@claudexor/core 3.6.0 → 3.8.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (42) hide show
  1. package/dist/adapter.d.ts +16 -2
  2. package/dist/adapter.d.ts.map +1 -1
  3. package/dist/adapter.js.map +1 -1
  4. package/dist/auth-capability-verifier.d.ts.map +1 -1
  5. package/dist/auth-capability-verifier.js +0 -1
  6. package/dist/auth-capability-verifier.js.map +1 -1
  7. package/dist/capabilities.d.ts +9 -2
  8. package/dist/capabilities.d.ts.map +1 -1
  9. package/dist/capabilities.js +22 -2
  10. package/dist/capabilities.js.map +1 -1
  11. package/dist/credential-profile-policy.d.ts +38 -0
  12. package/dist/credential-profile-policy.d.ts.map +1 -0
  13. package/dist/credential-profile-policy.js +67 -0
  14. package/dist/credential-profile-policy.js.map +1 -0
  15. package/dist/errors.d.ts +12 -21
  16. package/dist/errors.d.ts.map +1 -1
  17. package/dist/errors.js +14 -21
  18. package/dist/errors.js.map +1 -1
  19. package/dist/index.d.ts +1 -1
  20. package/dist/index.d.ts.map +1 -1
  21. package/dist/index.js +1 -1
  22. package/dist/index.js.map +1 -1
  23. package/dist/isolation-locator.d.ts +1 -1
  24. package/dist/isolation-locator.js +2 -2
  25. package/dist/isolation-locator.js.map +1 -1
  26. package/dist/model.d.ts.map +1 -1
  27. package/dist/model.js +3 -1
  28. package/dist/model.js.map +1 -1
  29. package/dist/native/claudexor-conpty-helper.exe +0 -0
  30. package/dist/native/claudexor-process-identity +0 -0
  31. package/dist/runloop.d.ts.map +1 -1
  32. package/dist/runloop.js +1 -7
  33. package/dist/runloop.js.map +1 -1
  34. package/dist/runtime-env.d.ts +2 -4
  35. package/dist/runtime-env.d.ts.map +1 -1
  36. package/dist/runtime-env.js +5 -4
  37. package/dist/runtime-env.js.map +1 -1
  38. package/package.json +6 -4
  39. package/dist/confinement.d.ts +0 -75
  40. package/dist/confinement.d.ts.map +0 -1
  41. package/dist/confinement.js +0 -396
  42. package/dist/confinement.js.map +0 -1
@@ -1 +1 @@
1
- {"version":3,"file":"runloop.js","sourceRoot":"","sources":["../src/runloop.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAmB,MAAM,WAAW,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,MAAM,UAAU,mBAAmB,CAAC,IAAoB;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,SAAS,GAAG,MAA8B,CAAC;IACjD,OAAO,OAAO,SAAS,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,gBAAgB,KAAK,UAAU;QAC/F,CAAC,CAAE,MAAsB;QACzB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAyCD,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,aAAa,CAAC,IAAuB;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,EAAE,GAAG,GAAW,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,yBAAyB,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;IAC7C,8EAA8E;IAC9E,iFAAiF;IACjF,IAAI,sBAAsB,GAGf,IAAI,CAAC;IAChB,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;IAEhG,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAA8B,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxD,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE;YACnE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,eAAe;YAChC,WAAW;YACX,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,wBAAwB,EAAE,CAAC,IAAI,EAAE,EAAE;gBACjC,sBAAsB,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpF,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,OAAO;gBACd,CAAC,CAAC;oBACE,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE,CAAC,EAAc,EAAE,EAAE;wBAC1B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;wBAChB,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY;4BAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;oBACtE,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,EAAE,CAAC;YACH,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACzB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACzB,IAAI,UAAU,CAAC,MAAM,GAAG,eAAe;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC5D,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACvB,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC;gBACnB,UAAU,GAAG,EAAE,CAAC,MAAM,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;gBAC1C,yEAAyE;gBACzE,oEAAoE;gBACpE,sBAAsB,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;gBAChF,QAAQ,GAAG,IAAI,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB,IAAI,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5D,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7D,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;wBAAE,QAAQ,GAAG,IAAI,CAAC;oBAC1C,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnE,kEAAkE;gBAClE,gEAAgE;gBAChE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;gBACjB,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,yBAAyB,IAAI,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;oBAAE,QAAQ,GAAG,IAAI,CAAC;gBAC1C,MAAM,GAAG,CAAC;gBACV,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/B,IAAI,GAAG,IAAI,CAAC;oBACZ,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,IAAI;gBAAE,MAAM;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,GAAG,IAAI,CAAC;QAChB,WAAW,GAAG,IAAI,CAAC;QACnB,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACvF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;QAClB,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,kFAAkF;IAClF,iFAAiF;IACjF,0EAA0E;IAC1E,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,kDAAkD,sBAAsB,CAAC,SAAS,CAAC,MAAM,sBACtG,sBAAsB,CAAC,UAAU,CAAC,MAAM;gBACtC,CAAC,CAAC,KAAK,sBAAsB,CAAC,UAAU,CAAC,MAAM,oCAAoC;gBACnF,CAAC,CAAC,EACN,EAAE;SACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;YACxE,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,qBAAqB,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;SACzE,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,EAAE,CAAC;QACpE,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,yBAAyB,UAAU,EAAE;SACrD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,IAAI,oBAAoB,GAAG,CAAC;QAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,oBAAoB,CAAC;IACvF,IAAI,yBAAyB,GAAG,CAAC;QAC/B,OAAO,CAAC,6BAA6B,CAAC,GAAG,yBAAyB,CAAC;IACrE,IAAI,OAAO;QAAE,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACvC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;IACvD,iFAAiF;IACjF,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,CAAC,yBAAyB,CAAC,GAAG;YACnC,SAAS,EAAE,sBAAsB,CAAC,SAAS;YAC3C,UAAU,EAAE,sBAAsB,CAAC,UAAU;SAC9C,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,qEAAqE;IACrE,IAAI,CAAC,OAAO,IAAI,UAAU;QAAE,OAAO,CAAC,aAAa,CAAC,GAAG,UAAU,CAAC;IAChE,IAAI,WAAW;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;IAChD,+EAA+E;IAC/E,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,IAAI,YAAY;QAAE,OAAO,CAAC,aAAa,CAAC,GAAG,YAAY,CAAC;IACxD,MAAM;QACJ,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,EAAE,EAAE,EAAE,EAAE;QACR,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"runloop.js","sourceRoot":"","sources":["../src/runloop.