@calliopelabs/cli 2.3.0 → 3.0.0

package/dist/sandbox/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Calliope CLI - Sandbox (unified public surface)
+ *
+ * Single entry point for code/shell sandboxing (#181). Two backends live
+ * behind this barrel:
+ *  - ./docker.ts  — Docker-container execution (executeInSandbox / execute)
+ *  - ./native.ts  — native OS sandbox (macOS Seatbelt via executeInNativeSandbox)
+ *
+ * Consumers import ONLY this module. The mode-routing helpers below resolve the
+ * `sandboxMode` config into a concrete backend decision:
+ *  - 'auto':   native/Docker when available, otherwise run unsandboxed
+ *  - 'native': require the native OS sandbox
+ *  - 'docker': use the Docker sandbox
+ *  - 'off':    no sandboxing
+ */
+export * from './docker.js';
+export * from './native.js';
+export type SandboxMode = 'auto' | 'native' | 'docker' | 'off';
+/** Current sandbox mode from config, defaulting to 'auto'. */
+export declare function getSandboxMode(): SandboxMode;
+/**
+ * Decide whether a shell command should run inside the native OS sandbox.
+ *  - 'use':     native sandbox available and should be used
+ *  - 'skip':    run unsandboxed (mode 'off'/'docker', or 'auto' with no backend)
+ *  - 'require': native sandbox mandated (mode 'native') — caller fails closed
+ *               if no backend is available
+ */
+export declare function shouldUseNativeSandbox(): 'use' | 'skip' | 'require';
+/**
+ * Decide which backend to use for sandboxed code execution.
+ *  - 'docker':      mode 'docker', or 'auto' with Docker available
+ *  - 'native':      mode 'native', or 'auto' with only the native backend available
+ *  - 'unsandboxed': mode 'off', or 'auto' with no backend available
+ */
+export declare function selectCodeSandbox(): 'docker' | 'native' | 'unsandboxed';
+//# sourceMappingURL=index.d.ts.map

package/dist/sandbox/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAE5B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE/D,8DAA8D;AAC9D,wBAAgB,cAAc,IAAI,WAAW,CAE5C;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,KAAK,GAAG,MAAM,GAAG,SAAS,CAMnE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,QAAQ,GAAG,QAAQ,GAAG,aAAa,CASvE"}

package/dist/sandbox/index.js

@@ -0,0 +1,62 @@
+/**
+ * Calliope CLI - Sandbox (unified public surface)
+ *
+ * Single entry point for code/shell sandboxing (#181). Two backends live
+ * behind this barrel:
+ *  - ./docker.ts  — Docker-container execution (executeInSandbox / execute)
+ *  - ./native.ts  — native OS sandbox (macOS Seatbelt via executeInNativeSandbox)
+ *
+ * Consumers import ONLY this module. The mode-routing helpers below resolve the
+ * `sandboxMode` config into a concrete backend decision:
+ *  - 'auto':   native/Docker when available, otherwise run unsandboxed
+ *  - 'native': require the native OS sandbox
+ *  - 'docker': use the Docker sandbox
+ *  - 'off':    no sandboxing
+ */
+import config from '../config.js';
+import { isDockerAvailable } from './docker.js';
+import { isNativeSandboxAvailable } from './native.js';
+export * from './docker.js';
+export * from './native.js';
+/** Current sandbox mode from config, defaulting to 'auto'. */
+export function getSandboxMode() {
+    return config.get('sandboxMode') || 'auto';
+}
+/**
+ * Decide whether a shell command should run inside the native OS sandbox.
+ *  - 'use':     native sandbox available and should be used
+ *  - 'skip':    run unsandboxed (mode 'off'/'docker', or 'auto' with no backend)
+ *  - 'require': native sandbox mandated (mode 'native') — caller fails closed
+ *               if no backend is available
+ */
+export function shouldUseNativeSandbox() {
+    const mode = getSandboxMode();
+    if (mode === 'off' || mode === 'docker')
+        return 'skip';
+    if (mode === 'native')
+        return 'require';
+    // 'auto': use if available
+    return isNativeSandboxAvailable() ? 'use' : 'skip';
+}
+/**
+ * Decide which backend to use for sandboxed code execution.
+ *  - 'docker':      mode 'docker', or 'auto' with Docker available
+ *  - 'native':      mode 'native', or 'auto' with only the native backend available
+ *  - 'unsandboxed': mode 'off', or 'auto' with no backend available
+ */
+export function selectCodeSandbox() {
+    const mode = getSandboxMode();
+    if (mode === 'docker')
+        return 'docker';
+    if (mode === 'native')
+        return 'native';
+    if (mode === 'off')
+        return 'unsandboxed';
+    // 'auto': prefer Docker, then the native OS sandbox, else unsandboxed
+    if (isDockerAvailable())
+        return 'docker';
+    if (isNativeSandboxAvailable())
+        return 'native';
+    return 'unsandboxed';
+}
+//# sourceMappingURL=index.js.map

