Le=Ie.lastIndexOf(".");if(Le<=0||!v.includes(Ie.slice(Le)))continue;Re=Ie.slice(0,Le)}if(!I.has(Re)||c.has(Re))continue;if(T){if(le&&await WI(ca(oe,ye.name)))continue}else{let Ie=ca(oe,ye.name);if((ye.isSymbolicLink()||Mf(ye))&&await xt(jf(Ie)))continue;try{await lc(Ie,II.X_OK)}catch{continue}}c.add(Re)}}))}async function $I(){let s=new Set;try{await P(jI(Kf,s),GI,"build tool PATH scan timed out")}catch{}return Kf.filter((c)=>s.has(c))}function VI(s){try{if(!s.isWslEnvironment())return!1;let c=Ff("npm");if(c===null)return!1;return c.startsWith("/mnt/c/")}catch(c){return!1}}function YI(){return process.env.__CFBundleIdentifier==="com.conductor.app"}var $f=["pycharm","intellij","webstorm","phpstorm","rubymine","clion","goland","rider","datagrip","appcode","dataspell","aqua","gateway","fleet","jetbrains","androidstudio"];function XI(s){let c=s.toLowerCase();return c.includes("windsurf")||c.includes("devin.app")||c.includes("devin desktop")||c.includes("devin-desktop")||/appdata[\\/]local[\\/](programs[\\/])?devin[\\/]/.test(c)}function JI(){if(process.env.CURSOR_TRACE_ID)return"cursor";let s=process.env.VSCODE_GIT_ASKPASS_MAIN?.toLowerCase()??"";if(s.includes("cursor"))return"cursor";if(XI(s))return"windsurf";if(s.includes("antigravity"))return"antigravity";let c=process.env.__CFBundleIdentifier?.toLowerCase();if(c?.includes("vscodium"))return"codium";if(c?.includes("windsurf")||c?.includes("devin"))return"windsurf";if(c?.includes("com.google.android.studio"))return"androidstudio";if(c){for(let T of $f)if(c.includes(T))return T}if(process.env.VisualStudioVersion)return"visualstudio";if(process.env.TERMINAL_EMULATOR==="JetBrains-JediTerm")return"pycharm";if(process.env.TERM==="xterm-ghostty")return"ghostty";if(process.env.TERM?.includes("kitty"))return"kitty";if(process.env.TERM_PROGRAM){if(/^devin([ -]desktop)?$/i.test(process.env.TERM_PROGRAM))return"windsurf";return process.env.TERM_PROGRAM}if(process.env.TMUX)return"tmux";if(process.env.STY)return"screen";if(process.env.KONSOLE_VERSION)return"konsole";if(process.env.GNOME_TERMINAL_SERVICE)return"gnome-terminal";if(process.env.XTERM_VERSION)return"xterm";if(process.env.VTE_VERSION)return"vte-based";if(process.env.TERMINATOR_UUID)return"terminator";if(process.env.KITTY_WINDOW_ID)return"kitty";if(process.env.ALACRITTY_LOG)return"alacritty";if(process.env.TILIX_ID)return"tilix";if(process.env.WT_SESSION)return"windows-terminal";if(process.env.SESSIONNAME&&process.env.TERM==="cygwin")return"cygwin";if(process.env.MSYSTEM)return process.env.MSYSTEM.toLowerCase();if(process.env.ConEmuANSI||process.env.ConEmuPID||process.env.ConEmuTask)return"conemu";if(process.env.WSL_DISTRO_NAME)return`wsl-${process.env.WSL_DISTRO_NAME}`;if(Yf())return"ssh-session";if(process.env.TERM){let T=process.env.TERM;if(T.includes("alacritty"))return"alacritty";if(T.includes("rxvt"))return"rxvt";if(T.includes("termite"))return"termite";return process.env.TERM}if(!process.stdout.isTTY)return"non-interactive";return null}class Vf{sources;globalClaudeFile;unusedGlobalClaudeFile;probedLegacyGlobalConfigFile;packageManagers;runtimes;detectedBuildTools;wslEnvironment;npmFromWindowsPath;deploymentEnvironment;primedWslInteropExists;primedHypervisorUuid;primedDockerenvExists;fallbackWslInteropExists;fallbackHypervisorUuid;fallbackDockerenvExists;constructor(s){this.sources=s}getGlobalClaudeFile(){if(this.globalClaudeFile===void 0){let{file:s,unused:c,legacy:T}=UI();this.globalClaudeFile=s,this.unusedGlobalClaudeFile=c,this.probedLegacyGlobalConfigFile=T}return this.globalClaudeFile}getUnusedGlobalClaudeFile(){return this.getGlobalClaudeFile(),this.unusedGlobalClaudeFile}getProbedLegacyGlobalConfigFile(){return this.getGlobalClaudeFile(),this.probedLegacyGlobalConfigFile}seedGlobalClaudeFile(s){if(this.globalClaudeFile===void 0)return this.globalClaudeFile=s,"seeded";return this.globalClaudeFile===s?"unchanged":"conflict"}getPackageManagers(){return this.packageManagers??=BI()}getRuntimes(){return this.runtimes??=zI()}getDetectedBuildTools(){return this.detectedBuildTools??=$I()}isWslEnvironment(){return this.wslEnvironment??=this.primedWslInteropExists??(process.platform==="linux"?this.fallbackWslInteropExists??=this.sources.wslInteropExistsSync():!1)}isNpmFromWindowsPath(){return this.npmFromWindowsPath??=VI(this)}hypervisorUuid(){return this.primedHypervisorUuid??(this.fallbackHypervisorUuid??=this.sources.readHypervisorUuidSync()??"")}isDockerenvPresent(){return this.primedDockerenvExists??(this.fallbackDockerenvExists??=this.sources.dockerenvExistsSync())}detectDeploymentEnvironment(){return this.deploymentEnvironment??=QI(this)}async prime(){if(this.primedWslInteropExists!==void 0||xs())return;let[s,c,T]=await Promise.all([lc("/proc/sys/fs/binfmt_misc/WSLInterop").then(()=>!0,()=>!1),PI("/sys/hypervisor/uuid",{encoding:"utf8"}).then((I)=>I.trim().toLowerCase(),()=>{return}),lc("/.dockerenv").then(()=>!0,()=>!1)]);this.primedWslInteropExists=s,this.primedHypervisorUuid=c??"",this.primedDockerenvExists=T,this.wslEnvironment=void 0,this.npmFromWindowsPath=void 0,this.deploymentEnvironment=void 0}}var ZI=new i(()=>new Vf({wslInteropExistsSync:Bf,readHypervisorUuidSync:zf,dockerenvExistsSync:Gf}));function ks(){return ZI.of(b().host)}function qI(){return ks().detectDeploymentEnvironment()}function QI(s){if(l(process.env.CODESPACES))return"codespaces";if(process.env.GITPOD_WORKSPACE_ID)return"gitpod";if(l(process.env.CODER)||process.env.CODER_WORKSPACE_NAME)return"coder";if(l(process.env.DEVPOD)||process.env.DEVPOD_WORKSPACE_UID)return"devpod";if(process.env.DAYTONA_WS_ID)return"daytona";if(l(process.env.GOOGLE_CLOUD_WORKSTATIONS))return"gcp-cloud-workstations";if(process.env.C9_PID||process.env.C9_USER)return"aws-cloud9";if(process.env.REPL_ID||process.env.REPL_SLUG)return"replit";if(process.env.PROJECT_DOMAIN)return"glitch";if(l(process.env.VERCEL))return"vercel";if(process.env.RAILWAY_ENVIRONMENT_NAME||process.env.RAILWAY_SERVICE_NAME)return"railway";if(l(process.env.RENDER))return"render";if(l(process.env.NETLIFY))return"netlify";if(process.env.DYNO)return"heroku";if(process.env.FLY_APP_NAME||process.env.FLY_MACHINE_ID)return"fly.io";if(l(process.env.CF_PAGES))return"cloudflare-pages";if(process.env.DENO_DEPLOYMENT_ID)return"deno-deploy";if(process.env.AWS_LAMBDA_FUNCTION_NAME)return"aws-lambda";if(process.env.AWS_EXECUTION_ENV==="AWS_ECS_FARGATE")return"aws-fargate";if(process.env.AWS_EXECUTION_ENV==="AWS_ECS_EC2")return"aws-ecs";if(s.hypervisorUuid().startsWith("ec2"))return"aws-ec2";if(process.env.K_SERVICE)return"gcp-cloud-run";if(process.env.GOOGLE_CLOUD_PROJECT)return"gcp";if(process.env.WEBSITE_SITE_NAME||process.env.WEBSITE_SKU)return"azure-app-service";if(process.env.AZURE_FUNCTIONS_ENVIRONMENT)return"azure-functions";if(process.env.APP_URL?.includes("ondigitalocean.app"))return"digitalocean-app-platform";if(process.env.SPACE_CREATOR_USER_ID)return"huggingface-spaces";if(l(process.env.GITHUB_ACTIONS))return"github-actions";if(l(process.env.GITLAB_CI))return"gitlab-ci";if(process.env.CIRCLECI)return"circleci";if(process.env.BUILDKITE)return"buildkite";if(l(!1))return"ci";if(process.env.KUBERNETES_SERVICE_HOST)return"kubernetes";if(s.isDockerenvPresent())return"docker";if(vs.platform==="darwin")return"unknown-darwin";if(vs.platform==="linux")return"unknown-linux";if(vs.platform==="win32")return"unknown-win32";return"unknown"}function Yf(){return!!(process.env.SSH_CONNECTION||process.env.SSH_CLIENT||process.env.SSH_TTY)}function Xf(){return process.env.CLAUDE_CODE_SPAWNED_BY_SERVER!==void 0||process.env.CLAUDE_SSH_DAEMON_CHILD!==void 0||process.env.CLAUDE_SSH_RUN_DIR!==void 0}var vs={probeInternalNetworkAccess:FI,isCI:l(!1),platform:["win32","darwin"].includes(process.platform)?process.platform:"linux",arch:process.arch,nodeVersion:process.version,terminal:JI(),isSSH:Yf,getPackageManagers(){return ks().getPackageManagers()},getRuntimes(){return ks().getRuntimes()},isRunningWithBun:ee,isWslEnvironment(){return ks().isWslEnvironment()},isNpmFromWindowsPath(){return ks().isNpmFromWindowsPath()},isConductor:YI,detectDeploymentEnvironment:qI};var Wr=["5m","1h"];var ew=w.triBool(),tw=w.int({min:0}),nw=w.int({min:0}),ow=w.int({min:0}),rw=w.triBool(),sw=w.triBool(),iw=w.bool(),aw=w.bool(),lw=w.bool(),cw=w.str(),dw=w.bool(),uw=w.str(),pw=w.str(),fw=w.triBool(),mw=w.triBool(),gw=w.enum(["strict","relaxed"]),_w=w.str(),Ew=w.bool(),hw=w.str(),Sw=w.triBool(),yw=w.triBool(),Ow=w.triBool(),Aw=w.enum(["drop","block","off"]),Cw=w.str(),bw=w.triBool(),Rw=w.triBool(),Tw=w.triBool(),Dw=w.triBool(),Lw=w.triBool(),Iw=w.triBool(),ww=w.triBool(),Pw=w.triBool(),Nw=w.triBool(),xw=w.triBool(),kw=w.bool(),vw=w.bool(),Mw=w.bool(),Uw=w.bool(),Hw=w.bool(),Fw=w.bool(),Bw=w.bool(),zw=w.bool(),Gw=w.bool(),Ww=w.bool(),Kw=w.bool(),jw=w.bool(),$w=w.str(),Vw=w.int({min:1,max:10080,digitsOnly:!0}),Yw=w.bool(),Xw=w.bool(),Jw=w.bool(),Zw=w.bool(),qw=w.bool(),Qw=w.bool(),eP=w.bool(),tP=w.bool(),nP=w.bool(),oP=w.bool(),rP=w.bool(),sP=w.bool(),iP=w.bool(),aP=w.bool(),lP=w.bool(),cP=w.bool(),dP=w.bool(),uP=w.bool(),pP=w.bool(),fP=w.bool(),mP=w.bool(),gP=w.bool(),_P=w.bool(),EP=w.bool(),hP=w.bool(),SP=w.bool(),yP=w.bool(),OP=w.bool(),AP=w.bool(),CP=w.bool(),bP=w.bool(),RP=w.bool(),TP=w.bool(),DP=w.bool(),LP=w.bool(),IP=w.bool(),wP=w.triBool(),PP=w.bool(),NP=w.bool(),xP=w.bool(),kP=w.bool(),vP=w.bool(),MP=w.bool(),UP=w.bool(),HP=w.bool(),FP=w.enum(["corroborate","immediate","never","recorded"]),BP=w.triBool(),zP=w.triBool(),GP=w.bool(),WP=w.bool(),KP=w.bool(),jP=w.bool(),$P=w.bool(),VP=w.bool(),YP=w.bool(),XP=w.bool(),JP=w.bool(),ZP=w.bool(),qP=w.bool(),QP=w.bool(),eN=w.bool(),tN=w.bool(),nN=w.bool(),oN=w.triBool(),rN=w.bool(),sN=w.bool(),iN=w.bool(),aN=w.bool(),lN=w.bool(),cN=w.bool(),dN=w.bool(),uN=w.bool(),pN=w.bool(),fN=w.bool(),mN=w.triBool(),gN=w.bool(),_N=w.bool(),EN=w.bool(),hN=w.bool(),SN=w.bool(),yN=w.bool(),ON=w.triBool(),AN=w.bool(),CN=w.bool(),bN=w.bool(),RN=w.triBool(),TN=w.bool(),DN=w.bool(),LN=w.bool(),IN=w.triBool(),wN=w.bool(),PN=w.bool(),NN=w.bool(),xN=w.bool(),kN=w.triBool(),vN=w.bool(),MN=w.triBool(),UN=w.bool(),HN=w.bool(),FN=w.str(),BN=w.bool(),zN=w.int({min:1,digitsOnly:!0}),GN=w.triBool(),WN=w.bool(),KN=w.triBool(),jN=w.bool(),$N=w.bool(),VN=w.triBool(),YN=w.bool(),XN=w.bool(),JN=w.triBool(),ZN=w.bool(),qN=w.str(),QN=w.bool(),ex=w.bool(),tx=w.bool(),nx=w.enum(["baseline","off"]),ox=w.str(),rx=w.int(),sx=w.str(),ix=w.str(),ax=w.str(),lx=w.triBool(),cx=w.str(),dx=w.triBool(),ux=w.triBool(),px=w.triBool(),fx=w.bool(),mx=w.bool(),gx=w.triBool(),_x=w.triBool(),Ex=w.str(),hx=w.triBool(),Sx=w.triBool(),yx=w.int({min:1}),Ox=w.int({min:1,wholeValue:!0}),Ax=w.str(),Cx=w.triBool(),bx=w.triBool(),Rx=w.triBool(),Tx=w.triBool(),Dx=w.triBool(),Lx=w.triBool(),Ix=w.triBool(),wx=w.triBool(),Px=w.triBool(),Nx=w.triBool(),xx=w.triBool(),kx=w.triBool(),vx=w.triBool(),Mx=w.triBool(),Ux=w.triBool(),Hx=w.triBool(),Fx=w.int({min:0}),Bx=w.bool(),zx=w.bool(),Gx=w.triBool(),Wx=w.triBool(),Kx=w.triBool(),jx=w.triBool(),$x=w.triBool(),Vx=w.triBool(),Yx=w.triBool(),Xx=w.triBool(),Jx=w.triBool(),Zx=w.triBool(),qx=w.triBool(),Qx=w.triBool(),ek=w.triBool(),tk=w.triBool(),nk=w.triBool(),ok=w.triBool(),rk=w.triBool(),sk=w.triBool(),ik=w.bool(),ak=w.str(),lk=w.bool(),ck=w.bool(),dk=w.bool(),uk=w.bool(),pk=w.bool(),fk=w.str(),mk=w.bool(),gk=w.triBool(),_k=w.bool(),Ek=w.bool(),hk=w.bool(),Sk=w.bool(),yk=w.bool(),Ok=w.bool(),Ak=w.bool(),Ck=w.bool(),bk=w.bool(),Rk=w.bool(),Tk=w.bool(),Dk=w.bool(),Lk=w.bool(),Ik=w.bool(),wk=w.triBool(),Pk=w.bool(),Nk=w.bool(),xk=w.bool(),kk=w.triBool(),vk=w.bool(),Mk=w.bool(),Uk=w.bool(),Hk=w.names(8),Fk=w.bool(),Bk=w.bool(),zk=w.bool(),Gk=w.triBool(),Wk=w.bool(),Kk=w.bool(),jk=w.bool(),$k=w.bool(),Vk=w.bool(),Yk=w.bool(),Xk=w.bool(),Jk=w.triBool(),Zk=w.str(),qk=w.bool(),Qk=w.bool(),ev=w.bool(),tv=w.bool(),nv=w.triBool(),ov=w.bool(),rv=w.bool(),sv=w.triBool(),iv=w.triBool(),av=w.triBool(),lv=w.bool(),cv=w.bool(),dv=w.bool(),uv=w.str(),pv=w.str(),fv=w.bool(),mv=w.bool(),gv=w.bool(),_v=w.bool(),Ev=w.bool(),hv=w.bool(),Sv=w.bool(),yv=w.str(),Ov=w.str(),Av=w.bool(),Cv=w.bool(),bv=w.bool(),Rv=w.bool(),Tv=w.bool(),Dv=w.bool(),Lv=w.bool(),Iv=w.bool(),wv=w.bool(),Pv=w.bool(),Nv=w.triBool(),xv=w.bool(),kv=w.bool(),vv=w.bool(),Mv=w.triBool(),Uv=w.bool(),Hv=w.triBool(),Fv=w.int({min:1,digitsOnly:!0}),Bv=w.int({min:0,digitsOnly:!0}),zv=w.bool(),Gv=w.bool(),Wv=w.bool(),Kv=w.triBool(),jv=w.bool(),$v=w.bool(),Vv=w.bool(),Yv=w.bool(),Xv=w.bool(),Jv=w.bool(),Zv=w.bool(),qv=w.bool(),Qv=w.triBool(),eM=w.triBool(),tM=w.triBool(),nM=w.bool(),oM=w.bool(),rM=w.bool(),sM=w.bool(),iM=w.bool(),aM=w.bool(),lM=w.int({min:1}),cM=w.int({min:1}),dM=w.int({min:0}),uM=w.int({min:1,max:256,digitsOnly:!0}),pM=w.bool(),fM=w.bool(),mM=w.bool(),gM=w.bool(),_M=w.bool(),EM=w.bool(),hM=w.bool(),SM=w.bool(),yM=w.bool(),OM=w.bool(),AM=w.bool(),CM=w.bool(),bM=w.bool(),RM=w.bool(),TM=w.bool(),DM=w.bool(),LM=w.bool(),IM=w.bool(),wM=w.bool(),PM=w.bool(),NM=w.bool(),xM=w.bool(),kM=w.bool(),vM=w.bool(),MM=w.triBool(),UM=w.bool(),HM=w.bool(),FM=w.bool(),BM=w.triBool(),zM=w.triBool(),GM=w.bool(),WM=w.bool(),KM=w.enum(Wr),jM=w.enum(Wr),$M=w.enum(["5m"]),VM=w.bool(),YM=w.bool(),XM=w.str(),JM=w.bool(),ZM=w.bool(),qM=w.bool(),QM=w.bool(),eU=w.bool(),tU=w.bool(),nU=w.bool(),oU=w.bool(),rU=w.triBool(),sU=w.str(),iU=w.bool();var aU=w.str(),lU=w.str(),cU=w.str(),dU=w.str(),uU=w.str(),pU=w.str(),fU=w.str(),mU=w.str(),gU=w.str(),_U=w.str(),EU=w.str(),hU=w.str(),SU=w.str(),yU=w.str(),OU=w.str(),AU=w.str(),CU=w.str(),bU=w.str(),RU=w.str(),TU=w.str(),DU=w.str(),LU=w.str(),IU=w.str(),wU=w.str(),PU=w.str(),NU=w.int({min:0,digitsOnly:!0}),xU=w.int({min:0,digitsOnly:!0}),kU=w.str(),vU=w.str(),MU=w.str(),UU=w.str(),HU=w.str(),FU=w.str(),BU=w.str(),zU=w.str(),GU=w.str(),WU=w.str(),KU=w.str(),jU=w.str(),$U=w.str(),VU=w.str(),YU=w.str(),XU=w.str(),JU=w.str(),ZU=w.str(),qU=w.str(),QU=w.str(),eH=w.str(),tH=w.str(),nH=w.str(),oH=w.str(),rH=w.str(),sH=w.str(),iH=w.str(),aH=w.str(),lH=w.str(),cH=w.str(),dH=w.str(),uH=w.str(),pH=w.str(),fH=w.str(),mH=w.str(),gH=w.str(),_H=w.str(),EH=w.str(),hH=w.str(),SH=w.str(),yH=w.str(),OH=w.str(),AH=w.str(),CH=w.str(),bH=w.str(),RH=w.str(),TH=w.str(),DH=w.rawStr(),LH=w.rawStr(),IH=w.str(),wH=w.str(),PH=w.str(),NH=w.str(),xH=w.str(),kH=w.str(),vH=w.str(),MH=w.str(),UH=w.str(),HH=w.str(),FH=w.str(),BH=w.str(),zH=w.str(),GH=w.str(),WH=w.str(),KH=w.str(),jH=w.str(),$H=w.str(),VH=w.str(),YH=w.str(),XH=w.str(),JH=w.str(),ZH=w.str(),qH=w.str(),QH=w.str(),eF=w.str(),tF=w.str(),nF=w.str(),oF=w.str(),rF=w.str(),sF=w.str(),iF=w.str(),aF=w.str(),lF=w.str(),cF=w.str(),dF=w.str(),uF=w.str(),pF=w.str(),fF=w.rawStr(),mF=w.str(),gF=w.str(),_F=w.str(),EF=w.str(),hF=w.str(),SF=w.str(),yF=w.str(),OF=w.str(),AF=w.str(),CF=w.str(),bF=w.str(),RF=w.str(),TF=w.str(),DF=w.str(),LF=w.str(),IF=w.str(),wF=w.str(),PF=w.str(),NF=w.str(),xF=w.str(),kF=w.str(),vF=w.str(),MF=w.str(),UF=w.rawStr(),HF=w.str(),FF=w.str(),BF=w.str(),zF=w.str(),GF=w.str(),WF=w.str(),KF=w.str(),jF=w.str(),$F=w.str(),VF=w.str(),YF=w.str(),XF=w.str(),JF=w.str(),ZF=w.str(),qF=w.str(),QF=w.str(),eB=w.str(),tB=w.str(),nB=w.str(),oB=w.str(),rB=w.str(),sB=w.str(),iB=w.str(),aB=w.str(),lB=w.str(),cB=w.str(),dB=w.str(),uB=w.str(),pB=w.str(),fB=w.str(),mB=w.str(),gB=w.str(),_B=w.str(),EB=w.str(),hB=w.str(),SB=w.str(),yB=w.str(),OB=w.str(),AB=w.str(),CB=w.str(),bB=w.str(),RB=w.str(),TB=w.str(),DB=w.str(),LB=w.str(),IB=w.str(),wB=w.str(),PB=w.str(),NB=w.str(),xB=w.str(),kB=w.str(),vB=w.str(),MB=w.str(),UB=w.str(),HB=w.str(),FB=w.str(),BB=w.str();var zB=w.str(),GB=w.str(),WB=w.str(),KB=w.str(),jB=w.str(),$B=w.rawStr(),VB=w.str(),YB=w.str(),XB=w.str(),JB=w.str(),ZB=w.str(),qB=w.str(),QB=w.str(),e0=w.str(),t0=w.str(),n0=w.str(),o0=w.str(),r0=w.bool(),s0=w.str(),i0=w.str(),a0=w.str(),l0=w.str(),c0=w.str(),d0=w.int({min:100,max:5000}),u0=w.str(),p0=w.str(),f0=w.str(),m0=w.str(),g0=w.bool(),_0=w.str(),E0=w.str(),h0=w.str(),S0=w.str(),y0=w.str(),O0=w.str(),A0=w.str(),C0=w.str(),b0=w.str(),R0=w.str(),T0=w.str(),D0=w.str(),L0=w.str(),I0=w.str(),w0=w.str(),P0=w.str(),N0=w.bool(),x0=w.str(),k0=w.str(),v0=w.str(),M0=w.str(),U0=w.str(),H0=w.str(),F0=w.str(),B0=w.str(),z0=w.str(),G0=w.bool(),W0=w.str(),K0=w.int({min:0}),j0=w.bool(),$0=w.str(),V0=w.str(),Y0=w.str(),X0=w.str(),J0=w.enum(["1","spent"]),Z0=w.str(),q0=w.str(),Q0=w.str(),ez=w.str(),tz=w.rawStr(),nz=w.str(),oz=w.str(),rz=w.str(),sz=w.str(),iz=w.str(),az=w.rawStr(),lz=w.str(),cz=w.str(),dz=w.bool(),uz=w.bool(),pz=w.bool(),fz=w.bool(),mz=w.bool(),gz=w.bool(),_z=w.bool(),Ez=w.bool(),hz=w.bool(),Sz=w.bool(),yz=w.str(),Oz=w.str(),Az=w.str(),Cz=w.str(),bz=w.bool(),Rz=w.bool(),Tz=w.bool(),Dz=w.bool(),Lz=w.str(),Iz=w.bool(),wz=w.bool(),Pz=w.bool(),Nz=w.int({min:0,wholeValue:!0}),xz=w.str(),kz=w.str(),vz=w.str(),Mz=w.str(),Uz=w.str(),Hz=w.str(),Fz=w.bool(),Bz=w.bool(),zz=w.str(),Gz=w.int({min:0}),Wz=w.int({min:0}),Kz=w.rawStr(),jz=w.str(),$z=w.str(),Vz=w.triBool(),Yz=w.str(),Xz=w.str(),Jz=w.str(),Zz=w.str(),qz=w.str(),Qz=w.int({min:1,wholeValue:!0}),eG=w.str(),tG=w.str(),nG=w.str(),oG=w.bool(),rG=w.str(),sG=w.str(),iG=w.str(),aG=w.str(),lG=w.str(),cG=w.str(),dG=w.str(),uG=w.str(),pG=w.str(),fG=w.str(),mG=w.str(),gG=w.str(),_G=w.bool(),EG=w.bool(),hG=w.str(),SG=w.str(),yG=w.str(),OG=w.str(),AG=w.str(),CG=w.rawStr(),bG=w.str(),RG=w.str(),TG=w.str(),DG=w.str(),LG=w.str(),IG=w.str(),wG=w.str(),PG=w.str(),NG=w.str(),xG=w.str(),kG=w.str(),vG=w.str(),MG=w.str(),UG=w.str(),HG=w.enum(["1"]),FG=w.str(),BG=w.str(),zG=w.str(),GG=w.enum(["claude_ai_chat"]),WG=w.int({min:1,max:9999999999999,digitsOnly:!0}),KG=w.str(),jG=w.str(),$G=w.str(),VG=w.str(),YG=w.bool(),XG=w.int({min:1,wholeValue:!0}),JG=w.str(),ZG=w.str(),qG=w.str(),QG=w.str(),eW=w.str(),tW=w.str(),nW=w.str(),oW=w.str(),rW=w.str(),sW=w.str(),iW=w.str(),aW=w.str(),lW=w.str(),cW=w.bool(),dW=w.str(),uW=w.str(),pW=w.str(),fW=w.bool(),mW=w.names(8),gW=w.bool(),_W=w.bool(),EW=w.str(),hW=w.str(),SW=w.str(),yW=w.str(),OW=w.str(),AW=w.str(),CW=w.str(),bW=w.str(),RW=w.str(),TW=w.str(),DW=w.str(),LW=w.str(),IW=w.str(),wW=w.str(),PW=w.str(),NW=w.str(),xW=w.str(),kW=w.str(),vW=w.str(),MW=w.str(),UW=w.str(),HW=w.str(),FW=w.str(),BW=w.str(),zW=w.str(),GW=w.str(),WW=w.str(),KW=w.str(),jW=w.rawStr(),$W=w.str(),VW=w.str(),YW=w.str(),XW=w.str(),JW=w.str(),ZW=w.str(),qW=w.str(),QW=w.bool(),eK=w.bool(),tK=w.bool(),nK=w.str(),oK=w.str(),rK=w.str(),sK=w.bool(),iK=w.bool(),aK=w.bool(),lK=w.bool(),cK=w.bool(),dK=w.bool(),uK=w.bool(),pK=w.bool(),fK=w.bool(),mK=w.bool(),gK=w.bool(),_K=w.bool(),EK=w.bool(),hK=w.bool(),SK=w.rawStr(),yK=w.bool(),OK=w.bool(),AK=w.bool(),CK=w.bool(),bK=w.bool(),RK=w.bool(),TK=w.bool(),DK=w.bool(),LK=w.bool(),IK=w.bool(),wK=w.bool(),PK=w.bool(),NK=w.bool(),xK=w.bool(),kK=w.int({min:0}),vK=w.bool(),MK=w.bool(),UK=w.bool(),HK=w.bool(),FK=w.bool(),BK=w.bool(),zK=w.bool(),GK=w.triBool(),WK=w.bool(),KK=w.str(),jK=w.bool(),$K=w.bool(),VK=w.bool(),YK=w.bool(),XK=w.bool(),JK=w.bool(),ZK=w.int({min:1000,max:5000,digitsOnly:!0}),qK=w.triBool(),QK=w.bool(),ej=w.bool(),tj=w.triBool(),nj=w.bool(),oj=w.str(),rj=w.bool(),sj=w.enum(["on","verify"]),ij=w.str(),aj=w.int({min:1,max:2147483647,wholeValue:!0}),lj=w.int({min:1,max:100,digitsOnly:!0}),cj=w.rawStr(),dj=w.bool(),uj=w.bool(),pj=w.str(),fj=w.bool(),mj=w.bool(),gj=w.bool(),_j=w.bool(),Ej=w.bool(),hj=w.triBool(),Sj=w.bool(),yj=w.str(),Oj=w.str(),Aj=w.bool(),Cj=w.int({min:1,max:32,digitsOnly:!0}),bj=w.int({min:1}),Rj=w.int({min:100,max:30000}),Tj=w.int({min:0}),Dj=w.int({min:1}),Lj=w.bool(),Ij=w.triBool(),wj=w.bool(),Pj=w.bool(),Nj=w.bool(),xj=w.bool(),kj=w.bool(),vj=w.bool(),Mj=w.bool(),Uj=w.bool(),Hj=w.str(),Fj=w.bool(),Bj=w.rawStr(),zj=w.str(),Gj=w.str(),Wj=w.bool(),Kj=w.rawStr(),jj=w.str(),$j=w.str(),Vj=w.str(),Yj=w.str(),Xj=w.str(),Jj=w.str(),Zj=w.bool(),qj=w.bool(),Qj=w.bool(),e$=w.triBool(),t$=w.bool(),n$=w.bool(),o$=w.int(),r$=w.int(),s$=w.int(),i$=w.int({min:1,max:2147483647,digitsOnly:!0}),a$=w.int(),l$=w.int(),c$=w.int(),d$=w.int({min:1}),u$=w.int({min:0,max:10080,digitsOnly:!0}),p$=w.int(),f$=w.int(),m$=w.int({min:1,digitsOnly:!0}),g$=w.int({min:1,digitsOnly:!0}),_$=w.int({min:1,digitsOnly:!0}),E$=w.int({min:0,digitsOnly:!0}),h$=w.int(),S$=w.int(),y$=w.int(),O$=w.int(),A$=w.int(),C$=w.int(),b$=w.int(),R$=w.int(),T$=w.int({min:1}),D$=w.int(),L$=w.int(),I$=w.int(),w$=w.int({min:1}),P$=w.int({min:1}),N$=w.int({min:0}),x$=w.int({min:0,max:86400000}),k$=w.int(),v$=w.int(),M$=w.int({min:1000,max:60000}),U$=w.int({wholeValue:!0}),H$=w.int({min:0,digitsOnly:!0}),F$=w.int({min:0,digitsOnly:!0}),B$=w.bool(),z$=w.int(),G$=w.int({min:1}),W$=w.int({min:1}),K$=w.int({min:3}),j$=w.int({min:1,max:2147483647,digitsOnly:!0}),$$=w.str(),V$=w.bool(),Y$=w.int({min:1}),X$=w.int(),J$=w.triBool(),Z$=w.int({min:1}),q$=w.int({min:1}),Q$=w.int({min:1}),e1=w.int({min:1}),t1=w.str(),n1=w.int({min:1}),o1=w.int({min:1}),r1=w.str(),s1=w.int(),i1=w.int({min:1}),a1=w.int(),l1=w.int({min:1,wholeValue:!0}),c1=w.int(),d1=w.int({min:1}),u1=w.int({min:0}),p1=w.str(),f1=w.int({min:0,digitsOnly:!0}),m1=w.names(16),g1=w.bool(),_1=w.bool(),E1=w.bool(),h1=w.bool(),S1=w.bool(),y1=w.bool(),O1=w.bool(),A1=w.int({min:1,digitsOnly:!0}),C1=w.int({min:1});var b1=w.str(),R1=w.str(),T1=w.str(),D1=w.str(),L1=w.str(),I1=w.str(),w1=w.str(),P1=w.str(),N1=w.str(),x1=w.str(),k1=w.str(),v1=w.str(),M1=w.str(),U1=w.str(),H1=w.str(),F1=w.str(),B1=w.str(),z1=w.str(),G1=w.str(),W1=w.str(),K1=w.bool(),j1=w.str(),$1=w.str(),V1=w.str(),Y1=w.str(),X1=w.str(),J1=w.bool(),Z1=w.str(),q1=w.str(),Q1=w.str(),eV=w.str(),tV=w.bool(),nV=w.bool(),oV=w.bool(),rV=w.bool(),sV=w.str(),iV=w.bool(),aV=w.triBool(),lV=w.bool(),cV=w.bool(),dV=w.bool(),uV=w.bool(),pV=w.bool(),fV=w.str(),mV=w.str(),gV=w.str(),_V=w.bool();var EV=w.str(),hV=w.str(),SV=w.str(),yV=w.str(),OV=w.str(),AV=w.str(),CV=w.str(),bV=w.str(),RV=w.str(),TV=w.str(),DV=w.str(),LV=w.bool(),IV=w.str(),wV=w.bool(),PV=w.bool(),NV=w.str(),xV=w.str(),kV=w.str(),vV=w.str(),MV=w.str(),UV=w.int(),HV=w.int(),FV=w.int(),BV=w.int(),zV=w.int({min:1,digitsOnly:!0}),GV=w.int({min:1,digitsOnly:!0}),WV=w.int({min:1}),KV=w.str(),jV=w.int(),$V=w.int(),VV=w.int(),YV=w.int(),XV=w.int({min:0,digitsOnly:!0}),JV=w.int({min:500,max:32000,digitsOnly:!0}),ZV=w.int({min:32000,max:300000,digitsOnly:!0}),qV=w.int({min:300000,max:3600000,digitsOnly:!0}),QV=w.int(),eY=w.triBool(),tY=w.bool(),nY=w.triBool(),oY=w.triBool(),rY=w.triBool(),sY=w.triBool(),iY=w.int({min:0,max:9,digitsOnly:!0}),aY=w.int({min:0,max:2,digitsOnly:!0}),lY=w.int({min:0,max:2,digitsOnly:!0}),cY=w.int({min:0,max:1000,digitsOnly:!0}),dY=w.int({min:1,max:2000,digitsOnly:!0}),uY=w.int({min:1,max:1000,digitsOnly:!0}),pY=w.int({min:1,max:2000,digitsOnly:!0}),fY=w.rawStr(),mY=w.int({min:1,max:60000,digitsOnly:!0}),gY=w.int({min:1}),_Y=w.int({min:1}),EY=w.int({min:1}),hY=w.int({min:1}),SY=w.bool(),yY=w.int({min:1,digitsOnly:!0}),OY=w.int({min:1,digitsOnly:!0}),AY=w.int({min:60000,max:10800000,digitsOnly:!0}),CY=w.enum(["capacity"]),bY=w.bool(),RY=w.bool(),TY=w.bool(),DY=w.int(),LY=w.int({min:0});var IY=w.bool(),wY=w.bool(),PY=w.bool(),NY=w.bool(),xY=w.bool(),kY=w.bool(),vY=w.str(),MY=w.triBool(),UY=w.str(),HY=w.str(),FY=w.enum(Rn),BY=w.str(),zY=w.str(),GY=w.str(),WY=w.str(),KY=w.str(),jY=w.str(),$Y=w.str(),VY=w.str(),YY=w.str(),XY=w.str(),JY=w.str(),ZY=w.str(),qY=w.str(),QY=w.str(),e2=w.str(),t2=w.str(),n2=w.str(),o2=w.str(),r2=w.str(),s2=w.str(),i2=w.str(),a2=w.str(),l2=w.str(),c2=w.str(),d2=w.str(),u2=w.str(),p2=w.str(),f2=w.str(),m2=w.bool(),g2=w.bool(),_2=w.bool(),E2=w.bool(),h2=w.bool(),S2=w.bool(),y2=w.bool(),O2=w.str(),A2=w.str(),C2=w.int({min:1,max:2147000000,digitsOnly:!0}),b2=w.bool(),R2=w.int({min:1,max:2147483647,digitsOnly:!0}),T2=w.str(),D2=w.int(),L2=w.bool(),I2=w.bool(),w2=w.bool(),P2=w.str(),N2=w.str(),x2=w.str(),k2=w.str(),v2=w.bool(),M2=w.bool(),U2=w.int({min:1,digitsOnly:!0}),H2=w.bool(),F2=w.str(),B2=w.rawStr(),z2=w.rawStr(),G2=w.rawStr(),W2=w.bool(),K2=w.str(),j2=w.bool(),$2=w.bool(),V2=w.str(),Y2=w.bool(),X2=w.bool(),J2=w.enum(["enforce","observe","off"]),Z2=w.str(),q2=w.bool();var eX={...ic,...mc,...pc,...cc,...fc,...dc,...ac,...uc},tX=new WeakMap;function nX(s,c,T){let I=T,v;return()=>{let U=process.env[s];if(U!==I)v=c.parse(U),I=U;return v}}function da(s,c){return typeof c==="string"&&Object.hasOwn(s,c)}function gc(s,c){let T=new Proxy(Object.create(c&&Object.getPrototypeOf(c)),{get:(oe,re,le)=>{if(!da(s,re))return Reflect.get(oe,re,le);let ye=nX(re,s[re],U);if(le===U)Object.defineProperty(U,re,{get:ye,configurable:!0});return ye()},set:(oe,re,le,ye)=>!da(s,re)&&Reflect.set(oe,re,le,ye),has:(oe,re)=>da(s,re)||Reflect.has(oe,re)}),I=Object.create(T),v=c===null?{}:Object.getOwnPropertyDescriptors(c);for(let[oe,re]of Object.entries(v)){if(da(s,oe))continue;Object.defineProperty(I,oe,typeof re.value==="function"?{...re,value:{[oe](...le){return Reflect.apply(Reflect.get(c,oe),this,le)}}[oe]}:re)}let U=Object.create(I);return tX.set(U,s),Object.defineProperties(U,{set:{value:(oe,re)=>{process.env[oe]=kf(re)}},unset:{value:(oe)=>{delete process.env[oe]}}}),U}var mn=gc(eX,vs),oX={},zle=gc(oX,null),rX={},Gle=gc(rX,null);function Jf(){}class qf{pendingWrite=Promise.resolve();cleanupRegistered=!1;notStarted=[];appendOldest=this.appendOldestNotStarted.bind(this);append(s,c){let T=this.notStarted.at(-1);if(T?.logFile===s){T.lines+=c;return}if(this.notStarted.push({logFile:s,lines:c}),this.pendingWrite=this.pendingWrite.then(this.appendOldest).catch(Jf),!this.cleanupRegistered)this.cleanupRegistered=!0,ot(()=>this.flush())}async appendOldestNotStarted(){let s=this.notStarted.shift();if(s===void 0)return;let c=a();try{await c.appendFile(s.logFile,s.lines)}catch{await c.mkdir(sX(s.logFile)).catch(Jf),await c.appendFile(s.logFile,s.lines)}}flush(){return this.pendingWrite}}var iX=new i(()=>new qf);function aX(){return W(iX)}function Ms(s,c,T,I="queued"){let v=cX();if(!v)return;let U;try{U=Zf(s,c,lX(T))}catch{U=Zf(s,c,{diagnostics_payload_failed:!0})}if(I==="now")try{a().appendFileSync(v,U)}catch{}else aX().append(v,U)}function lX(s){try{return(typeof s==="function"?s():s)??{}}catch{return{diagnostics_payload_failed:!0}}}function Zf(s,c,T){let I={timestamp:new Date().toISOString(),level:s,event:c,data:T,cc_version:typeof{VERSION:"0.3.325"}<"u"?"0.3.325":"unknown"};return o(I)+`
`}function cX(){return dX()?void 0:mn.CLAUDE_CODE_DIAGNOSTICS_FILE}function dX(){return xf()?m():Rt()}import{isUtf8 as uX}from"buffer";import{closeSync as pX,fstatSync as fX,openSync as mX,readlinkSync as gX}from"fs";import{open as _X,readlink as sce}from"fs/promises";function Qf(s,c){if(!pn())return;let{resolvedPath:T,isSymlink:I}=fe(s,c);if(I)t(`Reading through symlink: ${c} -> ${T}`)}function EX(s,c,T){let I=s.statSync(c);return Hs(I,c,T),I}function Hs(s,c,T){if(s.isDirectory())throw Object.assign(Error("EISDIR: illegal operation on a directory, read"),{code:"EISDIR",errno:-21,syscall:"read",path:c});if(!s.isFile())throw _c(c);if(T!==void 0&&s.size>T)throw Object.assign(Error("File exceeds maxBytes limit"),{code:"ERR_FILE_TOO_LARGE",path:c,size:s.size,maxBytes:T})}function _c(s){return Object.assign(Error("Not a regular file (device, FIFO, or socket)"),{code:"ERR_NOT_REGULAR_FILE",path:s})}var Us=10485760;function hX(){return process.platform!=="darwin"&&process.platform!=="win32"}function SX(s,c){let{resolvedPath:T,isCanonical:I}=fe(a(),c);if(I)return T;return ce(s)?c:void 0}function yX(s,c){let v=[];try{const T=E(v,R`readUnsizedFileBytesSync(${s})`,0);if(c?.(s))throw _c(s);let I=mX(s,st());try{let le;try{le=fX(I)}catch{}if(le!==void 0)Hs(le,s,Us);if(c!==void 0&&hX()){let Re;try{Re=gX(`/proc/self/fd/${I}`)}catch(Ie){Re=SX(Ie,s)}if(c(Re))throw _c(s)}let ye=vt(I,Us+8,"stream");return Fs(ye.length,s,Us),ye}finally{try{pX(I)}catch{}}}catch(U){var oe=U,re=1}finally{y(v,oe,re)}}async function OX(s,c){let T=await at(s,Us+8,"stream");return Fs(T.length,c,Us),T}function Fs(s,c,T){if(T===void 0)return;if(s>T)throw Object.assign(Error("File exceeds maxBytes limit"),{code:"ERR_FILE_TOO_LARGE",path:c,size:s,maxBytes:T})}function em(s){return s!=null&&typeof s==="object"&&"code"in s&&s.code==="ERR_FILE_TOO_LARGE"}function Ec(s){if(s.byteLength===0)return"utf8";if(s.byteLength>=2){if(s[0]===255&&s[1]===254)return"utf16le"}if(s.byteLength>=3&&s[0]===239&&s[1]===187&&s[2]===191)return"utf8";return"utf8"}var tm=4096,AX=8000;function CX(s){return s.subarray(0,AX).includes(0)}function bX(s){let c=Ec(s.subarray(0,tm));if(c!=="utf8")return{encoding:c};if(s.byteLength>=2&&s[0]===254&&s[1]===255)return{encoding:c,notText:"utf16be"};if(CX(s))return{encoding:c,notText:"nul"};return uX(s)?{encoding:c}:{encoding:c,notText:"not_utf8"}}function RX(s){let{buffer:c,bytesRead:T}=a().readSync(s,{length:tm});return Ec(c.subarray(0,T))}function nm(s){let c=0,T=0;for(let I=0;I<s.length;I++)if(s[I]===`
`)if(I>0&&s[I-1]==="\r")c++;else T++;return c>T?"CRLF":"LF"}function TX(s,c,T){let I=a();Qf(I,s);let v=EX(I,s,c);T?.(v);let U=c===void 0&&v.size===0?yX(s):void 0,oe=U===void 0?RX(s):Ec(U),re;if(U!==void 0)re=U.toString(oe);else if(c===void 0)re=I.readFileSync(s,{encoding:oe});else{let{buffer:ye,bytesRead:Re}=I.readSync(s,{length:c+1});Fs(Re,s,c),re=ye.subarray(0,Re).toString(oe)}let le=nm(re.slice(0,4096));return{content:re.replaceAll(`\r
`,`
`),encoding:oe,lineEndings:le}}function Bo(s,c,T){return TX(s,c,T).content}async function hc(s,c,T){let U=[];try{let I=a();Qf(I,s);Hs(await I.stat(s),s,c);const v=E(U,await _X(s,st()),1);return await DX(v,s,c,T)}catch(oe){var re=oe,le=1}finally{var ye=y(U,re,le);ye&&await ye}}async function DX(s,c,T,I){let v=await s.stat();Hs(v,c,T),I?.(v);let U;if(T!==void 0)U=await at(s,T+1,"file"),Fs(U.length,c,T);else if(v.size===0)U=await OX(s,c);else U=await s.readFile();let{encoding:oe,notText:re}=bX(U),le=U.toString(oe),ye=nm(le.slice(0,4096));return{content:le.replaceAll(`\r
`,`
`),encoding:oe,lineEndings:ye,...re&&{notText:re}}}var om;(function(s){s[s.lineFeed=10]="lineFeed",s[s.carriageReturn=13]="carriageReturn",s[s.space=32]="space",s[s._0=48]="_0",s[s._1=49]="_1",s[s._2=50]="_2",s[s._3=51]="_3",s[s._4=52]="_4",s[s._5=53]="_5",s[s._6=54]="_6",s[s._7=55]="_7",s[s._8=56]="_8",s[s._9=57]="_9",s[s.a=97]="a",s[s.b=98]="b",s[s.c=99]="c",s[s.d=100]="d",s[s.e=101]="e",s[s.f=102]="f",s[s.g=103]="g",s[s.h=104]="h",s[s.i=105]="i",s[s.j=106]="j",s[s.k=107]="k",s[s.l=108]="l",s[s.m=109]="m",s[s.n=110]="n",s[s.o=111]="o",s[s.p=112]="p",s[s.q=113]="q",s[s.r=114]="r",s[s.s=115]="s",s[s.t=116]="t",s[s.u=117]="u",s[s.v=118]="v",s[s.w=119]="w",s[s.x=120]="x",s[s.y=121]="y",s[s.z=122]="z",s[s.A=65]="A",s[s.B=66]="B",s[s.C=67]="C",s[s.D=68]="D",s[s.E=69]="E",s[s.F=70]="F",s[s.G=71]="G",s[s.H=72]="H",s[s.I=73]="I",s[s.J=74]="J",s[s.K=75]="K",s[s.L=76]="L",s[s.M=77]="M",s[s.N=78]="N",s[s.O=79]="O",s[s.P=80]="P",s[s.Q=81]="Q",s[s.R=82]="R",s[s.S=83]="S",s[s.T=84]="T",s[s.U=85]="U",s[s.V=86]="V",s[s.W=87]="W",s[s.X=88]="X",s[s.Y=89]="Y",s[s.Z=90]="Z",s[s.asterisk=42]="asterisk",s[s.backslash=92]="backslash",s[s.closeBrace=125]="closeBrace",s[s.closeBracket=93]="closeBracket",s[s.colon=58]="colon",s[s.comma=44]="comma",s[s.dot=46]="dot",s[s.doubleQuote=34]="doubleQuote",s[s.minus=45]="minus",s[s.openBrace=123]="openBrace",s[s.openBracket=91]="openBracket",s[s.plus=43]="plus",s[s.slash=47]="slash",s[s.formFeed=12]="formFeed",s[s.tab=9]="tab"})(om||(om={}));var IX=Array(20).fill(0).map((s,c)=>" ".repeat(c));var wX={" ":{"\n":Array(200).fill(0).map((s,c)=>`
`+" ".repeat(c)),"\r":Array(200).fill(0).map((s,c)=>"\r"+" ".repeat(c)),"\r\n":Array(200).fill(0).map((s,c)=>`\r
`+" ".repeat(c))},"\t":{"\n":Array(200).fill(0).map((s,c)=>`
`+"\t".repeat(c)),"\r":Array(200).fill(0).map((s,c)=>"\r"+"\t".repeat(c)),"\r\n":Array(200).fill(0).map((s,c)=>`\r
`+"\t".repeat(c))}};var sm;(function(s){s.DEFAULT={allowTrailingComma:!1}})(sm||(sm={}));var im;(function(s){s[s.None=0]="None",s[s.UnexpectedEndOfComment=1]="UnexpectedEndOfComment",s[s.UnexpectedEndOfString=2]="UnexpectedEndOfString",s[s.UnexpectedEndOfNumber=3]="UnexpectedEndOfNumber",s[s.InvalidUnicode=4]="InvalidUnicode",s[s.InvalidEscapeCharacter=5]="InvalidEscapeCharacter",s[s.InvalidCharacter=6]="InvalidCharacter"})(im||(im={}));var am;(function(s){s[s.OpenBraceToken=1]="OpenBraceToken",s[s.CloseBraceToken=2]="CloseBraceToken",s[s.OpenBracketToken=3]="OpenBracketToken",s[s.CloseBracketToken=4]="CloseBracketToken",s[s.CommaToken=5]="CommaToken",s[s.ColonToken=6]="ColonToken",s[s.NullKeyword=7]="NullKeyword",s[s.TrueKeyword=8]="TrueKeyword",s[s.FalseKeyword=9]="FalseKeyword",s[s.StringLiteral=10]="StringLiteral",s[s.NumericLiteral=11]="NumericLiteral",s[s.LineCommentTrivia=12]="LineCommentTrivia",s[s.BlockCommentTrivia=13]="BlockCommentTrivia",s[s.LineBreakTrivia=14]="LineBreakTrivia",s[s.Trivia=15]="Trivia",s[s.Unknown=16]="Unknown",s[s.EOF=17]="EOF"})(am||(am={}));var lm;(function(s){s[s.InvalidSymbol=1]="InvalidSymbol",s[s.InvalidNumberFormat=2]="InvalidNumberFormat",s[s.PropertyNameExpected=3]="PropertyNameExpected",s[s.ValueExpected=4]="ValueExpected",s[s.ColonExpected=5]="ColonExpected",s[s.CommaExpected=6]="CommaExpected",s[s.CloseBraceExpected=7]="CloseBraceExpected",s[s.CloseBracketExpected=8]="CloseBracketExpected",s[s.EndOfFileExpected=9]="EndOfFileExpected",s[s.InvalidCommentToken=10]="InvalidCommentToken",s[s.UnexpectedEndOfComment=11]="UnexpectedEndOfComment",s[s.UnexpectedEndOfString=12]="UnexpectedEndOfString",s[s.UnexpectedEndOfNumber=13]="UnexpectedEndOfNumber",s[s.InvalidUnicode=14]="InvalidUnicode",s[s.InvalidEscapeCharacter=15]="InvalidEscapeCharacter",s[s.InvalidCharacter=16]="InvalidCharacter"})(lm||(lm={}));var Kr=typeof performance==="object"&&performance&&typeof performance.now==="function"?performance:Date,dm=new Set,Sc=typeof process==="object"&&!!process?process:{},um=(s,c,T,I)=>{typeof Sc.emitWarning==="function"?Sc.emitWarning(s,c,T,I):console.error(`[${T}] ${c}: ${s}`)},{AbortController:ua,AbortSignal:cm}=globalThis;if(typeof ua>"u"){cm=class{onabort;_onabort=[];reason;aborted=!1;addEventListener(I,v){this._onabort.push(v)}},ua=class{constructor(){c()}signal=new cm;abort(I){if(this.signal.aborted)return;this.signal.reason=I,this.signal.aborted=!0;for(let v of this.signal._onabort)v(I);this.signal.onabort?.(I)}};let s=Sc.env?.LRU_CACHE_IGNORE_AC_WARNING!=="1",c=()=>{if(!s)return;s=!1,um("AbortController is not defined. If using lru-cache in node 14, load an AbortController polyfill from the `node-abort-controller` package. A minimal polyfill is provided for use by LRUCache.fetch(), but it should not be relied upon in other contexts (eg, passing it to other APIs that use AbortController/AbortSignal might have undesirable effects). You may disable this with LRU_CACHE_IGNORE_AC_WARNING=1 in the env.","NO_ABORT_CONTROLLER","ENOTSUP",c)}}var UX=(s)=>!dm.has(s),wce=Symbol("type"),zo=(s)=>s&&s===Math.floor(s)&&s>0&&isFinite(s),pm=(s)=>!zo(s)?null:s<=Math.pow(2,8)?Uint8Array:s<=Math.pow(2,16)?Uint16Array:s<=Math.pow(2,32)?Uint32Array:s<=Number.MAX_SAFE_INTEGER?Bs:null;class Bs extends Array{constructor(s){super(s);this.fill(0)}}class jr{heap;length;static#a=!1;static create(s){let c=pm(s);if(!c)return[];jr.#a=!0;let T=new jr(s,c);return jr.#a=!1,T}constructor(s,c){if(!jr.#a)throw TypeError("instantiate Stack using Stack.create(n)");this.heap=new c(s),this.length=0}push(s){this.heap[this.length++]=s}pop(){return this.heap[--this.length]}}class pa{#a;#u;#g;#_;#w;#P;ttl;ttlResolution;ttlAutopurge;updateAgeOnGet;updateAgeOnHas;allowStale;noDisposeOnSet;noUpdateTTL;maxEntrySize;sizeCalculation;noDeleteOnFetchRejection;noDeleteOnStaleGet;allowStaleOnFetchAbort;allowStaleOnFetchRejection;ignoreFetchAbort;#r;#E;#o;#n;#e;#c;#p;#l;#s;#h;#i;#S;#y;#f;#O;#T;#d;static unsafeExposeInternals(s){return{starts:s.#y,ttls:s.#f,sizes:s.#S,keyMap:s.#o,keyList:s.#n,valList:s.#e,next:s.#c,prev:s.#p,get head(){return s.#l},get tail(){return s.#s},free:s.#h,isBackgroundFetch:(c)=>s.#t(c),backgroundFetch:(c,T,I,v)=>s.#k(c,T,I,v),moveToTail:(c)=>s.#I(c),indexes:(c)=>s.#A(c),rindexes:(c)=>s.#C(c),isStale:(c)=>s.#m(c)}}get max(){return this.#a}get maxSize(){return this.#u}get calculatedSize(){return this.#E}get size(){return this.#r}get fetchMethod(){return this.#w}get memoMethod(){return this.#P}get dispose(){return this.#g}get disposeAfter(){return this.#_}constructor(s){let{max:c=0,ttl:T,ttlResolution:I=1,ttlAutopurge:v,updateAgeOnGet:U,updateAgeOnHas:oe,allowStale:re,dispose:le,disposeAfter:ye,noDisposeOnSet:Re,noUpdateTTL:Ie,maxSize:Le=0,maxEntrySize:Ze=0,sizeCalculation:$e,fetchMethod:dt,memoMethod:Me,noDeleteOnFetchRejection:nt,noDeleteOnStaleGet:rt,allowStaleOnFetchRejection:ct,allowStaleOnFetchAbort:pt,ignoreFetchAbort:bt}=s;if(c!==0&&!zo(c))throw TypeError("max option must be a nonnegative integer");let Nt=c?pm(c):Array;if(!Nt)throw Error("invalid max value: "+c);if(this.#a=c,this.#u=Le,this.maxEntrySize=Ze||this.#u,this.sizeCalculation=$e,this.sizeCalculation){if(!this.#u&&!this.maxEntrySize)throw TypeError("cannot set sizeCalculation without setting maxSize or maxEntrySize");if(typeof this.sizeCalculation!=="function")throw TypeError("sizeCalculation set to non-function")}if(Me!==void 0&&typeof Me!=="function")throw TypeError("memoMethod must be a function if defined");if(this.#P=Me,dt!==void 0&&typeof dt!=="function")throw TypeError("fetchMethod must be a function if specified");if(this.#w=dt,this.#T=!!dt,this.#o=new Map,this.#n=Array(c).fill(void 0),this.#e=Array(c).fill(void 0),this.#c=new Nt(c),this.#p=new Nt(c),this.#l=0,this.#s=0,this.#h=jr.create(c),this.#r=0,this.#E=0,typeof le==="function")this.#g=le;if(typeof ye==="function")this.#_=ye,this.#i=[];else this.#_=void 0,this.#i=void 0;if(this.#O=!!this.#g,this.#d=!!this.#_,this.noDisposeOnSet=!!Re,this.noUpdateTTL=!!Ie,this.noDeleteOnFetchRejection=!!nt,this.allowStaleOnFetchRejection=!!ct,this.allowStaleOnFetchAbort=!!pt,this.ignoreFetchAbort=!!bt,this.maxEntrySize!==0){if(this.#u!==0){if(!zo(this.#u))throw TypeError("maxSize must be a positive integer if specified")}if(!zo(this.maxEntrySize))throw TypeError("maxEntrySize must be a positive integer if specified");this.#z()}if(this.allowStale=!!re,this.noDeleteOnStaleGet=!!rt,this.updateAgeOnGet=!!U,this.updateAgeOnHas=!!oe,this.ttlResolution=zo(I)||I===0?I:1,this.ttlAutopurge=!!v,this.ttl=T||0,this.ttl){if(!zo(this.ttl))throw TypeError("ttl must be a positive integer if specified");this.#v()}if(this.#a===0&&this.ttl===0&&this.#u===0)throw TypeError("At least one of max, maxSize, or ttl is required");if(!this.ttlAutopurge&&!this.#a&&!this.#u){if(UX("LRU_CACHE_UNBOUNDED"))dm.add("LRU_CACHE_UNBOUNDED"),um("TTL caching without ttlAutopurge, max, or maxSize can result in unbounded memory consumption.","UnboundedCacheWarning","LRU_CACHE_UNBOUNDED",pa)}}getRemainingTTL(s){return this.#o.has(s)?1/0:0}#v(){let s=new Bs(this.#a),c=new Bs(this.#a);this.#f=s,this.#y=c,this.#M=(v,U,oe=Kr.now())=>{if(c[v]=U!==0?oe:0,s[v]=U,U!==0&&this.ttlAutopurge){let re=setTimeout(()=>{if(this.#m(v))this.#b(this.#n[v],"expire")},U+1);if(re.unref)re.unref()}},this.#D=(v)=>{c[v]=s[v]!==0?Kr.now():0},this.#R=(v,U)=>{if(s[U]){let oe=s[U],re=c[U];if(!oe||!re)return;v.ttl=oe,v.start=re,v.now=T||I();let le=v.now-re;v.remainingTTL=oe-le}};let T=0,I=()=>{let v=Kr.now();if(this.ttlResolution>0){T=v;let U=setTimeout(()=>T=0,this.ttlResolution);if(U.unref)U.unref()}return v};this.getRemainingTTL=(v)=>{let U=this.#o.get(v);if(U===void 0)return 0;let oe=s[U],re=c[U];if(!oe||!re)return 1/0;let le=(T||I())-re;return oe-le},this.#m=(v)=>{let U=c[v],oe=s[v];return!!oe&&!!U&&(T||I())-U>oe}}#D=()=>{};#R=()=>{};#M=()=>{};#m=()=>!1;#z(){let s=new Bs(this.#a);this.#E=0,this.#S=s,this.#L=(c)=>{this.#E-=s[c],s[c]=0},this.#U=(c,T,I,v)=>{if(this.#t(T))return 0;if(!zo(I))if(v){if(typeof v!=="function")throw TypeError("sizeCalculation must be a function");if(I=v(T,c),!zo(I))throw TypeError("sizeCalculation return invalid (expect positive integer)")}else throw TypeError("invalid size value (must be positive integer). When maxSize or maxEntrySize is used, sizeCalculation or size must be set.");return I},this.#N=(c,T,I)=>{if(s[c]=T,this.#u){let v=this.#u-s[c];while(this.#E>v)this.#x(!0)}if(this.#E+=s[c],I)I.entrySize=T,I.totalCalculatedSize=this.#E}}#L=(s)=>{};#N=(s,c,T)=>{};#U=(s,c,T,I)=>{if(T||I)throw TypeError("cannot set size without setting maxSize or maxEntrySize on cache");return 0};*#A({allowStale:s=this.allowStale}={}){if(this.#r)for(let c=this.#s;;){if(!this.#H(c))break;if(s||!this.#m(c))yield c;if(c===this.#l)break;else c=this.#p[c]}}*#C({allowStale:s=this.allowStale}={}){if(this.#r)for(let c=this.#l;;){if(!this.#H(c))break;if(s||!this.#m(c))yield c;if(c===this.#s)break;else c=this.#c[c]}}#H(s){return s!==void 0&&this.#o.get(this.#n[s])===s}*entries(){for(let s of this.#A())if(this.#e[s]!==void 0&&this.#n[s]!==void 0&&!this.#t(this.#e[s]))yield[this.#n[s],this.#e[s]]}*rentries(){for(let s of this.#C())if(this.#e[s]!==void 0&&this.#n[s]!==void 0&&!this.#t(this.#e[s]))yield[this.#n[s],this.#e[s]]}*keys(){for(let s of this.#A()){let c=this.#n[s];if(c!==void 0&&!this.#t(this.#e[s]))yield c}}*rkeys(){for(let s of this.#C()){let c=this.#n[s];if(c!==void 0&&!this.#t(this.#e[s]))yield c}}*values(){for(let s of this.#A())if(this.#e[s]!==void 0&&!this.#t(this.#e[s]))yield this.#e[s]}*rvalues(){for(let s of this.#C())if(this.#e[s]!==void 0&&!this.#t(this.#e[s]))yield this.#e[s]}[Symbol.iterator](){return this.entries()}[Symbol.toStringTag]="LRUCache";find(s,c={}){for(let T of this.#A()){let I=this.#e[T],v=this.#t(I)?I.__staleWhileFetching:I;if(v===void 0)continue;if(s(v,this.#n[T],this))return this.get(this.#n[T],c)}}forEach(s,c=this){for(let T of this.#A()){let I=this.#e[T],v=this.#t(I)?I.__staleWhileFetching:I;if(v===void 0)continue;s.call(c,v,this.#n[T],this)}}rforEach(s,c=this){for(let T of this.#C()){let I=this.#e[T],v=this.#t(I)?I.__staleWhileFetching:I;if(v===void 0)continue;s.call(c,v,this.#n[T],this)}}purgeStale(){let s=!1;for(let c of this.#C({allowStale:!0}))if(this.#m(c))this.#b(this.#n[c],"expire"),s=!0;return s}info(s){let c=this.#o.get(s);if(c===void 0)return;let T=this.#e[c],I=this.#t(T)?T.__staleWhileFetching:T;if(I===void 0)return;let v={value:I};if(this.#f&&this.#y){let U=this.#f[c],oe=this.#y[c];if(U&&oe){let re=U-(Kr.now()-oe);v.ttl=re,v.start=Date.now()}}if(this.#S)v.size=this.#S[c];return v}dump(){let s=[];for(let c of this.#A({allowStale:!0})){let T=this.#n[c],I=this.#e[c],v=this.#t(I)?I.__staleWhileFetching:I;if(v===void 0||T===void 0)continue;let U={value:v};if(this.#f&&this.#y){U.ttl=this.#f[c];let oe=Kr.now()-this.#y[c];U.start=Math.floor(Date.now()-oe)}if(this.#S)U.size=this.#S[c];s.unshift([T,U])}return s}load(s){this.clear();for(let[c,T]of s){if(T.start){let I=Date.now()-T.start;T.start=Kr.now()-I}this.set(c,T.value,T)}}set(s,c,T={}){if(c===void 0)return this.delete(s),this;let{ttl:I=this.ttl,start:v,noDisposeOnSet:U=this.noDisposeOnSet,sizeCalculation:oe=this.sizeCalculation,status:re}=T,{noUpdateTTL:le=this.noUpdateTTL}=T,ye=this.#U(s,c,T.size||0,oe);if(this.maxEntrySize&&ye>this.maxEntrySize){if(re)re.set="miss",re.maxEntrySizeExceeded=!0;return this.#b(s,"set"),this}let Re=this.#r===0?void 0:this.#o.get(s);if(Re===void 0){if(Re=this.#r===0?this.#s:this.#h.length!==0?this.#h.pop():this.#r===this.#a?this.#x(!1):this.#r,this.#n[Re]=s,this.#e[Re]=c,this.#o.set(s,Re),this.#c[this.#s]=Re,this.#p[Re]=this.#s,this.#s=Re,this.#r++,this.#N(Re,ye,re),re)re.set="add";le=!1}else{this.#I(Re);let Ie=this.#e[Re];if(c!==Ie){if(this.#T&&this.#t(Ie)){Ie.__abortController.abort(Error("replaced"));let{__staleWhileFetching:Le}=Ie;if(Le!==void 0&&!U){if(this.#O)this.#g?.(Le,s,"set");if(this.#d)this.#i?.push([Le,s,"set"])}}else if(!U){if(this.#O)this.#g?.(Ie,s,"set");if(this.#d)this.#i?.push([Ie,s,"set"])}if(this.#L(Re),this.#N(Re,ye,re),this.#e[Re]=c,re){re.set="replace";let Le=Ie&&this.#t(Ie)?Ie.__staleWhileFetching:Ie;if(Le!==void 0)re.oldValue=Le}}else if(re)re.set="update"}if(I!==0&&!this.#f)this.#v();if(this.#f){if(!le)this.#M(Re,I,v);if(re)this.#R(re,Re)}if(!U&&this.#d&&this.#i){let Ie=this.#i,Le;while(Le=Ie?.shift())this.#_?.(...Le)}return this}pop(){try{while(this.#r){let s=this.#e[this.#l];if(this.#x(!0),this.#t(s)){if(s.__staleWhileFetching)return s.__staleWhileFetching}else if(s!==void 0)return s}}finally{if(this.#d&&this.#i){let s=this.#i,c;while(c=s?.shift())this.#_?.(...c)}}}#x(s){let c=this.#l,T=this.#n[c],I=this.#e[c];if(this.#T&&this.#t(I))I.__abortController.abort(Error("evicted"));else if(this.#O||this.#d){if(this.#O)this.#g?.(I,T,"evict");if(this.#d)this.#i?.push([I,T,"evict"])}if(this.#L(c),s)this.#n[c]=void 0,this.#e[c]=void 0,this.#h.push(c);if(this.#r===1)this.#l=this.#s=0,this.#h.length=0;else this.#l=this.#c[c];return this.#o.delete(T),this.#r--,c}has(s,c={}){let{updateAgeOnHas:T=this.updateAgeOnHas,status:I}=c,v=this.#o.get(s);if(v!==void 0){let U=this.#e[v];if(this.#t(U)&&U.__staleWhileFetching===void 0)return!1;if(!this.#m(v)){if(T)this.#D(v);if(I)I.has="hit",this.#R(I,v);return!0}else if(I)I.has="stale",this.#R(I,v)}else if(I)I.has="miss";return!1}peek(s,c={}){let{allowStale:T=this.allowStale}=c,I=this.#o.get(s);if(I===void 0||!T&&this.#m(I))return;let v=this.#e[I];return this.#t(v)?v.__staleWhileFetching:v}#k(s,c,T,I){let v=c===void 0?void 0:this.#e[c];if(this.#t(v))return v;let U=new ua,{signal:oe}=T;oe?.addEventListener("abort",()=>U.abort(oe.reason),{signal:U.signal});let re={signal:U.signal,options:T,context:I},le=($e,dt=!1)=>{let{aborted:Me}=U.signal,nt=T.ignoreFetchAbort&&$e!==void 0;if(T.status)if(Me&&!dt){if(T.status.fetchAborted=!0,T.status.fetchError=U.signal.reason,nt)T.status.fetchAbortIgnored=!0}else T.status.fetchResolved=!0;if(Me&&!nt&&!dt)return Re(U.signal.reason);let rt=Le;if(this.#e[c]===Le)if($e===void 0)if(rt.__staleWhileFetching)this.#e[c]=rt.__staleWhileFetching;else this.#b(s,"fetch");else{if(T.status)T.status.fetchUpdated=!0;this.set(s,$e,re.options)}return $e},ye=($e)=>{if(T.status)T.status.fetchRejected=!0,T.status.fetchError=$e;return Re($e)},Re=($e)=>{let{aborted:dt}=U.signal,Me=dt&&T.allowStaleOnFetchAbort,nt=Me||T.allowStaleOnFetchRejection,rt=nt||T.noDeleteOnFetchRejection,ct=Le;if(this.#e[c]===Le){if(!rt||ct.__staleWhileFetching===void 0)this.#b(s,"fetch");else if(!Me)this.#e[c]=ct.__staleWhileFetching}if(nt){if(T.status&&ct.__staleWhileFetching!==void 0)T.status.returnedStale=!0;return ct.__staleWhileFetching}else if(ct.__returned===ct)throw $e},Ie=($e,dt)=>{let Me=this.#w?.(s,v,re);if(Me&&Me instanceof Promise)Me.then((nt)=>$e(nt===void 0?void 0:nt),dt);U.signal.addEventListener("abort",()=>{if(!T.ignoreFetchAbort||T.allowStaleOnFetchAbort){if($e(void 0),T.allowStaleOnFetchAbort)$e=(nt)=>le(nt,!0)}})};if(T.status)T.status.fetchDispatched=!0;let Le=new Promise(Ie).then(le,ye),Ze=Object.assign(Le,{__abortController:U,__staleWhileFetching:v,__returned:void 0});if(c===void 0)this.set(s,Ze,{...re.options,status:void 0}),c=this.#o.get(s);else this.#e[c]=Ze;return Ze}#t(s){if(!this.#T)return!1;let c=s;return!!c&&c instanceof Promise&&c.hasOwnProperty("__staleWhileFetching")&&c.__abortController instanceof ua}async fetch(s,c={}){let{allowStale:T=this.allowStale,updateAgeOnGet:I=this.updateAgeOnGet,noDeleteOnStaleGet:v=this.noDeleteOnStaleGet,ttl:U=this.ttl,noDisposeOnSet:oe=this.noDisposeOnSet,size:re=0,sizeCalculation:le=this.sizeCalculation,noUpdateTTL:ye=this.noUpdateTTL,noDeleteOnFetchRejection:Re=this.noDeleteOnFetchRejection,allowStaleOnFetchRejection:Ie=this.allowStaleOnFetchRejection,ignoreFetchAbort:Le=this.ignoreFetchAbort,allowStaleOnFetchAbort:Ze=this.allowStaleOnFetchAbort,context:$e,forceRefresh:dt=!1,status:Me,signal:nt}=c;if(!this.#T){if(Me)Me.fetch="get";return this.get(s,{allowStale:T,updateAgeOnGet:I,noDeleteOnStaleGet:v,status:Me})}let rt={allowStale:T,updateAgeOnGet:I,noDeleteOnStaleGet:v,ttl:U,noDisposeOnSet:oe,size:re,sizeCalculation:le,noUpdateTTL:ye,noDeleteOnFetchRejection:Re,allowStaleOnFetchRejection:Ie,allowStaleOnFetchAbort:Ze,ignoreFetchAbort:Le,status:Me,signal:nt},ct=this.#o.get(s);if(ct===void 0){if(Me)Me.fetch="miss";let pt=this.#k(s,ct,rt,$e);return pt.__returned=pt}else{let pt=this.#e[ct];if(this.#t(pt)){let jt=T&&pt.__staleWhileFetching!==void 0;if(Me){if(Me.fetch="inflight",jt)Me.returnedStale=!0}return jt?pt.__staleWhileFetching:pt.__returned=pt}let bt=this.#m(ct);if(!dt&&!bt){if(Me)Me.fetch="hit";if(this.#I(ct),I)this.#D(ct);if(Me)this.#R(Me,ct);return pt}let Nt=this.#k(s,ct,rt,$e),Ut=Nt.__staleWhileFetching!==void 0&&T;if(Me){if(Me.fetch=bt?"stale":"refresh",Ut&&bt)Me.returnedStale=!0}return Ut?Nt.__staleWhileFetching:Nt.__returned=Nt}}async forceFetch(s,c={}){let T=await this.fetch(s,c);if(T===void 0)throw Error("fetch() returned undefined");return T}memo(s,c={}){let T=this.#P;if(!T)throw Error("no memoMethod provided to constructor");let{context:I,forceRefresh:v,...U}=c,oe=this.get(s,U);if(!v&&oe!==void 0)return oe;let re=T(s,oe,{options:U,context:I});return this.set(s,re,U),re}get(s,c={}){let{allowStale:T=this.allowStale,updateAgeOnGet:I=this.updateAgeOnGet,noDeleteOnStaleGet:v=this.noDeleteOnStaleGet,status:U}=c,oe=this.#o.get(s);if(oe!==void 0){let re=this.#e[oe],le=this.#t(re);if(U)this.#R(U,oe);if(this.#m(oe)){if(U)U.get="stale";if(!le){if(!v)this.#b(s,"expire");if(U&&T)U.returnedStale=!0;return T?re:void 0}else{if(U&&T&&re.__staleWhileFetching!==void 0)U.returnedStale=!0;return T?re.__staleWhileFetching:void 0}}else{if(U)U.get="hit";if(le)return re.__staleWhileFetching;if(this.#I(oe),I)this.#D(oe);return re}}else if(U)U.get="miss"}#F(s,c){this.#p[c]=s,this.#c[s]=c}#I(s){if(s!==this.#s){if(s===this.#l)this.#l=this.#c[s];else this.#F(this.#p[s],this.#c[s]);this.#F(this.#s,s),this.#s=s}}delete(s){return this.#b(s,"delete")}#b(s,c){let T=!1;if(this.#r!==0){let I=this.#o.get(s);if(I!==void 0)if(T=!0,this.#r===1)this.#B(c);else{this.#L(I);let v=this.#e[I];if(this.#t(v))v.__abortController.abort(Error("deleted"));else if(this.#O||this.#d){if(this.#O)this.#g?.(v,s,c);if(this.#d)this.#i?.push([v,s,c])}if(this.#o.delete(s),this.#n[I]=void 0,this.#e[I]=void 0,I===this.#s)this.#s=this.#p[I];else if(I===this.#l)this.#l=this.#c[I];else{let U=this.#p[I];this.#c[U]=this.#c[I];let oe=this.#c[I];this.#p[oe]=this.#p[I]}this.#r--,this.#h.push(I)}}if(this.#d&&this.#i?.length){let I=this.#i,v;while(v=I?.shift())this.#_?.(...v)}return T}clear(){return this.#B("delete")}#B(s){for(let c of this.#C({allowStale:!0})){let T=this.#e[c];if(this.#t(T))T.__abortController.abort(Error("deleted"));else{let I=this.#n[c];if(this.#O)this.#g?.(T,I,s);if(this.#d)this.#i?.push([T,I,s])}}if(this.#o.clear(),this.#e.fill(void 0),this.#n.fill(void 0),this.#f&&this.#y)this.#f.fill(0),this.#y.fill(0);if(this.#S)this.#S.fill(0);if(this.#l=0,this.#s=0,this.#h.length=0,this.#E=0,this.#r=0,this.#d&&this.#i){let c=this.#i,T;while(T=c?.shift())this.#_?.(...T)}}}function fa(s,c,T=100){let I=new pa({max:T}),v=(...U)=>{let oe=c(...U),re=I.get(oe);if(re!==void 0)return re;let le=s(...U);return I.set(oe,le),le};return v.cache={clear:()=>I.clear(),size:()=>I.size,delete:(U)=>I.delete(U),get:(U)=>I.peek(U),has:(U)=>I.has(U),set:(U,oe)=>void I.set(U,oe)},v}var HX=8192;function mm(s,c){try{return{ok:!0,value:JSON.parse(Ee(s))}}catch(T){if(c)me($t(T,`safeParseJSON: invalid JSON (${T instanceof Error?T.constructor.name:typeof T}, ${s.length} bytes)`));return{ok:!1}}}class gm{cached=fa(mm,(s)=>s,50);cache=this.cached.cache;parse(s,c){return this.cached(s,c)}}var fm=new gm;var er=Object.assign(function(c,T=!0){if(!c)return null;let I=c.length>HX?mm(c,T):fm.parse(c,T);return I.ok?I.value:null},{cache:fm.cache});import{accessSync as ym,constants as bc,lstatSync as _m,readlinkSync as FX,realpath as BX,realpathSync as zX}from"fs";import{access as GX}from"fs/promises";import{basename as qce,dirname as WX,join as Ac,parse as KX,resolve as Cc,sep as Em}from"path";import{promisify as jX}from"util";function Om(s,c,T,I,v){let U=a(),oe=bm(s,c,T,I),re=oe.next();while(!re.done){let le;try{le=$X(U,re.value,v)}catch(ye){re=oe.throw(ye);continue}re=oe.next(le)}return re.value}async function Am(s,c,T,I){let v=a(),U=bm(s,c,T,I),oe=U.next();while(!oe.done){let re;try{re=await VX(v,oe.value)}catch(le){oe=U.throw(le);continue}oe=U.next(re)}return oe.value}var Cm={unreadableAncestry:"unverified",surfaceNetworkRaw:!0,literalLinkText:"opaque"};function $X(s,{ask:c,path:T},I){switch(c){case"isLink":{let v=s.lstatSync(T);return I.set(T,{uid:v.uid,gid:v.gid,mode:v.mode}),v.isSymbolicLink()}case"networkJunction":return De(s,T,Cm);case"realpath":return Z(zX.native(T));case"writable":return ym(T,bc.W_OK),!0}}async function VX(s,{ask:c,path:T}){switch(c){case"isLink":return(await s.lstat(T)).isSymbolicLink();case"networkJunction":return it(s,T,Cm);case"realpath":return Z(await jX(BX.native)(T));case"writable":return await GX(T,bc.W_OK),!0}}function*bm(s,c,T,I){let v=Ac(s,...c),U;try{if(U=yield*yc(Cc(s),I),!U){let ye=s,Re=!1;for(let[Ie,Le]of c.entries())if(ye=Ac(ye,Le),Re=Ie===c.length-1?T??(yield*yc(ye)):yield*yc(ye,I),Re)break;if(!Re)return null}}catch{return null}if(U){let ye=Rm()?yield*hm(yield*Oc(v)):"unknown";return{path:v,folder:s,kind:"outside",targetWritable:ye}}let oe=yield*Oc(v),re=yield*Oc(s);if(oe==="gone"||re==="gone")return null;if(re==="unverified"||"network"in re||oe==="unverified")return{path:v,folder:s,kind:"unverified"};if("real"in oe&&Dt(re.real,oe.real))return{path:v,folder:s,kind:"inside"};let le=yield*hm(oe);return{path:v,folder:s,kind:"outside",targetWritable:le}}function*yc(s,c){let T=c?.get(s);if(T===void 0)T=(yield{ask:"isLink",path:s})===!0,c?.set(s,T);return T}function*Oc(s){if(qt(s)&&!L(s))return{network:s};try{let c=yield{ask:"networkJunction",path:s};if(c===B||c===je)return"unverified";if(typeof c==="string")return{network:c};let T=yield{ask:"realpath",path:s};return typeof T==="string"?{real:T}:"unverified"}catch(c){let T=n(c);return T==="ENOENT"||T==="ENOTDIR"?"gone":"unverified"}}function Rm(){try{let s=g();return s!=="windows"&&s!=="wsl"}catch{return!1}}function*hm(s){try{if(typeof s==="string"||!("real"in s)||!Rm())return"unknown";let c=yield*Sm(s.real);if(c==="yes")return"yes";let T=yield*Sm(WX(s.real));if(T==="yes")return"yes";return c==="no"&&T==="no"?"no":"unknown"}catch{return"unknown"}}function*Sm(s){try{return yield{ask:"writable",path:s},"yes"}catch(c){return Tm(c)}}function Tm(s){switch(n(s)){case"EACCES":case"EPERM":case"EROFS":return"no";default:return"unknown"}}function Rc(s){try{return ym(s,bc.W_OK),"yes"}catch(c){return Tm(c)}}function Dm(s,c){return{uids:c===void 0||c===s?[s]:[s,c],groups:()=>[...process.getgroups?.()??[],...process.getegid?[process.getegid()]:[],...process.getgid?[process.getgid()]:[]]}}function Tc(s,c,T){for(let I of s.uids){let v=zt({file:c,folder:T,posix:!0,euid:I,groups:s.groups});if(v!==!1)return v}return!1}var YX=40;function Lm(s,c,T){let I=Cc(s);try{for(let v=0;v<=YX;v++){let U=KX(I).root,oe,re=I.slice(U.length).split(Em).filter(Boolean),le;for(let[ye,Re]of re.entries()){let Ie=T.get(U);if(Ie===void 0){oe??=_m(U);let $e={uid:oe.uid,gid:oe.gid,mode:oe.mode};Ie=Tc(c,$e,$e)===!1&&Rc(U)==="no",T.set(U,Ie)}if(!Ie)return!0;let Le=Ac(U,Re);if(T.has(Le)){U=Le,oe=void 0;continue}let Ze=_m(Le);if(Ze.isSymbolicLink()){let $e=FX(Le),dt=$e.split(Em).filter((Me)=>Me&&Me!==".");if(dt.lastIndexOf("..")>dt.findIndex((Me)=>Me!==".."))return!0;le=Cc(U,$e,...re.slice(ye+1));break}U=Le,oe=Ze}if(le===void 0)return!1;I=le}}catch{}return!0}import{join as XX}from"path";class Im{managedFilePath=void 0;dropInDir=void 0;getManagedFilePath(){return this.managedFilePath??=ZX(),this.managedFilePath}getDropInDir(){return this.dropInDir??=XX(Go(),"managed-settings.d"),this.dropInDir}clearDropInDir(){this.dropInDir=void 0}reset(){this.managedFilePath=void 0,this.dropInDir=void 0}}var JX=new Im;function Go(){return JX.getManagedFilePath()}function ZX(){let s=qX();if(s!==void 0)return s;switch(g()){case"macos":return"/Library/Application Support/ClaudeCode";case"windows":return"C:\\Program Files\\ClaudeCode";default:return"/etc/claude-code"}}function qX(){return}var wm="cc-plugin-sec-default";var Pm={cli:!0,mcp:!0,"sdk-cli":!0,"sdk-ts":!0,"sdk-py":!0,bench:!0,"claude-vscode":!0,"claude-code-github-action":!0,"local-agent":!0,local_agent:!0,"claude-desktop":!0,remote:!0,remote_baku:!0,remote_cowork:!0,remote_trigger:!0,remote_cowork_trigger:!0,remote_desktop:!0,remote_mobile:!0,remote_projects:!0,claude_in_slack:!0,"claude-in-slack":!0,"claude-in-teams":!0,"claude-desktop-3p":!0,"claude-security":!0,"ssh-remote":!0,"claude-coworker":!0,"claude-coworker-terminal":!0};var Kde=new Set(Object.keys(Pm));function Nm(){let s=mn.CLAUDE_CODE_ENTRYPOINT;return mn.CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST&&!mn.CLAUDE_CODE_REMOTE&&!Xf()&&(s==="claude-desktop-3p"||s==="local-agent"&&mn.CLAUDE_CODE_DESKTOP_APP_VERSION==="")}var n4=new Set(["claude-desktop-3p","local-agent"]);function Dc(){let s=mn.CLAUDE_CODE_ENTRYPOINT;return s!==void 0&&n4.has(s)}var xm=new Set(["claude-desktop","claude-desktop-3p"]);function zs(){return!1}function km(){return zs()&&o4()}function o4(){return mn.CLAUDE_CODE_HOST_GATEWAY_LINEAGE&&!!mn.CLAUDE_CODE_HOST_CREDS_FILE}var Lc=new Set(Ls);function vm(){let s=mn.CLAUDE_CODE_ENTRYPOINT;return s!==void 0&&Lc.has(s)}function Mm(){let s=Ic();return s!==void 0&&Lc.has(s)}function Um(){let s=At()?tn():void 0;return s!==void 0&&Lc.has(s)}function r4(s){return s?.startsWith("remote")===!0}class Hm{entrypoint=void 0;interactive=!1;spawnedByAttendedSession=void 0;childSession=!1;hasRemoteSessionOrContainerId=!1;claudecode=!1;hostManagedRunnerChild=!1;coworkFrameArtifacts=!1;hostScheduledRun=!1;desktopSkillSwitches=!1;desktopConnectorNames=!1;desktopWorkflowLimitWait=!1;desktopModeFromRecord=!1;desktopMessageCard=!1;desktopPluginInstallFrames=!1;hostUnattendedGrant=void 0;sdkMcpToolIdleTimeoutMs=void 0;desktopAppHostMark=!1;chromeTabGroupKey=void 0;hostAssignedGroup=void 0;hostGuest=void 0;hostTestVm=void 0;hostSkillCatalog=void 0;shownPluginsDir=void 0;desktopSkillsPluginDir=void 0;remoteControlOwnerDeclared=!1;remoteRelayMark=void 0;setEntrypoint(s){this.entrypoint=s}setInteractive(s){this.interactive=s}setSpawnedByAttendedSession(s){this.spawnedByAttendedSession=s}setChildSession(s){this.childSession=s}setHasRemoteSessionOrContainerId(s){this.hasRemoteSessionOrContainerId=s}setClaudecode(s){this.claudecode=s}setHostManagedRunnerChild(s){this.hostManagedRunnerChild=s}setDesktopAppHostMark(s){this.desktopAppHostMark=s}setCoworkFrameArtifacts(s){this.coworkFrameArtifacts=s}setHostScheduledRun(s){this.hostScheduledRun=s}setDesktopSkillSwitches(s){this.desktopSkillSwitches=s}setDesktopConnectorNames(s){this.desktopConnectorNames=s}setDesktopWorkflowLimitWait(s){this.desktopWorkflowLimitWait=s}setDesktopModeFromRecord(s){this.desktopModeFromRecord=s}setDesktopMessageCard(s){this.desktopMessageCard=s}setDesktopPluginInstallFrames(s){this.desktopPluginInstallFrames=s}setHostUnattendedGrant(s){this.hostUnattendedGrant=s}setSdkMcpToolIdleTimeoutMs(s){this.sdkMcpToolIdleTimeoutMs=s}setChromeTabGroupKey(s){this.chromeTabGroupKey=s}setHostSkillCatalog(s){this.hostSkillCatalog=s}setShownPluginsDir(s){this.shownPluginsDir=s}setDesktopSkillsPluginDir(s){this.desktopSkillsPluginDir=s}setRemoteControlOwnerDeclared(s){this.remoteControlOwnerDeclared=s}setRemoteRelayMark(s){this.remoteRelayMark=this.remoteRelayMark===!0||s}setHostGuest(s){this.hostGuest=s}setHostTestVm(s){this.hostTestVm=s}setHostAssignedGroup(s){this.hostAssignedGroup=s}}var s4=new i(()=>new Hm);function i4(){return s4.of(b().host)}function Ic(){return i4().entrypoint}var a4=new Set(["claude-vscode","claude-desktop","claude-desktop-3p","local-agent","local_agent","remote","remote_desktop","remote_mobile","remote_projects","remote_cowork","ssh-remote","claude-in-slack","claude_in_slack","claude-in-teams","claude-coworker","claude-coworker-terminal"]),l4=new Set([...a4].filter(r4)),jde=new Set([...l4].filter((s)=>s!=="remote_cowork"&&s!=="remote_mobile"));var $de=new Set([...Ls,"remote","remote_desktop","remote_mobile","remote_projects","remote_trigger"]);var Gs=["low","medium","high","xhigh","max"];var Ws=/^(?:Read|Edit)\((?:\.\/)?!/;var Eo=e(()=>[{path:["allowManagedPermissionRulesOnly"],restrictive:!0},{path:["allowManagedHooksOnly"],restrictive:!0},{path:["allowManagedMcpServersOnly"],restrictive:!0},{path:["enforceAvailableModels"],restrictive:!0},{path:["disableAllHooks"],restrictive:!0},{path:["disableClaudeAiConnectors"],restrictive:!0},{path:["disableCommandPluginSources"],restrictive:!0},{path:["disableSideloadFlags"],restrictive:!0},{path:["disableSkillShellExecution"],restrictive:!0},{path:["disableWindowsBashCommandSplit"],restrictive:!0},{path:["disableRemoteControl"],restrictive:!0},{path:["disableAgentView"],restrictive:!0},{path:["disableWorkflows"],restrictive:!0},{path:["disableArtifact"],restrictive:!0},{path:["disableBundledSkills"],restrictive:!0},{path:["fastModePerSessionOptIn"],restrictive:!0},{path:["isolatePeerMachines"],restrictive:!0},{path:["strictPluginOnlyCustomization"],restrictive:!0},{path:["disableAutoMode"],restrictive:"disable"},{path:["disableDeepLinkRegistration"],restrictive:"disable"},{path:["permissions","disableBypassPermissionsMode"],restrictive:"disable"},{path:["permissions","disableAutoMode"],restrictive:"disable"},{path:["permissions","blockReadsOutsideWorkingDirectories"],restrictive:!0},{path:["permissions","blockWritesOutsideWorkingDirectories"],restrictive:!0},{path:["permissions","denyInsteadOfPrompting"],restrictive:!0},{path:["autoMode","classifyAllShell"],restrictive:!0},...[],{path:["worktree","bgIsolation"],restrictive:"worktree"},{path:["enableArtifact"],restrictive:!1},{path:["enableWorkflows"],restrictive:!1},{path:["syncClaudeAiSkills"],restrictive:!1},{path:["syncClaudeAiPlugins"],restrictive:!1},{path:["useAutoModeDuringPlan"],restrictive:!1},{path:["skipDangerousModePermissionPrompt"],restrictive:!1},{path:["skipAutoPermissionPrompt"],restrictive:!1},{path:["enableAllProjectMcpServers"],restrictive:!1},{path:["channelsEnabled"],restrictive:!1},{path:["skipWebFetchPreflight"],restrictive:!1},{path:["skipWorkflowUsageWarning"],restrictive:!1},{path:["autoUploadSessions"],restrictive:!1},{path:["remoteControlAtStartup"],restrictive:!1},{path:["remoteTools","allowUnattendedServing"],restrictive:!1},{path:["autoContinueAtUsageLimit"],restrictive:!1},{path:["responseComparisonEnabled"],restrictive:!1},...[],...[],{path:["attribution","sessionUrl"],restrictive:!1},{path:["crossSessionInbound"],restrictive:["refuse","hold"]},{path:["remoteControl","shareHostProfile"],restrictive:["off","basic"]},{path:["modelProposedGoals"],restrictive:["disabled","alwaysAsk"]},{path:["maxEffortLevel"],restrictive:Gs},{path:["feedbackDrafts"],restrictive:"off"},{path:["availableModelsMatch"],restrictive:"exact"},{path:["askUserQuestionTimeout"],restrictive:"never"},{path:["dialogExpiry"],restrictive:"never"},{path:["sandbox","enabled"],restrictive:!0},{path:["sandbox","failIfUnavailable"],restrictive:!0},{path:["sandbox","autoAllowBashIfSandboxed"],restrictive:!1},{path:["sandbox","allowUnsandboxedCommands"],restrictive:!1},{path:["sandbox","enableWeakerNestedSandbox"],restrictive:!1},{path:["sandbox","enableWeakerNetworkIsolation"],restrictive:!1},{path:["sandbox","allowAppleEvents"],restrictive:!1},{path:["sandbox","allowNestedUserNamespaces"],restrictive:!1},{path:["sandbox","network","allowManagedDomainsOnly"],restrictive:!0},{path:["sandbox","network","strictAllowlist"],restrictive:!0},{path:["sandbox","network","allowAllUnixSockets"],restrictive:!1},{path:["sandbox","network","allowLocalBinding"],restrictive:!1},{path:["sandbox","filesystem","allowManagedReadPathsOnly"],restrictive:!0},{path:["sandbox","filesystem","disabled"],restrictive:!1},{path:["sandbox","credentials","allowPlaintextInject"],restrictive:!1},{path:["sandbox","credentials","sigv4","streaming"],restrictive:"deny"},{path:["sandbox","credentials","sigv4","presigned"],restrictive:"deny"},{path:["sandbox","credentials","sigv4","sigv4a"],restrictive:"deny"},{path:["isolation","required"],restrictive:!0},{path:["isolation","persistHome"],restrictive:!1}]),eue=e(()=>new Set([]));function tr(s){return Array.isArray(s)?s:[s]}function Yt(s,c){let T=s;for(let I of c){if(T===null||typeof T!