@cleocode/git-shim 2026.4.154 → 2026.4.158

package/README.md

@@ -0,0 +1,147 @@
+# @cleocode/git-shim
+
+Harness-agnostic `git` PATH override that fences agent (worker | lead |
+subagent) git invocations. Provides two layers of enforcement:
+
+1. **T1118 denylist** — branch-mutation operations
+   (`checkout`, `switch`, `branch -D`, `worktree add`, `reset --hard`,
+   `rebase`, `push --force`, etc.).
+2. **T1591 boundary fence** — contextual rules tied to the
+   worktree-by-default model (ADR-055) + worktree-merge integration
+   (ADR-062):
+   - **(a)** `git add` MUST stage paths inside the active worktree.
+   - **(b)** `git commit -m "<msg>"` MUST embed a CLEO task ID
+     (`T<NUM>`).
+   - **(c)** `git merge` MUST be invoked by `completeAgentWorktreeViaMerge`
+     (signalled via `CLEO_ORCHESTRATE_MERGE=1`).
+   - **(d)** `git cherry-pick <ref>` MUST NOT take a `task/T<NUM>` source
+     (cherry-pick from worktree branches is the deprecated integration
+     path superseded by ADR-062).
+
+Every block and every bypass is recorded in
+`<XDG_DATA_HOME ?? ~/.local/share>/cleo/audit/git-shim.jsonl`.
+
+## Installation
+
+The shim ships as the `git` bin entry of this package. The orchestrator
+materialises a `git` symlink inside `<projectRoot>/.cleo/bin/` (or any
+shim directory) via `installShimSymlink(...)` and prepends that
+directory to the spawned agent's `PATH`.
+
+## Activation gate
+
+The shim only enforces when the agent role is restricted:
+
+```bash
+CLEO_AGENT_ROLE=worker  # or lead, subagent
+```
+
+Orchestrators (the absence of `CLEO_AGENT_ROLE` or
+`CLEO_AGENT_ROLE=orchestrator`) bypass the shim entirely — this keeps
+orchestration code paths fast and unencumbered.
+
+## Environment contract
+
+| Variable | Set by | Purpose |
+|---|---|---|
+| `CLEO_AGENT_ROLE` | orchestrator (spawn) | Activates the fence for restricted roles. |
+| `CLEO_WORKTREE_ROOT` | orchestrator (spawn) | Explicit worktree path; auto-detected from cwd otherwise. |
+| `CLEO_TASK_ID` | orchestrator (spawn) | Active task ID; auto-derived from worktree path otherwise. |
+| `CLEO_ORCHESTRATE_MERGE` | `completeAgentWorktreeViaMerge` (T1587) | Single-purpose grant — allows `git merge`. See below. |
+| `CLEO_ALLOW_BRANCH_OPS` | operator (manual) | Single-shot bypass for the legacy denylist. Audited. |
+| `CLEO_ALLOW_GIT` | operator (emergency) | Universal bypass for any T1591 boundary block. Audited. |
+| `CLEO_AUDIT_LOG_PATH` | tests | Override audit log location. |
+| `CLEO_REAL_GIT_PATH` | tests | Skip PATH walk; use this binary as real git. |
+| `CLEO_SHIM_MARKER` | installer (optional) | Path-fragment that identifies the shim dir. Default: `.cleo/bin/git-shim`. |
+
+## `CLEO_ORCHESTRATE_MERGE=1` contract (T1587 / ADR-062 integration)
+
+`packages/core/src/spawn/branch-lock.ts::completeAgentWorktreeViaMerge`
+is the **only** sanctioned entry point for `git merge` on a CLEO task
+branch. It MUST set `CLEO_ORCHESTRATE_MERGE=1` in the env passed to the
+spawned `git merge --no-ff` process. The shim's boundary (c) refuses any
+other `git merge` invocation from a restricted role.