package/dist/sandbox/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,MAAM,MAAM,cAAc,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAI5B,8DAA8D;AAC9D,MAAM,UAAU,cAAc;IAC5B,OAAQ,MAAM,CAAC,GAAG,CAAC,aAAa,CAAiB,IAAI,MAAM,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IACvD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxC,2BAA2B;IAC3B,OAAO,wBAAwB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACvC,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACvC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,aAAa,CAAC;IACzC,sEAAsE;IACtE,IAAI,iBAAiB,EAAE;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,wBAAwB,EAAE;QAAE,OAAO,QAAQ,CAAC;IAChD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/{sandbox-native.d.ts → sandbox/native.d.ts}

@@ -23,6 +23,7 @@ export interface NativeSandboxOptions {
     /** Additional read-write paths to allow */
     readWritePaths?: string[];
 }
+export declare function buildSeatbeltProfile(cwd: string, options?: NativeSandboxOptions): string;
 /**
  * Check if macOS Seatbelt (sandbox-exec) is available
  */
@@ -56,4 +57,4 @@ export declare function executeInNativeSandbox(command: string, cwd: string, opt
  * Reset cached detection results (useful for testing)
  */
 export declare function resetDetectionCache(): void;
-//# sourceMappingURL=sandbox-native.d.ts.map
+//# sourceMappingURL=native.d.ts.map

package/dist/sandbox/native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../../src/sandbox/native.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;AAE9D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0CAA0C;IAC1C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAoDD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,oBAAyB,GACjC,MAAM,CAkER;AASD;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAiB7C;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAa7C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,OAAO,CAElD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,CAIpD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,cAAc,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB,CAyBA;AAcD;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAyB9B;AA0FD;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C"}