=="object")return;T=T[I]}return T}function yn(s,c,T){let I=[s],v=s;for(let oe of c.slice(0,-1)){let re={...v[oe]};v[oe]=re,v=re,I.push(v)}let U=c.at(-1);if(T!==void 0){v[U]=T;return}delete v[U];for(let oe=I.length-1;oe>0;oe--){if(Object.keys(I[oe]).length>0)break;delete I[oe-1][c[oe-1]]}}function ma(s,c){let T=Yt(c,s.path);return s.normalize===void 0?T:s.normalize(T)}var $r=`${wm}@builtin`,Bm=["sec-default@builtin"],ga=Object.freeze({settings:Object.freeze(["allowManagedHooksOnly","disableAllHooks","disableCommandPluginSources"]),policyModOptions:Object.freeze(["allowManagedModsOnly"]),setAside:Object.freeze(["allowModsToOverrideDenyRules"])});function Vr(){return c4()??vm()}function Ks(){return Vr()||Um()}function c4(){try{return Ic()===void 0?void 0:Mm()}catch(s){me(s);return}}function wc(s){let c=Yt(s,["pluginConfigs",$r,"options"]),T={};for(let v of ga.policyModOptions){let U=r(c)?c[v]:void 0;if(Gm(U))T[v]=U}return Object.keys(T).length>0?{[$r]:{options:T}}:void 0}function _a(s){let c={};for(let v of ga.settings){let U=Yt(s,[v]);if(zm(U))c[v]=U}let T=wc(s);if(T!==void 0)c.pluginConfigs=T;return Object.keys(c).length>0?{...c,managedSourcesBehavior:"merge"}:{}}function Pc(s,c){let T=d4.filter(({path:v,holds:U})=>U(Yt(s,v))&&!U(Yt(c,v)));if(T.length===0)return c;let I={...c};for(let{path:v}of T)yn(I,v,Yt(s,v));return{...I,managedSourcesBehavior:"merge"}}function zm(s){return s===!0}function Gm(s){return s!==!1&&(["string","number","boolean"].includes(typeof s)||Array.isArray(s)&&s.every((c)=>typeof c==="string"))}var d4=[...ga.settings.map((s)=>({path:[s],holds:zm})),...ga.policyModOptions.map((s)=>({path:["pluginConfigs",$r,"options",s],holds:Gm}))];var u4=d({asks:void 0,isAsking:!1,readAs:void 0,told:void 0},(s)=>{s.asks=void 0,s.isAsking=!1,s.readAs=void 0,s.told=void 0});function Ea(){let s=u4;if(s.isAsking)return s.readAs??=Vr(),s.readAs;let c=Vr();if(s.asks!==void 0){s.isAsking=!0;try{c=s.asks()}finally{s.isAsking=!1}}let T=s.readAs!==void 0&&s.readAs!==c;if(s.readAs=c,T)ie().invalidatePolicyLayer();return c}function p4(s){return function(c,T,I){var v=-1,U=Object(c),oe=I(c),re=oe.length;while(re--){var le=oe[s?re:++v];if(T(U[le],le,U)===!1)break}return c}}var Wm=p4;var f4=Wm(),ha=f4;function m4(s,c){return s&&ha(s,c,mo)}var Sa=m4;function g4(s,c){var T={};return c=go(c,3),Sa(s,function(I,v,U){Fo(T,v,c(I,v,U))}),T}var ya=g4;function _4(s,c,T){if(T!==void 0&&!lo(s[c],T)||T===void 0&&!(c in s))Fo(s,c,T)}var js=_4;var Vm=typeof Aa=="object"&&Aa&&!Aa.nodeType&&Aa,Km=Vm&&typeof Oa=="object"&&Oa&&!Oa.nodeType&&Oa,E4=Km&&Km.exports===Vm,jm=E4?Sn.Buffer:void 0,$m=jm?jm.allocUnsafe:void 0;function h4(s,c){if(c)return s.slice();var T=s.length,I=$m?$m(T):new s.constructor(T);return s.copy(I),I}var $s=h4;function S4(s){var c=new s.constructor(s.byteLength);return new br(c).set(new br(s)),c}var Yr=S4;function y4(s,c){var T=c?Yr(s.buffer):s.buffer;return new s.constructor(T,s.byteOffset,s.length)}var Ca=y4;function O4(s,c){var T=-1,I=s.length;c||(c=Array(I));while(++T<I)c[T]=s[T];return c}var ba=O4;var Ym=Object.create,A4=function(){function s(){}return function(c){if(!_n(c))return{};if(Ym)return Ym(c);s.prototype=c;var T=new s;return s.prototype=void 0,T}}(),Xm=A4;function C4(s){return typeof s.constructor=="function"&&!Pr(s)?Xm(Fr(s)):{}}var Ra=C4;function b4(s){return Ln(s)&&fo(s)}var Jm=b4;var R4="[object Object]",T4=Function.prototype,D4=Object.prototype,Zm=T4.toString,L4=D4.hasOwnProperty,I4=Zm.call(Object);function w4(s){if(!Ln(s)||$n(s)!=R4)return!1;var c=Fr(s);if(c===null)return!0;var T=L4.call(c,"constructor")&&c.constructor;return typeof T=="function"&&T instanceof T&&Zm.call(T)==I4}var Ta=w4;function P4(s,c){if(c==="constructor"&&typeof s[c]==="function")return;if(c=="__proto__")return;return s[c]}var Vs=P4;function N4(s,c,T,I){var v=!T;T||(T={});var U=-1,oe=c.length;while(++U<oe){var re=c[U],le=I?I(T[re],s[re],re,T,s):void 0;if(le===void 0)le=s[re];if(v)Fo(T,re,le);else Hr(T,re,le)}return T}var qn=N4;function x4(s){return qn(s,_o(s))}var qm=x4;function k4(s,c,T,I,v,U,oe){var re=Vs(s,T),le=Vs(c,T),ye=oe.get(le);if(ye){js(s,T,ye);return}var Re=U?U(re,le,T+"",s,c,oe):void 0,Ie=Re===void 0;if(Ie){var Le=Vt(le),Ze=!Le&&uo(le),$e=!Le&&!Ze&&wr(le);if(Re=le,Le||Ze||$e)if(Vt(re))Re=re;else if(Jm(re))Re=ba(re);else if(Ze)Ie=!1,Re=$s(le,!0);else if($e)Ie=!1,Re=Ca(le,!0);else Re=[];else if(Ta(le)||Ao(le)){if(Re=re,Ao(re))Re=qm(re);else if(!_n(re)||yr(re))Re=Ra(le)}else Ie=!1}if(Ie)oe.set(le,Re),v(Re,le,I,U,oe),oe.delete(le);js(s,T,Re)}var Qm=k4;function eg(s,c,T,I,v){if(s===c)return;ha(c,function(U,oe){if(v||(v=new co),_n(U))Qm(s,c,oe,T,eg,I,v);else{var re=I?I(Vs(s,oe),U,oe+"",s,c,v):void 0;if(re===void 0)re=U;js(s,oe,re)}},_o)}var tg=eg;function v4(s,c,T){switch(T.length){case 0:return s.call(c);case 1:return s.call(c,T[0]);case 2:return s.call(c,T[0],T[1]);case 3:return s.call(c,T[0],T[1],T[2])}return s.apply(c,T)}var ng=v4;var og=Math.max;function M4(s,c,T){return c=og(c===void 0?s.length-1:c,0),function(){var I=arguments,v=-1,U=og(I.length-c,0),oe=Array(U);while(++v<U)oe[v]=I[c+v];v=-1;var re=Array(c+1);while(++v<c)re[v]=I[v];return re[c]=T(oe),ng(s,this,re)}}var Da=M4;function U4(s){return function(){return s}}var rg=U4;var H4=!Ur?Mr:function(s,c){return Ur(s,"toString",{configurable:!0,enumerable:!1,value:rg(c),writable:!0})},sg=H4;var F4=800,B4=16,z4=Date.now;function G4(s){var c=0,T=0;return function(){var I=z4(),v=B4-(I-T);if(T=I,v>0){if(++c>=F4)return arguments[0]}else c=0;return s.apply(void 0,arguments)}}var ig=G4;var W4=ig(sg),La=W4;function K4(s,c){return La(Da(s,c,Mr),s+"")}var ag=K4;function j4(s,c,T){if(!_n(T))return!1;var I=typeof c;if(I=="number"?fo(T)&&Mo(c,T.length):I=="string"&&(c in T))return lo(T[c],s);return!1}var lg=j4;function $4(s){return ag(function(c,T){var I=-1,v=T.length,U=v>1?T[v-1]:void 0,oe=v>2?T[2]:void 0;if(U=s.length>3&&typeof U=="function"?(v--,U):void 0,oe&&lg(T[0],T[1],oe))U=v<3?void 0:U,v=1;c=Object(c);while(++I<v){var re=T[I];if(re)s(c,re,I,U)}return c})}var cg=$4;var V4=cg(function(s,c,T,I){tg(s,c,T,I)}),kn=V4;function Y4(s,c){var T=-1,I=s==null?0:s.length;while(++T<I)if(c(s[T],T,s)===!1)break;return s}var dg=Y4;function X4(s,c){return s&&qn(c,mo(c),s)}var ug=X4;function J4(s,c){return s&&qn(c,_o(c),s)}var pg=J4;function Z4(s,c){return qn(s,Dr(s),c)}var fg=Z4;function q4(s,c){return qn(s,aa(s),c)}var mg=q4;var Q4=Object.prototype,eJ=Q4.hasOwnProperty;function tJ(s){var c=s.length,T=new s.constructor(c);if(c&&typeof s[0]=="string"&&eJ.call(s,"index"))T.index=s.index,T.input=s.input;return T}var gg=tJ;function nJ(s,c){var T=c?Yr(s.buffer):s.buffer;return new s.constructor(T,s.byteOffset,s.byteLength)}var _g=nJ;var oJ=/\w*$/;function rJ(s){var c=new s.constructor(s.source,oJ.exec(s));return c.lastIndex=s.lastIndex,c}var Eg=rJ;var hg=Nn?Nn.prototype:void 0,Sg=hg?hg.valueOf:void 0;function sJ(s){return Sg?Object(Sg.call(s)):{}}var yg=sJ;var iJ="[object Boolean]",aJ="[object Date]",lJ="[object Map]",cJ="[object Number]",dJ="[object RegExp]",uJ="[object Set]",pJ="[object String]",fJ="[object Symbol]",mJ="[object ArrayBuffer]",gJ="[object DataView]",_J="[object Float32Array]",EJ="[object Float64Array]",hJ="[object Int8Array]",SJ="[object Int16Array]",yJ="[object Int32Array]",OJ="[object Uint8Array]",AJ="[object Uint8ClampedArray]",CJ="[object Uint16Array]",bJ="[object Uint32Array]";function RJ(s,c,T){var I=s.constructor;switch(c){case mJ:return Yr(s);case iJ:case aJ:return new I(+s);case gJ:return _g(s,T);case _J:case EJ:case hJ:case SJ:case yJ:case OJ:case AJ:case CJ:case bJ:return Ca(s,T);case lJ:return new I;case cJ:case pJ:return new I(s);case dJ:return Eg(s);case uJ:return new I;case fJ:return yg(s)}}var Og=RJ;var TJ="[object Map]";function DJ(s){return Ln(s)&&Co(s)==TJ}var Ag=DJ;var Cg=po&&po.isMap,LJ=Cg?Ir(Cg):Ag,bg=LJ;var IJ="[object Set]";function wJ(s){return Ln(s)&&Co(s)==IJ}var Rg=wJ;var Tg=po&&po.isSet,PJ=Tg?Ir(Tg):Rg,Dg=PJ;var NJ=1,xJ=2,kJ=4,Lg="[object Arguments]",vJ="[object Array]",MJ="[object Boolean]",UJ="[object Date]",HJ="[object Error]",Ig="[object Function]",FJ="[object GeneratorFunction]",BJ="[object Map]",zJ="[object Number]",wg="[object Object]",GJ="[object RegExp]",WJ="[object Set]",KJ="[object String]",jJ="[object Symbol]",$J="[object WeakMap]",VJ="[object ArrayBuffer]",YJ="[object DataView]",XJ="[object Float32Array]",JJ="[object Float64Array]",ZJ="[object Int8Array]",qJ="[object Int16Array]",QJ="[object Int32Array]",e6="[object Uint8Array]",t6="[object Uint8ClampedArray]",n6="[object Uint16Array]",o6="[object Uint32Array]",rn={};rn[Lg]=rn[vJ]=rn[VJ]=rn[YJ]=rn[MJ]=rn[UJ]=rn[XJ]=rn[JJ]=rn[ZJ]=rn[qJ]=rn[QJ]=rn[BJ]=rn[zJ]=rn[wg]=rn[GJ]=rn[WJ]=rn[KJ]=rn[jJ]=rn[e6]=rn[t6]=rn[n6]=rn[o6]=!0;rn[HJ]=rn[Ig]=rn[$J]=!1;function Ia(s,c,T,I,v,U){var oe,re=c&NJ,le=c&xJ,ye=c&kJ;if(T)oe=v?T(s,I,v,U):T(s);if(oe!==void 0)return oe;if(!_n(s))return s;var Re=Vt(s);if(Re){if(oe=gg(s),!re)return ba(s,oe)}else{var Ie=Co(s),Le=Ie==Ig||Ie==FJ;if(uo(s))return $s(s,re);if(Ie==wg||Ie==Lg||Le&&!v){if(oe=le||Le?{}:Ra(s),!re)return le?mg(s,pg(oe,s)):fg(s,ug(oe,s))}else{if(!rn[Ie])return v?s:{};oe=Og(s,Ie,re)}}U||(U=new co);var Ze=U.get(s);if(Ze)return Ze;if(U.set(s,oe),Dg(s))s.forEach(function(Me){oe.add(Ia(Me,c,T,Me,s,U))});else if(bg(s))s.forEach(function(Me,nt){oe.set(nt,Ia(Me,c,T,nt,s,U))});var $e=ye?le?Br:Ns:le?_o:mo,dt=Re?void 0:$e(s);return dg(dt||s,function(Me,nt){if(dt)nt=Me,Me=s[nt];Hr(oe,nt,Ia(Me,c,T,nt,s,U))}),oe}var Pg=Ia;function r6(s){var c=s==null?0:s.length;return c?s[c-1]:void 0}var Ng=r6;function s6(s,c,T){var I=-1,v=s.length;if(c<0)c=-c>v?0:v+c;if(T=T>v?v:T,T<0)T+=v;v=c>T?0:T-c>>>0,c>>>=0;var U=Array(v);while(++I<v)U[I]=s[I+c];return U}var xg=s6;function i6(s,c){return c.length<2?s:Ho(s,xg(c,0,-1))}var kg=i6;var a6=Object.prototype,l6=a6.hasOwnProperty;function c6(s,c){c=Zn(c,s);var T=-1,I=c.length;if(!I)return!0;while(++T<I){var v=Vn(c[T]);if(v==="__proto__"&&!l6.call(s,"__proto__"))return!1;if((v==="constructor"||v==="prototype")&&T<I-1)return!1}var U=kg(s,c);return U==null||delete U[Vn(Ng(c))]}var wa=c6;function d6(s){return Ta(s)?void 0:s}var vg=d6;var Mg=Nn?Nn.isConcatSpreadable:void 0;function u6(s){return Vt(s)||Ao(s)||!!(Mg&&s&&s[Mg])}var Ug=u6;function Hg(s,c,T,I,v){var U=-1,oe=s.length;T||(T=Ug),v||(v=[]);while(++U<oe){var re=s[U];if(c>0&&T(re))if(c>1)Hg(re,c-1,T,I,v);else Tr(v,re);else if(!I)v[v.length]=re}return v}var Fg=Hg;function p6(s){var c=s==null?0:s.length;return c?Fg(s,1):[]}var Bg=p6;function f6(s){return La(Da(s,void 0,Bg),s+"")}var Pa=f6;var m6=1,g6=2,_6=4,E6=Pa(function(s,c){var T={};if(s==null)return T;var I=!1;if(c=xr(c,function(U){return U=Zn(U,s),I||(I=U.length>1),U}),qn(s,Br(s),T),I)T=Pg(T,m6|g6|_6,vg);var v=c.length;while(v--)wa(T,c[v]);return T}),Fn=E6;function h6(s,c,T,I){var v=-1,U=s==null?0:s.length;while(++v<U){var oe=s[v];c(I,oe,T(oe),s)}return I}var zg=h6;function S6(s,c){return function(T,I){if(T==null)return T;if(!fo(T))return s(T,I);var v=T.length,U=c?v:-1,oe=Object(T);while(c?U--:++U<v)if(I(oe[U],U,oe)===!1)break;return T}}var Gg=S6;var y6=Gg(Sa),Wg=y6;function O6(s,c,T,I){return Wg(s,function(v,U,oe){c(I,v,T(v),oe)}),I}var Kg=O6;function A6(s,c){return function(T,I){var v=Vt(T)?zg:Kg,U=c?c():{};return v(T,s,go(I,2),U)}}var jg=A6;var C6=jg(function(s,c,T){s[T?0:1].push(c)},function(){return[[],[]]}),$g=C6;function b6(s,c){return ia(s,c,function(T,I){return sa(s,I)})}var Vg=b6;var R6=Pa(function(s,c){return s==null?{}:Vg(s,c)}),Wo=R6;function T6(s,c){return s==null?!0:wa(s,c)}var Yg=T6;import{homedir as $q}from"os";import{basename as Vq,dirname as xl,join as En,resolve as fn,sep as Yq}from"path";var D6="Expected a function";function L6(s){if(typeof s!="function")throw TypeError(D6);return function(){var c=arguments;switch(c.length){case 0:return!s.call(this);case 1:return!s.call(this,c[0]);case 2:return!s.call(this,c[0],c[1]);case 3:return!s.call(this,c[0],c[1],c[2])}return!s.apply(this,c)}}var Xg=L6;function I6(s,c){return zr(s,Xg(go(c)))}var nr=I6;function w6(s,c,T,I){var v=s.length,U=T+(I?1:-1);while(I?U--:++U<v)if(c(s[U],U,s))return U;return-1}var Jg=w6;function P6(s){return s!==s}var Zg=P6;function N6(s,c,T){var I=T-1,v=s.length;while(++I<v)if(s[I]===c)return I;return-1}var qg=N6;function x6(s,c,T){return c===c?qg(s,c,T):Jg(s,Zg,T)}var Qg=x6;function k6(s,c){var T=s==null?0:s.length;return!!T&&Qg(s,c,0)>-1}var e_=k6;function v6(s,c,T){var I=-1,v=s==null?0:s.length;while(++I<v)if(T(c,s[I]))return!0;return!1}var t_=v6;function M6(){}var n_=M6;var U6=1/0,H6=!(Uo&&1/Rr(new Uo([,-0]))[1]==U6)?n_:function(s){return new Uo(s)},o_=H6;var F6=200;function B6(s,c,T){var I=-1,v=e_,U=s.length,oe=!0,re=[],le=re;if(T)oe=!1,v=t_;else if(U>=F6){var ye=c?null:o_(s);if(ye)return Rr(ye);oe=!1,v=Wi,le=new Gi}else le=c?[]:re;e:while(++I<U){var Re=s[I],Ie=c?c(Re):Re;if(Re=T||Re!==0?Re:0,oe&&Ie===Ie){var Le=le.length;while(Le--)if(le[Le]===Ie)continue e;if(c)le.push(Ie);re.push(Re)}else if(!v(le,Ie,T)){if(le!==re)le.push(Ie);re.push(Re)}}return re}var r_=B6;function z6(s,c){return s&&s.length?r_(s,go(c,2)):[]}var s_=z6;import{join as cy}from"path";function i_(){return Jt()&&!(km()&&mn.CLAUDE_CODE_SESSION_KIND==="bg")}var G6="tengu_fizzy_widget";class a_{reader=null;register(s){let c=this.reader;return this.reader=s,c}servedTrue(s){let c=this.reader;if(!c)return!1;try{return c(s,!1)===!0}catch{return!1}}}var W6=new a_,Ys=d({settled:void 0,answeredOff:!1,answeredOn:!1},(s)=>{s.settled=void 0,s.answeredOff=!1,s.answeredOn=!1});function l_(){if(Ys.settled!==void 0)return Ys.settled;if(Ys.answeredOff)return!1;let s=W6.servedTrue(G6);return Ys.answeredOff=!s,Ys.answeredOn||=s,s}import{createHash as K6}from"crypto";function Xs(s){if(Array.isArray(s))return s.map(Xs);if(s!==null&&typeof s==="object"){let c={};for(let T of Object.keys(s).sort())c[T]=Xs(s[T]);return c}return s}function Na(s){if(typeof s==="number")return!Number.isFinite(s)||Object.is(s,-0);if(Array.isArray(s))return s.some(Na);if(s===null||typeof s!=="object")return!1;return Object.hasOwn(s,"__proto__")||Object.values(s).some(Na)}function c_(s){let c=Xs(s),T=o(c);return`sha256:${K6("sha256").update(T).digest("hex")}`}import*as Xr from"zod/v4";import{closeSync as j6,constants as $6,fstatSync as V6,lstatSync as Y6,openSync as X6,readSync as J6}from"fs";function d_(s,c,{refuseLinkOnWindows:T}){let I;try{if(T&&ae===0&&!Y6(s).isFile())return{kind:"refused"};I=X6(s,$6.O_RDONLY|ae);let v=V6(I);if(!v.isFile()||v.size>c)return{kind:"refused"};let U=Buffer.alloc(v.size),oe=J6(I,U,0,v.size,0);return{kind:"ok",text:U.toString("utf-8",0,oe)}}catch(v){return h(v)?{kind:"absent"}:{kind:"error",error:v}}finally{if(I!==void 0)try{j6(I)}catch{}}}import{verify as e5,X509Certificate as E_}from"crypto";import*as sn from"zod/v4";var Z6=[85,29,19];function xa(s,c,T){if(c+2>T)throw Error("DER: truncated element header");let I=s[c];if((I&31)===31)throw Error("DER: high-tag-number form is not supported");let v=s[c+1],U=c+2,oe;if(v<128)oe=v;else{let le=v&127;if(le===0||le>3||U+le>T)throw Error("DER: unsupported length encoding");oe=0;for(let ye=0;ye<le;ye++)oe=oe*256+s[U+ye];if(oe<128||le>1&&s[U]===0)throw Error("DER: non-minimal length encoding");U+=le}let re=U+oe;if(re>T)throw Error("DER: element overruns its container");return{tag:I,start:U,end:re}}function Js(s,c){let T=[],I=c.start;while(I<c.end){let v=xa(s,I,c.end);T.push(v),I=v.end}return T}function q6(s,c,T){return c.end-c.start===T.length&&T.every((I,v)=>s[c.start+v]===I)}function bo(s,c){if(s.tag!==c)throw Error("DER: unexpected tag");return s}function u_(s){let c=bo(xa(s,0,s.length),48);if(c.end!==s.length)throw Error("DER: bytes after the Certificate");let T=bo(xa(s,c.start,c.end),48),I=Js(s,T).find((le)=>le.tag===163);if(I===void 0)return;let[v,...U]=Js(s,I);if(v===void 0||U.length>0)throw Error("DER: [3] must wrap exactly one Extensions sequence");bo(v,48);let oe,re=!1;for(let le of Js(s,v)){bo(le,48);let ye=Js(s,le),Re=ye[0],Ie=ye.at(-1);if(Re===void 0||Ie===void 0||ye.length<2||ye.length>3)throw Error("DER: Extension is not { extnID, critical?, extnValue }");if(bo(Re,6),!q6(s,Re,Z6))continue;if(re)throw Error("DER: duplicate basicConstraints extension");if(re=!0,ye.length===3)bo(ye[1],1);bo(Ie,4);let Le=bo(xa(s,Ie.start,Ie.end),48);if(Le.end!==Ie.end)throw Error("DER: bytes after BasicConstraints");let Ze=Js(s,Le),$e=Ze[0]?.tag===1?Ze.slice(1):Ze;if($e.length>1)throw Error("DER: BasicConstraints has extra members");if($e[0]!==void 0)bo($e[0],2),oe=Q6(s,$e[0])}return oe}function Q6(s,c){let T=c.end-c.start;if(T===0)throw Error("DER: empty INTEGER");let I=s[c.start];if(I&128)throw Error("DER: negative pathLenConstraint");if(T>1&&I===0&&!(s[c.start+1]&128))throw Error("DER: non-minimal INTEGER");if((I===0?T-1:T)>2)throw Error("DER: pathLenConstraint out of range");let U=0;for(let oe=c.start;oe<c.end;oe++)U=U*256+s[oe];return U}var t5=["enterprise","team","consumer","api","other"];function p_(s){return t5.find((c)=>c===s)??"other"}var h_=Symbol("signed-cache mint");class Nc{#a=!0;kind;state;bodySha;issuedAt;notAfter;plan;organizationUuid;accountUuid;constructor(s,{kind:c,state:T,bodySha:I,issuedAt:v,notAfter:U,plan:oe,organizationUuid:re,accountUuid:le}){if(s!==h_)throw TypeError("only the verifier makes a VerifiedStatement");this.kind=c,this.state=T,this.bodySha=I,this.issuedAt=v,this.notAfter=U,this.plan=oe,this.organizationUuid=re,this.accountUuid=le,Object.freeze(this)}static isMadeByVerifier(s){return#a in s}}function S_(s){return typeof s==="object"&&s!==null&&Nc.isMadeByVerifier(s)}var n5="sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",o5={"managed-settings":86400,"policy-limits":86400},r5=300,xc=16384,s5=8192,i5=300000,a5=3,l5=3600000,c5=/^[A-Za-z0-9_-]+$/,d5=/^[A-Za-z0-9+/]+={0,2}$/,u5=e(()=>sn.object({alg:sn.literal("ES256"),typ:sn.literal("cc-signed-cache+jws"),kid:sn.string(),x5c:sn.array(sn.string().regex(d5)).min(1).max(a5)})),p5=e(()=>sn.object({v:sn.literal(1),typ:sn.string(),aud:sn.string(),iat:sn.number(),sha:sn.string(),sub:sn.string().optional(),ws:sn.string().optional(),exp:sn.int().optional(),abs:sn.literal(!0).optional(),doc:sn.string().optional(),plan:sn.string().optional()})),f5=e(()=>sn.object({v:sn.int().min(2)}));function y_({jws:s,...c}){if(!s)return{result:"unsigned"};let T={};try{let I=m5(s,c,T);if(typeof I==="string")return{result:I,...T};return{...T,result:"valid",issuedAt:I.issuedAt,notAfter:I.notAfter,plan:I.plan,verified:new Nc(h_,{kind:c.kind,state:I.state,bodySha:c.bodySha,issuedAt:I.issuedAt,notAfter:I.notAfter,plan:I.plan,organizationUuid:I.organizationUuid,accountUuid:I.accountUuid})}}catch{return{result:"malformed",...T}}}function m5(s,{kind:c,orgUuid:T,accountUuid:I,workspaceUuid:v,unanchoredClaims:U,bodySha:oe,nowMs:re,roots:le},ye){if(s.length>xc)return"malformed";let[Re,Ie,Le,...Ze]=s.split(".");if(Re===void 0||Ie===void 0||Le===void 0||Ze.length>0||![Re,Ie,Le].every((Tt)=>c5.test(Tt)))return"malformed";let $e=u5().safeParse(__(Re)),dt=__(Ie),Me=p5().safeParse(dt);if(!$e.success||!(Me.success||f5().safeParse(dt).success))return"malformed";if(Me.success){if(ye.issuedAt=Me.data.iat,ye.ageSeconds=Math.floor(re/1000)-Me.data.iat,ye.wsUnanchored=v===void 0&&Me.data.ws!==void 0,ye.statesLifetime=Me.data.exp!==void 0,ye.absence=Me.data.abs===!0,ye.plan=p_(Me.data.plan),Me.data.abs===!0&&Me.data.exp===void 0)return"malformed"}let nt=$e.data.x5c.map((Tt)=>Buffer.from(Tt,"base64"));if(nt.some((Tt)=>Tt.length>s5))return"malformed";let[rt,...ct]=nt,pt=g_(rt);if(ye.certHoursLeft=Math.floor((Date.parse(pt.validTo)-re)/l5),le.length===0)return"no_embedded_root";let bt=[pt,...ct.map(g_)];for(let Tt=0;Tt+1<bt.length;Tt++)if(!f_(bt[Tt],bt[Tt+1]))return"bad_chain";let Nt=bt.at(-1),Ct;for(let Tt of le){let Mt=new E_(Tt.pem);if(f_(Nt,Mt)){Ct={root:Tt,certificate:Mt};break}}if(Ct===void 0)return"bad_chain";for(let Tt=1;Tt<bt.length;Tt++)if(m_(bt[Tt],Tt-1))return"bad_chain";if(m_(Ct.certificate,bt.length-1))return"bad_chain";if(pt.ca)return"bad_chain";if(Ct.root.issuingCommonName!==void 0&&(bt.length!==2||_5(bt[1])!==Ct.root.issuingCommonName))return"bad_chain";let Ut=Me.success?Me.data.iat*1000:re;if(![...bt,Ct.certificate].every((Tt)=>E5(Tt,Ut)))return"cert_expired";if(!g5(pt.subjectAltName??"").includes(`URI:${Ct.root.marker}`))return"no_marker";if(pt.publicKey.asymmetricKeyType!=="ec"||pt.publicKey.asymmetricKeyDetails?.namedCurve!=="prime256v1")return"bad_signature";if(!e5("sha256",Buffer.from(`${Re}.${Ie}`,"utf8"),{key:pt.publicKey,dsaEncoding:"ieee-p1363"},Buffer.from(Le,"base64url")))return"bad_signature";if(!Me.success)return"unsupported_version";if(Me.data.typ!==c)return"wrong_type";let qe=U==="refuse";if((T!==void 0||qe)&&Me.data.aud!==T)return"aud_mismatch";if((I!==void 0||qe)&&Me.data.sub!==I)return"sub_mismatch";if(v!==void 0&&Me.data.ws!==v)return"ws_mismatch";if(Me.data.sha!==oe)return"sha_mismatch";let Ve=Me.data.abs===!0,ut=Me.data.sha===n5;if(c==="managed-settings"?(Ve||Me.data.exp!==void 0)&&(Ve!==ut||Ve&&Me.data.doc!==void 0):Ve)return"abs_mismatch";let Et=Math.floor(re/1000)-Me.data.iat;if(Et<-r5)return"future_iat";let yt=Math.min(o5[c],(Me.data.exp??Number.POSITIVE_INFINITY)-Me.data.iat),Pt=Me.data.iat+yt;if(ye.notAfter=Pt,yt<=0||Et>yt)return"stale";return{issuedAt:Me.data.iat,notAfter:Pt,state:Ve?"absence":"document",plan:p_(Me.data.plan),organizationUuid:Me.data.aud,accountUuid:Me.data.sub}}function g5(s){let c=[],T="",I=!1;for(let v=0;v<s.length;v++){let U=s[v];if(I){if(U==="\\"&&v+1<s.length){T+=U+s[v+1],v++;continue}if(T+=U,U==='"')I=!1;continue}if(U==='"'){I=!0,T+=U;continue}if(U===","){c.push(T),T="";let oe=v+1;while(oe<s.length&&/\s/.test(s[oe]))oe++;v=oe-1;continue}T+=U}if(I)return[];return c.push(T),c}function f_(s,c){return c.ca&&Boolean(s.checkIssued(c))&&s.verify(c.publicKey)}function _5(s){let c=s.toLegacyObject().subject?.CN;return typeof c==="string"?c:void 0}function m_(s,c){let T=u_(s.raw);return T!==void 0&&c>T}function g_(s){let c=new E_(s);if(c.raw.length!==s.length)throw Error("trailing bytes after x5c certificate DER");return c}function E5(s,c){return c>=Date.parse(s.validFrom)-i5&&c<=Date.parse(s.validTo)}function __(s){try{return A(Buffer.from(s,"base64url").toString("utf8"))}catch{return}}var h5=xc+256,S5=e(()=>Xr.object({jws:Xr.string().min(1),receivedAt:Xr.number()}));function y5(s){return`${s}.signature.json`}function O5(s){return`${s}.signature-iat.json`}var E_e=["remote-settings.json","policy-limits.json"].map(O5);function O_(s){let c=A5(y5(s),S5());return c.kind==="ok"?c.value:null}function A5(s,c){if(m())return{kind:"absent"};let T=d_(s,h5,{refuseLinkOnWindows:!0});if(T.kind!=="ok")return T.kind==="absent"?{kind:"absent"}:{kind:"unparsable"};try{let I=c.safeParse(A(T.text));return I.success?{kind:"ok",value:I.data}:{kind:"unparsable"}}catch{return{kind:"unparsable"}}}function kc(s,c){return c===void 0||c.includes(s)?void 0:"org_pin_mismatch"}function C5({verification:s,held:c,pinnedOrgs:T}){if(c.orgUuid!==void 0){let v=kc(c.orgUuid,T);if(v!==void 0)return{trusted:!1,reason:v}}let I;switch(s.result){case"valid":if(!S_(s.verified))return{trusted:!1,reason:"error"};if(s.statesLifetime!==!0)return{trusted:!1,reason:"no_lifetime"};I=s.verified;break;case"unsigned":case"malformed":case"no_embedded_root":case"bad_chain":case"cert_expired":case"no_marker":case"bad_signature":case"unsupported_version":case"wrong_type":case"aud_mismatch":case"sub_mismatch":case"ws_mismatch":case"sha_mismatch":case"abs_mismatch":case"future_iat":case"stale":return{trusted:!1,reason:s.result};default:return{trusted:!1,reason:"error"}}if(c.orgUuid===void 0){let v=kc(I.organizationUuid,T);if(v!==void 0)return{trusted:!1,reason:v}}return{trusted:!0,principal:{orgUuid:c.orgUuid??I.organizationUuid,accountUuid:c.accountUuid??I.accountUuid,workspaceUuid:c.workspaceUuid}}}function ka(s){switch(s){case"stale":case"future_iat":case"no_lifetime":case"unsigned":case"unsupported_version":return!0;case"malformed":case"no_embedded_root":case"bad_chain":case"cert_expired":case"no_marker":case"bad_signature":case"wrong_type":case"aud_mismatch":case"sub_mismatch":case"ws_mismatch":case"sha_mismatch":case"abs_mismatch":case"org_pin_mismatch":case"org_pin_unknown":case"error":return!1}}function A_({kind:s,cachePath:c,live:T,body:I,bodySha:v,account:U,pinnedOrgs:oe,nowMs:re,roots:le}){try{let ye=U?.organizationUuid||void 0,Re=U?.accountUuid||void 0,Ie=U?.workspaceUuid||void 0,Le={orgUuid:ye,accountUuid:Re,workspaceUuid:Ie};if(ye!==void 0&&kc(ye,oe)!==void 0)return{trusted:!1,reason:"org_pin_mismatch"};if(Na(I))return{trusted:!1,reason:"sha_mismatch"};return C5({verification:y_({jws:T!==void 0?T.jws:O_(c)?.jws,kind:s,orgUuid:ye,accountUuid:Re,workspaceUuid:Ie,unanchoredClaims:"accept",bodySha:v,nowMs:re,roots:le}),held:Le,pinnedOrgs:oe})}catch(ye){return t(`signed-cache: judging a stored copy failed: ${S(ye)}`,{level:"error"}),{trusted:!1,reason:"error"}}}var b5={begin:"-----SIGNED-CACHE-ROOTS-BEGIN-----",roots:[{pem:`-----BEGIN CERTIFICATE-----
MIIB3TCCAYKgAwIBAgIUANUYY/tuc08yPd9Nsh7rY/zDEiwwCgYIKoZIzj0EAwIw
OjESMBAGA1UEChMJQW50aHJvcGljMSQwIgYDVQQDExtBbnRocm9waWMgQXBwcyBT
aWduaW5nIFJvb3QwHhcNMjYwOTAyMjMzNDMwWhcNNDEwODI5MjMzNDI5WjA6MRIw
EAYDVQQKEwlBbnRocm9waWMxJDAiBgNVBAMTG0FudGhyb3BpYyBBcHBzIFNpZ25p
bmcgUm9vdDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAsUtD9z65VTC61W8M40
B+bGEhcvb+8mLm/9aTh39H4lwLH0agHzBBqkt4dvqqGzo1J2pJN7L7UoX9nEEVbO
7rmjZjBkMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEBMB0GA1Ud
DgQWBBQW+2L0kdDEOi+A6fBK5jpwNdtoCzAfBgNVHSMEGDAWgBQW+2L0kdDEOi+A
6fBK5jpwNdtoCzAKBggqhkjOPQQDAgNJADBGAiEA+vhhLCvaUT2ccO0ND0YZaUy0
e+zhUoJOBhE9hXPs+SkCIQCHdbMcFo/ZQEq/rVnaS8qv/BZvRfYoEm318TY0WBU4
XA==
-----END CERTIFICATE-----`,marker:"urn:anthropic:claude-code:signed-cache:production"}],end:"-----SIGNED-CACHE-ROOTS-END-----"},C_=b5.roots;var b_={marker:"urn:anthropic:claude-code:signed-cache:production",issuingCommonName:"Claude Code Signed Cache Issuing CA"},Jr=void 0,R_=Object.freeze(C_.map((s)=>Object.freeze({...s,issuingCommonName:Jr!==void 0&&s.marker===Jr.marker?Jr.issuingCommonName:b_.issuingCommonName})));function R5(){if(Jr!==void 0&&hn()&&R_.some((s)=>s.marker===Jr.marker))return Jr.marker;return b_.marker}function T5(s,c){return Object.freeze(s.filter((T)=>T.marker===c))}function T_(){return T5(R_,R5())}var va=["CLAUDE_CODE_USE_BEDROCK","CLAUDE_CODE_USE_FOUNDRY","CLAUDE_CODE_USE_ANTHROPIC_AWS","CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD","CLAUDE_CODE_USE_MANTLE","CLAUDE_CODE_USE_VERTEX"];var D5=d(new Map,(s)=>s.clear());var Ma=d({isOpen:!1},(s)=>{s.isOpen=!1});function L5(s){return process.env[s]}function D_(s,c){if(c===void 0){delete process.env[s];return}process.env[s]=c}function I5(s){return L5(s.name)===s.theirs}function w5(){let s=[...D5.values()];return Ma.isOpen?s:s.filter(I5)}function L_(s,c){if(Ma.isOpen)return s();let T=w5();if(T.length===0)return s();let I=T.filter((v)=>v.writer===void 0||c===void 0||!c(v.writer));for(let v=I.length-1;v>=0;v--)D_(I[v].name,I[v].before);Ma.isOpen=!0;try{return s()}finally{for(let v of I)D_(v.name,v.theirs);Ma.isOpen=!1}}var Zs="$defaults";var P5=["user_allow_rules_to_replace","user_soft_deny_rules_to_replace","user_hard_deny_rules_to_replace","user_environment_to_replace"];var N5=["account_standing_rule_changes","auto_mode_bypass","blind_apply","browser_file_upload_exfil","browser_input_exfil","browser_js_exfil","browser_navigate_exfil","browser_shortcut_execution","chatops_trigger_comments","ci_bypass","cloud_storage_mass_delete","cluster_wide_workload_creation","code_from_external","code_that_leaks_when_run","command_network_lists","containment_escape","create_public_surface","create_rce_surface","create_unsafe_agents","credential_exploration","credential_leakage","credential_materialization","data_exfiltration","dns_domain_cert_changes","excess_sensitive_detail","exfil_scouting","expose_local_services","external_ingress_tunnel","external_system_writes","feature_flag_writes","git_destructive","instruction_poisoning","interfere_with_workloads","irreversible_deletion_general","irreversible_local_destruction","live_shared_artifact_sensitive_delta","logging_audit_tampering","merge_without_review","modify_shared_resources","node_lifecycle_operations","out_of_place_publication","package_registry_bypass","permission_grant","pii_data_handling","production_deploy","production_reads","protected_scope_iac_apply","public_data_sharing_upload","real_world_transactions","remote_repoint","remote_shell_writes","safety_bypass_flag","sandbox_network_callback","secret_store_writes","security_test_removal","security_weaken","self_approval","self_modification","sensitive_remote_exec","sensitive_source_provenance","session_transcript_tampering","shared_cluster_mutation","shared_scratch_sweep","third_party_attack","tls_auth_weaken","tmux_self_drive","traffic_redirection","unauthorized_persistence","unrequested_artifact_publish","unrequested_commit_in_a_connected_app","untrusted_code_integration","unverifiable_deletion_scope","unverifiable_deletion_target"],x5=["cowork_delete_grant","cowork_folder_access","cowork_run_routine_now","cowork_scheduled_task_delete","cowork_scheduled_task_write","cowork_skill_persistence"],k5=["access_added_as_a_means","bot_check_circumvention","consent_given_for_the_user","identity_not_given","notes_for_later_sessions","save_over_an_occupied_name","stated_interface_sidestepped","walled_content_from_a_copy","website_access_circumvention"],v5=["destructive_or_unwanted_actions","unauthorized_access","undermining_oversight","unsanctioned_communication"];var M5=[],I_=new Set([...N5,...M5]),k_e=new Set([...I_,...k5,...v5]),v_e=new Set([...I_,...x5]);function Ua(s){for(let c=0;c<s.length;c++){let T=s.charCodeAt(c);if(T<32&&T!==9||T>=127&&T<=159||T===8232||T===8233)return!0}return!1}var U5=/[\p{Cf}\p{Default_Ignorable_Code_Point}\u2028\u2029\u2800\uFFF9-\uFFFB\u{1D173}-\u{1D17A}]/u;function Ha(s){return U5.test(s)}function w_(s){if(s.includes("<settings_")||P5.some((c)=>s.includes(`<${c}`)||s.includes(`</${c}`)))return"template_token";if(s.includes("<cc_automode")||s.includes("</cc_automode"))return"region_tag";return null}function P_(s){return s.trim().length>0&&!Ua(s)&&!Ha(s)&&w_(s)===null}import{posix as jh,win32 as $h}from"path";import*as se from"zod/v4";import{isAbsolute as N_}from"path";import*as _t from"zod/v4";var vc="When managed settings or a --settings file set allowUnsandboxedCommands: false, or managed settings set network.allowManagedDomainsOnly: true",H5="When managed settings or a --settings file set allowUnsandboxedCommands: false, network.deniedDomains "+"or a WebFetch(domain:…) deny rule, when managed settings set network.allowManagedDomainsOnly: true, "+"or when managed, --settings or user settings set network.strictAllowlist: true",F5="When managed settings or a --settings file set allowUnsandboxedCommands: false, filesystem.denyRead, "+"a Read(…) deny rule or a credentials.files entry (deny or mask), or managed settings set network.allowManagedDomainsOnly: true",B5="When managed settings or a --settings file set filesystem.denyRead, a Read(…) deny rule "+"or a credentials.files entry (deny or mask)",Ro="project settings (.claude/settings.json and .claude/settings.local.json)",Zr=`${vc}, values from ${Ro} are ignored.`,Fa=`${vc}, true from ${Ro} is ignored (false there still applies).`,x_=`${vc}, and managed, --settings or user settings set true, false from ${Ro} is ignored (true there still applies).`,k_=`${H5}, values from ${Ro} are ignored. With network.allowManagedDomainsOnly, only managed settings may set it.`,z5=`${F5}, a value from ${Ro} that would re-open a path managed, --settings or user settings deny reading is ignored, as is one spelled as a glob or a network path (UNC or automount); one carving out of the project's own denyRead still applies. A value inside a directory sandboxed commands can write is re-checked before every command and dropped once it has been re-pointed into a denied path.`,G5=`${Zr} ${B5}, a value from ${Ro} under or equal to a denied path, or spelled as a glob or a network path (UNC or automount), is ignored. A value inside a directory sandboxed commands can already write is re-checked before every command and dropped once it has been re-pointed into a denied read path.`,W5=e(()=>_t.object({allowedDomains:_t.array(_t.string()).optional().describe("Domains sandboxed commands may reach without a prompt (wildcards such as *.example.com supported). "+"Merged with WebFetch(domain:…) allow rules and across settings sources. "+Zr+" With network.allowManagedDomainsOnly, only managed settings supply it."),deniedDomains:_t.array(_t.string()).optional().describe("Domains that are always blocked, even if matched by allowedDomains. Supports the same wildcard syntax as allowedDomains. Merged from all settings sources regardless of allowManagedDomainsOnly."),strictAllowlist:_t.boolean().optional().describe("When true, the sandbox runtime deterministically denies hosts not in allowedDomains instead of prompting. "+"Enforced for sandboxed commands only — in-process tools such as WebFetch are not gated by this setting. "+"Only honored from user, managed/policy, or CLI (--settings) settings — "+`${Ro} are ignored, and while it is on their allowedDomains `+"and WebFetch(domain:…) allow rules are left out of the allowlist."),allowManagedDomainsOnly:_t.boolean().optional().describe("When true (and set in managed settings), only allowedDomains and WebFetch(domain:...) allow rules from managed settings are respected. User, project, local, and flag settings domains are ignored. Denied domains are still respected from all sources."),allowUnixSockets:_t.array(_t.string()).optional().describe("macOS only: Unix socket paths to allow. Ignored on Linux (seccomp cannot filter by path). Merged across settings sources. "+Zr),allowAllUnixSockets:_t.boolean().optional().describe("If true, allow all Unix sockets (disables blocking on both platforms). "+Fa),allowLocalBinding:_t.boolean().optional().describe("macOS only: If true, sandboxed commands can bind to localhost ports. "+Fa),allowMachLookup:_t.array(_t.string().refine((s)=>!(s.endsWith("*")?s.slice(0,-1):s).includes("*"),{message:'Wildcards are only allowed as a single trailing "*" (e.g., "com.example.*" or "*" for all services).'})).optional().describe('macOS only: Additional XPC/Mach service names to allow looking up. Supports trailing-wildcard prefix matching (e.g., "com.apple.CoreSimulator.*"). Needed for tools that communicate via XPC such as the iOS Simulator or Playwright. Each entry lets sandboxed commands reach services outside the sandbox, and the sandbox does not confine what those services do for them. Merged across settings sources. '+Zr),httpProxyPort:_t.number().optional().describe("Local TCP port of your own HTTP proxy for sandboxed traffic, used instead of the proxy Claude Code runs. "+k_),socksProxyPort:_t.number().optional().describe("Local TCP port of your own SOCKS5 proxy for sandboxed traffic, used instead of the proxy Claude Code runs. "+k_),tlsTerminate:_t.object({caCertPath:_t.string().min(1).optional(),caKeyPath:_t.string().min(1).optional()}).optional().describe("[EXPERIMENTAL] Enable in-process TLS termination so the per-request filter can see HTTPS request bodies. Provide a CA cert+key, or omit both to have sandbox-runtime generate an ephemeral one for the session. On native Windows an ephemeral CA cannot pass the sandbox trust check, so omitting the paths uses a persistent CA managed by the sandbox runtime (set up and trusted via /sandbox install); configured paths are passed to the sandbox runtime verbatim, which rejects a bad or incomplete pair at sandbox initialization. "+"Only honored from user, managed/policy, or CLI (`--settings`) settings — project settings "+"(.claude/settings.json and .claude/settings.local.json) are ignored.")}).optional()),K5=e(()=>_t.object({allowWrite:_t.array(_t.string()).optional().describe("Additional paths to allow writing within the sandbox. Merged with paths from Edit(...) allow permission rules. "+G5),denyWrite:_t.array(_t.string()).optional().describe("Additional paths to deny writing within the sandbox. Merged with paths from Edit(...) deny permission rules."),denyRead:_t.array(_t.string()).optional().describe("Additional paths to deny reading within the sandbox. Merged with paths from Read(...) deny permission rules."),allowRead:_t.array(_t.string()).optional().describe("Paths to re-allow reading within denyRead regions. Takes precedence over denyRead for matching paths. "+z5),allowManagedReadPathsOnly:_t.boolean().optional().describe("When true (set in managed settings), only allowRead paths from policySettings are used."),disabled:_t.boolean().optional().describe("macOS and Linux/WSL only: skip filesystem isolation entirely while keeping network and seccomp isolation. Ignored on native Windows, where the sandboxed process runs as a separate user with no inherent rights, so skipping the filesystem rules would "+"withhold every access grant rather than loosen them — filesystem isolation stays on there. "+"Sandboxed commands get unrestricted read/write access to the host filesystem; network egress is still confined to network.allowedDomains. Intended for deployments whose goal is egress control rather than filesystem containment. Does not change Bash prompting: sandbox.autoAllowBashIfSandboxed is independent and still defaults to false, so sandboxed commands keep going through the permission flow unless it is set to true. Drops the read protection from filesystem.denyRead and credentials.files deny entries for sandboxed commands, since both are enforced by the filesystem layer this turns off; credentials.files mask entries (sentinel binds) and credentials.envVars deny/mask are unaffected. "+"Only honored from user, managed/policy, or CLI (`--settings`) settings — "+"project settings (.claude/settings.json and .claude/settings.local.json) are ignored. If managed settings configure sandbox.filesystem at all, or list any sandbox.credentials.files deny entry, only managed settings can set this: an admin who deployed filesystem restrictions must not have them switched off by a user-writable file. (sandbox.credentials.envVars and credentials.files mask entries "+"do not pin it — env scrubbing and sentinel binds are independent of the filesystem "+"layer and survive this setting.) When unset, filesystem isolation stays on.")}).optional());function v_(s,c,T){if(s.length===0||s.some((I)=>I.length===0))T.addIssue({code:_t.ZodIssueCode.custom,path:["maskClaims"],message:"maskClaims must name at least one non-empty claim — omit maskClaims for whole-token masking."});if(c===void 0)T.addIssue({code:_t.ZodIssueCode.custom,path:["maskClaims"],message:"maskClaims requires decode — without a decode format there is no token to read claims from. Set decode, or omit maskClaims."})}function M_(s,c){let T;try{T=new RegExp(s)}catch(v){c.addIssue({code:_t.ZodIssueCode.custom,path:["extract"],message:`extract is not a valid regular expression: ${S(v)}`});return}if(new RegExp(T.source+"|").exec("").length-1<1)c.addIssue({code:_t.ZodIssueCode.custom,path:["extract"],message:"extract must contain at least one capturing group — "+'group 1 is the credential value to mask (e.g. "token:\\s*(\\S+)").'})}function U_(s){if(typeof s!=="object"||s===null)return s;let c=s;if(c.mode!=="deny")return s;let T={...c};if("extract"in T&&typeof T.extract!=="string")delete T.extract;if("onExtractNoMatch"in T&&T.onExtractNoMatch!=="warn"&&T.onExtractNoMatch!=="deny"&&T.onExtractNoMatch!=="error")delete T.onExtractNoMatch;if("decode"in T&&T.decode!=="jwt")delete T.decode;if("maskClaims"in T&&!(Array.isArray(T.maskClaims)&&T.maskClaims.every((I)=>typeof I==="string")))delete T.maskClaims;if("maskDuplicates"in T&&typeof T.maskDuplicates!=="boolean")delete T.maskDuplicates;if("injectHosts"in T&&!(Array.isArray(T.injectHosts)&&T.injectHosts.every((I)=>typeof I==="string")))delete T.injectHosts;return T}var Ba=e(()=>_t.preprocess(U_,_t.object({path:_t.string().min(1).describe("Path to a credential file or directory. Same resolution as sandbox.filesystem.* paths: absolute, ~ expanded, or relative to the settings file root (project root for project settings, ~/.claude for user settings)."),mode:_t.enum(["deny","mask"]).describe("Access mode for this path. `deny` blocks reads inside the sandbox; `mask` shows sandboxed commands a sentinel-substituted copy (whole-file, or only the spans captured by `extract`) and the "+"host proxy swaps sentinel→real on egress to `injectHosts`. "+"On macOS and Windows `mask` currently degrades to `deny`."),extract:_t.string().optional().describe("Optional regex for structured masking when mode is `mask`. Applied globally to the file; capture group 1 of each match is a credential value, and only those captured spans are replaced "+"with sentinels — the rest of the file is preserved so a tool "+"that parses it (.netrc, JSON, YAML) still succeeds. Without `extract`, the entire file content is replaced with one sentinel (whole-file masking, suited to single-secret files). If the regex matches nothing, behavior is governed by `onExtractNoMatch` (default `warn`). Accepted but ignored for `deny`."),onExtractNoMatch:_t.enum(["warn","deny","error"]).optional().describe("What to do when `extract` matches nothing in the file — or, "+"with `decode`, when no candidate survives verification. `warn` (default) emits a stderr warning and leaves the file readable as-is inside the sandbox (fail-open, for credentials that may be legitimately absent); `deny` degrades the entry to "+"mode `deny` so the file is unreadable (fail-closed) — under "+"`sandbox.filesystem.disabled` it is treated as `error`, since read-denies are dropped in that mode; `error` aborts at sandbox setup so nothing runs until the config is fixed. Only meaningful when mode is `mask` and `extract` or `decode` is set; accepted but ignored otherwise."),decode:_t.enum(["jwt"]).optional().describe("Optional encoded-credential format for `mask` mode. `jwt`: candidates are located with a built-in JWT regex (or the explicit `extract` pattern, if set), verified to actually be JWTs before masking, and replaced with a structurally valid fake JWT so client-side token parsing inside the sandbox keeps working. If no candidate verifies, behavior is governed by `onExtractNoMatch` (default `warn`). Accepted but ignored for `deny`."),maskClaims:_t.array(_t.string()).optional().describe("Names of top-level payload claims to mask inside each decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel and the token is rebuilt around the modified payload; all other claims are preserved so a tool that decodes the token and reads a non-secret claim keeps working. Requires `decode`. If no named claim matches in any verified token, behavior is governed by `onExtractNoMatch` (default `warn`). Only meaningful when mode is `mask`; accepted but ignored for `deny`."),maskDuplicates:_t.boolean().optional().describe("If true, verbatim occurrences of each captured credential value outside the regex-matched spans are also replaced with the "+"corresponding sentinel — for a secret repeated where the regex "+"does not reach (e.g. pasted into a comment). Matches raw substrings, so short or common values may corrupt unrelated content; intended for long, high-entropy secrets. Defaults to false. Only meaningful when mode is `mask` and `extract` or `decode` is set; accepted but ignored otherwise."),injectHosts:_t.array(_t.string()).optional().describe("Optional narrowing of where the proxy substitutes this credential. Only meaningful when mode is `mask`; accepted but ignored for `deny`. If unset, defaults to "+"`network.allowedDomains` — the credential is injected at "+"every reachable host. Each entry must be reachable via `network.allowedDomains` (sandbox-runtime validates this).")}).superRefine((s,c)=>{if(s.mode==="mask"&&s.path.endsWith("/"))c.addIssue({code:_t.ZodIssueCode.custom,path:["path"],message:'Credential mode "mask" applies to a single file, not a directory. List the specific credential file(s), or use "deny" for the directory.'});if(s.mode==="mask"&&s.extract!==void 0)M_(s.extract,c);if(s.mode==="mask"&&s.maskClaims!==void 0)v_(s.maskClaims,s.decode,c)}))),qr=()=>_t.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/,"Environment variable name must start with a letter or underscore and contain only letters, digits, and underscores"),za=e(()=>_t.preprocess(U_,_t.object({name:qr().describe("Environment variable name."),mode:_t.enum(["deny","mask"]).describe("Access mode for this environment variable. `deny` unsets the variable for sandboxed commands; `mask` shows sandboxed commands a sentinel value and the "+"host proxy swaps sentinel→real on egress to `injectHosts`."),extract:_t.string().optional().describe("Optional regex for structured masking when mode is `mask`. Applied globally to the value; capture group 1 of each match is a credential value, and only those captured spans are "+"replaced with sentinels — the rest of the value is preserved "+"so a tool that parses it (a `DATABASE_URL` connection string, a composite `KEY:SECRET` pair) still succeeds inside the sandbox. Without `extract`, the entire value is replaced with one sentinel (whole-value masking, suited to bare tokens). If the regex matches nothing, behavior is governed by `onExtractNoMatch` (default `warn`). Cannot be combined with `decode` (the decode path never consults it). Accepted but ignored for `deny`."),onExtractNoMatch:_t.enum(["warn","deny","error"]).optional().describe("What to do when `extract` matches nothing in the value. `warn` (default) emits a stderr warning and lets the variable pass through unmasked (fail-open, for credentials that may be legitimately absent); `deny` unsets the variable inside the sandbox (fail-closed); `error` aborts at sandbox setup so nothing runs until the config is fixed. Only meaningful when mode is `mask` and `extract` is set without `decode`. On a mask entry with `decode`, the runtime takes the decode path and never consults this field, so a fail-closed setting "+"cannot be honored — `deny` and `error` are rejected there; "+"only `warn` is accepted. In all other shapes the field is accepted but ignored."),decode:_t.enum(["jwt"]).optional().describe("Optional encoded-credential format for `mask` mode. `jwt`: the variable's whole value is verified to actually be a JWT and replaced with a structurally valid fake JWT so client-side token parsing inside the sandbox keeps working; the proxy swaps the whole fake token on egress. If the value does not verify, the variable is left unmasked with a stderr warning "+"(fail-open). Cannot be combined with `extract` — the decode "+"path never consults it. Accepted but ignored for `deny`."),maskClaims:_t.array(_t.string()).optional().describe("Names of top-level payload claims to mask inside the decoded value, instead of replacing the whole token. Each named claim present with a string value gets its own sentinel and the token is rebuilt around the modified payload; all other claims are preserved so claim-reading clients keep working. Requires `decode`. If no named claim matches, the variable is left unmasked with a stderr warning (fail-open). Only meaningful when mode is `mask`; accepted but ignored for `deny`."),injectHosts:_t.array(_t.string()).optional().describe("Optional narrowing of where the proxy substitutes this credential. Only meaningful when mode is `mask`; accepted but ignored for `deny`. If unset, defaults to "+"`network.allowedDomains` — the credential is injected at "+"every reachable host. Each entry must be reachable via `network.allowedDomains` (sandbox-runtime validates this).")}).superRefine((s,c)=>{if(s.mode==="mask"&&s.extract!==void 0)M_(s.extract,c);if(s.mode==="mask"&&s.maskClaims!==void 0)v_(s.maskClaims,s.decode,c);if(s.mode==="mask"&&s.decode!==void 0&&s.extract!==void 0)c.addIssue({code:_t.ZodIssueCode.custom,path:["extract"],message:"extract cannot be combined with decode on an env entry — the runtime takes the decode path (whole-value JWT verification) and never consults extract, silently disabling the structured masking. Remove one of the two."});if(s.mode==="mask"&&s.decode!==void 0&&(s.onExtractNoMatch==="deny"||s.onExtractNoMatch==="error"))c.addIssue({code:_t.ZodIssueCode.custom,path:["onExtractNoMatch"],message:"onExtractNoMatch cannot be honored on an env entry with decode — the runtime takes the decode path (which is unconditionally fail-open on verify failure) and never consults extract or onExtractNoMatch. Remove onExtractNoMatch, or drop decode to use extract-based masking (whose no-match handling does honor it)."})}))),Ko=["AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_SESSION_TOKEN"];var Mc="_INVALID_PAIR_",Ga="_PARENT_PAIR_SUPPRESSOR_";var Wa=e(()=>_t.object({accessKeyIdVar:qr().describe("Name of the masked env var holding the AWS access key id."),secretAccessKeyVar:qr().describe("Name of the masked env var holding the AWS secret access key."),sessionTokenVar:qr().optional().describe("Optional name of the masked env var holding the AWS session token (temporary credentials). When set, the proxy sends the real token as x-amz-security-token on re-signed requests and adds it to the signed header set if the client did not.")}).superRefine((s,c)=>{let T=new Map;for(let[I,v]of[["accessKeyIdVar",s.accessKeyIdVar],["secretAccessKeyVar",s.secretAccessKeyVar],["sessionTokenVar",s.sessionTokenVar]]){if(v===void 0)continue;let U=T.get(v);if(U!==void 0)c.addIssue({code:_t.ZodIssueCode.custom,path:[I],message:`${I} names the same env var ('${v}') as ${U} — each pair member must be a distinct variable.`});else T.set(v,I)}})),j5=e(()=>{let s=_t.enum(["deny","passthrough"]);return _t.object({streaming:s.optional().describe("Policy for aws-chunked streaming uploads (x-amz-content-sha256: STREAMING-*): per-chunk signatures chain off the seed signature, so re-signing would require rewriting the body. `deny` (default) fails closed with a 403; `passthrough` forwards the request unre-signed (the upstream will reject its signature)."),presigned:s.optional().describe("Policy for presigned URLs (X-Amz-Algorithm/X-Amz-Signature in the query, no Authorization header): the signature lives in the URL itself. `deny` (default) or `passthrough`."),sigv4a:s.optional().describe("Policy for SigV4A (AWS4-ECDSA-P256-SHA256) asymmetric signatures: there is no shared-key HMAC to recompute. `deny` (default) or `passthrough`.")})}),$5=e(()=>_t.object({files:_t.array(Ba()).optional().describe("Credential files or directories to protect. `deny` blocks reads inside the sandbox; `mask` substitutes a sentinel inside the sandbox (whole-file, or per-`extract` capture) and injects the real value at the proxy. On macOS and Windows `mask` degrades to `deny`."),envVars:_t.array(za()).optional().describe("Environment variables to protect. `deny` unsets the variable for sandboxed commands; `mask` substitutes a sentinel inside the sandbox and injects the real value at the proxy."),allowPlaintextInject:_t.boolean().optional().describe("Allow sentinel→real substitution on the plain-HTTP proxy path. "+"Defaults to false: without TLS termination the upstream identity is unverified and the credential travels in cleartext. Set only for trusted-network test fixtures. Only honored from user, managed/policy, or CLI (`--settings`) "+"settings — project settings (.claude/settings.json and "+".claude/settings.local.json) are ignored."),awsPairs:_t.array(Wa()).optional().describe("Explicit groupings of masked env vars into AWS credential pairs for SigV4 re-signing, for non-standard variable names. The conventional AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN trio is paired automatically when masked. Only honored from user, managed/policy, or CLI (`--settings`) "+"settings — project settings (.claude/settings.json and "+".claude/settings.local.json) are ignored. A member is only usable when its env var is forwarded as a whole-value `mask` entry (an entry carrying `extract` or `decode` does not "+"qualify — re-signing needs the whole real value). A pair "+"whose key id or secret member is unusable never re-signs: it is dropped, unless it names a conventional AWS variable, in which case it is forwarded as an inert suppressor so implicit auto-pairing stays overridden. A pair whose ONLY unusable member is the session token still re-signs, without an x-amz-security-token (temporary-credential requests fail upstream until the entry is fixed)."),sigv4:j5().optional().describe("Policies for AWS SigV4 request shapes the proxy cannot re-sign (streaming, presigned, sigv4a) when they reference a masked credential pair: `deny` (default) or `passthrough`. Only honored from user, managed/policy, or CLI (`--settings`) "+"settings — project settings (.claude/settings.json and "+".claude/settings.local.json) are ignored.")}).superRefine((s,c)=>{let T=new Set;for(let[I,v]of(s?.awsPairs??[]).entries()){let U=[["accessKeyIdVar",v.accessKeyIdVar],["secretAccessKeyVar",v.secretAccessKeyVar],["sessionTokenVar",v.sessionTokenVar]],oe=new Set;for(let[re,le]of U){if(le===void 0)continue;if(T.has(le))c.addIssue({code:_t.ZodIssueCode.custom,path:["awsPairs",I,re],message:`"${le}" appears in more than one awsPairs slot (within or across pairs) — each variable can fill exactly one slot.`});oe.add(le)}for(let re of oe)T.add(re)}}).optional()),Uc=e(()=>_t.object({enabled:_t.boolean().optional().describe("Run Bash commands inside the sandbox. Default: false. "+x_),failIfUnavailable:_t.boolean().optional().describe("Exit with an error at startup if sandbox.enabled is true but the sandbox cannot start (missing dependencies or unsupported platform). When false (default), a warning is shown and commands run unsandboxed. Intended for managed-settings deployments that require sandboxing as a hard gate. A Claude Code on the web, scheduled-task or Cowork cloud session (Anthropic's cloud container, which has no command sandbox) starts anyway with a warning: the container isolates it, and the sandbox.filesystem and sandbox.network rules in settings are not enforced there. "+x_),autoAllowBashIfSandboxed:_t.boolean().optional().describe("macOS and Linux/WSL only: approve a Bash command that will run inside the sandbox without a permission prompt, unless a deny rule, a command-specific ask rule or a safety check stops it. Default: false, so sandboxed commands go through the same permission flow as any other command. Has no effect on native Windows."),allowUnsandboxedCommands:_t.boolean().optional().describe(`Allow commands to run outside the sandbox via the dangerouslyDisableSandbox parameter. When false, the dangerouslyDisableSandbox parameter is completely ignored and all commands must run sandboxed. Default: true. A false in managed, --settings or user settings holds whatever ${Ro} say (false there still applies).`),network:W5(),filesystem:K5(),credentials:$5(),ignoreViolations:_t.record(_t.string(),_t.array(_t.string())).optional().describe('Sandbox violations to leave unreported: a map of command patterns ("*" for every command) to the filesystem paths whose violations are ignored. Merged across settings sources. '+Zr),enableWeakerNestedSandbox:_t.boolean().optional().describe("Linux only: Run without the fresh /proc mount, for hosts such as unprivileged Docker containers that cannot create one. "+"**Reduces security** — the host /proc stays readable by sandboxed commands. Default: false. "+Fa),allowNestedUserNamespaces:_t.boolean().optional().describe("Linux/WSL only: Let sandboxed commands create user namespaces of their own, which the sandbox refuses by default. Needed by tools that sandbox themselves that way, such as Chromium's and Electron's sandbox, a nested bubblewrap, and `unshare`. "+"**Removes code-execution isolation** — in any folder a hostile command may write, it can then bypass filesystem.denyWrite, filesystem.denyRead, credentials.files entries and the paths the sandbox always write-protects (such as .claude/settings.json, git hooks and git config), "+"and so plant code that later runs outside the sandbox; while autoAllowBashIfSandboxed is on, the command that plants it needs no approval. Default: false. "+"Only honored from user, managed/policy, or CLI (--settings) settings — "+`true from ${Ro} is ignored (false there still applies).`),enableWeakerNetworkIsolation:_t.boolean().optional().describe("macOS only: Allow access to com.apple.trustd.agent in the sandbox. Needed for Go-based CLI tools (gh, gcloud, terraform, etc.) to verify TLS certificates when using httpProxyPort with a MITM proxy and custom CA. "+"**Reduces security** — opens a potential data exfiltration vector through the trustd service. Default: false. "+Fa),allowAppleEvents:_t.boolean().optional().describe("macOS only: Allow sandboxed commands to send Apple Events (and look up the appleeventsd Mach service). Needed for `open`, `osascript`, and browser-based auth flows that open URLs. "+"**Removes code-execution isolation** — sandboxed commands can launch other applications "+"unsandboxed with no user prompt, and can script running apps (e.g. Terminal) subject to the user's per-app TCC automation consent. "+"Only honored from user, managed/policy, or CLI (--settings) settings — "+"project settings (.claude/settings.json and .claude/settings.local.json) are ignored. Default: false"),excludedCommands:_t.array(_t.string()).optional().describe("Command patterns (Bash permission-rule syntax) for commands to run outside the sandbox. An entry takes a call out of the sandbox only when every command in the call matches an entry: in a Bash pipe or a chain such as `a && b`, each part needs its own match. Some calls stay sandboxed whatever the entries, such as one with a `cd`, a command substitution, or a redirect other than a file-descriptor duplication like `2>&1`, a heredoc included. A convenience, not a security boundary: excluded commands still go through the permission flow. Merged across settings sources. "+Zr),ripgrep:_t.object({command:_t.string(),args:_t.array(_t.string()).optional()}).optional().describe("Custom ripgrep configuration for bundled ripgrep support. "+"Only honored from user, managed/policy, or CLI (--settings) settings — "+"project settings (.claude/settings.json and .claude/settings.local.json) are ignored."),bwrapPath:_t.preprocess((s)=>typeof s==="string"&&N_(s)?s:void 0,_t.string()).optional().catch(void 0).describe("Linux/WSL only: Absolute path to the bwrap (bubblewrap) binary. Overrides auto-detection via PATH. Only honored from admin-controlled managed settings."),socatPath:_t.preprocess((s)=>typeof s==="string"&&N_(s)?s:void 0,_t.string()).optional().catch(void 0).describe("Linux/WSL only: Absolute path to the socat binary used for the sandbox network proxy. Overrides auto-detection via PATH. Only honored from admin-controlled managed settings.")}).passthrough());import*as qs from"zod/v4";var or=["acceptEdits","auto","bypassPermissions","default","dontAsk","plan"],V5=[...or],F_=V5;function Qr(s){return s==="manual"?"default":s}var K_e=`Cannot set permission mode: must be one of ${or.join(", ")}`;var j_e={dangerousRemoval:{bypassImmune:!0,waivableInBypass:!0,classifierRouted:!0,autoModeDeny:!0,hostPersonOnly:!1,localProjectionOnly:!1,servedUnplaceable:!1},backgroundOperator:{bypassImmune:!1,waivableInBypass:!1,classifierRouted:!0,autoModeDeny:!1,hostPersonOnly:!1,localProjectionOnly:!1,servedUnplaceable:!1},suspiciousWindowsPath:{bypassImmune:!1,waivableInBypass:!1,classifierRouted:!0,autoModeDeny:!1,hostPersonOnly:!1,localProjectionOnly:!1,servedUnplaceable:!1},isolatePeerMachines:{bypassImmune:!0,waivableInBypass:!1,classifierRouted:!1,autoModeDeny:!1,hostPersonOnly:!1,localProjectionOnly:!1,servedUnplaceable:!1},restrictedMode:{bypassImmune:!0,waivableInBypass:!1,classifierRouted:!1,autoModeDeny:!1,hostPersonOnly:!1,localProjectionOnly:!1,servedUnplaceable:!1},outsideReadsBlocked:{bypassImmune:!0,waivableInBypass:!1,classifierRouted:!1,autoModeDeny:!1,hostPersonOnly:!1,localProjectionOnly:!1,servedUnplaceable:!1},claudeSettingsFile:{bypassImmune:!1,waivableInBypass:!1,classifierRouted:!1,autoModeDeny:!1,hostPersonOnly:!0,localProjectionOnly:!1,servedUnplaceable:!1},internalHardDeny:{bypassImmune:!1,waivableInBypass:!1,classifierRouted:!1,autoModeDeny:!1,hostPersonOnly:!1,localProjectionOnly:!1,servedUnplaceable:!0},connectorFileSend:{bypassImmune:!0,waivableInBypass:!1,classifierRouted:!1,autoModeDeny:!1,hostPersonOnly:!1,localProjectionOnly:!1,servedUnplaceable:!1},unfinishedCheck:{bypassImmune:!0,waivableInBypass:!1,classifierRouted:!1,autoModeDeny:!1,hostPersonOnly:!0,localProjectionOnly:!1,servedUnplaceable:!1},...{},...{},...{}};var Y5=["auto_mode_no_check_in_session","auto_mode_stop_no_check_in_session","auto_mode_stop_no_result_for_calls","auto_mode_stop_no_verdict"],$_e=["classifier_transcript_too_long","outside_reads_blocked","memory_paused",...Y5];var B_=["auto","iterm2","terminal_bell","iterm2_with_bell","kitty","ghostty","notifications_disabled"];var z_=["normal","vim"];var G_=["auto","12-hour","24-hour","24-hour-utc"],Qs=["auto","tmux","iterm2","in-process"],X5=["dark","light","light-daltonized","dark-daltonized","light-ansi","dark-ansi"],W_=["auto",...X5],K_=["auto","alwaysAsk","disabled"],j_=1e5,$_=1e6;import*as V_ from"zod/v4";import*as eo from"zod/v4/core";var J5=eo.$ZodType,Z5=V_.ZodType,Hc=eo.$constructor("ZodDeferredOptional",(s,c)=>{J5.init(s,c),Z5.init(s,c),s._zod.optin="optional",s._zod.optout="optional",Object.defineProperty(s._zod,"innerType",{get:c.built,configurable:!0}),s._zod.processJSONSchema=(T,I,v)=>{let U=c.getter();eo.process(U,T,v),T.seen.get(s).ref=U},eo.util.defineLazy(s._zod,"values",()=>{let T=c.getter()._zod.values;return T?new Set([...T,void 0]):void 0}),eo.util.defineLazy(s._zod,"pattern",()=>{let T=c.getter()._zod.pattern;return T?new RegExp(`^(${eo.util.cleanRegex(T.source)})?$`):void 0}),eo.util.defineLazy(s._zod,"propValues",()=>c.getter()._zod.propValues),s._zod.parse=(T,I)=>{if(T.value===void 0)return T;return c.getter()._zod.run(T,I)},s.unwrap=c.getter});function Yn(s){let c;return new Hc({type:"lazy",getter:()=>{if(c===void 0){let I=s();if(I._zod.optin!==void 0)throw Error("deferredOptional(): the schema the build callback returned already handles a missing key itself (.optional(), .catch(), .default(), .prefault(), z.preprocess(), or a union or wrapper holding one). Return the plain schema and let deferredOptional() make it optional, or use that schema with .optional() without deferring it.");c=I}return c},built:()=>c})}import*as lt from"zod/v4";var q5=String.raw`\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-[^}]*)?\}`;function Y_(s){return new RegExp(q5).test(s)}var X_=/(?<![^\s\p{P}])\p{M}+/gu;function Q5(s){return un(n3(Be(s))).replace(/ {2,}/g," ").trim()}var e3=/\x1b\[[\x30-\x3f]*[\x20-\x2f]*[\x40-\x7e]|\x1b[\]PX^_][^\x1b\x07]*(?:\x07|\x1b\\)/g,t3=4;function n3(s){let c=s;for(let T=0;T<t3;T++){let I=c.replace(e3,"");if(I===c)break;c=I}return c}function Fc(s,c=160){return o3(Q5(r3(s,c)).normalize("NFC").replace(/[`\uff40\u02cb\u1fef\u2035]/g,"'").replace(X_,""),c)}var aEe=new RegExp(`[^\\S ]|[${K}]`,"u");function o3(s,c=2000){return s.length>c?