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAmB,MAAM,WAAW,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,MAAM,UAAU,mBAAmB,CAAC,IAAoB;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,SAAS,GAAG,MAA8B,CAAC;IACjD,OAAO,OAAO,SAAS,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,gBAAgB,KAAK,UAAU;QAC/F,CAAC,CAAE,MAAsB;QACzB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAyCD,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,aAAa,CAAC,IAAuB;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,EAAE,GAAG,GAAW,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,yBAAyB,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,UAAU,GAA0B,IAAI,CAAC;IAC7C,8EAA8E;IAC9E,iFAAiF;IACjF,IAAI,sBAAsB,GAGf,IAAI,CAAC;IAChB,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;IAEhG,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAA8B,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,eAAe;YAChC,WAAW;YACX,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,wBAAwB,EAAE,CAAC,IAAI,EAAE,EAAE;gBACjC,sBAAsB,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpF,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,OAAO;gBACd,CAAC,CAAC;oBACE,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE,CAAC,EAAc,EAAE,EAAE;wBAC1B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;wBAChB,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY;4BAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;oBACtE,CAAC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,EAAE,CAAC;YACH,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACzB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACzB,IAAI,UAAU,CAAC,MAAM,GAAG,eAAe;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC5D,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACvB,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC;gBACnB,UAAU,GAAG,EAAE,CAAC,MAAM,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;gBAC1C,yEAAyE;gBACzE,oEAAoE;gBACpE,sBAAsB,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;gBAChF,QAAQ,GAAG,IAAI,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB,IAAI,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5D,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7D,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;wBAAE,QAAQ,GAAG,IAAI,CAAC;oBAC1C,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnE,kEAAkE;gBAClE,gEAAgE;gBAChE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;gBACjB,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,yBAAyB,IAAI,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;oBAAE,QAAQ,GAAG,IAAI,CAAC;gBAC1C,MAAM,GAAG,CAAC;gBACV,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/B,IAAI,GAAG,IAAI,CAAC;oBACZ,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,IAAI;gBAAE,MAAM;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,GAAG,IAAI,CAAC;QAChB,WAAW,GAAG,IAAI,CAAC;QACnB,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACvF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;QAClB,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,kFAAkF;IAClF,iFAAiF;IACjF,0EAA0E;IAC1E,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,kDAAkD,sBAAsB,CAAC,SAAS,CAAC,MAAM,sBACtG,sBAAsB,CAAC,UAAU,CAAC,MAAM;gBACtC,CAAC,CAAC,KAAK,sBAAsB,CAAC,UAAU,CAAC,MAAM,oCAAoC;gBACnF,CAAC,CAAC,EACN,EAAE;SACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;YACxE,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,qBAAqB,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;SACzE,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,EAAE,CAAC;QACpE,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,EAAE,EAAE;YACR,KAAK,EAAE,GAAG,KAAK,yBAAyB,UAAU,EAAE;SACrD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,IAAI,oBAAoB,GAAG,CAAC;QAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,oBAAoB,CAAC;IACvF,IAAI,yBAAyB,GAAG,CAAC;QAC/B,OAAO,CAAC,6BAA6B,CAAC,GAAG,yBAAyB,CAAC;IACrE,IAAI,OAAO;QAAE,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACvC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;IACvD,iFAAiF;IACjF,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,CAAC,yBAAyB,CAAC,GAAG;YACnC,SAAS,EAAE,sBAAsB,CAAC,SAAS;YAC3C,UAAU,EAAE,sBAAsB,CAAC,UAAU;SAC9C,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,qEAAqE;IACrE,IAAI,CAAC,OAAO,IAAI,UAAU;QAAE,OAAO,CAAC,aAAa,CAAC,GAAG,UAAU,CAAC;IAChE,IAAI,WAAW;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;IAChD,+EAA+E;IAC/E,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,IAAI,YAAY;QAAE,OAAO,CAAC,aAAa,CAAC,GAAG,YAAY,CAAC;IACxD,MAAM;QACJ,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,EAAE,EAAE,EAAE,EAAE;QACR,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC"}
@@ -28,10 +28,8 @@ export declare function managedRunnerNodeDir(execPath?: string, platform?: NodeJ
28
28
  * The managed toolchain root under `home`: the notarized Node distribution
29
29
  * Claudexor installs plus the pinned vendor CLI shims (`<home>/.claudexor/node`
30
30
  * — `bin/codex`, `bin/claude`, the `node` that runs them, and their
31
- * `lib/node_modules` payloads). ONE spelling, shared by the harness PATH
32
- * producer below and the delegated confinement's exec carve-out
33
- * (`packages/core/src/confinement.ts`): the launcher resolving a binary from
34
- * here and the sandbox profile allowing its exec must never drift apart.
31
+ * `lib/node_modules` payloads). ONE spelling shared by every harness PATH
32
+ * producer.
35
33
  * Deliberately HOME-anchored, not config-dir-anchored — a
36
34
  * `CLAUDEXOR_CONFIG_DIR` override relocates the runtime root, never the
37
35
  * installed toolchain.
@@ -1 +1 @@
1
- {"version":3,"file":"runtime-env.d.ts","sourceRoot":"","sources":["../src/runtime-env.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAef;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,GAAE,MAAM,CAAC,UAAwB,EACvC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAiCR;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,GAAE,MAAM,CAAC,UAAwB,EACvC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAAC,UAAU,CAEnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,MAAM,CAAC,UAAwB,EACvC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAcf;AAoBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,MAAM,CAAC,UAAwB,EACvC,YAAY,GAAE,SAAS,MAAM,EAAsB,GAClD,MAAM,GAAG,IAAI,CAuDf;AA4CD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAQf"}
1
+ {"version":3,"file":"runtime-env.d.ts","sourceRoot":"","sources":["../src/runtime-env.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAef;AAYD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,GAAE,MAAM,CAAC,UAAwB,EACvC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAoCR;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,GAAE,MAAM,CAAC,UAAwB,EACvC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAAC,UAAU,CAEnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,MAAM,CAAC,UAAwB,EACvC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAcf;AAoBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,MAAM,CAAC,UAAwB,EACvC,YAAY,GAAE,SAAS,MAAM,EAAsB,GAClD,MAAM,GAAG,IAAI,CAuDf;AA4CD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,GAAE,MAAyB,EACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAQf"}
@@ -62,10 +62,8 @@ function dirIsGroupOrWorldWritable(dir) {
62
62
  * The managed toolchain root under `home`: the notarized Node distribution
63
63
  * Claudexor installs plus the pinned vendor CLI shims (`<home>/.claudexor/node`
64
64
  * — `bin/codex`, `bin/claude`, the `node` that runs them, and their
65
- * `lib/node_modules` payloads). ONE spelling, shared by the harness PATH
66
- * producer below and the delegated confinement's exec carve-out
67
- * (`packages/core/src/confinement.ts`): the launcher resolving a binary from
68
- * here and the sandbox profile allowing its exec must never drift apart.