package/dist/{sandbox-native.js → sandbox/native.js}

@@ -16,11 +16,32 @@ import * as os from 'os';
  * Defaults:
  *  - deny everything by default
  *  - allow process execution and forking
- *  - allow all file reads (safe; write restriction is the enforcement point)
+ *  - allow broad file reads BUT explicitly deny common secret locations
+ *    (~/.ssh, ~/.aws, ~/.config, ~/.gnupg, ~/.gcloud, *.env) so that even with
+ *    network off a poisoned command cannot read credentials (#133). Seatbelt
+ *    applies the most-specific matching rule, so a (deny file-read*) subpath
+ *    overrides the broad (allow file-read*).
  *  - allow file writes only in: project cwd, /dev (stdout/stderr), temp dirs
  *  - allow file-ioctl (terminal I/O), sysctl-read, mach-lookup, signal
- *  - optionally allow outbound HTTP/HTTPS
+ *  - network is DENIED by default; outbound HTTP/HTTPS is only added when the
+ *    caller explicitly opts in via options.networkEnabled (#133).
  */
+/**
+ * Common secret/credential locations that must never be readable from inside the
+ * sandbox, expressed relative to the user's home directory plus a literal .env
+ * regex. Read denials for these override the broad (allow file-read*).
+ */
+const SECRET_READ_DENY_SUBPATHS = [
+    '.ssh',
+    '.aws',
+    '.config',
+    '.gnupg',
+    '.gcloud',
+    '.config/gcloud',
+    '.kube',
+    '.docker',
+    '.netrc',
+];
 /**
  * Sanitize a path for safe embedding in a Seatbelt profile string.
  * Escapes characters that are significant in the Scheme-like DSL
@@ -34,17 +55,27 @@ function sanitizeSeatbeltPath(p) {
     // Escape backslashes first, then double quotes
     return p.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 }
-function buildSeatbeltProfile(cwd, options = {}) {
+export function buildSeatbeltProfile(cwd, options = {}) {
     const extraReadWrite = options.readWritePaths || [];
     const safeCwd = sanitizeSeatbeltPath(cwd);
     // Build read-write subpath rules for extra paths
     const extraRwRules = extraReadWrite
         .map((p) => `(allow file-write* (subpath "${sanitizeSeatbeltPath(p)}"))`)
         .join('\n');
-    // Network rules
+    // Network rules — DENIED by default; only enabled on explicit opt-in (#133)
     const networkRules = options.networkEnabled
         ? `(allow network-outbound (remote ip "*:443") (remote ip "*:80"))\n(allow network-outbound (remote unix-socket))`
         : '';
+    // Deny reads of well-known secret locations even though reads are broadly
+    // allowed (#133). Seatbelt resolves the most-specific subpath rule, so these
+    // denials win over the broad (allow file-read*) below. We also deny *.env via
+    // a regex so credential files anywhere on disk are not readable.
+    const home = os.homedir();
+    const secretDenyRules = [
+        ...SECRET_READ_DENY_SUBPATHS.map((sub) => `(deny file-read* (subpath "${sanitizeSeatbeltPath(`${home}/${sub}`)}"))`),
+        // Any file whose name ends in .env (e.g. .env, foo.env, .env.production)
+        `(deny file-read* (regex #"\\.env($|\\.)"))`,
+    ].join('\n');
     const profile = `(version 1)
 (deny default)
 
@@ -52,8 +83,9 @@ function buildSeatbeltProfile(cwd, options = {}) {
 (allow process-exec)
 (allow process-fork)
 
-;; File reads: allow broadly (read-only is safe; write restrictions are the enforcement point)
+;; File reads: allow broadly, then deny known secret locations (#133)
 (allow file-read*)
+${secretDenyRules}
 
 ;; File writes: restricted to project directory, temp dirs, and stdout/stderr devices
 (allow file-write*
@@ -289,4 +321,4 @@ export function resetDetectionCache() {
     _seatbeltAvailable = null;
     _landlockAvailable = null;
 }
-//# sourceMappingURL=sandbox-native.js.map
+//# sourceMappingURL=native.js.map