`${he(s,c)}…`:s}function r3(s,c){let T=he(s,c*8);if(T.length===s.length)return T;let I=/\x1b(?:[\]PX^_][^\x1b\x07]*\x1b?|\[[\x30-\x3f]*[\x20-\x2f]*)$/.exec(T);if(I===null)return T;let v=s.slice(I.index);return(v[1]==="["?/^\x1b\[[\x30-\x3f]*[\x20-\x2f]*[\x40-\x7e]/.test(v):/^\x1b[\]PX^_][^\x1b\x07]*(?:\x07|\x1b\\)/.test(v))?T.slice(0,I.index):T}var dEe=d({accepted:!1},(s)=>{s.accepted=!1});function Bc(s){let c=u3();return Object.hasOwn(c,s)?c[s]:s}var J_="workspace",EEe=`mcp__${J_}__bash`,hEe=`mcp__${J_}__web_fetch`;function ei(s){return s.includes("*")}function i3(s){return s.replaceAll("\\","\\\\").replaceAll("(","\\(").replaceAll(")","\\)")}function a3(s){return l3(s).replaceAll("\\\\","\\")}function l3(s){return s.replaceAll("\\(","(").replaceAll("\\)",")")}function zc(s){if(typeof s==="string"&&!s.includes("(")&&!s.includes(")"))return{kind:"bare"};let c=c3(s,"("),T=d3(s,")");if(c===-1&&T===-1)return{kind:"bare"};let I=s.substring(0,c);if(c===-1||T<=c||T!==s.length-1||/[()]/.test(I))return{kind:"malformed"};return{kind:"call",toolName:I,rawContent:s.substring(c+1,T)}}function Z_(s){let c=zc(s);if(c.kind!=="call"||!c.toolName)return{toolName:Bc(s)};if(c.rawContent===""||c.rawContent==="*")return{toolName:Bc(c.toolName)};let T=a3(c.rawContent);return{toolName:Bc(c.toolName),ruleContent:T}}function Bn(s){if(!s.ruleContent)return s.toolName;let c=i3(s.ruleContent);return`${s.toolName}(${c})`}function c3(s,c){for(let T=0;T<s.length;T++)if(s[T]===c){let I=0,v=T-1;while(v>=0&&s[v]==="\\")I++,v--;if(I%2===0)return T}return-1}function d3(s,c){for(let T=s.length-1;T>=0;T--)if(s[T]===c){let I=0,v=T-1;while(v>=0&&s[v]==="\\")I++,v--;if(I%2===0)return T}return-1}function u3(){return Ke}function ti(s){let c=s.replace(/[^a-zA-Z0-9_-]/g,"_");if(s.startsWith("claude.ai "))c=c.replace(/_+/g,"_").replace(/^_|_$/g,"");return c}function q_(){return{active:!1,enforcesGrants:!1,readLegacyKeyOwner:()=>{return},claimLegacyKeyOwner:async()=>{return},legacyKeyOwners:new Map,unsavedLegacyKeys:new Set,refusedLegacyKeys:new Map,claimedMayNotOwn:new Set,notedMayNotOwn:new Set,needsRebuild:!1,servers:new Map,tools:new Map,wireByInternal:new Map,internalByWire:new Map,wireKeyByInternalKey:new Map,internalKeyByWireKey:new Map,keptLegacyNames:0,serverKeyMoved:!1,sessionKeyById:new Map,formerKeys:new Map,formerSessionKeys:new Map,spelledKeys:new Map,otherDenyOrAskNames:new Map,retiredWireNames:new Map,wireHolders:new Map,sentWires:new Map}}var KEe=new pe(q_),jEe=new i(()=>({used:!1})),$Ee=q_();function p3(s,c){return s.value===!c&&s.source==="payload"&&s.defaultHost?!c:c}class ni{reader=null;register(s){let c=this.reader;return this.reader=s,c}read(s,c){let T=this.reader;if(!T)return c;try{return p3(T(s,c),c)}catch{return c}}}var JEe=new ni;var QEe=new ni;var f3="mcp__";function es(s){let c=s.split("__"),[T,I,...v]=c;if(T!=="mcp"||!I)return null;let U=v.length>0?v.join("__"):void 0;return{serverName:I,toolName:U}}function Gc(s){return`${f3}${ti(s)}__`}function Q_(s){return es(`${Gc(s)}t`)===null}function eE(s){return s in Object.prototype&&Q_(s)}var Ka="server names may only contain letters, numbers, hyphens and underscores, and may not be constructor, prototype, __proto__, __defineGetter__, __defineSetter__, __lookupGetter__ or __lookupSetter__";var Ihe=e(()=>lt.enum(["local","user","project","dynamic","enterprise","claudeai","managed","agent"]));var m3=/^[A-Za-z0-9_-]+$/;var ts=e(()=>lt.literal("comms").optional().catch(void 0)),jo=e(()=>lt.number().int().positive()),g3=300000,tE=e(()=>lt.number().int().positive().optional().catch(void 0).describe("@internal CCR backend wire hint; folded into timeout at parse."));function nE({request_timeout_ms:s,...c}){return{...c,...c.timeout===void 0&&s!==void 0&&{timeout:Math.min(s,g3)}}}var _3=e(()=>lt.object({type:lt.literal("stdio").optional(),command:lt.string().min(1,"Command cannot be empty"),args:lt.array(lt.string()).default([]),env:lt.record(lt.string(),lt.string()).optional(),timeout:jo().optional(),alwaysLoad:lt.boolean().optional(),bareElicitationCapability:lt.boolean().optional(),role:ts()})),E3=e(()=>lt.boolean()),h3=65536,ns=()=>lt.string().refine((s)=>s.length<=h3,{abort:!0,message:"url is too long"}),S3=4096,oE=e(()=>lt.object({clientId:lt.string().optional(),callbackPort:lt.number().int().positive().optional(),authServerMetadataUrl:lt.string().refine((s)=>s.length<=S3,{abort:!0,message:"authServerMetadataUrl is too long"}).url().startsWith("https://",{message:"authServerMetadataUrl must use https://"}).optional(),scopes:lt.string().min(1).optional(),xaa:E3().optional()})),Wc=e(()=>lt.object({name:lt.string(),permission_policy:lt.enum(["always_allow","always_ask","always_deny"]).optional()})),rE=e(()=>lt.object({type:lt.literal("sse"),url:ns(),headers:lt.record(lt.string(),lt.string()).optional(),headersHelper:lt.string().optional(),oauth:oE().optional(),timeout:jo().optional(),request_timeout_ms:tE(),tools:lt.array(Wc()).optional(),alwaysLoad:lt.boolean().optional(),displayName:lt.string().optional().catch(void 0),bareElicitationCapability:lt.boolean().optional(),discoveryCache:lt.boolean().optional(),role:ts(),toolPermissions:lt.record(lt.string(),Vc()).optional()}).transform(nE)),y3=e(()=>lt.object({type:lt.literal("sse-ide"),url:ns(),ideName:lt.string(),ideRunningInWindows:lt.boolean().optional(),timeout:jo().optional(),alwaysLoad:lt.boolean().optional(),role:ts()})),O3=e(()=>lt.object({type:lt.literal("ws-ide"),url:ns(),ideName:lt.string(),authToken:lt.string().optional(),ideRunningInWindows:lt.boolean().optional(),timeout:jo().optional(),alwaysLoad:lt.boolean().optional(),role:ts()})),sE=e(()=>lt.object({type:lt.enum(["http","streamable-http"]).transform(()=>"http"),url:ns(),headers:lt.record(lt.string(),lt.string()).optional(),headersHelper:lt.string().optional(),oauth:oE().optional(),timeout:jo().optional(),request_timeout_ms:tE(),tools:lt.array(Wc()).optional(),alwaysLoad:lt.boolean().optional(),displayName:lt.string().optional().catch(void 0),bareElicitationCapability:lt.boolean().optional(),discoveryCache:lt.boolean().optional(),role:ts(),toolPermissions:lt.record(lt.string(),Vc()).optional()}).transform(nE)),A3=["command","args","env","headersHelper"],C3=new Set(["http","streamable-http","sse"]),b3=/[\p{Cc}\p{Cf}\u2028\u2029]/u,R3=/[\p{Cc}\p{Cf}\u2028\u2029]/gu;function Kc(s){return/^[A-Za-z0-9_-]+$/.test(s)&&!eE(s)&&s!=="constructor"&&s!=="prototype"}function T3(s){try{let c=new URL(s);return c.protocol==="https:"&&c.hostname!==""}catch{return!1}}function iE(s,c="",T=0){if(typeof s==="string")return[[c,s,!1]];if(T>4||s===null||typeof s!=="object")return[];return Object.entries(s).flatMap(([I,v])=>{let U=I.replace(R3,(re)=>`\\u${re.codePointAt(0).toString(16).padStart(4,"0")}`),oe=c?`${c}.${U}`:U;return[[oe,I,!0],...iE(v,oe,T+1)]})}var jc=e(()=>lt.record(lt.string(),lt.unknown()).check((s)=>{let c=(I,v)=>{s.issues.push({code:"custom",path:I,message:v,input:s.value})};for(let I of A3)if(Object.hasOwn(s.value,I))c([I],`"${I}" is not allowed in managed settings: only http/sse URL servers can be delivered this way, and a managed settings document must not name a program to run`);if(!C3.has(s.value.type))c(["type"],'managed settings can only deliver "http" or "sse" servers');let T=s.value.url;if(typeof T==="string"&&!T3(T))c(["url"],"managed settings servers must use a valid https:// url");for(let[I,v,U]of iE(s.value))if(b3.test(v))c(I.split("."),"contains control or invisible format characters (in a key or a value); a managed settings document must not be able to print escape sequences");else if(!U&&Y_(v))c(I.split("."),"${VAR} references are not expanded in managed settings; use a literal value (a managed settings document must not read the user's environment)")}).pipe(lt.union([sE(),rE()]))),$c=`"managedMcpServers" must be an object keyed by server name (the .mcp.json mcpServers shape; Claude Desktop's array form of its same-named key is not accepted here: use the server name as the key and "type" instead of "transport"). No managed MCP servers are installed from it until it is fixed.`;function ja(s,c){if(s===void 0)return;if(s===null||typeof s!=="object"||Array.isArray(s)){c("",$c);return}let T=Object.create(null);for(let[I,v]of Object.entries(s)){if(!Kc(I)){c("<invalid name>",Ka);continue}let U=jc().safeParse(v);if(U.success){T[I]=U.data;continue}let oe=U.error.issues[0];c(I,oe?[oe.path.join("."),oe.message].filter(Boolean).join(": "):"failed validation")}return T}var D3=e(()=>lt.object({type:lt.literal("ws"),url:ns(),headers:lt.record(lt.string(),lt.string()).optional(),headersHelper:lt.string().optional(),timeout:jo().optional(),alwaysLoad:lt.boolean().optional(),bareElicitationCapability:lt.boolean().optional(),role:ts()})),L3=e(()=>lt.object({type:lt.literal("sdk"),name:lt.string(),timeout:jo().optional(),alwaysLoad:lt.boolean().optional(),disableAutoBackground:lt.boolean().optional().catch(void 0),tools:lt.array(Wc()).optional().catch(void 0),connectorId:lt.string().min(1).optional().catch(void 0),autoModeVerdictTools:lt.array(lt.string()).optional().catch(void 0),dataFlowServer:I3().optional().catch(void 0)})),I3=e(()=>lt.union([lt.object({type:lt.literal("anthropic"),id:lt.string().min(1)}),lt.object({type:lt.literal("claude_ai_connector"),id:lt.string().min(1),directory_id:lt.string().min(1).nullable()}),lt.object({type:lt.literal("client_configured"),transport:lt.enum(["stdio","http","in_process"]),plugin_id_hash:lt.string().min(1).optional()})])),Vc=e(()=>lt.enum(["allow","ask","blocked"])),w3=e(()=>lt.object({type:lt.literal("claudeai-proxy"),url:ns(),id:lt.string().regex(m3),displayName:lt.string().optional(),urlReportable:lt.boolean().optional(),noDirectoryEntry:lt.boolean().optional(),iconUrl:lt.string().optional(),timeout:jo().optional(),alwaysLoad:lt.boolean().optional(),toolPermissions:lt.record(lt.string(),Vc()).optional(),stateless:lt.boolean().optional(),cachedInitResponse:lt.record(lt.string(),lt.unknown()).nullish(),discoverSupport:lt.enum(["supported","legacy","unknown"]).optional().catch(void 0),cachedDiscoverResponse:lt.record(lt.string(),lt.unknown()).nullish(),eligible:lt.boolean().nullish(),ineligibleReason:lt.string().nullish(),enterpriseManaged:lt.boolean().optional()})),$a=e(()=>lt.union([_3(),rE(),y3(),O3(),sE(),D3(),L3(),w3()]));var whe=e(()=>lt.object({mcpServers:lt.record(lt.string(),$a())}));import*as os from"zod/v4";var oi=["anthropic","customEndpoint","bedrock","vertex","foundry","anthropicAws","mantle","gateway"],P3=/^anthropic[A-Z][A-Za-z0-9]*$/,N3=new Set(oi);function Yc(s){return typeof s==="string"&&N3.has(s)}function Xc(s){return Yc(s)||typeof s==="string"&&P3.test(s)}var rr="Your session can't run on this machine",xhe=`${rr}: its requests must go to Anthropic's API or a cloud provider this machine is set up for, so a gateway, a custom endpoint, or a project's provider, credential or model settings aren't allowed. Remove the setting, such as ANTHROPIC_BASE_URL, from wherever it's set, or ask whoever runs this machine to.`,khe=`${rr}: an env entry in a project's .claude settings file changes the provider settings, credentials, proxy, certificates, headers, request body or auto mode settings this machine is set up with. Remove that entry, set the same value on the machine, or ask whoever runs this machine to.`,vhe=`${rr}: none of the models allowed for its auto mode check can be used here. Ask whoever runs this machine to update Claude Code or use a provider that offers one of them, and ask your organization's administrator whether its model settings block them or, on Microsoft Foundry, to map one to a deployment.`,Mhe=[`${rr}: its requests must go straight to Anthropic's API, and this machine sends them somewhere else. Remove what does that, or ask whoever runs this machine to. It is usually a setting such as CLAUDE_CODE_USE_BEDROCK or ANTHROPIC_BASE_URL, in the environment, in managed settings or in a Claude Code settings file such as the project's .claude/settings.json.`,`${rr}: its requests must go to Anthropic's API, or straight to a cloud provider Anthropic allows for these sessions with no custom endpoint, and this machine sends them somewhere else. Remove the custom endpoint, gateway or provider setting that does that, in the environment, managed settings or a Claude Code settings file, or ask whoever runs this machine to.`,`${rr}: it needs the server's auto mode check, and CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS turns that off here. Remove it from the environment, managed settings or the Claude Code settings file that sets it, or ask whoever runs this machine to.`],Uhe=`${rr}: it needs the server's auto mode check, and your organization's compliance policy rules that out, so this kind of session can't run for your organization.`;import*as rs from"zod/v4";var Bhe=g()==="macos"?"⏺":"●";var x3=new Set(["Claude Preview","Claude Browser"]),k3=new Set(["claude-in-chrome","Claude in Chrome"]),nSe=new Set([...k3,...x3]);var v3=["Claude_Browser__"],M3=["claude-in-chrome__","Claude_in_Chrome__"],oSe=[...v3,...M3];var fSe=e(()=>rs.preprocess(Qr,rs.enum(F_))),mSe=e(()=>rs.preprocess(Qr,rs.enum(or)));import{posix as e9,win32 as t9}from"path";import*as _e from"zod/v4";var aE={".ts":"ts",".tsx":"tsx",".jsx":"jsx",".js":"js",".mjs":"js",".cjs":"js",".mts":"ts",".cts":"ts"};var Jc=Object.keys(aE);var F3=`${Jc.slice(0,-1).join(", ")} or `+String(Jc.at(-1));import{isIPv4 as B3,isIPv6 as z3}from"net";var G3=new Set(["metadata.google.internal","metadata.goog","metadata","instance-data","instance-data.ec2.internal","ip6-localhost","ip6-loopback","localhost.localdomain","localhost4","localhost4.localdomain4","localhost6","localhost6.localdomain6"]),cE=new Set(["100.100.100.200","168.63.129.16","192.0.0.192"]),W3=new Set(["fd00:ec2::254","fd00:ec2::23","fd20:ce::254","fd00:c1::a9fe:a9fe","fd00:a9fe:a9fe::1"].map((s)=>String(uE(s))));function dE(s,c,T,I){return s===127||s===169&&c===254||s===0}function uE(s){let c=s.indexOf("%"),I=(c>=0?s.slice(0,c):s).toLowerCase().split("::");if(I.length>2)return;let v=I[0]?I[0].split(":"):[],U=I.length===2&&I[1]?I[1].split(":"):[],oe=I.length===2?U:v,re=[],le=oe.at(-1);if(le!==void 0&&le.includes(".")){let Ze=le.split(".").map(Number);if(Ze.length!==4||Ze.some(($e)=>!Number.isInteger($e)||$e<0||$e>255))return;re=Ze,oe.pop()}let ye=(Ze)=>{let $e=[];for(let dt of Ze){if(!/^[0-9a-f]{1,4}$/.test(dt))return;let Me=parseInt(dt,16);$e.push(Me>>8,Me&255)}return $e},Re=ye(I.length===2?v:[]),Ie=ye(oe);if(Re===void 0||Ie===void 0)return;let Le=Re.length+Ie.length+re.length;if(Le>16||I.length===1&&Le!==16)return;return[...Re,...Array(16-Le).fill(0),...Ie,...re]}function K3(s){return pE(s)&&s[4]===0&&s[5]===1}function pE(s){return s[0]===0&&s[1]===100&&s[2]===255&&s[3]===155}function j3(s){let c=[];if(s[0]===32&&s[1]===2)c.push(s.slice(2,6));let T=s.slice(0,10).every((re)=>re===0),I=T&&s[10]===255&&s[11]===255,v=T&&s[10]===0&&s[11]===0,U=pE(s)&&s.slice(4,12).every((re)=>re===0),oe=(s[8]===0||s[8]===2)&&s[9]===0&&s[10]===94&&s[11]===254;if(I||v||U||oe)c.push(s.slice(12,16));return c}function fE(s){let c=s.toLowerCase().replace(/^\[|\]$/g,"");if(c.endsWith("."))c=c.slice(0,-1);if(c===""||c==="localhost"||c.endsWith(".localhost"))return!0;if(G3.has(c))return!0;if(c.startsWith("instance-data.")&&c.endsWith(".compute.internal"))return!0;if(B3(c)){if(cE.has(c))return!0;let[I=0,v=0,U=0,oe=0]=c.split(".").map(Number);return dE(I,v,U,oe)}if(!z3(c))return!1;let T=uE(c);if(T===void 0)return!0;if(K3(T))return!0;if(T.every((I)=>I===0))return!0;if(T.slice(0,15).every((I)=>I===0)&&T[15]===1)return!0;if(W3.has(String(T)))return!0;if(T[0]===254&&(T[1]??0)>=128&&(T[1]??0)<=191)return!0;return j3(T).some((I)=>{let[v=0,U=0,oe=0,re=0]=I;return dE(v,U,oe,re)||cE.has(`${v}.${U}.${oe}.${re}`)})}import*as St from"zod/v4";var mE=["bash","powershell"];import*as gE from"zod/v4";var _E=e(()=>gE.enum(["continue","block"]).optional());var ri=e(()=>St.string().optional().describe('Permission rule syntax to filter when this hook runs (e.g., "Bash(git *)"). Only runs if the tool call matches the pattern. Avoids spawning hooks for non-matching commands.')),EE=e(()=>_E().describe("What a failure of this hook does: it could not start (a missing script or plugin directory), timed out, exited with a code other than 0 or 2, or printed JSON that is invalid or fails validation. 'continue' (default): the failure is reported and the action goes ahead. 'block': the failure counts as exit code 2, so the action the event guards (a tool call, a permission request, a prompt) is blocked. Ignored for async hooks and on Stop, SubagentStop, TaskCompleted and TeammateIdle."));function $3(){let s=St.object({type:St.literal("command").describe("Shell command hook type"),command:St.string().describe("Shell command to execute"),args:St.array(St.string()).optional().describe("Argument list for exec form. When present, `command` is resolved as "+"an executable and spawned directly with these arguments — no shell. "+"Path placeholders like ${CLAUDE_PLUGIN_ROOT} are substituted per-element as plain strings, so paths with quotes, $, or backticks never reach a shell parser. When absent, `command` runs through a shell (bash on POSIX, PowerShell on Windows without Git Bash)."),if:ri(),shell:St.enum(mE).optional().describe("Shell interpreter. 'bash' uses your $SHELL (bash/zsh/sh); 'powershell' uses pwsh. Defaults to bash (powershell on Windows without Git Bash)."),timeout:St.number().positive().optional().describe("Timeout in seconds for this specific command"),onFailure:EE(),statusMessage:St.string().optional().describe("Custom status message to display in spinner while hook runs"),once:St.boolean().optional().describe("If true, hook runs once and is removed after execution"),async:St.boolean().optional().describe("If true, hook runs in background without blocking"),asyncRewake:St.boolean().optional().describe("If true, hook runs in background and wakes the model on exit code 2 (blocking error). Implies async."),rewakeMessage:St.string().min(1).optional().describe("@internal Custom prefix for the system-reminder shown to the model when an asyncRewake hook exits with code 2. The hook output is appended after this prefix."),rewakeSummary:St.string().min(1).optional().describe('@internal One-line summary shown to the user in the terminal when an asyncRewake hook exits with code 2. Defaults to "Stop hook feedback".'),cloud:St.enum(["device","skip"]).optional().catch("skip").describe("@internal Where this hook may run when a cloud session is driven from this machine. 'device': offer it to the cloud session and run it here even when its script sits where the cloud session can write on this machine or cannot be pinned — the author accepts that the session may have changed files this hook executes. 'skip': never offer it to cloud sessions. Omit for the default: a command hook whose script could be read and pinned and lies outside everything the cloud session can write here is offered; other command hooks are not. Applies to this entry only: the same hook written in another settings scope keeps its own setting. An unrecognised value reads as 'skip' (the file still loads; the hook stays on this machine).")}),c=St.object({type:St.literal("prompt").describe("LLM prompt hook type"),prompt:St.string().describe("Prompt to evaluate with LLM. Use $ARGUMENTS placeholder for hook input JSON."),if:ri(),timeout:St.number().positive().optional().describe("Timeout in seconds for this specific prompt evaluation"),model:St.string().optional().describe('Model to use for this prompt hook (e.g., "claude-sonnet-5"). If not specified, uses the default small fast model.'),continueOnBlock:St.boolean().optional().describe(`Sets the continue value for the decision:"block" produced when ok is false. Default false (turn ends). Whether continue:true lets the turn proceed depends on the event's decision:"block" semantics. On PostToolUse, the reason is fed back to Claude and the turn continues.`),statusMessage:St.string().optional().describe("Custom status message to display in spinner while hook runs"),once:St.boolean().optional().describe("If true, hook runs once and is removed after execution")}),T=St.object({type:St.literal("mcp_tool").describe("MCP tool hook type"),server:St.string().describe("Name of an already-configured MCP server to invoke"),tool:St.string().describe("Name of the tool on that server to call"),input:St.record(St.string(),St.unknown()).optional().describe('Arguments passed to the MCP tool. String values support ${path} interpolation from the hook input JSON (e.g. "${tool_input.file_path}").'),if:ri(),timeout:St.number().positive().optional().describe("Timeout in seconds for this specific tool call"),statusMessage:St.string().optional().describe("Custom status message to display in spinner while hook runs"),once:St.boolean().optional().describe("If true, hook runs once and is removed after execution")}),I=St.object({type:St.literal("http").describe("HTTP hook type"),url:St.string().url().describe("URL to POST the hook input JSON to"),if:ri(),timeout:St.number().positive().optional().describe("Timeout in seconds for this specific request"),onFailure:EE(),headers:St.record(St.string(),St.string()).optional().describe('Additional headers to include in the request. Values may reference environment variables using $VAR_NAME or ${VAR_NAME} syntax (e.g., "Authorization": "Bearer $MY_TOKEN"). Only variables listed in allowedEnvVars will be interpolated.'),allowedEnvVars:St.array(St.string()).optional().describe("Explicit list of environment variable names that may be interpolated in header values. Only variables listed here will be resolved; all other $VAR references are left as empty strings. Required for env var interpolation to work."),statusMessage:St.string().optional().describe("Custom status message to display in spinner while hook runs"),once:St.boolean().optional().describe("If true, hook runs once and is removed after execution"),cloud:St.enum(["device","skip"]).optional().catch("skip").describe("@internal Where this hook may run when a cloud session is driven from this machine. 'skip': never offer it to cloud sessions; 'device' or omitted: offered (an HTTP hook has no script to pin). Applies to this entry only. An unrecognised value reads as 'skip' (the file still loads).")}),v=St.object({type:St.literal("agent").describe("Agentic verifier hook type"),prompt:St.string().describe('Prompt describing what to verify (e.g. "Verify that unit tests ran and passed."). Use $ARGUMENTS placeholder for hook input JSON.'),if:ri(),timeout:St.number().positive().optional().describe("Timeout in seconds for agent execution (default 60)"),model:St.string().optional().describe('Model to use for this agent hook (e.g., "claude-sonnet-5"). If not specified, uses Haiku.'),statusMessage:St.string().optional().describe("Custom status message to display in spinner while hook runs"),once:St.boolean().optional().describe("If true, hook runs once and is removed after execution")});return{BashCommandHookSchema:s,PromptHookSchema:c,HttpHookSchema:I,AgentHookSchema:v,McpToolHookSchema:T}}var Va=e(()=>{let{BashCommandHookSchema:s,PromptHookSchema:c,AgentHookSchema:T,HttpHookSchema:I,McpToolHookSchema:v}=$3();return St.discriminatedUnion("type",[...[s,c,T,I,v]])}),Zc=e(()=>St.object({matcher:St.string().optional().describe('String pattern to match (e.g. tool names like "Write")'),hooks:St.array(Va()).describe("List of hooks to execute when the matcher matches")})),ar=e(()=>St.partialRecord(St.enum(z),St.array(Zc())));function Ya(){return new Set(Va().options.map((s)=>s.shape.type.value))}function V3(s,c){if(!s||typeof s!=="object"||Array.isArray(s)){let v=sr(s);return{problem:`Hook entry must be an object; received ${v}`,received:v,aboutType:!1}}let T=s.type;if(typeof T!=="string"){let v=sr(T);return{problem:T===void 0?'Hook entry has no "type"':`Hook entry "type" must be a string; received ${v}`,received:v,aboutType:!0}}if(!c.has(T)){let v=et(T);return{problem:`Unknown hook type "${v}"`,received:v,aboutType:!0}}let I=Va().safeParse(s);if(!I.success)return{problem:`Invalid ${T} hook (${hE(I.error)})`,received:T,aboutType:!1};return}function hE(s){return s.issues.map((c)=>c.path.length>0?`${c.path.join(".")}: ${c.message}`:c.message).join("; ")}function Xa(s){if(!s||typeof s!=="object"||Array.isArray(s))return!1;if(!("matcher"in s)&&Object.keys(s).some((T)=>z.includes(T)))return!1;let c=s.hooks;if(Array.isArray(c))return c.length>0;return!!c&&typeof c==="object"&&(("matcher"in s)||typeof c.type==="string")}function ir(s,c=3,{matchersCount:T=!0,unscannedKeys:I=Y3,inHooksList:v=!1}={}){if(OE(s))return!0;if(T&&Xa(s))return!0;if(c===0||!s||typeof s!=="object")return!1;if(Array.isArray(s))return s.some((U)=>ir(U,c-1,{matchersCount:T,unscannedKeys:I,inHooksList:v}));if(v&&typeof s.type==="string")return!1;return Object.entries(s).some(([U,oe])=>!I.has(U)&&ir(oe,c-1,{unscannedKeys:I,matchersCount:T&&!z.includes(U),inHooksList:U==="hooks"&&Array.isArray(oe)}))}function SE(s,c){if(!s||typeof s!=="object"||Array.isArray(s))return!1;return OE(s)||Object.entries(s).some(([T,I])=>T!=="hooks"&&!c.has(T)&&ir(I,3,{unscannedKeys:c,matchersCount:!z.includes(T)}))}var Y3=new Set,yE=new Set(["mcpServers","managedMcpServers","lspServers","pluginConfigs","enabledPlugins","extraKnownMarketplaces","env","skillOverrides","modelSettings"]),X3=new Set(["metadata","mcpServers","lspServers"]),vSe=new Set([...X3,"experimental"]);function OE(s){if(!s||typeof s!=="object"||Array.isArray(s))return!1;return Object.entries(s).some(([c,T])=>si.has(c)&&T!==null&&T!==void 0&&!(Array.isArray(T)&&T.length===0))}function qc(s){if(Xa(s))return!0;if(Array.isArray(s))return s.some(qc);if(!s||typeof s!=="object")return!1;return Object.entries(s).some(([c,T])=>si.has(c)&&T!==null&&T!==void 0&&!(Array.isArray(T)&&T.length===0))}var si=new Set(["PreToolUse","PermissionRequest"]);function AE(s,c){if(!Array.isArray(s))return{stripped:[],unloadableGuards:[]};let T=si.has(c),I=Ya(),v=Zc(),U=[],oe=[];for(let re=s.length-1;re>=0;re--){let le=s[re],ye=(Ze,$e)=>{if(!T)s.splice(re,1);U.push({hookIndex:void 0,path:`${re}`,problem:Ze,received:$e,aboutType:!1})};if(ir(le,3,{matchersCount:!1})){(T?U:oe).push({hookIndex:void 0,path:`${re}`,problem:"holds PreToolUse/PermissionRequest hooks where a matcher was expected",received:sr(le),aboutType:!1});continue}if(!le||typeof le!=="object"||Array.isArray(le)){ye(`Hook matcher must be an object; received ${sr(le)}`,sr(le));continue}let Re=le.hooks;if(!Array.isArray(Re)){ye(`Hook matcher "hooks" must be an array of hook entries; received ${sr(Re)}`,sr(Re));continue}let Ie=[];for(let Ze=Re.length-1;Ze>=0;Ze--){let $e=V3(Re[Ze],I);if($e!==void 0){if(!T)Re.splice(Ze,1);Ie.push({hookIndex:Ze,path:`${re}.hooks.${Ze}`,...$e})}}let Le=v.safeParse(T?{...le,hooks:[]}:le);if(!Le.success){ye(`Invalid hook matcher (${hE(Le.error)})`,"matcher");continue}U.push(...Ie)}return U.reverse(),oe.reverse(),T?{stripped:[],unloadableGuards:U}:{stripped:U,unloadableGuards:oe}}var To="a PreToolUse/PermissionRequest hook that cannot be loaded may be what guards the permissions declared beside it, so nothing it sits in is applied until the entry is fixed or removed";function sr(s){if(s===null||s===void 0)return String(s);if(Array.isArray(s))return"an array";let c=typeof s;return`${c==="object"?"an":"a"} ${c}`}var CE=new Set(["http","https","ws","wss","ftp"]);function lr(s){s=s.replace(/^[\x00-\x20]+/,"").replace(/[\t\n\r]/g,"");let c=s.indexOf("://");if(c===-1)return!1;let T=s.slice(c+3),I=s.slice(0,c).toLowerCase();if(CE.has(I)){let oe=T.match(/^[/\\]+/)?.[0]??"";if(oe.includes("\\"))return!0;T=T.slice(oe.length)}let v=T.search(/[/?#]/);return(v===-1?T:T.slice(0,v)).includes("\\")}var zn="github.com",zSe=[`git@${zn}:`,`ssh://git@${zn}/`],GSe=[`https://${zn}`,`https://${zn}/`,zn],WSe=`users.noreply.${zn}`;var J3=/[:/\\?#@\s]/;function ii(s){let c=RE(s.replace(/[\t\n\r]/g,"").toLowerCase());if(c===""||J3.test(c))return c;try{let T=new URL(`https://${c}`);if(T.username!==""||T.password!==""||T.port!==""||T.pathname!=="/"||T.search!==""||T.hash!=="")return c;return RE(T.hostname)}catch{return c}}var TE=fa(function(c){let T=ii(c);while(T.startsWith("www."))T=T.slice(4);return T},(s)=>s,50);function DE(s,c){return TE(s)===c}function $o(s){return DE(s,zn)}function bE(s){return/[%\x00-\x1f\x7f-\u{10FFFF}]/u.test(s)}function Qc(s){if(xe(s))return!0;if(s.includes("://")){if(lr(s))return!0;try{let v=new URL(s);if(v.protocol==="http:"||v.protocol==="https:")return!1;return bE(v.hostname)}catch{return!0}}let c=s.indexOf(":"),T=s.indexOf("@");if(c>=0&&T>c)return!0;let I=s.match(/^(?:[^@]+@)?([^:]+):/)?.[1];return I?bE(I):!1}function RE(s){let c=s.length;while(c>0&&s[c-1]===".")c--;return s.slice(0,c)}function ed(s){let c=ii(s);return $o(c)?zn:c}function LE(s){let c=s.trimStart(),T=/^([A-Za-z][A-Za-z0-9+.-]*):\/\//.exec(c);if(T===null||/^https?$/i.test(T[1]??""))return te(c);return te(T[0]+ze(c.slice(T[0].length)))}function IE(s){let c=/^([^@:/[\]]+)@([^@:/[\]]+):(.*)$/s.exec(s);return c&&!xe(s)?{user:c[1],host:c[2],path:c[3]}:null}import*as ss from"zod/v4";var Q3=64;class is{fields;activeWhenAbsent;keys;built=new Map;byPresentKeys=new Map;wholeSchema;constructor(s,c=new Set){this.fields=s;this.activeWhenAbsent=c;this.keys=Object.keys(s).filter((T)=>s[T]!==void 0)}has(s){return Object.hasOwn(this.fields,s)&&this.fields[s]!==void 0}field(s){let c=this.built.get(s);if(c)return c;let T=this.has(s)?this.fields[s]:void 0;if(!T)return;let I=T();return this.built.set(s,I),I}carries(s,c){return this.activeWhenAbsent.has(c)||typeof s==="object"&&s!==null&&c in s}whole(){return this.wholeSchema??=ss.object(this.shapeOf(this.keys)).passthrough(),this.wholeSchema}forDocument(s,c="passthrough"){let T=this.keys.filter((re)=>this.carries(s,re));if(T.length===this.keys.length&&c==="passthrough")return this.whole();let I=`${c}
${T.join(`
`)}`,v=this.byPresentKeys.get(I);if(v)return this.byPresentKeys.delete(I),this.byPresentKeys.set(I,v),v;let U=this.shapeOf(T),oe=c==="strip"?ss.preprocess((re,le)=>{for(let ye of this.wrongDocumentIssues(re,U))le.addIssue(ye);return re},ss.object(U)):ss.object(U).passthrough().check((re)=>{re.issues.push(...this.wrongDocumentIssues(re.value,U))});if(this.byPresentKeys.size>=Q3)for(let re of this.byPresentKeys.keys()){this.byPresentKeys.delete(re);break}return this.byPresentKeys.set(I,oe),oe}wrongDocumentIssues(s,c){if(typeof s!=="object"||s===null)return[];let T=[];for(let I of Object.keys(s))if(!Object.hasOwn(c,I)&&this.has(I))T.push({code:"custom",input:s[I],path:[I],message:"This settings schema was built for a document without this key"});return T}shapeOf(s){let c={};for(let T of s){let I=this.field(T);if(I)c[T]=I}return c}}var wE=600;var ad=500,n9=32;function UE(){return{claudeaiPluginId:_e.string().max(128).optional().catch(void 0),archiveSha256:Sh().optional().catch(void 0)}}function HE(){return{directoryRepositoryKey:_e.string().max(4096).optional().catch(void 0)}}function FE(s){if(!/^https?:\/\/[^/\\]/i.test(s))return!1;try{let{protocol:c}=new URL(s);return c==="https:"||c==="http:"}catch{return!1}}function BE(){return{sourceCommand:_e.string().max(ad+20).optional().catch(void 0).describe("The `command`-source command the user accepted at explicit install/update. The once-per-session background re-resolve only runs while the marketplace entry still declares this exact command; a changed command (or an entry that became command-sourced later) is skipped with a warning until the user runs an explicit update."),sourceProducerPath:_e.string().max(4096).refine(PE,{message:"must be an absolute path"}).optional().catch(void 0).describe("The directory a `command`-source plugin was last resolved to (what its command printed). Served in place in link mode and re-copied every session in copy mode, so the sandbox write-denies it; refreshed on every install/update, including no-op updates that resolve to a new location."),previousProducerPaths:_e.array(_e.unknown()).transform((s)=>s.filter((c)=>typeof c==="string"&&c.length<=4096&&PE(c)).slice(-n9)).optional().catch(void 0).describe("Producer directories this installation was resolved to before the current one (most recent last, bounded). A concurrent older session may still serve one of them, so the sandbox keeps write-denying them too.")}}function PE(s){return e9.isAbsolute(s)||t9.isAbsolute(s)}var zE=/[^\x20-\x7E]| {4,}/;function ld(){return _e.string().max(ad,{message:"headersHelper must not be longer than the install consent UI can display"}).refine((s)=>!zE.test(s),{message:"headersHelper must be printable ASCII (letters, digits, punctuation, single spaces) with no runs of 4 or more spaces"})}var o9="anthropic-plugin-directory",r9=["healthcare"],GE=new Set(["claude-community","claude-plugins-community",...r9]),WE=new Set(["claude-code-marketplace","claude-code-plugins","claude-plugins-official","anthropic-marketplace","anthropic-plugins","agent-skills","anthropic-agent-skills","life-sciences","knowledge-work-plugins","claude-for-legal","claude-for-financial-services","financial-services-plugins","first-party-plugins","claude-tag-plugins"]),s9=new Set([o9,"claude-plugin-directory"]),cd=new Set([...WE,...GE,...s9]);var KE=["marketplace","plugins","official"];function i9(){return KE}var jE="official[^a-z0-9]*(anthropic|claude)|(?:anthropic|claude)[^a-z0-9]*official",kye=new RegExp(jE,"i");function $E(s){return new RegExp(`(?:${jE}|^(?:anthropic|claude)[^a-z0-9]*(${s.join("|")}))`,"i")}var a9=$E(i9()),l9=$E(KE),c9=/[^\u0020-\u007E]/;function VE(s){if(cd.has(s.toLowerCase()))return!1;if(d9(s))return!0;if(a9.test(s))return!0;return!1}function d9(s){return!cd.has(s.toLowerCase())&&(c9.test(s)||l9.test(s))}var Xn=e(()=>_e.string().startsWith("./")),cr=e(()=>Xn().endsWith(".json")),NE=e(()=>_e.union([_e.literal("."),Xn()])),xE=e(()=>_e.union([Xn().refine((s)=>s.endsWith(".mcpb")||s.endsWith(".dxt"),{message:"MCPB file path must end with .mcpb or .dxt"}).describe("Path to MCPB file relative to plugin root"),_e.string().url().refine((s)=>s.endsWith(".mcpb")||s.endsWith(".dxt"),{message:"MCPB URL must end with .mcpb or .dxt"}).describe("URL to MCPB file")])),od=e(()=>Xn().endsWith(".md")),rd=e(()=>_e.union([od(),Xn()])),YE={inline:"--plugin-dir session plugins",builtin:"built-in plugins","skills-dir":"plugins auto-loaded from .claude/skills/",synced:"plugins synced from your claude.ai account","claude-plugin-test":"plugins loaded by claude plugin test"};function dd(s){return Object.hasOwn(YE,s)}var u9="Marketplace name impersonates an official Anthropic/Claude marketplace",ud=(s)=>_e.string().min(1,"Marketplace must have a name").refine((c)=>!c.includes(" "),{message:'Marketplace name cannot contain spaces. Use kebab-case (e.g., "my-marketplace")'}).refine((c)=>!Ah.test(c),{message:"Marketplace name cannot contain control or bidirectional-formatting characters"}).refine((c)=>!c.includes("/")&&!c.includes("\\")&&!c.includes("..")&&c!==".",{message:'Marketplace name cannot contain path separators (/ or \\), ".." sequences, or be "."'}).refine((c)=>!s(c),{message:u9}).superRefine((c,T)=>{let I=c.toLowerCase();if(!dd(I))return;T.addIssue({code:"custom",message:`Marketplace name "${I}" is reserved for ${YE[I]}`})}),p9=e(()=>ud(VE)),f9=e(()=>ud(()=>!1)),Ja=e(()=>_e.string().min(1,"Plugin name cannot be empty").refine((s)=>!s.includes(" "),{message:'Plugin name cannot contain spaces. Use kebab-case (e.g., "my-plugin")'}).refine((s)=>!Ah.test(s),{message:"Plugin name cannot contain control or bidirectional-formatting characters"})),pd=e(()=>_e.object({name:_e.string().min(1,"Author name cannot be empty").describe("Display name of the plugin author or organization"),email:_e.string().optional().describe("Contact email for support or feedback"),url:_e.string().optional().describe("Website, GitHub profile, or organization URL")})),XE=e(()=>_e.preprocess((s)=>r(s)?s:void 0,_e.record(_e.string(),_e.unknown()).optional()).optional().describe('Versions of its hosts this plugin runs on. "claude-code" is a semver range (e.g. ">=2.1.320"): outside it, the plugin is not installed, updated or loaded. Other keys are ignored.')),Gn=e(()=>_e.object({$schema:_e.string().optional().describe("JSON Schema reference for editor autocomplete/validation; ignored at load time"),name:Ja().describe("Unique identifier for the plugin, used for namespacing (prefer kebab-case)"),displayName:_e.string().optional().describe('Human-readable name shown in UI (e.g., "GitHub Utils"). Falls back to `name` when omitted. Unlike `name`, may contain spaces and any casing; not used for namespacing or lookup.'),version:_e.string().optional().describe("Semantic version (e.g., 1.2.3) following semver.org specification"),description:_e.string().optional().describe("Brief, user-facing explanation of what the plugin provides"),author:pd().optional().describe("Information about the plugin creator or maintainer"),homepage:_e.string().url().optional().describe("Plugin homepage or documentation URL"),repository:_e.string().optional().describe("Source code repository URL"),license:_e.string().optional().describe("SPDX license identifier (e.g., MIT, Apache-2.0)"),keywords:_e.array(_e.string()).optional().describe("Tags for plugin discovery and categorization"),defaultEnabled:_e.boolean().optional().describe("Whether the plugin starts enabled when the user has no explicit enabled/disabled setting for it (default: true). Explicit enabledPlugins values always win, and a plugin required by an enabled dependent is enabled regardless of this value. In a cloud session that began as a claude.ai chat, so is a plugin synced from the user's claude.ai account."),dependencies:_e.array(c8()).optional().describe(`Plugins that must be enabled for this plugin to function. Bare names (no "@marketplace") are resolved against the declaring plugin's own marketplace.`),metadata:_e.preprocess((s)=>r(s)?s:void 0,_e.record(_e.string(),_e.unknown()).optional()).describe("Free-form metadata for the plugin author's own use (e.g. entitlement or catalog fields). Preserved on the parsed manifest but not read by Claude Code."),engines:XE()})),m9=1,vye=e(()=>_e.object({$schema:_e.string().optional().catch(void 0).describe("JSON Schema reference for editor autocomplete/validation; ignored at load time"),description:_e.string().optional().describe("Brief, user-facing explanation of what these hooks provide"),hooks:_e.lazy(()=>ar()).optional().describe("The hooks provided by the plugin, in the same format as the one used for settings"),modules:_e.array(_e.string()).max(m9,{message:"hooks.json `modules` names one hooks module per plugin; a second entry is refused"}).optional().describe(`The hooks module: one path, relative to this hooks.json, of a module exporting register(on). The module, and every file it imports from the plugin, is named like code (${F3}; a file named otherwise is not loaded) and is an ES module whatever its suffix. What it hooks and calls is read from its source before it loads; \`claude plugin validate\` shows the result.`),surface:_e.never({error:'hooks.json `surface` is gone: name the module in the Client element, `Client({ module: "./board.tsx", key })`, a path relative to the file that builds it'}).optional()}).refine((s)=>s.hooks!==void 0||(s.modules?.length??0)>0,{message:"hooks.json must have `hooks` (the hook matchers) or `modules` (hooks modules), or both"})),JE=e(()=>_e.object({hooks:_e.union([cr().describe("Path to file with additional hooks (in addition to those in hooks/hooks.json, if it exists), relative to the plugin root"),_e.lazy(()=>ar()).describe("Additional hooks (in addition to those in hooks/hooks.json, if it exists)"),_e.array(_e.union([cr().describe("Path to file with additional hooks (in addition to those in hooks/hooks.json, if it exists), relative to the plugin root"),_e.lazy(()=>ar()).describe("Additional hooks (in addition to those in hooks/hooks.json, if it exists)")]))])})),g9=e(()=>_e.object({source:rd().optional().describe("Path to command markdown file, relative to plugin root"),content:_e.string().optional().describe("Inline markdown content for the command"),description:_e.string().optional().describe("Command description override"),argumentHint:_e.string().optional().describe('Hint for command arguments (e.g., "[file]")'),model:_e.string().optional().describe("Default model for this command"),allowedTools:_e.array(_e.string()).optional().describe("Tools allowed when command runs")}).refine((s)=>s.source&&!s.content||!s.source&&s.content,{message:'Command must have either "source" (file path) or "content" (inline markdown), but not both'})),ZE=e(()=>_e.object({commands:_e.union([rd().describe("Path to a command file or skill directory, relative to the plugin root. When set, the commands/ directory is not auto-loaded — list its files here if you want both."),_e.array(rd().describe("Path to a command file or skill directory, relative to the plugin root. When set, the commands/ directory is not auto-loaded — list its files here if you want both.")).describe("List of command file or skill directory paths. When set, the commands/ directory is not auto-loaded."),_e.record(_e.string(),g9()).describe('Object mapping of command names to their metadata and source files. Command name becomes the slash command name (e.g., "about" → "/plugin:about")')])})),qE=e(()=>_e.object({agents:_e.union([od().describe("Path to an agent file, relative to the plugin root. When set, the agents/ directory is not auto-loaded — list its files here if you want both."),_e.array(od().describe("Path to an agent file, relative to the plugin root. When set, the agents/ directory is not auto-loaded — list its files here if you want both.")).describe("List of agent file paths. When set, the agents/ directory is not auto-loaded.")])})),QE=e(()=>_e.object({skills:_e.union([NE().describe('Path to a skill directory, relative to the plugin root ("." / "./" denote the plugin root itself). Loaded in addition to the skills/ directory (except: for a marketplace entry whose source resolves to the marketplace root, declaring a specific subdirectory replaces the skills/ scan).'),_e.array(NE().describe('Path to a skill directory, relative to the plugin root ("." / "./" denote the plugin root itself).')).describe("List of skill directory paths, loaded in addition to the skills/ directory (except: for a marketplace entry whose source resolves to the marketplace root, declaring specific subdirectories replaces the skills/ scan).")])})),_9=e(()=>_e.union([_e.string(),_e.array(_e.string())])),fd=e(()=>_e.object({outputStyles:_e.union([Xn().describe("Path to an output-styles directory or file, relative to the plugin root. When set, the output-styles/ directory is not auto-loaded — list its files here if you want both."),_e.array(Xn().describe("Path to an output-styles directory or file, relative to the plugin root. When set, the output-styles/ directory is not auto-loaded — list its files here if you want both.")).describe("List of output-style directory or file paths. When set, the output-styles/ directory is not auto-loaded.")])})),E9=e(()=>_e.string().max(64).regex(/^[a-z][a-z0-9_-]*$/,"must match ^[a-z][a-z0-9_-]*$")),h9=16,S9=e(()=>_e.object({id:E9(),remote:_e.string().max(256).regex(/^(npm:[@a-z0-9/._-]+(@[a-z0-9._+-]+)?|github:[\w.-]+\/[\w.-]+@[\w./-]+#.+\.js)$/,"must be npm:<pkg>[@ver] or github:<owner>/<repo>@<ref>#<path>.js").optional(),integrity:_e.string().max(512).regex(/^sha(256|384|512)-[A-Za-z0-9+/=]+$/,"must be SRI form: sha256-, sha384-, or sha512-<base64>").optional()}).strict()),y9=e(()=>_e.object({syntaxHighlighting:_e.object({hljsLanguages:_e.array(S9()).max(h9)}).strict()})),md=e(()=>_e.object({themes:_e.union([Xn().describe("Path to a themes directory or file, relative to the plugin root. When set, the themes/ directory is not auto-loaded — list its files here if you want both."),_e.array(Xn().describe("Path to a themes directory or file, relative to the plugin root. When set, the themes/ directory is not auto-loaded — list its files here if you want both.")).describe("List of theme directory or file paths. When set, the themes/ directory is not auto-loaded.")])})),eh=e(()=>_e.object({workflows:_e.union([Xn().describe("Path to a workflows directory or .js file, relative to the plugin root. When set, the workflows/ directory is not auto-loaded — list its files here if you want both."),_e.array(Xn().describe("Path to a workflows directory or .js file, relative to the plugin root. When set, the workflows/ directory is not auto-loaded — list its files here if you want both.")).describe("List of workflow directory or .js file paths. When set, the workflows/ directory is not auto-loaded.")]).optional()})),kE=e(()=>_e.string().min(1)),O9=e(()=>_e.string().min(2).refine((s)=>s.startsWith("."),{message:'File extensions must start with dot (e.g., ".ts", not "ts")'})),th=e(()=>_e.object({mcpServers:_e.union([cr().describe("MCP servers to include in the plugin (in addition to those in the .mcp.json file, if it exists)"),xE().describe("Path or URL to MCPB file containing MCP server configuration"),_e.record(_e.string(),$a()).describe("MCP server configurations keyed by server name"),_e.array(_e.union([cr().describe("Path to MCP servers configuration file"),xE().describe("Path or URL to MCPB file"),_e.record(_e.string(),$a()).describe("Inline MCP server configurations")])).describe("Array of MCP server configurations (paths, MCPB files, or inline definitions)")])})),nh=e(()=>_e.object({type:_e.enum(["string","number","boolean","directory","file"]).describe("Type of the configuration value"),title:_e.string().describe("Human-readable label shown in the config dialog"),description:_e.string().describe("Help text shown beneath the field in the config dialog"),required:_e.boolean().optional().describe("If true, validation fails when this field is empty"),default:_e.union([_e.string(),_e.number(),_e.boolean(),_e.array(_e.string())]).optional().describe("Default value used when the user provides nothing"),multiple:_e.boolean().optional().describe("For string type: allow an array of strings"),sensitive:_e.boolean().optional().describe("If true, masks dialog input and stores value in secure storage (keychain/credentials file) instead of settings.json"),min:_e.number().optional().describe("Minimum value (number type only)"),max:_e.number().optional().describe("Maximum value (number type only)"),options:_e.array(_e.string().min(1,"An option cannot be empty").max(64,"An option can be at most 64 characters").refine((s)=>dn(s)===s,{message:"An option cannot contain control, invisible or bidirectional-formatting characters"}).refine((s)=>s.trim()===s,{message:"An option cannot start or end with a space"})).min(1,"options needs at least one value").refine((s)=>new Set(s.map((c)=>c.toLowerCase())).size===s.length,{message:"options cannot repeat a value (in any letter case)"}).readonly().optional().describe("For string type: the only values the field takes. /config shows the field as a picker over them, and a stored value outside them counts as unset")}).strict().superRefine((s,c)=>{if(s.options===void 0)return;if(s.type!=="string"||s.multiple===!0||s.sensitive===!0){c.addIssue({code:"custom",path:["options"],message:'options is only for a field of type "string" that is neither multiple nor sensitive'});return}if(s.default===void 0){if(s.required!==!0)c.addIssue({code:"custom",path:["default"],message:"a field with options needs a default among them, or required: true"});return}if(typeof s.default!=="string"||!s.options.includes(s.default))c.addIssue({code:"custom",path:["default"],message:`default must be one of the options: ${s.options.join(", ")}`})})),oh=e(()=>_e.object({userConfig:_e.record(_e.string().regex(/^[A-Za-z_]\w*$/,"Option keys must be valid identifiers (letters, digits, underscore; no leading digit) — they become CLAUDE_PLUGIN_OPTION_<KEY> env vars in hooks"),nh()).optional().describe("User-configurable values this plugin needs. Prompted at enable time. Non-sensitive values saved to settings.json; sensitive values to secure storage. Available as ${user_config.KEY} in MCP/LSP server config, hook commands, and (non-sensitive only) skill/agent content. Keep sensitive value counts small.")})),rh=e(()=>_e.object({channels:_e.array(_e.object({server:_e.string().min(1).describe("Name of the MCP server this channel binds to. Must match a key in this plugin's mcpServers."),displayName:_e.string().optional().describe('Human-readable name shown in the config dialog title (e.g., "Telegram"). Defaults to the server name.'),userConfig:_e.record(_e.string(),nh()).optional().describe("Fields to prompt the user for when enabling this plugin in assistant mode. Saved values are substituted into ${user_config.KEY} references in the mcpServers env.")}).strict()).describe("Channels this plugin provides. Each entry declares an MCP server as a message channel and optionally specifies user configuration to prompt for at enable time.")})),vE=e(()=>_e.strictObject({command:_e.string().min(1).refine((s)=>{if(s.includes(" ")&&!s.startsWith("/"))return!1;return!0},{message:"Command should not contain spaces. Use args array for arguments."}).describe('Command to execute the LSP server (e.g., "typescript-language-server")'),args:_e.array(kE()).optional().describe("Command-line arguments to pass to the server"),extensionToLanguage:_e.record(O9(),kE()).refine((s)=>Object.keys(s).length>0,{message:"extensionToLanguage must have at least one mapping"}).describe("Mapping from file extension to LSP language ID. File extensions and languages are derived from this mapping."),transport:_e.enum(["stdio","socket"]).default("stdio").describe("Communication transport mechanism"),env:_e.record(_e.string(),_e.string()).optional().describe("Environment variables to set when starting the server"),initializationOptions:_e.unknown().optional().describe("Initialization options passed to the server during initialization"),settings:_e.unknown().optional().describe("Settings passed to the server via workspace/didChangeConfiguration"),workspaceFolder:_e.string().optional().describe("Workspace folder path to use for the server"),startupTimeout:_e.number().int().positive().optional().describe("Maximum time to wait for server startup (milliseconds)"),shutdownTimeout:_e.number().int().positive().optional().describe("Maximum time to wait for graceful shutdown (milliseconds)"),requestTimeout:_e.number().int().positive().max(2147483647).optional().describe("Maximum time to wait for the server to answer a request (milliseconds). Defaults to 60000."),restartOnCrash:_e.boolean().optional().describe("Whether to restart the server if it crashes"),maxRestarts:_e.number().int().nonnegative().optional().describe("Maximum number of restart attempts before giving up"),diagnostics:_e.boolean().optional().describe("Whether to push publishDiagnostics into the agent context after edits. Set to false to keep LSP navigation (goToDefinition, hover, etc.) but suppress automatic diagnostic injection. Defaults to true.")})),A9=e(()=>_e.strictObject({name:_e.string().min(1).describe("Identifier for this monitor, unique within the plugin. Used to dedupe so re-arming (plugin reload, repeat skill invoke) does not spawn duplicates."),command:_e.string().min(1).describe('Shell command to run as a persistent background monitor. Each stdout line is delivered to the model as a <task_notification> event; the process runs for the session lifetime. ${CLAUDE_PLUGIN_ROOT}, ${CLAUDE_PLUGIN_DATA}, ${CLAUDE_PROJECT_DIR}, ${user_config.*}, and ${ENV_VAR} are substituted. Runs in the session cwd (the named --project-config-root when a host set one) — prefix with `cd "${CLAUDE_PLUGIN_ROOT}" && ` if the script needs its own directory.'),description:_e.string().min(1).describe("Short human-readable description of what is being monitored (shown in task panel and notification summary)."),when:_e.union([_e.literal("always"),_e.string().startsWith("on-skill-invoke:").refine((s)=>s.length>16,{message:"on-skill-invoke: must specify a skill name"})]).default("always").describe('Arm trigger. "always" arms at session start and on plugin reload. "on-skill-invoke:<skill>" arms the first time that skill is dispatched (via Skill tool or slash command).')})),C9=e(()=>_e.array(A9()).refine((s)=>new Set(s.map((c)=>c.name)).size===s.length,{message:"Monitor names must be unique within a plugin"})),gd=e(()=>_e.object({monitors:_e.union([cr().describe("Path to a JSON file containing the monitors array, relative to the plugin root"),C9()]).describe("Background watch scripts the host arms as persistent Monitor tasks (unsandboxed, same trust tier as hooks) so plugins need not instruct the model to arm them. When omitted, monitors/monitors.json at the plugin root is loaded if present.")})),sh=e(()=>_e.object({lspServers:_e.union([cr().describe("Path to .lsp.json configuration file relative to plugin root"),_e.record(_e.string(),vE()).describe("LSP server configurations keyed by server name"),_e.array(_e.union([cr().describe("Path to LSP configuration file"),_e.record(_e.string(),vE()).describe("Inline LSP server configurations")])).describe("Array of LSP server configurations (paths or inline definitions)")])})),b9=/^@[a-z0-9][a-z0-9-._]*\/[a-z0-9][a-z0-9-._]*$/,R9=/^[a-z0-9][a-z0-9-._]*$/,T9=/^@[a-z0-9][a-z0-9-._]*\/\*$/;function _d(s){return!s.includes("..")&&!s.includes("//")&&(b9.test(s)||R9.test(s))}var ih=e(()=>_e.string().refine((s)=>!s.includes("..")&&!s.includes("//"),"Package name cannot contain path traversal patterns").refine((s)=>_d(s),"Invalid npm package name format")),ah=/^[a-z0-9](?:[a-z0-9._-]*[a-z0-9_-])?$/,D9=/^[0-9a-f]{64}$/;var L9=64;var I9=e(()=>_e.object({sha256:_e.string().regex(D9)}));function w9(s){let c=_e.record(_e.string(),_e.unknown()).safeParse(s);if(!c.success)return;let T=Object.create(null),I=0;for(let[v,U]of Object.entries(c.data)){if(I>=L9)break;let oe=I9().safeParse(U);if(ah.test(v)&&oe.success)T[v]=oe.data,I++}return I>0?T:void 0}var lh=e(()=>_e.object({binaries:_e.unknown().transform(w9).describe("sha256-pinned files to fetch into bin/ at install time, keyed by basename (target triple encoded in the name)")})),ch=e(()=>_e.object({settings:_e.record(_e.string(),_e.unknown()).optional().describe("Settings to merge into the user settings while this plugin is enabled. Only the documented allowlisted keys are applied.")})),dh=e(()=>_e.object({types:Xn().refine((s)=>s.endsWith(".d.ts"),{message:"types must name a TypeScript declaration file ending in '.d.ts'"}).refine((s)=>!s.split(/[\\/]/).includes(".."),{message:"types must stay inside the plugin directory (no '..' segment)"}).optional().describe("Path to the plugin's type contract, relative to the plugin root and starting with ./: a self-contained .d.ts (no import, export-from, require or reference) that exports the types of the noun the plugin's hooks module adds in engine.create at its top level and declares the noun in a `declare module 'claude-code' { interface EngineInterface { ... } }` block, nothing else. A mod that lists this plugin under dependencies gets the contract laid at .claude-plugin/types/<plugin>/index.d.ts each time the engine loads it from a folder the person owns, so it types against the noun with nothing copied; claude plugin validate checks the file.")})),uh=e(()=>_e.object({experimental:_e.preprocess((s)=>r(s)?s:void 0,_e.object({...md().partial().shape,...y9().partial().shape,...gd().partial().shape,...fd().partial().shape,evals:_9().optional().describe("Directory of eval cases for the plugin evaluation harness, relative to the plugin root (default: evals/). A list is accepted; its first entry is the case directory.")}).passthrough().optional().describe("Components whose manifest shape may change without a deprecation cycle. Move a key out of here once it is promoted to stable."))}));var P9=e(()=>_e.object({...Gn().shape,...JE().partial().shape,...ZE().partial().shape,...qE().partial().shape,...QE().partial().shape,...fd().partial().shape,...md().partial().shape,...eh().shape,...rh().partial().shape,...th().partial().shape,...sh().partial().shape,...gd().partial().shape,...ch().partial().shape,...dh().partial().shape,...oh().partial().shape,...lh().partial().shape,...uh().partial().shape})),Mye=e(()=>new is({$schema:()=>Gn().shape.$schema,name:()=>Gn().shape.name,displayName:()=>Gn().shape.displayName,version:()=>Gn().shape.version,description:()=>Gn().shape.description,author:()=>Gn().shape.author,homepage:()=>Gn().shape.homepage,repository:()=>Gn().shape.repository,license:()=>Gn().shape.license,keywords:()=>Gn().shape.keywords,defaultEnabled:()=>Gn().shape.defaultEnabled,dependencies:()=>Gn().shape.dependencies,metadata:()=>Gn().shape.metadata,engines:()=>Gn().shape.engines,hooks:()=>JE().partial().shape.hooks,commands:()=>ZE().partial().shape.commands,agents:()=>qE().partial().shape.agents,skills:()=>QE().partial().shape.skills,outputStyles:()=>fd().partial().shape.outputStyles,themes:()=>md().partial().shape.themes,workflows:()=>eh().shape.workflows,channels:()=>rh().partial().shape.channels,mcpServers:()=>th().partial().shape.mcpServers,lspServers:()=>sh().partial().shape.lspServers,monitors:()=>gd().partial().shape.monitors,settings:()=>ch().partial().shape.settings,types:()=>dh().partial().shape.types,userConfig:()=>oh().partial().shape.userConfig,binaries:()=>lh().partial().shape.binaries,experimental:()=>uh().partial().shape.experimental},new Set(["name"])));var ph=new Set(["url","github","git","npm","file","directory","skills-dir","hostPattern","pathPattern","settings"]);function fh(s){try{return new RegExp(s),!0}catch{return!1}}function N9(s){return lr(s)||xe(s)}var mh="ssh.github.com";function td(s){return $o(s)||ii(s)===mh}var x9=/^[A-Za-z0-9._-]+$/;function k9(s){return x9.test(s)&&!s.startsWith("-")&&s!=="."&&s!==".."}function gh(s){if(!s.endsWith("/*"))return null;let c=s.slice(0,-2);return k9(c)?c:null}function v9(s){let c=[];for(let T of s.split("/")){if(T===".")continue;if(T===".."){c.pop();continue}c.push(T)}return c.filter((T)=>T!=="").join("/")}function M9(s){let c=s.length;for(;;){let T=c;while(T>0&&s.charCodeAt(T-1)===47)T--;if(T>=4&&s.startsWith(".git",T-4))T-=4;if(T===c)return c===s.length?s:s.slice(0,c);c=T}}function ME(s){let c=ed(s);return c===mh?zn:c}function U9(s,c){if(s.includes("://"))try{let I=LE(s);if(I===null)return s;I.hostname=ME(I.hostname),I.username="",I.password="",I.search="",I.hash="";try{I.pathname=decodeURIComponent(I.pathname)}catch{}let v=v9(I.pathname);return I.pathname=c?.stripDotGit?M9(v):v,I.toString()}catch{return s}let T=ve(s);return T?`${ME(T.host)}:${T.path}`:s}var H9=new Set(["http:","https:","git:","git+http:","git+https:"]);function F9(s){if(Qc(s))return s;if(s.includes("://"))try{let I=new URL(s);if(I.hostname=ed(I.hostname),H9.has(I.protocol)||$o(I.hostname))I.username="",I.password="";return I.toString()}catch{return s}let c=IE(s);if(!c)return s;let T=c.host.toLowerCase().replace(/\.+$/,"");return $o(T)?`${zn}:${c.path}`:`${c.user}@${T}:${c.path}`}function _h(s){if(s.includes("://")){if(N9(s))return!1;let U=ve(s)?.host;if(U!==void 0&&td(U)&&U9(s,{stripDotGit:!0}).includes("*"))return!0;let oe=te(s)?.hostname;if(!oe||!td(oe))return!1;let re=F9(s);try{let le=new URL(re);return le.hostname.includes("*")||le.pathname.includes("*")}catch{return re.includes("*")}}let c=ve(s),T=c?.host,I=c?.path;if(!T||I===void 0||!td(T))return!1;let v=I;try{v=decodeURIComponent(I)}catch{}return v.includes("*")}function Eh(s){return _e.discriminatedUnion("source",[_e.object({source:_e.literal("url"),url:_e.string().url().describe("Direct URL to marketplace.json file"),headers:_e.record(_e.string(),_e.string()).optional().describe("Custom HTTP headers (e.g., for authentication)"),headersHelper:ld().optional().describe("Command that prints a JSON object of HTTP headers (e.g. a short-lived auth token). Its output overrides `headers` and, like `headers`, is inherited by same-origin archive downloads from this marketplace. Runs from a fixed directory (the Claude config home, never the session's), so give a bare command found via PATH or an absolute path; it is re-run on later refreshes of this marketplace.")}),_e.object({source:_e.literal("github"),repo:_e.string().describe('GitHub repository in owner/repo format. ONLY in the managed-settings policy lists (strictKnownMarketplaces / blockedMarketplaces) the owner-wildcard form "owner/*" matches every repository under exactly that owner. Everywhere else (marketplace add, extraKnownMarketplaces, known_marketplaces.json) the value '+"must name a single repository — a wildcard is taken literally and fails to clone."),ref:_e.string().optional().describe('Git branch, tag or full commit id to use (e.g., "main", "v1.0.0"). Defaults to repository default branch. A full commit id (40 or 64 lowercase hex digits) holds the marketplace at that commit: refreshes and auto-updates do not move it. A branch or tag of the repository must hold the commit. Plugins listed with a remote source follow that source unless they name a `sha`. Reserved Anthropic marketplace names do not accept a commit id.'),path:_e.string().optional().describe("Path to marketplace.json within repo (defaults to .claude-plugin/marketplace.json)"),sparsePaths:_e.array(_e.string()).optional().describe('Directories to include via git sparse-checkout (cone mode). Use for monorepos where the marketplace lives in a subdirectory. Example: [".claude-plugin", "plugins"]. If omitted, the full repository is cloned.'),skipLfs:_e.boolean().optional().describe("Has no effect; accepted so existing settings keep working. Claude Code's own git never downloads Git LFS content: LFS-tracked files in the marketplace repository are checked out as pointer files whether or not this is set, and adding or updating the marketplace says how many were. To fetch their content, run `git lfs pull` in the marketplace's checkout under ~/.claude/plugins/marketplaces/.")}),_e.object({source:_e.literal("git"),url:_e.string().describe("Full git repository URL"),ref:_e.string().optional().describe('Git branch, tag or full commit id to use (e.g., "main", "v1.0.0"). Defaults to repository default branch. A full commit id (40 or 64 lowercase hex digits) holds the marketplace at that commit: refreshes and auto-updates do not move it. A branch or tag of the repository must hold the commit. Plugins listed with a remote source follow that source unless they name a `sha`. Reserved Anthropic marketplace names do not accept a commit id.'),path:_e.string().optional().describe("Path to marketplace.json within repo (defaults to .claude-plugin/marketplace.json)"),sparsePaths:_e.array(_e.string()).optional().describe('Directories to include via git sparse-checkout (cone mode). Use for monorepos where the marketplace lives in a subdirectory. Example: [".claude-plugin", "plugins"]. If omitted, the full repository is cloned.'),skipLfs:_e.boolean().optional().describe("Has no effect; accepted so existing settings keep working. Claude Code's own git never downloads Git LFS content: LFS-tracked files in the marketplace repository are checked out as pointer files whether or not this is set, and adding or updating the marketplace says how many were. To fetch their content, run `git lfs pull` in the marketplace's checkout under ~/.claude/plugins/marketplaces/.")