+
+Concretely (see `branch-lock.ts:830`):
+
+```ts
+execFileSync('git', ['merge', '--no-ff', branch, '-m', subject], {
+  cwd: gitRoot,
+  encoding: 'utf-8',
+  stdio: ['pipe', 'pipe', 'pipe'],
+  env: { ...process.env, CLEO_ORCHESTRATE_MERGE: '1' },
+});
+```
+
+If you discover a code path that needs to invoke `git merge` from
+restricted-role context **other than** `completeAgentWorktreeViaMerge`,
+file a follow-up task — do NOT silently set `CLEO_ORCHESTRATE_MERGE=1`
+elsewhere. The narrow scope of this env var is what makes the boundary
+auditable.
+
+`--abort`, `--continue`, and `--quit` flag invocations are exempt —
+they do not perform a merge.
+
+## Bypass workflow
+
+For a legitimate emergency (e.g. operator hotfix, incident triage):
+
+```bash
+# One-off bypass; audit entry written to git-shim.jsonl.
+CLEO_ALLOW_GIT=1 git <subcommand> ...
+```
+
+The bypass is logged with full context (subcommand, args, cwd, role,
+task_id, worktree_path). Reviewers can list bypasses via:
+
+```bash
+jq 'select(.outcome | startswith("bypassed"))' \
+  ~/.local/share/cleo/audit/git-shim.jsonl
+```
+
+## Audit record schema
+
+```ts
+interface AuditRecord {
+  ts: string;                          // ISO 8601
+  outcome: 'blocked' | 'bypassed-allow-git' | 'bypassed-orchestrate-merge';
+  boundary: 'a' | 'b' | 'c' | 'd' | 'denylist';
+  code: string;                        // E_GIT_OP_BLOCKED | E_GIT_BOUNDARY_*
+  subcommand: string;
+  args: string[];
+  cwd: string;
+  worktree_path: string | null;
+  task_id: string | null;
+  role: string | null;
+  context: Record<string, string>;
+}
+```
+
+The schema is project-agnostic: the audit log under
+`~/.local/share/cleo/audit/` is shared across every CLEO-managed
+project on the host.
+
+## Defense-in-depth pipeline
+
+The git-binary fence (this package) is one layer in a multi-checkpoint
+pipeline:
+
+| Layer | Package | Catches |
+|---|---|---|
+| Git binary | `@cleocode/git-shim` (this) | Direct git invocations from agents |
+| Commit-msg hook | `@cleocode/core` (T1588) | Editor-flow commits (no inline `-m`) |
+| Drift watchdog | `@cleocode/core` (T1594) | Files modified outside worktree |
+| Pre-push reconcile | `@cleocode/core` (T1595) | Branch state drift before push |
+| Sync linter | CI (T1598) | Review-time policy mismatches |
+
+Both T1588 (hook) and T1591 (shim, boundary b) enforce the
+commit-subject T-ID rule. This is intentional defense in depth: a
+developer who disables the local hook still trips the shim.
+
+## References
+
+- ADR-055 — worktree-by-default agent isolation
+- ADR-062 — worktree integration via `git merge --no-ff` (not cherry-pick)
+- T1118 — original branch-lock engine (denylist)
+- T1587 — `completeAgentWorktreeViaMerge` (sets `CLEO_ORCHESTRATE_MERGE=1`)
+- T1591 — this fence (boundary a/b/c/d)

package/dist/__tests__/boundary-enforcement.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=boundary-enforcement.test.d.ts.map

package/dist/__tests__/boundary-enforcement.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary-enforcement.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/boundary-enforcement.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/boundary-enforcement.test.js

@@ -0,0 +1,282 @@
+/**
+ * Boundary-enforcement tests for the git-shim (T1591).
+ *
+ * Covers the four boundaries:
+ *   (a) git add path inside agent worktree
+ *   (b) git commit subject contains task ID
+ *   (c) git merge requires CLEO_ORCHESTRATE_MERGE=1
+ *   (d) git cherry-pick refuses task/T<NUM> sources
+ *
+ * Plus override (`CLEO_ALLOW_GIT=1`) + audit-log persistence.