package/dist/sandbox/native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../../src/sandbox/native.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AA2BzB,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;;;;;;;;;;;GAeG;AACH;;;;GAIG;AACH,MAAM,yBAAyB,GAAG;IAChC,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;IACR,SAAS;IACT,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,QAAQ;CACT,CAAC;AACF;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,CAAS;IACrC,qCAAqC;IACrC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,+CAA+C;IAC/C,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,UAAgC,EAAE;IAElC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IAEpD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE1C,iDAAiD;IACjD,MAAM,YAAY,GAAG,cAAc;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC;SACxE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,4EAA4E;IAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc;QACzC,CAAC,CAAC,gHAAgH;QAClH,CAAC,CAAC,EAAE,CAAC;IAEP,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,iEAAiE;IACjE,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,eAAe,GAAG;QACtB,GAAG,yBAAyB,CAAC,GAAG,CAC9B,CAAC,GAAG,EAAE,EAAE,CAAC,8BAA8B,oBAAoB,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,KAAK,CACnF;QACD,yEAAyE;QACzE,4CAA4C;KAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,OAAO,GAAG;;;;;;;;;EAShB,eAAe;;;;;;;;;;cAUH,OAAO;;;;EAInB,YAAY;;;;;;;;;;;EAWZ,YAAY;CACb,CAAC;IAEA,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,IAAI,kBAAkB,GAAmB,IAAI,CAAC;AAC9C,IAAI,kBAAkB,GAAmB,IAAI,CAAC;AAE9C;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,kBAAkB,KAAK,IAAI;QAAE,OAAO,kBAAkB,CAAC;IAE3D,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC/B,kBAAkB,GAAG,KAAK,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,6EAA6E;QAC7E,YAAY,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,kBAAkB,GAAG,IAAI,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,kBAAkB,KAAK,IAAI;QAAE,OAAO,kBAAkB,CAAC;IAE3D,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,kBAAkB,GAAG,KAAK,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,2DAA2D;IAC3D,kBAAkB,GAAG,KAAK,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,mBAAmB,EAAE,IAAI,mBAAmB,EAAE,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,mBAAmB,EAAE;QAAE,OAAO,UAAU,CAAC;IAC7C,IAAI,mBAAmB,EAAE;QAAE,OAAO,UAAU,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAM9B,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,KAAK,MAAM,CAAC;IAErC,IAAI,WAAmB,CAAC;IACxB,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,UAAU;YACb,WAAW,GAAG,kFAAkF,CAAC;YACjG,MAAM;QACR,KAAK,UAAU;YACb,WAAW,GAAG,qDAAqD,CAAC;YACpE,MAAM;QACR,KAAK,MAAM;YACT,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,WAAW,GAAG,6CAA6C,CAAC;YAC9D,CAAC;iBAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAChC,WAAW,GAAG,oEAAoE,CAAC;YACrF,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,mCAAmC,QAAQ,EAAE,CAAC;YAC9D,CAAC;YACD,MAAM;IACV,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,uFAAuF;AACvF,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAElE,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,GAAW,EACX,UAAgC,EAAE;IAElC,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IAEtC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,UAAU;YACb,OAAO,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACpD,KAAK,UAAU;YACb,6DAA6D;YAC7D,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,oEAAoE;gBAC5E,QAAQ,EAAE,CAAC;gBACX,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;QACL,KAAK,MAAM,CAAC;QACZ;YACE,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,gEAAgE;gBACxE,QAAQ,EAAE,CAAC;gBACX,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,GAAW,EACX,UAAgC,EAAE;IAElC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,eAAe,GAAG,KAAK,CAAC;QAE5B,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;YAC1E,GAAG;YACH,OAAO;YACP,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE;YACrC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;oBACpC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;oBAC1C,eAAe,GAAG,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;oBACpC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;oBAC1C,eAAe,GAAG,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YAEpB,IAAI,eAAe;gBAAE,MAAM,IAAI,kBAAkB,CAAC;YAClD,IAAI,eAAe;gBAAE,MAAM,IAAI,kBAAkB,CAAC;YAElD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,CAAC;oBACN,MAAM;oBACN,MAAM,EAAE,MAAM,GAAG,uBAAuB;oBACxC,QAAQ,EAAE,GAAG;oBACb,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,UAAU;iBACpB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC;oBACN,MAAM;oBACN,MAAM;oBACN,QAAQ,EAAE,IAAI,IAAI,CAAC;oBACnB,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,UAAU;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,QAAQ,EAAE,CAAC;gBACX,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,kBAAkB,GAAG,IAAI,CAAC;IAC1B,kBAAkB,GAAG,IAAI,CAAC;AAC5B,CAAC"}

package/dist/scope.d.ts

@@ -32,6 +32,16 @@ declare class ScopeManager {
      * to prevent scope leakage across sessions.
      */
     reset(cwd?: string): void;
+    /**
+     * Resolve a path to its canonical (symlink-free) form before scope checks (#139).
+     *
+     * - If the path exists, returns fs.realpathSync(path). On a realpath error for
+     *   an existing path we fail closed by returning null.
+     * - If the path does not yet exist (e.g. a write target), we canonicalize the
+     *   nearest existing ancestor directory and re-append the remaining segments,
+     *   so a write whose parent dir is a symlink out of scope is screened too.
+     */
+    private canonicalize;
     /**
      * Add a directory to the allowed scope
      */