}),_e.object({source:_e.literal("npm"),package:ih().or(_e.string().regex(T9,"Invalid npm package name format")).describe('npm package containing marketplace.json (e.g. "@acme/claude-marketplace"). A scope wildcard such as "@acme/*" still parses in a managed list, so a list that holds one stays valid, but it matches no marketplace package.'),version:_e.string().optional().describe('Version or range to fetch (e.g. "1.4.0", "^1.4"); defaults to the latest dist-tag'),registry:_e.string().url().refine(FE,"Registry must be an http(s) URL").optional().describe("Registry URL. When adding a marketplace: a one-off registry override (otherwise your npm configuration decides). Under allowManagedPermissionRulesOnly, an npm marketplace keeps plugin allowed-tools only when both the entry and the registration pin this same registry.")}),_e.object({source:_e.literal("file"),path:_e.string().describe("Local file path to marketplace.json")}),_e.object({source:_e.literal("directory"),path:_e.string().describe("Local directory containing .claude-plugin/marketplace.json")}),_e.object({source:_e.literal("skills-dir")}).describe("Policy-list sentinel for the ~/.claude/skills/ auto-load (@skills-dir plugins). In strictKnownMarketplaces: opt the scan back IN (by default any allowlist blocks it). In blockedMarketplaces: turn the scan OFF without otherwise restricting marketplaces. Only meaningful in those two managed-settings lists (areLocalPluginDirsAllowedByPolicy); known_marketplaces.json / marketplace add etc. ignore it."),_e.object({source:_e.literal("hostPattern"),hostPattern:_e.string().describe('Regex pattern to match the host/domain extracted from any marketplace source type. For github sources, matches against github.com. For git sources (SSH or HTTPS), extracts the hostname from the URL. Use in strictKnownMarketplaces to allow all marketplaces from a specific host (e.g., "^github\\.mycompany\\.com$").')}),_e.object({source:_e.literal("pathPattern"),pathPattern:_e.string().describe('Regex pattern matched against the .path field of file and directory sources. Use in strictKnownMarketplaces to allow filesystem-based marketplaces alongside hostPattern restrictions for network sources. Use ".*" to allow all filesystem paths, or a narrower pattern (e.g., "^/opt/approved/") to restrict to specific directories.')}),_e.object({source:_e.literal("settings"),name:s?f9().describe("Marketplace name, as stored in known_marketplaces.json. A reserved name is refused per entry at load (revalidateReservedNameEntry); a look-alike name is judged when that marketplace's own catalog is parsed (catalogNameSchemaFor)."):p9().refine((c)=>!cd.has(c.toLowerCase()),{message:"Reserved marketplace names cannot be used with settings sources. validateOfficialNameSource only accepts github/git sources from anthropics/* for these names; a settings source would be rejected after loadAndCacheMarketplace has already written to disk with cleanupNeeded=false."}).describe("Marketplace name. Must match the extraKnownMarketplaces key (enforced); the synthetic manifest is written under this name. Same validation "+"as PluginMarketplaceSchema plus reserved-name rejection — "+"validateOfficialNameSource runs after the disk write, too late to clean up."),plugins:_e.array(K9()).describe("Plugin entries declared inline in settings.json"),owner:pd().optional()}).describe("Inline marketplace manifest defined directly in settings.json. The reconciler writes a synthetic marketplace.json to the cache; diffMarketplaces detects edits via isEqual on the stored source (the plugins array is inside this object, so edits surface as sourceChanged).")])}var ai=e(()=>Eh(!1));var Ed=String.raw`[\w./+-]`,Uye=new RegExp(`^(?:#${Ed}*)?$`),Hye=new RegExp(String.raw`^(?:(?:git\+)?ssh:\/\/)?[^@:/\\?#%]+@[^@:/\\?#]+:[^@?#]*(?:#${Ed}*)?$`),Fye=new RegExp(String.raw`^(?:(?:github|gitlab|bitbucket):)?[^@:/\\?#%]+(?:\/[^@:/\\?#%]+)+(?:#${Ed}*)?$`);var B9=e(()=>Eh(!0));function hh(){return ai()}var hd=e(()=>hh()),Za=e(()=>hh()),nd=e(()=>_e.string().length(40).regex(/^[a-f0-9]{40}$/,"Must be a full 40-character lowercase git commit SHA")),Sh=e(()=>_e.string().regex(/^[0-9a-fA-F]{64}$/,"Must be a 64-character hex SHA-256 digest")),z9="Archive URLs must use https:// and must not point at a loopback, link-local, or cloud-metadata host";function G9(s){try{let c=new URL(s);return c.protocol==="https:"&&!fE(c.hostname)}catch{return!1}}var W9=e(()=>_e.object({source:_e.literal("archive"),url:_e.string().url().refine(G9,{message:z9}).describe("HTTPS URL of a zip archive containing the plugin. The plugin root (the directory holding .claude-plugin/) may be at the top of the archive "+"or nested one directory deep — a single wrapping directory is stripped."),sha256:Sh().optional().describe("SHA-256 digest of the archive. When set, every download is verified against it and the install is refused on mismatch. It also serves as the version identity when neither plugin.json nor the marketplace entry declares a `version`. Recommended. Note the update signal is the version string (plugin.json "+"version, else the entry version, else this digest) — changing only the digest "+"while a version is declared does not trigger an update.")}).describe("Plugin distributed as a zip archive fetched over HTTPS — for hosting on any "+"static file server or artifact repository (S3, GitLab, nginx) with no git or npm on the client. Authentication: the entry's own `headers` / `headersHelper` (bound to this URL), overlaid on the enclosing url-source marketplace's headers (static or `headersHelper`-minted) when the archive shares its origin.")),yh=e(()=>_e.union([_e.preprocess((s)=>s==="."?"./":s,Xn()).describe("Path to the plugin root, relative to the marketplace root (the directory containing .claude-plugin/, not .claude-plugin/ itself)"),_e.object({source:_e.literal("npm"),package:ih().or(_e.string().refine((s)=>/^(?:file|https?|git(?:\+https?|\+ssh)?|ssh|github|gitlab|bitbucket):/i.test(s)||!s.includes(".."),'Package reference cannot contain ".." path segments')).describe("Package name (or url, or local path, or anything else that can be passed to `npm` as a package)"),version:_e.string().optional().describe("Specific version or version range (e.g., ^1.0.0, ~2.1.0)"),registry:_e.string().url().refine(FE,"Registry must be an http(s) URL").optional().describe("Custom NPM registry URL (defaults to using system default, likely npmjs.org)")}).describe("NPM package as plugin source"),_e.object({source:_e.literal("url"),url:_e.string().describe("Full git repository URL (https:// or git@)"),ref:_e.string().optional().describe('Git branch or tag to use (e.g., "main", "v1.0.0"). Defaults to repository default branch.'),sha:nd().optional().describe("Specific commit SHA to use")}),_e.object({source:_e.literal("github"),repo:_e.string().describe("GitHub repository in owner/repo format"),ref:_e.string().optional().describe('Git branch or tag to use (e.g., "main", "v1.0.0"). Defaults to repository default branch.'),sha:nd().optional().describe("Specific commit SHA to use")}),_e.object({source:_e.literal("git-subdir"),url:_e.string().describe("Git repository: GitHub owner/repo shorthand, https://, or git@ URL"),path:_e.string().min(1).describe('Subdirectory within the repo containing the plugin (e.g., "tools/claude-plugin"). '+"Checked out sparsely — over https or ssh as a partial clone (--filter=tree:0) — to minimize bandwidth for monorepos."),ref:_e.string().optional().describe('Git branch or tag to use (e.g., "main", "v1.0.0"). Defaults to repository default branch.'),sha:nd().optional().describe("Specific commit SHA to use")}).describe("Plugin located in a subdirectory of a larger repository (monorepo). Only the specified subdirectory is materialized; the rest of the repo is not downloaded."),W9(),_e.object({source:_e.literal("command"),command:_e.string().min(1).max(ad,{message:"command must not be longer than the install consent UI can display"}).refine((s)=>!zE.test(s),{message:"command must be printable ASCII (letters, digits, punctuation, single spaces) with no runs of 4 or more spaces"}).describe("Shell command that prints the absolute path of the plugin directory on stdout (exactly one line) and exits 0. It must leave a complete plugin in that directory before exiting; the directory is copied into the plugin cache, so the printed path may change between runs (it is re-resolved on every install and update, and once per session in the background). Runs through the platform shell (sh on macOS/Linux, cmd.exe on Windows) from the user's home directory with Claude Code's subprocess environment."),timeout:_e.number().int().positive().max(wE).optional().describe("Seconds to wait for the command before giving up (default: 60)"),mode:_e.enum(["copy","link"]).optional().describe("copy (default): the printed directory is copied into the plugin cache and content-hashed, so it may be deleted afterwards. link: the cache entry links to the printed directory "+"in place (no copy, no size limit; macOS/Linux) — for large exports; the directory must then stay "+"valid while Claude Code runs, and a different printed path is what signals new content.")}).describe("Plugin directory produced by a locally installed tool (e.g. an IDE that renders its plugin for the currently selected SDK). Claude Code runs the command, copies the directory it prints, and re-runs it in the background at startup to pick up changes."),_e.object({source:_e.literal("unsupported"),error:_e.string().optional()}).describe("Placeholder for source types this Claude Code version does not recognize, or a known type whose fields failed validation (then `error` "+"holds the reason). Never authored by hand — PluginMarketplaceSchema rewrites "+"unparseable sources to this so the entry remains in marketplace.plugins (detectDelistedPlugins must not see it as removed). Install attempts fail at cachePlugin with an actionable message.")])),K9=e(()=>_e.object({name:Ja().describe("Plugin name as it appears in the target repository"),source:yh().describe("Where to fetch the plugin from. Must be a remote source — relative "+"paths have no marketplace repository to resolve against. Under allowManagedPermissionRulesOnly, a settings marketplace keeps its plugins' allowed-tools only when every npm entry here pins a `registry` on a bare package name; unpinned, the package resolves through the member's own npm config, and a non-bare spelling (an `npm:` alias, a `name@range`, a URL or git spec) packs as an "+"exotic spec the pin does not bind — either way the marketplace "+"vouches no tool grants."),description:_e.string().optional(),version:_e.string().optional(),strict:_e.boolean().optional(),engines:XE(),headers:_e.record(_e.string(),_e.string()).optional().describe("HTTP headers sent when downloading this entry's `archive` source."),headersHelper:ld().optional().describe("Command that prints a JSON object of HTTP headers for downloading this entry's `archive` source. Runs only when a user explicitly installs or updates this plugin. Unlike a catalog entry, an entry written here does not need `strict: false`: it is declared in a settings file, which has no manifest fields to inline. A declaration in project settings is not operator-authored, so request-routing and client-identity header names are still filtered there. Use an absolute path.")}).refine((s)=>typeof s.source!=="string",{message:'Plugins in a settings-sourced marketplace must use remote sources (github, git-subdir, npm, url, archive, command). Relative-path sources like "./foo" have no marketplace repository to resolve against.'}).refine((s)=>typeof s.source==="string"||s.source.source!=="unsupported",{message:"source.source: 'unsupported' is a parse-time placeholder and cannot be authored. Use a remote source (github, git-subdir, npm, url, archive, command)."}));var j9=e(()=>_e.object({cli:_e.array(_e.string().max(64)).max(10).optional().describe('First command tokens (e.g. ["stripe"]) — exact match against commands run this session.'),hosts:_e.array(_e.string().max(128)).max(20).optional().describe('Hostnames (e.g. ["api.stripe.com"]) — exact, case-insensitive match against '+"hostnames seen in https?:// URLs in bash commands run this session. Bare hostname only: lowercase, no scheme, no port, no path."),filesRead:_e.array(_e.string().max(256)).max(10).optional().describe('Glob patterns (e.g. ["**/*.tf"]) — the plugin is relevant when a file Claude has read '+"this session matches any pattern. Matched against read-file paths, forward-slash normalized, case-insensitive."),manifestDeps:_e.array(_e.object({file:_e.string().max(256),pattern:_e.string().max(256)})).max(10).optional().describe("Dependency declared in a package manifest. Each {file, pattern} is a pair of RegExp sources: "+"`file` matches the manifest filename (package.json, go.mod, requirements.txt, …); "+"`pattern` matches the dependency declaration inside that file. Evaluated against files read this session."),cwd:_e.array(_e.string().max(256)).max(10).optional().describe('Glob patterns (e.g. ["Engine/Source/Runtime/Renderer/**"]) — the plugin is relevant when the '+`session's working directory is at or under a directory matching the pattern. Matched against the cwd both relative to the enclosing git repo root and as an absolute path, forward-slash normalized, case-insensitive. A bare directory (no glob characters) means "cwd is at or under this directory". Known at session start, so this signal can surface a suggestion before the first turn.`)})),$9=e(()=>_e.object({topic:_e.string().max(64).optional().describe('What the user is working with when this plugin is relevant — fills "Working with {topic}?". '+'Often the product name (e.g. "Stripe"); use a domain (e.g. "design") when the plugin name does not read naturally as a topic. Defaults to the plugin name with each hyphen-segment capitalized.'),signals:j9().optional().describe("Matchers that determine when the plugin is relevant.")})),V9=e(()=>P9().partial().extend({name:Ja().describe("Unique identifier matching the plugin name"),source:yh().describe("Where to fetch the plugin from"),headers:_e.record(_e.string(),_e.string()).optional().describe("Custom HTTP headers for fetching this plugin's archive; overrides the marketplace's"),headersHelper:ld().optional().describe("Command that prints a JSON object of HTTP headers for fetching this plugin's archive (e.g. a short-lived auth token); overrides this entry's `headers` and the marketplace's. Runs only when the user installs or updates this plugin, never during catalog browse. An entry that sets it must be `strict: false` with its manifest inlined here, so consent is informed from the entry alone before the command runs."),category:_e.string().optional().describe('Category for organizing plugins (e.g., "productivity", "development")'),tags:_e.array(_e.string()).optional().describe("Tags for searchability and discovery"),strict:_e.boolean().optional().default(!0).describe("Require the plugin manifest to be present in the plugin folder. If false, the marketplace entry provides the manifest."),relevance:_e.preprocess((s)=>r(s)?s:void 0,$9().optional()).describe(`Declares when this plugin is relevant to the user's work. Consumed by the spinner tip ("Working with {topic}?"), session-start auto-suggest, and marketplace browse ranking.`)})),Y9=e(()=>_e.object({name:Ja()}));function X9(s){let c=V9();return s.flatMap((T,I)=>{let v=c.safeParse(T);if(v.success){let re=v.data.source;if(typeof re==="object"&&re.source==="unsupported"&&re.error!==void 0)return[{...v.data,source:{source:"unsupported"}}];return[v.data]}let U=Y9().safeParse(T).data?.name,oe=v.error.issues.map((re)=>`${re.path.join(".")}: ${re.message}`).join(", ");if(U){t(`Stubbing unparseable marketplace plugin entry (${U}): ${oe}`,{level:"warn"});let re=Oh(r(T)?T.source:void 0)?o8:Sd(T)?void 0:q9(v.error.issues)??qa(v.error.issues);return[{name:U,source:{source:"unsupported",...re&&{error:re}},strict:!0}]}return t(`Dropping unparseable marketplace plugin entry (index ${I}): ${oe}`,{level:"warn"}),[]})}function J9(s){if(!r(s))return s;let c=Object.keys(s).filter((T)=>typeof s[T]!=="string"&&s[T]!==null);if(c.length>0){if(t(`Unreadable entries in a marketplace's renames map: ${c.length}`,{level:"warn"}),Object.hasOwn(s,"__proto__"))return}return{...s,...Object.fromEntries(c.map((T)=>[T,T]))}}var Z9=new Set(["npm","url","github","git-subdir","archive","command","unsupported"]);function Sd(s){if(!s||typeof s!=="object")return!1;let c=s.source;if(!c||typeof c!=="object")return!1;let T=c.source;return typeof T==="string"&&!Z9.has(T)}function q9(s){let c=s.find((I)=>I.path.length===1&&I.path[0]==="source");if(!c||c.code!=="invalid_union")return;let T=c.errors.find((I)=>!I.some((v)=>v.path.length===0||v.code==="invalid_value"&&v.path[0]==="source"));if(!T||T.length===0)return;return qa(T.map((I)=>({...I,path:["source",...I.path]})))}var Q9=/^[A-Za-z0-9_$.-]{1,40}$/;function to(s){return Q9.test(s)?s:"<key>"}var e8=3,t8=160;function qa(s){let c=s.slice(0,e8).map((I)=>{let v=I.path.map(String).map((oe)=>to(oe)).join("."),U=I.code==="unrecognized_keys"?`Unrecognized ${I.keys.length===1?"field":"fields"}: ${I.keys.map(to).join(", ")}`:Fc(I.message,t8);return v?`${v}: ${U}`:U}),T=s.length-c.length;return T>0?`${c.join(", ")} (+${T} more)`:c.join(", ")}var n8=/^[A-Za-z0-9][-A-Za-z0-9._]*$/,o8='Bare source names resolve under metadata.pluginRoot, which this marketplace does not set (or sets to a path outside the marketplace root). Use a "./relative/path" source, or set metadata.pluginRoot to allow bare names.';function Oh(s){return typeof s==="string"&&n8.test(s)&&!s.includes("..")}function r8(s){if(typeof s!=="string"||s===""||s.startsWith("/")||s.includes("\\")||s.includes(":"))return;let c=s.replace(/^\.\//,"").replace(/\/+$/,"");if(c===""||c===".")return".";if(c.split("/").some((T)=>T===""||T==="."||T===".."))return;return c}function s8(s,c){if(c===void 0||!r(s)||!Oh(s.source))return s;let T=c==="."?`./${s.source}`:`./${c}/${s.source}`;return{...s,source:T}}function i8(s){if(!r(s)||!Array.isArray(s.plugins))return s;let c=r(s.metadata)?r8(s.metadata.pluginRoot):void 0;if(c===void 0)return s;return{...s,plugins:s.plugins.map((T)=>s8(T,c))}}var a8=e(()=>_e.object({$schema:_e.string().optional().describe("JSON Schema reference for editor autocomplete/validation; ignored at load time"),name:ud(VE),version:_e.string().optional().describe("Marketplace manifest version"),description:_e.string().optional().describe("Human-readable description of this marketplace"),owner:pd().describe("Marketplace maintainer or curator information"),plugins:_e.array(_e.unknown()).transform(X9).describe("Collection of available plugins in this marketplace"),forceRemoveDeletedPlugins:_e.boolean().optional().describe("When true, plugins removed from this marketplace will be automatically uninstalled and flagged for users"),metadata:_e.object({pluginRoot:_e.string().optional().describe('Base directory for bare plugin source names, relative to the marketplace root (e.g. "./plugins" resolves "source": "formatter" as ./plugins/formatter). Sources that already start with "./" are unaffected.'),version:_e.string().optional().describe("Marketplace version"),description:_e.string().optional().describe("Marketplace description")}).optional().describe("Optional marketplace metadata"),allowCrossMarketplaceDependenciesOn:_e.array(_e.string()).optional().describe("Marketplace names whose plugins may be auto-installed as dependencies. Only the root marketplace's allowlist applies — no transitive trust."),renames:_e.preprocess(J9,_e.record(_e.string(),_e.string().nullable()).optional()).catch(void 0).describe("Append-only map of old plugin name → current name (or null when removed). The loader follows this on plugin-not-found and migrates user settings to the new name.")})),Bye=e(()=>_e.preprocess(i8,a8()));var sd="[A-Za-z0-9][-A-Za-z0-9._]*",zye=new RegExp(`^${sd}$`);var as=e(()=>_e.string().regex(new RegExp(`^${sd}@${sd}$`),"Plugin ID must be in format: plugin@marketplace")),Gye=new RegExp(`[@:\\s/\\\\${K}]`,"u"),Wye=new RegExp(`[${K}]`,"u"),Ah=/[\p{Cc}\u200E\u200F\u202A-\u202E\u2066-\u2069]/u,l8=/^[A-Za-z0-9][-A-Za-z0-9._]*(@[A-Za-z0-9][-A-Za-z0-9._]*)?(@\^[^@]*)?$/,c8=e(()=>_e.union([_e.string().regex(l8,"Dependency must be a plugin name, optionally qualified with @marketplace").transform((s)=>s.replace(/@\^[^@]*$/,"")),_e.object({name:_e.string().min(1).regex(/^[A-Za-z0-9][-A-Za-z0-9._]*$/),marketplace:_e.string().min(1).regex(/^[A-Za-z0-9][-A-Za-z0-9._]*$/).optional()}).loose().transform((s)=>s.marketplace?`${s.name}@${s.marketplace}`:s.name)])),d8=e(()=>_e.object({version:_e.string().describe("Currently installed version"),installedAt:_e.string().describe("ISO 8601 timestamp of installation"),lastUpdated:_e.string().optional().describe("ISO 8601 timestamp of last update"),installPath:_e.string().describe("Absolute path to the installed plugin directory"),gitCommitSha:_e.string().optional().describe("Git commit SHA for git-based plugins (for version tracking)"),resolvedVersion:_e.string().optional().describe("Tag-derived semver this install resolved to (when fetched via a version constraint). Used by verifyAndDemote in preference to manifest.version, since the upstream may have forgotten to bump plugin.json."),auto:_e.boolean().optional().describe("True when this plugin was pulled in as a dependency rather than installed explicitly. Auto-installed plugins are eligible for removal by the orphan sweep when nothing depends on them. Absent = manual (preserves pre-flag installs)."),...UE(),...HE(),...BE()})),Kye=e(()=>_e.object({version:_e.literal(1).describe("Schema version 1"),plugins:_e.record(as(),d8()).describe("Map of plugin IDs to their installation metadata")})),u8=e(()=>_e.enum(["managed","user","project","local"])),p8=e(()=>_e.object({scope:u8().describe("Installation scope"),projectPath:_e.string().optional().describe("Project path (required for project/local scopes)"),installPath:_e.string().describe("Absolute path to the versioned plugin directory"),version:_e.string().optional().describe("Currently installed version"),installedAt:_e.string().optional().describe("ISO 8601 timestamp of installation"),lastUpdated:_e.string().optional().describe("ISO 8601 timestamp of last update"),gitCommitSha:_e.string().optional().describe("Git commit SHA for git-based plugins"),resolvedVersion:_e.string().optional().describe("Tag-derived semver this install resolved to"),auto:_e.boolean().optional().describe("True when pulled in as a dependency. Eligible for orphan sweep."),copyHash:_e.string().optional().catch(void 0).describe("What a listed mod was copied as: compared at each load, and absent on any other plugin"),...UE(),...HE(),...BE()})),jye=e(()=>_e.object({version:_e.literal(2).describe("Schema version 2"),plugins:_e.record(as(),_e.array(p8())).describe("Map of plugin IDs to arrays of installation entries")})),$ye=e(()=>_e.object({version:_e.literal(2),plugins:_e.record(_e.string(),_e.unknown())}));var f8=e(()=>_e.object({source:B9().describe("Where to fetch the marketplace from"),installLocation:_e.string().describe("Local cache path where marketplace manifest is stored"),lastUpdated:_e.string().describe("ISO 8601 timestamp of last marketplace refresh"),autoUpdate:_e.boolean().optional().describe("Whether to automatically update this marketplace and its installed plugins on startup"),declaredByManagedSettings:_e.literal(!0).optional().describe("Managed settings declared this source for this name: when they later declare another, it is the organization moving its marketplace, and what its plugins saved stays")})),Vye=e(()=>_e.record(_e.string(),f8()));import*as Ch from"zod/v4";function ls(s){return s==="true"?!0:s==="false"?!1:s}var Qa=["aspell","hunspell","ispell"];import*as An from"zod/v4";var m8=["autoMode","deepLink","voice","briefView","screenReader"],g8={},Od={autoMode:{buildGate:()=>!0,shape:()=>({skipAutoPermissionPrompt:An.boolean().optional().describe("Whether the user has accepted the auto mode opt-in dialog"),useAutoModeDuringPlan:An.boolean().optional().describe("Whether plan mode uses auto mode semantics when auto mode is available (default: true)"),autoMode:An.object({allow:An.array(An.string()).optional().describe('Rules for the auto mode classifier allow section. Include the literal string "$defaults" to inherit the built-in rules at that position.'),soft_deny:An.array(An.string()).optional().describe('Rules for the auto mode classifier SOFT BLOCK section — destructive/irreversible actions that user intent can clear. Include the literal string "$defaults" to inherit the built-in rules at that position.'),hard_deny:An.array(An.string()).optional().describe('Rules for the auto mode classifier HARD BLOCK section — security boundaries that user intent does NOT clear. Include the literal string "$defaults" to inherit the built-in rules at that position.'),...!1,...{},environment:An.array(An.string()).optional().describe('Entries for the auto mode classifier environment section. Include the literal string "$defaults" to inherit the built-in entries at that position.'),classifyAllShell:An.boolean().optional().describe("When true, every Bash/PowerShell allow rule is suspended while auto mode is active so all shell commands are routed through the classifier (higher safety, more classifier calls). Default: false.")}).optional().describe("Auto mode classifier prompt customization")}),permissionModes:()=>[]},deepLink:{buildGate:()=>!0,shape:()=>({disableDeepLinkRegistration:An.enum(["disable"]).optional().describe("Prevent claude-cli:// protocol handler registration with the OS")})},voice:{buildGate:()=>!0,shape:()=>({voiceEnabled:An.boolean().optional().describe("Enable voice mode (hold-to-talk dictation)")})},briefView:{buildGate:()=>!0,shape:()=>({defaultView:An.enum(["chat","transcript"]).optional().describe("Default transcript view: chat (SendUserMessage checkpoints only) or transcript (full)")})},screenReader:{buildGate:()=>!1,shape:()=>g8}};function cs(){return m8.filter((s)=>Od[s].buildGate())}function bh(s){let c={};for(let T of s)c={...c,...Od[T].shape()};return c}function Ad(s){let c=[];for(let T of s)c.push(...Od[T].permissionModes?.()??[]);return c}import*as tl from"zod/v4";var tOe=new RegExp("\x00ESCAPED_STAR\x00","g"),nOe=new RegExp("\x00ESCAPED_BACKSLASH\x00","g");var oOe=new RegExp("\x00GLOBSTAR\x00","g");function Rh(s){return s.match(/^(.+):\*$/)?.[1]??null}function Th(s){let c=s.trimEnd();if(!c.endsWith("*"))return!1;let T=0,I=c.length-2;while(I>=0&&c[I]==="\\")T++,I--;return T%2===0}var li={filePatternTools:["Read","Write","Edit","Glob","NotebookRead","NotebookEdit","Cd"],bashPrefixTools:["Bash"],customValidation:{WebSearch:(s)=>{if(s.includes("*")||s.includes("?"))return{valid:!1,error:"WebSearch does not support wildcards",suggestion:"Use exact search terms without * or ?",examples:["WebSearch(claude ai)","WebSearch(typescript tutorial)"]};return{valid:!0}},WebFetch:(s)=>{if(s.includes("://")||s.startsWith("http"))return{valid:!1,error:"WebFetch permissions use domain format, not URLs",suggestion:'Use "domain:hostname" format',examples:["WebFetch(domain:example.com)","WebFetch(domain:github.com)"]};if(!s.startsWith("domain:"))return{valid:!1,error:'WebFetch permissions must use "domain:" prefix',suggestion:'Use "domain:hostname" format',examples:["WebFetch(domain:example.com)","WebFetch(domain:*.google.com)"]};return{valid:!0}}}},sOe=[...li.filePatternTools,"Grep","MultiEdit","LS"];function Cd(s){return li.filePatternTools.includes(s)}function Dh(s){return li.bashPrefixTools.includes(s)}function Lh(s){return Object.hasOwn(li.customValidation,s)?li.customValidation[s]:void 0}function Ph(s,c){let T=0,I=c-1;while(I>=0&&s[I]==="\\")T++,I--;return T%2!==0}function Ih(s,c){let T=0;for(let I=0;I<s.length;I++)if(s[I]===c&&!Ph(s,I))T++;return T}var _8=/(?:^|[^\\])\\[()]/;function E8(s){return _8.test(s)&&Ih(s,"(")!==Ih(s,")")}var h8=/^(?:[|&;<>]|\d+[<>])/;function Nh(s){return h8.test(s)}function el(s){for(let c=0;c<s.length;c++)if(s[c]==="*"&&!Ph(s,c))return!0;return!1}function S8(s){if(s.endsWith(":*"))return;let c=s.trim().split(/\s+/).filter(Boolean),T=c[0];if(c.length<3||T===void 0||el(T))return;let I=!1;for(let v of c.slice(1)){if(Nh(v))return;if(el(v)){I=!0;continue}if(v.startsWith("-"))continue;return I?T:void 0}return}function y8(s){if(s.endsWith(":*"))return;let c=s.trim().split(/\s+/).filter(Boolean),T=c.findIndex((v)=>!/^[A-Za-z_]\w*\+?=/.test(v)),I=c[T]??"";return!Nh(I)&&c.slice(0,T).some(el)?/^[^*]+/.exec(I)?.[0]:void 0}function wh(s){if(!ei(s))return null;let c=es(s);if(c&&!ei(c.serverName))return null;return{valid:!1,error:`Wildcard tool name "${s}" is not supported in allow rules`,suggestion:"An allow pattern must name the scope it widens — globs are permitted only in the tool position after a literal mcp__<server>__ prefix. Deny and ask rules accept wildcards anywhere",examples:["mcp__puppeteer__*","mcp__github__get_*"]}}function bd(s,c){if(!s||s.trim()==="")return{valid:!1,error:"Permission rule cannot be empty"};let T=zc(s);if(T.kind==="malformed")return{valid:!1,error:"Malformed Tool(content) rule",suggestion:'Rules take the form Tool or Tool(content) and must end at the closing ")"; parentheses inside the content are literal'};if(T.kind==="call"&&T.rawContent===""){if(!T.toolName)return{valid:!1,error:"Empty parentheses with no tool name",suggestion:"Specify a tool name before the parentheses"};return{valid:!1,error:"Empty parentheses",suggestion:`Either specify a pattern or use just "${T.toolName}" without parentheses`,examples:[`${T.toolName}`,`${T.toolName}(some-pattern)`]}}let I=Z_(s),v=es(I.toolName);if(v){if(T.kind==="call"){let oe=v.toolName&&!ei(v.toolName)?`${I.toolName}__*`:void 0;return{valid:!1,error:"MCP rules do not support patterns in parentheses",suggestion:oe===void 0?`Use "${I.toolName}" without parentheses, or use "mcp__${v.serverName}__*" for all tools`:`Use "${I.toolName}" without parentheses. For all tools of a server, use "mcp__${v.serverName}__*" for the server "${v.serverName}", or "${oe}" for a server named "${v.serverName}__${v.toolName}"`,examples:[`mcp__${v.serverName}`,`mcp__${v.serverName}__*`,v.toolName&&v.toolName!=="*"?`mcp__${v.serverName}__${v.toolName}`:void 0,oe].filter(Boolean)}}if(c==="allow"){let oe=wh(I.toolName);if(oe)return oe}return{valid:!0}}if(!I.toolName||I.toolName.length===0)return{valid:!1,error:"Tool name cannot be empty"};if(c==="allow"){let oe=wh(I.toolName);if(oe)return oe}if(!I.toolName.includes("_")&&I.toolName[0]!==I.toolName[0]?.toUpperCase())return{valid:!1,error:"Tool names must start with uppercase",suggestion:`Use "${He(String(I.toolName))}"`};if(T.kind==="call"&&E8(T.rawContent)){let oe=Cd(I.toolName);return{valid:!1,error:'Ambiguous "\\(" or "\\)" beside an unescaped parenthesis',suggestion:oe?"Write a Windows path with forward slashes, or spell a literal parenthesis as [(] or [)]":'Double a backslash that is a path separator ("\\\\("), and escape literal parentheses in pairs',examples:oe?[`${I.toolName}(C:/Projects/(drafts)/**)`,`${I.toolName}(C:\\Projects\\[(]drafts)\\**)`]:[`${I.toolName}(C:\\tools\\\\(x86)\\run.exe *)`]}}let U=Lh(I.toolName);if(U&&I.ruleContent!==void 0){let oe=U(I.ruleContent);if(!oe.valid)return oe}if(Dh(I.toolName)&&I.ruleContent!==void 0){let oe=I.ruleContent;if(oe===":*")return{valid:!1,error:"Prefix cannot be empty before :*",suggestion:"Specify a command prefix before :*",examples:["Bash(npm *)","Bash(git *)"]};if(c==="allow"){let le=y8(oe);if(le!==void 0)return{valid:!0,warning:`${Bn(I)} has a * in a variable's value. A * also matches spaces, so this rule can also approve a different command that has ${le} later in the line, without a prompt. Give the variable an exact value instead.`,securityNotice:`${Bn(I)} allows any command at the * in its value · use an exact value`};let ye=S8(oe);if(ye!==void 0){let Re=ye==="git",Ie=Re?" For git, options such as -c and --exec-path can run arbitrary commands.":"",Le=Re?" (for example Bash(git status *))":"";return{valid:!0,warning:`${Bn(I)} has a wildcard before the rest of the command, so it also matches any options inserted at that position and approves them without a prompt.${Ie} Replace that * with the exact value you mean, or only use * after the subcommand${Le}.`,securityNotice:`${Bn(I)} allows any option at its * · use an exact value`}}}let re=Rh(oe)?.trimEnd();if(re!==void 0){if(el(re)){let le=Th(re),ye=le?"matches only commands containing a literal * at that position":"will likely never match",Re=le?re:`${re}*`,Ie=c==="allow"?" Replace that * with the exact value you mean.":Re.endsWith(":*")?"":` Use ${Bn({toolName:I.toolName,ruleContent:Re})} for wildcard matching.`;return{valid:!0,warning:`${Bn(I)} mixes * with the trailing :* prefix syntax, so it is matched as a literal prefix (the * is not expanded) and ${ye}.${Ie}`,...c!=="allow"&&{securityNotice:`${Bn(I)} reads its * literally${Re.endsWith(":*")?"":` · use ${Bn({toolName:I.toolName,ruleContent:Re})}`}`}}}}else if(oe.includes(":*")&&!oe.endsWith(":*")){let le=c==="allow"?"Replace that :* with the exact value you mean.":"It already matches as a * wildcard; moving :* to the end would make it a literal prefix and change which commands match.";return{valid:!0,warning:`${Bn(I)} has a :* that is not at the end, so it is matched as a * wildcard (the : is literal), not as the trailing :* prefix syntax. ${le}`,...c==="allow"&&{securityNotice:`${Bn(I)} reads its :* as a wildcard · use an exact value`}}}}if(Cd(I.toolName)&&I.ruleContent!==void 0){if(I.ruleContent.includes(":*"))return{valid:!1,error:'The ":*" syntax is only for Bash prefix rules',suggestion:'Use glob patterns like "*" or "**" for file matching',examples:[`${I.toolName}(*.ts) - matches .ts files`,`${I.toolName}(src/**) - matches all files in src`,`${I.toolName}(**/*.test.ts) - matches test files`]}}if(I.ruleContent!==void 0){let oe=I.toolName==="Write"||I.toolName==="NotebookEdit"||I.toolName==="MultiEdit"?"Edit":I.toolName==="Glob"?"Read":void 0;if(oe!==void 0&&!I.ruleContent.includes(":*"))return{valid:!0,warning:`${Bn(I)} is not matched by file permission checks — only ${oe}(path) rules are. Use ${Bn({toolName:oe,ruleContent:I.ruleContent})} instead (${oe} rules cover all file-${oe==="Edit"?"editing":"reading"} tools).`,...c!=="allow"&&{securityNotice:`${Bn(I)} never matches · use ${Bn({toolName:oe,ruleContent:I.ruleContent})}`}}}return{valid:!0}}var Rd=e(()=>kh()),xh=e(()=>kh("allow"));function kh(s){return tl.string().superRefine((c,T)=>{let I=bd(c,s);if(!I.valid){let v=I.error;if(I.suggestion)v+=`. ${I.suggestion}`;if(I.examples&&I.examples.length>0)v+=`. Examples: ${I.examples.join(", ")}`;T.addIssue({code:tl.ZodIssueCode.custom,message:v,params:{received:c}})}})}var pi=["accept","hold","refuse"],il=["off","basic","full"],O8=e(()=>se.record(se.string(),se.coerce.string()));function Vh(s){return se.object({allow:se.array(xh()).optional().describe("List of permission rules for allowed operations"),deny:se.array(Rd()).optional().describe("List of permission rules for denied operations"),ask:se.array(Rd()).optional().describe("List of permission rules that should always prompt for confirmation"),defaultMode:se.preprocess(Qr,se.enum([...or,...Ad(s)])).optional().describe("Default permission mode when Claude Code needs access ('manual' is accepted as an alias for 'default')"),disableBypassPermissionsMode:se.enum(["disable"]).optional().describe("Disable the ability to bypass permission prompts"),blockReadsOutsideWorkingDirectories:se.boolean().optional().describe('Refuse file-tool reads (Read, Grep, Glob, LSP) outside the working directories in every permission mode; true in any settings source wins. No allow rule lifts it. Also binds shell commands: one that names a path outside them is asked about in every mode, and the sandbox, where it is on, denies such reads. Also set when the user picks "block" on the one-time auto-mode prompt for a read outside the working directories.'),blockFileToolReadsOutsideWorkingDirectories:se.boolean().optional().describe("@internal For the program that starts Claude Code: read only from --settings at the launch; ignored in settings sent to a running session and in user, project, local and managed settings. Refuse reads outside the working directories, other than a shell command's, in every permission mode: reads by the file tools (Read, Grep, Glob, LSP) and by other built-in tools that send or publish a file, attachments, connectors' file inputs, Chrome uploads, memory recall, a project's CLAUDE.md includes and memory. No allow rule lifts it, and blockReadsExemptPaths applies to it. With it on, only the starting directory, --add-dir and the additionalDirectories of --settings or of settings sent later by that program (a full path, on Windows with its drive, or ~ or ~/…; a relative entry does not count) count as working directories, for it and for blockWritesOutsideWorkingDirectories: the user, project, local and managed settings and /add-dir add none. Claude Code's own files stay readable: this project's and this session's files in its configuration folder, this project's memory unless a user, project or local settings file, or managed settings, chose that folder, and the CLAUDE.md, rules, skills, plugins, agents and commands in its configuration folder. It is blockReadsOutsideWorkingDirectories without that setting's hold on the shell: it does not limit shell commands, sandboxed or not, nor what MCP servers and the programs that hooks run read by themselves. Like that setting, it does not stop Claude Code loading skills, commands, agents, output styles and workflows from .claude folders above the working directory (as far as the repository's root; outside a repository, the home folder or the disk's root), nor through links in a .claude folder, the working directory's own included. It does not limit writes, but Edit and Write need an existing file read first, and where Read is refused only a shell command (such as cat) can do that. Cloud sessions (Claude Code on the web), whose file tools run in a container that is itself the boundary, may not apply it."),blockWritesOutsideWorkingDirectories:se.boolean().optional().describe("Refuse file-tool writes (Write, Edit, NotebookEdit) outside the working directories in every permission mode; true in any settings source wins. No allow rule lifts it. Files that Claude Code keeps for the session are not refused: its plan files, scratchpad and background job folder, and the auto-memory of this project, unless a repository settings file points it elsewhere (a setting of the program that starts Claude Code can narrow this and the working directories). Nothing runs them unless the model asks. Also refuses file-tool writes to Claude Code settings files, inside the working directories too, and takes EnterWorktree and ExitWorktree, which move the working directory, out of the tools on offer (a setting of the program that starts Claude Code can keep them). Does not limit shell commands, MCP tools, the programs that hooks run, or the memory tools. Cloud sessions (Claude Code on the web), whose file tools run in a container that is itself the boundary, may not apply it."),blockReadsExemptPaths:se.array(se.string().catch("")).optional().catch(void 0).describe('For the program that starts Claude Code: read only from --settings and from settings that program sends while the session runs; ignored in user, project, local and managed settings. Absolute paths, each a folder with all below it or one file, that blockReadsOutsideWorkingDirectories lets through beside the working directories. It allows nothing: an allow rule, the permission mode or the user still decides each read, as with that setting off, and a shell command that hands such a path to a program is still asked about unless a Read allow rule covers it. The paths do not become working directories, so blockWritesOutsideWorkingDirectories refuses writes to them, and they are not told to MCP servers or to the model. Each path counts as written: a link in it is not followed and a pattern is not expanded, so list every spelling that a read may arrive by. Ignored: an entry that starts with ~, has a ".." segment or has white space at either end (as written or once normalized), a relative or network path, and the root of a filesystem. Does not change what sandboxed commands may read (sandbox.filesystem.allowRead does).'),workingDirectoriesAsGiven:se.array(se.string().catch("")).optional().catch(void 0).describe("For the program that starts Claude Code: read only from --settings and from settings that program sends while the session runs; ignored in user, project, local and managed settings. Absolute paths of working directories, each spelled exactly as it is passed, letter case included (the session folder, --add-dir, permissions.additionalDirectories). To decide what lies inside a listed working directory, Claude Code takes it as written and follows no link at it, so a link that later stands in its place gives the file tools no access to where the link leads. List real paths: the files of a listed path that runs through a link count as outside the working directories, because where they really are lies outside it. List a mapped network drive by its drive-letter path: Claude Code still derives the UNC form of that path by itself and adds it, as for any mapped drive. A file path that is itself spelled as a UNC path is judged as written, so a link on the share is not seen by that spelling. It adds no working directory and allows nothing. Once listed, a path stays so until the process ends, also if later settings leave it out. Ignored: an entry that is not already normalized (a relative path, one that starts with ~, a \"..\" segment, a separator at its end unless it is a filesystem root, forward slashes on Windows, white space at either end). Does not change what sandboxed commands may write."),disableAutoMode:se.enum(["disable"]).optional().describe("Disable auto mode"),denyInsteadOfPrompting:se.boolean().optional().describe("Never wait for a person to answer a tool permission prompt: a call that would prompt is denied at once, the model is told, and the turn carries on. This is what --permission-prompts none does for -p, in every kind of session, subagents and agent teams included. Allow rules, the permission mode, auto mode's classifier and PermissionRequest hooks decide first, as they do without it; it only ever denies, and allows nothing. Claude's questions and plan mode's tools are not offered to the model, and an MCP server's request for input is cancelled unless an Elicitation hook answers it. An app or script that answers prompts through canUseTool or --permission-prompt-tool is not asked either: answer from a PermissionRequest hook instead. Read from user settings, --settings and managed settings; project and local settings are ignored, and true in any of those sources wins."),additionalDirectories:se.array(se.string()).optional().describe("Additional directories to include in the permission scope")}).passthrough()}var XOe=e(()=>Vh(cs())),A8=e(()=>se.union([se.string(),se.object({}).passthrough().describe('{ id: stable id (letters, digits, ".", "_", "-"; max 64), text: the tip (max 500 characters, one line), cooldownSessions?: sessions to wait before showing it again (default 0), priority?: tie-break weight among never-shown tips (default 0) }')])),C8=e(()=>se.preprocess((s)=>Array.isArray(s)?s.filter((c)=>typeof c==="string"||!!c&&typeof c==="object"&&!Array.isArray(c)):[],se.array(A8()))),wd=e(()=>se.object({source:ai().describe("Where to fetch the marketplace from"),installLocation:se.string().optional().describe("Local cache path where marketplace manifest is stored (auto-generated if not provided)"),autoUpdate:se.boolean().optional().describe("Whether to automatically update this marketplace and its installed plugins on startup"),pluginDigests:se.record(se.string(),se.array(se.string()).catch([])).optional().catch(void 0).describe("Deprecated and ignored: settings that hold it still load. A plugin takes the organization tier when managed settings enable it, declare its marketplace with a remote source and list it in prependPlugins or appendPlugins.")})),Pd=e(()=>{let s=()=>se.number().min(0).max(1e4);return se.object({input:s(),output:s(),cacheRead:s(),cacheWrite:s()})}),Nd=e(()=>se.number().gt(0).lte(10).optional()),xd=e(()=>se.object({model:se.string().describe('Model to select, taken verbatim: an alias ("opus"), an Anthropic model ID, or a provider-format ID (Vertex, Bedrock, gateway). Same values --model accepts.'),label:se.string().optional().describe("Row title. Defaults to the model name."),description:se.string().optional().describe("Row subtitle. Defaults to a generic description."),behavesAs:se.string().optional().describe("For a model this version of Claude Code does not know: the ID of a model it does know "+'(e.g. "claude-opus-4-8") whose client-side handling — prompt profile, capability and effort '+"defaults — applies to it. Changes neither the row's label nor the model ID sent. Without it, "+"a model-catalog row for a model this version does not know is not offered until Claude Code is updated.")})),al=e(()=>se.object({serverName:se.string().regex(/^[a-zA-Z0-9_-]+$/,"Server name can only contain letters, numbers, hyphens, and underscores").optional().describe("Name of the MCP server that users are allowed to configure"),serverCommand:se.array(se.string()).min(1,"Server command must have at least one element (the command)").optional().describe("Command array [command, ...args] to match exactly for allowed stdio servers"),serverUrl:se.string().optional().describe('URL pattern with wildcard support (e.g., "https://*.example.com/*") for allowed remote MCP servers')}).refine((s)=>Ae([s.serverName!==void 0,s.serverCommand!==void 0,s.serverUrl!==void 0],Boolean)===1,{message:'Entry must have exactly one of "serverName", "serverCommand", or "serverUrl"'})),ll=e(()=>se.object({serverName:se.string().min(1,"Server name must be non-empty").refine((s)=>s.trim().length>0,{message:"Server name must not be whitespace-only"}).refine((s)=>s===s.trim(),{message:"Server name has leading or trailing whitespace and will never match (names are compared verbatim)"}).optional().describe("Name of the MCP server that is explicitly blocked"),serverCommand:se.array(se.string()).min(1,"Server command must have at least one element (the command)").optional().describe("Command array [command, ...args] to match exactly for blocked stdio servers"),serverUrl:se.string().optional().describe('URL pattern with wildcard support (e.g., "https://*.example.com/*") for blocked remote MCP servers')}).refine((s)=>Ae([s.serverName!==void 0,s.serverCommand!==void 0,s.serverUrl!==void 0],Boolean)===1,{message:'Entry must have exactly one of "serverName", "serverCommand", or "serverUrl"'})),Yh=e(()=>se.object({marketplace:se.string(),plugin:se.string()})),b8=e(()=>se.preprocess((s)=>{if(typeof s!=="string"||!as().safeParse(s).success)return s;let c=s.indexOf("@");return{marketplace:s.slice(c+1),plugin:s.slice(0,c)}},Yh())),R8=/[\x00-\x1f\x7f-\x9f\u2028\u2029]|\p{DI}/u;function T8(s){let c=s.replaceAll("/","\\");if(X(c))return!1;return/^\\{2}[^\\]/.test(c)}function D8(s){return G(s)||/^\/network\/servers(\/|$)/i.test(s)||J(s)}function L8(s){return/^\/(proc|dev\/(fd|stdin|stdout|stderr))(\/|$)/i.test(s)}function I8(s,c,T={}){if(c==="win32"){let I=s.replaceAll("/","\\");if(X(I))return!1;let v=T8(I);if(T.rejectUnc&&v)return!1;if(T.rejectDriveRelative){if(!/^[A-Za-z]:\\/.test(I)&&!v&&/^(\\|[A-Za-z]:)/.test(I))return!1}if($h.normalize(I)!==I)return!1;let U=I.split("\\");if(U.some((re)=>re==="."||re===".."))return!1;if(U.some((re,le)=>/[. ]$/.test(re)||re.includes(":")&&!(le===0&&/^[A-Za-z]:$/.test(re))))return!1;let oe=I.startsWith("\\\\")?I.slice(2):I;if(/\\{2}/.test(oe))return!1;return!I.endsWith("\\")||/^([A-Za-z]:)?\\$/.test(I)}if(T.rejectNetworkRoot&&D8(s))return!1;if(T.rejectMagicLinkRoot&&L8(s))return!1;if(jh.normalize(s)!==s)return!1;if(s.split("/").some((I)=>I==="."||I===".."))return!1;if(/\/{2}/.test(s))return!1;return!s.endsWith("/")||s==="/"}var w8=/\.(exe|ps1)$/i;function P8(s){return/\.ps1$/i.test(s)}function N8(s){return P8(s)&&/[[\]`*?]/.test(s)}var x8='a .ps1 path must not contain "[", "]", "`", "*", or "?" on Windows (PowerShell resolves them as wildcard syntax)',k8=()=>se.string().describe("Absolute path to the helper executable"),Vo=(s)=>se.preprocess((c)=>c===null?void 0:c,s.optional()).optional(),v8=Se,vh=(s)=>se.number().int().min(s).transform((c)=>Math.min(c,v8)),Mh=["path","script","defaultSettings"];function Xh(s){if(!s||typeof s!=="object"||Array.isArray(s))return!1;let c=s;return Mh.some((T)=>c[T]===null)&&Mh.every((T)=>c[T]===null||c[T]===void 0)}var Uh=64,rl=e(()=>se.object({path:k8(),timeoutMs:Vo(vh(1000)),refreshIntervalMs:Vo(se.union([se.literal(0),vh(60000)]))})),Jh=()=>se.enum(["replace","merge"]).describe("How the helper's managedSettings compose with the settings of the source that delivered this entry: 'replace' (default) — the output is the policy; 'merge' — the output is deep-merged over that source's own settings the way merged managed sources compose (helper scalars win, arrays union, objects merge — except fallbackModel, forceLoginOrgUUID, gatewayInternalNetworks, sandbox.filesystem.allowRead, sandbox.credentials.awsPairs, sandbox.ripgrep and the restriction allowlists such as allowedMcpServers, allowedProviders, availableModels and allowedHttpHookUrls, which are the helper's whole value when it emits one; tighten a permission with a deny), so a failed helper costs only the delta");function Zh(s){return s==="continue"||s==="refuse"}var M8=()=>se.preprocess((s)=>s===void 0||Zh(s)?s:"refuse",se.enum(["continue","refuse"]).describe(`What happens when this entry's helper fails at startup (bad path, missing file or interpreter, non-zero exit, timeout, oversize or invalid output) and no static settings payload (this entry's own, the linux entry's on WSL, or the map's "default") applies in its place: 'refuse' — Claude Code does not start, naming the failure; 'continue' — Claude Code starts without the helper's output, on the delivering source's own settings, with a /status notice. Default: 'refuse' when the entry comes from MDM or the managed settings file, 'continue' when it comes from remote managed settings. Any other value is treated as 'refuse', with a /status notice. The install and update commands start no session and are never refused over a remote entry: they report the refusal in /status. An entry whose other fields fail validation runs no helper; from MDM or the managed settings file, any value but 'continue' on it then refuses to start Claude Code until the entry is fixed, unless a static settings payload (the entry's own, kept when it validates, the linux entry's for a wsl one, or the map's "default") serves in its place. From remote, a non-interactive session runs the helper off settings verified this session without the interactive approval, so 'refuse' there too means the helper ran and failed; a launch whose remote settings could not be verified this session (offline, fetch failed) starts without the helper regardless; and a failure first reached after the session has started (settings verified or approved mid-session, which on a machine that only ever runs non-interactively is every launch) ends a session no person watches (non-interactive, a background session no client is attached to, or a teammate session) as the refused start would have, and leaves a watched interactive one (a terminal, with or without remote control, or an attached background session) running under a /status notice with its next start refused. Background refresh failures always keep the last good output whatever this says`)),U8=5,H8=()=>se.number().int().min(0).transform((s)=>Math.min(s,U8)).describe("How many more times to run this entry's helper when a run fails to execute — it could not be launched, exited non-zero, or was stopped at timeoutMs — before that counts as a failure (a non-negative integer; default 0, a single attempt; above 5 is treated as 5). Attempts are separated by a short randomized backoff (from 250 ms, doubling per attempt, at most 4 s each) and each attempt gets the full timeoutMs, so a start that waits on the helper can wait up to (retries + 1) × timeoutMs plus the backoff. Output the helper did produce and that was refused — oversized, not a JSON object, an invalid envelope, or settings that fail validation — is not retried, and neither is an invalid path. Applies alike at startup and on each background refresh; only once the attempts are used up do the entry's failure rules (a static settings payload in its place, onFailure, the refresh notice) apply, naming the last attempt's failure"),F8=(s)=>(s==="windows"?se.literal("pwsh",{message:"interpreter must be 'pwsh' on windows ('sh' is not supported there)"}):se.literal("sh",{message:"interpreter must be 'sh' on macos/linux/wsl"})).describe("Fixed interpreter for `script`: 'sh' (/bin/sh) on macos/linux/wsl entries; 'pwsh' (PowerShell at its fixed install locations, never PATH) on the windows entry"),B8="exactly one of path/script must be configured",z8='"script" and "interpreter" must be configured together',G8="script must be ASCII-only on Windows (PowerShell decodes stdin with the console OEM code page); spell non-ASCII characters as escapes, e.g. [char]0x00E9",W8=(s)=>se.string({message:"script must be a string"}).min(1,{message:"script must not be empty"}).max(65536,{message:"script must be at most 65536 characters"}).refine((c)=>!c.includes("\x00"),{message:"script must not contain NUL bytes"}).refine((c)=>Te(c),{message:"script must be valid UTF-8 (no lone surrogates)"}).refine((c)=>s!=="windows"||!/[\u0080-\uffff]/.test(c),{message:G8}).describe("Inline helper script, delivered to the fixed interpreter over stdin (never written to disk)");var vn=["macos","linux","windows","wsl"];function kd(s){return s==="wsl"?["wsl","linux"]:[s]}function K8(s){return s==="windows"?"win32":"posix"}function j8(s){return{rejectDriveRelative:s==="windows",rejectUnc:s==="windows",rejectNetworkRoot:s!=="windows",rejectMagicLinkRoot:s!=="windows",requireWin32ExecutableSuffix:s==="windows"}}function $8(s){let c=K8(s),T=j8(s);return se.string().max(1024,{message:"path must be at most 1024 characters"}).refine((I)=>!R8.test(I),{message:"path must not contain control, line/paragraph-separator, or invisible (default-ignorable) characters"}).refine((I)=>(c==="win32"?$h:jh).isAbsolute(I),{message:"path must be absolute"}).refine((I)=>!(c==="win32"&&T.requireWin32ExecutableSuffix)||w8.test(I),{message:"path must end in .exe or .ps1 on Windows"}).refine((I)=>c!=="win32"||!N8(I),{message:x8}).refine((I)=>I8(I,c,T),{message:c==="win32"?'path must be in normalized form: no "." or ".." segments, no doubled or trailing separators, no component ending in "." or a space, no ":" outside the drive letter, no device-namespace (\\\\?\\) prefix, no drive-relative (\\dir or C:name) or UNC (\\\\server\\share) form':'path must be in normalized form: no "." or ".." segments, no doubled or trailing separators, and not under a network automount root (/net/<host>, /Network/Servers, or macOS /.vol /.file /.nofollow /.resolve) or a kernel magic-link root (/proc, /dev/fd)'}).describe("Absolute path to the helper executable")}var vd=[...vn,"default"],Td=["path","script","interpreter","outputBehavior","onFailure","retries","timeoutMs","refreshIntervalMs","defaultSettings"],ol=["managedSettings","appendSystemPrompt"],dr=e(()=>se.record(se.string(),se.unknown()).superRefine((s,c)=>{for(let T of["policyHelper","policyHelpers"])if(s[T]!==void 0&&s[T]!==null)c.addIssue({code:"custom",message:`must not contain "${T}" — the default payload is applied as managed settings and cannot configure further policy helpers`});for(let T of Td)if(s[T]!==void 0&&s[T]!==null)c.addIssue({code:"custom",message:`must not contain "${T}" — a static payload is a managed-settings object, not a policyHelpers entry; entry fields (${Td.join("/")}) belong on the per-OS entries (policyHelpers.${vn.join("/")})`});for(let T of ol)if(s[T]!==void 0&&s[T]!==null)c.addIssue({code:"custom",message:`must not contain "${T}" — a static payload is the managedSettings SUBTREE, not the helper's stdout envelope; paste the object your helper emits UNDER "managedSettings", not the envelope around it`});for(let T of vd)if(s[T]!==void 0&&s[T]!==null)c.addIssue({code:"custom",message:`must not contain "${T}" — a static payload is the VALUE of a policyHelpers key (a managed-settings object), never another policyHelpers map; don't paste the map or its "${T}" line inside the slot`})})),V8='Entry must carry "path" (a helper executable) or "script" + "interpreter" (an inline helper), and/or "defaultSettings" (a static settings payload)';function Y8(s){let{path:c,script:T,interpreter:I,defaultSettings:v}=s;if(c!==void 0&&T!==void 0)return B8;if(T===void 0!==(I===void 0))return z8;if(c===void 0&&T===void 0&&v===void 0)return V8;return null}function qh(s,c){return rl().omit({path:!0}).extend({path:Vo($8(s)),script:Vo(W8(s)),interpreter:Vo(F8(s)),outputBehavior:Vo(Jh()),onFailure:Vo(M8()),retries:Vo(H8()),defaultSettings:se.preprocess((T)=>T===null?void 0:T,c.optional()).optional()}).check((T)=>{if(T.issues.length>0)return;let I=Y8(T.value);if(I!==null)T.issues.push({code:"custom",message:I,input:T.value})})}var JOe=e(()=>qh("linux",dr()));function Dd(s,c=dr()){return s==="default"?dr():qh(s,c)}var X8=e(()=>se.object(Object.fromEntries(vd.map((s)=>[s,se.preprocess((c)=>{if(c===null)return;if(s!=="default"&&Xh(c))return;return c},Dd(s).optional()).optional()])))),ui=["skills","agents","hooks","mcp"];function Qh(s){return se.preprocess((c)=>{if(!Array.isArray(c))return c;let T=c.filter((I)=>ui.includes(I));if(T.length<c.length)s?.(c.length-T.length);return T},se.union([se.boolean(),se.array(se.enum(ui))]))}function eS(){return se.union([se.array(se.string()),se.boolean(),se.undefined()])}var Hh=Object.freeze({type:"invalid-entry-stripped"}),J8=e(()=>se.union([se.object({type:se.literal("regex").describe('Config variant. This client understands "regex": matches turn output and builds a URL from named capture groups. Entries with other variants are preserved but skipped at runtime.'),pattern:se.string().describe("Regex matched against turn output (tool results and assistant text)"),url:se.string().describe("Link target. {name} placeholders are filled from named regex capture groups, e.g. (?<id>...) -> {id}. Values are URL-encoded; the origin must be literal in the template. The scheme must be https, http, or a recognized editor or workspace deep-link scheme: vscode, vscode-insiders, cursor, windsurf, zed, jetbrains, idea, slack, linear, notion, figma."),label:se.string().optional().describe("Badge text. {name} placeholders filled from named capture groups; defaults to the full match.")}).passthrough(),se.object({type:se.string().describe("Config variant discriminator for entries this client does not understand; the entry is preserved as-is and skipped at runtime.")}).passthrough()])),Fh=()=>se.number().int().min(j_).max($_).optional().catch(void 0);function tS(s,{strictPolicyHelperKeys:c=!1}={}){function T(v){return se.record(se.string(),wd()).check((U)=>{for(let[oe,re]of Object.entries(U.value))if(re.source.source==="settings"&&re.source.name!==oe)U.issues.push({code:"custom",input:re.source.name,path:[oe,"source","name"],message:`Settings-sourced marketplace name must match its ${v} key (got key "${oe}" but source.name "${re.source.name}")`})})}let I=(v,U)=>c?se.preprocess((oe)=>{if(oe===null)return;return U?U(oe):oe},v):v.catch(void 0);return{$schema:()=>se.string().optional().describe("JSON Schema reference for Claude Code settings"),apiKeyHelper:()=>se.string().optional().describe("Path to a script that outputs authentication values"),proxyAuthHelper:()=>se.string().optional().describe("Shell command that outputs a Proxy-Authorization header value (EAP)"),awsCredentialExport:()=>se.string().optional().describe("Path to a script that exports AWS credentials"),awsAuthRefresh:()=>se.string().optional().describe("Path to a script that refreshes AWS authentication"),gcpAuthRefresh:()=>se.string().optional().describe("Command to refresh GCP authentication (e.g., gcloud auth application-default login)"),processWrapper:()=>se.string().optional().describe("Corporate launcher argv prefix for the background-agent supervisor, the sessions and workers it hosts, and the other covered background processes listed in the Claude Code corporate-launcher documentation. Equivalent to the CLAUDE_CODE_PROCESS_WRAPPER environment variable, which takes precedence when set. Honored from managed settings, a --settings/SDK-supplied settings file, and user settings, in that precedence order; project and local settings are ignored."),policyHelper:()=>I(rl().optional(),(v)=>v&&typeof v==="object"&&!Array.isArray(v)&&v.path===null?void 0:v).describe("Executable that computes managed settings at startup. Honored only from admin-controlled policy sources."),policyHelpers:()=>I(X8().optional()).describe(`@internal Per-OS variant of policyHelper, keyed by platform: macos, linux, windows, wsl, plus an optional "default" entry that is a STATIC settings payload (a JSON object of managed settings, not a helper). Each per-OS entry carries a helper — a "path", or an inline "script" + "interpreter" delivered to a fixed interpreter over stdin, either with timeoutMs/refreshIntervalMs — its own static "defaultSettings" payload, or both; an entry may be payload-only. Selection for a platform walks its chain (the platform's own entry; on wsl the linux entry next): the first helper on the chain wins over policyHelper; if no helper is configured — or the selected helper fails at startup or refresh — the first payload applies (the chain's "defaultSettings" in platform-specific-first order, then the top-level "default", applied with no process spawned; unrecognized platforms reach only "default"); with no payload either, policyHelper. Honored from admin-controlled policy sources, and from remote managed settings — a payload of plain policy as delivered, like any other remote key; a helper, or a payload carrying anything the managed-settings approval dialog lists, only once the settings are verified this session and approved there (policyHelper itself is never honored from remote).`),...mn.CLAUDE_CODE_ENABLE_XAA&&{xaaIdp:()=>se.object({issuer:se.string().url().describe("IdP issuer URL for OIDC discovery"),clientId:se.string().describe("Claude Code's client_id registered at the IdP"),callbackPort:se.number().int().positive().optional().describe("Fixed loopback callback port for the IdP OIDC login. Only needed if the IdP does not honor RFC 8252 port-any matching.")}).optional().describe("XAA (SEP-990) IdP connection. Configure once; all XAA-enabled MCP servers reuse this.")