65
+ * `lib/node_modules` payloads). ONE spelling shared by every harness PATH
66
+ * producer.
69
67
  * Deliberately HOME-anchored, not config-dir-anchored — a
70
68
  * `CLAUDEXOR_CONFIG_DIR` override relocates the runtime root, never the
71
69
  * installed toolchain.
@@ -95,6 +93,9 @@ export function normalizedHarnessPath(source = process.env, execPath = process.e
95
93
  : []),
96
94
  join(managedNodeRoot(home), "bin"),
97
95
  join(home, ".local", "bin"),
96
+ // Cursor's vendor installer may choose this legacy vendor-owned prefix
97
+ // instead of ~/.local/bin; discovery and execution must resolve either.
98
+ join(home, ".cursor", "bin"),
98
99
  join(home, ".npm-global", "bin"),
99
100
  join(home, ".bun", "bin"),
100
101
  "/opt/homebrew/bin",
@@ -1 +1 @@
1
- {"version":3,"file":"runtime-env.js","sourceRoot":"","sources":["../src/runtime-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjE,yEAAyE;IACzE,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,6EAA6E;IAC7E,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,gFAAgF;IAChF,IAAI,QAAQ,KAAK,OAAO,IAAI,yBAAyB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;gFACgF;AAChF,SAAS,yBAAyB,CAAC,GAAW;IAC5C,IAAI,CAAC;QACH,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAM,GAAsB,OAAO,CAAC,GAAG,EACvC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG;QAChB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,2EAA2E;QAC3E,6EAA6E;QAC7E,GAAG,CAAC,MAAM,CAAC,wBAAwB,KAAK,GAAG;YACzC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACvD,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC;QAChC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC;QACzB,mBAAmB;QACnB,gBAAgB;QAChB,UAAU;QACV,MAAM;QACN,WAAW;QACX,OAAO;KACR,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC;SAChC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAChB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAAM,GAAsB,OAAO,CAAC,GAAG,EACvC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,MAAM,GAAsB,OAAO,CAAC,GAAG,EACvC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,IAAI,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAAE,OAAO,SAAS,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAE3D,SAAS,oBAAoB,CAAC,GAAW,EAAE,QAAyB;IAClE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,eAAe,EAAE,YAAY,EAAE,4BAA4B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,MAAM,GAAsB,OAAO,CAAC,GAAG,EACvC,YAAY,GAAsB,iBAAiB;IAEnD,IAAI,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GACb,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC;QAChC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;aAC1B,KAAK,CAAC,SAAS,CAAC;aAChB,MAAM,CAAC,OAAO,CAAC;aACf,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC5B,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,gBAAgB,MAAM,GAAG,CAAC;QAClF,MAAM,GAAG,GACP,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAC1C,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,IAAI,KAAK,KAAK;gBACd,CAAC,CAAC,iCAAiC;gBACnC,CAAC,CAAC,sBAAsB,CAAC;QAC/B,MAAM,GAAG,GACP,eAAe,CAAC,MAAM,IAAI,SAAS,CAAC;YACpC,aAAa,IAAI,oDAAoD,CAAC;QACxE,OAAO,GAAG,KAAK,eAAe,GAAG,MAAM,GAAG,EAAE,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI;gBAAE,SAAS;YAClD,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,mFAAmF,IAAI,0CAA0C,CAAC;QAC7J,CAAC;IACH,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;YACzB,CAAC,UAAU,EAAE,SAAS,CAAC;YACvB,CAAC,QAAQ,EAAE,EAAE,CAAC;SACN,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACrC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC7B,oEAAoE;gBACpE,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC;oBAC9B,CAAC,CAAC,2BAA2B,GAAG,iBAAiB;oBACjD,CAAC,CAAC,2CAA2C,CAAC;gBAChD,OAAO,wBAAwB,IAAI,kBAAkB,GAAG,SAAS,QAAQ,0CAA0C,IAAI,IAAI,IAAI,KAAK,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7L,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;6EAE6E;AAC7E,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD;;yCAEyC;AACzC,SAAS,SAAS,CAAC,OAAe,EAAE,IAA2B;IAC7D,MAAM,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED,2EAA2E;AAC3E,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5C,IAAI,IAAI;QAAE,OAAO,+BAA+B,IAAI,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO;QAAE,OAAO,wBAAwB,OAAO,IAAI,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GACV,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;QACjC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACrC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,WAAW,QAAQ,yIAAyI,CAAC;AACtK,CAAC"}
1
+ {"version":3,"file":"runtime-env.js","sourceRoot":"","sources":["../src/runtime-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjE,yEAAyE;IACzE,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,6EAA6E;IAC7E,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,gFAAgF;IAChF,IAAI,QAAQ,KAAK,OAAO,IAAI,yBAAyB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;gFACgF;AAChF,SAAS,yBAAyB,CAAC,GAAW;IAC5C,IAAI,CAAC;QACH,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAM,GAAsB,OAAO,CAAC,GAAG,EACvC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG;QAChB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,2EAA2E;QAC3E,6EAA6E;QAC7E,GAAG,CAAC,MAAM,CAAC,wBAAwB,KAAK,GAAG;YACzC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACvD,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC;QAC3B,uEAAuE;QACvE,wEAAwE;QACxE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC;QAChC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC;QACzB,mBAAmB;QACnB,gBAAgB;QAChB,UAAU;QACV,MAAM;QACN,WAAW;QACX,OAAO;KACR,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC;SAChC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAChB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAAM,GAAsB,OAAO,CAAC,GAAG,EACvC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,MAAM,GAAsB,OAAO,CAAC,GAAG,EACvC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,IAAI,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAAE,OAAO,SAAS,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAE3D,SAAS,oBAAoB,CAAC,GAAW,EAAE,QAAyB;IAClE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,eAAe,EAAE,YAAY,EAAE,4BAA4B,CAAC,CAAC;AAExF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,MAAM,GAAsB,OAAO,CAAC,GAAG,EACvC,YAAY,GAAsB,iBAAiB;IAEnD,IAAI,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GACb,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC;QAChC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;aAC1B,KAAK,CAAC,SAAS,CAAC;aAChB,MAAM,CAAC,OAAO,CAAC;aACf,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC5B,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,gBAAgB,MAAM,GAAG,CAAC;QAClF,MAAM,GAAG,GACP,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAC1C,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,IAAI,KAAK,KAAK;gBACd,CAAC,CAAC,iCAAiC;gBACnC,CAAC,CAAC,sBAAsB,CAAC;QAC/B,MAAM,GAAG,GACP,eAAe,CAAC,MAAM,IAAI,SAAS,CAAC;YACpC,aAAa,IAAI,oDAAoD,CAAC;QACxE,OAAO,GAAG,KAAK,eAAe,GAAG,MAAM,GAAG,EAAE,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI;gBAAE,SAAS;YAClD,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,mFAAmF,IAAI,0CAA0C,CAAC;QAC7J,CAAC;IACH,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;YACzB,CAAC,UAAU,EAAE,SAAS,CAAC;YACvB,CAAC,QAAQ,EAAE,EAAE,CAAC;SACN,