package/dist/scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,MAAM,WAAW,WAAW;IAC1B,4CAA4C;IAC5C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,gDAAgD;IAChD,SAAS,EAAE,OAAO,CAAC;IACnB,sCAAsC;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,uDAAuD;IACvD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,oDAAoD;IACpD,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAgCD,cAAM,YAAY;IAChB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;;IAcvB;;;;OAIG;IACH,KAAK,CAAC,GAAG,GAAE,MAAsB,GAAG,IAAI;IAQxC;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAyBpE;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAgBvE;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAoDpE;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM;IAkBnD;;OAEG;IACH,cAAc,IAAI,MAAM,EAAE;IAI1B;;OAEG;IACH,eAAe,IAAI,MAAM;IAqBzB;;OAEG;IACH,eAAe,IAAI,MAAM;IAyBzB;;;OAGG;IACH,OAAO,CAAC,cAAc;CAkBvB;AAMD,eAAO,MAAM,YAAY,cAAqB,CAAC;AAM/C,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEjF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEtF;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAEzC"}
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,MAAM,WAAW,WAAW;IAC1B,4CAA4C;IAC5C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,gDAAgD;IAChD,SAAS,EAAE,OAAO,CAAC;IACnB,sCAAsC;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,uDAAuD;IACvD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,oDAAoD;IACpD,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAgCD,cAAM,YAAY;IAChB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;;IAcvB;;;;OAIG;IACH,KAAK,CAAC,GAAG,GAAE,MAAsB,GAAG,IAAI;IAQxC;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IA2BpB;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAyBpE;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAgBvE;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,qBAAqB;IAiFpE;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM;IAkBnD;;OAEG;IACH,cAAc,IAAI,MAAM,EAAE;IAI1B;;OAEG;IACH,eAAe,IAAI,MAAM;IAqBzB;;OAEG;IACH,eAAe,IAAI,MAAM;IAyBzB;;;OAGG;IACH,OAAO,CAAC,cAAc;CAkBvB;AAMD,eAAO,MAAM,YAAY,cAAqB,CAAC;AAM/C,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEjF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAEtF;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAEzC"}