},fileSuggestion:()=>se.object({type:se.literal("command"),command:se.string()}).optional().describe("Custom file suggestion configuration for @ mentions"),respectGitignore:()=>se.boolean().optional().describe("Whether file picker should respect .gitignore files (default: true). Note: .ignore files are always respected."),breakReminder:()=>se.object({enabled:se.boolean().optional().describe("Show a friendly nudge after sustained continuous use (default false). Must be true for the reminder to fire."),intervalMinutes:se.number().int().positive().optional().describe("Minutes of continuous use before the reminder fires (default 30). Re-fires every interval until you take a break."),breakThresholdMinutes:se.number().int().positive().optional().describe("Minutes of inactivity that count as a break and reset the timer (default 10)"),message:se.string().optional().describe("Custom reminder text. Leave unset for a rotating set of friendly nudges.")}).optional().describe("@internal Opt-in break reminder. When enabled, shows a dismissible nudge after sustained continuous use. Never blocks — just a friendly heads-up."),quietHours:()=>se.object({enabled:se.boolean().optional().describe("Show a one-time nudge when you start or keep using the CLI inside your quiet-hours window (default false)."),start:se.string().regex(/^([01]?\d|2[0-3]):[0-5]\d$/,'Expected 24-hour local time "HH:MM" (e.g. "22:00")').optional().describe('Start of the quiet-hours window, 24-hour local time "HH:MM".'),end:se.string().regex(/^([01]?\d|2[0-3]):[0-5]\d$/,'Expected 24-hour local time "HH:MM" (e.g. "07:00")').optional().describe('End of the quiet-hours window, 24-hour local time "HH:MM". May be earlier than start for an overnight range.')}).optional().describe("@internal Opt-in quiet hours. When enabled, shows a single soft nudge per session while inside the configured local-time window. Never blocks."),cleanupPeriodDays:()=>se.number().int().positive().optional().describe("Number of days to retain chat transcripts before automatic cleanup (default: 30). Minimum 1. Use a large value for long retention; use --no-session-persistence to disable transcript writes entirely. Cleanup deletes data only on this computer, not anything stored by Anthropic."),desktopSessionCleanupPeriodDays:()=>se.number().int().nonnegative().optional().describe("Retention ceiling in days for session transcripts created or last written by a desktop-host surface (Claude Desktop, Cowork), which are otherwise exempt from the cleanupPeriodDays sweep. 0 (the default) means no ceiling: such transcripts are kept until deleted another way. Unlike cleanupPeriodDays, 0 is allowed because this setting never disables writes — it only bounds an exemption from deletion. The ceiling is a hard cap: it also bounds an active archive grace, so the grace window of a release marker never keeps files past the ceiling. Ignored when cleanupPeriodDays is managed by org policy. A ceiling at or below cleanupPeriodDays effectively disables the exemption: those transcripts age out on the regular cleanupPeriodDays schedule, so the effective retention is whichever of the two periods is longer. Cleanup deletes data only on this computer, not anything stored by Anthropic."),syncClaudeAiSkills:()=>se.boolean().optional().describe("Set to false to turn off syncing of the skills you have enabled on claude.ai. In your user settings (or managed settings): nothing more is downloaded, previously synced skills (~/.claude/skills/synced) can no longer be run, are hidden from every session started afterwards, and are moved to ~/.claude/skills/.trash at the next launch (deleted after cleanupPeriodDays; re-downloaded, not restored, if you re-enable). In .claude/settings.local.json or --settings: downloads stop and synced skills are blocked and hidden for sessions in that workspace or invocation only (nothing is moved). Not read from project settings (.claude/settings.json). Only false is honored — the feature is enabled server-side for your account, so setting true does not turn it on early. While it is on, synced skills are available in every session, re-synced about every 10 minutes while a session is in use and a quarter as often otherwise, and removed when you disable them on claude.ai. Only applies when signed in with your Claude account."),syncClaudeAiPlugins:()=>se.boolean().optional().describe("Set to false to turn off syncing of the plugins you have enabled on claude.ai. In your user settings (or managed settings): nothing more is downloaded, previously synced plugins (~/.claude/plugins/synced) are hidden from every session started afterwards and moved to ~/.claude/plugins/.trash at the next launch (deleted after cleanupPeriodDays; re-downloaded, not restored, if you re-enable). In .claude/settings.local.json or --settings: downloads stop and synced plugins are hidden for sessions in that workspace or invocation only (nothing is moved). Not read from project settings (.claude/settings.json). Only false is honored — the feature is enabled server-side for your account, so setting true does not turn it on early. While it is on, synced plugins load in every session like plugins you installed yourself (a plugin you installed with the same name takes precedence), are re-synced at each launch, and are removed when you disable them on claude.ai. Only applies when signed in with your Claude account."),skillListingMaxDescChars:()=>se.number().int().positive().optional().describe("Per-skill description character cap in the skill listing sent to Claude (default: 1536). Descriptions longer than this are truncated. Raise to opt in to higher per-turn context cost."),skillListingBudgetFraction:()=>se.number().gt(0).lte(1).optional().describe("Fraction of the context window (in characters) reserved for the skill listing sent to Claude (default: 0.01 = 1%). When the listing exceeds this, descriptions are shortened to fit. Raise to opt in to higher per-turn context cost."),wslInheritsWindowsSettings:()=>se.boolean().optional().describe("When set to true in either admin-only Windows source — the HKLM SOFTWARE/Policies/ClaudeCode registry key or C:/Program Files/ClaudeCode/managed-settings.json — WSL reads managed settings from the full Windows policy chain (HKLM, C:/Program Files/ClaudeCode via DrvFs, HKCU) in addition to /etc/claude-code. Windows sources take priority. The flag is also required in HKCU itself for HKCU policy to apply on WSL (double opt-in: admin enables the chain, user confirms HKCU). On native Windows the flag has no effect."),env:()=>Yn(()=>O8()).describe("Environment variables to set for Claude Code sessions"),attribution:()=>{let v=se.object({commit:se.string().optional().describe("Attribution text for git commits, including any trailers. Empty string hides attribution."),pr:se.string().optional().describe("Attribution text for pull request descriptions. Empty string hides attribution."),sessionUrl:se.boolean().optional().describe("Whether to append the claude.ai session link to commits and PRs created from web or Remote Control sessions (default: true). Set to false to omit the Claude-Session trailer and PR-body link."),...!1}).passthrough();return se.union([se.boolean(),v],{error:(U)=>{let oe=(U.errors??[]).flat().filter((le)=>le.path.length>0);if(oe.length>0)return oe.map((le)=>`${le.path.join(".")}: ${le.message.replace(/^Invalid input: /,"")}`).join("; ");return`Expected false, true, or an object such as { "commit": "", "pr": "" }, but received ${Array.isArray(U.input)?"array":U.input===null?"null":typeof U.input}`}}).transform((U)=>{if(typeof U!=="boolean")return U;return U?{}:{commit:"",pr:"",sessionUrl:!1}}).pipe(v).optional().describe('Customize attribution text for commits and PRs. Each field defaults to the standard Claude Code attribution if not set. Set to false to hide all attribution, the same as { "commit": "", "pr": "", "sessionUrl": false }. Setting it to true is the same as leaving it out. Older Claude Code versions reject true or false here, so use the object form in settings files shared across versions.')},attributionProject:()=>se.string().optional().describe(`The claude.ai Project this session names for your organization's usage reports: the Project's ID, starting with "claude_proj_" or "chan_", or the UUID of a "claude_proj_" Project. An empty string names none and stops lower-precedence files from naming one; the organization default still applies. Sent only when Claude Code uses your claude.ai login, connects directly to the Anthropic API, is not in a cloud session, and CLAUDE_CODE_ATTRIBUTION_HEADER is not 0. CLAUDE_CODE_ATTRIBUTION_PROJECT takes precedence over it. Set in managed settings, it overrides people's own settings files. A project's .claude/settings.json and settings.local.json count only once the folder is trusted; for runs in a folder nobody has trusted, such as CI, use CLAUDE_CODE_ATTRIBUTION_PROJECT.`),attributionProjectPolicy:()=>se.object({default:se.string().optional().describe('The Project used when neither CLAUDE_CODE_ATTRIBUTION_PROJECT nor attributionProject names one: its ID, starting with "claude_proj_" or "chan_", or the UUID of a "claude_proj_" Project.')}).optional().describe("Your organization's default for attributionProject. Only honored from managed settings (server-managed, MDM / OS policy, or managed-settings.json); ignored in user, project, local and --settings sources."),includeCoAuthoredBy:()=>se.boolean().optional().describe("Deprecated: Use attribution instead. Whether to include Claude's co-authored by attribution in commits and PRs (defaults to true)"),...!1,...!1,includeGitInstructions:()=>se.boolean().optional().describe("Include built-in commit and PR workflow instructions in Claude's system prompt (default: true)"),permissions:()=>Yn(()=>Vh(s)).describe("Tool usage permissions configuration"),model:()=>se.string().optional().describe("Override the default model used by Claude Code"),fallbackModel:()=>se.array(se.string()).optional().describe('Fallback model(s) tried in order when the primary model is overloaded or unavailable. Each element accepts a model name or alias; "default" expands to the default model. CLI --fallback-model takes precedence.'),availableModels:()=>se.array(se.string()).optional().describe('Allowlist of models that users can select. Accepts family aliases ("opus" allows any opus version), version prefixes ("opus-4-5" allows that version and any model ID that extends it, so "claude-opus-5" also allows "claude-opus-5-5"), and full model IDs. If undefined, all models are available. If empty array, only the default model is available. Typically set in managed settings by enterprise administrators.'),enforceAvailableModels:()=>se.boolean().optional().describe("When true and availableModels is a non-empty array, the Default model selection is also constrained: if the default model for the user tier is not in availableModels, Default resolves to the first allowed availableModels entry instead. Has no effect when availableModels is unset or an empty array. Typically set in managed settings by enterprise administrators."),availableModelsMatch:()=>se.enum(["prefix","exact"]).optional().describe('How availableModels entries match model IDs. "prefix" (the default) lets an entry also allow any model ID that extends it, so "claude-opus-5" allows "claude-opus-5-5". "exact" keeps that matching but stops a model ID entry from allowing other versions: "claude-opus-5" allows Opus 5 and its dated and -fast IDs, but not Opus 5.5 or a later release until it is listed, and a -latest ID needs a -latest entry. Family aliases ("opus") still allow the whole family; aliases whose model depends on the release or settings (best, opusplan, default) are ignored. With "exact" and a list that names at least one model, the Default option also uses only a listed model; if none can be used, Claude Code will not start. Haiku background models, and hooks and other helper requests that pick their own model, are not restricted (deniedModels covers them; allowManagedHooksOnly limits hooks). Read from managed settings only.'),deniedModels:()=>se.array(se.string()).optional().describe('Models users cannot select, even when availableModels allows them. A family alias ("opus") blocks that family. A model ID blocks that version in every spelling: dates, -fast and provider prefixes are ignored, so "claude-opus-5-5" blocks every Opus 5.5 ID but not Opus 5. An ID with no minor version ("claude-opus-5") also blocks later minor versions, as it allows them in availableModels. Aliases whose model depends on the release or settings (best, opusplan, default) are ignored. The Default option steps down past a blocked model; if the Default has no allowed model to step down to, Claude Code will not start. Read from managed settings only.'),modelOverrides:()=>se.record(se.string(),se.string()).optional().describe('Override mapping from Anthropic model ID (e.g. "claude-opus-4-6") to provider-specific model ID (e.g. a Bedrock inference profile ARN). Typically set in managed settings by enterprise administrators.'),modelPicker:()=>se.object({options:se.array(xd()).describe("Rows to show in the /model picker, in order."),replaceBuiltInOptions:se.boolean().optional().describe("When true, the picker shows only the Default row and these options — the built-in "+"lineup, gateway-discovered models and ANTHROPIC_CUSTOM_MODEL_OPTION are hidden. When false or unset, these options are added after the built-in lineup.")}).optional().describe("Curate the /model picker: an ordered list of models with your own labels, independent of the built-in lineup and of Claude Code releases. availableModels still applies to these rows. Honored from managed, --settings/SDK, and user settings only (not from a project checkout); the highest-precedence of those that defines modelPicker wins outright (no merging across sources). Typically set in managed settings by enterprise administrators."),modelPricing:()=>se.object({multiplier:Nd(),overrides:se.record(se.string(),Pd()).optional()}).optional().describe("Price usage at your organization's contracted rates instead of list price. "+"Affects every spend figure Claude Code reports — /cost, the status line, the SDK total_cost_usd, "+"--max-budget-usd, and the OpenTelemetry cost metric and events — which remain USD estimates, not an invoice "+'(the per-Mtok price labels in /model stay at list). "overrides" maps a model ID to its USD-per-million-token rates (input, output, cacheRead, '+"cacheWrite — all four required, each 0 to 10000; cacheWrite prices both 5-minute and 1-hour cache writes). "+"A matching row is charged exactly as written; fast-mode and US-data-residency surcharges are not added on top. "+'A key Claude Code itself uses for a built-in model — its ID such as "claude-sonnet-4-6", or its '+"first-party, Bedrock (any or no region prefix), Vertex or Foundry ID — covers every dated and provider form "+"of that model; any other key — a gateway model alias, or a spelling Claude Code does not itself use — "+'matches that model ID only (case-insensitive), and such an exact match wins over a built-in row. On Bedrock an application inference profile is matched by its backing model. An invalid row or multiplier is reported and skipped; the rest still apply. "multiplier" in (0, 10] scales every computed cost, overridden or not (0.85 = 85% of the price, 1.2 = 120%). Only honored from managed settings (server-managed, MDM / OS policy, or managed-settings.json), '+"or — when none of those sets it — when supplied by a host application that manages the model "+"provider; ignored in user, project, local and --settings sources."),...!1,enableAllProjectMcpServers:()=>se.boolean().optional().describe("Whether to automatically approve all MCP servers in the project"),enabledMcpjsonServers:()=>se.array(se.string()).optional().describe("List of approved MCP servers from .mcp.json"),disabledMcpjsonServers:()=>se.array(se.string()).optional().describe("List of rejected MCP servers from .mcp.json"),disableClaudeAiConnectors:()=>se.boolean().optional().describe("When true in any settings source, claude.ai MCP cloud connectors are not auto-fetched or connected, and a claudeai-proxy server passed explicitly (e.g. via --mcp-config or the SDK mcpServers option) does not connect either. Where a managed or served source sets it, the connectors that the desktop app's Code tab hands to a session do not connect either, from the app version that shows them as turned off. Any-source-true wins: a project can opt out, but a project-level false cannot override a user-level true."),skillOverrides:()=>se.record(se.string(),se.enum(["on","name-only","user-invocable-only","off"])).optional().describe('Per-skill listing overrides keyed by skill name. "name-only" lists the skill without its description; "user-invocable-only" hides it from the model but keeps /name; "off" hides it from both. Absent = on.'),disableBundledSkills:()=>se.boolean().optional().describe("Disable the skills and workflows that ship with Claude Code: bundled skills and workflows are removed entirely; built-in slash commands stay typable but are hidden from the model. Plugins, .claude/skills/, and .claude/commands/ are unaffected. Equivalent to CLAUDE_CODE_DISABLE_BUNDLED_SKILLS=1."),managedMcpServers:()=>Yn(()=>se.record(se.string().refine(Kc,{error:Ka}),jc(),{error:$c})).describe(`MCP servers the organization provides to every user, keyed by server name, each with the .mcp.json entry shape; only "http" and "sse" servers are accepted (nothing that names a program to run, no \${VAR} references). Honored from managed settings only; users cannot remove them, deniedMcpServers still applies, and they need no allowedMcpServers entry. Not read in Claude Desktop's Code tab on a third-party deployment or in Cowork sessions, where Claude Desktop supplies and locks the session's MCP servers itself.`),allowedMcpServers:()=>Yn(()=>se.array(al())).describe("Enterprise allowlist of the MCP servers users may use. Governs servers users add (user, project and local config, --mcp-config, agent frontmatter, plugins, claude.ai connectors); servers the organization itself delivers (managedMcpServers, and managed-mcp.json entries with no ${VAR} in their command, args, url or header values) are allowed without being listed; a managed-mcp.json entry with ${VAR} in any of those must match this list. If undefined, all servers are allowed. If empty array, users can use no servers of their own. Denylist takes precedence - if a server is on both lists, it is denied."),deniedMcpServers:()=>Yn(()=>se.array(ll())).describe("Enterprise denylist of MCP servers that are explicitly blocked. If a server is on the denylist, it will be blocked across all scopes including enterprise. Denylist takes precedence over allowlist - if a server is on both lists, it is denied."),hooks:()=>Yn(()=>ar()).describe("Custom commands to run before/after tool executions"),worktree:()=>se.object({symlinkDirectories:se.array(se.string()).optional().describe('Directories to symlink from main repository to worktrees to avoid disk bloat. Must be explicitly configured - no directories are symlinked by default. Common examples: "node_modules", ".cache", ".bin"'),sparsePaths:se.array(se.string()).optional().describe("Directories to include when creating worktrees, via git sparse-checkout (cone mode). "+"Dramatically faster in large monorepos — only the listed paths are written to disk."),baseRef:se.enum(["fresh","head"]).optional().describe("Which ref new worktrees branch from. 'fresh' (default) branches from origin/<default-branch> for a clean tree. 'head' branches from your current local HEAD so unpushed commits and feature-branch state are present. Applies to --worktree, EnterWorktree, and agent isolation."),bgIsolation:se.enum(["worktree","none"]).optional().catch(void 0).describe("Isolation mode for background sessions in this repo. 'worktree' (default) blocks Edit/Write in the main checkout until EnterWorktree is called. 'none' lets background jobs edit the working copy directly."),location:se.string().optional().catch(void 0).describe("Directory under which Claude Code Desktop creates the worktrees of SSH sessions that run on this machine (an absolute path or one starting with ~/), instead of <project>/.claude/worktrees. Read by the desktop app from the SSH host user settings; a location chosen in the desktop app's SSH connection settings takes precedence. The CLI (--worktree, EnterWorktree, agent isolation) does not read it yet.")}).optional().describe("Git worktree configuration: the CLI --worktree flag, EnterWorktree and agent isolation, plus the location Claude Code Desktop uses for SSH-session worktrees on this machine."),disableAllHooks:()=>se.boolean().optional().describe("Disable all hooks and statusLine execution: the hooks defined in settings files and by installed plugins. Features built into Claude Code are not hooks in this sense and keep working; each has its own switch."),disableReplyCheck:()=>se.boolean().optional().describe("Disable the reply check in Claude Tag sessions on a self-hosted runner. The check re-prompts Claude, at most four times a turn, when a turn ends without a call to one of Claude Tag's reply tools. It is not a hook, so disableAllHooks does not affect it. Disabling it also stops two messages to Claude that Anthropic's service can request for such a session: a nudge after a long stretch of work with no visible update, and a reminder added to prompts. Claude Code's built-in reminder to give progress updates, on models that have it, is then no longer held back. Set it in managed settings; false there keeps the check on. Everywhere else it is ignored and the check stays on. Has no effect on sessions that Anthropic hosts."),disableAgentView:()=>se.boolean().optional().describe("Disable agent view (`claude agents`, `--bg`, /background, the on-demand daemon). Typically set in managed settings. Equivalent to CLAUDE_CODE_DISABLE_AGENT_VIEW=1."),disableRemoteControl:()=>se.boolean().optional().describe("Disable Remote Control (claude.ai/code, `claude remote-control`, `--remote-control`/`--rc`, auto-start, and the in-session toggle). Typically set in managed settings."),disableWorkflows:()=>se.boolean().optional().describe("Disable the Workflows feature. Code Review on pull requests and /ultrareview run in Anthropic's cloud and are not stopped by this setting, except an /ultrareview that has to restart partway through. A machine that runs a review itself refuses it when that machine's own administrator set this, or CLAUDE_CODE_DISABLE_WORKFLOWS in an `env` block, in its managed settings (MDM, the managed-settings file or an administrator's policy helper). Set in the environment before Claude Code starts, CLAUDE_CODE_DISABLE_WORKFLOWS disables Workflows. Beyond the cases above it stops a review only when the review's own session starts with it set."),disableArtifact:()=>se.boolean().optional().describe("Deprecated: use enableArtifact: false. Still honored — true disables the Artifact tool; false is ignored."),enableArtifact:()=>se.boolean().optional().describe("Turn the Artifact tool on or off. Off in any of managed, --settings, or user settings wins; project and local settings can only turn it off. Unset defaults to on once the feature is available."),enableWorkflows:()=>se.boolean().optional().describe("Enable or disable the Workflows feature for this user. Unset = default by plan once the feature is available."),workflowSizeGuideline:()=>se.enum(["unrestricted","small","medium","large"]).optional().describe('Advisory size guideline for the dynamic workflows Claude writes: "small" aims for fewer than 5 agents, "medium" fewer than 10, "large" fewer than 50, and "unrestricted" sends no guideline. Unset defaults to "medium", or "small" on Pro plans. A value here — including from managed settings — takes precedence over the "Dynamic workflow size" choice in /config, and that /config row is hidden while a settings file provides the key. This is a guideline, not an enforced limit.'),workflowKeywordTriggerEnabled:()=>se.boolean().optional().describe('Enable the "ultracode" keyword trigger: including the keyword in a prompt opts that turn into the Workflow tool. Set to false to disable the trigger. Default: true.'),disableSkillShellExecution:()=>se.boolean().optional().describe("Disable inline shell execution in skills and custom slash commands from user, project, or plugin sources. Commands are replaced with a placeholder instead of being run."),disableWindowsBashCommandSplit:()=>se.boolean().optional().describe("Windows only. Set to true to keep every Bash command in a single argument to bash, so that endpoint security tools that match text in process command lines see it whole. Otherwise Claude Code may split a long command over several arguments. With true, a command of about 7,000 characters or more, or fewer if it is full of quotes, may reach bash cut short, and then usually fails with a syntax error. Only honored from managed settings; ignored in user, project, local and --settings sources."),defaultShell:()=>se.enum(["bash","powershell"]).optional().describe("Default shell for input-box ! commands. Defaults to 'bash' on all platforms (no Windows auto-flip)."),bashEditDiffEnabled:()=>se.boolean().optional().describe("Whether the Bash tool shows a diff of the files a Bash command changed (PostToolUse Bash hooks get the changed-file list in tool_response). Set to false to turn that off. Default: off, except in auto and bypassPermissions modes when the Bash tool handles file edits or the model's configuration turns it on. Only user, flag or policy settings can turn it on in other modes."),bashOutputMaxChars:()=>se.number().int().positive().optional().catch(void 0).describe("How many characters of a successful Bash or PowerShell command's output Claude receives inline (default 30000; values clamp to 4000-128000). Output past this is saved to a file and Claude receives a short preview plus the path. When set, this also replaces BASH_MAX_OUTPUT_LENGTH, which on its own only sizes the read-back window."),taskOutputMaxChars:()=>se.number().int().positive().optional().catch(void 0).describe("Deprecated: no longer has any effect (the TaskOutput tool was removed). Read a background task's output file with the Read tool instead."),respondToBashCommands:()=>se.boolean().optional().describe("Whether Claude responds after an input-box ! bash command runs. Set to false to add the command output to context without a response. Default: true."),allowManagedHooksOnly:()=>se.boolean().optional().describe("When true (and set in managed settings), only hooks from managed settings and from plugins that managed settings enable run. User, project, and local hooks and the hooks of plugins the user installed are ignored. Features built into Claude Code are not hooks in this sense and keep working."),allowedHttpHookUrls:()=>se.array(se.string()).optional().describe('Allowlist of URL patterns that HTTP hooks may target. Supports * as a wildcard (e.g. "https://hooks.example.com/*"). When set, HTTP hooks with non-matching URLs are blocked. If undefined, all URLs are allowed. If empty array, no HTTP hooks are allowed. Arrays merge across settings sources (same semantics as allowedMcpServers).'),httpHookAllowedEnvVars:()=>se.array(se.string()).optional().describe("Allowlist of environment variable names HTTP hooks may interpolate into headers. When set, each hook's effective allowedEnvVars is the intersection with this list. If undefined, no restriction is applied. Arrays merge across settings sources (same semantics as allowedMcpServers)."),allowManagedPermissionRulesOnly:()=>se.boolean().optional().describe("When true (and set in managed settings), permission rules from user, project, local, and --settings files and allow rules from --allowedTools are ignored; only managed settings can add allow rules through settings. "+"The allowed-tools frontmatter of skills and custom commands from user, project, and --add-dir sources, and of plugins no managed setting vouches for, is ignored too. Plugins keep theirs only on an admin-backed channel: host-delivered --plugin-dir plugins (in Claude Desktop, only while this is not set by the organization's own managed settings), the official marketplace registered from its unpinned anthropics source, claude.ai-synced plugins Anthropic attests, the saved login organization's claude.ai-hosted marketplaces, marketplaces whose registered source managed extraKnownMarketplaces declares or an exact or owner-pinned (owner/*) strictKnownMarketplaces entry names at the path it pins (an npm marketplace source only when the registration and the declared entry pin the same registry, and a settings marketplace source only when every nested npm plugin entry pins one on a bare package name — unpinned, the package resolves through the member's own npm config, and a non-bare spelling packs as an exotic spec the pin does not bind, so nothing an entry names is what was fetched) (host and path patterns and enabledPlugins ids do not vouch); managed and bundled skills keep theirs. "+"--disallowedTools, skill disallowed-tools, and other deny and ask rules from the command line or the current session still apply."),allowManagedMcpServersOnly:()=>se.boolean().optional().describe("When true (and set in managed settings), allowedMcpServers is only read from managed settings. deniedMcpServers still merges from all sources, so users can deny servers for themselves. Users can still add their own MCP servers, but only the admin-defined allowlist applies."),allowAllClaudeAiMcps:()=>se.boolean().optional().describe("When true (and set in managed settings), claude.ai cloud MCP connectors load alongside managed-mcp.json instead of being suppressed by its exclusive-control lockdown. Default off preserves the lockdown. Read from managed settings only."),allowClaudeInChromeWithManagedMcp:()=>se.boolean().optional().describe("When true (and set in device managed settings: MDM, the managed-settings.json file, or a policy helper those configure), the built-in Claude in Chrome MCP server can run alongside managed-mcp.json instead of being blocked by its exclusive-control lockdown. deniedMcpServers and the organization's Claude in Chrome setting still block it. Default off preserves the lockdown."),strictPluginOnlyCustomization:()=>Qh().optional().catch(void 0).describe('When set in managed settings, blocks non-plugin customization sources for the listed surfaces. Array form locks specific surfaces (e.g. ["skills", "hooks"]); `true` locks all four; `false` is an explicit no-op. Blocked: ~/.claude/{surface}/, .claude/{surface}/ (project), settings.json hooks, .mcp.json. NOT blocked: managed (policySettings) sources, plugin-provided customizations. '+"Composes with strictKnownMarketplaces for end-to-end admin control — plugins gated by "+"marketplace allowlist, everything else blocked here."),statusLine:()=>se.object({type:se.literal("command"),command:se.string(),padding:se.number().optional(),refreshInterval:se.number().min(1).optional().catch(void 0).describe("Re-run the status line command every N seconds in addition to event-driven updates"),hideVimModeIndicator:se.boolean().optional().describe("Hide the built-in `-- INSERT --` / `-- VISUAL --` indicator below the prompt. Use this when your status line script renders `vim.mode` itself.")}).optional().describe("Custom status line display configuration"),prUrlTemplate:()=>se.string().optional().describe('URL template for PR links in the footer link badges and inline messages. The detected git PR is rendered as the first footer-link badge. Placeholders: {host} {owner} {repo} {number} {url}. Example: "https://reviews.example.com/{owner}/{repo}/pull/{number}"'),footerLinksRegexes:()=>se.array(J8().catch(Hh)).transform((v)=>v.filter((U)=>U!==Hh)).optional().catch(void 0).describe("Extra clickable footer badges that appear when a regex matches turn output (tool results and assistant responses). Read from user, flag, and managed settings only; ignored in project .claude/settings.json and local .claude/settings.local.json. At most 5 badges render; the oldest is displaced by newer matches and /clear removes them. Use to surface IDs printed by project CLIs as session links."),subagentStatusLine:()=>se.object({type:se.literal("command"),command:se.string()}).optional().catch(void 0).describe("Deprecated: no longer has any effect. Subagent rows always use the default look."),enabledPlugins:()=>se.record(se.string(),eS()).optional().describe('Enabled plugins using plugin-id@marketplace-id format. Example: { "formatter@anthropic-tools": true }. Only true turns on a marketplace plugin: a list of versions is accepted but leaves it off. Settings precedence is user < project < local < flag < policy, so to disable a plugin that project settings enable, set it to false in .claude/settings.local.json — setting false in ~/.claude/settings.json is overridden by the project.'),prependPlugins:()=>se.array(se.string()).optional().catch(void 0).describe("Managed plugins (plugin@marketplace ids that managed enabledPlugins sets true) whose hooks run first, outermost, in the listed order: the first id listed sees every event before any other plugin and every result after it. Managed plugins read in place from a local folder managed settings name, and not listed here or in appendPlugins, follow the listed ones; user, project and marketplace plugins come after those, with a managed plugin from a remote marketplace that neither key lists; then appendPlugins; then the built-in plugins. The bundled cc-plugin-sec-default@builtin seats itself outermost (on a machine with managed settings and for Team and Enterprise organizations) unless this list is set, in which case list it where it should sit or leave it out. Name it there as sec-default@builtin, the id every release reads, for as long as any machine in the organization may run a release from before its rename; a release that knows the new id reads either. Any other id that is not an enabled managed plugin is skipped; an id listed in both keys is prepended. Only honored from managed settings (or, on a machine with none, from user settings for your own plugins); ignored in project, local and --settings sources."),appendPlugins:()=>se.array(se.string()).optional().catch(void 0).describe("Managed plugins (plugin@marketplace ids that managed enabledPlugins sets true) whose hooks run last among plugins, innermost, in the listed order: the last id listed sits just above the built-in plugins and sees each event as every other plugin left it. Only honored from managed settings (or, on a machine with none, from user settings for your own plugins); ignored in project, local and --settings sources."),extraKnownMarketplaces:()=>Yn(()=>T("extraKnownMarketplaces")).describe("Additional marketplaces to make available for this repository. Typically used in repository .claude/settings.json to ensure team members have required plugin sources."),additionalMarketplaces:()=>Yn(()=>T("additionalMarketplaces")).describe("Alias for extraKnownMarketplaces: this key is read exactly as if it were spelled "+"extraKnownMarketplaces. Do not set both in one file — if both appear, this key is ignored "+"with a warning. Claude Code may rewrite this key as extraKnownMarketplaces when it updates the file. Clients older than this alias ignore it, so prefer extraKnownMarketplaces while older Claude Code versions still share the same settings."),strictKnownMarketplaces:()=>Yn(()=>se.array(Za())).describe('Enterprise strict list of allowed marketplace sources. When set in managed settings, ONLY these sources can be added as marketplaces. Entries match exactly, except that a github entry may use the owner-wildcard form {"source":"github","repo":"owner/*"} to allow every repository under that owner. The check happens BEFORE downloading, so blocked sources never touch the filesystem. '+"Note: this is a policy gate only — it does NOT register marketplaces. "+"To pre-register allowed marketplaces for users, also set extraKnownMarketplaces."),allowedMarketplaces:()=>Yn(()=>se.array(Za())).describe("Alias for strictKnownMarketplaces (managed settings only): this key is read exactly as if it "+"were spelled strictKnownMarketplaces. Do not set both in one file — if both appear, this key "+"is ignored with a warning. Clients older than this alias ignore it, so keep using strictKnownMarketplaces when the allowlist must also bind older Claude Code versions."),blockedMarketplaces:()=>Yn(()=>se.array(hd())).describe('Enterprise blocklist of marketplace sources. When set in managed settings, these sources are blocked from being added as marketplaces. Entries match exactly, except that a github entry may use the owner-wildcard form {"source":"github","repo":"owner/*"} to block every repository under that owner, and an entry naming a branch or tag in `ref` also blocks every full commit id in that repository. The check happens BEFORE downloading, so blocked sources never touch the filesystem.'),disableCommandPluginSources:()=>se.boolean().optional().describe("Controls the `command` plugin source, whose plugin directory is produced by running a marketplace-declared command on this machine. true: command-sourced plugins are never installed, updated, or re-resolved (the command never runs). false: explicitly allowed. "+"Unset: follows allowManagedHooksOnly — an org that restricts hook execution to managed "+"settings gets command sources disabled too. Only honored from managed settings."),...!1,disableSideloadFlags:()=>se.boolean().optional().describe("When true (and set in managed settings), rejects the --plugin-dir, --plugin-url, --agents, and non-sdk --mcp-config CLI flags at startup. Closes the CLI-flag bypass of strictKnownMarketplaces. Pair with allowedMcpServers for per-server MCP control; this setting does not gate other MCP entry points (SDK setMcpServers, claude mcp add, .mcp.json). Also blocks surfaces that spawn the CLI with these flags internally (see settings documentation). Only honored from managed settings; ignored in user/project/local settings."),pluginSuggestionMarketplaces:()=>se.array(se.string()).optional().describe("Marketplace names whose plugins may surface as contextual install suggestions (relevance-based tips). No marketplace-declared suggestions surface without this allowlist; the built-in tips for Anthropic's own plugins are unaffected. Only honored when set in managed settings (policy scope); the key is ignored in user, project, and local settings. A name only takes effect when the marketplace is registered on the machine AND its registered source is also declared in managed settings, either as the extraKnownMarketplaces entry for that name or as an entry of strictKnownMarketplaces. A marketplace registered from a different source under an allowlisted name is ignored. The official marketplace is exempt from the source requirement: allowlisting its name alone suffices, since that name can only register from the official Anthropic source."),forceLoginMethod:()=>se.enum(["claudeai","console","gateway"]).optional().catch(void 0).describe('Force a specific login method: "claudeai" for a Claude subscription (individual, Team, or Enterprise plans), "console" for Console billing, "gateway" for the Cloud gateway OIDC device flow'),forceLoginGatewayUrl:()=>se.string().min(1).optional().catch(void 0).describe('Cloud gateway URL to pre-fill during login, alongside forceLoginMethod: "gateway". Honored from admin-controlled managed settings (MDM / managed-settings.json / policy helper) and, on a machine with none of those, from your own user settings; ignored in project, local, flag, and remote-delivered settings.'),gatewayInternalNetworks:()=>se.array(se.string()).optional().catch([oS]).meta({default:void 0}).describe("IPv4 CIDR blocks (at most 4, each /8 to /32, not overlapping) your Cloud gateway sits in: the public block your organization numbers its internal network from, which lets /login reach a gateway there. A block must lie entirely outside private space, where /login accepts a gateway without this key. /login accepts a gateway inside a listed block over a direct connection only, and only when this machine's own address on that connection is inside the same block, so /login must happen from a machine whose own address is inside the block (not through a proxy, VPN pool, container or NAT segment outside it). A bar against copied settings files, not proof of location. Honored only from admin-controlled managed settings (MDM / managed-settings.json / policy helper); ignored in user, project, and remote-delivered settings."),parentSettingsBehavior:()=>se.enum(["first-wins","merge"]).optional().describe(`Controls whether the SDK parent tier (Options.managedSettings / --managed-settings) layers under this admin tier. "first-wins" (the default, except in a gateway session Claude Desktop's Code `+'tab launched, where "merge" is): parent is dropped — admin tiers '+`are the only policy source. "merge": parent's restrictive-only-filtered settings union under the admin winner. Has no effect when no admin tier exists (parent applies as the sole policy tier, still filtered restrictive-only).`),managedSourcesBehavior:()=>se.enum(["first-wins","merge"]).optional().describe('Controls how the managed settings sources compose. "first-wins" (default): the highest-priority source present (server-managed > MDM (managed plist / HKLM) > managed-settings.json) is the managed tier alone. "merge": every present source deep-merges with fixed '+"precedence server-managed > MDM > managed-settings.json — scalars "+"take the highest source's value (a restrictive boolean or enum — "+"the allowManaged*Only locks, the disable* switches, the sandbox "+"lock family — takes the strictest value any source sets) and "+"arrays union, except fallbackModel, the restriction allowlists allowedMcpServers, allowedProviders, availableModels, strictKnownMarketplaces and allowedChannelPlugins, and sandbox.credentials.awsPairs and sandbox.ripgrep (the highest source that sets one owns it whole), modelOverrides (the whole map of the highest source that sets it, dropped when that source sits below the one that sets availableModels), managedMcpServers (server names union; a name set by two sources takes the higher source's whole entry), and the keys taken from the highest source only: the auth pins forceLoginOrgUUID, forceLoginMethod, forceLoginGatewayUrl and gatewayInternalNetworks, the credential helpers apiKeyHelper, awsAuthRefresh, awsCredentialExport, gcpAuthRefresh, otelHeadersHelper and proxyAuthHelper, modelPicker, permissions.defaultMode, parentSettingsBehavior and the policyHelper configuration (env keeps its own per-key union). In both modes, a forceLoginOrgUUID, or a forceLoginMethod of claudeai or console, that this machine's own MDM policy or managed settings file sets applies ahead of server-managed settings. Honored only from the highest-priority source present; enable it only when every lower source is admin-controlled, since lower sources then contribute entries such as permissions.allow. HKCU and --managed-settings never take part in the merge."),forceLoginOrgUUID:()=>se.union([se.string(),se.array(se.string())]).optional().describe("Organization UUID to require for OAuth login. Accepts a single UUID string or an array of UUIDs (any one is permitted). When set in managed settings, login fails if the authenticated account does not belong to a listed organization."),allowedProviders:()=>se.preprocess((v)=>Array.isArray(v)?v.filter(Yc):v,se.array(se.enum(oi))).optional().catch(void 0).describe(`Managed settings only (managed-settings.json, MDM, or server-managed). The API providers Claude Code may use on this machine: "anthropic" (the Anthropic API on Anthropic's own host, via a claude.ai or Console sign-in or an API key; pair it with forceLoginMethod / forceLoginOrgUUID to require a sign-in), "bedrock", "vertex", "foundry", "anthropicAws", "mantle" (each meaning that provider's own service: its regional, FIPS, private-endpoint and sovereign-cloud hosts), "customEndpoint" (the `+"Anthropic API or a cloud provider's API sent to some other host — ANTHROPIC_BASE_URL, that "+"provider's ANTHROPIC_*_BASE_URL, a Foundry resource name that is not a bare name, or for "+"Bedrock the AWS SDK's AWS_ENDPOINT_URL[_BEDROCK[_RUNTIME]] — such as an LLM gateway; admitted "+`only for the value pinned in the "env" block of the same managed source), or "gateway" (the Cloud gateway sign-in). A session on a provider that is not listed is refused at startup, at login, and when it next contacts the API, with a message naming what selected the provider and the entry that would allow it. Under a list, where first-party traffic goes (ANTHROPIC_BASE_URL, a gateway sign-in) is honored only when the same managed source pins it in "env" (or forceLoginGatewayUrl), and a claude ssh tunnel into the machine is refused. A cloud provider's credential and tenancy variables, and the network path and TLS trust (HTTPS_PROXY, NODE_EXTRA_CA_CERTS, CLAUDE_CODE_CERT_STORE), are not judged by this list; set those for the fleet in the managed "env" block, whose values replace the user's. To route Bedrock through a gateway for a fleet, pin ANTHROPIC_BEDROCK_BASE_URL there (it is what the clients use, ahead of an endpoint_url in ~/.aws/config, which this list does not judge); the AWS SDK's AWS_ENDPOINT_URL* pins only sanction where the SDK's own clients go and never stand in for the "bedrock" entry. Unset allows every provider; an empty array allows none. Only a list in managed-settings.json or MDM is enforcement on the machine: it cannot be widened or hidden by server-managed settings and reaches every session. A list set `+"only in the admin console reaches only sessions that fetch your server-managed settings — not "+"a session on a cloud provider, another organization or a non-Anthropic ANTHROPIC_BASE_URL, one authenticating only with apiKeyHelper or ANTHROPIC_AUTH_TOKEN, a Pro/Max/Ultra login, --bare without "+"an API key, or a first launch before the fetch lands — all conditions the user controls. "+`Versions that predate this setting ignore it; pair it with a minimum-version policy on a mixed fleet. 'claude auth status' reports the Anthropic API as apiProvider "firstParty".`),...!1,forceRemoteSettingsRefresh:()=>se.boolean().optional().describe("When set in managed settings, the CLI blocks startup until remote managed settings are freshly fetched, and exits if the fetch fails"),otelHeadersHelper:()=>se.string().optional().describe("Path to a script that outputs OpenTelemetry headers"),outputStyle:()=>se.string().optional().describe("Controls the output style for assistant responses"),viewMode:()=>se.enum(["default","verbose","focus"]).optional().catch(void 0).describe("Default transcript view mode on startup"),language:()=>se.string().optional().describe('Preferred language for Claude responses and voice dictation (e.g., "japanese", "spanish")'),skipWebFetchPreflight:()=>se.boolean().optional().describe("Skip the WebFetch blocklist check for enterprise environments with restrictive security policies"),sandbox:()=>Yn(()=>Uc()),...!1,feedbackSurveyRate:()=>se.number().min(0).max(1).optional().describe("Probability (0–1) that the session quality survey appears when eligible. 0.05 is a reasonable starting point."),feedbackDrafts:()=>se.enum(["notify","quiet","off"]).optional().describe('Model-drafted feedback (the SendFeedback tool). "notify" (default) shows a one-line notice when a draft is queued; "quiet" shows only the footer counter; "off" disables the tool entirely so drafts are never queued.'),spinnerTipsEnabled:()=>se.boolean().optional().describe("Whether to show tips in the spinner"),clawdFileProgressEnabled:()=>se.boolean().optional().describe("@internal Whether to show Clawd, Claude Code's mascot, carrying the file on the progress line when a file goes to or from a connector"),spinnerVerbs:()=>se.object({mode:se.enum(["append","replace"]),verbs:se.array(se.string())}).optional().describe('Customize spinner verbs. mode: "append" adds verbs to defaults, "replace" uses only your verbs.'),spinnerTipsOverride:()=>se.object({excludeDefault:se.boolean().optional().catch(void 0),tips:C8().optional(),tipsFile:se.string().optional().catch(void 0).describe("Absolute or ~/ local path to a JSON file holding an array of tips (same shapes as `tips`); honored from user, --settings and on-disk managed settings only. Read once per CLI process (restart to pick up edits)."),label:se.string().optional().catch(void 0).describe('Prefix shown before your tips in the spinner (default "Tip")')}).passthrough().optional().catch(void 0).describe("Add your organization's own tips to the spinner tip rotation. tips: strings or {id, text, cooldownSessions?, priority?} objects; tipsFile: a JSON file of the same; label: prefix shown before your tips; excludeDefault: if true, only show your tips (default: false)."),syntaxHighlightingDisabled:()=>se.boolean().optional().describe("Whether to disable syntax highlighting in diffs"),maxProseWidth:()=>se.number().int().min(40).optional().catch(void 0).describe("Maximum width, in terminal columns, of the prose in Claude's responses (paragraphs, headings, lists, blockquotes). In a wider terminal the prose wraps at this width while tables and code blocks keep the full width; only the display wraps, the response text itself gains no line breaks. Minimum 40. Unset (the default) uses the full terminal width."),spellcheck:()=>se.object({enabled:se.boolean().optional().catch(void 0).describe("Turn on spell checking of the prompt input (default: false)"),checker:se.string().optional().catch(void 0).describe(`Which spell checker to run: ${Qa.map((v)=>`"${v}"`).join(", ")}, or "auto" (default) for the first of those found on PATH`),language:se.string().optional().catch(void 0).describe(`Dictionary to use, passed to the checker as-is (aspell --lang, hunspell -d, ispell -d), e.g. "en_GB"; names are checker-specific (letters, digits and _ - . , only). Default: the checker's own default`),color:se.string().optional().catch(void 0).describe(`Color of misspelled words (they are also underlined): a terminal color name such as "red" or "magenta", "#rrggbb", "rgb(r,g,b)", "ansi256(n)" or "ansi:<name>". Default: the theme's error color`)}).passthrough().optional().catch(void 0).describe(`Underline misspelled words in the prompt input as you type, using an installed ${Qa.slice(0,-1).join(", ")} or ${Qa.at(-1)} (off unless "enabled" is true; does nothing if none is installed). Read from user, flag and managed settings only (the whole block from the highest-precedence of those applies); ignored in project .claude/settings.json and .claude/settings.local.json.`),terminalTitleFromRename:()=>se.boolean().optional().describe("Whether /rename updates the terminal tab title (defaults to true). Set to false to keep auto-generated topic titles."),promptCacheTtl:()=>se.enum(Wr).optional().catch(void 0).describe('Prompt cache TTL for the main conversation (interactive, -p and SDK turns, plus the helpers that run inline with it): "5m" or "1h". Unset = automatic: 1 hour on a Claude subscription within its usage limits, 5 minutes on an API key, Bedrock, Vertex or Foundry. 1-hour cache writes are billed at a higher rate; the cache stays warm across longer breaks. The CLAUDE_CODE_PROMPT_CACHE_TTL environment variable takes precedence.'),subagentPromptCacheTtl:()=>se.enum(Wr).optional().catch(void 0).describe("Prompt cache TTL for everything outside the main conversation — subagents, workflows, background and helper requests: "+'"5m" or "1h". Unset = automatic (5 minutes unless ENABLE_PROMPT_CACHING_1H=1). The CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL environment variable takes precedence.'),alwaysThinkingEnabled:()=>se.boolean().optional().describe("When false, thinking is disabled. When absent or true, thinking is enabled automatically for supported models."),effortLevel:()=>se.enum(["low","medium","high","xhigh"]).optional().catch(void 0).describe("Persisted effort level for supported models."),maxEffortLevel:()=>se.enum(Gs).optional().catch(void 0).describe("Maximum effort level. Anything above it (an /effort or /model pick, --effort, CLAUDE_CODE_EFFORT_LEVEL, a model default) is clamped to it, on every provider including Bedrock, Vertex and Foundry. Combines with an organization's per-model effort cap by taking the lower of the two; across settings files the lowest value wins, and modelSettings.<model>.maxEffortLevel replaces it per model. Enforced client-side: an effort supplied through CLAUDE_CODE_EXTRA_BODY is not clamped."),modelSettings:()=>se.preprocess((v)=>typeof v==="object"&&v!==null&&!Array.isArray(v)?nr(v,(U,oe)=>Object.hasOwn(Object.prototype,oe)):v,se.record(se.string(),se.object({effortLevel:se.enum(["low","medium","high","xhigh"]).optional().catch(void 0).describe("Persisted effort level for this model."),maxEffortLevel:se.enum(Gs).optional().catch(void 0).describe('Maximum effort level for this model. Within one settings file it replaces the top-level maxEffortLevel for the model ("max" exempts it); across settings files the lowest applicable value wins. Keyed like effortLevel: the canonical model name also matches its dated, [1m], Bedrock and Vertex spellings.'),autoCompactWindow:se.union([se.literal("auto"),Fh()]).describe('Auto-compact window for this model, in tokens (100000 to 1000000), or "auto" for the window tuned for the model. Within one settings file it replaces the top-level autoCompactWindow for the model. /autocompact saves here. The canonical model name as key also matches its dated, [1m], Bedrock and Vertex spellings.')}).passthrough().optional().catch(void 0))).optional().catch(void 0).describe("Per-model settings keyed by canonical model name."),ultracode:()=>se.boolean().optional().catch(void 0).describe("Enable ultracode for the session: standing dynamic-workflow orchestration at any effort level. "+"Session-scoped — typically provided via --settings or the apply_flag_settings control request; "+"interactive toggles never persist it. Requires workflows to be enabled and a model that supports ultracode."),autoCompactWindow:()=>Fh().describe("Auto-compact window size"),...!1,advisorModel:()=>se.string().optional().describe("Advisor model for the server-side advisor tool."),fastMode:()=>se.boolean().optional().describe("When true, fast mode is enabled. When absent or false, fast mode is off. On Vertex a saved value is ignored: use /fast each session."),fastModePerSessionOptIn:()=>se.boolean().optional().describe("When true, fast mode does not persist across sessions. Each session starts with fast mode off."),promptSuggestionEnabled:()=>se.boolean().optional().describe("When false, prompt suggestions are disabled. When absent or true, prompt suggestions are enabled."),emojiCompletionEnabled:()=>se.boolean().optional().describe("When false, the :emoji: shortcode typeahead (the suggestion popup and the :name: inline replacement) is disabled. When absent or true, it is enabled."),awaySummaryEnabled:()=>se.boolean().optional().describe("@internal When false, the session recap (shown when you return after being away for 5+ minutes) is disabled. When absent or true, recap is enabled. Hidden from public SDK types until external launch."),responseComparisonEnabled:()=>se.boolean().optional().describe("@internal Set to false to stop Claude Code from showing two answers to one message and asking which is better. When absent or true, it may do so on some turns. Hidden from public SDK types until external launch."),showClearContextOnPlanAccept:()=>se.boolean().optional().describe('When true, the plan-approval dialog offers a "clear context" option. Defaults to false.'),askUserQuestionTimeout:()=>se.enum(["60s","5m","10m","never"]).optional().catch(void 0).describe(`Idle time before Claude's questions in the terminal auto-continue with any answers selected so far. When unset, the terminal does not auto-continue. The Claude desktop and web apps show Claude's questions in their own interface and may move on from some unanswered ones after a wait the app sets. Claude is then told that nobody answered and uses its best judgment. In sessions that read this setting, only "never" stops the apps from moving on. Leaving it unset does not. Cloud sessions and Cowork tasks do not read your user settings file (~/.claude/settings.json), and managed settings do not reach all of them. This setting is ignored in a project's settings files.`),dialogExpiry:()=>se.enum(["60s","5m","10m","never"]).optional().catch(void 0).describe('Max time a permission/user dialog forwarded to a remote client stays parked awaiting an answer, and how long a HELD cross-session message awaits approval, before either resolves to its safe no-action default (cancelled / dropped-with-denial). Defaults to 5m to match the long-standing remote-dialog deadline; "never" disables the deadline. Local-only permission prompts (no remote client) are unaffected. The CLAUDE_CODE_USER_DIALOG_TIMEOUT_MS env var, when set, overrides this. Read from trusted sources only (never a checked-in repo settings file).'),agent:()=>se.string().optional().describe("Name of an agent (built-in or custom) to use for the main thread. Applies the agent's system prompt, tool restrictions, and model."),modelProposedGoals:()=>se.enum(K_).optional().catch(void 0).describe("@internal Controls the ProposeGoal tool (model-proposed session goals). 'auto' (the default when absent) lets the model choose per proposal whether to ask for approval via its ask_user parameter; 'alwaysAsk' routes every model-proposed goal through the approval dialog; 'disabled' turns the tool off. A typed /goal is unaffected. Consent-affecting, so it is read "+"from trusted sources only (user/policy/flag) — "+"workspace-resident project and local settings are ignored."),companyAnnouncements:()=>se.array(se.string()).optional().describe("Company announcements to display at startup (one will be randomly selected if multiple are provided)"),pluginConfigs:()=>se.record(se.string(),se.object({mcpServers:se.record(se.string(),se.record(se.string(),se.union([se.string(),se.number(),se.boolean(),se.array(se.string())]))).optional().describe("User configuration values for MCP servers keyed by server name"),options:se.record(se.string(),se.union([se.string(),se.number(),se.boolean(),se.array(se.string())])).optional().describe("Non-sensitive option values from plugin manifest userConfig, keyed by option name. Sensitive values go to secure storage instead.")}).or(se.undefined())).optional().describe("Per-plugin configuration including MCP server user configs, keyed by plugin ID (plugin@marketplace format)"),remote:()=>se.object({defaultEnvironmentId:se.string().optional().describe("Default environment ID to use for cloud sessions")}).optional().describe("Cloud session configuration"),autoUpdatesChannel:()=>se.enum(["latest","stable","rc"]).optional().describe("Release channel for auto-updates (latest or stable)"),minimumVersion:()=>se.string().optional().describe("Minimum version to stay on - prevents downgrades when switching to stable channel"),requiredMinimumVersion:()=>se.string().optional().describe("Minimum Claude Code version required to start. If the running version is older, Claude Code exits at startup with instructions to update. Only enforced from managed (policy) settings."),requiredMaximumVersion:()=>se.string().optional().describe("Maximum Claude Code version allowed to start. If the running version is newer, Claude Code exits at startup with instructions to install an approved version. Only enforced from managed (policy) settings."),plansDirectory:()=>se.string().optional().describe("Custom directory for plan files, relative to project root. If not set, defaults to ~/.claude/plans/"),tui:()=>se.enum(["default","fullscreen"]).optional().describe('Terminal UI renderer. "fullscreen" uses the flicker-free alt-screen renderer with virtualized scrollback (equivalent to CLAUDE_CODE_NO_FLICKER=1). "default" uses the classic main-screen renderer.'),...!1,voice:()=>se.object({enabled:se.boolean().optional(),mode:se.enum(["hold","tap"]).optional().describe("'hold' (default): hold to talk. 'tap': tap to start, tap to stop+submit."),autoSubmit:se.boolean().optional().describe("Submit the prompt when hold-to-talk is released (hold mode only)")}).optional().describe("Voice mode settings (hold-to-talk / tap-to-toggle dictation)"),channelsEnabled:()=>se.boolean().optional().describe("Managed-org opt-in for channel notifications (MCP servers with the claude/channel capability pushing inbound messages). claude.ai Teams/Enterprise: default off. Console: default on unless managed settings exist. Set true to allow; users then select servers via --channels."),allowedChannelPlugins:()=>se.array(Yh()).optional().describe("Managed-org allowlist of channel plugins. When set, "+"replaces the default Anthropic allowlist — admins decide which "+"plugins may push inbound messages. Undefined falls back to the default. Requires channelsEnabled: true."),prefersReducedMotion:()=>se.boolean().optional().describe("Reduce or disable animations for accessibility (spinner shimmer, flash effects, etc.)"),timeFormat:()=>se.union([se.enum(G_),se.string()]).optional().describe('Clock format for times shown in the UI: "auto" (default, follows the locale), "12-hour", "24-hour", "24-hour-utc" ("18:05Z"), or a strftime pattern such as "%H:%M" (any value containing "%"; other values read as "auto"). A pattern replaces the time everywhere; message timestamps show only the pattern, so include %Y-%m-%d for the date. /config offers the presets; a pattern is set here.'),timeZone:()=>se.string().optional().describe('IANA time zone for times shown in the UI, e.g. "UTC" or "Europe/Dublin". Default: the system time zone. An unknown name falls back to the system time zone.'),doneMeansMerged:()=>se.boolean().optional().describe("@internal When true, Claude keeps working until the PR is ready for you to merge, a cron/Monitor is armed to resume later, or it hands you a self-contained next step."),totalTokensReminder:()=>se.enum(["off","infinite","fixed","countdown","padded-countdown"]).optional().describe("@internal Emit a <total_tokens>N tokens left</total_tokens> block in the system prompt, after each tool result, and (when totalTokensReminderAfterUserTurn is on) after each regular user prompt. 