+ *
+ * Tests are project-agnostic: fixture lives under a tmpdir using a fake
+ * project name (`fake-project-T1591`). No cleocode-specific paths.
+ *
+ * @task T1591
+ */
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { resolveAuditLogPath, writeAuditRecord } from '../audit-log.js';
+import { validateAddPaths, validateCherryPickSource, validateCommitSubject, validateMergeAllowed, } from '../boundary.js';
+import { extractTaskIdFromWorktreePath, isPathInsideWorktree, resolveActiveWorktree, resolveCleoWorktreesRoot, } from '../worktree-path.js';
+let workspace;
+let auditLogPath;
+const ENV_KEYS = [
+    'CLEO_AGENT_ROLE',
+    'CLEO_WORKTREE_ROOT',
+    'CLEO_TASK_ID',
+    'CLEO_ALLOW_GIT',
+    'CLEO_ORCHESTRATE_MERGE',
+    'CLEO_AUDIT_LOG_PATH',
+    'XDG_DATA_HOME',
+];
+const savedEnv = {};
+beforeEach(() => {
+    for (const key of ENV_KEYS)
+        savedEnv[key] = process.env[key];
+    workspace = mkdtempSync(join(tmpdir(), 'cleo-git-shim-T1591-'));
+    // Treat the workspace as a fake XDG_DATA_HOME so worktree paths land here.
+    process.env['XDG_DATA_HOME'] = workspace;
+    auditLogPath = join(workspace, 'audit', 'git-shim.jsonl');
+    process.env['CLEO_AUDIT_LOG_PATH'] = auditLogPath;
+});
+afterEach(() => {
+    for (const key of ENV_KEYS) {
+        const v = savedEnv[key];
+        if (v === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = v;
+    }
+    if (existsSync(workspace))
+        rmSync(workspace, { recursive: true, force: true });
+});
+// ---------------------------------------------------------------------------
+// worktree-path resolution (project-agnostic)
+// ---------------------------------------------------------------------------
+describe('worktree-path resolution', () => {
+    it('resolveCleoWorktreesRoot uses XDG_DATA_HOME', () => {
+        const root = resolveCleoWorktreesRoot();
+        expect(root).toBe(join(workspace, 'cleo', 'worktrees'));
+    });
+    it('extractTaskIdFromWorktreePath returns taskId from canonical layout', () => {
+        const wt = join(workspace, 'cleo', 'worktrees', 'abc123def4567890', 'T1591');
+        const taskId = extractTaskIdFromWorktreePath(wt);
+        expect(taskId).toBe('T1591');
+    });
+    it('extractTaskIdFromWorktreePath returns null outside worktree root', () => {
+        expect(extractTaskIdFromWorktreePath('/var/tmp/somewhere')).toBeNull();
+    });
+    it('isPathInsideWorktree detects descendants', () => {
+        const wt = join(workspace, 'cleo', 'worktrees', 'p1', 'T1591');
+        expect(isPathInsideWorktree(join(wt, 'src/file.ts'), wt)).toBe(true);
+        expect(isPathInsideWorktree(wt, wt)).toBe(true);
+        expect(isPathInsideWorktree('/var/tmp/other', wt)).toBe(false);
+    });
+    it('resolveActiveWorktree honours CLEO_WORKTREE_ROOT + CLEO_TASK_ID', () => {
+        const wt = join(workspace, 'cleo', 'worktrees', 'p1', 'T9999');
+        mkdirSync(wt, { recursive: true });
+        process.env['CLEO_WORKTREE_ROOT'] = wt;
+        process.env['CLEO_TASK_ID'] = 'T9999';
+        const active = resolveActiveWorktree('/some/unrelated/cwd');
+        expect(active).toEqual({ worktreePath: wt, taskId: 'T9999' });
+    });
+    it('resolveActiveWorktree walks up from cwd inside a worktree', () => {
+        const wt = join(workspace, 'cleo', 'worktrees', 'p1', 'T1591');
+        mkdirSync(join(wt, 'src'), { recursive: true });
+        const active = resolveActiveWorktree(join(wt, 'src'));
+        expect(active?.taskId).toBe('T1591');
+        expect(active?.worktreePath).toBe(wt);
+    });
+    it('resolveActiveWorktree returns null outside worktree tree', () => {
+        expect(resolveActiveWorktree('/tmp/random')).toBeNull();
+    });
+});
+// ---------------------------------------------------------------------------
+// Boundary (a) — git add path inside worktree