package/dist/scope.js

@@ -43,7 +43,7 @@ class ScopeManager {
         this.config = {
             allowedDirs: [process.cwd()],
             allowHome: false,
-            allowTmp: true,
+            allowTmp: false,
             deniedDirs: [],
             deniedPatterns: [...DEFAULT_DENIED_PATTERNS],
         };
@@ -58,7 +58,43 @@ class ScopeManager {
         this.config.deniedDirs = [];
         this.config.deniedPatterns = [...DEFAULT_DENIED_PATTERNS];
         this.config.allowHome = false;
-        this.config.allowTmp = true;
+        this.config.allowTmp = false;
+    }
+    /**
+     * Resolve a path to its canonical (symlink-free) form before scope checks (#139).
+     *
+     * - If the path exists, returns fs.realpathSync(path). On a realpath error for
+     *   an existing path we fail closed by returning null.
+     * - If the path does not yet exist (e.g. a write target), we canonicalize the
+     *   nearest existing ancestor directory and re-append the remaining segments,
+     *   so a write whose parent dir is a symlink out of scope is screened too.
+     */
+    canonicalize(absPath) {
+        try {
+            return fs.realpathSync(absPath);
+        }
+        catch {
+            // Path (or an ancestor) does not exist, or realpath failed. Walk up to the
+            // nearest existing ancestor, canonicalize it, then re-append the tail.
+        }
+        let current = absPath;
+        const tail = [];
+        while (true) {
+            const parent = path.dirname(current);
+            if (parent === current) {
+                // Reached filesystem root without finding an existing ancestor.
+                return absPath;
+            }
+            tail.unshift(path.basename(current));
+            current = parent;
+            try {
+                const realParent = fs.realpathSync(current);
+                return path.join(realParent, ...tail);
+            }
+            catch {
+                // Keep walking up.
+            }
+        }
     }
     /**
      * Add a directory to the allowed scope
@@ -102,32 +138,56 @@ class ScopeManager {
      */
     isInScope(filePath, baseCwd) {
         const cwd = baseCwd || process.cwd();
-        const absPath = path.isAbsolute(filePath)
+        const lexicalPath = path.isAbsolute(filePath)
             ? path.resolve(filePath)
             : path.resolve(cwd, filePath);
-        const fileName = path.basename(absPath);
-        // Check denied patterns first (match against filename)
+        // Resolve symlinks before any scope/denylist check so an in-scope symlink
+        // cannot point at an out-of-scope target (#139). Fail closed on null.
+        const canonical = this.canonicalize(lexicalPath);
+        if (canonical === null) {
+            return {
+                allowed: false,
+                reason: `Path could not be resolved (possible symlink/realpath failure)`,
+            };
+        }
+        const absPath = canonical;
+        // Check denied patterns against BOTH the lexical name and the canonical
+        // (symlink-resolved) target name, so a benignly-named symlink pointing at a
+        // secret (e.g. notes.txt -> ~/.ssh/id_rsa) is still blocked (#139).
+        const namesToScreen = new Set([
+            path.basename(lexicalPath),
+            path.basename(absPath),
+        ]);
         for (const pattern of this.config.deniedPatterns) {
-            if (this.matchesPattern(fileName, pattern)) {
-                return {
-                    allowed: false,
-                    reason: `File matches denied pattern: ${pattern}`,
-                    suggestedAction: 'This file type is blocked for security reasons.',
-                };
+            for (const name of namesToScreen) {
+                if (this.matchesPattern(name, pattern)) {
+                    return {
+                        allowed: false,
+                        reason: `File matches denied pattern: ${pattern}`,
+                        suggestedAction: 'This file type is blocked for security reasons.',
+                    };
+                }
             }
         }
-        // Check denied directories
+        // Check denied directories. Compare against the canonical form too, since
+        // absPath was symlink-resolved above and the stored dir may be lexical (#139).
         for (const denied of this.config.deniedDirs) {
-            if (absPath.startsWith(denied + path.sep) || absPath === denied) {
+            const canonicalDenied = this.canonicalize(denied) ?? denied;
+            if (absPath.startsWith(denied + path.sep) || absPath === denied ||
+                absPath.startsWith(canonicalDenied + path.sep) || absPath === canonicalDenied) {
                 return {
                     allowed: false,
                     reason: `Path is in denied directory: ${denied}`,
                 };
             }
         }
-        // Check allowed directories
+        // Check allowed directories. Compare against the canonical form of each
+        // allowed dir as well, so symlinked roots (e.g. macOS /var/folders tmp
+        // dirs) still match after the target was symlink-resolved above (#139).
         for (const allowed of this.config.allowedDirs) {
-            if (absPath.startsWith(allowed + path.sep) || absPath === allowed) {
+            const canonicalAllowed = this.canonicalize(allowed) ?? allowed;
+            if (absPath.startsWith(allowed + path.sep) || absPath === allowed ||
+                absPath.startsWith(canonicalAllowed + path.sep) || absPath === canonicalAllowed) {
                 return { allowed: true };
             }
         }
@@ -142,7 +202,7 @@ class ScopeManager {
         return {
             allowed: false,
             reason: `Path is outside allowed scope`,
-            suggestedAction: `Use /add-dir "${path.dirname(absPath)}" to add this directory to scope`,
+            suggestedAction: `Use /scope add "${path.dirname(absPath)}" to add this directory to scope`,
         };
     }
     /**