'infinite' uses the literal value Infinite, 'fixed' uses 5000000, 'countdown' uses the live remaining context-window tokens, 'padded-countdown' counts down from totalTokensReminderBudget (re-anchoring to the full budget on each regular user prompt when totalTokensReminderAfterUserTurn "+"is on — task-budget semantics). Defaults to padded-countdown for a "+"model with the total_tokens_reminder capability, else off. Env var CLAUDE_CODE_TOTAL_TOKENS_REMINDER overrides."),totalTokensReminderBudget:()=>se.number().int().positive().optional().describe("@internal Starting budget (tokens) for totalTokensReminder 'padded-countdown' mode. Defaults to 15000000. Server-controlled via GrowthBook; env var CLAUDE_CODE_TOTAL_TOKENS_REMINDER_BUDGET overrides."),totalTokensReminderAfterUserTurn:()=>se.boolean().optional().describe("@internal When true, emit the totalTokensReminder block after each regular user prompt and (for 'padded-countdown') re-anchor the task budget to the full configured value at the start of each user turn. When false, the reminder appears only in the system prompt and after each tool-result batch, and 'padded-countdown' counts down over the whole session. Defaults to on. Env var CLAUDE_CODE_TOTAL_TOKENS_REMINDER_AFTER_USER_TURN overrides; server-controlled via GrowthBook tengu_lapis_anchor_user_turn."),autoMemoryEnabled:()=>se.boolean().optional().describe("Enable auto-memory for this project. When false, Claude will not read from or write to the auto-memory directory."),autoMemoryDirectory:()=>se.string().optional().describe("Custom directory path for auto-memory storage. Supports ~/ prefix for home directory expansion. Ignored if set in projectSettings (checked-in .claude/settings.json) for security. When unset, defaults to ~/.claude/projects/<sanitized-cwd>/memory/."),...!1,autoDreamEnabled:()=>se.boolean().optional().describe("Enable background memory consolidation (auto-dream). When set, overrides the server-side default."),showThinkingSummaries:()=>se.boolean().optional().describe("Request API-side thinking summaries and show them in the conversation and in the transcript view (ctrl+o). Set explicitly to override the default for your install."),skipDangerousModePermissionPrompt:()=>se.boolean().optional().describe("Whether the user has accepted the bypass permissions mode dialog"),skipWorkflowUsageWarning:()=>se.boolean().optional().describe("@internal Whether the user has accepted the multi-agent workflow usage warning. Until set, auto permission mode prompts before running a workflow."),disableAutoMode:()=>se.enum(["disable"]).optional().describe("Disable auto mode"),remoteTools:()=>se.object({allowUnattendedServing:se.boolean().optional().describe("@internal When false in managed or user settings, a cloud session in auto mode may not run commands on this computer without a person approving each one, whatever consent the computer has given; a project, local or --settings value is ignored. Default: true.")}).optional().describe("@internal How this computer serves tool calls to cloud sessions"),sshConfigs:()=>se.array(se.object({id:se.string().describe("Unique identifier for this SSH config. Used to match configs across settings sources."),name:se.string().describe("Display name for the SSH connection"),sshHost:se.string().describe('SSH host in format "user@hostname" or "hostname", or a host alias from ~/.ssh/config'),sshPort:se.number().int().optional().describe("SSH port (default: 22)"),sshIdentityFile:se.string().optional().describe("Path to SSH identity file (private key)"),startDirectory:se.string().optional().describe("Default working directory on the remote host. Supports tilde expansion (e.g. ~/projects). If not specified, defaults to the remote user home directory. Can be overridden by the [dir] positional argument in `claude ssh <config> [dir]`.")})).optional().describe("SSH connection configurations for remote environments. Typically set in managed settings by enterprise administrators to pre-configure SSH connections for team members."),sshHostCommands:()=>se.unknown().meta({type:"array"}).optional().describe("SSH connections in Claude Desktop whose host comes from a command. A list of entries, each with `id`, `name` and `command`, and optionally `sshIdentityFile` and `startDirectory`. Desktop runs `command` on this computer when you create the connection or another host for it, not each time you connect. `command` is a program name or absolute path (single-quote a path with spaces), then plain arguments. Nothing else can be quoted. For pipes, variables or a leading `~`, use a script. On Windows, the program must be a full path from a drive letter, such as `C:/tools/acme.exe`, ending in `.exe`, `.cmd` or `.bat`. Quoted paths and Windows need Claude Desktop v4.16336.0 or later. The command must print only the host on standard output: `host` or `user@host` on one line, or a JSON object with `sshHost` and, optionally, `sshPort` and `startDirectory`. Desktop reads this key only from user settings and from this computer's managed settings. Claude Code itself does not use it."),claudeMd:()=>se.string().optional().describe("CLAUDE.md-style instructions injected as organization-managed memory. Only honored from managed/policy settings."),claudeMdExcludes:()=>se.array(se.string()).optional().describe('Glob patterns or absolute paths of CLAUDE.md files to exclude from loading. Patterns are matched against absolute file paths using picomatch. Only applies to User, Project, and Local memory types (Managed/policy files cannot be excluded). Examples: "/home/user/monorepo/CLAUDE.md", "**/code/CLAUDE.md", "**/some-dir/.claude/rules/**"'),pluginTrustMessage:()=>se.string().optional().describe('Custom message to append to the plugin trust warning shown before installation. Only read from policy settings (managed-settings.json / MDM). Useful for enterprise administrators to add organization-specific context (e.g., "All plugins from our internal marketplace are vetted and approved.").'),theme:()=>se.union([se.enum(W_),se.string().startsWith("custom:").transform((v)=>v)]).optional().catch(void 0).describe("Color theme for the UI"),editorMode:()=>se.enum(z_).optional().catch(void 0).describe("Key binding mode for the prompt input"),keybindingFlavor:()=>se.enum(["classic","readline"]).optional().catch(void 0).describe("Deprecated: no longer has any effect. The prompt's word-editing keys always follow Bash (readline) conventions."),vimInsertModeRemaps:()=>se.record(se.string(),se.unknown()).optional().catch(void 0).describe('Vim INSERT-mode key-sequence remaps, e.g. {"jj": "<Esc>"}. Each key is exactly two printable characters typed in sequence; "<Esc>" (return to NORMAL mode) is the only supported target. Applies when editorMode is "vim".'),verbose:()=>se.boolean().optional().describe("Show full tool output instead of truncated summaries"),preferredNotifChannel:()=>se.enum(B_).optional().catch(void 0).describe("Preferred OS notification channel"),autoCompactEnabled:()=>se.boolean().optional().describe("Automatically compact conversation when context fills"),precomputeCompactionEnabled:()=>se.boolean().optional().describe("Precompute the compaction summary in the background before it is needed. Only applies when auto-compact is on."),precomputeArmTokens:()=>se.number().int().positive().optional().catch(void 0).describe("@internal Read from the flag settings only, for a host that sends /compact below the automatic threshold: the main conversation starts its background compaction summary at this many tokens, when that is sooner than it would by itself, so that /compact finds it ready. A window set below the billing boundary compacts without a background summary, and this does not change that."),idleCompaction:()=>se.boolean().optional().describe("Set to false to stop Claude Code from compacting a long conversation while the session is idle. Defaults to true."),switchModelsOnFlag:()=>se.boolean().optional().describe("When safeguards flag a message, automatically switch to a different model to keep chatting. When off, your session will pause instead."),autoContinueAtUsageLimit:()=>se.boolean().optional().describe("When a claude.ai usage limit stops your session, wait for the limit to reset and continue the task automatically. When off, the limit dialog offers the wait as a choice instead."),autoScrollEnabled:()=>se.boolean().optional().describe("Auto-scroll the conversation view to bottom (fullscreen mode only)"),wheelScrollAccelerationEnabled:()=>se.boolean().optional().describe("Ramp mouse-wheel scroll speed during fast scrolls (fullscreen mode only)"),fileCheckpointingEnabled:()=>se.boolean().optional().describe("Snapshot files before edits so /rewind can restore them"),showTurnDuration:()=>se.boolean().optional().describe('Show "Cooked for Nm Ns" after each assistant turn'),showMessageTimestamps:()=>se.boolean().optional().describe("Stamp each message with its arrival time"),terminalProgressBarEnabled:()=>se.boolean().optional().describe("Emit OSC 9;4 progress sequences during long operations"),todoFeatureEnabled:()=>se.boolean().optional().describe("Enable the todo / task tracking panel"),teammateMode:()=>se.enum(Qs).optional().catch(void 0).describe("How spawned teammates execute (tmux, iterm2, in-process, auto)"),remoteControlAtStartup:()=>se.boolean().optional().describe("Start Remote Control bridge automatically each session"),remoteControl:()=>se.object({shareHostProfile:se.enum(il).optional().catch(void 0).describe("@internal What a Remote Control environment reports about this machine when it registers: 'off' reports nothing, 'basic' the OS, architecture and detected developer tools, 'full' also the names of MCP servers configured on this machine (never a repository's .mcp.json). When unset, the level comes from the feature rollout, which may be any of the three. Managed, --settings and user settings choose the level (the most restrictive wins); project and local settings can only lower it, never raise it. Read when Remote Control starts; lowering it later applies from the next registration, raising it from the next start.")}).optional().describe("@internal Remote Control (`claude remote-control`) options"),isolatePeerMachines:()=>se.boolean().optional().describe("Require explicit approval before SendMessage can reach a peer session on another machine via Remote Control"),daemonColdStart:()=>se.enum(["transient","ask"]).optional().describe("When no background service is running: 'transient' spawns one for this login session; 'ask' offers to install it persistently"),crossSessionInbound:()=>se.enum(pi).optional().catch(void 0).describe("Inbound cross-session peer messages (SendMessage from your other sessions): 'accept' delivers them, 'hold' parks them for your review without letting Claude act, 'refuse' opts this session out. An explicit value always wins. Unset (mode parity): a message auto-delivers only when the sending session's permission-mode class matches yours (bypass↔bypass or prompting↔prompting); a mismatched sender's message is held for your approval; a sender that asserts no class is held only while this session bypasses permission prompts."),autoUploadSessions:()=>se.boolean().optional().describe("Mirror local sessions to claude.ai as view-only (no remote control)"),inputNeededNotifEnabled:()=>se.boolean().optional().describe("Push to mobile when a permission prompt or question is waiting"),agentPushNotifEnabled:()=>se.boolean().optional().describe("Allow Claude to push proactive mobile notifications"),...ya(bh(s),(v)=>()=>v)}}function Md(s,c={}){let T=tS(s,c);return new is(T).whole()}var Z8=new Set,q8=new Set,cl=e(()=>new is(tS(cs()),Z8)),Q8=e(()=>cl().whole());function dl(s){return cl().forDocument(s)}var Bh=Object.freeze({serverName:"invalid-entry-stripped"});function nS(s){for(let c of s){let T=c.path.length>0?`${c.path.map(String).join(".")}: `:"";if(c.code==="invalid_union"){for(let I of c.errors){let v=nS(I);if(v!==null)return`${T}${v}`}if("note"in c&&typeof c.note==="string"&&c.note!=="")return`${T}${c.note}`}if(c.message!=="")return`${T}${c.message}`}return null}var Ud=e(()=>{let s=cl();return Eo().flatMap(({path:c,restrictive:T})=>{if(c.length!==1||c[0]==="strictPluginOnlyCustomization"||c[0]==="disableAllHooks"||typeof T!=="boolean"&&typeof T!=="string")return[];let I=c[0],v=s.field(I);if(v===void 0||v instanceof se.ZodCatch)return[];return[{key:I,restrictive:T,field:v}]})}),ul=e(()=>["strictKnownMarketplaces","blockedMarketplaces","strictPluginOnlyCustomization",...Ud().map((s)=>s.key)]),Yo=["managedSourcesBehavior","wslInheritsWindowsSettings"];function fi(s){return r(s)&&Object.values(s).every(fi)}function Hd(s){let c=s.wslInheritsWindowsSettings;if(c===void 0||c===null)return"disarmed";let T=ls(c);return T===!0?"armed":T===!1?"disarmed":"unreadable"}function Fd(s){let c=s.source==="hostPattern"?s.hostPattern:s.source==="pathPattern"?s.pathPattern:null;if(c!==null&&!fh(c))return`${s.source}: regex does not compile; the entry cannot be enforced`;if(s.source==="github"&&s.repo.includes("*")&&gh(s.repo)===null)return'github: an owner wildcard must be exactly "<owner>/*"; the entry cannot be enforced';if(s.source==="git"&&_h(s.url))return'git: wildcards are only supported in github-form entries, as "<owner>/*"; the entry cannot be enforced';if((s.source==="github"||s.source==="git")&&s.ref!==void 0&&s.ref.includes("*"))return`${s.source}: ref contains "*", which git does not allow in ref names; the entry cannot be enforced`;return null}function zh(s,c){return se.union([se.null().transform(()=>{return}),se.array(se.unknown()).transform((T)=>{let I=[];for(let[v,U]of T.entries()){let oe=(s==="blockedMarketplaces"?hd():Za()).safeParse(U);if(oe.success){let re=Fd(oe.data);if(re!==null){if(s==="blockedMarketplaces")c({path:`${s}[${v}]`,message:`Unenforceable entry was kept: ${re}; it can never match a marketplace source, but marketplace restrictions stay active`}),I.push(oe.data);else c({path:`${s}[${v}]`,message:`Invalid entry was ignored: ${re}`});continue}I.push(oe.data)}else c({path:`${s}[${v}]`,message:`Invalid entry was ignored: ${nS(oe.error.issues)??"failed validation"}`})}if(s==="blockedMarketplaces"&&T.length>0&&I.length===0)c({path:s,message:'Every entry of "blockedMarketplaces" was invalid; none of them can be enforced until it is fixed.'});return I})]).optional()}function Gh(s,c,T){return se.array(c.catch((I)=>(T({path:`${s}[]`,message:`Invalid entry was ignored: ${I.issues[0]?.message??"failed validation"}`}),Bh))).transform((I)=>I.filter((v)=>v!==Bh)).optional()}var oS="(unreadable)";function nl(s,c,T,I,v,U){return se.array(se.unknown()).transform((oe)=>{let re=[];for(let[le,ye]of oe.entries()){let Re=c.safeParse(ye);if(Re.success){re.push(Re.data);let Ie=v?.(ye,Re.data);if(Ie!==void 0)T({path:`${s}[${le}]`,message:Ie,statusOnly:!0})}else{let Ie=Re.error.issues[0],Le=Ie===void 0?"failed validation":Ie.path.length?`${Ie.path.join(".")}: ${Ie.message}`:Ie.message;T({path:`${s}[${le}]`,message:`Invalid entry was ignored: ${Le}`,...U?.invalidEntryIsStatusOnly&&{statusOnly:!0}})}}if(oe.length>0&&re.length===0)T({path:s,message:`Every entry of "${s}" was invalid; enforcing an empty allowlist (${I}) until it is fixed.`});return re}).optional().catch(()=>(T({path:s,message:`"${s}" was present but invalid; enforcing an empty allowlist (${I}) until it is fixed.`}),[]))}var ds=e(()=>new Map(Eo().flatMap(({path:s,restrictive:c})=>s.length>1?[[s.join("."),tr(c)[0]]]:[]))),us=["soft_deny","hard_deny","deny"],e7=new Map([["permissions",{restrictions:["deny","ask"],grants:["allow","additionalDirectories","defaultMode"]}],["autoMode",{restrictions:us,grants:["allow","environment"],withholdOnEntryDrop:!0}],["sandbox.network",{restrictions:["deniedDomains"],grants:["allowedDomains"],withholdOnEntryDrop:!0}],["sandbox.filesystem",{restrictions:["denyWrite","denyRead"],grants:["allowWrite","allowRead"],withholdOnEntryDrop:!0}]]),pl=new Map([["permissions.defaultMode",{read:(s)=>{let c=Qr(s);return[...or,...Ad(cs())].find((T)=>T===c)},inert:new Set(["default","dontAsk","plan"]),floor:"default"}]]);function Bd(s,c,T,I){let v=[],U=e7.get(s);if(U===void 0)return v;let oe=U.restrictions.flatMap((le)=>{switch(T(le)){case"unreadable":return[`"${le}"`];case"trimmed":return U.withholdOnEntryDrop?[`an entry of "${le}"`]:[];case void 0:return[]}});if(oe.length===0)return v;let re=oe.join(" and ");for(let le of U.grants){let ye=pl.get(`${s}.${le}`),Re=ye===void 0?c[le]:ye.read(c[le]);if(Re===void 0||ye?.inert.has(Re)===!0)continue;if(ye===void 0)delete c[le];else c[le]=ye.floor,v.push(le);I({path:`${s}.${le}`,message:ye===void 0?`"${le}" was withheld because ${re} in the same block could not be read; it takes effect again once that is fixed.`:`"${le}" was withheld because ${re} in the same block could not be read; treating it as ${di(ye.floor)} until that is fixed.`,...ye!==void 0&&{substituted:!0}})}return v}function sl(s){for(let c of ds().keys())if(c.startsWith(`${s}.`))return!0;return!1}function fl(s){return s!=="sandbox.credentials"&&!s.startsWith("sandbox.credentials.")&&sl(s)}function zd(s){let c=s;while(c instanceof se.ZodOptional||c instanceof Hc||c instanceof se.ZodPipe)c=c instanceof se.ZodPipe?c.out:c.unwrap();return c instanceof se.ZodObject?c:void 0}var Wh=new Set(["remoteTools","remoteControl"]);function rS(s,c){return typeof c==="object"&&c!==null&&s.has(c)}function sS(s,c,T){let I={};for(let[v,U]of Object.entries(c.shape)){let oe=`${s}.${v}`;if(T?.has(oe))continue;let re=ds().get(oe),le=zd(U);if(re!==void 0)I[v]=re;else if(le!==void 0&&sl(oe))I[v]=sS(oe,le,T)}return I}function Kh(s,c){return{path:s,message:`"${c}" was null, which is read as key removal; this source does not set it.`,statusOnly:!0,removal:!0}}function di(s){return typeof s==="string"?`"${s}"`:String(s)}function ci(s,c=0){let T=s===void 0||s.input===void 0?"failed validation":s.code==="custom"&&s.message!==void 0?s.message:("expected"in s)&&typeof s.expected==="string"?`expected ${s.expected}`:("values"in s)&&Array.isArray(s.values)?`expected ${s.values.map(di).join(" or ")}`:"failed validation",I=(s?.path??[]).slice(c);if(I.length===0)return T;return I.every((v)=>typeof v==="number")?`${I.join(".")}: ${T}`:`nested value: ${T}`}function iS(s){return s===!1||s==="false"}function Gd(s,c){if(c===null)return!0;return(s.includes(".")?ds().get(s):Ud().find((I)=>I.key===s)?.restrictive)==="disable"&&iS(c)}function Ld(s,c,T,I){let v=s.slice(s.lastIndexOf(".")+1);if(typeof c==="boolean")return se.preprocess((U)=>{let oe=ls(U);if(oe!==U)I({path:s,message:`"${v}" holds the string "${String(oe)}" where a boolean belongs; reading it as ${String(oe)}. Write it without quotes.`,statusOnly:!0});return oe},T);if(c==="disable")return se.preprocess((U)=>{if(iS(U)){I({path:s,message:`"${v}" was set to false; reading it as absent (the key's only value is "disable"). Remove the key instead.`,statusOnly:!0,removal:!0});return}return U},T);return T}function t7(s,c,T,I,v,U,oe){let re=s.slice(s.lastIndexOf(".")+1),le=ds().get(s),ye=oe?void 0:le,Re=pl.get(s),Ie=c instanceof se.ZodCatch?c.unwrap():void 0,Le=Ie instanceof se.ZodType?Ie:c;return Ld(s,le,Le,T).catch(($e)=>{if(ye!==void 0)return T({path:s,message:`"${re}" was present but invalid (${ci($e.issues[0])}); treating it as ${di(ye)}, its restrictive value, until it is fixed.`,substituted:!0}),I.add(re),ye;if(Re!==void 0)return T({path:s,message:`"${re}" was present but invalid (${ci($e.issues[0])}); treating it as ${di(Re.floor)} until it is fixed.`,substituted:!0}),I.add(re),Re.floor;if(Le.safeParse([]).success){let dt=$e.value;if(Array.isArray(dt)){let Me=new Map;for(let rt of $e.issues){let ct=rt.path?.[0];if(typeof ct==="number"&&!Me.has(ct))Me.set(ct,ci(rt,1))}let nt=Le.safeParse(dt.filter((rt,ct)=>!Me.has(ct)));if(Me.size>0&&Me.size<dt.length&&nt.success){for(let[rt,ct]of Me)T({path:`${s}[${rt}]`,message:`Invalid entry was ignored (${ct}); it cannot take effect until it is fixed.`});return U.add(re),nt.data}}}T({path:s,message:le===void 0?`"${re}" was present but invalid (${ci($e.issues[0])}) and was ignored; it cannot take effect until it is fixed.`:`"${re}" was present but invalid (${ci($e.issues[0])}) and was ignored, not treated as ${di(le)}; it cannot take effect until it is fixed.`}),v.add(re);return})}function Id(s,c,T,I={}){let v=s.slice(s.lastIndexOf(".")+1),U=new Set,oe=new Set,re=new Set,le={};for(let[Ie,Le]of Object.entries(c.shape)){let Ze=`${s}.${Ie}`,$e=zd(Le);le[Ie]=I.override?.[Ze]??($e!==void 0&&sl(Ze)?Id(Ze,$e,T,{...I,strictField:Le}):t7(Ze,Le,T,U,oe,re,I.neverSubstitute?.has(Ze)===!0))}let ye=new Set([...I.skeletonExclude??[],...I.neverSubstitute??[]]),Re=c.safeExtend(le);return se.unknown().transform((Ie)=>{if(Ie===null){T(Kh(s,v));return}U.clear(),oe.clear(),re.clear();let Le=r(Ie)||I.strictField===void 0?void 0:I.strictField.safeParse(Ie),Ze=Le?.success===!0&&r(Le.data)?Le.data:Ie,$e=r(Ze)?Re.safeParse(nr(Ze,(rt)=>rt===null||rt===void 0)):void 0;if(!r(Ze)||$e?.success!==!0){let rt=sS(s,c,ye),ct=Object.keys(rt);if(T({path:s,message:ct.length>0?`"${v}" was present but not an object; treating its locks as their restrictive values (${ct.join(", ")}) until it is fixed.`:`"${v}" was present but not an object and was ignored; it cannot take effect until it is fixed.`,...ct.length>0&&{substituted:!0}}),ct.length===0)return;if(!Wh.has(s))I.synthesized?.add(rt);return rt}for(let[rt,ct]of Object.entries(Ze)){let pt=`${s}.${rt}`;if(ct===null&&(ds().has(pt)||sl(pt)))T(Kh(pt,rt))}let dt={...$e.data};for(let rt of Bd(s,dt,(ct)=>oe.has(ct)?"unreadable":re.has(ct)?"trimmed":void 0,T))U.add(rt);let Me=nr(dt,(rt)=>rt===void 0);if(Object.keys(Me).length===0)return Object.entries(Ze).some(([rt,ct])=>ct!==void 0&&Object.hasOwn(c.shape,rt))?void 0:Me;let nt=I.synthesized;if(nt!==void 0&&!Wh.has(s)&&Object.entries(Me).every(([rt,ct])=>U.has(rt)||rS(nt,ct)||fi(ct)))nt.add(Me);return Me}).optional()}function Wd(s,c,T){let I=cl(),v=(qe)=>q8.has(qe)||I.carries(T,qe),U=(qe)=>{let Ve=I.field(qe);if(!Ve)throw Error("policyTolerantSettingsSchema: not a settings field of this build");return Ve},oe=new Map,re=(qe,Ve)=>{oe.set(qe,Ve)};for(let qe of["prependPlugins","appendPlugins"])if(I.has(qe))re(qe,()=>se.array(se.string()).optional().catch((Ve)=>{s({path:qe,message:`${Ve.issues[0]?.message??"Failed schema validation"}. This field was ignored; read as unset.`});return}));re("wslInheritsWindowsSettings",()=>se.union([se.null().transform(()=>{return}),se.preprocess((qe)=>{let Ve=ls(qe);if(Ve!==qe)s({path:"wslInheritsWindowsSettings",message:`"wslInheritsWindowsSettings" holds the string "${String(Ve)}" where a boolean belongs; reading it as ${String(Ve)}. Write it without quotes.`,statusOnly:!0});return Ve},U("wslInheritsWindowsSettings"))]).optional().catch(()=>{s({path:"wslInheritsWindowsSettings",message:`"wslInheritsWindowsSettings" was present but invalid (it takes true or false), so this source's WSL opt-in cannot be read until it is fixed. WSL fails it closed: in an administrator source it arms the Windows policy chain with no user-writable source (/etc/claude-code, HKCU) read beneath it; in HKCU it leaves HKCU unapplied.`});return})),re("strictKnownMarketplaces",()=>zh("strictKnownMarketplaces",s).catch(()=>(s({path:"strictKnownMarketplaces",message:'"strictKnownMarketplaces" was present but invalid; enforcing an empty allowlist (no marketplaces admitted) until it is fixed.'}),[]))),re("blockedMarketplaces",()=>zh("blockedMarketplaces",s).catch(()=>{s({path:"blockedMarketplaces",message:'"blockedMarketplaces" was present but invalid and was dropped; its entries cannot be enforced until it is fixed.'});return})),re("allowedMcpServers",()=>Gh("allowedMcpServers",al(),s).catch(()=>(s({path:"allowedMcpServers",message:'"allowedMcpServers" was present but invalid; enforcing an empty allowlist (no MCP servers admitted) until it is fixed.'}),[]))),re("deniedMcpServers",()=>Gh("deniedMcpServers",ll(),s).catch(()=>{s({path:"deniedMcpServers",message:'"deniedMcpServers" was present but invalid and was dropped; its entries cannot be enforced until it is fixed.'});return})),re("managedMcpServers",()=>se.unknown().transform((qe)=>ja(qe,(Ve,ut)=>s({path:Ve?`managedMcpServers.${Ve}`:"managedMcpServers",message:Ve?`Managed MCP server was ignored: ${ut}`:ut,statusOnly:!0}))).optional());let le=new Set;for(let{key:qe,restrictive:Ve,field:ut}of Ud()){let Et=typeof Ve==="string"?`"${Ve}"`:String(Ve);re(qe,()=>se.union([se.null().transform(()=>{return}),Ld(qe,Ve,ut,s)]).optional().catch(()=>(s({path:qe,message:`"${qe}" was present but invalid; treating it as ${Et} (its restrictive value) until it is fixed.`,substituted:!0}),le.add(qe),Ve)))}re("strictPluginOnlyCustomization",()=>se.union([se.null().transform(()=>{return}),Qh((qe)=>s({path:"strictPluginOnlyCustomization",message:`"strictPluginOnlyCustomization" lists ${qe} ${Q(qe,"entry","entries")} this version does not recognize as a surface (known: ${ui.join(", ")}); an unrecognized entry locks nothing, so check it for a typo.`,statusOnly:!0}))]).optional().catch(()=>(s({path:"strictPluginOnlyCustomization",message:'"strictPluginOnlyCustomization" was present but invalid; treating it as true (skills, agents, hooks and MCP servers load from managed settings and plugins only) until it is fixed.',substituted:!0}),le.add("strictPluginOnlyCustomization"),!0))),re("enabledPlugins",()=>{let qe=eS();return se.record(se.string(),se.unknown()).transform((Ve)=>{let ut=[],Et=0;for(let[yt,Pt]of Object.entries(Ve)){let Tt=qe.safeParse(Pt);if(Tt.success){ut.push([yt,Tt.data]);continue}Et++,s({path:as().safeParse(yt).success?`enabledPlugins.${yt}`:"enabledPlugins.<invalid id>",message:"Invalid entry was ignored: the value must be true, false, or a list of version constraints. This plugin is neither force-enabled nor blocked until it is fixed."})}if(Et>0&&ut.length===0){s({path:"enabledPlugins",message:'Every entry of "enabledPlugins" was invalid; no plugin is force-enabled or blocked by it until it is fixed.'});return}return Object.fromEntries(ut)}).optional().catch(()=>{s({path:"enabledPlugins",message:'"enabledPlugins" was present but invalid (not a map of plugin ids) and was ignored; no plugin is force-enabled or blocked by it until it is fixed.'});return})}),re("availableModels",()=>se.array(se.unknown()).transform((qe)=>{let Ve=[];for(let ut of qe)if(typeof ut==="string")Ve.push(ut);else s({path:"availableModels",message:`"availableModels" contained a non-string entry (${JSON.stringify(ut)}); the entry was ignored.`});return Ve}).optional().catch(()=>(s({path:"availableModels",message:'"availableModels" was present but invalid; enforcing an empty allowlist (only the default model is available) until it is fixed.'}),[]))),re("deniedModels",()=>se.array(se.unknown()).transform((qe)=>{let{entries:Ve,notes:ut}=mt(qe);for(let Et of ut)s({path:"deniedModels",message:Et});return Ve}).optional().catch(()=>{s({path:"deniedModels",message:gt});return})),re("allowedHttpHookUrls",()=>nl("allowedHttpHookUrls",se.string(),s,"no HTTP hooks may run")),re("httpHookAllowedEnvVars",()=>nl("httpHookAllowedEnvVars",se.string(),s,"no environment variables may be interpolated into HTTP hook headers")),re("allowedChannelPlugins",()=>nl("allowedChannelPlugins",b8(),s,"no channel plugins admitted",(qe,Ve)=>typeof qe==="string"?`"allowedChannelPlugins" entry "${qe}" was accepted; prefer the documented object form {"plugin": "${Ve.plugin}", "marketplace": "${Ve.marketplace}"}.`:void 0)),re("gatewayInternalNetworks",()=>se.array(se.string()).optional().catch(()=>(s({path:"gatewayInternalNetworks",message:'"gatewayInternalNetworks" was present but invalid; gateway sign-in governed by this source is refused until it is fixed.'}),[oS]))),re("forceLoginOrgUUID",()=>U("forceLoginOrgUUID").catch(()=>(s({path:"forceLoginOrgUUID",message:'"forceLoginOrgUUID" was present but invalid; no organization is permitted to log in until it is fixed.'}),[]))),re("allowedProviders",()=>nl("allowedProviders",se.custom(Xc,{message:`not a known provider name (${oi.join(", ")})`}),s,"no API provider may be used, so Claude Code will not start on this machine",void 0,{invalidEntryIsStatusOnly:!0}));let ye=!1,Re=(qe,Ve)=>{let ut=qe.safeParse(Ve);if(ut.success)return;return ut.error.issues.slice(0,3).map((Et)=>Et.path.length?`${Et.path.join(".")}: ${Et.message}`:Et.message).join("; ")},Ie;re("policyHelper",()=>se.preprocess((qe)=>{if(ye=!1,Ie=qe,qe&&typeof qe==="object"&&!Array.isArray(qe)){let Ve=qe;for(let ut of["defaultSettings","default",...ol])if(Ve[ut]!==void 0&&Ve[ut]!==null)s({path:"policyHelper",message:`"${ut}" on the singular policyHelper is ignored — static fallback payloads belong on the policyHelpers per-OS entries ("defaultSettings") or the map's "default" key. The intended fallback will NOT apply from here.`,statusOnly:!0});for(let ut of["policyHelper","policyHelpers"])if(Ve[ut]!==void 0&&Ve[ut]!==null)s({path:"policyHelper",message:`"${ut}" inside the singular policyHelper is ignored — "policyHelper" and "policyHelpers" are TOP-LEVEL settings keys; nothing nests inside the singular entry. The nested config will NOT apply from here.`,statusOnly:!0});for(let ut of vn)if(Ve[ut]!==void 0&&Ve[ut]!==null)s({path:"policyHelper",message:`"${ut}" on the singular policyHelper is ignored — per-OS entries live on the policyHelpers MAP ("policyHelpers": {"${ut}": ...}), not inside the singular key. The intended per-OS config will NOT apply from here.`,statusOnly:!0});if(Ve.claudeMd!==void 0&&Ve.claudeMd!==null)s({path:"policyHelper",message:`"claudeMd" on the singular policyHelper is ignored — "claudeMd" is a managed-settings key: put it at the settings top level or inside a static payload, or emit it from the helper's stdout envelope. The intended instructions will NOT apply from here.`,statusOnly:!0});if(Ve.outputBehavior!==void 0&&Ve.outputBehavior!==null)s({path:"policyHelper",message:`"outputBehavior" on the singular policyHelper is ignored — it is only honored on the policyHelpers per-OS entries (policyHelpers.${vn.join("/")}); this helper's output REPLACES the policy tier whatever the value says.`,statusOnly:!0});if(Ve.onFailure!==void 0&&Ve.onFailure!==null)s({path:"policyHelper",message:`"onFailure" on the singular policyHelper is ignored — it is only honored on the policyHelpers per-OS entries (policyHelpers.${vn.join("/")}); a failure of this helper REFUSES to start Claude Code whatever the value says.`,statusOnly:!0});if(Ve.retries!==void 0&&Ve.retries!==null)s({path:"policyHelper",message:`"retries" on the singular policyHelper is ignored — it is only honored on the policyHelpers per-OS entries (policyHelpers.${vn.join("/")}); this helper is run ONCE per start or refresh, never re-run, whatever the value says.`,statusOnly:!0});if(Ve.path===null||Ve.path===void 0)ye=!0}return qe===null?void 0:qe},rl().optional()).catch((qe)=>{s({path:"policyHelper",message:`${qe.issues[0]?.message??Re(rl(),Ie)??"Failed schema validation"}. This field was ignored.`,...ye&&{statusOnly:!0}});return}));let Le=(qe,Ve)=>{s({path:qe,message:`"${qe}" is not a valid static settings payload: ${Ve??"failed validation"}. When delivered from an OS-admin policy source (MDM or the managed settings file), Claude Code will not start until this is fixed.`,startupFatal:!0})},Ze=[],$e=(qe)=>{let Ve=!1,ut,Et=Dd(qe,dr().optional().catch((yt)=>{Ve=!0,Le(`policyHelpers.${qe}.defaultSettings`,yt.issues[0]?.message??Re(dr(),ut&&typeof ut==="object"&&!Array.isArray(ut)?ut.defaultSettings:void 0));return}));return se.preprocess((yt)=>{if(Ve=!1,ut=yt,qe!=="default"&&yt&&typeof yt==="object"&&!Array.isArray(yt)){let Pt=yt;for(let Mt of[...ol,"claudeMd"])if(Pt[Mt]!==void 0&&Pt[Mt]!==null)s({path:`policyHelpers.${qe}`,message:`"${Mt}" on the policyHelpers.${qe} entry is ignored — helper output cannot be pre-seeded on an entry; a static fallback payload goes under this entry's "defaultSettings" (a managed-settings object). The intended content will NOT apply from here.`,statusOnly:!0});for(let Mt of["policyHelper","policyHelpers"])if(Pt[Mt]!==void 0&&Pt[Mt]!==null)s({path:`policyHelpers.${qe}`,message:`"${Mt}" on the policyHelpers.${qe} entry is ignored — "policyHelper" and "policyHelpers" are TOP-LEVEL settings keys; nothing nests inside an entry. The nested config will NOT apply from here.`,statusOnly:!0});for(let Mt of vn)if(Pt[Mt]!==void 0&&Pt[Mt]!==null)s({path:`policyHelpers.${qe}`,message:`"${Mt}" on the policyHelpers.${qe} entry is ignored — per-OS entries are SIBLINGS on the policyHelpers map, not nested inside each other. The intended ${Mt} config will NOT apply from here.`,statusOnly:!0});if(Pt.default!==void 0&&Pt.default!==null)s({path:`policyHelpers.${qe}`,message:`"default" on the policyHelpers.${qe} entry is ignored — the per-entry static payload field is spelled "defaultSettings"; "default" is the MAP's any-platform catch-all key (a sibling of the OS entries). The intended fallback will NOT apply from here.`,statusOnly:!0});let Tt=Pt.onFailure;if(Tt!==void 0&&Tt!==null&&!Zh(Tt)){let Mt;if(typeof Tt==="string"){let jn=Tt.replace(/[^\x20-\x7e]/gu,"?");Mt=JSON.stringify(jn.length>Uh?`${jn.slice(0,Uh-1)}…`:jn)}else if(typeof Tt==="number"||typeof Tt==="boolean")Mt=String(Tt);else Mt=`a non-string value (${Array.isArray(Tt)?"array":typeof Tt})`;s({path:`policyHelpers.${qe}.onFailure`,message:`"onFailure": ${Mt} on the policyHelpers.${qe} entry is not a recognized value ("continue" or "refuse"); it is treated as "refuse" — a startup failure of this entry's helper with no static payload in its place will not start Claude Code.`,statusOnly:!0})}if(Xh(yt))return}return yt===null?void 0:yt},Et.optional()).catch((yt)=>{if(qe==="default"){Le("policyHelpers.default",yt.issues[0]?.message??Re(dr(),ut));return}if(Ve)return;let Pt=Re(Dd(qe),ut)??"failed validation",Tt=ut,Mt=Tt&&typeof Tt==="object"&&!Array.isArray(Tt)?Tt:null,jn=Mt?.onFailure,So=jn!==void 0&&jn!==null&&jn!=="continue",Dn=(Pn)=>{let ro=`policyHelpers.${qe}`;if(So)Ze.push({entryKey:qe,message:Pn});else s({path:ro,message:Pn,statusOnly:!0})};if(Mt){let Pn=Mt.defaultSettings;if(Pn!==void 0&&Pn!==null){let ro=dr().safeParse(Pn);if(ro.success){let so=Mt.outputBehavior,Wn=so===void 0||so===null?null:Jh().safeParse(so);if(Wn&&!Wn.success){Dn(`Invalid entry was ignored: ${Pt}. Its "defaultSettings" static payload was NOT kept: "outputBehavior" is unrecognized, so whether the payload replaces or merges over this source's settings is unknown. No policy helper runs on ${qe} from this entry.`);return}return s({path:`policyHelpers.${qe}`,message:`Invalid entry: its helper fields were ignored (${Pt}), but its "defaultSettings" static payload was kept. No policy helper runs on ${qe} from this entry.`,statusOnly:!0}),{defaultSettings:ro.data,...Wn&&{outputBehavior:Wn.data}}}}}Dn(`Invalid entry was ignored: ${Pt}. No policy helper runs on ${qe} from this entry.`);return})};re("policyHelpers",()=>se.preprocess((qe)=>{if(Ze=[],qe&&typeof qe==="object"&&!Array.isArray(qe)){let Ve=qe;for(let ut of["defaultSettings",...ol,"claudeMd"])if(Ve[ut]!==void 0&&Ve[ut]!==null)s({path:"policyHelpers",message:`"${ut}" directly on the policyHelpers map is ignored — static fallback payloads go on a per-OS entry's "defaultSettings" or the map's "default" key (a managed-settings object), and helper-output keys come from the helper's stdout. The intended content will NOT apply from here.`,statusOnly:!0});for(let ut of["policyHelper","policyHelpers"])if(Ve[ut]!==void 0&&Ve[ut]!==null)s({path:"policyHelpers",message:`"${ut}" inside the policyHelpers map is ignored — "policyHelper" and "policyHelpers" are TOP-LEVEL settings keys; the map's keys are the per-OS entries and "default". The nested config will NOT apply from here.`,statusOnly:!0});for(let ut of Td.filter((Et)=>Et!=="defaultSettings"))if(Ve[ut]!==void 0&&Ve[ut]!==null){let Et=ut==="script"||ut==="interpreter"?"; inline scripts are per-OS only (the singular policyHelper key takes a path)":ut==="outputBehavior"||ut==="onFailure"||ut==="retries"?"":", or on the singular policyHelper key";s({path:"policyHelpers",message:`"${ut}" directly on the policyHelpers map is ignored — helper configs go on a per-OS entry (policyHelpers.${vn.join("/")})${Et}. No helper runs from this field here.`,statusOnly:!0})}}return qe===null?void 0:qe},se.object(Object.fromEntries(vd.map((qe)=>[qe,$e(qe)]))).transform((qe)=>{for(let Ve of Object.keys(qe))if(qe[Ve]===void 0)delete qe[Ve];for(let{entryKey:Ve,message:ut}of Ze){let Et=`policyHelpers.${Ve}`,yt=kd(Ve).find((Tt)=>qe[Tt]?.defaultSettings!==void 0&&qe[Tt]?.defaultSettings!==null),Pt=yt!==void 0?`${yt}.defaultSettings`:qe.default!==void 0?"default":null;s(Pt!==null?{path:Et,message:`${ut} Its "onFailure" requires the helper; the "policyHelpers.${Pt}" static payload serves in its place.`,statusOnly:!0}:{path:Et,message:`${ut} Its "onFailure" requires the helper, so when delivered from an OS-admin policy source (MDM or the managed settings file), Claude Code will not start until this is fixed.`,startupFatal:!0})}return Ze=[],qe}).optional().catch((qe)=>(s({path:"policyHelpers",message:`"policyHelpers" could not be parsed: expected an object mapping OS keys (${vn.join(", ")}) to helper entries, plus an optional "default" settings payload (${qe.issues[0]?.message??"failed schema validation"}). When delivered from an OS-admin policy source (MDM or the managed settings file), Claude Code will not start until this is fixed.`,startupFatal:!0}),{}))));let dt=new WeakSet;for(let qe of I.keys){if(qe==="sandbox"||!fl(qe))continue;re(qe,()=>{let Ve=U(qe),ut=zd(Ve);if(ut===void 0)return Ve.catch((Et)=>{s({path:qe,message:`${Et.issues[0]?.message??"Failed schema validation"}. This field was ignored.`});return});return Id(qe,ut,s,{synthesized:dt,strictField:Ve})})}let Me=Object.freeze({mode:"deny"}),nt=Object.freeze({accessKeyIdVar:"_STRIPPED_",secretAccessKeyVar:"_STRIPPED_2_"}),rt=0,ct=[],pt=new Set,bt=new Set,Nt=c===void 0?"":`${[...c].reduce((qe,Ve)=>Math.imul(qe^Ve.charCodeAt(0),16777619)>>>0,2166136261).toString(16).toUpperCase().padStart(8,"0")}_`,Ct=(qe,Ve)=>{if(typeof qe!=="object"||qe===null)return;let ut=(Kt)=>Ve.some((io)=>io.path?.includes(Kt)),Et=(Kt)=>{let io=qe[Kt];if(typeof io==="string")return io;return ut(Kt)?"":void 0},yt=Et("accessKeyIdVar"),Pt=Et("secretAccessKeyVar"),Tt=Et("sessionTokenVar"),Mt=Ko;if(![yt,Pt,Tt].some((Kt)=>Kt!==void 0&&Mt.includes(Kt)))return;let jn=(Kt)=>Kt!==void 0&&qr().safeParse(Kt).success;rt+=1;let So=(Kt)=>`${Mc}${Kt}_${Nt}${rt}_`,Dn=jn(yt)?yt:So("ACCESS_KEY_ID"),Pn=jn(Pt)&&Pt!==Dn?Pt:So("SECRET_ACCESS_KEY"),ro=Tt===void 0?void 0:jn(Tt)&&Tt!==Dn&&Tt!==Pn?Tt:So("SESSION_TOKEN"),so=(Kt)=>Kt.startsWith(Mc);if(!so(Dn)&&!so(Pn)){let Kt=Mt.includes(Pn)?Pn:void 0;if(Pn=So("SECRET_ACCESS_KEY"),Kt!==void 0){let io=Ct({accessKeyIdVar:Kt},[]);if(io!==void 0)ct.push(io)}}let Wn=Wa().safeParse({accessKeyIdVar:Dn,secretAccessKeyVar:Pn,...ro!==void 0&&{sessionTokenVar:ro}});return Wn.success?Wn.data:void 0},Ut=(qe,Ve,ut)=>se.array(Ve.catch((Et)=>{let yt=ut(Et.value);if(yt!==void 0)return s({path:`sandbox.credentials.${qe}[]`,message:`Invalid entry was degraded to mode "deny": ${Et.issues[0]?.message??"failed validation"}. The credential stays blocked (not masked) until the entry is fixed.${qe==="files"?" Under sandbox.filesystem.disabled, file read-denies are not enforced.":""}`,substituted:!0}),yt;return s({path:`sandbox.credentials.${qe}[]`,message:`Invalid entry was ignored: ${Et.issues[0]?.message??"failed validation"}. This credential is NOT protected until the entry is fixed.`}),Me})).transform((Et)=>{let yt=Et.filter((Pt)=>Pt!==Me);if(Et.length>0&&yt.length===0)pt.add(qe);return yt}).optional().catch((Et)=>{if(typeof Et.value==="object"&&Et.value!==null&&!Array.isArray(Et.value)){let yt=Ve.safeParse(Et.value);if(yt.success)return s({path:`sandbox.credentials.${qe}`,message:`"${qe}" must be an array; a lone entry object was accepted as a one-element list. Wrap it in [ ] to silence this warning.`}),[yt.data];let Pt=ut(Et.value);if(Pt!==void 0)return s({path:`sandbox.credentials.${qe}`,message:`"${qe}" must be an array; its lone entry object was invalid and was degraded to mode "deny". The credential stays blocked (not masked) until it is fixed.`,substituted:!0}),[Pt]}return s({path:`sandbox.credentials.${qe}`,message:`${Et.issues[0]?.message??"Invalid value"}. "${qe}" was ignored; these credential entries are NOT protected until it is fixed.`}),pt.add(qe),[]});re("sandbox",()=>{let qe=se.object({files:Ut("files",Ba(),(Ve)=>{if(typeof Ve!=="object"||Ve===null||!("mode"in Ve)||Ve.mode!=="mask"&&Ve.mode!=="deny"||!("path"in Ve)||typeof Ve.path!=="string")return;let ut=Ba().safeParse({path:Ve.path,mode:"deny"});return ut.success?ut.data:void 0}),envVars:Ut("envVars",za(),(Ve)=>{if(typeof Ve!=="object"||Ve===null||!("mode"in Ve)||Ve.mode!=="mask"&&Ve.mode!=="deny"||!("name"in Ve)||typeof Ve.name!=="string")return;let ut=za().safeParse({name:Ve.name,mode:"deny"});return ut.success?ut.data:void 0}),allowPlaintextInject:Ld("sandbox.credentials.allowPlaintextInject",ds().get("sandbox.credentials.allowPlaintextInject"),se.boolean().optional(),s).catch((Ve)=>(s({path:"sandbox.credentials.allowPlaintextInject",message:`${Ve.issues[0]?.message??"Invalid value"}. "allowPlaintextInject" was degraded to an explicit false; plaintext credential injection stays disabled (lower-precedence values cannot enable it) until it is fixed.`,substituted:!0}),pt.add("allowPlaintextInject"),!1)),awsPairs:se.array(Wa().catch((Ve)=>{let ut=Ct(Ve.value,Ve.issues);if(ut!==void 0)return s({path:"sandbox.credentials.awsPairs[]",message:`Invalid pair was degraded to a non-functional suppressor: ${Ve.issues[0]?.message??"failed validation"}. It keeps implicit AWS auto-pairing suppressed but re-signs nothing until it is fixed.`,substituted:!0}),ut;return s({path:"sandbox.credentials.awsPairs[]",message:`Invalid pair was ignored: ${Ve.issues[0]?.message??"failed validation"}. SigV4 re-signing stays unconfigured for this pair until it is fixed.`}),nt})).transform((Ve)=>{let ut=Ve.filter((Et)=>Et!==nt);if(ct.length>0)ut.push(...ct),ct.length=0;if(Ve.length>0&&ut.length===0)pt.add("awsPairs");return ut}).optional().catch((Ve)=>{let ut=typeof Ve.value==="object"&&Ve.value!==null?Ct(Ve.value,[]):void 0,Et=typeof Ve.value==="object"&&Ve.value!==null&&(("accessKeyIdVar"in Ve.value)||("secretAccessKeyVar"in Ve.value)||("sessionTokenVar"in Ve.value));if(ut===void 0&&Et)return ct.length=0,s({path:"sandbox.credentials.awsPairs",message:`${Ve.issues[0]?.message??"Invalid value"}. "awsPairs" must be an array; its lone pair-shaped entry claimed no conventional AWS name and was ignored. SigV4 re-signing stays unconfigured until it is fixed.`}),pt.add("awsPairs"),[];let yt=ut!==void 0?[ut]:Ko.flatMap((Pt)=>{let Tt=Ct({accessKeyIdVar:Pt},[]);return Tt!==void 0?[Tt]:[]});if(ct.length>0)yt.push(...ct),ct.length=0;if(ut===void 0)pt.add("awsPairs");return s({path:"sandbox.credentials.awsPairs",message:`${Ve.issues[0]?.message??"Invalid value"}. "awsPairs" was degraded to non-functional suppressor pair(s); implicit AWS auto-pairing stays suppressed but nothing re-signs until it is fixed.`,substituted:!0}),yt}),sigv4:se.object(Object.fromEntries(["streaming","presigned","sigv4a"].map((Ve)=>[Ve,se.enum(["deny","passthrough"]).optional().catch((ut)=>(s({path:`sandbox.credentials.sigv4.${Ve}`,message:`${ut.issues[0]?.message??"Invalid value"}. "${Ve}" was degraded to an explicit deny; this SigV4 request shape stays denied until it is fixed.`,substituted:!0}),bt.add(Ve),"deny"))]))).transform((Ve)=>{let ut=Object.entries(Ve).filter(([,Et])=>Et!==void 0);if(ut.length>0&&ut.every(([Et])=>bt.has(Et)))pt.add("sigv4");return bt.clear(),Ve}).optional().catch((Ve)=>(s({path:"sandbox.credentials.sigv4",message:`${Ve.issues[0]?.message??"Invalid value"}. "sigv4" was degraded to an all-deny block (all shapes stay denied, and lower-precedence sigv4 values cannot take effect) until it is fixed.`,substituted:!0}),bt.clear(),pt.add("sigv4"),{streaming:"deny",presigned:"deny",sigv4a:"deny"}))}).transform((Ve)=>{let ut=Object.entries(Ve).filter(([,Et])=>Et!==void 0);if(ut.length>0&&ut.every(([Et])=>pt.has(Et)))dt.add(Ve);return pt.clear(),Ve}).optional().catch((Ve)=>{s({path:"sandbox.credentials",message:`${Ve.issues[0]?.message??"Failed schema validation"}. The credentials block was degraded to a fail-closed skeleton (all-deny sigv4, implicit AWS auto-pairing suppressed, no masking) until it is fixed.`,substituted:!0});let ut=Ko.flatMap((yt)=>{let Pt=Ct({accessKeyIdVar:yt},[]);return Pt!==void 0?[Pt]:[]});ct.length=0,pt.clear(),bt.clear();let Et={allowPlaintextInject:!1,awsPairs:ut,sigv4:{streaming:"deny",presigned:"deny",sigv4a:"deny"}};return dt.add(Et),Et});return Id("sandbox",Uc(),s,{override:{"sandbox.credentials":qe},skeletonExclude:new Set(["sandbox.enabled"]),neverSubstitute:new Set(["sandbox.failIfUnavailable"]),synthesized:dt})});let jt={};for(let qe of I.keys){if(!v(qe))continue;let Ve=oe.get(qe);jt[qe]=Ve?Ve():U(qe).catch((ut)=>{s({path:qe,message:`${ut.issues[0]?.message??"Failed schema validation"}. This field was ignored.`});return})}for(let[qe,Ve]of oe)if(!(qe in jt)&&v(qe))jt[qe]=Ve();return se.object(jt).passthrough().check((qe)=>{qe.issues.push(...I.wrongDocumentIssues(qe.value,jt))}).transform((qe)=>{for(let Et of Object.keys(qe))if(qe[Et]===void 0)delete qe[Et];let Ve=Object.keys(qe).filter((Et)=>!Yo.some((yt)=>yt===Et)&&!fi(qe[Et])),ut=Ve.length>0&&Ve.every((Et)=>le.has(Et)||rS(dt,qe[Et]));if(le.clear(),ut)for(let Et of Ve)s({path:Et,message:`"${Et}" holds nothing that could be applied as written and is this source's only policy content; its fail-closed reading binds (beside a lower managed settings source's policy, when one supplies it) until it is fixed.`,statusOnly:!0,onlySubstitutes:!0});return qe})}var n7=65536,aS=new RegExp(`[${cn("<")}]`,"gu");function o7(s){return P_(s)&&s.search(aS)===-1}function lS(s){let c={},T=n7,I=0,v=0;for(let U of us.toSorted((oe,re)=>Number(re==="hard_deny")-Number(oe==="hard_deny"))){let oe=r(s)?s[U]:void 0;if(oe!==void 0&&oe!==null&&!Array.isArray(oe))I++;let re=[Zs];for(let le of Array.isArray(oe)?oe:[]){if(typeof le!=="string"){I++;continue}if(["",Zs].includes(le.trim()))continue;let ye=le.length>2*T?1/0:Ot(le);if(ye>T){I++;continue}T-=ye;let Ie=Array.from(nn(le),(Ze)=>Ua(Ze)||Ha(Ze)?" ":Ze).join("").replace(aS,"&lt;");if(Ie.trim()===Zs)continue;let Le=Ot(Ie)-ye;if(!o7(Ie)||Le>T){I++;continue}if(T-=Le,re.push(Ie),Ie!==le)v++}if(re.length>1)c[U]=re}return{lists:c,leftOut:I,mended:v}}var cS="anthropic-skills";var r7=[/^agent-a[0-9a-f]{16}$/,/^agent-a[0-9a-f]{7}$/,/^wf_[0-9a-f]{8}-[0-9a-f]{3}-\d+$/];var IAe=[...r7,/^wf-\d+$/,/^bridge-[A-Za-z0-9_]+(-[A-Za-z0-9_]+)*$/,/^job-[a-zA-Z0-9._-]{1,55}-[0-9a-f]{8}$/,/^bg-[a-zA-Z0-9._-]{1,55}-[0-9a-f]{8}$/];var pS=/[\u200c-\u200f\u202a-\u202e\u206a-\u206f\ufeff]/,s7=new RegExp(pS,"g");function Kd(s){return i7(s,!0)}function i7(s,c){let T=s.toLowerCase().replace(/\u0131/g,"i").replace(/\u017f/g,"s"),I=T.replace(s7,"");return(c?I.replace(/:.*$/,""):I).replace(/[. ]+$/,"")||T}var fS=String.raw`[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*\.?`,ml="[A-Za-z0-9._-]+",jd="[A-Za-z0-9._~-]",a7=`${jd}+(?::${jd}*)?@`,l7=":[1-9][0-9]{0,4}",c7=`(?:/(?:${jd}|%[0-9A-Fa-f]{2})*)*`,$Ae=new RegExp(`^${ml}/${ml}$`),VAe=new RegExp(`^git@(${fS}):(${ml}(?:/${ml})*)/?$`),mS=`(?:${a7})?(${fS})(?:${l7})?(${c7})$`,YAe=new RegExp(`^https://${mS}`),XAe=new RegExp(`^https?://${mS}`),JAe=`ssh.${zn}`;class gS{reader=null;register(s){let c=this.reader;return this.reader=s,c}}var eCe=new gS;var d7="inline",fCe=`${cS}@${d7}`;var ps="builtin";function _S(s){let c=s.toLowerCase();return dd(c)?c:s}function ES(s){if(s.startsWith("@")&&_d(s))return{name:s};if(s.includes("@")){let c=s.split("@");return{name:c[0]||"",marketplace:c[1]}}return{name:s}}function mi(s){return s.normalize("NFC").toLowerCase()}var hS=new Set(["disableAllHooks","disableReplyCheck"]),SS=["accessKeyIdVar","secretAccessKeyVar","sessionTokenVar"],u7;function yS(s){let c=s.enabledPlugins,T=Object.entries(c??{}).flatMap(([I,v])=>v===!1&&I.endsWith(`@${ps}`)&&u7?.(c,I)===!0?[I]:[]);return T.length>0?Object.fromEntries(T.map((I)=>[I,!1])):void 0}function $d(s){let c={};for(let $e of Eo()){let{path:dt,restrictive:Me}=$e;if(hS.has(dt[0]))continue;let nt=ma($e,s);if((typeof nt==="boolean"||typeof nt==="string")&&tr(Me).includes(nt))yn(c,dt,nt)}if(Yt(s,["attribution"])===!1)yn(c,["attribution","sessionUrl"],!1);let T=gl(s.permissions,["deny","ask","disableBypassPermissionsMode","disableAutoMode"]);if(T)c.permissions={...c.permissions,...T};for(let $e of p7)if(s[$e]!==void 0)c[$e]=s[$e];for(let[$e,dt]of Object.entries(s))if(($e.startsWith("disable")&&(dt===!0||dt==="disable")||$e.startsWith("enable")&&dt===!1)&&!hS.has($e))c[$e]=dt;if(s.disableAllHooks===!0)c.allowManagedHooksOnly=!0;if(Array.isArray(s.httpHookAllowedEnvVars)&&s.httpHookAllowedEnvVars.length===0)c.httpHookAllowedEnvVars=[];let I=gl(s.sandbox?.filesystem,["denyRead","denyWrite","allowManagedReadPathsOnly"]),v=gl(s.sandbox?.network,["deniedDomains","strictAllowlist","allowManagedDomainsOnly"]),U=gl(s.sandbox?.credentials,["files","envVars"])??{},oe=s.sandbox?.credentials?.awsPairs,re=r(oe)&&SS.some(($e)=>($e in oe)),ye=(Array.isArray(oe)?oe:re?[oe]:[]).flatMap(($e)=>r($e)?SS.map((dt)=>$e[dt]):[]),Re=oe!==void 0&&!Array.isArray(oe)&&!re,Ie=Ko.filter(($e)=>Re||ye.includes($e));if(Ie.length>0)U.awsPairs=Ie.map(($e,dt)=>({accessKeyIdVar:$e,secretAccessKeyVar:`${Ga}${dt+1}_`}));let Le=s.sandbox?.credentials?.sigv4;if(Le){let $e={};for(let[dt,Me]of Object.entries(Le))if(Me==="deny")$e[dt]="deny";if(Object.keys($e).length>0)U.sigv4=$e}let Ze=Object.keys(U).length>0;if(I||v||Ze){let $e=c.sandbox??{};c.sandbox={...$e,...I&&{filesystem:{...$e.filesystem,...I}},...v&&{network:{...$e.network,...v}},...Ze&&{credentials:{...$e.credentials,...U}}}}return Object.keys(c).length>0?c:null}function gl(s,c){if(!s)return;let T={};for(let I of c)if(s[I]!==void 0)T[I]=s[I];return Object.keys(T).length>0?T:void 0}var p7=["allowedMcpServers","deniedMcpServers","allowManagedMcpServersOnly","disabledMcpjsonServers","allowManagedHooksOnly","allowedHttpHookUrls","strictKnownMarketplaces","allowedMarketplaces","blockedMarketplaces","strictPluginOnlyCustomization","availableModels","enforceAvailableModels","availableModelsMatch","deniedModels","allowedProviders"];var f7=["SSL_CERT_FILE","NODE_EXTRA_CA_CERTS","REQUESTS_CA_BUNDLE","CURL_CA_BUNDLE","CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE","HTTPLIB2_CA_CERTS"],m7=["AWS_CA_BUNDLE","DENO_CERT","CARGO_HTTP_CAINFO","PIP_CERT","GIT_SSL_CAINFO","GRPC_DEFAULT_SSL_ROOTS_FILE_PATH","NIX_SSL_CERT_FILE","HEX_CACERTS_PATH"],OS=[...f7,...m7],AS={UV_NATIVE_TLS:"true",DENO_TLS_CA_STORE:"system,mozilla"};var g7=Object.freeze(["-c","core.hooksPath=/dev/null","-c","core.fsmonitor="]);var OCe=Object.freeze(["--no-optional-locks","status","--porcelain","--untracked-files=normal","--ignore-submodules=dirty"]),_7=Object.freeze({GIT_LFS_SKIP_SMUDGE:"1"});var E7=["'alias.remote-none=version'","'alias.remote-none.command=version'","'alias.remote-/.command=version'","'fetch.bundleURI='","'help.autocorrect=0'"],h7=E7.join(" "),ACe=Object.freeze({GIT_ALLOW_PROTOCOL:"/",GIT_CONFIG_PARAMETERS:h7,GIT_NO_LAZY_FETCH:"1",GIT_NO_REPLACE_OBJECTS:"1",GIT_TERMINAL_PROMPT:"0",..._7}),CCe=Object.freeze({LC_ALL:"C",LANGUAGE:"C"}),bCe=Object.freeze({GIT_SSH_COMMAND:"false"});var RCe=Object.freeze([...g7,"-c","safe.bareRepository=explicit","-c","protocol.file.allow=never"]),Vd=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE","GIT_CEILING_DIRECTORIES","GIT_DISCOVERY_ACROSS_FILESYSTEM","GIT_OBJECT_DIRECTORY","GIT_ALTERNATE_OBJECT_DIRECTORIES","GIT_SHALLOW_FILE","GIT_NAMESPACE","GIT_IMPLICIT_WORK_TREE","GIT_REFERENCE_BACKEND"],Yd=[...Vd,"GIT_CONFIG_COUNT","GIT_CONFIG_PARAMETERS","GIT_CONFIG_GLOBAL","GIT_CONFIG_SYSTEM","GIT_CONFIG"],S7=/^GIT_CONFIG_(KEY|VALUE)_\d+$/,y7=new RegExp(S7.source,"i");var TCe=new Set(Yd);function bS(s){let c=0,T=s.length;while(c<T&&CS(s.charCodeAt(c)))c++;while(T>c&&CS(s.charCodeAt(T-1)))T--;let I=O7(s.slice(c,T));if(I!==-1)return{kind:"line_break",index:Xd(s,c+I)};for(let v=c;v<T;v++){let U=s.charCodeAt(v);if(U===0)return{kind:"nul",index:Xd(s,v)};if(U>255)return{kind:"non_ascii",index:Xd(s,v),codePoint:A7(s,v)}}return null}function O7(s){let c=s.indexOf(`
`),T=s.indexOf("\r");if(c===-1)return T;return T===-1?c:Math.min(c,T)}function CS(s){return s===9||s===32||s===10||s===13}function A7(s,c){return s.codePointAt(c)??s.charCodeAt(c)}function Xd(s,c){let T=0;for(let I=0;I<c;I++){let v=s.charCodeAt(I);if(v>=55296&&v<=56319&&I+1<s.length&&(s.charCodeAt(I+1)&64512)===56320)I++;T++}return T}var Jd=["NODE_TLS_REJECT_UNAUTHORIZED","BUN_TLS_REFUSE_DISTRUSTED_KEYS"];var RS=["YARN_HTTP_PROXY","YARN_HTTPS_PROXY","npm_config_proxy","npm_config_https_proxy","npm_config_noproxy","GLOBAL_AGENT_HTTP_PROXY","GLOBAL_AGENT_HTTPS_PROXY","GLOBAL_AGENT_NO_PROXY","DOCKER_HTTP_PROXY","DOCKER_HTTPS_PROXY","ELECTRON_GET_USE_PROXY","CLOUDSDK_PROXY_TYPE","CLOUDSDK_PROXY_ADDRESS","CLOUDSDK_PROXY_PORT","CLOUDSDK_PROXY_USERNAME","CLOUDSDK_PROXY_PASSWORD","FSSPEC_GCS","JAVA_TOOL_OPTIONS"];var Zd=["CLAUDE_CODE_USE_BEDROCK","CLAUDE_CODE_USE_VERTEX","CLAUDE_CODE_USE_FOUNDRY","CLAUDE_CODE_USE_ANTHROPIC_AWS","CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD","CLAUDE_CODE_USE_MANTLE","CLAUDE_CODE_USE_GATEWAY","ANTHROPIC_FOUNDRY_RESOURCE","ANTHROPIC_VERTEX_PROJECT_ID","ANTHROPIC_AWS_WORKSPACE_ID","ANTHROPIC_GOOGLE_CLOUD_PROJECT","ANTHROPIC_GOOGLE_CLOUD_LOCATION","ANTHROPIC_GOOGLE_CLOUD_WORKSPACE_ID","CLOUD_ML_REGION"],TS=["CLAUDE_CODE_USE_BEDROCK","CLAUDE_CODE_USE_ANTHROPIC_AWS","CLAUDE_CODE_USE_MANTLE"];var DS="OTEL_EXPORTER_OTLP_",qd=["OTEL_LOG_RAW_API_BODIES","OTEL_LOG_USER_PROMPTS","OTEL_LOG_ASSISTANT_RESPONSES","OTEL_LOG_TOOL_CONTENT","OTEL_LOG_TOOL_DETAILS","OTEL_LOG_MANAGED_SETTINGS","OTEL_LOGS_EXPORTER","ENABLE_BETA_TRACING_DETAILED","BETA_TRACING_ENDPOINT","ANT_OTEL_LOGS_EXPORTER"],LS=[DS,`ANT_${DS}`];var IS={apiKeyHelper:["ANTHROPIC_BASE_URL","_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL"],awsAuthRefresh:[...TS,"ANTHROPIC_BEDROCK_BASE_URL","ANTHROPIC_AWS_BASE_URL","ANTHROPIC_BEDROCK_MANTLE_BASE_URL"],awsCredentialExport:[...TS,"ANTHROPIC_BEDROCK_BASE_URL","ANTHROPIC_AWS_BASE_URL","ANTHROPIC_BEDROCK_MANTLE_BASE_URL"],gcpAuthRefresh:["CLAUDE_CODE_USE_VERTEX","CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD","ANTHROPIC_VERTEX_BASE_URL","ANTHROPIC_GOOGLE_CLOUD_BASE_URL"]},wS=["CLAUDE_CODE_MEMORY_API_BASE_URL","CLAUDE_CODE_MEMORY_API_TOKEN"];var PS=["CLAUDE_CODE_ARTIFACTS_API_BASE_URL","CLAUDE_CODE_ARTIFACTS_API_TOKEN","CLAUDE_CODE_ARTIFACT_ASSET_BASE_URL","CLAUDE_CODE_ARTIFACT_LIVE_BASE_URL","CLAUDE_CODE_ARTIFACT_SYNC_BASE_URL","CLAUDE_CODE_ARTIFACT_VIEWER_BASE_URL"],Qd=["ANTHROPIC_BASE_URL","_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL","ANTHROPIC_BEDROCK_BASE_URL","ANTHROPIC_VERTEX_BASE_URL","ANTHROPIC_FOUNDRY_BASE_URL","ANTHROPIC_AWS_BASE_URL","ANTHROPIC_GOOGLE_CLOUD_BASE_URL","ANTHROPIC_BEDROCK_MANTLE_BASE_URL",...PS,...wS],C7=[{endpoint:"ANTHROPIC_BASE_URL",companions:["_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL","ANTHROPIC_CUSTOM_HEADERS"]},{endpoint:"ANTHROPIC_BEDROCK_BASE_URL",selection:"CLAUDE_CODE_USE_BEDROCK",companions:["CLAUDE_CODE_SKIP_BEDROCK_AUTH","ANTHROPIC_CUSTOM_HEADERS"]},{endpoint:"ANTHROPIC_VERTEX_BASE_URL",selection:"CLAUDE_CODE_USE_VERTEX",companions:["CLAUDE_CODE_SKIP_VERTEX_AUTH","ANTHROPIC_CUSTOM_HEADERS"]},{endpoint:"ANTHROPIC_FOUNDRY_BASE_URL",selection:"CLAUDE_CODE_USE_FOUNDRY",companions:["CLAUDE_CODE_SKIP_FOUNDRY_AUTH","ANTHROPIC_CUSTOM_HEADERS"]},{endpoint:"ANTHROPIC_AWS_BASE_URL",selection:"CLAUDE_CODE_USE_ANTHROPIC_AWS",companions:["CLAUDE_CODE_SKIP_ANTHROPIC_AWS_AUTH","ANTHROPIC_CUSTOM_HEADERS"]},{endpoint:"ANTHROPIC_GOOGLE_CLOUD_BASE_URL",selection:"CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD",companions:["CLAUDE_CODE_SKIP_ANTHROPIC_GOOGLE_CLOUD_AUTH","ANTHROPIC_CUSTOM_HEADERS"]},{endpoint:"ANTHROPIC_BEDROCK_MANTLE_BASE_URL",selection:"CLAUDE_CODE_USE_MANTLE",companions:["CLAUDE_CODE_SKIP_MANTLE_AUTH","ANTHROPIC_CUSTOM_HEADERS"]}],WCe=u(C7.flatMap((s)=>[s.endpoint,...s.companions])),_l=["ANTHROPIC_API_KEY","ANTHROPIC_AUTH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","AWS_BEARER_TOKEN_BEDROCK","ANTHROPIC_FOUNDRY_API_KEY","ANTHROPIC_FOUNDRY_AUTH_TOKEN","ANTHROPIC_AWS_API_KEY"];var KCe=[..._l,"ANTHROPIC_CUSTOM_HEADERS"];var eu=["CLAUDE_CODE_SKIP_BEDROCK_AUTH","CLAUDE_CODE_SKIP_VERTEX_AUTH","CLAUDE_CODE_SKIP_FOUNDRY_AUTH","CLAUDE_CODE_SKIP_ANTHROPIC_AWS_AUTH","CLAUDE_CODE_SKIP_ANTHROPIC_GOOGLE_CLOUD_AUTH","CLAUDE_CODE_SKIP_MANTLE_AUTH"],tu=["ANTHROPIC_MODEL","ANTHROPIC_DEFAULT_MODEL","ANTHROPIC_DEFAULT_FABLE_MODEL","ANTHROPIC_DEFAULT_FABLE_MODEL_DESCRIPTION","ANTHROPIC_DEFAULT_FABLE_MODEL_NAME","ANTHROPIC_DEFAULT_FABLE_MODEL_SUPPORTED_CAPABILITIES","ANTHROPIC_DEFAULT_HAIKU_MODEL","ANTHROPIC_DEFAULT_HAIKU_MODEL_DESCRIPTION","ANTHROPIC_DEFAULT_HAIKU_MODEL_NAME","ANTHROPIC_DEFAULT_HAIKU_MODEL_SUPPORTED_CAPABILITIES","ANTHROPIC_DEFAULT_OPUS_MODEL","ANTHROPIC_DEFAULT_OPUS_MODEL_DESCRIPTION","ANTHROPIC_DEFAULT_OPUS_MODEL_NAME","ANTHROPIC_DEFAULT_OPUS_MODEL_SUPPORTED_CAPABILITIES","ANTHROPIC_DEFAULT_SONNET_MODEL","ANTHROPIC_DEFAULT_SONNET_MODEL_DESCRIPTION","ANTHROPIC_DEFAULT_SONNET_MODEL_NAME","ANTHROPIC_DEFAULT_SONNET_MODEL_SUPPORTED_CAPABILITIES","ANTHROPIC_SMALL_FAST_MODEL","ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION","CLAUDE_CODE_SUBAGENT_MODEL","CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL","CLAUDE_CODE_3P_PROBE_WROTE_SONNET_DEFAULT","CLAUDE_CODE_3P_PROBE_WROTE_OPUS_DEFAULT","CLAUDE_CODE_3P_PROBE_WROTE_HAIKU_DEFAULT","CLAUDE_CODE_3P_SEEDED_SONNET_DEFAULT","CLAUDE_CODE_3P_SEEDED_OPUS_DEFAULT"],nu=["ANTHROPIC_CUSTOM_MODEL_OPTION","ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION","ANTHROPIC_CUSTOM_MODEL_OPTION_NAME","ANTHROPIC_CUSTOM_MODEL_OPTION_SUPPORTED_CAPABILITIES"],b7=["CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR","CLAUDE_CODE_GATEWAY_TOKEN_FILE_DESCRIPTOR","CLAUDE_CODE_API_KEY_FILE_DESCRIPTOR","CLAUDE_CODE_WEBSOCKET_AUTH_FILE_DESCRIPTOR","CCR_AGENT_PROXY_TOKEN_FILE_DESCRIPTOR"],jCe=[...PS,...wS,"CLAUDE_CODE_API_BASE_URL","CLAUDE_BRIDGE_BASE_URL","CLAUDE_BRIDGE_SESSION_INGRESS_URL","CLAUDE_REMOTE_TOOLS_BRIDGE_URL","CLAUDE_CODE_GB_BASE_URL","VOICE_STREAM_BASE_URL"],$Ce=["CLAUDE_CODE_OAUTH_TOKEN","CLAUDE_CODE_SESSIONS_OAUTH_TOKEN",...b7,"CLAUDE_CODE_ARTIFACTS_API_TOKEN","CLAUDE_CODE_SLACK_TAG_TOKEN","CLAUDE_CODE_HFI_BEARER_TOKEN","CLAUDE_BRIDGE_OAUTH_TOKEN","CLAUDE_TRUSTED_DEVICE_TOKEN","AGENT_PROXY_AUTH_TOKEN","CLAUDE_CODE_MCP_SERVE_AUTH_TOKEN","CLAUDE_BG_AUTH_SNAPSHOT_PATH","CLAUDE_BG_SOCKET_TOKENS_PATH","CLAUDE_BG_RV_AUTH","CLAUDE_BG_PTY_AUTH","CLAUDE_BG_CLAIM_AUTH"];var R7=["AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_SESSION_TOKEN"],ou=[...R7,"AWS_PROFILE","AWS_CONFIG_FILE","AWS_SHARED_CREDENTIALS_FILE","GOOGLE_APPLICATION_CREDENTIALS","GOOGLE_CLOUD_PROJECT"];var gi=["AWS_CONTAINER_CREDENTIALS_FULL_URI","AWS_CONTAINER_CREDENTIALS_RELATIVE_URI","AWS_CONTAINER_AUTHORIZATION_TOKEN","AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE","AWS_EC2_METADATA_SERVICE_ENDPOINT","AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE","AWS_WEB_IDENTITY_TOKEN_FILE","AWS_ROLE_ARN"],ru=["GCE_METADATA_HOST","GCE_METADATA_ROOT","GCE_METADATA_IP","METADATA_SERVER_DETECTION"],VCe=new Set(["CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST",...Zd,...Qd,..._l,...eu,"CLAUDE_CODE_HOST_AUTH_ENV_VAR","CLAUDE_CODE_SDK_HAS_HOST_AUTH_REFRESH","CLAUDE_CODE_HOST_AUTH_REFRESH_TIMEOUT_MS","CLAUDE_CODE_HOST_CREDS_FILE",...ou,"GCLOUD_PROJECT","GOOGLE_CLOUD_QUOTA_PROJECT",...ru,...gi,"AWS_REGION","AWS_DEFAULT_REGION",...tu,"ANTHROPIC_BEDROCK_SERVICE_TIER","ANTHROPIC_BEDROCK_REGION_PREFIX","CLAUDE_CODE_CERT_STORE","CLAUDE_CODE_DISABLE_FEATURE_FLAGS","DISABLE_GROWTHBOOK","CLAUDE_CODE_AUTO_MODE_MODEL","CLAUDE_CODE_BG_CLASSIFIER_MODEL","CLAUDE_CODE_SUBAGENT_MODEL_FORCE",...nu]);var NS=["SSL_CERT_FILE","SSL_CERT_DIR","ALL_PROXY"],T7=["NPM_CONFIG_HTTPS_PROXY","NPM_CONFIG_HTTP_PROXY","NPM_CONFIG_PROXY"],D7=new Set(Vd),L7=new Set(["HTTP_PROXY","HTTPS_PROXY","ALL_PROXY","NO_PROXY","CLAUDE_CODE_PROXY_RESOLVES_HOSTS","CLAUDE_CODE_HTTP_PROXY","CLAUDE_CODE_HTTPS_PROXY","NPM_CONFIG_PROXY","NPM_CONFIG_HTTP_PROXY","NPM_CONFIG_HTTPS_PROXY"]);var I7=u([...OS,...Object.keys(AS),...RS.map((s)=>s.toUpperCase()),...NS,...Yd.filter((s)=>!D7.has(s))]).filter((s)=>s!=="NODE_EXTRA_CA_CERTS"&&s!