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACrC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC7B,oEAAoE;gBACpE,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC;oBAC9B,CAAC,CAAC,2BAA2B,GAAG,iBAAiB;oBACjD,CAAC,CAAC,2CAA2C,CAAC;gBAChD,OAAO,wBAAwB,IAAI,kBAAkB,GAAG,SAAS,QAAQ,0CAA0C,IAAI,IAAI,IAAI,KAAK,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7L,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;6EAE6E;AAC7E,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD;;yCAEyC;AACzC,SAAS,SAAS,CAAC,OAAe,EAAE,IAA2B;IAC7D,MAAM,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED,2EAA2E;AAC3E,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5C,IAAI,IAAI;QAAE,OAAO,+BAA+B,IAAI,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO;QAAE,OAAO,wBAAwB,OAAO,IAAI,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAQ,GAAW,OAAO,CAAC,QAAQ,EACnC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GACV,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;QACjC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACrC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,WAAW,QAAQ,yIAAyI,CAAC;AACtK,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@claudexor/core",
3
- "version": "3.6.0",
3
+ "version": "3.8.1",
4
4
  "license": "MIT",
5
5
  "description": "HarnessAdapter contract, process helpers, typed errors, and low-level execution utilities.",
6
6
  "type": "module",
@@ -20,8 +20,8 @@
20
20
  ],
21
21
  "dependencies": {
22
22
  "@playwright/mcp": "0.0.78",
23
- "@claudexor/schema": "3.6.0",
24
- "@claudexor/util": "3.6.0"
23
+ "@claudexor/schema": "3.8.1",
24
+ "@claudexor/util": "3.8.1"
25
25
  },
26
26
  "repository": {
27
27
  "type": "git",
@@ -39,8 +39,10 @@
39
39
  "access": "public"
40
40
  },
41
41
  "scripts": {
42
- "build": "tsc && node scripts/build-darwin-process-identity.mjs",
42
+ "build": "tsc && node scripts/build-darwin-process-identity.mjs && node scripts/build-win32-conpty-helper.mjs",
43
43
  "build:darwin-helper": "node scripts/build-darwin-process-identity.mjs",
44
+ "build:win32-helper": "node scripts/build-win32-conpty-helper.mjs --require",
45
+ "build:win32-fixtures": "node scripts/build-win32-conpty-helper.mjs --require --with-test-child",
44
46
  "typecheck": "tsc --noEmit"
45
47
  }
46
48
  }
@@ -1,75 +0,0 @@
1
- import type { HarnessConfinement } from "@claudexor/schema";
2
- export interface ConfinementInput {
3
- /** The operator's REAL home — the thing the child must not be able to mine. */
4
- operatorHome: string;
5
- /** Claudexor's runtime tree: daemon token/socket, trust, every project's state. */
6
- runtimeRoot: string;
7
- /** Vendor credential state the harness itself authenticates out of (§8 carve-out). */
8
- nativeStateRoot: string;
9
- /** This attempt's scoped HOME. */
10
- scopedHome: string;
11
- /** This attempt's worktree (its cwd). */
12
- worktree: string;
13
- /** Scratch root the toolchain writes to; defaults to the process TMPDIR. */
14
- tmpDir?: string;
15
- }
16
- /**
17
- * The host the boundary is being applied ON. Injectable so the platform
18
- * branches are TESTABLE without booting that platform: the availability probe
19
- * and every exec go through here.
20
- */
21
- export interface ConfinementHost {
22
- platform: NodeJS.Platform;
23
- exists(path: string): boolean;
24
- run(bin: string, args: readonly string[]): {
25
- status: number | null;
26
- stderr?: string;
27
- };
28
- }
29
- /**
30
- * The paths this profile must make unreadable. Also the probe surface: the
31
- * boundary is verified by trying to read the FIRST of them.
32
- */
33
- export declare function confinementDeniedReadPaths(input: ConfinementInput): string[];
34
- /** Kept for the seam tests and the docs: the macOS policy text for one attempt. */
35
- export declare function buildConfinementProfile(input: ConfinementInput): string;
36
- /**
37
- * The one question a caller outside this file may ask about the host.
38
- *
39
- * Deliberately NOT "which mechanism": the routing decision that depends on this
40
- * — whether to tell the adapter to stand its own sandbox down — turns on
41
- * whether Claudexor will actually provide a boundary, never on which one or on
42
- * the platform's name.
43
- */
44
- export declare function confinementBoundaryAvailable(host?: ConfinementHost): {
45
- available: boolean;
46
- reason: string | null;
47
- };
48
- /** What one attempt's boundary turned out to be: applied, or absent and why. */
49
- export interface ConfinementOutcome {
50
- /** The APPLIED boundary, or null when this host has none. */
51
- confinement: HarnessConfinement | null;
52
- /** Why no boundary was applied; null exactly when one was. */
53
- unavailableReason: string | null;
54
- }
55
- /**
56
- * Build, verify and describe the boundary for one attempt.
57
- *
58
- * Degrades HONESTLY where the platform offers nothing — the run proceeds and
59
- * the outcome carries the reason, which the caller writes onto the attempt,
60
- * into the child's prompt and into its own result. It never degrades SILENTLY,
61
- * and it never names a mechanism it did not just prove on this host.
62
- *
63
- * Still refuses for the three conditions that are Claudexor's own layout or
64
- * this host's rather than the platform's: an allowed root that swallows a
65
- * denied one, a host where no denied path exists so nothing can be proven
66
- * denied, and a policy that a working mechanism failed to enforce for this
67
- * attempt.
68
- */
69
- export declare function applyConfinement(input: ConfinementInput, host?: ConfinementHost): ConfinementOutcome;
70
- /** Rewrite an argv so the child (and every descendant) starts inside the boundary. */
71
- export declare function confinedInvocation(confinement: HarnessConfinement | null | undefined, bin: string, args: readonly string[]): {
72
- bin: string;
73
- args: string[];
74
- };
75
- //# sourceMappingURL=confinement.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"confinement.d.ts","sourceRoot":"","sources":["../src/confinement.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAgD5D,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,eAAe,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvF;AAkID;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAQ5E;AA8DD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAEvE;AA6HD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,GAAE,eAA8B,GAAG;IAClF,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAGA;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,gBAAgB,EACvB,IAAI,GAAE,eAA8B,GACnC,kBAAkB,CA8CpB;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,EAClD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAWjC"}
@@ -1,396 +0,0 @@
1
- import { spawnSync } from "node:child_process";
2
- import { existsSync, realpathSync } from "node:fs";
3
- import { dirname, join, relative, sep } from "node:path";
4
- import { sensitiveResourcePolicy, sha256 } from "@claudexor/util";
5
- import { ConfinementUnavailableError } from "./errors.js";
6
- import { managedNodeRoot } from "./runtime-env.js";
7
- /**
8
- * OS-enforced filesystem confinement for a delegated harness process.