+// ---------------------------------------------------------------------------
+describe('boundary (a): worktree-path enforcement', () => {
+    const worktreePath = '/var/tmp/wt/T1591';
+    it('allows git add . (no explicit path)', () => {
+        expect(validateAddPaths(['.'], worktreePath, worktreePath)).toBeNull();
+    });
+    it('allows git add inside worktree', () => {
+        expect(validateAddPaths(['src/file.ts'], worktreePath, worktreePath)).toBeNull();
+    });
+    it('allows git add with -A flag', () => {
+        expect(validateAddPaths(['-A'], worktreePath, worktreePath)).toBeNull();
+    });
+    it('refuses git add with absolute path outside worktree', () => {
+        const v = validateAddPaths(['/etc/passwd'], worktreePath, worktreePath);
+        expect(v).not.toBeNull();
+        expect(v?.code).toBe('E_GIT_BOUNDARY_WORKTREE_PATH');
+        expect(v?.boundary).toBe('a');
+        expect(v?.context['attempted_path']).toBe('/etc/passwd');
+    });
+    it('refuses git add with ../escape relative path', () => {
+        const v = validateAddPaths(['../../etc/passwd'], worktreePath, worktreePath);
+        expect(v).not.toBeNull();
+        expect(v?.code).toBe('E_GIT_BOUNDARY_WORKTREE_PATH');
+    });
+});
+// ---------------------------------------------------------------------------
+// Boundary (b) — commit subject must contain task ID
+// ---------------------------------------------------------------------------
+describe('boundary (b): commit T-ID gate', () => {
+    it('allows commit with T<NUM> in subject (no expected ID)', () => {
+        expect(validateCommitSubject(['-m', 'feat(T1591): add boundary'], null)).toBeNull();
+    });
+    it('refuses commit without any T<NUM> token', () => {
+        const v = validateCommitSubject(['-m', 'wip: stuff'], null);
+        expect(v).not.toBeNull();
+        expect(v?.code).toBe('E_GIT_BOUNDARY_COMMIT_TASK_ID');
+        expect(v?.boundary).toBe('b');
+    });
+    it('refuses commit when expected ID is missing from subject', () => {
+        const v = validateCommitSubject(['-m', 'feat(T9999): wrong id'], 'T1591');
+        expect(v).not.toBeNull();
+        expect(v?.context['expected_task_id']).toBe('T1591');
+    });
+    it('allows commit with --message=… inline syntax', () => {
+        expect(validateCommitSubject(['--message=fix(T1591): boundary'], 'T1591')).toBeNull();
+    });
+    it('passes through commits with no inline -m (editor flow)', () => {
+        expect(validateCommitSubject([], null)).toBeNull();
+        expect(validateCommitSubject(['--amend'], null)).toBeNull();
+    });
+});
+// ---------------------------------------------------------------------------
+// Boundary (c) — merge requires CLEO_ORCHESTRATE_MERGE
+// ---------------------------------------------------------------------------
+describe('boundary (c): merge restriction', () => {
+    it('refuses git merge without CLEO_ORCHESTRATE_MERGE', () => {
+        const v = validateMergeAllowed(['task/T1591'], {});
+        expect(v).not.toBeNull();
+        expect(v?.code).toBe('E_GIT_BOUNDARY_MERGE_FORBIDDEN');
+        expect(v?.boundary).toBe('c');
+    });
+    it('allows git merge when CLEO_ORCHESTRATE_MERGE=1', () => {
+        expect(validateMergeAllowed(['task/T1591'], { CLEO_ORCHESTRATE_MERGE: '1' })).toBeNull();
+    });
+    it('allows control-flow flags --abort/--continue/--quit without env', () => {
+        expect(validateMergeAllowed(['--abort'], {})).toBeNull();
+        expect(validateMergeAllowed(['--continue'], {})).toBeNull();
+        expect(validateMergeAllowed(['--quit'], {})).toBeNull();
+    });
+    it('refuses when env value is not exactly "1"', () => {
+        const v = validateMergeAllowed(['task/T1591'], { CLEO_ORCHESTRATE_MERGE: 'true' });
+        expect(v).not.toBeNull();
+    });
+});
+// ---------------------------------------------------------------------------