=="JAVA_TOOL_OPTIONS"&&!L7.has(s));var YCe=new Set(["CLAUDE_CODE_CLIENT_CERT","CLAUDE_CODE_CLIENT_KEY","CLAUDE_CODE_CLIENT_KEY_PASSPHRASE","NODE_EXTRA_CA_CERTS","CLAUDE_CODE_DISABLE_LOOPED_CROSS_CERT_DROP","CLAUDE_CODE_DISABLE_SELF_NAMED_CERT_DROP",...Jd,"CLAUDE_CODE_OAUTH_SCOPES",...I7]);var xS="CLAUDE_CODE_AUTO_MODE_MODEL";var w7=["HTTPS_PROXY","HTTP_PROXY","NO_PROXY",...NS,...T7,"NODE_EXTRA_CA_CERTS","CLAUDE_CODE_CERT_STORE","CLAUDE_CODE_DISABLE_LOOPED_CROSS_CERT_DROP","CLAUDE_CODE_DISABLE_SELF_NAMED_CERT_DROP","CLAUDE_CODE_CLIENT_CERT","CLAUDE_CODE_CLIENT_KEY","CLAUDE_CODE_CLIENT_KEY_PASSPHRASE",...Jd],kS=[...w7,"CLAUDE_CODE_PROXY_RESOLVES_HOSTS","CLAUDE_CODE_ENABLE_PROXY_AUTH_HELPER","CLAUDE_CODE_PROXY_AUTH_HELPER_TTL_MS","API_FORCE_IDLE_TIMEOUT","ANTHROPIC_UNIX_SOCKET","CLAUDE_CODE_DISABLE_HTTPS_AGENT_KEEPING","NODE_OPTIONS"];var vS=["apiKeyHelper","awsAuthRefresh","awsCredentialExport","fileSuggestion","gcpAuthRefresh","otelHeadersHelper","processWrapper","policyHelpers","proxyAuthHelper","statusLine","subagentStatusLine"],su=["bwrapPath","ripgrep","socatPath"],MS=["allowAppleEvents","allowNestedUserNamespaces","credentials","enableWeakerNestedSandbox","enableWeakerNetworkIsolation","filesystem.disabled","network.allowAllUnixSockets","network.allowMachLookup","network.allowUnixSockets","network.httpProxyPort","network.socksProxyPort","network.tlsTerminate"],US=["required","egress"],P7=new Set(["ANTHROPIC_BEDROCK_REGION_PREFIX","ANTHROPIC_BEDROCK_SERVICE_TIER","ANTHROPIC_CUSTOM_MODEL_OPTION","ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION","ANTHROPIC_CUSTOM_MODEL_OPTION_NAME","ANTHROPIC_CUSTOM_MODEL_OPTION_SUPPORTED_CAPABILITIES","ANTHROPIC_DEFAULT_FABLE_MODEL","ANTHROPIC_DEFAULT_FABLE_MODEL_DESCRIPTION","ANTHROPIC_DEFAULT_FABLE_MODEL_NAME","ANTHROPIC_DEFAULT_FABLE_MODEL_SUPPORTED_CAPABILITIES","ANTHROPIC_DEFAULT_MODEL","ANTHROPIC_DEFAULT_HAIKU_MODEL","ANTHROPIC_DEFAULT_HAIKU_MODEL_DESCRIPTION","ANTHROPIC_DEFAULT_HAIKU_MODEL_NAME","ANTHROPIC_DEFAULT_HAIKU_MODEL_SUPPORTED_CAPABILITIES","ANTHROPIC_DEFAULT_OPUS_MODEL","ANTHROPIC_DEFAULT_OPUS_MODEL_DESCRIPTION","ANTHROPIC_DEFAULT_OPUS_MODEL_NAME","ANTHROPIC_DEFAULT_OPUS_MODEL_SUPPORTED_CAPABILITIES","ANTHROPIC_DEFAULT_SONNET_MODEL","ANTHROPIC_DEFAULT_SONNET_MODEL_DESCRIPTION","ANTHROPIC_DEFAULT_SONNET_MODEL_NAME","ANTHROPIC_DEFAULT_SONNET_MODEL_SUPPORTED_CAPABILITIES","ANTHROPIC_FOUNDRY_API_KEY","ANTHROPIC_MODEL","ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION","ANTHROPIC_SMALL_FAST_MODEL","AWS_DEFAULT_REGION","AWS_PROFILE","AWS_REGION","BASH_DEFAULT_TIMEOUT_MS","BASH_MAX_OUTPUT_LENGTH","BASH_MAX_TIMEOUT_MS","CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR","CLAUDE_CODE_API_KEY_HELPER_TTL_MS","CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS","CLAUDE_CODE_DISABLE_FEATURE_FLAGS","CLAUDE_CODE_DISABLE_TERMINAL_TITLE","CLAUDE_CODE_ENABLE_AUTO_MODE","CLAUDE_CODE_ENABLE_DESIGN_SYNC","CLAUDE_CODE_ENABLE_FEEDBACK_SURVEY_FOR_OTEL","CLAUDE_CODE_ENABLE_TELEMETRY","CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS","CLAUDE_CODE_IDE_SKIP_AUTO_INSTALL","CLAUDE_CODE_MAX_MCP_DESCRIPTION_LENGTH","CLAUDE_CODE_MAX_OUTPUT_TOKENS","CLAUDE_CODE_SKIP_BEDROCK_AUTH","CLAUDE_CODE_SKIP_FOUNDRY_AUTH","CLAUDE_CODE_SKIP_ANTHROPIC_AWS_AUTH","CLAUDE_CODE_SKIP_ANTHROPIC_GOOGLE_CLOUD_AUTH","CLAUDE_CODE_SKIP_MANTLE_AUTH","CLAUDE_CODE_SKIP_VERTEX_AUTH","CLAUDE_CODE_SUBAGENT_MODEL","CLAUDE_CODE_USE_BEDROCK","CLAUDE_CODE_USE_FOUNDRY","CLAUDE_CODE_USE_ANTHROPIC_AWS","CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD","CLAUDE_CODE_USE_GATEWAY","CLAUDE_CODE_USE_MANTLE","CLAUDE_CODE_USE_POWERSHELL_TOOL","CLAUDE_CODE_USE_VERTEX","CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL","DISABLE_AUTOUPDATER","DISABLE_BUG_COMMAND","DISABLE_COST_WARNINGS","DISABLE_FEEDBACK_COMMAND","DISABLE_GROWTHBOOK","DISABLE_INSTALLATION_CHECKS","DISABLE_UPDATES","ENABLE_TOOL_SEARCH","MAX_MCP_OUTPUT_TOKENS","MAX_THINKING_TOKENS","MCP_CONNECT_TIMEOUT_MS","MCP_TIMEOUT","MCP_TOOL_TIMEOUT","OTEL_EXPORTER_OTLP_COMPRESSION","OTEL_EXPORTER_OTLP_HEADERS","OTEL_EXPORTER_OTLP_LOGS_COMPRESSION","OTEL_EXPORTER_OTLP_LOGS_HEADERS","OTEL_EXPORTER_OTLP_LOGS_PROTOCOL","OTEL_EXPORTER_OTLP_METRICS_COMPRESSION","OTEL_EXPORTER_OTLP_METRICS_HEADERS","OTEL_EXPORTER_OTLP_METRICS_PROTOCOL","OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE","OTEL_EXPORTER_OTLP_PROTOCOL","OTEL_EXPORTER_OTLP_TRACES_COMPRESSION","OTEL_EXPORTER_OTLP_TRACES_HEADERS","OTEL_EXPORTER_OTLP_TRACES_PROTOCOL","OTEL_LOG_ASSISTANT_RESPONSES","OTEL_LOG_TOOL_CONTENT","OTEL_LOG_TOOL_DETAILS","OTEL_LOG_USER_PROMPTS","OTEL_LOGS_EXPORT_INTERVAL","OTEL_LOGS_EXPORTER","OTEL_METRIC_EXPORT_INTERVAL","OTEL_METRICS_EXPORTER","OTEL_METRICS_INCLUDE_ACCOUNT_UUID","OTEL_METRICS_INCLUDE_ENTRYPOINT","OTEL_METRICS_INCLUDE_REPOSITORY","OTEL_METRICS_INCLUDE_RESOURCE_ATTRIBUTES","OTEL_METRICS_INCLUDE_SESSION_ID","OTEL_METRICS_INCLUDE_VERSION","OTEL_RESOURCE_ATTRIBUTES","OTEL_SERVICE_NAME","OTEL_TRACES_EXPORT_INTERVAL","OTEL_TRACES_EXPORTER","USE_BUILTIN_RIPGREP","VERTEX_REGION_CLAUDE_3_5_HAIKU","VERTEX_REGION_CLAUDE_3_5_SONNET","VERTEX_REGION_CLAUDE_3_7_SONNET","VERTEX_REGION_CLAUDE_4_0_OPUS","VERTEX_REGION_CLAUDE_4_0_SONNET","VERTEX_REGION_CLAUDE_4_1_OPUS","VERTEX_REGION_CLAUDE_4_5_OPUS","VERTEX_REGION_CLAUDE_4_6_OPUS","VERTEX_REGION_CLAUDE_4_7_OPUS","VERTEX_REGION_CLAUDE_4_8_OPUS","VERTEX_REGION_CLAUDE_5_OPUS","VERTEX_REGION_CLAUDE_5_5_OPUS","VERTEX_REGION_CLAUDE_FABLE_5","VERTEX_REGION_CLAUDE_FABLE_5_1","VERTEX_REGION_CLAUDE_FABLE_5_2","VERTEX_REGION_CLAUDE_4_5_SONNET","VERTEX_REGION_CLAUDE_4_6_SONNET","VERTEX_REGION_CLAUDE_5_SONNET","VERTEX_REGION_CLAUDE_5_5_SONNET","VERTEX_REGION_CLAUDE_HAIKU_4_5","VERTEX_REGION_CLAUDE_HAIKU_5_5","CLAUDE_AUTOCOMPACT_PCT_OVERRIDE","CLAUDE_CODE_AUTO_COMPACT_WINDOW","CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT","CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS","CLAUDE_CODE_MAX_CONTEXT_TOKENS","DISABLE_AUTO_COMPACT","DISABLE_COMPACT","CLAUDE_CODE_ALWAYS_ENABLE_EFFORT","CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING","CLAUDE_CODE_DISABLE_FAST_MODE","CLAUDE_CODE_DISABLE_LEGACY_MODEL_REMAP","CLAUDE_CODE_DISABLE_NONSTREAMING_FALLBACK","CLAUDE_CODE_DISABLE_THINKING","CLAUDE_CODE_EFFORT_LEVEL","CLAUDE_CODE_MAX_EFFORT_REMINDER","CLAUDE_CODE_SUBAGENT_EFFORT","CLAUDE_CODE_MESSAGES_PROMPT_CACHE_TTL","CLAUDE_CODE_PROMPT_CACHE_TTL","CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL","DISABLE_INTERLEAVED_THINKING","DISABLE_PROMPT_CACHING","DISABLE_PROMPT_CACHING_FABLE","DISABLE_PROMPT_CACHING_HAIKU","DISABLE_PROMPT_CACHING_OPUS","DISABLE_PROMPT_CACHING_SONNET","ENABLE_PROMPT_CACHING_1H","ENABLE_PROMPT_CACHING_1H_BEDROCK","FALLBACK_FOR_ALL_PRIMARY_MODELS","FORCE_PROMPT_CACHING_5M","CLAUDE_AUTO_BACKGROUND_TASKS","CLAUDE_CODE_DISABLE_ADVISOR_TOOL","CLAUDE_CODE_DISABLE_AGENT_VIEW","CLAUDE_CODE_DISABLE_ARTIFACT","CLAUDE_CODE_DISABLE_BACKGROUND_TASKS","CLAUDE_CODE_DISABLE_BUNDLED_SKILLS","CLAUDE_CODE_DISABLE_CRON","CLAUDE_CODE_DISABLE_EXPLORE_PLAN_AGENTS","CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY","CLAUDE_CODE_DISABLE_FILE_CHECKPOINTING","CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND","CLAUDE_CODE_DISABLE_MEMORY_RO_UNSAVED_NOTICE","CLAUDE_CODE_DISABLE_WORKFLOWS","CLAUDE_CODE_ENABLE_AWAY_SUMMARY","CLAUDE_CODE_ENABLE_FINE_GRAINED_TOOL_STREAMING","CLAUDE_CODE_ENABLE_FUNCTION_HOOKS","CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION","CLAUDE_CODE_ENABLE_TASKS","CLAUDE_CODE_FORK_SUBAGENT","CLAUDE_CODE_PLAN_MODE_REQUIRED","DISABLE_DOCTOR_COMMAND","DISABLE_EXTRA_USAGE_COMMAND","DISABLE_INSTALL_GITHUB_APP_COMMAND","DISABLE_LOGIN_COMMAND","DISABLE_LOGOUT_COMMAND","DISABLE_UPGRADE_COMMAND","CLAUDE_AX_SCREEN_READER","CLAUDE_CODE_ACCESSIBILITY","CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN","CLAUDE_CODE_DISABLE_MOUSE","CLAUDE_CODE_DISABLE_MOUSE_CLICKS","CLAUDE_CODE_DISABLE_VIRTUAL_SCROLL","CLAUDE_CODE_FORCE_STRIKETHROUGH","CLAUDE_CODE_FORCE_TERMINAL_IMAGES","CLAUDE_CODE_HIDE_CWD","CLAUDE_CODE_NATIVE_CURSOR","CLAUDE_CODE_NO_FLICKER","CLAUDE_CODE_SCROLL_SPEED","CLAUDE_CODE_SYNTAX_HIGHLIGHT","API_TIMEOUT_MS","CLAUDE_ASYNC_AGENT_STALL_TIMEOUT_MS","CLAUDE_CODE_FILE_READ_MAX_OUTPUT_TOKENS","CLAUDE_CODE_GLOB_TIMEOUT_SECONDS","CLAUDE_CODE_MAX_RETRIES","CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION","CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY","CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION","CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS","CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT","CLAUDE_CODE_TEAM_TEARDOWN_PARK_TIMEOUT_MS","CLAUDE_CODE_WEB_SEARCH_REFILLS_PER_HOUR","CLAUDE_STREAM_FIRST_BYTE_TIMEOUT_MS","CLAUDE_STREAM_IDLE_TIMEOUT_MS","MAX_STRUCTURED_OUTPUT_RETRIES","MCP_REMOTE_SERVER_CONNECTION_BATCH_SIZE","MCP_SERVER_CONNECTION_BATCH_SIZE","SLASH_COMMAND_TOOL_CHAR_BUDGET","TASK_MAX_OUTPUT_LENGTH","MCP_CONNECTION_NONBLOCKING","CLAUDE_ENABLE_BYTE_WATCHDOG","CLAUDE_ENABLE_BYTE_WATCHDOG_BEDROCK","CLAUDE_ENABLE_STREAM_WATCHDOG"]),N7=new Set(["API_FORCE_IDLE_TIMEOUT","CLAUDE_CODE_DISABLE_AGENT_PROGRESS_SUMMARIES","CLAUDE_CODE_DISABLE_MCP_TASKS","CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC","CLAUDE_CODE_DISABLE_RESPONSE_COMPARISON","CLAUDE_CODE_DISABLE_ULTRATHINK","CLAUDE_CODE_DISABLE_WEB_FETCH","DISABLE_ERROR_REPORTING","DISABLE_TELEMETRY","DO_NOT_TRACK"]),x7=new Set([...[],"ENABLE_BETA_TRACING_DETAILED","OTEL_LOG_RAW_API_BODIES"]),k7=/auth|key|token|cookie|secret|credential|session|signature|passw|jwt|assertion|cert|oidc|org|tenant|account|project|workspace|user|email|identity|principal|consumer|client|host|url|base|target|upstream|endpoint|proxy|forward|route|fallback|override|apigw|x-goog-|l5d-|bypass|guardrail|amz|x-ms-|azureml|extra-parameters|envoy|helicone|litellm|cf-aig|cf-access|beta|version/;function v7(s){if(/\r(?!\n)/.test(s))return!0;return s.split(/\n|\r\n/).some((c)=>{let T=c.indexOf(":");if(T===-1)return!1;let I=c.slice(0,T).trim();return!M7.test(I)||bS(c.slice(T+1))!==null||k7.test(I.toLowerCase())})}var M7=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;function HS(s,c){let T=s.toUpperCase();return P7.has(T)||U7(T,c)||T==="ANTHROPIC_CUSTOM_HEADERS"&&!v7(c)}function U7(s,c){return N7.has(s)&&l(c)||x7.has(s)&&Y(c)}function iu(){let s=Xe();return s!==void 0&&Ce(s)}function FS(){let s=g(),c=s==="wsl"&&!iu()?"linux":s;switch(c){case"unknown":return{platform:c,chain:[]};default:return{platform:c,chain:kd(c)}}}var fs=[{alias:"additionalMarketplaces",canonical:"extraKnownMarketplaces"},{alias:"allowedMarketplaces",canonical:"strictKnownMarketplaces"}];function BS(s,c,T){if(!r(s))return[];let I=[];for(let{alias:v,canonical:U}of fs){if(!(v in s))continue;if(s[v]===null){if(!(U in s)&&T?.loneNullAlias==="rename")s[U]=null;delete s[v];continue}if(U in s&&s[U]!==null)I.push({file:c,path:v,message:`"${v}" is an alias for "${U}" and this file sets both; the "${v}" value was ignored. Use only "${U}".`,severity:"warning",alias:v,canonical:U});else s[U]=s[v];delete s[v]}return I}var B7=["enabled","enabledPlatforms"],_i="network.allowedDomains",z7=new Set(["OTEL_LOG_MANAGED_SETTINGS"]);function jS(s){if(!s)return{shellSettings:{},envVars:{},sandboxSettings:{},isolationSettings:{},hasHooks:!1,payloadSlots:{}};let c=[["top",s],...Ei(s),...Ei(s).map(([re])=>[re,{slotPresent:!0}]),...vn.map((re)=>[`policyHelpers.${re}`,{outputBehavior:Xo(s,`policyHelpers.${re}.outputBehavior`)}])],T=$S(s,c),I=G7(s,c);W7([T,...I.map(([,re])=>re)]);let v={};for(let[re,le]of I){let ye={shellSettings:le.hasHooks?{...le.shellSettings,hooks:Do(le.hooks)}:le.shellSettings,envVars:le.envVars,sandboxSettings:le.sandboxSettings,isolationSettings:le.isolationSettings};if(XS(ye))v[re]=ye}let{sandboxSwitches:U,...oe}=T;return{...oe,payloadSlots:v}}function $S(s,c){let T={},I;for(let Le of vS){let Ze=s[Le];if(Le==="policyHelpers"){if(Ze!==null&&typeof Ze==="object")for(let dt of vn){let Me=Z7(Ze[dt]);if(Me){if(T[`policyHelpers.${dt}`]=Me.command,Me.scriptSize)I??={},I[`policyHelpers.${dt}`]=Me.scriptSize}}continue}let $e;if(typeof Ze==="string")$e=Ze;else if(Ze!==null&&typeof Ze==="object"&&"command"in Ze&&typeof Ze.command==="string")$e=Ze.command;if($e!==void 0&&$e.length>0)T[Le]=$e}let v=sZ(s);for(let[Le,Ze]of nZ(s,v,c))T[`extraKnownMarketplaces[${o(Le)}].listedMods`]=Do({source:Object.hasOwn(v??{},Le)?v?.[Le]?.source??null:null,arming:oZ(c,Ze)});if(v&&typeof v==="object")for(let[Le,Ze]of Object.entries(v)){let $e=Ze?.source;if(!$e||typeof $e!=="object")continue;if($e.source==="url"&&typeof $e.headersHelper==="string"&&$e.headersHelper.length>0)T[`extraKnownMarketplaces[${o(Le)}].source.headersHelper`]=KS($e.headersHelper,"url",$e.url);if($e.source==="settings"&&Array.isArray($e.plugins)){let dt=new Map;for(let Me of $e.plugins){let nt=o(Me?.name),rt=dt.get(nt)??0;dt.set(nt,rt+1);let ct=Me?.source;if(ct!==null&&typeof ct==="object"&&"source"in ct&&ct.source==="command"&&"command"in ct&&typeof ct.command==="string"&&ct.command.length>0)T[`extraKnownMarketplaces[${o(Le)}].plugins[${o(Me.name)}][${rt}].source.command`]=ct.command;if(typeof Me?.headersHelper==="string"&&Me.headersHelper.length>0){let pt=Me.source,bt=pt!==null&&typeof pt==="object";T[`extraKnownMarketplaces[${o(Le)}].plugins[${o(Me.name)}][${rt}].headersHelper`]=KS(Me.headersHelper,bt&&"source"in pt?pt.source:void 0,bt&&"url"in pt?pt.url:void 0)}}}}let U=s.sandbox,oe={},re={enabled:Xo(U,"enabled"),enabledPlatforms:Xo(U,"enabledPlatforms"),[_i]:Xo(U,_i)};if(U!==null&&typeof U==="object"){let Le={enabled:re.enabled,enabledPlatforms:re.enabledPlatforms};for(let Ze of su){let $e=eZ(U[Ze]);if($e)T[`sandbox.${Ze}`]=Do({value:$e,...Le})}for(let Ze of MS){let $e=Xo(U,Ze);if(K7(Ze,$e))oe[`sandbox.${Ze}`]=Do({value:$e,...Le,...JS.has(Ze)&&{allowedDomains:ZS(re[_i])}})}}let le=s.isolation,ye={};for(let Le of US){let Ze=Xo(le,Le);if(j7(Le,Ze))ye[`isolation.${Le}`]=Do({value:Ze})}let Re={};if(s.env&&typeof s.env==="object")for(let[Le,Ze]of Object.entries(s.env)){if(Ze===void 0)continue;let $e=String(Ze);if($e.length>0&&!z7.has(Le.toUpperCase())&&!HS(Le,$e))Re[Le]=$e}let Ie=s.hooks!==void 0&&s.hooks!==null&&typeof s.hooks==="object"&&Object.keys(s.hooks).length>0;return{shellSettings:T,inlineHelperScriptSizes:I,envVars:Re,sandboxSettings:oe,isolationSettings:ye,hasHooks:Ie,hooks:Ie?s.hooks:void 0,sandboxSwitches:re}}function G7(s,c){return Ei(s).map(([T,I])=>[T,$S(I,c)])}function Ei(s){let c=[];for(let T of YS){let I=`policyHelpers.${T}`,v=Xo(s,I);if(!x(v))continue;let{policyHelper:U,policyHelpers:oe,...re}=v;c.push([I,re])}return c}function lu(s){return vn.find((c)=>s===`policyHelpers.${c}.defaultSettings`)}function VS(s,c){let T=lu(c);return T!==void 0&&Xo(s,`policyHelpers.${T}.outputBehavior`)==="merge"}function W7(s){let c=s.map((I)=>Object.keys(I.sandboxSettings).length>0||su.some((v)=>I.shellSettings[`sandbox.${v}`]!==void 0)),T=s.map((I)=>[...JS].some((v)=>I.sandboxSettings[`sandbox.${v}`]!==void 0));s.forEach((I,v)=>{if(c.some((U,oe)=>U&&oe!==v))for(let U of B7){let oe=I.sandboxSwitches[U];if(oe!==void 0)I.sandboxSettings[`sandbox.${U}`]=Do({value:oe})}if(T.some((U,oe)=>U&&oe!==v)){let U=I.sandboxSwitches[_i];if(U!==void 0)I.sandboxSettings[`sandbox.${_i}`]=Do({value:ZS(U)??U})}})}var YS=[...vn.map((s)=>`${s}.defaultSettings`),"default"];function au(s){let c=[];for(let T of YS){let I=`policyHelpers.${T}`,v=s.payloadSlots[I];if(v!==void 0&&XS(v))c.push([I,v])}return c}function XS(s){return Object.keys(s.shellSettings).length>0||Object.keys(s.envVars).length>0||Object.keys(s.sandboxSettings).length>0||Object.keys(s.isolationSettings).length>0}var JS=new Set(["credentials","network.tlsTerminate"]);function ZS(s){return Array.isArray(s)?u(s.filter((c)=>typeof c==="string")).sort():void 0}function Xo(s,c){let T=s;for(let I of c.split(".")){if(T===null||typeof T!=="object")return;T=T[I]}return T}function K7(s,c){if(c===void 0||c===null||c===!1)return!1;if(Array.isArray(c)&&c.length===0)return!1;return!(s==="credentials"&&V7(c))}function j7(s,c){if(c===void 0||c===null)return!1;switch(s){case"required":return c!==!1;case"egress":return!x(c)||Object.entries(c).some(([T,I])=>$7.has(T)?I!==void 0&&I!==null&&!(Array.isArray(I)&&I.length===0):I!==void 0)}}var $7=new Set(["allowedHosts","deniedHosts"]);function V7(s){if(typeof s!=="object"||s===null)return!1;return Object.entries(s).every(([c,T])=>{if(T===void 0)return!0;if(c==="files"||c==="envVars")return Array.isArray(T)&&T.every((I)=>typeof I==="object"&&I!==null&&I.mode==="deny");if(c==="sigv4")return typeof T==="object"&&T!==null&&Object.values(T).every((I)=>I===void 0||I==="deny");return c==="allowPlaintextInject"&&T===!1})}function Y7(s){return Object.keys(s.shellSettings).some(X7)}function X7(s){return vn.some((c)=>s===`policyHelpers.${c}`)}function qS(s){return Y7(s)||Object.keys(s.shellSettings).some((c)=>c.startsWith("extraKnownMarketplaces["))||au(s).length>0}function J7(s){return s==="sh"||s==="pwsh"}function Z7(s){if(s===null||typeof s!=="object")return;let{path:c,script:T,interpreter:I,timeoutMs:v,refreshIntervalMs:U}=s,oe,re;if(typeof c==="string"&&c)oe=c;else if(typeof T==="string"&&T&&J7(I))oe={interpreter:I,script:Q7(T)},re=q7(T);else return;return{command:o([oe,v??null,U??null]),scriptSize:re}}function q7(s){return{bytes:Buffer.byteLength(s,"utf8"),lines:on(s,`
`)+(s.endsWith(`
`)?0:1)}}function Q7(s){return Pe(o(s))}function eZ(s){if(typeof s==="string")return s||void 0;if(s===null||typeof s!=="object"||!("command"in s)||typeof s.command!=="string"||!s.command)return;let c="args"in s&&Array.isArray(s.args)?s.args.map(String):[];return o([s.command,...c])}function tZ(s){return Do(QS(s))}function QS(s){return{shellSettings:s.shellSettings,envVars:s.envVars,sandboxSettings:Object.keys(s.sandboxSettings).length>0?s.sandboxSettings:void 0,...zS(s),hooks:s.hooks,payloadSlots:au(s).length>0?Object.fromEntries(au(s).map(([c,T])=>{let{isolationSettings:I,...v}=T;return[c,{...v,...zS(T)}]})):void 0}}function zS(s){return Object.keys(s.isolationSettings).length>0?{isolationSettings:s.isolationSettings}:{}}function GS(s){return[s.prependPlugins,s.appendPlugins].flatMap((c)=>Array.isArray(c)?c:[]).filter((c)=>typeof c==="string").map(mi)}function WS(s){return ES(s).marketplace}function nZ(s,c,T){let I=T.flatMap(([,re])=>GS(re)),v=Object.keys(c??{}),U=GS(s).filter((re)=>!re.endsWith(`@${ps}`)).flatMap((re)=>WS(re)??[]).filter((re)=>!v.some((le)=>mi(le)===re)),oe=new Map;for(let re of[...v,...U]){let le=mi(re),ye=I.filter((Re)=>WS(Re)===le);if(ye.length>0)oe.set(re,ye)}return oe}function oZ(s,c){let T=new Set(c);return s.flatMap(([I,v])=>["enabledPlugins","prependPlugins","appendPlugins","managedSourcesBehavior","outputBehavior","slotPresent"].flatMap((U)=>{let oe=v[U],re=U==="enabledPlugins"?x(oe):Array.isArray(oe);if(oe===void 0)return[];if(!re)return[[I,`${U}:whole`,oe]];return(x(oe)?Object.entries(oe).toSorted():[oe].flat().map((ye)=>[ye])).filter(([ye])=>typeof ye!=="string"||T.has(mi(ye))).map((ye)=>[I,U,...ye])}))}function Do(s){return o(Xs(s))}function ey(s){return Pe(tZ(s))}function ty(s,c,T){if(ey(c)===s)return!0;return typeof T==="string"&&T.length>0&&Pe(Do({...QS(c),claudeMd:T}))===s}function KS(s,c,T){return o([s,typeof c==="string"?c:null,typeof T==="string"?T:null])}var rZ=new Set(["dns","unix","ipv4","ipv6"]),Lbe=new Set([...rZ,"http","https","ws","wss","ftp","file","grpc","grpcs","otlp","xds","tcp","udp","tls","h2","h2c","http2"]);function ny(s){return s.replace(/[^\x20-\x7e]/gu,"?")}function sZ(s){let c=s.extraKnownMarketplaces;if(c!==void 0&&c!==null)return c;let T=s;for(let{alias:I,canonical:v}of fs){if(v!=="extraKnownMarketplaces")continue;let U=T[I];if(U!==void 0&&U!==null&&typeof U==="object")return U}return}var aZ="remote-settings.json",lZ=5000;var dy="remote-settings-helper-consent";function cZ(){return cy(C(),dy)}function dZ(s){let c=jS(s);return qS(c)?c:void 0}function uZ(s){let c=nr(s,(T,I)=>I.startsWith("$")&&I!=="$schema");if(Object.keys(c).length!==Object.keys(s).length)uy.set(c,s);return c}function oy(s){return uy.get(s)??s}var uy=new WeakMap;class py{sessionCache=null;storedAccountReader=null;storedCopyGateCovers=!0;storedCopyOrgPin={kind:"unreadable"};mayHideDialog=()=>!1;writesForHiddenDialog=()=>!1;seededUnjudged=null;storedCopyTrust="not_asked";storedCopyRefusal=null;helperTierReadAtMs=null;refusedCopyHelperTier=null;droppedHelperTier=null;eligible=void 0;eligibilityMemo=void 0;machinePinsSignInMemo=void 0;ineligibleReason=void 0;evalPolicySnapshotOnly=!1;hybridTokenRenewalDue=!1;hybridOrganizationUuid=null;usesGatewayVariable=!1;hybridSignInEnded=!1;hybridBlockFilter=null;hybridHostsWithheld=!1;hybridProviderFromOrganization=!1;hybridOnlyForConnection=!1;hybridSignInKeepsCredentialAside=!1;hybridLeftOut=null;hybridMarketplacesOffered=null;hybridPluginLocksByUrl=new Map;hybridPluginLockRules=null;pluginMcpServersListed=[];pluginLocksByUrlView=null;hybridNote=null;hybridCacheLeftOut=null;lastLoadStatus=void 0;loadCycleEnded=!1;loadCycleBegun=!1;loadCycleEndedSignal=p();loadBackstopReleased=!1;lastLoadStatusChanged=p();policySettingsNotified=!1;verifiedPayload=null;verifiedByGateway=void 0;unverifiedView=null;projectedView=null;projectedParse=null;consentedPayload=null;deferredPayload=null;resetEpoch=0;backendView=void 0;coworkCloudHolds={};heldSoFar(s){let c=Object.keys(this.coworkCloudHolds).length>0;if(!c&&!Ks())return s;if(s!==null){let T=Pc(this.coworkCloudHolds,s);return this.coworkCloudHolds=_a(T),T}return c?this.coworkCloudHolds:null}replaceSessionCache(s,c){let T=c?.verified===!0||!Ks();if(!T&&s!==null&&s===this.sessionCache)return;let I=this.heldSoFar(T?EZ(s):null);if(this.keepHelperLeaving(),this.sessionCache=I,c?.verified){if(this.seededUnjudged=null,this.verifiedPayload=I,this.verifiedByGateway=en()?.url,this.projectedView=null,this.projectedParse=null,c.consentDeferred)this.deferredPayload=I}}seedFromDisk(s){let c=Object.keys(this.coworkCloudHolds).length>0?Pc(this.coworkCloudHolds,s):s;this.sessionCache=c,this.seedConsentBaseline(c)}seedConsentBaseline(s){let c=dZ(s);if(c!==void 0){let T=AZ();if(T===void 0||!ty(T,c,s.claudeMd))return}this.consentedPayload??=s}markConsented(s){this.consentedPayload=s}dropConsentDeferral(){this.deferredPayload=null}markPolicySettingsNotified(){this.policySettingsNotified=!0}recordEligibility(s,c){if(this.eligible=s,c.memoize)this.eligibilityMemo=s,this.ineligibleReason=s?void 0:c.ineligibleReason}resetListener=null;registerResetListener(s){if(this.resetListener!==null)throw Error("registerSyncCacheResetListener: a listener is already registered; a second one would unhook the first");this.resetListener=s}keepHelperLeaving(){if(this.sessionCache===this.verifiedPayload){let s=cu(this.sessionCache);this.droppedHelperTier=s===null?this.droppedHelperTier:{...s,env:{...this.droppedHelperTier?.env,...s.env}}}}reset(){this.keepHelperLeaving(),this.sessionCache=null,this.helperTierReadAtMs=null,this.storedCopyTrust="not_asked",this.storedCopyRefusal=null,this.refusedCopyHelperTier=null,this.storedAccountReader=null,this.storedCopyGateCovers=!0,this.storedCopyOrgPin={kind:"unreadable"},this.mayHideDialog=()=>!1,this.writesForHiddenDialog=()=>!1,this.seededUnjudged=null,this.eligible=void 0,this.eligibilityMemo=void 0,this.machinePinsSignInMemo=void 0,this.ineligibleReason=void 0,this.hybridTokenRenewalDue=!1,this.evalPolicySnapshotOnly=!1,this.hybridOrganizationUuid=null,this.usesGatewayVariable=!1,this.hybridSignInEnded=!1,this.hybridBlockFilter=null,this.hybridHostsWithheld=!1,this.hybridProviderFromOrganization=!1,this.hybridOnlyForConnection=!1,this.hybridSignInKeepsCredentialAside=!1,this.hybridLeftOut=null,this.hybridMarketplacesOffered=null,this.hybridPluginLocksByUrl=new Map,this.hybridPluginLockRules=null,this.pluginLocksByUrlView=null,this.hybridNote=null,this.hybridCacheLeftOut=null,this.lastLoadStatus=void 0,this.loadCycleEnded=!1,this.loadCycleBegun=!1,this.loadBackstopReleased=!1,this.policySettingsNotified=!1,this.verifiedPayload=null,this.verifiedByGateway=void 0,this.unverifiedView=null,this.projectedView=null,this.projectedParse=null,this.consentedPayload=null,this.deferredPayload=null,this.resetEpoch++,this.emitLoadStatusChanged(void 0)}emitLoadStatusChanged(s){try{this.lastLoadStatusChanged.emit(s)}catch(c){t(`Remote settings: load-status listener threw: ${S(c)}`,{level:"error"})}}}var pZ=new i(()=>new py);function Jn(){return pZ.of(b().host)}function El(){return l_()||(!Zt()&&!Qt()||i_())&&Jn().mayHideDialog()}function fy(){return Jn().lastLoadStatus}function ms(){return}function fZ(){return Jn().evalPolicySnapshotOnly}var xRe=new i(()=>new Map);var kRe=new i(()=>new Map);var vRe=new i(()=>({held:void 0,running:void 0,afterRefusal:!1}));var MRe=new i(()=>({credentials:new Set,resources:new Set}));var URe=new i(()=>({value:!1}));var HRe=new i(()=>({value:!0}));function du(){return m()||fZ()}function my(s){let{projectedView:c,projectedParse:T}=Jn();return s!==null&&(c?.view===s||T?.view===s||mZ(s))}function mZ(s){return Vr()&&Object.keys(s).length>0&&Qn(_a(s),s)}var gZ=[["allowedHttpHookUrls"],["httpHookAllowedEnvVars"],["isolation","required"]],gy=[{path:["sandbox","credentials","files"],names:"path"},{path:["sandbox","credentials","envVars"],names:"name"}];function _y(s){for(let T of gZ)yn(s,T,void 0);for(let{path:T,names:I}of gy){let v=Yt(s,T),U=(Array.isArray(v)?v:[v]).flatMap((oe)=>r(oe)&&typeof oe[I]==="string"?[{[I]:oe[I],mode:"deny"}]:[]);yn(s,T,U.length>0?U:void 0)}for(let T of[["permissions","deny"],["permissions","ask"]]){let I=Yt(s,T);if(Array.isArray(I)){let v=I.filter((U)=>typeof U!=="string"||!Ws.test(U));yn(s,T,v)}}for(let{path:T,restrictive:I}of Eo()){let v=Yt(s,T),U=T[0]==="strictPluginOnlyCustomization"?v:ls(v);if(I===!0&&U===!1)yn(s,T,void 0)}let c=s.strictPluginOnlyCustomization;if(Array.isArray(c)&&!c.some((T)=>ui.includes(T)))delete s.strictPluginOnlyCustomization;if(s.availableModelsMatch==="prefix")delete s.availableModelsMatch}function Ey(s){let c={...$d(s)};if(_y(c),s.parentSettingsBehavior==="merge")c.parentSettingsBehavior="merge";let T=Object.fromEntries([...Bm,$r].flatMap((U)=>Object.entries(s.pluginConfigs?.[U]?.options??{}))),I=wc({pluginConfigs:{[$r]:{options:T}}});if(I!==void 0)c.pluginConfigs=I;let v=Object.entries(s.enabledPlugins??{}).filter(([U,oe])=>oe===!1&&!(U.includes("@")&&_S(U.slice(U.lastIndexOf("@")+1))===ps));return v.length===0?c:{...c,enabledPlugins:Object.fromEntries(v)}}function ry(s){if(!s||!du())return s;let c={...$d(s)};if(m()){if(_y(c),s.fastMode===!1)c.fastMode=!1;if(s.fastModePerSessionOptIn===!0)c.fastModePerSessionOptIn=!0;let T=Object.entries(r(s.skillOverrides)?s.skillOverrides:{}).flatMap(([I,v])=>v==="off"?[[I,"off"]]:[]);if(T.length>0)c.skillOverrides=Object.fromEntries(T);if(s===Jn().verifiedPayload){if(typeof s.claudeMd==="string"&&s.claudeMd!=="")c.claudeMd=s.claudeMd;let I=yS(s);if(I!==void 0)c.enabledPlugins=I;for(let[v,U]of Object.entries(lS(s.autoMode).lists))yn(c,["autoMode",v],U)}}return{...c,managedSourcesBehavior:"merge"}}function _Z(){return L_(()=>Ks()||mn.CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST&&xm.has(mn.CLAUDE_CODE_ENTRYPOINT??"")||zs())}function hy(){return ms()??cy(C(),aZ)}var Sy=8388608;function EZ(s){if(s===null||!Ks())return s;let c=_a(s);return Qn(c,s)?s:c}function hZ(){if(_Z())return null;let s=Jn(),c=s.storedCopyRefusal;if(c!==null&&El()&&Date.now()-c.atMs<lZ)return s.storedCopyTrust={trusted:!1,reason:c.reason},null;s.storedCopyTrust="not_asked",s.storedCopyRefusal=null,s.refusedCopyHelperTier=null;try{let T=CZ();if(T===null)return null;let I=A(Ee(T));if(!I||typeof I!=="object"||Array.isArray(I))return null;let v=uZ(I);return SZ(v)?v:null}catch(T){if(em(T))t(`Remote settings: Disk cache exceeds ${Sy} bytes; ignoring it as if absent`);return null}}function SZ(s){let c=Jn();if(!El()||!c.storedCopyGateCovers||ms()!==void 0||c.evalPolicySnapshotOnly)return c.storedCopyTrust="not_asked",!0;let T=c.storedCopyOrgPin;if(T.kind==="read"){let v=sy(s,T.orgs);if(v.trusted)return c.storedCopyTrust=v,!0;return iy(s,v.reason,ka(v.reason)),!1}let I=s.forceRemoteSettingsRefresh===!0?sy(s,void 0):void 0;return iy(s,"org_pin_unknown",I!==void 0&&(I.trusted||ka(I.reason))),!1}function sy(s,c){try{return A_({kind:"managed-settings",cachePath:hy(),body:oy(s),bodySha:c_(oy(s)),account:Jn().storedAccountReader?.(),pinnedOrgs:c,nowMs:Date.now(),roots:T_()})}catch(T){return t(`Remote settings: the gate on a stored copy failed: ${S(T)}`,{level:"error"}),{trusted:!1,reason:"error"}}}function iy(s,c,T){let I=Jn();I.storedCopyTrust={trusted:!1,reason:c},I.storedCopyRefusal={atMs:Date.now(),reason:c,forcesRefresh:T&&s.forceRemoteSettingsRefresh===!0},I.refusedCopyHelperTier=ka(c)?yZ(s):null,I.seedConsentBaseline(s),t(`Remote settings: the stored copy is not trusted at rest (${c}); treating it as absent`)}function cu(s){if(s===null)return null;let{apiKeyHelper:c,env:T}=s;return typeof c==="string"&&c.trim()!==""?{apiKeyHelper:c,env:zr(r(T)?T:{},(I)=>typeof I==="string")}:null}function yZ(s){let[c]=Oy(s);if(s===null||c===void 0)return cu(s);let[T,I]=c;return cu(VS(s,T)?{...s,...I,env:{...s.env,...I.env}}:I)}var OZ=4096;function AZ(){let s=uu();if(s!==void 0)return s.attestation;if(m())return;try{return Bo(cZ(),OZ).trim()||void 0}catch{return}}function CZ(){let s=uu();if(s!==void 0)return s.content;if(m()&&ms()===void 0)return null;return Bo(hy(),Sy)}function uu(){let s=Jn().backendView;if(!f()||s===void 0||!s.ready||s.stoodDown||ms()!==void 0)return;if(!an(s.configHome)){s.standDown("config home changed");return}return s}var FRe=N.state("remote-settings"),BRe=N.state(dy);var bZ=new Set([...kS,...Zd,...Qd,"AWS_ENDPOINT_URL_STS","AWS_ENDPOINT_URL","AWS_ENDPOINT_URL_SSO","AWS_ENDPOINT_URL_SSO_OIDC","AWS_ENDPOINT_URL_BEDROCK","AWS_ENDPOINT_URL_BEDROCK_RUNTIME",...ou,...gi,...ru,"CLOUDSDK_CONFIG","GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES","GCLOUD_PROJECT","CLAUDE_CODE_CUSTOM_OAUTH_URL",..._l,"CLAUDE_CODE_API_BASE_URL","CLAUDE_CODE_OAUTH_REFRESH_TOKEN","CLAUDE_CODE_OAUTH_SCOPES","CLAUDE_CODE_OAUTH_CLIENT_ID","CLAUDE_CODE_SESSION_ACCESS_TOKEN","CLAUDE_SESSION_INGRESS_TOKEN_FILE","CLAUDE_CODE_ENVIRONMENT_KIND","CLAUDE_CODE_REMOTE_SESSION_ID","ANTHROPIC_FEDERATION_RULE_ID","ANTHROPIC_ORGANIZATION_ID","ANTHROPIC_WORKSPACE_ID","ANTHROPIC_SERVICE_ACCOUNT_ID","ANTHROPIC_IDENTITY_TOKEN","ANTHROPIC_IDENTITY_TOKEN_FILE","ANTHROPIC_SCOPE","ANTHROPIC_PROFILE","ANTHROPIC_CONFIG_DIR","CLAUDE_CODE_FEDERATION_CACHE_DIR","HOME","XDG_CONFIG_HOME","APPDATA","USERPROFILE","HOMEDRIVE","HOMEPATH","PROGRAMDATA","ALLUSERSPROFILE","ANTHROPIC_CUSTOM_HEADERS","CLAUDE_CODE_HOST_CREDS_FILE","CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST","CLAUDE_CODE_HOST_AUTH_ENV_VAR","CLAUDE_CONFIG_DIR","CLAUDE_SECURESTORAGE_CONFIG_DIR","CLAUDE_CODE_REMOTE_SETTINGS_PATH","CLAUDE_CODE_MANAGED_SETTINGS_PATH","CLAUDE_CODE_DISABLE_ADMIN_ENV_UNION","CLAUDE_CODE_MOCK_REMOTE_SETTINGS","USE_LOCAL_OAUTH","USE_STAGING_OAUTH","CLAUDE_LOCAL_OAUTH_API_BASE","CLAUDE_LOCAL_OAUTH_APPS_BASE","CLAUDE_LOCAL_OAUTH_CONSOLE_BASE","CLAUDE_BRIDGE_BASE_URL","CLAUDE_BRIDGE_OAUTH_TOKEN","CLAUDE_BRIDGE_SESSION_INGRESS_URL","CLAUDE_REMOTE_TOOLS_BRIDGE_URL","CLAUDE_CODE_GB_BASE_URL"].map((s)=>s.toUpperCase()));function RZ(s){if(!s||!s.env&&!("managedMcpServers"in s))return s;let{managedMcpServers:c,...T}=s;return s.env?{...T,env:nr(s.env,(I,v)=>bZ.has(v.toUpperCase()))}:T}function yy(){let s=Cy();if(s===null||du()||Ay(Jn(),s))return!1;if(ay(s))return!0;return Oy(s).some(([,c])=>ay(c))}function Oy(s){let c=Ei(s);if(c.length===0)return[];return[...FS().chain,void 0].flatMap((T)=>c.filter(([I])=>lu(I)===T))}function ay(s){let c=s.managedMcpServers;return r(c)&&Object.keys(c).length>0}function Ay(s,c){return c===s.verifiedPayload||Boolean(ms())}function Cy(){let s=Jn();if(!ms()&&s.eligible!==!0)return s.heldSoFar(null);if(s.sessionCache){if(s.sessionCache!==s.seededUnjudged||!El())return s.sessionCache;s.sessionCache=null,s.seededUnjudged=null,Ft()}let c=uu()!==void 0,T=hZ();if(T){if(s.seedFromDisk(T),s.seededUnjudged=El()?null:s.sessionCache,c)ie().invalidatePolicyLayer();else Ft();return s.sessionCache}return s.heldSoFar(null)}function by(s){let c=Cy(),T=Jn(),I=Ay(T,c)?c:TZ(T,c);if(I===null)return null;if(!du())return I;if(T.projectedView?.raw!==I)T.projectedView={raw:I,view:ry(I)};let v=T.projectedView.view;if(!s)return v;if(T.projectedParse?.raw!==I){let U={...v};if(Ry(U,ry(s(I))??{}),m())for(let{path:oe,names:re}of gy){let le=[v,U].flatMap((ye)=>Yt(ye,oe)??[]);if(le.length>0)yn(U,oe,s_(le,re))}T.projectedParse={raw:I,view:U}}return T.projectedParse.view}function Ry(s,c){for(let[T,I]of Object.entries(c)){let v=s[T];if(v!==I&&r(v)&&r(I)){let U={...v};Ry(U,I),s[T]=U}else s[T]=I}}function TZ(s,c){if(c===null)return null;if(s.unverifiedView?.raw!==c)s.unverifiedView={raw:c,view:RZ(c)};return s.unverifiedView.view}var DZ=d(new Set,(s)=>s.clear());function Ty(s){DZ.add(s)}var rTe=d({noFollowAny:"untried",localVolumes:void 0},(s)=>{s.noFollowAny="untried",s.localVolumes=void 0});var sTe=Symbol("no procfs"),iTe=Symbol("descriptor path unreadable");var aTe=Symbol("boundRead.linkToNothing");var LZ={opus:"ANTHROPIC_DEFAULT_OPUS_MODEL",sonnet:"ANTHROPIC_DEFAULT_SONNET_MODEL",haiku:"ANTHROPIC_DEFAULT_HAIKU_MODEL",fable:"ANTHROPIC_DEFAULT_FABLE_MODEL"},Dy=["ANTHROPIC_BEDROCK_BASE_URL","ANTHROPIC_BEDROCK_MANTLE_BASE_URL","ANTHROPIC_VERTEX_BASE_URL","ANTHROPIC_FOUNDRY_BASE_URL"],Ly=[...va,"AWS_REGION","AWS_PROFILE",...Dy,"AWS_BEARER_TOKEN_BEDROCK",...eu,"ANTHROPIC_VERTEX_PROJECT_ID","CLOUD_ML_REGION","ANTHROPIC_FOUNDRY_RESOURCE"],fTe=[...va,...Dy,"ANTHROPIC_BASE_URL","AWS_REGION","AWS_DEFAULT_REGION","AWS_PROFILE","CLOUD_ML_REGION","ANTHROPIC_VERTEX_PROJECT_ID","ANTHROPIC_FOUNDRY_RESOURCE","ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION",...tt.map(([,s])=>s)],mTe=[...Ly,"AWS_ENDPOINT_URL_BEDROCK_RUNTIME","AWS_ENDPOINT_URL_BEDROCK","AWS_ENDPOINT_URL","AWS_ENDPOINT_URL_STS","AWS_ENDPOINT_URL_SSO","AWS_ENDPOINT_URL_SSO_OIDC","AWS_ENDPOINT_URL_SIGNIN","ANTHROPIC_BEDROCK_REGION_PREFIX","AWS_CONFIG_FILE","AWS_SHARED_CREDENTIALS_FILE","GOOGLE_APPLICATION_CREDENTIALS","AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_SESSION_TOKEN",...gi],Iy=["AWS_BEARER_TOKEN_BEDROCK","AWS_CONFIG_FILE","AWS_SHARED_CREDENTIALS_FILE","AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_SESSION_TOKEN","GOOGLE_APPLICATION_CREDENTIALS","ANTHROPIC_BEDROCK_SERVICE_TIER"],IZ=["ANTHROPIC_BEDROCK_BASE_URL","ANTHROPIC_BEDROCK_MANTLE_BASE_URL"];function wZ(s,c){return}function wy(s,c){let T=new Map(Object.entries(s).map(([ye,Re])=>[ye.toUpperCase(),Re])),I=new Set(Object.entries(c??{}).filter(([,ye])=>ye.trim()!=="").map(([ye])=>ye.toUpperCase())),v=wZ(c,T.get("AWS_REGION"))!==void 0&&IZ.some((ye)=>T.get(ye)==="")?["AWS_BEARER_TOKEN_BEDROCK"]:[],U=Boolean(T.get("AWS_CONFIG_FILE"))&&T.get("AWS_ACCESS_KEY_ID")==="",oe=I.has("AWS_PROFILE")||I.has("AWS_ACCESS_KEY_ID"),re=I.has("AWS_CONFIG_FILE")||I.has("AWS_SHARED_CREDENTIALS_FILE"),le=I.has("AWS_ACCESS_KEY_ID");if(!(re||le))return{dropped:[],cleared:v};return{dropped:["AWS_CONFIG_FILE","AWS_SHARED_CREDENTIALS_FILE",...U||le||I.has("AWS_PROFILE")?["AWS_PROFILE"]:[],...U&&!oe?["AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_SESSION_TOKEN","AWS_BEARER_TOKEN_BEDROCK"]:[]],cleared:[...v,...le&&!T.has("AWS_SESSION_TOKEN")&&!I.has("AWS_SESSION_TOKEN")?["AWS_SESSION_TOKEN"]:[]]}}var gTe=[...Ly,"AWS_CONFIG_FILE","AWS_SHARED_CREDENTIALS_FILE","GOOGLE_APPLICATION_CREDENTIALS","AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_SESSION_TOKEN","ANTHROPIC_BEDROCK_SERVICE_TIER",...Object.values(LZ),"ANTHROPIC_DEFAULT_MODEL","ANTHROPIC_SMALL_FAST_MODEL","ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION",...tt.map(([,s])=>s),"ANTHROPIC_CUSTOM_HEADERS"],Py=["availableModels","availableModelsMatch","modelPicker"];function Ny(s){let c=Bt(s.trim().toLowerCase());if(c==="")return{kind:"ignored"};if(be(c))return{kind:"family",family:c};let T=c.startsWith("claude-")?c.slice(7):"";if(be(T))return{kind:"family",family:T};if(ft(c)||c==="default")return{kind:"ignored"};let I=V(c)!==null||c.startsWith("claude-")?c:`claude-${c}`,v=V(I);return v!==null?{kind:"model",id:v,latest:NZ(I,v),spelling:I}:{kind:"literal",value:c}}function PZ(s,c){let T=s.toLowerCase(),I=T.lastIndexOf(c.base);return I===-1?"":T.slice(I+c.base.length)}function NZ(s,c){return c.trailer===void 0&&PZ(s,c).startsWith("-latest")}function xZ(s,c){for(let T of c){if(be(T))continue;let I=T.indexOf(s);if(I===-1)continue;let v=I+s.length;if(v===T.length||T[v]==="-")return!0}return!1}function kZ(s){return s.charAt(0).toUpperCase()+s.slice(1)}function xy(s){let c;for(let T of On){let I=V(T);if(I!==null&&I.family===s&&!I.legacyVersionFirst&&(c===void 0||Tn(I,c)>0))c=I}return c?.base}function ky(s,c){let T=Ny(s);switch(T.kind){case"ignored":{if(s.trim()==="")return"An empty availableModels entry was ignored.";let I=xy("opus");return`"${D(s)}" in availableModels was ignored, because "availableModelsMatch" is "exact" and this name means a different model depending on the release and settings. List the model IDs you want to allow instead${I===void 0?"":`, for example "${I}"`}.`}case"family":{let I=c.filter((U)=>Ny(U).kind!=="ignored").map((U)=>Bt(U.trim().toLowerCase()));if(be(s.trim().toLowerCase())&&xZ(T.family,I))return;let v=xy(T.family);return`"${D(s)}" in availableModels allows every ${kZ(T.family)} model, including future releases, even though "availableModelsMatch" is "exact". To allow only some versions, list their model IDs instead${v===void 0?"":`, for example "${v}"`}.`}case"model":return;case"literal":return vZ(s,T.value)}}function vZ(s,c){let T=`"${D(s)}" in availableModels allows only a model named exactly "${D(c)}".`,I=c.replace(/(\d)\.(\d)/g,"$1-$2");if(I!==c){let U=I.startsWith("claude-")?I:`claude-${I}`;if(V(U)!==null)return`${T} To allow a version, write it with a hyphen: "${D(U)}".`}let v=new RegExp(`^(${ge.join("|")})\\s+(\\d+)(?:\\.(\\d+))?$`).exec(c);if(v){let[,U,oe,re]=v;return`${T} To allow a version, write its model ID, for example "claude-${U}-${oe}${re!==void 0?`-${re}`:""}".`}return}function MZ(s){return s!==void 0&&(s.commit!==void 0||s.pr!==void 0)}function vy(s,c){let T=s?.commitTrailers;if(typeof T==="boolean")return T?"explicit-enabled":"disabled";if(s!==void 0&&MZ(s))return s.commit===""?"disabled":"implicit-enabled";if(c!==void 0)return c?"implicit-enabled":"disabled";return}import{closeSync as $Z,lstatSync as By,openSync as VZ,readdirSync as YZ,readSync as XZ,realpath as JZ,realpathSync as ZZ,statSync as qZ}from"node:fs";import{join as YTe,posix as yl,resolve as zy,sep as QZ}from"node:path";import{promisify as eq}from"node:util";import{posix as UZ}from"path";var My=String.raw`(?![\p{Default_Ignorable_Code_Point}\u{16FE4}])[\p{L}\p{M}\p{N}._-]`;var{dirname:hl,isAbsolute:wTe,join:Sl,normalize:PTe,relative:NTe,sep:xTe}=UZ,hi="/mnt/user-data/uploads",HZ="/uploads",Uy="/uploads/cowork-folders/",kTe=`${hi}${Uy.slice(HZ.length)}`;var vTe=new RegExp(`^(${Uy}[a-z0-9-]+/)(?:CLAUDE\\.md|\\.cowork-folder)$`);var MTe=Sl(hl(hi),"outputs");var UTe=Sl(hl(hi),"attachments"),HTe=Sl(hl(hi),"project-docs"),FZ="/connector-downloads",BZ=String.raw`download-[0-9a-f]{8}\.[a-z0-9]{2,5}`,zZ=String.raw`(?!(?:(?<![\p{L}\p{N}\p{M}])|(?<=\p{M}{8}))\p{M})${My}`,GZ=String.raw`[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}/(?:${BZ}|(?![.-])(?:${zZ}){1,80}\.[a-z0-9]{2,5})`,FTe=new RegExp(`^${GZ}$`,"u");var WZ=Sl(hl(hi),FZ);function Hy(){return WZ}var KZ="/mnt/project-files",BTe=Object.freeze({product:KZ,attach:"/mnt/attach/project-files"});import{constants as pu}from"fs";function Fy(){return pu.O_RDONLY|jZ()}function jZ(){if(g()==="windows")return 0;return pu.O_NOFOLLOW|pu.O_NONBLOCK}var iDe=eq(JZ.native),tq="connector-downloads";function nq(s){if(typeof s!=="string")return!1;return s.split(/[\\/]/).slice(0,-1).some(fu)}function fu(s){return Kd(s)===tq}var oq=1000;var Al=d(new Map,(s)=>s.clear()),rq=256,Cl=/^([^~./\\]{1,6})~\d+(\.[^./\\]{0,3})?$/;function sq(s,c,T){if(Al.size>=rq)Al.clear();Al.set(s,{expanded:c,dev:T.dev,ino:T.ino})}function iq(s){if(process.platform!=="linux"||!s.startsWith("/"))return;let c=s.split("/").filter((I)=>I!=="");if(!c.some((I)=>Cl.test(I))||g()!=="wsl")return;let T="/";try{for(let I of c){let v=Cl.exec(I);if(v===null){T=yl.join(T,I);continue}let U=yl.join(T,I),oe=qZ(U,{bigint:!0}),re=Al.get(U);if(re!==void 0&&re.dev===oe.dev&&re.ino===oe.ino){T=re.expanded;continue}let le;if(!Ge(oe.ino)){let Re=YZ(T);for(let Ie of lq(Re,I,v[1])){let Le;try{Le=By(yl.join(T,Ie),{bigint:!0})}catch{continue}if(Le!==void 0&&Le.dev===oe.dev&&Le.ino===oe.ino){le=Ie;break}}}let ye=yl.join(T,le??I);sq(U,ye,oe),T=ye}}catch{return}return T}function aq(s){if(process.platform!=="win32"||Oe(s))return;try{return ZZ.native(s)}catch{return}}function lq(s,c,T){let I=T.toLowerCase(),v=s.filter((le)=>le!==c),U=v.filter((le)=>!Cl.test(le)),oe=U.filter(fu),re=U.filter((le)=>!oe.includes(le)&&le.replace(/[ .]/g,"").toLowerCase().startsWith(I));return[...oe,...re,...U.filter((le)=>!oe.includes(le)&&!re.includes(le)),...v.filter((le)=>Cl.test(le))].slice(0,oq)}function cq(s){return s.replace(/[\\/][^\\/]*$/,"")}var Ol=d(new Map,(s)=>s.clear());function bl(s){let c=Ol.get(s);if(c!==void 0)return c;let T=!1;for(let I of Gy(s)){let v=zy(I).split(/[\\/]/);for(let U=0;U<v.length&&!T;U++)if(fu(v[U])){let oe=v.slice(0,U+1).join("/");T=oe===Hy()||pq(`${oe}/.gitignore`)}}if(Ol.size>=64)Ol.clear();if(T||!s.includes("~"))Ol.set(s,T);return T}var dq=/^(download-[0-9a-f]{8}(-\d+)?(\.[^./\\]*)?|\.download-[0-9a-f]{8}(-\d+)?(\.[^./\\]*)?\.(from\.json|part))$/;function uq(s){let c=By(s);if(!c.isFile()||c.size>3)return"";let T=VZ(s,Fy());try{let I=Buffer.alloc(4),v=XZ(T,I,0,I.length,0);return I.subarray(0,v).toString("utf8")}finally{$Z(T)}}function pq(s){let c=a();try{let T=We(c,s);if(c.readdirSync(cq(s)).some((v)=>dq.test(v.name)))return!0;if(T.absentAt!==void 0)return!1;return["*",`*
`,`*\r
`].includes(uq(s))}catch{return!0}}function Si(s){return Gy(s).some((c)=>nq(`${c}/.`))}function Gy(s){let c=g();if(!s.includes("~")||c!=="windows"&&c!=="wsl")return[s];let T=zy(s).split(/[\\/]/);return[s,...T.flatMap((I,v)=>{if(!I.includes("~")&&v<T.length-1)return[];let{resolvedPath:U,isCanonical:oe}=fe(a(),Ue(T.slice(0,v+1).join(QZ)));return oe?[aq(U)??iq(U)??U]:[]})]}var fq=["allowManagedMcpServersOnly","allowedMcpServers","deniedMcpServers","disabledMcpjsonServers","enabledMcpjsonServers","enableAllProjectMcpServers","disableClaudeAiConnectors","managedMcpServers"];function Rl({slot:s,adminTiers:c}){return s?.allowManagedMcpServersOnly===!0||c.some((T)=>T.allowManagedMcpServersOnly===!0)}function mu({slot:s,adminTiers:c}){return s?.allowedMcpServers??c.find((T)=>T.allowedMcpServers!==void 0)?.allowedMcpServers}function Wy(s,c){return fq.filter((T)=>s[T]!==void 0&&!mq(T,s,c))}function mq(s,c,T){let I=T.slot??{};switch(s){case"deniedMcpServers":return!0;case"allowManagedMcpServersOnly":return c.allowManagedMcpServersOnly===Rl(T);case"disableClaudeAiConnectors":return c.disableClaudeAiConnectors===(I.disableClaudeAiConnectors===!0||T.adminTiers.some((v)=>v.disableClaudeAiConnectors===!0));case"allowedMcpServers":return Qn(c.allowedMcpServers,Rl(T)?mu(T):I.allowedMcpServers);case"disabledMcpjsonServers":return(c.disabledMcpjsonServers??[]).every((v)=>I.disabledMcpjsonServers?.includes(v)===!0);case"enabledMcpjsonServers":return(c.enabledMcpjsonServers??[]).every((v)=>I.enabledMcpjsonServers?.includes(v)===!0);case"enableAllProjectMcpServers":return(c.enableAllProjectMcpServers??!1)===(I.enableAllProjectMcpServers??!1);case"managedMcpServers":{let v=I.managedMcpServers??{};return Object.entries(c.managedMcpServers??{}).every(([U,oe])=>Object.hasOwn(v,U)&&Qn(v[U],oe))}}}var Ky=512;function gu(s){return s.map(gq)}function gq(s){let{file:c,severity:T,docLink:I,statusOnly:v,startupFatal:U,loadedWithoutGuardHook:oe,errorClass:re,errno:le,unreadCause:ye,preserveOnWrite:Re,mcpErrorMetadata:Ie,userWritable:Le,wslIgnored:Ze,substituted:$e,onlySubstitutes:dt,removal:Me,unattendedSafe:nt,path:rt,message:ct,expected:pt,suggestion:bt,invalidValue:Nt,...Ct}=s,Ut=Ct;return{file:c,severity:T,docLink:I,statusOnly:v,startupFatal:U,loadedWithoutGuardHook:oe,errorClass:re,errno:le,unreadCause:ye,preserveOnWrite:Re,mcpErrorMetadata:Ie,userWritable:Le,wslIgnored:Ze,substituted:$e,onlySubstitutes:dt,removal:Me,unattendedSafe:nt,path:yi(rt),message:yi(ct),expected:pt===void 0?void 0:yi(pt),suggestion:bt===void 0?void 0:yi(bt),invalidValue:typeof Nt==="string"?yi(Nt):void 0}}function yi(s){let c=ny(s.replace(/\s+/gu," "));return c.length>Ky?`${c.slice(0,Ky-1)}…`:c}function jy(s,c){if(c===null)return s;let T=[...c.values];return{settings:kn(Fn(s.settings,T.filter(([,I])=>I===void 0).map(([I])=>I)),M(Object.fromEntries(T.filter(([,I])=>I!==void 0))),(I,v)=>v),errors:[...s.errors,...c.errors]}}import{globalRegistry as EDe,toJSONSchema as hDe}from"zod/v4";import{$ZodCheck as yDe,$ZodLazy as ODe}from"zod/v4/core";var Lo="https://code.claude.com/docs/en",_q=[{matches:(s)=>s.path==="permissions.defaultMode"&&s.code==="invalid_value",tip:{suggestion:'Valid modes: "acceptEdits" (ask before file changes), "plan" (analysis only), "bypassPermissions" (auto-accept all), or "default" (standard behavior)',docLink:`${Lo}/iam#permission-modes`}},{matches:(s)=>s.path==="apiKeyHelper"&&s.code==="invalid_type",tip:{suggestion:'Provide a shell command that outputs your API key to stdout. The script should output only the API key. Example: "/bin/generate_temp_api_key.sh"'}},{matches:(s)=>s.path==="cleanupPeriodDays"&&s.code==="too_small",tip:{suggestion:'cleanupPeriodDays must be at least 1. To keep transcripts for a long time, set a large number (e.g. 3650 for ~10 years). To disable transcript writes entirely, remove this setting and use the --no-session-persistence CLI flag or the SDK persistSession:false option instead. (0 is rejected because it previously silently disabled all transcript writes, which users setting it to mean "never clean up" did not expect.)'}},{matches:(s)=>s.path.startsWith("env.")&&s.code==="invalid_type",tip:{suggestion:'Environment variables must be strings. Wrap numbers and booleans in quotes. Example: "DEBUG": "true", "PORT": "3000"',docLink:`${Lo}/settings#environment-variables`}},{matches:(s)=>(s.path==="permissions.allow"||s.path==="permissions.deny")&&s.code==="invalid_type"&&s.expected==="array",tip:{suggestion:'Permission rules must be in an array. Format: ["Tool(specifier)"]. Examples: ["Bash(npm run build)", "Edit(docs/**)", "Read(~/.zshrc)"]. Use * for wildcards.'}},{matches:(s)=>s.path==="hooks"&&s.code==="unrecognized_keys",tip:{suggestion:"Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",docLink:`${Lo}/hooks`}},{matches:(s)=>/\.hooks\.\d+\.command$/.test(s.path)&&s.code==="invalid_type"&&s.received==="undefined",tip:{suggestion:'Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {"type": "command", "command": "echo", "args": ["hi"]}. For shell form, set `command` to the full shell string: {"type": "command", "command": "echo hi"}.',docLink:`${Lo}/hooks#exec-form-and-shell-form`}},{matches:(s)=>s.path.includes("hooks")&&s.code==="invalid_type",tip:{suggestion:'Hooks use a matcher + hooks array. The matcher is a string: a tool name ("Bash"), pipe-separated list ("Edit|Write"), or empty to match all. Example: {"PostToolUse": [{"matcher": "Edit|Write", "hooks": [{"type": "command", "command": "echo Done"}]}]}'}},{matches:(s)=>s.code==="invalid_type"&&s.expected==="boolean",tip:{suggestion:'Use true or false without quotes. Example: "includeCoAuthoredBy": true'}},{matches:(s)=>s.code==="unrecognized_keys",tip:{suggestion:"Check for typos or refer to the documentation for valid fields",docLink:`${Lo}/settings`}},{matches:(s)=>s.code==="invalid_value"&&s.enumValues!==void 0,tip:{suggestion:void 0}},{matches:(s)=>s.code==="invalid_type"&&s.expected==="object"&&s.received===null&&s.path==="",tip:{suggestion:"Check for missing commas, unmatched brackets, or trailing commas. Use a JSON validator to identify the exact syntax error."}},{matches:(s)=>s.path==="permissions.additionalDirectories"&&s.code==="invalid_type",tip:{suggestion:'Must be an array of directory paths. Example: ["~/projects", "/tmp/workspace"]. You can also use --add-dir flag or /add-dir command',docLink:`${Lo}/iam#working-directories`}}],Eq={permissions:`${Lo}/iam#configuring-permissions`,env:`${Lo}/settings#environment-variables`,hooks:`${Lo}/hooks`};function $y(s){let c=_q.find((I)=>I.matches(s));if(!c)return null;let T={...c.tip};if(s.code==="invalid_value"&&s.enumValues&&!T.suggestion)T.suggestion=`Valid values: ${s.enumValues.map((I)=>`"${I}"`).join(", ")}`;if(!T.docLink&&s.path)T.docLink=Eq[Qe(s.path,".")];return T}var eLe=e(()=>Md(cs(),{strictPolicyHelperKeys:!0}).strict());function Vy(s){return s.code==="invalid_type"}function Yy(s){return s.code==="invalid_value"}function hq(s){return s.code==="unrecognized_keys"}function Xy(s){return s.code==="too_small"}var Sq='a PreToolUse/PermissionRequest hook that cannot be loaded does not run, nor does any other hook of the document where "hooks" is listed here as ignored; fix or remove the entry. The managed settings document is not skipped for it, unlike a user or project settings file';function qy(s){return s.map((c)=>c.severity!=="warning"&&c.message.includes(To)?{...c,message:c.message.replace(To,()=>Sq),loadedWithoutGuardHook:!0}:c)}function Mn(s){if(s===null)return"null";if(s===void 0)return"undefined";if(Array.isArray(s))return"array";return typeof s}function Jy(s){let c=s.match(/received (\w+)/);return c?c[1]:void 0}function Oi(s,c){return s.issues.flatMap((I)=>{if(I.code!=="invalid_union"||I.path.join(".")!=="attribution")return[I];let v=I.errors.flat().filter((U)=>U.path.length>0);return v.length>0?v.map((U)=>({...U,path:[...I.path,...U.path]})):[I]}).map((I)=>{let v=I.path.map(String).join("."),U=I.message,oe,re,le,ye,Re;if(Yy(I))re=I.values.map((Le)=>String(Le)),le=re.join(" | "),ye=void 0,Re=void 0;else if(Vy(I)){le=I.expected;let Le=Jy(I.message);ye=Le??Mn(I.input),Re=Le??Mn(I.input)}else if(Xy(I))le=String(I.minimum);else if(I.code==="custom"&&"params"in I)ye=I.params.received,Re=ye;let Ie=$y({path:v,code:I.code,expected:le,received:ye,enumValues:re,message:I.message,value:ye});if(Yy(I))oe=re?.map((Le)=>`"${Le}"`).join(", "),U=`Invalid value. Expected one of: ${oe}`;else if(Vy(I)){let Le=Jy(I.message)??Mn(I.input);if(I.expected==="object"&&Le==="null"&&v==="")U="Invalid or malformed JSON";else U=`Expected ${I.expected}, but received ${Le}`}else if(hq(I)){let Le=I.keys.join(", ");U=`Unrecognized ${Q(I.keys.length,"field")}: ${Le}`}else if(Xy(I))U=`Number must be greater than or equal to ${I.minimum}`,oe=String(I.minimum);return{file:c,path:v,message:U,expected:oe,invalidValue:Re,suggestion:Ie?.suggestion,docLink:Ie?.docLink}})}function yq(s,c,T){if(!s||typeof s!=="object")return[];let I=s;if(!I.permissions||typeof I.permissions!=="object")return[];let v=I.permissions,U=[],oe=new Map;for(let re of["allow","deny","ask"]){let le=v[re];if(!Array.isArray(le))continue;let ye=le.filter((Re)=>{if(typeof Re!=="string")return U.push({file:c,path:`permissions.${re}`,message:`Non-string value in ${re} array was removed`,severity:"warning",invalidValue:Re}),!1;let Ie=bd(Re,re);if(!Ie.valid){let Le=`Invalid permission rule "${Re}" was skipped: ${Ie.error}`;if(Ie.suggestion)Le+=`. ${Ie.suggestion}`;return U.push({file:c,path:`permissions.${re}`,message:Le,severity:"warning",invalidValue:Re}),!1}return!0});if(T?.policySource&&re!=="allow"&&le.length>0&&ye.length===0){if(!T.strictParseFollows)continue;oe.set(re,"unreadable")}else if(ye.length<le.length)oe.set(re,"trimmed");v[re]=ye}return Bd("permissions",v,(re)=>oe.get(re),(re)=>U.push({file:c,path:re.path,message:re.message,severity:"warning",...re.substituted&&{substituted:re.substituted}})),U}var Oq=new Set(z);function Aq(s,c){if(!s||typeof s!=="object")return[];return[...SE(s,yE)?[{file:c,path:"hooks",message:`PreToolUse/PermissionRequest hooks are declared outside "hooks" (at the top level or under another key) — ${To}.`,severity:"fatal",docLink:"https://code.claude.com/docs/en/hooks"}]:[],...Cq(s,c)]}function Cq(s,c){if(!("hooks"in s))return[];if(s.hooks===null||typeof s.hooks!=="object"||Array.isArray(s.hooks)){let v=Mn(s.hooks);if(Array.isArray(s.hooks)&&(s.hooks.some(r)||qc(s.hooks)))return[{file:c,path:"hooks",message:`"hooks" must be an object mapping event names to matcher arrays; received ${v} — ${To}.`,invalidValue:v,docLink:"https://code.claude.com/docs/en/hooks"}];return delete s.hooks,[{file:c,path:"hooks",message:`"hooks" must be an object mapping event names to matcher arrays; received ${v}. This field was ignored.`,severity:"warning",invalidValue:v,docLink:"https://code.claude.com/docs/en/hooks"}]}let T=s.hooks;if(Xa(T))return[{file:c,path:"hooks",message:`"hooks" must be an object mapping event names to matcher arrays; received a single matcher — ${To}.`,docLink:"https://code.claude.com/docs/en/hooks"}];let I=[];for(let v of Object.keys(T)){let U=et(v);if(!Oq.has(v)){if(ir(T[v],3,{matchersCount:!Array.isArray(T[v])})){I.push({file:c,path:`hooks.${U}`,message:`"${U}" is not a hook event, but it holds PreToolUse/PermissionRequest hooks — ${To}.`,docLink:"https://code.claude.com/docs/en/hooks"});continue}delete T[v],I.push({file:c,path:`hooks.${U}`,message:`Unknown hook event "${U}" was ignored. Valid events: ${z.join(", ")}`,severity:"warning",invalidValue:U,docLink:"https://code.claude.com/docs/en/hooks",preserveOnWrite:!0});continue}if(!Array.isArray(T[v])){let oe=T[v],re=Mn(oe);if(si.has(v)&&oe!==null||ir(oe,3,{matchersCount:!1})){I.push({file:c,path:`hooks.${U}`,message:`Hook event "${U}" must be an array of matchers; received ${re} — ${To}.`,invalidValue:re,docLink:"https://code.claude.com/docs/en/hooks"});continue}delete T[v],I.push({file:c,path:`hooks.${U}`,message:`Hook event "${U}" must be an array of matchers; received ${re}. This entry was ignored.`,severity:"warning",invalidValue:re,docLink:"https://code.claude.com/docs/en/hooks",...oe!==null&&{preserveOnWrite:!0}})}}for(let[v,U]of Object.entries(T)){let{stripped:oe,unloadableGuards:re}=AE(U,v);for(let le of re)I.push({file:c,path:le.aboutType?`hooks.${v}.${le.path}.type`:`hooks.${v}.${le.path}`,message:`${le.problem} — ${To}.${le.aboutType?` Valid types: ${[...Ya()].join(", ")}`:""}`,severity:"fatal",invalidValue:le.received,docLink:"https://code.claude.com/docs/en/hooks"});for(let le of oe)I.push({file:c,path:le.aboutType?`hooks.${v}.${le.path}.type`:`hooks.${v}.${le.path}`,message:le.aboutType?`${le.problem}; entry ignored. Valid types: ${[...Ya()].join(", ")}`:`${le.problem}; ${le.hookIndex===void 0?"matcher":"entry"} ignored.`,severity:"warning",invalidValue:le.received,docLink:"https://code.claude.com/docs/en/hooks",preserveOnWrite:!0})}if(I.length>0&&Object.keys(T).length===0)delete s.hooks;return I}var bq=[{key:"allowedMcpServers",schema:al},{key:"deniedMcpServers",schema:ll}];function Rq(s,c,T){if(!s||typeof s!=="object")return[];let I=s,v=[];for(let{key:U,schema:oe}of bq){if(!(U in I))continue;if(!Array.isArray(I[U])){if(T?.keepWholeFieldInvalid)continue;let ye=I[U];delete I[U],v.push({file:c,path:U,message:`"${U}" must be an array; received ${Mn(ye)}. This field was ignored.`,severity:"warning",invalidValue:ye});continue}let re=I[U],le=[];for(let ye=0;ye<re.length;ye++){let Re=oe().safeParse(re[ye]);if(Re.success)le.push(re[ye]);else v.push({file:c,path:`${U}[${ye}]`,message:`Invalid entry was ignored: ${Re.error.issues[0]?.message??"failed validation"}`,severity:"warning",invalidValue:re[ye]})}if(le.length<re.length)I[U]=le}return v}var Tq=["strictKnownMarketplaces","blockedMarketplaces"];function Dq(s){if(!r(s)||!Object.values(s).includes(null))return;for(let c of ul())if(s[c]===null)delete s[c]}function Lq(s,c,T){if(!r(s))return[];let I=[];for(let v of Tq){let U=s[v];if(!Array.isArray(U))continue;let oe=[],re=[];for(let le=0;le<U.length;le++){let ye=ai().safeParse(U[le]);if(!ye.success){oe.push(U[le]),re.push(le);continue}let Re=Fd(ye.data);if(Re===null){oe.push(U[le]),re.push(le);continue}if(v==="blockedMarketplaces"){oe.push(U[le]),re.push(le),I.push({file:c,path:`${v}[${le}]`,message:`Unenforceable entry was kept: ${Re}; it can never match a marketplace source, but marketplace restrictions stay active`,severity:"warning"});continue}I.push({file:c,path:`${v}[${le}]`,message:`Invalid entry was ignored: ${Re}`,severity:"warning"})}if(oe.length<U.length)s[v]=oe,T?.set(v,re)}return I}function Iq(s,c){if(!r(s)||s.managedMcpServers===void 0)return[];let I=[],v=ja(s.managedMcpServers,(U,oe)=>I.push({file:c,path:U?`managedMcpServers.${U}`:"managedMcpServers",message:U?`Managed MCP server was ignored: ${oe}`:oe,severity:"warning"}));if(v===void 0)delete s.managedMcpServers;else s.managedMcpServers=v;return I}function wq(s){if(!s||typeof s!=="object")return;let c=s.source;if(!c||typeof c!=="object")return;let T=c.source;return typeof T==="string"?T:void 0}function Pq(s){if(!s||typeof s!=="object")return!1;let c=s.source;if(!c||typeof c!=="object")return!1;let T=c.plugins;return Array.isArray(T)&&T.some(Sd)}function Nq(s,c){if(!s||typeof s!=="object")return[];let T=s,I="extraKnownMarketplaces";if(!(I in T))return[];let v=T[I];if(!v||typeof v!=="object"||Array.isArray(v)){let re=Mn(v);return delete T[I],[{file:c,path:I,message:`"${I}" must be an object mapping marketplace names to declarations; received ${re}. This field was ignored.`,severity:"warning",invalidValue:re}]}let U=v,oe=[];for(let re of Object.keys(U)){let le=wd().safeParse(U[re]),ye,Re=!1;if(!le.success){let Ie=wq(U[re]);if(Ie!==void 0&&!ph.has(Ie)||Pq(U[re]))continue;ye=qa(le.error.issues)}else if(le.data.source.source==="settings"&&le.data.source.name!==re)ye=`key "${to(re)}" must match the settings source name "${to(le.data.source.name)}"`;if(ye!==void 0)oe.push({file:c,path:`${I}.${to(re)}`,message:Re?"Marketplace entry was ignored: its name reads like an official Anthropic or Claude marketplace. It stays in this file: rename it (the key and the source's name) to use it, or delete it. If /plugin also shows a marketplace of this name as refused, remove that one in /plugin → Marketplaces once this entry is renamed or deleted.":`Invalid marketplace entry was ignored: ${ye}`,severity:"warning",...Re&&{preserveOnWrite:!0}}),delete U[re]}return oe}function xq(s,c){if(!s||typeof s!=="object")return[];let T=s,I="modelPicker";if(!(I in T))return[];let v=T[I];if(!r(v)||!Array.isArray(v.options)){let le=r(v)?`options: ${Mn(v.options)}`:Mn(v);return delete T[I],[{file:c,path:I,message:`"${I}" must be an object with an "options" array of { model, label?, description?, behavesAs? } rows; received ${le}. This field was ignored.`,severity:"warning",invalidValue:le}]}let U=[];if("replaceBuiltInOptions"in v&&typeof v.replaceBuiltInOptions!=="boolean"){let le=Mn(v.replaceBuiltInOptions);delete v.replaceBuiltInOptions,U.push({file:c,path:`${I}.replaceBuiltInOptions`,message:`"replaceBuiltInOptions" must be true or false; received ${le}. This entry was ignored (the rows are added to the built-in lineup).`,severity:"warning",invalidValue:le})}let oe=v.options,re=[];for(let le=0;le<oe.length;le++){let ye=xd().safeParse(oe[le]);if(ye.success){re.push(oe[le]);continue}U.push({file:c,path:`${I}.options.${le}`,message:`${vq(ye.error.issues[0])}. This row was ignored; the other rows still apply.`,severity:"warning",invalidValue:Mn(oe[le])})}if(re.length!==oe.length)v.options=re;return U}function kq(s,c){if(!s||typeof s!=="object"||Array.isArray(s))return[];let T=s;if(!("modelPricing"in T)||T.modelPricing===void 0)return[];let I=T.modelPricing;if(!I||typeof I!=="object"||Array.isArray(I))return delete T.modelPricing,[{file:c,path:"modelPricing",message:`"modelPricing" must be an object; received ${Mn(I)}. It was ignored.`,severity:"warning"}];let v=I,U=[];if(v.multiplier!==void 0&&!Nd().safeParse(v.multiplier).success)U.push({file:c,path:"modelPricing.multiplier",message:'"multiplier" must be a number greater than 0 and at most 10. It was ignored.',severity:"warning",invalidValue:v.multiplier}),delete v.multiplier;if(v.overrides!==void 0){let oe=v.overrides;if(!oe||typeof oe!=="object"||Array.isArray(oe))U.push({file:c,path:"modelPricing.overrides",message:`"overrides" must be an object mapping model ID to rates; received ${Mn(oe)}. It was ignored.`,severity:"warning"}),delete v.overrides;else{let re=oe;for(let le of Object.keys(re)){let ye=Pd().safeParse(re[le]);if(ye.success&&le!=="constructor"&&le!=="__proto__")continue;let Re=ye.success?void 0:ye.error.issues[0];U.push({file:c,path:`modelPricing.overrides.${to(le)}`,message:`Invalid pricing row was ignored (${Re?`${Re.path.join(".")||"row"}: ${Re.message}`:"not a model ID"}).`,severity:"warning",invalidValue:re[le]}),delete re[le]}}}return U}function vq(s){if(!s)return"Invalid modelPicker row";return`modelPicker row ${s.path.length>0?`"${s.path.join(".")}" `:""}${s.message}`.trim()}function Mq(s,c,T){if(!s||typeof s!=="object"||Array.isArray(s))return[];let I=s,v=I.crossSessionInbound;if(v===void 0||Uq(v))return[];if(T?.policySource)I.crossSessionInbound="refuse";else delete I.crossSessionInbound;return[Bq(v,c,T?.policySource===!0)]}function Uq(s){return typeof s==="string"&&pi.includes(s)}var Hq="crossSessionInbound";function Fq(s){let c=pi.map((I)=>`"${I}"`).join(", "),T=typeof s==="string"?`"${to(s).replace(/^<key>$/,"<value>")}"`:Mn(s);return`must be one of ${c}; received ${T}`}function Bq(s,c,T=!1){let I=pi.map((U)=>`"${U}"`).join(", "),v=T?'In managed settings an unrecognized value is treated as "refuse" (the most restrictive): cross-session messages to this session are turned away until an administrator fixes it.':"This value was ignored; while it is present, cross-session messages are held for your approval instead of being delivered. Set it to one of the values above.";return{file:c,path:Hq,message:`"crossSessionInbound" ${Fq(s)}. ${v}`,severity:"warning",expected:I,...T&&{statusOnly:!0}}}function zq(s,c,T){if(!r(s))return[];let I=s.teammateMode;if(I===void 0||Qs.some((le)=>le===I))return[];let v=T?.policySource===!0;if(!v)delete s.teammateMode;let U=Qs.map((le)=>`"${le}"`).join(", "),oe=typeof I==="string"?`"${to(I).replace(/^<key>$/,"<value>")}"`:Mn(I);return[{file:c,path:"teammateMode",message:`"teammateMode" must be one of ${U}; received ${oe}. ${v?'In managed settings this value is ignored and teammates use the mode from other settings or the default ("in-process").':'This value is ignored and teammates use the mode from your other settings or the default ("in-process"); change it to one of the values above.'}`,severity:"warning",expected:U,...v?{statusOnly:!0}:{unattendedSafe:!0}}]}var Zy="remoteControl.shareHostProfile";function Gq(s,c,T){if(!r(s)||s.remoteControl===void 0)return[];let I=T?.policySource===!0,v=il.map((Le)=>`"${Le}"`).join(", "),U=I?'In managed settings this is treated as "off" (the most restrictive): Remote Control environments report nothing about this machine until an administrator fixes it.':"While it is present, Remote Control environments report nothing about this machine.",oe=(Le)=>({file:c,path:Zy,message:`${Le}. ${U}`,severity:"warning",expected:v,...I?{statusOnly:!0}:{preserveOnWrite:!0}}),re=(Le)=>typeof Le==="string"?`"${to(Le).replace(/^<key>$/,"<value>")}"`:Mn(Le),le=s.remoteControl;if(!r(le)){if(I)s.remoteControl={shareHostProfile:"off"};else delete s.remoteControl;return[oe(`"remoteControl" must be an object like { "shareHostProfile": ${v.replace(/, /g," | ")} }; received ${re(le)}`)]}let ye=[],Re=Object.keys(le).filter((Le)=>Le!=="shareHostProfile");if(Re.length>0){if(I)le.shareHostProfile="off";ye.push(oe(`"remoteControl" has an unrecognized key ${Re.map((Le)=>`"${to(Le)}"`).join(", ")} (its only key is "shareHostProfile")`))}let Ie=le.shareHostProfile;if(Ie!==void 0&&!(typeof Ie==="string"&&il.includes(Ie))){if(I)le.shareHostProfile="off";else delete le.shareHostProfile;ye.push(oe(`"${Zy}" must be one of ${v}; received ${re(Ie)}`))}return ye}var Wq=["enabledMcpjsonServers","disabledMcpjsonServers"],Kq=/^[A-Za-z0-9_-]+$/;function jq(s){if(!r(s))return;for(let c of Wq){let T=s[c];if(typeof T==="string"&&Kq.test(T))s[c]=[T]}}function Ai(s,c,T){let I=[...BS(s,c)];if(Dq(s),!T?.policySource)jq(s);return I.push(...yq(s,c,{policySource:T?.policySource,strictParseFollows:T?.mcpServerEntrySalvageOnly}),...Aq(s,c),...Nq(s,c),...xq(s,c),...kq(s,c),...Mq(s,c,{policySource:T?.policySource}),...Gq(s,c,{policySource:T?.policySource}),...zq(s,c,{policySource:T?.policySource}),...T?.skipMcpServerEntryFilter?[]:Rq(s,c,{keepWholeFieldInvalid:T?.mcpServerEntrySalvageOnly}),...T?.mcpServerEntrySalvageOnly?Iq(s,c):[],...T?.mcpServerEntrySalvageOnly?Lq(s,c,T.marketplacePatternIndexMapOut):[]),I}function Cu(s){let c=new Set(s.allowedSources);return c.add("flagSettings"),c.add("policySettings"),bn.filter((T)=>c.has(T))}function Xq(){return En(Go(),"managed-settings.json")}function eO(s){return s.map((c)=>{let{invalidValue:T}=c,I=T!==void 0&&T!==null,v=I?wt(T):void 0,U=v===void 0?void 0:k(v);return{...c,path:k(c.path),message:k(c.message),...c.expected!==void 0&&{expected:k(c.expected)},...c.suggestion!==void 0&&{suggestion:k(c.suggestion)},...I&&(v===void 0||typeof T==="string"||U!==v)&&{invalidValue:U}}})}function kl(s){if(s.diskless)return{settings:null,errors:[],documentHasPolicyContent:!1,loadState:"absent"};if(la(s))return Ss(s.parentManaged??{},Su);let c,T=(rt)=>{if(rt===yO)return!0;return c??=s.asksOrganization?.()===!0,c&&rt()},I=!1,v={},U=new Set,oe=nO(s,(rt,ct,pt)=>{if(rt.settings===null){if(!T(pt))return rt;return ht.forEach((bt)=>U.add(bt)),{...rt,errors:eO(rt.errors)}}if(!T(pt))return Object.assign(v,Wo(rt.settings,Yo)),rt;return I=!0,{...rt,settings:{},errors:eO(rt.errors)}});if(!I)return U.size===0?oe:{...oe,lostSignInPins:[...U]};let re=[],le=[],ye=nO(s,(rt,ct,pt)=>{if(rt.settings===null||!T(pt))return{...rt,settings:rt.settings&&{},errors:[]};let bt=Jq(rt,rt.settings,ct);for(let Nt of ht)if(rt.settings[Nt]!==void 0&&bt.settings?.[Nt]===void 0)U.add(Nt);return re.push([ct,Object.keys(bt.settings??{})]),le.push(...bt.errors.slice(rt.errors.length)),bt}),Re=[...oe.errors,...le],Ie=oe.settings??{},Le=ye.settings??{},Ze=!_s({...oe,settings:Ie})&&{heldOnly:!0};if(Object.keys(Le).length===0)return{...oe,errors:Re,...Ze,lostSignInPins:[...U]};let $e=Object.keys(Ie).length===0,dt={...$e?Le:Fn(Ll([Ie,Le],"merge",!1,0).admin,"parentSettingsBehavior"),...Wo(Ie,"parentSettingsBehavior"),...v},Me=dt,nt=Ie;for(let[rt,ct]of re)for(let pt of ct)if(pt in nt&&Qn(Me[pt],nt[pt]))Re.push({file:rt,path:k(pt),message:`In a cloud session that takes its managed settings from your organization, a managed settings file may only restrict: "${k(pt)}" was ignored in ${k(rt)}, since another managed settings document sets it and this one adds nothing to it.`,severity:"warning",statusOnly:!0,userWritable:!0});return{...$e?ye:oe,settings:dt,errors:Re,...Ze,lostSignInPins:[...U],...!Cs(Ie)&&{onlyHeldContent:!0},settingsNotHeld:Ie,heldOffPlugins:Object.keys(Le.enabledPlugins??{}).filter((rt)=>Ie.enabledPlugins?.[rt]===void 0),heldAllowLists:Pu.filter((rt)=>Le[rt]!==void 0&&Ie[rt]===void 0)}}function Jq(s,c,T){let I=Ey(c),v=Zq(c,I).map((U)=>({...U,key:k(U.key)}));if(v.length===0)return s;if(!tO.has(T))tO.add(T),t(`${k(T)}: not taken as written: ${v.map(({key:U})=>U).join(", ")}: this session takes its managed settings from its organization, and a managed settings file may only restrict there`,{level:"warn"});return{...s,settings:I,errors:[...s.errors,...v.filter(({key:U})=>!Jo(U)).map(({key:U,became:oe})=>({file:T,path:U,message:`In a cloud session that takes its managed settings from your organization, a managed settings file may only restrict: "${U}" ${oe} in ${k(T)}.