9
- *
10
- * WHY THIS IS NOT AN ENV VAR. A scoped `HOME` redirects `~`-relative lookups
11
- * and nothing else; `/Users/<op>/.claudexor/v3/daemon/token` — a bearer for the
12
- * whole control API — stays one absolute path away. The threat model, the
13
- * live reproduction and the list of what this does NOT cover are in
14
- * docs/DELEGATED_CONFINEMENT.md; keep them in step with this file.
15
- *
16
- * WHY THE HARNESS SANDBOX STANDS DOWN. macOS refuses `sandbox_apply` inside an
17
- * already-restricted process (measured: any deny clause in the outer profile is
18
- * enough), and codex shells out to `/usr/bin/sandbox-exec` for its own
19
- * workspace-write sandbox. An outer boundary and the harness's own are
20
- * mutually exclusive, so the engine states `external_sandbox_full` — the
21
- * access profile that already means "I am providing the sandbox" — and each
22
- * adapter maps that onto its own switch. No harness name is branched on. That
23
- * stand-down is spent ONLY where a boundary was actually proven available: a
24
- * host with none keeps whatever enforcement the harness brings itself.
25
- *
26
- * WHERE THERE IS NO BOUNDARY — every platform but macOS, by owner decision, and
27
- * a macOS host missing `sandbox-exec`. The run still runs, on the scoped `HOME`
28
- * alone. It does not pretend: the absence and its reason are recorded on the
29
- * attempt, told to the child, and returned to the caller. Refusing instead would
30
- * make "delegated" a macOS-only feature; claiming a boundary we did not prove
31
- * would be worse than having none, so the type below cannot express a mechanism
32
- * name without the path it was proven to deny.
33
- */
34
- const SEATBELT_BIN = "/usr/bin/sandbox-exec";
35
- /** System prefixes a workspace-scoped run has no business writing to. */
36
- const SYSTEM_WRITE_DENY = [
37
- "/usr",
38
- "/opt",
39
- "/Library",
40
- "/Applications",
41
- "/System",
42
- "/bin",
43
- "/sbin",
44
- "/etc",
45
- "/var",
46
- ];
47
- const DEFAULT_HOST = {
48
- platform: process.platform,
49
- exists: existsSync,
50
- run: (bin, args) => spawnSync(bin, [...args], { encoding: "utf8", timeout: 15_000 }),
51
- };
52
- /**
53
- * Seatbelt matches RESOLVED paths (`/tmp` is `/private/tmp`), so a profile
54
- * written against the symlinked spelling silently allows what it names.
55
- * Resolution falls back to the literal for a path that does not exist yet —
56
- * a deny on a not-yet-created path is still worth emitting.
57
- */
58
- function resolved(path) {
59
- try {
60
- return realpathSync.native(path);
61
- }
62
- catch {
63
- return path;
64
- }
65
- }
66
- /** Whether `root` is `path` or an ancestor of it, after resolution. */
67
- function contains(root, path) {
68
- const rel = relative(resolved(root), resolved(path));
69
- return rel === "" || (!rel.startsWith("..") && !rel.startsWith(sep) && !/^[A-Za-z]:/.test(rel));
70
- }
71
- function subpath(paths) {
72
- return paths.map((path) => `(subpath ${JSON.stringify(resolved(path))})`).join(" ");
73
- }
74
- function literal(paths) {
75
- return paths.map((path) => `(literal ${JSON.stringify(resolved(path))})`).join(" ");
76
- }
77
- /**
78
- * The strict ancestors of the run's OWN roots that lie INSIDE the denied
79
- * runtime root: for each own root, `dirname(root)` walking up to and including
80
- * `runtimeRoot` itself, deduplicated in first-encounter order.
81
- *
82
- * WHY THESE NEED A METADATA CARVE-OUT. Path canonicalization — libc
83
- * `realpath(3)`, Rust `fs::canonicalize`, SQLite's unix VFS full-path
84
- * resolution — lstat/readlinks every intermediate path component. The
85
- * own-roots allow re-opens each root's SUBTREE, but the components BETWEEN
86
- * the runtime root and the root still match the runtime-root read deny, so
87
- * the walk dies with EPERM before the harness runs a single turn. Measured
88
- * live on two different own roots: codex canonicalizes its CODEX_HOME under
89
- * the native state root at startup (2026-08-10, `failed to canonicalize
90
- * CODEX_HOME`), and cursor-agent opens its SQLite chat store under the scoped
91
- * HOME, whose open canonicalizes the database path (2026-08-15,
92
- * `RetriableError: [internal] unable to open database file`, SQLITE_CANTOPEN,
93
- * 100% of mutating delegated cursor runs). These directories get
94
- * `file-read-metadata` on the LITERAL path only: stat/readlink of the
95
- * directory entry itself, never the data of any file under the runtime root
96
- * and never a directory listing (readdir is a data read on the directory).
97
- */
98
- function ownRootTraversalAncestors(input) {
99
- const root = resolved(input.runtimeRoot);
100
- const chain = [];
101
- for (const ownRoot of ownRoots(input)) {
102
- let current = dirname(resolved(ownRoot));
103
- // An already-collected ancestor proves the rest of its chain up to the
104
- // runtime root was collected with it, so the walk can stop there.
105
- while (contains(root, current) && !chain.includes(current)) {
106
- chain.push(current);
107
- if (current === root)
108
- break;
109
- const parent = dirname(current);
110
- if (parent === current)
111
- break; // filesystem root; cannot ascend further
112
- current = parent;
113
- }
114
- }
115
- return chain;
116
- }
117
- /**
118
- * The managed toolchain subtree (`<operator home>/.claudexor/node` — the Node
119
- * distribution plus the pinned vendor CLI shims), WHEN it lies inside the
120
- * denied runtime root. Null when it does not — nothing denies it there, so a
121
- * carve-out would be a no-op, mirroring the own-roots traversal pattern above.
122
- *
123
- * WHY THIS NEEDS A READ+EXEC CARVE-OUT. In the DEFAULT layout the runtime
124
- * root IS `~/.claudexor`, so the very binaries the spawn layer resolves for
125
- * the child (`~/.claudexor/node/bin/codex`, the `node` that runs them, their
126
- * `lib/node_modules` payloads) sit inside the read-denied tree — and exec IS
127
- * a read: the kernel refuses execvp of a binary the profile makes unreadable.