+// Boundary (d) — cherry-pick refuses task/T<NUM> sources
+// ---------------------------------------------------------------------------
+describe('boundary (d): cherry-pick from worktree branches', () => {
+    it('refuses cherry-pick of task/T1591', () => {
+        const v = validateCherryPickSource(['task/T1591']);
+        expect(v).not.toBeNull();
+        expect(v?.code).toBe('E_GIT_BOUNDARY_CHERRY_PICK_TASK_BRANCH');
+        expect(v?.boundary).toBe('d');
+    });
+    it('refuses cherry-pick of range task/T1591..HEAD', () => {
+        const v = validateCherryPickSource(['task/T1591..HEAD']);
+        expect(v).not.toBeNull();
+        expect(v?.context['source_ref']).toBe('task/T1591');
+    });
+    it('refuses cherry-pick of triple-dot range', () => {
+        const v = validateCherryPickSource(['main...task/T1591']);
+        expect(v).not.toBeNull();
+    });
+    it('allows cherry-pick of regular branch', () => {
+        expect(validateCherryPickSource(['feature/regular-branch'])).toBeNull();
+    });
+    it('allows cherry-pick of explicit SHA', () => {
+        expect(validateCherryPickSource(['abc123def456'])).toBeNull();
+    });
+    it('allows cherry-pick of HEAD~3', () => {
+        expect(validateCherryPickSource(['HEAD~3'])).toBeNull();
+    });
+});
+// ---------------------------------------------------------------------------
+// Audit log
+// ---------------------------------------------------------------------------
+describe('audit log', () => {
+    it('resolveAuditLogPath honours CLEO_AUDIT_LOG_PATH override', () => {
+        expect(resolveAuditLogPath()).toBe(auditLogPath);
+    });
+    it('resolveAuditLogPath defaults to XDG-conformant path', () => {
+        delete process.env['CLEO_AUDIT_LOG_PATH'];
+        expect(resolveAuditLogPath()).toBe(join(workspace, 'cleo', 'audit', 'git-shim.jsonl'));
+    });
+    it('writeAuditRecord persists a JSONL entry', () => {
+        const record = {
+            ts: '2026-04-29T00:00:00.000Z',
+            outcome: 'blocked',
+            boundary: 'a',
+            code: 'E_GIT_BOUNDARY_WORKTREE_PATH',
+            subcommand: 'add',
+            args: ['/etc/passwd'],
+            cwd: '/var/tmp/wt/T1591',
+            worktree_path: '/var/tmp/wt/T1591',
+            task_id: 'T1591',
+            role: 'worker',
+            context: { attempted_path: '/etc/passwd' },
+        };
+        writeAuditRecord(record);
+        expect(existsSync(auditLogPath)).toBe(true);
+        const content = readFileSync(auditLogPath, 'utf-8').trim();
+        const parsed = JSON.parse(content);
+        expect(parsed.code).toBe('E_GIT_BOUNDARY_WORKTREE_PATH');
+        expect(parsed.outcome).toBe('blocked');
+        expect(parsed.boundary).toBe('a');
+    });
+    it('writeAuditRecord appends rather than overwrites', () => {
+        const base = {
+            ts: '2026-04-29T00:00:00.000Z',
+            outcome: 'blocked',
+            boundary: 'b',
+            code: 'E_GIT_BOUNDARY_COMMIT_TASK_ID',
+            subcommand: 'commit',
+            args: ['-m', 'wip'],
+            cwd: '/var/tmp/wt/T1591',
+            worktree_path: null,
+            task_id: null,
+            role: 'worker',
+            context: {},
+        };
+        writeAuditRecord(base);
+        writeAuditRecord({ ...base, outcome: 'bypassed-allow-git' });
+        const lines = readFileSync(auditLogPath, 'utf-8').trim().split('\n');
+        expect(lines).toHaveLength(2);
+        expect(JSON.parse(lines[0] ?? '{}').outcome).toBe('blocked');
+        expect(JSON.parse(lines[1] ?? '{}').outcome).toBe('bypassed-allow-git');
+    });
+});
+// ---------------------------------------------------------------------------
+// Project-agnostic verification (no cleocode-specific paths)
+// ---------------------------------------------------------------------------
+describe('project-agnostic verification', () => {