package/dist/scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope.js","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAyBzB,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,MAAM,uBAAuB,GAAG;IAC9B,MAAM;IACN,YAAY;IACZ,kBAAkB;IAClB,iBAAiB;IACjB,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,OAAO;IACP,OAAO;IACP,UAAU;IACV,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,aAAa;IACb,eAAe;IACf,QAAQ;IACR,SAAS;CACV,CAAC;AAEF,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,MAAM,YAAY;IACR,MAAM,CAAc;IACpB,OAAO,CAAS;IAChB,MAAM,CAAS;IAEvB;QACE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC;QACrE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG;YACZ,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAC5B,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,EAAE;YACd,cAAc,EAAE,CAAC,GAAG,uBAAuB,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;QAC/B,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,CAAC,GAAG,uBAAuB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,OAAe;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,6BAA6B,OAAO,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,OAAO,EAAE,EAAE,CAAC;QACpE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,OAAO,EAAE,EAAE,CAAC;QACrE,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,OAAO,EAAE,EAAE,CAAC;YACvE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,OAAO,EAAE,EAAE,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAe;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,OAAO,EAAE,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,OAAO,EAAE,EAAE,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAgB,EAAE,OAAgB;QAC1C,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YACvC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACxB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAExC,uDAAuD;QACvD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACjD,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC3C,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,gCAAgC,OAAO,EAAE;oBACjD,eAAe,EAAE,iDAAiD;iBACnE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBAChE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,gCAAgC,MAAM,EAAE;iBACjD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,+BAA+B;YACvC,eAAe,EAAE,iBAAiB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,kCAAkC;SAC1F,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,QAAgB,EAAE,GAAW;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YACvC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACxB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,QAAQ,GAAG,kBAAkB,QAAQ,4BAA4B,CAAC;YACtE,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC3B,QAAQ,IAAI,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,MAAM,KAAK,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAClD,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,qBAAqB,CAAC,CAAC;QAEvF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,eAAe;QACb,MAAM,KAAK,GAAG,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;QAE9C,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAEnE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACjD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACK,cAAc,CAAC,QAAgB,EAAE,OAAe;QACtD,cAAc;QACd,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yBAAyB;QACzB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,sDAAsD;YACtD,MAAM,QAAQ,GAAG,OAAO;iBACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;iBACrB,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACxB,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;AAE/C,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,GAAY;IACtD,OAAO,YAAY,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,GAAW;IACxD,OAAO,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC,eAAe,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC,eAAe,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAyBzB,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,MAAM,uBAAuB,GAAG;IAC9B,MAAM;IACN,YAAY;IACZ,kBAAkB;IAClB,iBAAiB;IACjB,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,OAAO;IACP,OAAO;IACP,UAAU;IACV,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,aAAa;IACb,eAAe;IACf,QAAQ;IACR,SAAS;CACV,CAAC;AAEF,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,MAAM,YAAY;IACR,MAAM,CAAc;IACpB,OAAO,CAAS;IAChB,MAAM,CAAS;IAEvB;QACE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC;QACrE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG;YACZ,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAC5B,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,EAAE;YACd,cAAc,EAAE,CAAC,GAAG,uBAAuB,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;QAC/B,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,CAAC,GAAG,uBAAuB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;IAC/B,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,OAAe;QAClC,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,uEAAuE;QACzE,CAAC;QAED,IAAI,OAAO,GAAG,OAAO,CAAC;QACtB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,gEAAgE;gBAChE,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,OAAO,GAAG,MAAM,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;gBAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,mBAAmB;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,OAAe;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,6BAA6B,OAAO,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,OAAO,EAAE,EAAE,CAAC;QACpE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,OAAO,EAAE,EAAE,CAAC;QACrE,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,OAAO,EAAE,EAAE,CAAC;YACvE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,OAAO,EAAE,EAAE,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAe;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,OAAO,EAAE,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,OAAO,EAAE,EAAE,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAgB,EAAE,OAAgB;QAC1C,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC3C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACxB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEhC,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,gEAAgE;aACzE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC;QAE1B,wEAAwE;QACxE,4EAA4E;QAC5E,oEAAoE;QACpE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS;YACpC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;SACvB,CAAC,CAAC;QACH,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACjD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;oBACvC,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,gCAAgC,OAAO,EAAE;wBACjD,eAAe,EAAE,iDAAiD;qBACnE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,+EAA+E;QAC/E,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;YAC5D,IACE,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,MAAM;gBAC3D,OAAO,CAAC,UAAU,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,eAAe,EAC7E,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,gCAAgC,MAAM,EAAE;iBACjD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;YAC/D,IACE,OAAO,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,OAAO;gBAC7D,OAAO,CAAC,UAAU,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,gBAAgB,EAC/E,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,+BAA+B;YACvC,eAAe,EAAE,mBAAmB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,kCAAkC;SAC5F,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,QAAgB,EAAE,GAAW;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YACvC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACxB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,QAAQ,GAAG,kBAAkB,QAAQ,4BAA4B,CAAC;YACtE,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC3B,QAAQ,IAAI,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,MAAM,KAAK,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAClD,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,qBAAqB,CAAC,CAAC;QAEvF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,eAAe;QACb,MAAM,KAAK,GAAG,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;QAE9C,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAEnE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACjD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACK,cAAc,CAAC,QAAgB,EAAE,OAAe;QACtD,cAAc;QACd,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yBAAyB;QACzB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,sDAAsD;YACtD,MAAM,QAAQ,GAAG,OAAO;iBACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;iBACrB,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACxB,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;AAE/C,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,GAAY;IACtD,OAAO,YAAY,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,GAAW;IACxD,OAAO,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC,eAAe,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC,eAAe,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC;AACvC,CAAC"}