128
- * Measured live in the 3.3.15 VM battery (default config, phase 13):
129
- * `sandbox-exec: execvp() of '<runtime root>/node/bin/codex' failed:
130
- * Operation not permitted`, exit 71, before the harness ran an instruction.
131
- * The development-host smoke missed it because scratch mode relocates the
132
- * config root, putting the toolchain outside the denied tree.
133
- *
134
- * The subtree holds no secrets (a Node distribution and CLI shims), so it
135
- * gets a full `file-read*` allow — data, metadata and listings — which is
136
- * what execvp, `#!/usr/bin/env node` shim resolution and the CLI's own
137
- * resource loads need. It does NOT re-open writes: the later operator-home
138
- * write deny still covers the toolchain, so a confined child cannot trojan
139
- * the shims the operator's own daemon executes. The path is derived from the
140
- * same helper the launcher's PATH producer uses (`managedNodeRoot`), keyed on
141
- * the operator home — the anchor `composeBaseEnv` resolves binaries against —
142
- * so the profile and the spawn layer cannot drift apart.
143
- */
144
- function managedToolchainSubtree(input) {
145
- const toolchain = managedNodeRoot(input.operatorHome);
146
- return contains(input.runtimeRoot, toolchain) ? toolchain : null;
147
- }
148
- /**
149
- * The paths this profile must make unreadable. Also the probe surface: the
150
- * boundary is verified by trying to read the FIRST of them.
151
- */
152
- export function confinementDeniedReadPaths(input) {
153
- return [
154
- join(input.runtimeRoot, "daemon"),
155
- input.runtimeRoot,
156
- ...sensitiveResourcePolicy
157
- .homeRelativeCredentialEntries()
158
- .map((entry) => join(input.operatorHome, entry)),
159
- ];
160
- }
161
- /** The run's own roots: allowed, and the reason the deny set needs carve-outs. */
162
- function ownRoots(input) {
163
- return [input.scopedHome, input.worktree, input.nativeStateRoot];
164
- }
165
- /** macOS: kernel-enforced per-path denial for the process and every descendant. */
166
- const SEATBELT = {
167
- id: "seatbelt",
168
- platform: "darwin",
169
- bins: [SEATBELT_BIN],
170
- /** SBPL text. Last match wins, so the carve-outs follow the denies. */
171
- buildProfile(input) {
172
- const scratch = input.tmpDir ?? process.env.TMPDIR ?? "/tmp";
173
- const traversal = ownRootTraversalAncestors(input);
174
- const toolchain = managedToolchainSubtree(input);
175
- // SBPL is last-match-wins, and the order below is the policy. The scratch
176
- // allow sits ABOVE the operator-home deny on purpose: a `TMPDIR` configured
177
- // inside `$HOME` would otherwise re-open the whole home for writing. The run's
178
- // own roots come last because they outrank every deny above them, including
179
- // the case where the worktree lives inside the operator's home (isolation:
180
- // live, which is exactly the delegated shape). The two read carve-outs sit
181
- // directly AFTER the read deny they punch through, and BEFORE the write
182
- // section so neither can outrank a write deny: literal-only stat/readlink
183
- // on the own roots' intermediate directories, so `realpath(CODEX_HOME)` and
184
- // cursor's SQLite open under the scoped HOME work while file data and
185
- // directory listings under the runtime root stay denied (see
186
- // ownRootTraversalAncestors); then a full read allow on the
187
- // managed toolchain subtree, so the child can exec the very binaries the
188
- // spawn layer resolved for it (see managedToolchainSubtree). Writes to the
189
- // toolchain stay denied by the operator-home deny below.
190
- return [
191
- "(version 1)",
192
- "(allow default)",
193
- `(deny file-read* ${subpath(confinementDeniedReadPaths(input))})`,
194
- ...(traversal.length ? [`(allow file-read-metadata ${literal(traversal)})`] : []),
195
- ...(toolchain ? [`(allow file-read* ${subpath([toolchain])})`] : []),
196
- `(deny file-write* ${subpath([...SYSTEM_WRITE_DENY])})`,
197
- `(allow file-write* ${subpath([scratch, "/tmp"])})`,
198
- `(deny file-write* ${subpath([input.operatorHome])})`,
199
- `(allow file-read* file-write* ${subpath(ownRoots(input))})`,
200
- "",
201
- ].join("\n");
202
- },
203
- invocation(profile, bin, args) {
204
- return { bin: SEATBELT_BIN, args: ["-p", profile, bin, ...args] };
205
- },
206
- };
207
- /**
208
- * The registry. ONE mechanism today, by owner decision: Seatbelt on macOS, and
209
- * NO kernel boundary anywhere else. Linux bubblewrap/Landlock and a Windows
210
- * equivalent were considered and declined — see docs/DELEGATED_CONFINEMENT.md §6.
211
- * Non-macOS is served by the scoped HOME plus a disclosed, typed absence, which
212
- * is what the rest of this file and the delegated terminal are shaped around.
213
- *
214
- * The list stays a list because the mechanism id is OPAQUE end to end: the only
215
- * place a name selects behaviour is the lookup in `confinedInvocation`.
216
- */
217
- const MECHANISMS = [SEATBELT];
218
- /** Kept for the seam tests and the docs: the macOS policy text for one attempt. */
219
- export function buildConfinementProfile(input) {
220
- return SEATBELT.buildProfile(input, SEATBELT_BIN);
221
- }
222
- /** Read `probePath` from inside the policy, the way the harness child would. */
223
- function readUnder(mechanism, profile, probePath, host) {
224
- const invocation = mechanism.invocation(profile, "/bin/ls", [probePath]);
225
- return host.run(invocation.bin, invocation.args);
226
- }
227
- /** A trimmed, bounded stderr tail for a probe's failure reason. */
228
- function describeProbeFault(stderr) {
229
- return stderr && stderr.trim() ? ` (${stderr.trim().slice(0, 200)})` : "";
230
- }
231
- /**
232
- * stderr signatures of the SANDBOX ITSELF failing to launch or apply the
233
- * profile — a refused `sandbox_apply`, a profile that would not compile/parse —
234
- * as opposed to the wrapped program running and hitting a real policy deny.
235
- * `sandbox-exec` prefixes its OWN failures with `sandbox-exec:` and never runs
236
- * the wrapped tool; a denied read instead surfaces from the tool itself
237
- * (`ls: <path>: Operation not permitted`). A nonzero exit carrying one of these
238
- * is infrastructure, not proof.
239
- */
240
- const SANDBOX_APPLICATION_FAULT_RE = /sandbox-exec:|sandbox_apply|sandbox_compile|failed to (parse|compile|apply|initialize)|could not (parse|compile)|error parsing/i;
241
- function isSandboxApplicationFault(stderr) {
242
- return typeof stderr === "string" && SANDBOX_APPLICATION_FAULT_RE.test(stderr);
243
- }
244
- /**
245
- * Prove the policy denies, on THIS host, before anything runs under it.