`,severity:"warning",statusOnly:!0,userWritable:!0}))]}}function Zq(s,c){let T=(I,v)=>v==="disableAllHooks"&&s.disableAllHooks===!0&&c.allowManagedHooksOnly===!0?'was taken as "allowManagedHooksOnly"':v==="allowManagedHooksOnly"&&I===!0?'was set by "disableAllHooks"':I===void 0?"was ignored":"was kept in part";return Object.keys(s).flatMap((I)=>{let v=s[I],U=c[I];if(Qn(v,U))return[];if(!r(v)||!r(U))return[{key:I,became:T(U,I)}];return Object.keys(v).filter((oe)=>!Qn(v[oe],U[oe])).map((oe)=>({key:`${I}.${oe}`,became:T(U[oe],I)}))})}function SO(s){return g()==="wsl"&&(!s||iu())}var tO=d(new Set,(s)=>s.clear());function nO(s,c){let T=s.mdm?.()?.heldDocuments??[];if(SO(s.asksOrganization?.()===!0)){let I=oo(vl({...s,file:()=>({settings:null,errors:[]})}));if(s.wslInherits?.()){let v=T.length===0?void 0:I||oo(Ci(Hn,s.store)),U=Ci(Hn,s.store,c,v?T:[]);if(v??(oo(U)||I))return U;let oe=Ci(Go(),s.store,c,T);return{...oe,errors:[...U.errors,...oe.errors],loadState:ho(U.loadState,oe.loadState)}}if(I)return Ci(null,s.store,c,T)}return Ci(Go(),s.store,c,T)}var yO=()=>!0;function _u(s,c,T){T.push(...c.errors);let{settings:I}=c;if(!I||Object.keys(I).length===0)return;for(let[v,U]of pl){let oe=v.split(".");if(Yt(I,oe)===void 0)continue;let re=c.errors.find((Re)=>Re.substituted&&Re.path===v),le=re!==void 0,ye=Yt(s.merged,oe);if(le&&ye!==void 0&&!s.floors.has(v)){let Re=oe.at(-1);if(U.inert.has(U.read(ye))){Yg(I,oe),T.push({file:re.file,path:v,message:`That substitute is not applied: "${Re}" keeps the value an earlier managed-settings document of this folder wrote.`,severity:"warning",statusOnly:!0});continue}T.push({file:re.file,path:v,message:`That substitute also displaces the wider "${Re}" an earlier managed-settings document of this folder wrote, until this document is fixed.`,severity:"warning",statusOnly:!0})}if(le)s.floors.add(v);else s.floors.delete(v)}if(s.merged=kn(s.merged,I,no),s.found=!0,Cs(I)&&!c.errors.some((v)=>v.onlySubstitutes))s.authored=!0}function bu(s){return s.endsWith(".json")&&!s.startsWith(".")}function qq(s){return(s.isFile()||s.isSymbolicLink())&&bu(s.name)}function oO(s,c,T,I){let v=s.managedFileProtections,U={file:I,folder:s.managedDocumentLinks.folderIsLink.get(c)===!1?v.folderOwners.get(c):void 0,posix:g()!=="windows"&&!T.startsWith(Hn)};return v.note(T,Wt({...U,linked:s.managedDocumentLinks.isLinked(T)})),()=>Ru(s,T,U.file,U.folder)}function Ru(s,c,T,I){let v=process.geteuid?.(),U=process.getuid?.();if(SO(!0)&&(c===Po||c.startsWith(`${Hn}${Yq}`)))return rO;if(v===0||U===0)return!0;if(g()==="windows"||v===void 0)return rO;let re=s.managedDocumentLinks.linkOf(c),le=Dm(v,U);if(Tc(le,T,re===null?I:T)!==!1||re?.kind==="unverified")return!0;let Re=s.policy.writableNow??=new Map,Ie=Re.get(c)??Rc(c);if(Re.set(c,Ie),Ie!=="no")return!0;let Le=s.policy.walkedDocuments??=new Map,Ze=Le.get(c)??Lm(c,le,s.policy.certainDirectories??=new Map);return Le.set(c,Ze),Ze}var rO=!1;function sO(s,c,T,I,v){let U=s.managedDocumentLinks;U.noteWalked(En(c,...T),!I.errors.some((oe)=>oe.errorClass==="unreadable"),()=>Om(c,T,v,U.folderIsLink,s.managedFileProtections.folderOwners))}function Ci(s,c,T=(v)=>v,I=[]){let v=[],U={merged:{},found:!1,authored:!1,floors:new Set},oe=!1,re="absent";for(let{path:Ie,parsed:Le}of I)_u(U,T(Le,Ie,yO),v),oe||=Es(Le),re=ho(re,Io(Le));if(s===null)return iO(U,v,oe,re,c);let le=hs(En(s,"managed-settings.json"),c,void 0,!0),ye=()=>!1;if(Io(le)!=="absent")sO(c,s,["managed-settings.json"],le),ye=oO(c,fn(s),En(s,"managed-settings.json"),le.fileOwner);_u(U,T(le,En(s,"managed-settings.json"),ye),v),oe||=Es(le),re=ho(re,Io(le));let Re=En(s,"managed-settings.d");try{let Ie=c.folderListingForPolicyWalk(Re),Le,Ze,$e=c.frozenFolderMembership(Re),dt=void 0,Me;if(Ie!==void 0)Le=Ie;else{let nt;try{nt=a().readdirSync(Re).filter(qq)}catch(rt){if($e===void 0)throw rt;dt=rt,nt=[]}if(Le=nt.map((rt)=>rt.name).sort(),Me=new Set(Le),Ze=new Set(nt.filter((rt)=>!rt.isFile()).map((rt)=>rt.name)),dt===void 0)c.noteRawFolderListing(Re,Le),c.noteWalkListing(Re,Le)}if($e!==void 0)Le=u([...Le,...$e]).sort();c.noteFolderListed(Re,Le);for(let nt of Le){let rt=hs(En(Re,nt),c,void 0,!0),ct=()=>!1;if(Io(rt)!=="absent")sO(c,s,["managed-settings.d",nt],rt,Me?.has(nt)===!0?Ze?.has(nt):void 0),ct=oO(c,Re,En(Re,nt),rt.fileOwner);_u(U,T(rt,En(Re,nt),ct),v),oe||=Es(rt),re=ho(re,Io(rt))}if(dt!==void 0)throw dt}catch(Ie){let Le=n(Ie),Ze=Le==="ENOENT"||Le==="ENOTDIR";if(c.noteFolderListed(Re,Ze?[]:"failed"),c.noteRawFolderListing(Re,Ze?"absent":"failed"),!Ze)t(`managed-settings.d read failed: ${Ie}`,{level:"error"}),v.push(Ti(Re,Ie,"directory")),re="didNotLoad",T({settings:null,errors:[]},Re,()=>!0)}return iO(U,v,oe,re,c)}function iO(s,c,T,I,v){let U=s.found&&As(s.merged)?s.merged:null;if(U?.forceLoginOrgUUID!==void 0)v.managedFileProtections.setsOrgPin=!0;return{settings:U,errors:c,documentHasPolicyContent:T,loadState:I,...U!==null&&!s.authored&&Cs(U)&&{onlySubstitutes:!0}}}function Qq(s,c){if(h(s))lQ(c);else t(k(`settings file read failed at ${c}: ${s}`),{level:"error"})}function hs(s,c,T,I){let v=T!==void 0?`${s}\x00pinned`:s,U=c.parsedFiles.get(v);if(U)return{...U,settings:U.settings?M(U.settings):null};let oe,re=sQ(s,T,I,({ino:le,size:ye,mtimeMs:Re,ctimeMs:Ie})=>{oe={ino:le,size:ye,mtimeMs:Re,ctimeMs:Ie}});if(T===void 0&&re.loadState==="absent")oe??=null;if(oe!==void 0)c.noteFirstRead(s,oe);if(T===void 0)c.noteReadFromDisk(s,re.settings!==null&&!!oe?.size),c.noteRead(s,re,I===!0);return c.parsedFiles.set(v,re),{...re,settings:re.settings?M(re.settings):null}}function vl(s){let c=s.mdm?.();if(!c)return{settings:null,errors:[],documentHasPolicyContent:!1,loadState:"absent"};return{settings:c.settings&&Object.keys(c.settings).length>0?c.settings:null,errors:uQ(c,()=>Tu(s),()=>s.file?.()??kl(s)),documentHasPolicyContent:Es(c),loadState:Io(c),...c.onlySubstitutes&&{onlySubstitutes:c.onlySubstitutes}}}function Ss(s,c){let T=lO.get(s),I=T?.get(c);if(I)return aO(I);let v=eQ(s,c);if(T)T.set(c,v);else lO.set(s,new Map([[c,v]]));return aO(v)}function aO(s){return{settings:s.settings&&M(s.settings),errors:s.errors.map((c)=>({...c})),documentHasPolicyContent:s.documentHasPolicyContent,loadState:s.loadState,removed:s.removed,...s.onlySubstitutes&&{onlySubstitutes:s.onlySubstitutes}}}var lO=new WeakMap;function eQ(s,c){let T=M(s),I=Ai(T,c,{skipMcpServerEntryFilter:!0,policySource:!0}),v=[],U=Wd(bO(c,v),c,T).safeParse(T);if(!U.success)return{settings:null,errors:[...I,...Oi(U.error,c)],documentHasPolicyContent:!1,loadState:"didNotLoad",removed:[]};let oe=[...MO(I,U.data,v),...v],re=s,le=Object.keys(U.data).length>0?U.data:null;return{settings:le,errors:oe,documentHasPolicyContent:HO(s,U.data),loadState:"loaded",removed:Object.keys(re).filter((ye)=>OO(ye,re[ye])&&U.data[ye]===void 0&&oe.every((Re)=>Re.statusOnly||Re.path!==ye&&!Re.path.startsWith(`${ye}.`))),...le!==null&&v.some((ye)=>ye.onlySubstitutes)&&{onlySubstitutes:!0}}}function OO(s,c){let T=ul();return T.includes(s)||fs.some(({alias:I,canonical:v})=>I===s&&T.includes(v))?Gd(s,c):fl(s)&&AO(s,c)}function AO(s,c){return c===null||r(c)&&Object.keys(c).length>0&&Object.entries(c).every(([T,I])=>{let v=`${s}.${T}`;return Gd(v,I)||fl(v)&&AO(v,I)})}function Jo(s){return Dc()&&(s==="managedMcpServers"||s.startsWith("managedMcpServers."))}var Ml=["managedMcpServers","isolation","attributionProjectPolicy"],tQ=[...Ml,"deniedModels","availableModelsMatch"];function CO(s,c){if(!r(s))return[];let T=[];for(let I of tQ){if(!(I in s))continue;if(delete s[I],!Jo(I))T.push({file:c,path:I,message:`"${I}" is only honored from managed settings and was ignored here.`,severity:"warning",preserveOnWrite:!0})}return T}function bO(s,c){return(T)=>{if(Jo(T.path))return;if(c.push({file:s,path:T.path,message:T.message,severity:"warning",...T.statusOnly&&{statusOnly:T.statusOnly},...T.startupFatal&&{startupFatal:T.startupFatal},...T.substituted&&{substituted:T.substituted},...T.onlySubstitutes&&{onlySubstitutes:T.onlySubstitutes},...T.removal&&{removal:T.removal}}),T.statusOnly||T.startupFatal)t(k(`${s}: ${T.path}: ${T.message}`),{level:T.startupFatal?"error":"warn"})}}function Tu(s){let c=s?.remote?s.remote():by((ye)=>Ss(ye,"remote managed settings").settings),T=!s?.remote&&!Jo("managedMcpServers")&&yy()?[{file:"remote managed settings",path:"managedMcpServers",message:"The organization's MCP servers in the cached remote settings are withheld until the server confirms them this session; they connect as soon as it does.",severity:"warning",statusOnly:!0}]:[],I=s?.remote?void 0:fy(),v=(I?.state==="stale_cache"||I?.state==="failed")&&I.failure.errorKind==="ruled_empty"?gu(I.failure.rulings??[]):[];if(!c||Object.keys(c).length===0)return{settings:null,errors:[...T,...v],servedSnapshot:!1,documentHasPolicyContent:!1};let{settings:U,errors:oe,documentHasPolicyContent:re,onlySubstitutes:le}=Ss(c,"remote managed settings");return{settings:U,errors:[...T,...v,...gu(oe)],servedSnapshot:my(c),documentHasPolicyContent:re,...le&&{onlySubstitutes:le}}}var Su="parent managed settings";function nQ(s){let c=s.parentManaged;if(!c||Object.keys(c).length===0)return{settings:null,errors:[]};let T=Ss(c,Su);for(let I of Ml)if(T.settings?.[I]!==void 0&&!Jo(I))T.errors.push({file:Su,path:I,message:`"${I}" is only honored from the organization's managed settings sources (server-managed, MDM, managed-settings.json), not from settings a host passes in, and was ignored here.`,severity:"warning",statusOnly:!0});return T}function oQ(s){return null}function RO(s){let c=s.flagInline;if(!c)return{settings:null,errors:[]};let T=Dc(),I=s.store.inlineFlagParse;if(I?.inline!==c||I.desktopSupplied!==T)I={inline:c,desktopSupplied:T,parsed:rQ(c)},s.store.inlineFlagParse=I;let{settings:v,errors:U}=I.parsed;return{settings:v&&M(v),errors:U.map((oe)=>({...oe}))}}function rQ(s){let c=M(s),T=[...CO(c,"SDK inline settings"),...Ai(c,"SDK inline settings")],I=dl(c).safeParse(c);if(!I.success)return{settings:null,errors:[...T,...Oi(I.error,"SDK inline settings")]};if(T.some((v)=>v.severity==="fatal"))return{settings:null,errors:T};return{settings:I.data,errors:T}}var Ri=2097152;function sQ(s,c,T,I){try{let v;if(c!==void 0)v=c;else{let U=T||iQ(s)?fe(a(),s):We(a(),s);if(T){let oe={};v=Bo(U.resolvedPath,Ri,(le)=>{oe.owner={uid:le.uid,gid:le.gid,mode:le.mode},I?.(le)});let re=wl(v,s,T);return oe.owner?{...re,fileOwner:oe.owner}:re}v=Bo(U.resolvedPath,Ri,I)}return wl(v,s,T)}catch(v){return dQ(v,s)}}function wl(s,c,T){if(s.trim()==="")return{settings:{},errors:[],loadState:"loaded"};let I=er(s,!1);if(T){if(!r(I))return{settings:null,errors:[Ul(c)],loadState:"didNotLoad"};let re=M(I),le=Ai(re,c,{skipMcpServerEntryFilter:!0,policySource:!0}),ye=[],Re=Wd(bO(c,ye),c,re).safeParse(re);if(!Re.success)return{settings:null,errors:[...le,...Oi(Re.error,c)],documentHasPolicyContent:!1,loadState:"didNotLoad"};return{settings:Re.data,errors:[...MO(le,Re.data,ye),...ye],documentHasPolicyContent:HO(I,Re.data),loadState:"loaded"}}let v=M(I),U=[...CO(v,c),...Ai(v,c)],oe=dl(v).safeParse(v);if(!oe.success){let re=Oi(oe.error,c);return{settings:null,errors:[...U,...re]}}if(U.some((re)=>re.severity==="fatal"))return{settings:null,errors:U};return{settings:oe.data,errors:U}}function Ul(s,{userWritable:c=!1}={}){return c?{file:s,path:"",message:`Managed settings document (${s}) could not be parsed as a JSON object; none of its settings are in effect. Fix or remove it.`,severity:"warning",statusOnly:!0,userWritable:!0}:{file:s,path:"",message:"Managed settings document could not be parsed as a JSON object; none of its settings are in effect. Fix or remove it.",startupFatal:!0}}function iQ(s){let c=ke();if(c===null)return!1;let T=_(xl(fn(s))),I=fn(c);return T===_(I)||T===aQ(I)}var Eu;function aQ(s){if(Eu?.lexical!==s){let c=xl(s);Eu={lexical:s,physical:_(En(Je(c)??c,Vq(s)))}}return Eu.physical}function lQ(s){t(k(`Broken symlink or missing file encountered for settings.json at path: ${s}`))}function cQ(){return{settings:null,errors:[],loadState:"absent"}}function dQ(s,c){if(Xt(s))throw s;if(Qq(s,c),h(s))return cQ();return{settings:null,errors:[Ti(c,s)],loadState:"didNotLoad"}}function Ti(s,c,T="file"){return{file:s,path:"",message:`${T==="directory"?"Managed settings drop-in directory":"Settings file"} could not be read: ${c instanceof Error?c.message:String(c)}`,severity:"fatal",errorClass:"unreadable",...n(c)!==void 0&&{errno:n(c)}}}function TO(s){return{file:s,path:"wslInheritsWindowsSettings",message:`"wslInheritsWindowsSettings" in ${s} holds a value that cannot be read (it takes true or false) and no Windows administrator policy is deployed beside it (HKLM or ${Hn}), so whether WSL inherits Windows policy is unknown: no Windows or managed-file policy is in effect (/etc/claude-code is not read beneath it), and unless server-managed settings supply the policy — they apply regardless — sign-in and policy enforcement fail closed until the flag is fixed.`,severity:"fatal",statusOnly:!0}}function cO(s){return s.path==="wslInheritsWindowsSettings"&&s.severity==="fatal"}function uQ(s,c,T){let I=s.withheldFlagRecord&&T().heldOnly===!0?[...s.errors,s.withheldFlagRecord]:s.errors;if(!I.some(cO))return I;if(!_s(c()))return I;return I.map((v)=>cO(v)?{...v,severity:"warning"}:v)}function DO(s){return}function yu(s,c){let T=DO(s);if(T!==void 0)return T;switch(s){case"userSettings":return fn(C());case"policySettings":return fn(Tl(c));case"projectSettings":return fn(c.projectConfigDir??Tl(c));case"localSettings":{if(c.launchsLocalSettingsStoreRoot!==void 0)return c.launchsLocalSettingsStoreRoot;if(c.projectConfigDir!==void 0)return fn(c.projectConfigDir);return IO(Tl(c),c.canonicalGitRoot)}case"flagSettings":return c.flagPath?xl(fn(c.flagPath)):fn(Tl(c))}}function LO(s){if(s.launchsLocalSettingsStoreRoot!==void 0){let c=s.projectConfigDir??s.cwd;return c!==null&&s.launchsLocalSettingsStoreRoot!==fn(c)?fn(c):null}if(s.projectConfigDir!==void 0||s.cwd===null)return null;return IO(s.cwd,s.canonicalGitRoot)!==fn(s.cwd)?fn(s.cwd):null}function Tl(s){if(s.cwd===null)throw new Fe;return s.cwd}function IO(s,c){let T=pQ(s,c);if(T.decided!==void 0)return T.decided;if(!_Q(T.root))return T.cwdResolved;return T.root}function pQ(s,c){let T=c?.(s);if(!T)return{decided:fn(s)};let I=fn(T),v=fn(s);if(I===v)return{decided:I};let U;try{U=EQ()}catch{return{decided:v}}if(I===U)return{decided:v};return{decided:void 0,root:I,cwdResolved:v}}function fQ(s){return ie().localStoreProbes.canonicalRootOwnerUids(s,mQ)}function mQ(s){let c=a(),T=null;try{T=c.lstatSync(En(s,".claude")).uid}catch(I){if(!h(I))throw I}return{rootUid:c.statSync(s).uid,gitEntryUid:gQ(s),claudeEntryUid:T}}function gQ(s){let c=a();try{return c.lstatSync(En(s,".git")).uid}catch(T){throw T}}function _Q(s){if(typeof process.getuid!=="function"&&typeof process.geteuid!=="function")return t(`localSettings: not canonicalizing the consent store to ${s} — this platform has no uid semantics to verify directory ownership with, so the store stays at the session cwd (canonicalization is POSIX-only)`,{level:"warn"}),!1;let c=typeof process.geteuid==="function"?process.geteuid():process.getuid?.();try{let{rootUid:T,gitEntryUid:I,claudeEntryUid:v}=fQ(s);if(T===c&&I===c&&(v===null||v===c))return!0;return t(`localSettings: not canonicalizing the consent store to ${s} — it (uid ${T}), its .git entry (uid ${I}), or its .claude entry (uid ${v??"absent"}) is not owned by the current user (uid ${c}); the store stays at the session cwd (the pre-canonicalization behavior). If you own this repo, chown it (including .git and .claude) or run from a directory you own.`,{level:"warn"}),!1}catch(T){return t(`localSettings: not canonicalizing the consent store to ${s} — its ownership could not be verified (${T instanceof Error?T.message:String(T)}); the store stays at the session cwd`,{level:"warn"}),!1}}function EQ(){return ie().localStoreProbes.normalizedRealHomeDir(hQ)}function hQ(){let s=Je($q());if(s===null)throw Error("home directory realpath unavailable");return _(s)}var dO={default:"settings.json",cowork:"cowork_settings.json"};function SQ(s){if(s.coworkPlugins||mn.CLAUDE_CODE_USE_COWORK_PLUGINS)return dO.cowork;return dO.default}function ys(s,c){switch(s){case"userSettings":return En(yu(s,c),SQ(c));case"projectSettings":case"localSettings":{if(c.diskless||c.cwd===null&&c.projectConfigDir===void 0)return;let T=yu(s,c),I=En(T,Pl(s));if(Du(c)&&Si(T)&&bl(T))return;return I}case"policySettings":return Xq();case"flagSettings":return c.flagPath}}function Pl(s){switch(s){case"projectSettings":return En(".claude","settings.json");case"localSettings":return En(".claude","settings.local.json")}}function wO(s){if(s.diskless||DO("localSettings")!==void 0)return;let c=LO(s);if(c===null||Du(s))return;return En(c,Pl("localSettings"))}function Du(s){let c=s.projectConfigDir??s.cwd;return c!==null&&Si(fn(c))&&bl(fn(c))}function yQ(s,c){if(s!=="projectSettings"&&s!=="localSettings"||c.diskless||c.cwd===null&&c.projectConfigDir===void 0)return[];if(!Du(c))return[];let T=[],I=yu(s,c),v=En(I,Pl(s));if(Si(I)&&bl(I))T.push(v);let U=s==="localSettings"?LO(c):null;if(U!==null&&Si(U))T.push(En(U,Pl("localSettings")));return T}var OQ=" is not used: it is in a connector-downloads folder, where Claude Code saves files from claude.ai connectors, so no settings are taken from it. To use it, move or rename the folder named connector-downloads.";function AQ(s){return{file:s,path:"",message:`${k(s)}${OQ}`,severity:"fatal",statusOnly:!0}}function CQ(s,c){let T=c.repoTierFreeze.tier(s);if(T!==void 0)return T.settings;return c.perSource.get(s)}function PO(s,c){let T=CQ(s,c.store);if(T!==void 0)return T;let I=tee(s,c),v=I&&bi(s,I,c);return c.store.perSource.set(s,v),v}function NO(s){return(s.parentSettingsBehavior??(zs()?"merge":"first-wins"))==="merge"}function bQ(s,c=!1){return!s||NO(s)||c}var RQ=[["permissions","defaultMode"],["modelPicker","replaceBuiltInOptions"]];function TQ(s){let c={};for(let{path:T,restrictive:I}of Eo()){let v=Yt(s,T);if(T[0]==="sandbox"&&tr(I).includes(v))yn(c,T,v)}return c.sandbox??{}}function xO(s){let c=s?.disableAllHooks;return c!==void 0&&c!==null&&c!==!1&&c!=="false"}var Lu=["disableRemoteControl","disableAgentView","disableWorkflows","disableArtifact"],Iu=["enableWorkflows","enableArtifact"],DQ=new Set([...Lu,...Iu]);function Ou(s,c,T,I){let v={};if(s.allowManagedHooksOnly===!0||s.disableAllHooks===!0||xO(T))v.allowManagedHooksOnly=!0;if(s.disableSkillShellExecution===!0)v.disableSkillShellExecution=!0;for(let re of Lu)if(s[re]===!0)v[re]=!0;for(let re of Iu)if(s[re]===!1)v[re]=!1;if(c.hooks===void 0&&!Object.values(c.enabledPlugins??{}).some((re)=>re!==!1&&re!==void 0)){if(s.allowedHttpHookUrls?.length===0)v.allowedHttpHookUrls=[];if(s.httpHookAllowedEnvVars?.length===0)v.httpHookAllowedEnvVars=[]}if(s.disableCommandPluginSources===!0)v.disableCommandPluginSources=!0;if(s.disableSideloadFlags===!0)v.disableSideloadFlags=!0;if(s.disableWindowsBashCommandSplit===!0)v.disableWindowsBashCommandSplit=!0;if(s.allowManagedMcpServersOnly===!0)v.allowManagedMcpServersOnly=!0;if(s.disableClaudeAiConnectors===!0)v.disableClaudeAiConnectors=!0;if(s.syncClaudeAiSkills===!1)v.syncClaudeAiSkills=!1;if(s.syncClaudeAiPlugins===!1)v.syncClaudeAiPlugins=!1;if(s.remoteTools?.allowUnattendedServing===!1)v.remoteTools={...v.remoteTools,allowUnattendedServing:!1};if(s.allowManagedPermissionRulesOnly===!0)v.allowManagedPermissionRulesOnly=!0;if(s.disableAutoMode==="disable")v.disableAutoMode="disable";let U=s.remoteControl?.shareHostProfile;if(U==="off"||U==="basic")v.remoteControl={...v.remoteControl,shareHostProfile:U};if(vy(s.attribution,s.includeCoAuthoredBy)==="disabled")v.attribution={...v.attribution,commitTrailers:!1};if(s.attribution?.sessionUrl===!1)v.attribution={...v.attribution,sessionUrl:!1};let oe=s.strictPluginOnlyCustomization;if(oe===!0||Array.isArray(oe)&&oe.length>0)v.strictPluginOnlyCustomization=oe;if(s.deniedMcpServers)v.deniedMcpServers=s.deniedMcpServers;if(s.blockedMarketplaces?.length)v.blockedMarketplaces=s.blockedMarketplaces;if(s.deniedModels&&s.deniedModels.length>0)v.deniedModels=s.deniedModels;if(c.forceLoginOrgUUID===void 0&&s.forceLoginOrgUUID)v.forceLoginOrgUUID=s.forceLoginOrgUUID;for(let re of gs)if(c[re]===void 0&&s[re])Object.assign(v,{[re]:s[re]});if(s.enforceAvailableModels===!0)v.enforceAvailableModels=!0;if(s.availableModelsMatch==="exact")v.availableModelsMatch="exact";if(s.permissions){let re=Wo(s.permissions,["deny","ask"]);for(let le of["deny","ask"]){let ye=re[le];if(ye!==void 0)re[le]=ye.filter((Re)=>{if(!Ws.test(Re))return!0;return t(`Ignoring ${le} rule "${Re}" from the parent process's managed settings: a rule starting with "!" removes paths from the rules listed before it instead of restricting anything, so it is not merged into the policy rules. Spell the deny without the exception instead.`,{level:"warn"}),!1})}if(s.permissions.disableBypassPermissionsMode==="disable")re.disableBypassPermissionsMode="disable";if(s.permissions.disableAutoMode==="disable")re.disableAutoMode="disable";if(s.permissions.blockReadsOutsideWorkingDirectories===!0)re.blockReadsOutsideWorkingDirectories=!0;if(s.permissions.blockWritesOutsideWorkingDirectories===!0)re.blockWritesOutsideWorkingDirectories=!0;if(s.permissions.denyInsteadOfPrompting===!0)re.denyInsteadOfPrompting=!0;if(c.allowManagedPermissionRulesOnly!==!0){let{allow:le,additionalDirectories:ye}=s.permissions;if(le&&c.sandbox?.network?.allowManagedDomainsOnly!==!0)re.allow=le;if(ye)re.additionalDirectories=ye}if(Object.keys(re).length>0)v.permissions=re}if(s.sandbox){let{network:re,filesystem:le,credentials:ye}=s.sandbox,Re={},Ie=re?Wo(re,["deniedDomains"]):{},Le=le?Wo(le,["denyRead","denyWrite"]):{};if(re){if(c.sandbox?.network?.allowManagedDomainsOnly!==!0&&re.allowedDomains)Ie.allowedDomains=re.allowedDomains}if(Object.keys(Ie).length>0)Re.network=Ie;if(le){if(c.sandbox?.filesystem?.allowManagedReadPathsOnly!==!0&&le.allowRead)Le.allowRead=le.allowRead}if(Object.keys(Le).length>0)Re.filesystem=Le;if(ye){let Ze=(ye.files??[]).map((Me)=>Me.mode==="deny"?{path:Me.path,mode:"deny"}:{path:Me.path,mode:"mask",injectHosts:[]}),$e=(ye.envVars??[]).filter((Me)=>Me.mode==="deny").map((Me)=>({name:Me.name,mode:"deny"})),dt={...Ze.length>0&&{files:Ze},...$e.length>0&&{envVars:$e}};if(ye.sigv4){let Me={};for(let nt of["streaming","presigned","sigv4a"])if(ye.sigv4[nt]==="deny")Me[nt]="deny";dt.sigv4=Me}{let Me=kO(ye.awsPairs??[],[]);if(Me.length>0)dt.awsPairs=Me}if(Object.keys(dt).length>0)Re.credentials=dt}if(kn(Re,TQ(s)),Object.keys(Re).length>0)v.sandbox=Re}return v}function kO(s,c){let T=Ko,I=new Set(c.flatMap(uO));return u(s.flatMap(uO)).filter((v)=>T.includes(v)&&!I.has(v)).map((v,U)=>({accessKeyIdVar:v,secretAccessKeyVar:`${Ga}${U+1}_`}))}function uO(s){if(!r(s))return[];return[s.accessKeyIdVar,s.secretAccessKeyVar,s.sessionTokenVar].filter((c)=>typeof c==="string")}var LQ=new Set([...[...tu].filter((s)=>s!=="ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION"),...nu,"CLAUDE_CODE_AUTO_MODE_MODEL","CLAUDE_CODE_BG_CLASSIFIER_MODEL","CLAUDE_CODE_SUBAGENT_MODEL_FORCE"]);function IQ(s,c){if(!c||!s)return null;let T={};if(s.model!==void 0)T.model=s.model;if(s.availableModels!==void 0)T.availableModels=s.availableModels;if(s.availableModelsMatch==="exact"||s.availableModelsMatch!==void 0&&s.availableModels!==void 0)T.availableModelsMatch=s.availableModelsMatch;if(s.enforceAvailableModels!==void 0)T.enforceAvailableModels=s.enforceAvailableModels;if(s.deniedModels!==void 0&&s.deniedModels.length>0)T.deniedModels=s.deniedModels;if(s.fallbackModel!==void 0)T.fallbackModel=s.fallbackModel;if(s.modelPicker!==void 0)T.modelPicker=s.modelPicker;return Object.keys(T).length>0?T:null}function wQ(s){let c=[];for(let T of s?.deniedModels??[]){let{warning:I}=Ye(T);if(I!==void 0)c.push({file:"managed settings",path:"deniedModels",message:I,severity:"warning",statusOnly:!0})}return c}function PQ(s){if(s?.availableModelsMatch!=="exact")return[];let c=s.availableModels??[];return c.flatMap((T)=>{let I=ky(T,c);return I===void 0?[]:[{file:"managed settings",path:"availableModels",message:I,severity:"warning",statusOnly:!0}]})}function pO(s,c){let T=s.deniedModels;if(Object.assign(s,c),T!==void 0&&c.deniedModels!==void 0)s.deniedModels=u([...T,...c.deniedModels])}function Dl(s,c=!1){if(delete s.model,delete s.fallbackModel,delete s.modelPicker,delete s.modelOverrides,s.env){let T={};for(let[I,v]of Object.entries(s.env)){let U=I.toUpperCase();if(!LQ.has(U)||c&&U===xS)T[I]=v}s.env=T}}function NQ(s){let c=s.store.policy.allTiers;if(c!==void 0)return c;let T=WQ(s);return s.store.policy.allTiers=T,T}function pr(){return g()==="macos"?"plist":"hklm"}function vO(s){let c=Di(s);if(c.composes==="tier")return"helper";let T=Os(s);if(c.composes==="remoteSlot"||T.present.remote)return"remote";if(T.present.mdm)return pr();if(T.present.file)return"file";if(T.parentSlice||T.hostModelOverlay)return"parent";let I=s.hkcu?.();return I&&Object.keys(I.settings).length>0?"hkcu":null}function Os(s){let c=[],T=Tu(s),{settings:I,servedSnapshot:v}=T;c.push(...T.errors);let U=Di(s),oe=U.composes==="remoteSlot"?U.helper:Il(I),re=vl(s),le=re.settings;c.push(...re.errors);let ye=Il(le),Re=s.file?.()??kl(s),Ie=Re.settings;c.push(...Re.errors);let Le=Il(Ie),Ze=_s(re),$e=_s(Re),dt=$e&&Re.heldOnly===!0,Me=s.policyOnlyServerTier?.()==="unconfirmed"&&(Ze&&s.mdm?.().userWritable!==!0||$e),nt=Me&&oe?MQ(oe):oe,rt=!Me&&(U.composes==="remoteSlot"?nt!==null:_s(T)),ct=hu(nt,rt),pt=hu(ye,Ze),bt=Re.onlyHeldContent?UO:hu(Le,$e),Nt=!Me&&nt!==null&&ct>=Math.max(pt,bt),Ct=ye!==null&&pt>=bt,Ut=[[Me?null:I,Nt],[le,Ct],[Ie,Le!==null]],In=(U.composes==="remoteSlot"?U.helper:Ut.find(([It,gn])=>It!==null&&(It===I&&v?gn:It.managedSourcesBehavior!==void 0||gn))?.[0])?.managedSourcesBehavior,qe=Me?nt:null,Ve=nt!==null&&!Nt,ut=Ve?null:nt,Et=ye!==null&&!Ct&&ut===null,yt=Et?null:ye,Pt=[],Tt=[[Ve,"remote",nt],[Et,pr(),ye]];for(let[It,gn,Un]of Tt){if(!It||Un===null)continue;if(Pt.push([Un,gn]),!Cs(Un)||Un===qe)continue;let wo=gn==="remote"&&Ze?pr():"file";c.push({file:ur[gn],path:Object.keys(Un).find((Er)=>!Yo.includes(Er))??"",message:`${ur[gn]} holds only values that could not be applied as written, so ${ur[wo]} supplies the managed settings while that fail-closed reading still binds beside it (the most restrictive value of each such key applies), until it is fixed.`,severity:"warning",statusOnly:!0})}let{settings:Mt,errors:jn}=nQ(s);c.push(...jn);let So=oQ(s);c.push(...So?.errors??[]);let Dn=So?.settings??Mt,Pn=ut!==null&&v&&U.composes!=="remoteSlot",ro=!(ut!==null&&rt&&!Pn)&&!(yt!==null&&Ze),so=ro&&(!$e||dt),Wn=so&&dt,Kt=Wn&&Dn&&Le?Fn(Le,gs.filter((It)=>Dn[It]!==void 0)):Le,io=(Ze?yt:null)??($e?Le:null),pA=Dn!==null&&(io===null||NO(io)||Wn),xn=[UQ(ut,v&&U.composes!=="remoteSlot",[yt,Kt&&Fn(Kt,Re.heldAllowLists??[]),...pA?[Wo(Dn,gs)]:[]]),yt,Kt,...Pt.map(([It])=>It)].filter((It)=>It!==null),fA=[...ut!==null?["remote"]:[],...yt!==null?[pr()]:[],...Le!==null?["file"]:[],...Pt.map(([,It])=>It)],Fu=(It)=>xn.some((gn)=>gn!==Kt&&gn[It]!==void 0),zl=Kt!==null&&Re.onlyHeldContent===!0&&ro&&In!=="merge"&&xn[0]!==Kt,Gl=ut!==null&&s.policyOnlyServerTier?.()!==void 0,{admin:gr,merged:wi}=Ll(zl?xn.filter((It)=>It!==Kt):xn,In,Pn,zl?xn.length-2:Pt.length,Gl),Bu=(It)=>Rl({slot:It,adminTiers:xn})||Dn?.allowManagedMcpServersOnly===!0&&It?.allowManagedMcpServersOnly!==!1,zu=(It,gn)=>wi?Fu(It):xn[0]!==Kt&&xn[0]?.[It]!==void 0||It==="allowedMcpServers"&&Fu(It)&&Bu(gn),_r=gr&&Kt&&zl?Ll([gr,Fn(Kt,Pu.filter((It)=>zu(It,gr)))],"merge",!1,0).admin:gr&&qe&&!wi?Ll([gr,qe],"merge",!1,0).admin:gr;if(Gl&&_r!==null){let{kept:It}=JO(s);for(let gn of XO){let Un=Yt(It,gn),wo=Yt(_r,gn),Er=Py.some((xi)=>xi===gn[0])&&Yt(xn[0],gn)!==void 0;if(Un!==void 0&&!Er)yn(_r,gn,XQ.includes(gn.join("."))&&Array.isArray(Un)&&Array.isArray(wo)?u([...wo,...Un]):Un)}}let Ts=_r===null?[T,re,Re].find(Es):void 0,ao=_r??(Ts?{}:null),Wl={remote:ut!==null||Ts===T,mdm:yt!==null||Ts===re,file:Le!==null||Ts===Re},Gu=[];if(wi){let It=Wl.remote?"remote":Wl.mdm?pr():"file",gn=[[yt,pr()],[Kt,"file"]];for(let[Un,wo]of gn){if(Un===null||Un===xn[0]||Pn&&Un===xn[1])continue;let Er=wu.filter((Vl)=>Object.values(Un[Vl]??{}).some((ju)=>ju!==void 0&&ju!==null)),[xi]=Er;if(xi===void 0)continue;Gu.push(wo),c.push({file:ur[wo],path:xi,message:`${Er.map((Vl)=>`"${Vl}"`).join(" and ")} in ${ur[wo]} ignored: policy helper configuration is read from the highest managed settings source only (${ur[It]} here), even with managedSourcesBehavior "merge". Configure the helper in that source instead.`,severity:"warning",statusOnly:!0})}}let Kl=(It)=>It!==null&&(It===xn[0]||Object.keys(Fn(It,ZO())).length>0),mA={remote:Kl(ut),mdm:Kl(yt),file:Kl(Kt)},Ds={allowManagedPermissionRulesOnly:xn.some((It)=>It.allowManagedPermissionRulesOnly===!0)||void 0,forceLoginOrgUUID:ao?.forceLoginOrgUUID,...Wo(ao??{},gs),hooks:ao?.hooks,enabledPlugins:ao?.enabledPlugins,allowedMcpServers:Bu(ao)?mu({slot:ao,adminTiers:xn}):ao?.allowedMcpServers,sandbox:{network:{allowManagedDomainsOnly:xn.some((It)=>It.sandbox?.network?.allowManagedDomainsOnly===!0)||void 0},filesystem:{allowManagedReadPathsOnly:xn.some((It)=>It.sandbox?.filesystem?.allowManagedReadPathsOnly===!0)||void 0}}},jl=!la(s)&&bQ(_r,so),Pi=Wn&&Dn?fO(Dn,Ds):Dn,Wu=jl&&Dn&&!Wn?gs.filter((It)=>Dn[It]!==void 0&&Re.heldAllowLists?.includes(It)===!0&&Qn(Ds[It],Le?.[It])&&!zu(It,ao)):[],$l=(Pi||xO(s.parentManaged))&&jl?Wn?Ou(Pi??{},{...Ds,allowManagedPermissionRulesOnly:!0,sandbox:{network:{allowManagedDomainsOnly:!0},filesystem:{allowManagedReadPathsOnly:!0}}},s.parentManaged,s.parentOrganizationSettings?.own):Ou(Pi??{},Fn(Ds,Wu),s.parentManaged,s.parentOrganizationSettings?.own):null,Ni=$l&&Object.keys($l).length>0?$l:null,Ku=Ni&&!ao&&Object.entries(Ni).every(([It,gn])=>DQ.has(It)&&s.parentOrganizationSettings?.own[It]!==gn)&&Object.keys(s.hkcu?.().settings??{}).length>0?Ni:null,gA=Ku?null:Ni,_A=IQ(Dn===Mt?Pi:Wn&&Mt?fO(Mt,Ds):Mt,s.hostManagedProvider);return{tiers:xn,tierSources:fA,admin:ao,parentSlice:gA,hostFeatureOverlay:Ku,hostModelOverlay:_A,errors:c,present:Wl,mode:In,merged:wi,composed:mA,snapshotFirst:Pn,parentNeverShutOut:so,shadowedHelperSources:Gu,parentIncluded:jl,heldEmpty:Ts!==void 0,fileNotHeld:Re.settingsNotHeld,heldInTheHostsPlace:Wu,policyOnlyLeads:Gl}}function Ll(s,c,T,I,v=!1){let U=s[0];if(!U)return{admin:null,merged:!1};let{managedSourcesBehavior:oe,...re}=U,le=c==="merge"&&s.length>=2;if(!le&&I===0&&!v)return{admin:oe===void 0?U:re,merged:!1};let ye=s.slice(le||v?1:s.length-I).map((Ie,Le)=>{let Ze=le&&T&&Le===0,$e=Ze?{...Ie}:Fn(Ie,ZO());if(!Ze){for(let Me of RQ)if(Yt($e,Me)!==void 0)yn($e,Me,void 0)}let dt=Yt($e.sandbox,["enabledPlatforms"]);if(Array.isArray(dt)&&dt.includes(g()))yn($e,["sandbox","enabledPlatforms"],void 0);else if(dt!==void 0)delete $e.sandbox;return $e});if(!le)return mO(re,[U,...ye]),{admin:re,merged:!1};let Re={};for(let Ie of[...ye].reverse())kn(Re,Ie,Au);return kn(Re,re,T?HQ:Au),mO(Re,[U,...ye]),xQ(Re,[U,...ye],T),{admin:Re,merged:!0}}var wu=["policyHelper","policyHelpers"],ur={remote:"server-managed settings",plist:"the managed preferences plist",hklm:"the HKLM policy key",file:"managed-settings.json"};function As(s){return Object.keys(s).some((c)=>!Yo.includes(c))}function Cs(s){return Object.entries(s).some(([c,T])=>!Yo.includes(c)&&!fi(T))}function Il(s){return s&&As(s)?s:null}function _s(s){return s.settings!==null&&Cs(s.settings)&&!s.onlySubstitutes}function MO(s,c,T){return _s({settings:c})&&!T.some((I)=>I.onlySubstitutes)?qy(s):s}var UO=0;function hu(s,c){if(s===null)return-1;if(c)return 2;return Cs(s)?1:UO}function HO(s,c){return Object.entries(s).some(([T,I])=>I!==null&&!OO(T,I)&&!Yo.includes(T))||c!==null&&As(c)}function Es(s){return s.documentHasPolicyContent??(s.settings!==null&&As(s.settings))}function Io(s){return s.loadState??(s.settings!==null?"loaded":"absent")}function ho(s,c){if(s==="didNotLoad"||c==="didNotLoad")return"didNotLoad";return s==="loaded"||c==="loaded"?"loaded":"absent"}function oo(s){return s.userWritable!==!0&&(Es(s)||s.loadState==="didNotLoad")}function xQ(s,c,T){let I=c.findIndex((U)=>U.availableModels!==void 0),v=c.findIndex((U)=>U.modelOverrides!==void 0);if(v!==-1&&(I===-1||v<=I||T&&I===0))s.modelOverrides={...c[v].modelOverrides};else delete s.modelOverrides}var FO=["allowedMcpServers","availableModels","strictKnownMarketplaces","allowedChannelPlugins","allowedProviders"],kQ=["awsPairs","ripgrep"];function BO(s,c,T){if(c===void 0)return s;if(Array.isArray(c))return T==="awsPairs"&&Array.isArray(s)?[...c,...kO(s,c)]:[...c];if(!r(c))return c;return ya(c,(I)=>Array.isArray(I)?[...I]:I)}var Pu=["allowedMcpServers","availableModels","strictKnownMarketplaces","allowedChannelPlugins","allowedProviders","allowedMarketplaces","allowedHttpHookUrls","httpHookAllowedEnvVars"],gs=["allowedMcpServers","availableModels","strictKnownMarketplaces","allowedProviders"],zO=[["allowManagedMcpServersOnly","allowedMcpServers"],["enforceAvailableModels","availableModels"]];function fO(s,c){return Fn(s,zO.filter(([,T])=>s[T]===void 0&&c[T]===void 0).map(([T])=>T))}var vQ=[...zO.map(([s])=>s),"allowManagedPermissionRulesOnly","allowManagedHooksOnly","disableAllHooks","allowedHttpHookUrls","httpHookAllowedEnvVars","strictPluginOnlyCustomization","sandbox.network.allowManagedDomainsOnly","sandbox.filesystem.allowManagedReadPathsOnly","sandbox.enabled"];function MQ(s){return Il(Ou(Fn(s,vQ),{...Object.fromEntries(gs.map((c)=>[c,[]])),forceLoginOrgUUID:[],allowManagedPermissionRulesOnly:!0,sandbox:{network:{allowManagedDomainsOnly:!0},filesystem:{allowManagedReadPathsOnly:!0}}}))}function UQ(s,c,T){if(s===null||!c)return s;let I=Pu.filter((v)=>T.some((U)=>U?.[v]!==void 0));return I.length===0?s:Fn(s,I)}function Au(s,c,T){if(T!==void 0&&(FO.includes(T)||kQ.includes(T)))return BO(s,c,T);return GO(s,c,T)}function HQ(s,c,T){if(T!==void 0&&FO.includes(T))return BO(s,c,T);return GO(s,c,T)}function GO(s,c,T){if(Array.isArray(s)&&Array.isArray(c)&&T!=="fallbackModel")return u([...c,...s]);return no(s,c,T)}function mO(s,c){let T=c[0],I=s;for(let v of Eo()){let{path:U,restrictive:oe}=v,re=tr(oe),le=Math.min(...c.map((ye)=>re.indexOf(ma(v,ye))).filter((ye)=>ye!==-1));if(Number.isFinite(le))yn(I,U,re[le]);else if(Yt(T,U)===void 0&&Yt(s,U)!==void 0)yn(I,U,void 0)}if(s.strictPluginOnlyCustomization!==!0){let v=u(c.flatMap((U)=>Array.isArray(U.strictPluginOnlyCustomization)?U.strictPluginOnlyCustomization:[]));if(v.length>0)s.strictPluginOnlyCustomization=v;else if(T?.strictPluginOnlyCustomization===void 0)delete s.strictPluginOnlyCustomization}}function Di(s){let c=s.helper?.()??null;if(!c)return{composes:"none"};let T=s.helperArmedFromRemote?.()===!1?"tier":"remoteSlot";if(s.helperMergesOutput?.()!==!0)return{composes:T,helper:c,mergedOver:null};if(!s.store.policy.mergedHelper){let{base:I,mergedOver:v}=T==="remoteSlot"?{base:Tu(s).settings,mergedOver:"remote"}:WO(s);s.store.policy.mergedHelper={helper:GQ(I,c),mergedOver:Object.keys(KO(I)).length>0?v:null}}return{composes:T,...s.store.policy.mergedHelper}}function WO(s){let c=vl(s);if(Os({...s,helper:void 0}).present.mdm)return{base:c.settings,mergedOver:pr(),errors:c.errors};let T=s.file?.()??kl(s);return{base:T.settings,mergedOver:"file",errors:[...c.errors,...T.errors]}}function KO(s){return Fn(s??{},wu)}function FQ(s,c){let T=new Map;for(let[v,U]of Object.entries(c)){let oe=v.toUpperCase();if(!T.has(oe))T.set(oe,U)}let I={};for(let[v,U]of Object.entries(s))I[v]=T.get(v.toUpperCase())??U;return Object.assign(I,c)}var BQ=["forceLoginOrgUUID","gatewayInternalNetworks","allowedHttpHookUrls","httpHookAllowedEnvVars","allowRead"];function zQ(s,c,T){let I=T!==void 0&&c!==void 0&&BQ.includes(T)?c:Au(s,c,T);return I===c&&Array.isArray(I)?[...I]:I}function GQ(s,c){let T=KO(s),I=kn({},T,c,zQ);if(T.env&&c.env)I.env=FQ(T.env,c.env);return I}function jO(s){let c=vl(s);return s.mdm?.().userWritable!==!0&&c.loadState==="didNotLoad"||c.errors.some((T)=>T.errorClass==="unreadable"&&T.userWritable!==!0)}function $O(s){return Io(s.file?.()??kl(s))==="didNotLoad"}function WQ(s){let c=Di(s);if(c.composes==="tier")return[c.helper];let{tiers:T,parentSlice:I}=Os(s);return I?[...T,I]:T}function KQ(s,c,T){let I={slot:T,adminTiers:s};return s.flatMap((v,U)=>{let oe=c[U],re=Wy(v,I);return oe!==void 0&&re.length>0?[{source:oe,keys:re}]:[]})}var VO=["apiKeyHelper","awsAuthRefresh","awsCredentialExport","gcpAuthRefresh"];var Nl=[...VO,"otelHeadersHelper","proxyAuthHelper"],gO=["disableAllHooks","enabledPlugins","extraKnownMarketplaces","agent","allowedHttpHookUrls","httpHookAllowedEnvVars","autoMemoryDirectory","modelOverrides","allowedMcpServers","skipWebFetchPreflight","autoUploadSessions","xaaIdp","claudeMdExcludes","enableAllProjectMcpServers","enabledMcpjsonServers"];function jQ(s,c,T){if(!gO.some((v)=>c[v]!==void 0)||(T.launchFolderKeysFrom?.(s)??"as_read")==="as_read")return c;let I={...c};for(let v of gO)delete I[v];return Ty("keys"),I}function bi(s,c,T){return $Q(s,jQ(s,c,T),T)}function $Q(s,c,T){let I=Nl.some((re)=>c[re]!==void 0);if(!I&&s!=="policySettings")return c;let v=T.credentialHelperKeysFrom(s);if(v==="as_read")return c;let U=s==="policySettings"&&v==="machine_admin"?VQ(T):{};if(!I&&Object.keys(U).length===0)return c;let oe={...c};for(let re of Nl)delete oe[re];return Object.assign(oe,U)}function VQ(s){let c=Nu(s),T={};for(let I of Nl){let v=c?.[I];if(v!==void 0)T[I]=v}return T}function Nu(s){let c=YO(s),T=Di(c);return T.composes==="tier"?T.helper:Os(c).admin}function YO(s){let c=s.helperArmedFromRemote?.()===!1&&s.helperArmedFromUserWritableBase?.()===!1;return{...s,store:new de,remote:()=>null,helper:c?s.helper:()=>null,...s.mdm?.().userWritable===!0&&{mdm:()=>({settings:{},errors:[]})}}}function YQ(s){return s.helperArmedFromUserWritableBase?.()!==!1||s.helperMergesOutput?.()===!0&&s.mdm?.().userWritable===!0}function _O(s,c){if(c.store.policy.machineLoginPins===void 0){let v=Nu(c);c.store.policy.machineLoginPins={value:{forceLoginOrgUUID:v?.forceLoginOrgUUID,forceLoginMethod:v?.forceLoginMethod}}}let{forceLoginOrgUUID:T,forceLoginMethod:I}=c.store.policy.machineLoginPins.value;if(T!==void 0)s.forceLoginOrgUUID=T;if(I==="claudeai"||I==="console")s.forceLoginMethod=I}var XO=[["model"],["fallbackModel"],["advisorModel"],["modelOverrides"],["modelPricing"],["modelPicker"],["processWrapper"],["sandbox","credentials","files"],["sandbox","credentials","envVars"],["sandbox","credentials","awsPairs"],["availableModels"],["requiredMinimumVersion"],["requiredMaximumVersion"],["strictKnownMarketplaces"],["allowedMarketplaces"],["allowedChannelPlugins"],["deniedModels"],["blockedMarketplaces"],...us.map((s)=>["autoMode",s]),["hooks"],["allowedHttpHookUrls"],["httpHookAllowedEnvVars"],["managedMcpServers"],["extraKnownMarketplaces"],["additionalMarketplaces"],["enabledPlugins"],["pluginConfigs"],["pluginTrustMessage"],["pluginSuggestionMarketplaces"],["claudeMd"],["cleanupPeriodDays"],["desktopSessionCleanupPeriodDays"]],XQ=["deniedModels","blockedMarketplaces",...us.map((s)=>`autoMode.${s}`)];function JO(s){if(s.store.policy.machineBeneathPolicyOnly===void 0){let c=Nu(s),T={};for(let I of XO){let v=Yt(c,I);if(v!==void 0)yn(T,I,v)}s.store.policy.machineBeneathPolicyOnly={kept:T,env:JQ(s)}}return s.store.policy.machineBeneathPolicyOnly}function JQ(s){return xu({...YO(s),helper:()=>null,hkcu:void 0,parentManaged:null}).settings?.env}var ZQ=[...Nl,"forceLoginOrgUUID","forceLoginMethod","forceLoginGatewayUrl","gatewayInternalNetworks","parentSettingsBehavior","env","modelPicker",...wu,...Yo];function ZO(){return ZQ}function qO(s){return LS.some((c)=>s.startsWith(c))||qd.includes(s)}function qQ(s,c,T,I=0){let v=new Map,U=new Map,oe=!1;for(let[re,le]of s.entries()){let ye=new Set,Re=c?.[re]===!0;for(let[Ie,Le]of Object.entries(le??{})){let Ze=Ie.toUpperCase(),$e=qO(Ze);if($e&&Le.trim()==="")continue;if($e&&oe)continue;if($e&&re>I&&c?.[re]===!0)continue;let dt=v.get(Ze);if(dt!==void 0){if(ye.has(Ze))U.set(Ie,Le);else if(!U.has(Ie))U.set(Ie,dt);continue}if(re>I&&T?.[re]?.has(Ze))continue;if(U.set(Ie,Le),ye.add(Ze),v.set(Ze,Le),$e)Re=!0}if(Re)oe=!0}return Object.fromEntries(U)}var QQ="CLAUDE_CODE_DISABLE_ADMIN_ENV_UNION";function EO(s){if(!s)return;let c={};for(let[T,I]of Object.entries(s))if(T.toUpperCase()!==QQ)c[T]=I;return c}function eee(s,c){let T=Object.entries(s??{}),I=c??{};return T.length===Object.keys(I).length&&T.every(([v,U])=>I[v]===U)}function hO(s,c){if(c===s.store.parentLeftOutReason)return;if(s.store.parentLeftOutReason=c,c!==null)t(`--managed-settings left out of the policy tier: ${c}`,{level:"warn"})}function xu(s){let c=Di(s),T=(s.helperWarnings?.()??[]).filter((Ct)=>!Jo(Ct.path)),I=!la(s)&&Object.keys(s.parentManaged??{}).length>0;if(c.composes==="tier"){hO(s,I?"a policy helper supplies that tier (parentSettingsBehavior does not apply to it)":null);let{helper:Ct}=c;s.store.lastPolicyEnvComposition=null;let Ut=YQ(s),jt=s.hostManagedProvider||Ut?{...Ct}:Ct;if(s.hostManagedProvider)Dl(jt);if(Ut)_O(jt,s);s.store.policy.pairedModelOverrides={value:s.hostManagedProvider&&Ct.availableModels!==void 0?Ct.modelOverrides:void 0},s.store.policy.deniedModelsOverrides={value:s.hostManagedProvider?Ct.modelOverrides:void 0};let In=s.store.policy.helperBaseStatusNotices??=[...s.helperMergesOutput?.()===!0?WO(s).errors.filter((qe)=>!qe.statusOnly):[],...Os(s).errors.filter((qe)=>qe.statusOnly)];return{settings:jt,errors:[...In,...T]}}let{tiers:v,tierSources:U,admin:oe,parentSlice:re,hostFeatureOverlay:le,hostModelOverlay:ye,errors:Re,present:Ie,snapshotFirst:Le,parentIncluded:Ze,heldInTheHostsPlace:$e,policyOnlyLeads:dt}=Os(s),Me=null;if(I&&!Ze)Me="an administrator's managed settings apply and do not set parentSettingsBehavior to 'merge'";else if(I&&!re&&!le&&!ye)Me="nothing shuts it out, yet none of its keys was kept (unreadable, no restriction, or already set by an administrator)";if(hO(s,Me),Re.push(...T),!oe&&!re){s.store.lastPolicyEnvComposition=null,s.store.policy.pairedModelOverrides={value:void 0},s.store.policy.deniedModelsOverrides={value:void 0};let Ct=s.hkcu?.();if(Ct&&Object.keys(Ct.settings).length>0){let Ut=s.hostManagedProvider||le?{...Ct.settings,...le}:Ct.settings;if(s.hostManagedProvider){if(Dl(Ut),ye)pO(Ut,ye)}return{settings:Ut,errors:[...Re,...Ct.errors]}}if(ye)return{settings:{...ye},errors:[...Re,...Ct?.errors??[]]};return{settings:null,errors:[...Re,...Ct?.errors??[]]}}let nt=kn({},re??{},Fn(oe??{},$e),no);if(re?.availableModelsMatch==="exact")nt.availableModelsMatch="exact";if(re?.allowManagedHooksOnly===!0)nt.allowManagedHooksOnly=!0;if(re?.disableSkillShellExecution===!0)nt.disableSkillShellExecution=!0;if(re?.disableWindowsBashCommandSplit===!0)nt.disableWindowsBashCommandSplit=!0;for(let Ct of Lu)if(re?.[Ct]===!0)nt[Ct]=!0;for(let Ct of Iu)if(re?.[Ct]===!1)nt[Ct]=!1;if(v.some((Ct)=>Ct.forceRemoteSettingsRefresh===!0))nt.forceRemoteSettingsRefresh=!0;if(U.includes("remote")||s.mdm?.().userWritable===!0)_O(nt,s);let rt=mn.CLAUDE_CODE_DISABLE_ADMIN_ENV_UNION===!0&&!dt,ct=nt.env;if(!rt){let Ct=v;if(dt){let jt=JO(s).env,In=new Set(Object.entries(jt??{}).filter(([,yt])=>yt.trim()!=="").map(([yt])=>yt.toUpperCase())),qe=wy(v[0]?.env??{},jt),Ve=Object.entries(v[0]?.env??{}).filter(([yt])=>{let Pt=yt.toUpperCase();return!(Iy.includes(Pt)&&In.has(Pt)||qe.dropped.includes(Pt))}).concat(qe.cleared.map((yt)=>[yt,""])),[ut,Et]=$g(Ve,([yt,Pt])=>qd.includes(yt.toUpperCase())&&Y(Pt));Ct=[{...v[0],env:Object.fromEntries(Et.some(([yt])=>qO(yt.toUpperCase()))?Ve:Et)},{env:{...jt,...Object.fromEntries(ut)}}]}let Ut=qQ(Ct.map((jt)=>jt.env),Ct.map((jt)=>(jt.otelHeadersHelper??"").trim()!==""),Ct.map((jt)=>{let In=new Set;for(let qe of VO){let Ve=jt[qe];if(typeof Ve==="string"&&Ve.trim()!=="")for(let ut of IS[qe])In.add(ut)}return In.size>0?In:void 0}),Le||dt?1:0);if(Object.keys(Ut).length>0)nt.env=Ut;else delete nt.env}if(nt.env){let Ct=EO(nt.env);if(Ct&&Object.keys(Ct).length>0)nt.env=Ct;else delete nt.env}let pt=Nm();if(s.hostManagedProvider){if(Dl(nt,pt),ye)pO(nt,ye)}let bt={env:EO(ct)};if(s.hostManagedProvider)Dl(bt,pt);let Nt=!rt&&!eee(nt.env,bt.env);s.store.lastPolicyEnvComposition={unionOptedOut:rt,unionChangedEnv:Nt,remoteTierPresent:Ie.remote,mdmTierPresent:Ie.mdm,fileTierPresent:Ie.file,adminTierCount:v.length,tiersWithEnv:Ae(v,(Ct)=>Object.keys(Ct.env??{}).length>0)},s.store.policy.pairedModelOverrides={value:s.hostManagedProvider&&oe?.availableModels!==void 0&&oe.modelOverrides!==void 0&&ye?.availableModels===void 0?oe.modelOverrides:void 0},s.store.policy.deniedModelsOverrides={value:s.hostManagedProvider?oe?.modelOverrides:void 0};for(let{source:Ct,keys:Ut}of KQ(v,U,nt)){let[jt]=Ut;if(jt===void 0)continue;let In=ur[Ct],qe=Ut.length===1;Re.push({file:In,path:jt,message:`${Ut.map((Ve)=>`"${Ve}"`).join(" and ")} in ${In} ${qe?"is":"are"} not applied: ${In} is not the managed settings source that applies for ${qe?"this key":"these keys"} (/status lists the setting sources). Remove ${qe?"it":"them"} from ${In}, or set ${qe?"it":"them"} in the source that applies.`,severity:"warning",statusOnly:!0})}return{settings:nt,errors:Re}}function tee(s,c,{includeLegacyLocalSettings:T=!0}={}){if(s==="policySettings")return xu(c).settings;let I=ys(s,c),{settings:v}=I?hs(I,c.store,s==="flagSettings"?c.flagExpectedContent:void 0):{settings:null};if(s==="flagSettings"){let{settings:U}=RO(c);if(U)return kn(v||{},U,no)}if(s==="localSettings"&&T){let U=wO(c);if(U){let{settings:oe}=hs(U,c.store);if(oe)return c.onLegacyLocalSettingsRead?.("per_source"),kn(oe,v||{},no)}}return v}function nee(s,c){return{...s,...c}}function no(s,c,T){if(T==="modelPicker"&&c!==void 0)return QO(c);if(Array.isArray(s)&&Array.isArray(c)){if(T==="fallbackModel")return c;return u([...s,...c])}if((T==="extraKnownMarketplaces"||T==="managedMcpServers")&&r(s)&&r(c))return nee(s,c);return}function QO(s){if(!r(s))return s;let c=s.options;return{...s,...Array.isArray(c)&&{options:c.map((T)=>r(T)?{...T}:T)}}}function oee(s){if(s.store.isLoadingFromDisk)return{settings:{},errors:[]};let c=Date.now();Ms("info","settings_load_started"),s.store.isLoadingFromDisk=!0;try{let T=s.store.pluginBase,I={};if(T)I=kn(I,T,no);let v=[],U=new Set,oe=new Set,re=(Me)=>{for(let nt of Me){let rt=`${nt.file}:${nt.path}:${nt.message}`;if(!U.has(rt))U.add(rt),v.push(nt)}},le=[],ye=[Go()];if(g()==="wsl"&&s.wslInherits?.())ye.push(Hn);let Re=new Set(ye.map((Me)=>fn(En(Me,"managed-settings.json")))),Ie=new Set(ye.map((Me)=>fn(En(Me,"managed-settings.d")))),Le=(Me)=>{let nt=fn(Me);return Re.has(nt)||Ie.has(xl(nt))},Ze=(Me,nt,rt)=>{if(rt?.channelLabel!==!0&&Le(Me))return;let ct=nt.sandbox?.filesystem?.allowRead?.length??0,pt=nt.sandbox?.network?.allowedDomains?.length??0;if(ct>0||pt>0)le.push({file:Me,allowReadCount:ct,allowedDomainsCount:pt})},$e=null;for(let Me of Cu(s)){if(Me==="policySettings"){let{settings:ct,errors:pt}=xu(s);if($e=ct,re(wQ(ct)),re(PQ(ct)),ct)I=kn(I,bi(Me,ct,s),no);re(pt);continue}let nt=s.store.repoTierFreeze.tier(Me);if(nt!==void 0){let ct=ys(Me,s);if(ct)oe.add(fn(ct));if(re([...nt.errors]),nt.settings)I=kn(I,nt.settings,no);continue}if(Me==="localSettings"){let ct=wO(s);if(ct&&!oe.has(fn(ct))){oe.add(fn(ct));let{settings:pt,errors:bt}=hs(ct,s.store);if(re(bt),pt)s.onLegacyLocalSettingsRead?.("cascade"),Ze(ct,pt),I=kn(I,bi(Me,pt,s),no)}}for(let ct of yQ(Me,s)){let pt;try{pt=We(a(),ct).absentAt===void 0}catch{pt=!0}if(pt)re([AQ(ct)]),t(`Settings file ${ct} is not used: it is in a connector-downloads folder`)}let rt=ys(Me,s);if(rt){let ct=fn(rt),pt=Me==="flagSettings"&&s.flagExpectedContent!==void 0;if(!oe.has(ct)||pt){oe.add(ct);let{settings:bt,errors:Nt}=hs(rt,s.store,Me==="flagSettings"?s.flagExpectedContent:void 0);if(re(Nt),bt){if(Me==="flagSettings"&&s.flagInlineJson===!0)Ze(Cn,bt,{channelLabel:!0});else Ze(rt,bt);I=kn(I,bi(Me,bt,s),no)}}}if(Me==="flagSettings"){let{settings:ct,errors:pt}=RO(s);if(re(pt),ct)Ze("SDK inline settings",ct,{channelLabel:!0}),I=kn(I,bi(Me,ct,s),no)}}if($e){if($e.availableModels!==void 0)I.availableModels=[...$e.availableModels];if($e.enforceAvailableModels!==void 0)I.enforceAvailableModels=$e.enforceAvailableModels;if($e.modelPicker!==void 0)I.modelPicker=QO($e.modelPicker)}let dt=$e?.deniedModels;if(dt!==void 0)I.deniedModels=[...dt];else delete I.deniedModels;if(le.length>0){let Me=NQ(s),nt=(rt,ct,pt,bt,Nt)=>({file:rt,path:ct,severity:"warning",statusOnly:!0,message:`${ct} is ignored — managed settings set ${pt}, so only ${bt} from managed settings are honored. The ${Nt===1?"entry":`${Nt} entries`} in ${rt} will NOT apply (see https://code.claude.com/docs/en/settings#sandbox-settings).`});if(Me.some((rt)=>rt.sandbox?.filesystem?.allowManagedReadPathsOnly===!0)){for(let rt of le)if(rt.allowReadCount>0)re([nt(rt.file,"sandbox.filesystem.allowRead","allowManagedReadPathsOnly","allowRead paths",rt.allowReadCount)])}if(Me.some((rt)=>rt.sandbox?.network?.allowManagedDomainsOnly===!0)){for(let rt of le)if(rt.allowedDomainsCount>0)re([nt(rt.file,"sandbox.network.allowedDomains","allowManagedDomainsOnly","allowed domains (and WebFetch domain rules)",rt.allowedDomainsCount)])}}return Ms("info","settings_load_completed",{duration_ms:Date.now()-c,source_count:oe.size,error_count:v.length}),s.store.hookedMerge.computed=I,jy({settings:I,errors:v},s.store.hookedMerge.answers)}finally{s.store.isLoadingFromDisk=!1}}function ree(s){let c=s.store.mergedSettings;if(c!==null)return c;let T=oee(s);return s.store.mergedSettings=T,T}function see(s){let{settings:c}=ree(s);return c||{}}function eA(s){s.store.invalidateAll();let c=[];for(let T of Cu(s)){let I=PO(T,s);if(I&&Object.keys(I).length>0)c.push({source:T,settings:I})}return{effective:see(s),sources:c}}function tA(s,c){let T=Cu(c);for(let I=T.length-1;I>=0;I--){let v=T[I];if(PO(v,c)?.[s]!==void 0)return v}return null}var sA=Object.freeze({settings:{},errors:[],loadState:"absent"}),fr=Object.freeze({settings:{},errors:[]});class iA{mdm=null;hkcu=null;wslInherits=!1;whereAsked=void 0;readOutcomes=null;unansweredReadsInARow=0;lastAnswered=null;seatedWithNoAnswer=void 0;loadPromise=null;sdkReread={lastReadAt:0,inFlight:void 0,lossSeen:""};reread={failedFor:void 0,failedAt:0,inFlight:void 0,startedAt:0};startLoad(s){if(this.loadPromise)return;this.loadPromise=(async()=>{let c=Date.now(),I=await(sp()??Hi()),{mdm:v,hkcu:U,wslInherits:oe,whereAsked:re}=await Fl(I,s);this.replace(v,U,oe,re,I.outcomes),this.readOutcomes=I.outcomes;let le=Date.now()-c;t(`MDM settings load completed in ${le}ms`);try{ne("tengu_managed_settings_os_read",Tee(I,le))}catch{}let ye=bs();if(Object.keys(ye.settings).length>0){t(`MDM settings found: ${Object.keys(ye.settings).join(", ")}`);try{Ms("info","mdm_settings_loaded",{duration_ms:le,key_count:Object.keys(v.settings).length,error_count:v.errors.length})}catch{}}})()}replace(s,c,T,I,v){if(this.mdm=s,this.hkcu=c,this.wslInherits=T,this.whereAsked=I,this.sdkReread.lossSeen="",v===void 0)return;this.sdkReread.lastReadAt=Date.now();let U={mdm:s,hkcu:c,wslInherits:T,whereAsked:I};if((v.hklm===null||v.hklm.answered)&&!Bl(U).mdm.errors.some((re)=>re.errorClass==="unreadable"&&re.errno===void 0&&re.userWritable!==!0))this.unansweredReadsInARow=0,this.lastAnswered=U,this.seatedWithNoAnswer=void 0;else this.unansweredReadsInARow++,this.seatedWithNoAnswer=s}reset(){this.mdm=null,this.hkcu=null,this.wslInherits=!1,this.whereAsked=void 0,this.readOutcomes=null,this.unansweredReadsInARow=0,this.lastAnswered=null,this.seatedWithNoAnswer=void 0,this.loadPromise=null,this.sdkReread={lastReadAt:0,inFlight:void 0,lossSeen:""},this.reread={failedFor:void 0,failedAt:0,inFlight:void 0,startedAt:0}}}var nA="@builtin",lee=["prependPlugins","appendPlugins"];function cee(s){return typeof s==="object"&&s!==null&&!Array.isArray(s)}var dee=new i(()=>new iA);function Rs(){return dee.of(b().host)}function uee(s){Rs().startLoad(s)}async function pee(){let s=Rs();if(!s.loadPromise)uee();await s.loadPromise}var fee=1800000,mee=1000,gee=30000;function _ee(s,c){let{mdm:T}=Bl(s),I={...bs().settings,...Ii().settings},v=s.readOutcomes?.hklm??null,U=v===null||v.answered||c&&!Ui(v),oe=s.readOutcomes?.hkcu??null,re=oe===null||oe.answered||oo(T)||Object.keys(Ii().settings).length===0;return s.readOutcomes!==void 0&&U&&re&&(!hr()&&!oo(bs())&&Object.keys(I).length===0||T.loadState!=="didNotLoad"&&!T.errors.some((le)=>le.severity!=="warning"&&le.userWritable!==!0))}function Eee(s){let c=Bl(s),T=bs(),I={...T.settings,...Ii().settings},v={...c.mdm.settings,...c.hkcu.settings};return[!oo(c.mdm)&&(oo(T)||Object.keys(I).length>0&&Object.keys(v).length===0)&&"all policy",T.plist===ql&&c.mdm.plist!==T.plist&&"the per-user plist",!c.wslInherits&&Hu()&&"WSL's inheriting"].filter(Boolean).join()}async function aA(){await pee();let s=Rs(),{sdkReread:c,unansweredReadsInARow:T}=s;if(c.inFlight===void 0){let I=T>=1&&T<=4,v=c.lossSeen?gee:!I?fee:T===1?0:Xu,U=Date.now()-c.lastReadAt;if(U>=0&&U<v)return;let oe="",re=(async()=>{try{let le=await yee();if(_ee(le,s.lastAnswered===null)){let ye=Eee(le);if(ye===""||ye===c.lossSeen){s.replace(le.mdm,le.hkcu,le.wslInherits,le.whereAsked,le.readOutcomes),s.readOutcomes=le.readOutcomes;return}if(!I){oe=ye;return}}t("MDM re-read for resolveSettings was not taken: the reading in force stays")}catch(le){t(`MDM re-read for resolveSettings failed (${n(le)??(le instanceof Error?le.name:typeof le)})`,{level:"error"})}See()})().finally(()=>{c.lossSeen=oe,c.lastReadAt=Date.now(),c.inFlight=void 0});c.inFlight=ue(re,mee)}if(T<=1)await c.inFlight}function bs(){if(sc())return sA;return Uu().mdm}function Uu(){return hee()}function hee(){let{mdm:s,hkcu:c,wslInherits:T}=Bl(Rs());return{mdm:s??sA,hkcu:c??fr,wslInherits:T}}function Bl(s){return s.whereAsked!==void 0&&Ea()?s.whereAsked:s}function lA(){return Rs().readOutcomes?.hklm??null}function Ii(){if(sc())return fr;return Uu().hkcu}function Hu(){return Uu().wslInherits}function See(){Rs().unansweredReadsInARow++}async function yee(s){let c=await Hi(!0);return{...await Fl(c,s),readOutcomes:c.outcomes}}function Li(s,c,{userWritable:T=!1}={}){let I=er(s,!1);if(!r(I))return{settings:{},errors:[Ul(c,{userWritable:T})],documentHasPolicyContent:!1,loadState:"didNotLoad"};let v=[],U=I;for(let Le of T?Ml:[]){if(!(Le in U))continue;if(U=U===I?{...I}:U,delete U[Le],!Jo(Le))v.push({file:c,path:Le,message:`"${Le}" is only honored from administrator-controlled managed settings and was ignored in ${c}, which the user account can write.`,severity:"warning",statusOnly:!0})}if(T){for(let Ze of lee){if(!(Ze in U))continue;U=U===I?{...I}:U,delete U[Ze],v.push({file:c,path:Ze,message:`"${Ze}" is only honored from administrator-controlled managed settings and was ignored in ${c}, which the user account can write.`,severity:"warning",statusOnly:!0})}let Le=U.enabledPlugins;if(cee(Le)){if(Object.entries(Le).filter(([$e,dt])=>$e.endsWith(nA)||dt!==!1).length>0){U=U===I?{...I}:U;let $e=zr(Le,(dt,Me)=>!Me.endsWith(nA)&&dt===!1);if(Object.keys($e).length>0)U.enabledPlugins=$e;else delete U.enabledPlugins;v.push({file:c,path:"enabledPlugins",message:`"enabledPlugins" entries that enable a plugin, or name a built-in, are only honored from administrator-controlled managed settings and were ignored in ${c}, which the user account can write.`,severity:"warning",statusOnly:!0})}}}let{settings:oe,errors:re,documentHasPolicyContent:le,loadState:ye,onlySubstitutes:Re}=Ss(U,c),Ie=[...v,...re];return{settings:oe??{},errors:T?Ie.map((Le)=>({...Le.severity==="warning"&&!Le.startupFatal?Le:{...Oee(Le),severity:"warning",statusOnly:!0},userWritable:!0})):Ie,documentHasPolicyContent:le,loadState:ye,...Re&&{onlySubstitutes:Re}}}function Oee({startupFatal:s,loadedWithoutGuardHook:c,...T}){return T}function ku(s,c,T,I){return{file:s,path:"",message:`Managed settings document (${s}) could not be read: ${c}; none of its settings are in effect.`,severity:T?"warning":"fatal",statusOnly:!0,errorClass:"unreadable",...I.errno!==void 0&&{errno:I.errno},...I.cause!==void 0&&{unreadCause:I.cause},...T&&{userWritable:!0}}}function Hl(s,c="Settings"){let T=c.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),I=new RegExp(`^[ \\t]+${T}[ \\t]+REG_(?:EXPAND_)?SZ[ \\t]+([\\s\\S]*)`,"im"),v=s.match(I)?.[1]?.trimEnd();return v?v:null}var Aee=new Map([["ENOENT",O("ENOENT")],["EACCES",O("EACCES")],["EPERM",O("EPERM")],["ENOEXEC",O("ENOEXEC")],["EAGAIN",O("EAGAIN")],["EMFILE",O("EMFILE")],["ENOMEM",O("ENOMEM")],["ETIMEDOUT",O("ETIMEDOUT")],["ERR_CHILD_PROCESS_STDIO_MAXBUFFER",O("ERR_CHILD_PROCESS_STDIO_MAXBUFFER")]]),Cee=new Map([["SIGTERM",O("SIGTERM")],["SIGKILL",O("SIGKILL")],["SIGINT",O("SIGINT")]]);function bee(s){if(!s)return;return Aee.get(s)??O("other")}function Ree(s){if(!s)return;return Cee.get(s)??O("other")}function oA(s,c){if(!c)return{};return{[`${s}_status`]:q(c.status),[`${s}_exit_code`]:c.exitCode??void 0,[`${s}_errno`]:bee(c.errno),[`${s}_signal`]:Ree(c.signal),[`${s}_duration_ms`]:c.durationMs}}function Tee(s,c){return{is_wsl:hr(),await_ms:c,...oA("hklm",s.outcomes.hklm),...oA("hkcu",s.outcomes.hkcu)}}async function Fl(s,c,T=!1){let I=[],v=!1,U="absent";for(let nt of s.plistStdouts??[]){let{label:rt,userWritable:ct}=nt;if(ct&&v)continue;let pt=nt.stdout===null?{settings:{},errors:[ku(rt,nt.unreadReason,ct,{errno:nt.unreadErrno,cause:nt.unreadCause})],documentHasPolicyContent:!1,loadState:"didNotLoad",...ct&&{userWritable:ct}}:{...Li(nt.stdout,rt,{userWritable:ct}),...ct&&{userWritable:ct}};if(ct?As(pt.settings):pt.documentHasPolicyContent)return{mdm:{...pt,errors:[...I,...pt.errors],documentHasPolicyContent:!0,plist:rt},hkcu:fr,wslInherits:!1};if(v||=oo(pt),I.push(...pt.errors),!ct)U=ho(U,pt.loadState)}let oe=`Registry: ${ki}\\${Is}`,re=null,le="disarmed",ye=`Registry: ${vi}\\${Is}`;if(!T&&(s.hklmStdout!==null||s.hklmUnreadReason!==void 0||s.hkcuStdout!==null)&&process.platform!=="win32"&&Zl()){let[nt,rt]=await Promise.all([Po,aee(Po)].map((pt)=>iee(pt).then(({uid:bt,gid:Nt,mode:Ct})=>({uid:bt,gid:Nt,mode:Ct}),()=>{return}))),ct=!0;try{ct=Ru(new de,Po,nt,rt)}catch(pt){t(`registry tool: could not be asked about, held: ${pt}`,{level:"error"})}if(ct){let pt=[];if(s.hklmStdout!==null)pt.push([oe,Li(Hl(s.hklmStdout)??"",oe)]);else if(s.hklmUnreadReason!==void 0)pt.push([oe,{settings:{},errors:[ku(oe,s.hklmUnreadReason,!1,{cause:"oversize"})],documentHasPolicyContent:!1,loadState:"didNotLoad"}]);if(s.hkcuStdout!==null)pt.push([ye,Li(Hl(s.hkcuStdout)??"",ye,{userWritable:!0})]);let bt=await Fl(s,c,!0),Nt=await Fl({...s,hklmStdout:null,hklmUnreadReason:void 0,hkcuStdout:null},c,!0);return{...bt,whereAsked:{...Nt,mdm:{...Nt.mdm,heldDocuments:pt.map(([Ct,Ut])=>({path:Ct,parsed:{...Ut,settings:Ut.loadState==="loaded"?Ut.settings:null}}))}}}}}if(s.hklmStdout!==null){let nt=Hl(s.hklmStdout)??"";re=Li(nt,oe);let rt=er(nt,!1);if(r(rt))le=Hd(rt)}else if(s.hklmUnreadReason!==void 0)re={settings:{},errors:[ku(oe,s.hklmUnreadReason,!1,{cause:"oversize"})],documentHasPolicyContent:!1,loadState:"didNotLoad"};let Re=re!==null&&oo(re);if(re)I.push(...re.errors),U=ho(U,re.loadState);let Ie=hr(),Le="disarmed",Ze=oe,$e=[];if(Ie){if(Le=le,Le!=="armed"){let nt=await Lee(c);if($e=nt.links,nt.flag==="armed"||Le==="disarmed")Le=nt.flag,Ze=nt.unreadableFlagPath??Hn;if(Le==="disarmed")I.push(...nt.records),U=ho(U,nt.loadState)}}let dt=Le!=="disarmed",Me={settings:{},errors:I,loadState:U};if(Ie&&!dt){let nt=new Set(re?.errors.filter((rt)=>rt.severity==="warning"));return{mdm:{...Me,errors:Me.errors.map((rt)=>nt.has(rt)?{...rt,wslIgnored:!0}:rt),...$e.length>0&&{managedDocumentLinks:$e}},hkcu:fr,wslInherits:!1}}if(re&&Re)return{mdm:re,hkcu:fr,wslInherits:dt};if(Le==="unreadable"){let nt=await Mu(Hn,c),rt=TO(Ze);return{mdm:{...Me,errors:nt?Me.errors:[...Me.errors,rt],...nt&&{withheldFlagRecord:rt},documentHasPolicyContent:!0,loadState:ho(Me.loadState,"loaded")},hkcu:fr,wslInherits:dt}}if(s.hkcuStdout!==null&&!m()&&!await Dee(dt,c)){let nt=Li(Hl(s.hkcuStdout)??"",ye,{userWritable:!0});if(!Ie||nt.settings.wslInheritsWindowsSettings===!0){let{wslInheritsWindowsSettings:rt,managedSourcesBehavior:ct,...pt}=nt.settings;return{mdm:Me,hkcu:{settings:pt,errors:nt.errors},wslInherits:dt}}if(nt.errors.length>0)return{mdm:Me,hkcu:{settings:{},errors:nt.errors},wslInherits:dt}}return{mdm:Me,hkcu:fr,wslInherits:dt}}async function cA(s,c){if(f()&&c!==void 0)return(await hc(s,Ri)).content;return Bo(s,Ri)}async function Dee(s,c){if(s&&await Mu(Hn,c))return!0;return Mu(Go(),c)}async function rA(s,c){let T;try{T=await cA(s,c)}catch(I){return!h(I)}try{let I=wl(T,s,!0);return oo({...I,loadState:Io(I)})}catch{return!0}}function vu(s){let c=n(s);return c==="ENOENT"||c==="ENOTDIR"}async function Lee(s){let c=[],T="absent",I=[],v=new Map;async function U(Ie,Le){let Ze=mr(Hn,...Ie),$e;try{$e=await cA(Ze,s)}catch(nt){if(vu(nt))return"disarmed";c.push(Ti(Ze,nt)),T="didNotLoad"}let dt=await Am(Hn,Ie,Le,v);if(dt!==null)I.push({link:dt,read:$e!==void 0});if($e===void 0)return"disarmed";let Me=$e.trim()===""?{}:er($e,!1);if(!r(Me))return c.push(Ul(Ze)),T="didNotLoad","disarmed";return T=ho(T,"loaded"),Hd(Me)}let oe=mr(Hn,"managed-settings.json"),re=await U(["managed-settings.json"]);if(re==="armed")return{flag:re,records:c,loadState:T,links:I};let le=re==="unreadable"?oe:void 0,ye=mr(Hn,"managed-settings.d"),Re;try{Re=await a().readdir(ye)}catch(Ie){if(!vu(Ie))c.push(Ti(ye,Ie,"directory")),T="didNotLoad";return{flag:re,unreadableFlagPath:le,records:c,loadState:T,links:I}}for(let Ie of Re){if(!(Ie.isFile()||Ie.isSymbolicLink())||!Ie.name.endsWith(".json")||Ie.name.startsWith("."))continue;let Le=await U(["managed-settings.d",Ie.name],Ie.isSymbolicLink());if(Le==="armed")return{flag:Le,records:c,loadState:T,links:I};if(Le==="unreadable")re=Le,le??=mr(ye,Ie.name)}return{flag:re,unreadableFlagPath:le,records:c,loadState:T,links:I}}async function Mu(s,c){if(await rA(mr(s,"managed-settings.json"),c))return!0;let T=mr(s,"managed-settings.d"),I;try{I=await a().readdir(T)}catch(v){return!vu(v)}for(let v of I)if((v.isFile()||v.isSymbolicLink())&&bu(v.name)&&await rA(mr(T,v.name),c))return!0;return!1}function dA(s){if(!Object.hasOwn(s,Ht))return{tier:s,organization:null,memberLost:!1};let{[Ht]:c,...T}=s;return{tier:T,organization:null,memberLost:!1}}var wee={user:"userSettings",project:"projectSettings",local:"localSettings"},uA={userSettings:"user",projectSettings:"project",localSettings:"local",flagSettings:"flag",policySettings:"managed"},Pee=["user","project","local"];async function ewe(s={}){await aA();let c=s.managedSettings&&dA(s.managedSettings),T={store:new de,cwd:Iee(s.cwd??a().cwd()),allowedSources:(s.settingSources??Pee).map((Re)=>wee[Re]),diskless:m(),parentManaged:c?.tier??null,parentOrganizationSettings:c?.organization,flagInline:null,flagPath:void 0,mdm:bs,hkcu:Ii,wslInherits:Hu,credentialHelperKeysFrom:()=>"as_read",asksOrganization:()=>Ea(),...s.serverManagedSettings!==void 0&&{remote:()=>s.serverManagedSettings}},{effective:I,sources:v}=eA(T),U=vO(T)??void 0,oe=v.map(({source:Re,settings:Ie})=>({source:uA[Re],settings:Ie,path:Re==="policySettings"?void 0:ys(Re,T),...Re==="policySettings"&&{policyOrigin:U}})),re={};for(let Re of Object.keys(I)){let Ie=tA(Re,T);if(Ie)re[Re]={source:uA[Ie],path:Ie==="policySettings"?void 0:ys(Ie,T),...Ie==="policySettings"&&{policyOrigin:U}}}let le=lA(),ye=[];if(jO(T))ye.push(le===null?"profile":"registry");else if(le!==null&&Ui(le))ye.push("registry");if($O(T))ye.push("file");return{effective:I,provenance:re,sources:oe,machinePolicy:{didNotLoad:ye.length>0&&ye}}}export{ewe as resolveSettingsForSdk};