package/dist/scuttlebot/client.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Scuttlebot Integration Client
+ *
+ * Main integration point for scuttlebot. Registers via HTTP API, then connects
+ * directly to IRC for all runtime messaging. No HTTP polling.
+ */
+import { type ScuttlebotConfig } from './http-client.js';
+export interface ScuttlebotIntegration {
+    enabled: boolean;
+    config?: ScuttlebotConfig;
+    nick?: string;
+    connected: boolean;
+}
+export declare class ScuttlebotClient {
+    private httpClient;
+    private ircClient;
+    private config;
+    private nick;
+    private enabled;
+    private registeredByClient;
+    private instructionHandler;
+    private presenceTimer;
+    private static readonly PRESENCE_INTERVAL_MS;
+    /**
+     * Initialize from environment variables.
+     *
+     * Flow: resolve config -> register via HTTP -> connect IRC -> send agent.hello.
+     */
+    initialize(sessionId: string, cwd: string): Promise<boolean>;
+    /**
+     * Post a plain text message to the primary channel.
+     */
+    postMessage(text: string): Promise<void>;
+    /**
+     * Post online presence (agent.hello envelope).
+     */
+    postOnline(): Promise<void>;
+    /**
+     * Post offline presence (agent.bye envelope).
+     */
+    postOffline(): Promise<void>;
+    /**
+     * Mirror a tool call as a plain text status message.
+     */
+    mirrorToolCall(toolName: string, args?: unknown): Promise<void>;
+    /**
+     * Mirror assistant message as plain text.
+     */
+    mirrorAssistant(message: string): Promise<void>;
+    /**
+     * Register an instruction handler for incoming tasks/commands.
+     */
+    startPolling(handler: (instruction: string) => void): void;
+    /**
+     * Stop listening for instructions.
+     */
+    stopPolling(): void;
+    /**
+     * Disconnect and cleanup.
+     */
+    disconnect(): Promise<void>;
+    /**
+     * Get integration status.
+     */
+    getStatus(): ScuttlebotIntegration;
+    /**
+     * Check if enabled.
+     */
+    isEnabled(): boolean;
+    private sendHello;
+    private sendBye;
+    /**
+     * Touch presence via HTTP API so the registry marks this agent as online.
+     * Best-effort — skipped silently if no URL/token configured.
+     */
+    private touchPresence;
+    /**
+     * Sanitize secrets from text before posting.
+     */
+    private sanitizeSecrets;
+}
+export declare const scuttlebotClient: ScuttlebotClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/scuttlebot/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/scuttlebot/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA8C/E,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;CACpB;AAsCD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,MAAM,CAAiC;IAC/C,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,kBAAkB,CAAgD;IAC1E,OAAO,CAAC,aAAa,CAA+C;IAEpE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAU;IAEtD;;;;OAIG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwHlE;;OAEG;IACG,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlC;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAcrE;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrD;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAI1D;;OAEG;IACH,WAAW,IAAI,IAAI;IAInB;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAwBjC;;OAEG;IACH,SAAS,IAAI,qBAAqB;IASlC;;OAEG;IACH,SAAS,IAAI,OAAO;IAMpB,OAAO,CAAC,SAAS;IASjB,OAAO,CAAC,OAAO;IASf;;;OAGG;YACW,aAAa;IAK3B;;OAEG;IACH,OAAO,CAAC,eAAe;CAoBxB;AAGD,eAAO,MAAM,gBAAgB,kBAAyB,CAAC"}