246
- *
247
- * Returns the reason it could NOT be proven, or null when it was. A policy that
248
- * fails to compile, that a launcher refuses to apply, or that a future OS
249
- * quietly stops enforcing, would otherwise produce a run that records a false
250
- * `verified_denied_path` and reports `confined` when it is not.
251
- *
252
- * Three guards, because a nonzero exit alone means nothing:
253
- * NEGATIVE control — the denied path must be readable UNCONFINED, or an
254
- * ENOENT there would masquerade as a policy deny.
255
- * POSITIVE control — an ALLOWED path must stay readable UNDER the sandbox. If
256
- * it does not, the sandbox never applied (failed `sandbox_apply`, a profile
257
- * that would not compile), so any subsequent "deny" is the launcher
258
- * failing, not the policy denying. This is the guard the audit was missing.
259
- * FAULT discrimination — even with the sandbox applied, a nonzero exit whose
260
- * stderr is a launch/application fault, or that never completed, is never
261
- * recorded as proof. Only an explained nonzero (positive control passed, no
262
- * fault signature, path proven readable unconfined) is a real deny.
263
- */
264
- function proveConfinementDenial(mechanism, profile, probePath, allowedControlPaths, host) {
265
- // NEGATIVE CONTROL.
266
- if (host.run("/bin/ls", [probePath]).status !== 0) {
267
- return `the probe path ${probePath} is not readable even unconfined, so a denial there proves nothing`;
268
- }
269
- // POSITIVE CONTROL. Pick an allowed path that is readable unconfined, then
270
- // require it to STAY readable under the sandbox. A failure here is the sandbox
271
- // not applying, not the policy working.
272
- const control = allowedControlPaths
273
- .map((path) => resolved(path))
274
- .find((path) => host.run("/bin/ls", [path]).status === 0);
275
- if (!control) {
276
- return `no allowed control path was readable unconfined, so the ${mechanism.id} sandbox application could not be confirmed`;
277
- }
278
- const positive = readUnder(mechanism, profile, control, host);
279
- if (positive.status !== 0) {
280
- return `the ${mechanism.id} sandbox did not apply: the allowed control path ${control} was not readable under it${describeProbeFault(positive.stderr)}`;
281
- }
282
- // THE TEST: the denied path must now be denied under the proven-applied sandbox.
283
- const probe = readUnder(mechanism, profile, probePath, host);
284
- if (probe.status === 0)
285
- return `${probePath} stayed readable under the ${mechanism.id} policy`;
286
- if (isSandboxApplicationFault(probe.stderr)) {
287
- return `the ${mechanism.id} probe hit a sandbox application fault, not a policy deny${describeProbeFault(probe.stderr)}`;
288
- }
289
- if (probe.status === null) {
290
- return `the ${mechanism.id} probe did not complete${describeProbeFault(probe.stderr)}`;
291
- }
292
- return null;
293
- }
294
- /**
295
- * Whether an OS-enforced boundary exists on this host, and which one.
296
- *
297
- * A platform with no mechanism is a DECISION, not a gap to be discovered at
298
- * spawn time, so the answer is a stated reason rather than a throw. Nothing here
299
- * hunts for a boundary the owner declined to build: the question is only whether
300
- * THIS platform's declared mechanism is present.
301
- */
302
- function confinementMechanism(host) {
303
- const mechanism = MECHANISMS.find((candidate) => candidate.platform === host.platform);
304
- if (!mechanism) {
305
- return {
306
- mechanism: null,
307
- bin: null,
308
- reason: `Claudexor applies no OS-enforced filesystem boundary on ${host.platform}; only macOS has one`,
309
- };
310
- }
311
- const bin = mechanism.bins.find((candidate) => host.exists(candidate));
312
- if (!bin) {
313
- return {
314
- mechanism: null,
315
- bin: null,
316
- reason: `${host.platform} enforces a boundary with ${mechanism.id}, which is not installed here (looked for ${mechanism.bins.join(", ")})`,
317
- };
318
- }
319
- return { mechanism, bin, reason: null };
320
- }
321
- /**
322
- * The one question a caller outside this file may ask about the host.
323
- *
324
- * Deliberately NOT "which mechanism": the routing decision that depends on this
325
- * — whether to tell the adapter to stand its own sandbox down — turns on
326
- * whether Claudexor will actually provide a boundary, never on which one or on
327
- * the platform's name.
328
- */
329
- export function confinementBoundaryAvailable(host = DEFAULT_HOST) {
330
- const availability = confinementMechanism(host);
331
- return { available: availability.mechanism !== null, reason: availability.reason };
332
- }
333
- /**
334
- * Build, verify and describe the boundary for one attempt.
335
- *
336
- * Degrades HONESTLY where the platform offers nothing — the run proceeds and
337
- * the outcome carries the reason, which the caller writes onto the attempt,
338
- * into the child's prompt and into its own result. It never degrades SILENTLY,
339
- * and it never names a mechanism it did not just prove on this host.
340
- *
341
- * Still refuses for the three conditions that are Claudexor's own layout or
342
- * this host's rather than the platform's: an allowed root that swallows a
343
- * denied one, a host where no denied path exists so nothing can be proven
344
- * denied, and a policy that a working mechanism failed to enforce for this
345
- * attempt.
346
- */
347
- export function applyConfinement(input, host = DEFAULT_HOST) {
348
- const denied = confinementDeniedReadPaths(input);
349
- // The carve-outs re-open whatever they contain, so an "own root" that CONTAINS
350
- // a denied path silently defeats the policy. This contradiction is Claudexor's
351
- // own layout being wrong, not a platform fact, so it is refused BEFORE the
352
- // host is asked whether it can enforce anything: a host with no boundary must
353
- // not turn a self-defeating policy into a quiet scoped-HOME run. Refuse rather
354
- // than emit one that reads like a boundary and is not.
355
- const swallowed = ownRoots(input).find((root) => denied.some((path) => path !== root && contains(root, path)));
356
- if (swallowed) {
357
- throw new ConfinementUnavailableError(`filesystem confinement would be self-defeating: the allowed root ${swallowed} contains a path the policy must deny`);
358
- }
359
- const available = confinementMechanism(host);
360
- if (!available.mechanism)
361
- return { confinement: null, unavailableReason: available.reason };
362
- const profile = available.mechanism.buildProfile(input, available.bin);
363
- const probeCandidate = denied.find((path) => host.exists(path));
364
- if (!probeCandidate) {
365
- throw new ConfinementUnavailableError("filesystem confinement could not be verified: none of the denied paths exists on this host, so the policy cannot be proven to deny anything");
366
- }
367
- const probePath = resolved(probeCandidate);
368
- // The run's own allow-listed roots double as the positive-control surface:
369
- // one of them staying readable under the sandbox is what proves the profile
370
- // actually applied before any denial is credited.
371
- const why = proveConfinementDenial(available.mechanism, profile, probePath, ownRoots(input), host);
372
- if (why)
373
- throw new ConfinementUnavailableError(`filesystem confinement failed: ${why}`);
374
- return {
375
- confinement: {
376
- mechanism: available.mechanism.id,
377
- profile,
378
- profile_digest: sha256(profile),
379
- verified_denied_path: probePath,
380
- },
381
- unavailableReason: null,
382
- };
383
- }
384
- /** Rewrite an argv so the child (and every descendant) starts inside the boundary. */
385
- export function confinedInvocation(confinement, bin, args) {
386
- if (!confinement)
387
- return { bin, args: [...args] };
388
- const mechanism = MECHANISMS.find((candidate) => candidate.id === confinement.mechanism);
389
- if (!mechanism) {
390
- // The record names a boundary this engine cannot apply. Spawning unwrapped
391
- // would run the child outside the boundary its own record claims.
392
- throw new ConfinementUnavailableError(`the attempt records confinement mechanism '${confinement.mechanism}', which this engine cannot apply`);
393
- }
394
- return mechanism.invocation(confinement.profile, bin, args);
395
- }
396
- //# sourceMappingURL=confinement.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"confinement.js","sourceRoot":"","sources":["../src/confinement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C,yEAAyE;AACzE,MAAM,iBAAiB,GAAG;IACxB,MAAM;IACN,MAAM;IACN,UAAU;IACV,eAAe;IACf,SAAS;IACT,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;CACE,CAAC;AA4BX,MAAM,YAAY,GAAoB;IACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;CACrF,CAAC;AAyBF;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,OAAO,CAAC,KAAwB;IACvC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,OAAO,CAAC,KAAwB;IACvC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,yBAAyB,CAAC,KAAuB;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,uEAAuE;QACvE,kEAAkE;QAClE,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,IAAI,OAAO,KAAK,IAAI;gBAAE,MAAM;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO;gBAAE,MAAM,CAAC,yCAAyC;YACxE,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAS,uBAAuB,CAAC,KAAuB;IACtD,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACtD,OAAO,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAuB;IAChE,OAAO;QACL,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC;QACjC,KAAK,CAAC,WAAW;QACjB,GAAG,uBAAuB;aACvB,6BAA6B,EAAE;aAC/B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,KAAuB;IACvC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;AACnE,CAAC;AAED,mFAAmF;AACnF,MAAM,QAAQ,GAAyB;IACrC,EAAE,EAAE,UAAU;IACd,QAAQ,EAAE,QAAQ;IAClB,IAAI,EAAE,CAAC,YAAY,CAAC;IACpB,uEAAuE;IACvE,YAAY,CAAC,KAAK;QAChB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC;QAC7D,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACjD,0EAA0E;QAC1E,4EAA4E;QAC5E,+EAA+E;QAC/E,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,6DAA6D;QAC7D,4DAA4D;QAC5D,yEAAyE;QACzE,2EAA2E;QAC3E,yDAAyD;QACzD,OAAO;YACL,aAAa;YACb,iBAAiB;YACjB,oBAAoB,OAAO,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,GAAG;YACjE,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,6BAA6B,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,qBAAqB,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,qBAAqB,OAAO,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,GAAG;YACvD,sBAAsB,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,GAAG;YACnD,qBAAqB,OAAO,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG;YACrD,iCAAiC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG;YAC5D,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI;QAC3B,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACpE,CAAC;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAoC,CAAC,QAAQ,CAAC,CAAC;AAE/D,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,KAAuB;IAC7D,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAChB,SAA+B,EAC/B,OAAe,EACf,SAAiB,EACjB,IAAqB;IAErB,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,mEAAmE;AACnE,SAAS,kBAAkB,CAAC,MAA0B;IACpD,OAAO,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,4BAA4B,GAChC,iIAAiI,CAAC;AAEpI,SAAS,yBAAyB,CAAC,MAA0B;IAC3D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,sBAAsB,CAC7B,SAA+B,EAC/B,OAAe,EACf,SAAiB,EACjB,mBAAsC,EACtC,IAAqB;IAErB,oBAAoB;IACpB,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,kBAAkB,SAAS,oEAAoE,CAAC;IACzG,CAAC;IAED,2EAA2E;IAC3E,+EAA+E;IAC/E,wCAAwC;IACxC,MAAM,OAAO,GAAG,mBAAmB;SAChC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SAC7B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,2DAA2D,SAAS,CAAC,EAAE,6CAA6C,CAAC;IAC9H,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,SAAS,CAAC,EAAE,oDAAoD,OAAO,6BAA6B,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1J,CAAC;IAED,iFAAiF;IACjF,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,SAAS,8BAA8B,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/F,IAAI,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,OAAO,OAAO,SAAS,CAAC,EAAE,4DAA4D,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3H,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,OAAO,SAAS,CAAC,EAAE,0BAA0B,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,IAAqB;IACjD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,2DAA2D,IAAI,CAAC,QAAQ,sBAAsB;SACvG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,6BAA6B,SAAS,CAAC,EAAE,6CAA6C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC3I,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAI,GAAoB,YAAY;IAI/E,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,KAAK,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;AACrF,CAAC;AAUD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAuB,EACvB,IAAI,GAAoB,YAAY;IAEpC,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACjD,+EAA+E;IAC/E,+EAA+E;IAC/E,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,uDAAuD;IACvD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAC7D,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,2BAA2B,CACnC,oEAAoE,SAAS,uCAAuC,CACrH,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,CAAC,SAAS;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC5F,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,2BAA2B,CACnC,6IAA6I,CAC9I,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC3C,2EAA2E;IAC3E,4EAA4E;IAC5E,kDAAkD;IAClD,MAAM,GAAG,GAAG,sBAAsB,CAChC,SAAS,CAAC,SAAS,EACnB,OAAO,EACP,SAAS,EACT,QAAQ,CAAC,KAAK,CAAC,EACf,IAAI,CACL,CAAC;IACF,IAAI,GAAG;QAAE,MAAM,IAAI,2BAA2B,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;IACxF,OAAO;QACL,WAAW,EAAE;YACX,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE;YACjC,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;YAC/B,oBAAoB,EAAE,SAAS;SAChC;QACD,iBAAiB,EAAE,IAAI;KACxB,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAChC,WAAkD,EAClD,GAAW,EACX,IAAuB;IAEvB,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,WAAW,CAAC,SAAS,CAAC,CAAC;IACzF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,IAAI,2BAA2B,CACnC,8CAA8C,WAAW,CAAC,SAAS,mCAAmC,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC"}