+    it('worktree path uses a fake project name without hardcoding "cleocode"', () => {
+        // Resolve a worktree path for a fake project at /home/user/projects/fake-app.
+        // The sha256-derived hash should never contain "cleocode".
+        const fakeProjectRoot = '/home/user/projects/fake-app';
+        const wt = join(workspace, 'cleo', 'worktrees', 'someProjectHash', 'T1591');
+        mkdirSync(wt, { recursive: true });
+        process.env['CLEO_WORKTREE_ROOT'] = wt;
+        process.env['CLEO_TASK_ID'] = 'T1591';
+        const active = resolveActiveWorktree('/totally/elsewhere');
+        expect(active?.worktreePath).toBe(wt);
+        expect(active?.worktreePath.includes('cleocode')).toBe(false);
+        // Reference to fakeProjectRoot to keep the test self-documenting.
+        expect(fakeProjectRoot.includes('cleocode')).toBe(false);
+    });
+    it('audit log path uses XDG conventions, not project name', () => {
+        delete process.env['CLEO_AUDIT_LOG_PATH'];
+        const path = resolveAuditLogPath();
+        expect(path.includes('cleocode')).toBe(false);
+        expect(path.endsWith(join('cleo', 'audit', 'git-shim.jsonl'))).toBe(true);
+    });
+});
+//# sourceMappingURL=boundary-enforcement.test.js.map

package/dist/__tests__/boundary-enforcement.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary-enforcement.test.js","sourceRoot":"","sources":["../../src/__tests__/boundary-enforcement.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAoB,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC1F,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAE7B,IAAI,SAAiB,CAAC;AACtB,IAAI,YAAoB,CAAC;AACzB,MAAM,QAAQ,GAAG;IACf,iBAAiB;IACjB,oBAAoB;IACpB,cAAc;IACd,gBAAgB;IAChB,wBAAwB;IACxB,qBAAqB;IACrB,eAAe;CAChB,CAAC;AACF,MAAM,QAAQ,GAAuC,EAAE,CAAC;AAExD,UAAU,CAAC,GAAG,EAAE;IACd,KAAK,MAAM,GAAG,IAAI,QAAQ;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChE,2EAA2E;IAC3E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC;IACzC,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,YAAY,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;YACxC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,CAAC;QAAE,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACjF,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,6BAA6B,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,6BAA6B,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/D,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/D,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC;QACtC,MAAM,MAAM,GAAG,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/D,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,MAAM,YAAY,GAAG,mBAAmB,CAAC;IAEzC,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,gBAAgB,CAAC,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACrD,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,kBAAkB,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;QAC7E,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAE9E,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,EAAE,2BAA2B,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACtD,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1E,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,qBAAqB,CAAC,CAAC,gCAAgC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnD,MAAM,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,GAAG,oBAAoB,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,oBAAoB,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,oBAAoB,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,CAAC,oBAAoB,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5D,MAAM,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,oBAAoB,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,GAAG,wBAAwB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QAC/D,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,GAAG,wBAAwB,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,GAAG,wBAAwB,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,wBAAwB,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,wBAAwB,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC1C,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAgB;YAC1B,EAAE,EAAE,0BAA0B;YAC9B,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,GAAG;YACb,IAAI,EAAE,8BAA8B;YACpC,UAAU,EAAE,KAAK;YACjB,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,GAAG,EAAE,mBAAmB;YACxB,aAAa,EAAE,mBAAmB;YAClC,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE;SAC3C,CAAC;QACF,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,IAAI,GAAgB;YACxB,EAAE,EAAE,0BAA0B;YAC9B,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,GAAG;YACb,IAAI,EAAE,+BAA+B;YACrC,UAAU,EAAE,QAAQ;YACpB,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;YACnB,GAAG,EAAE,mBAAmB;YACxB,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;SACZ,CAAC;QACF,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,gBAAgB,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9E,MAAM,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,8EAA8E;QAC9E,2DAA2D;QAC3D,MAAM,eAAe,GAAG,8BAA8B,CAAC;QACvD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAC5E,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC;QACtC,MAAM,MAAM,GAAG,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,kEAAkE;QAClE,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/audit-log.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Outcome of a shim invocation that warrants an audit entry.
+ *
+ * @task T1591
+ */
+export type AuditOutcome = 'blocked' | 'bypassed-allow-git' | 'bypassed-orchestrate-merge';
+/**
+ * Single JSONL record written to the audit log.
+ *
+ * @task T1591
+ */
+export interface AuditRecord {
+    /** ISO 8601 UTC timestamp. */
+    ts: string;
+    /** What happened. */
+    outcome: AuditOutcome;
+    /** Boundary letter (a-d) or "denylist" for legacy denylist hits. */
+    boundary: 'a' | 'b' | 'c' | 'd' | 'denylist';
+    /** CLEO error code, when blocked. */
+    code: string;
+    /** Git subcommand. */
+    subcommand: string;
+    /** Argv tail after subcommand. */
+    args: string[];
+    /** Working directory at invocation time. */
+    cwd: string;
+    /** Active worktree, when resolvable. */
+    worktree_path: string | null;
+    /** Task ID extracted from the worktree, when resolvable. */
+    task_id: string | null;
+    /** Agent role from CLEO_AGENT_ROLE. */
+    role: string | null;
+    /** Free-form context from the boundary predicate. */
+    context: Record<string, string>;
+}
+/**
+ * Resolve the audit log file path.
+ *
+ * Honours `CLEO_AUDIT_LOG_PATH` (test/owner override), otherwise defaults
+ * to the XDG-conformant location.
+ *
+ * @returns Absolute path to the jsonl file.
+ *
+ * @task T1591
+ */
+export declare function resolveAuditLogPath(): string;
+/**
+ * Append a single record to the audit log.
+ *
+ * Best-effort: failures are swallowed so the shim can never wedge a git
+ * invocation. The record is also echoed to stderr so operators see it
+ * even if the file write fails.
+ *
+ * @param record - The audit record to persist.
+ *
+ * @task T1591
+ */
+export declare function writeAuditRecord(record: AuditRecord): void;
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../src/audit-log.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,oBAAoB,GAAG,4BAA4B,CAAC;AAE3F;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB,oEAAoE;IACpE,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,UAAU,CAAC;IAC7C,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4DAA4D;IAC5D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,uCAAuC;IACvC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAK5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAmB1D"}

package/dist/audit-log.js

@@ -0,0 +1,66 @@
+/**
+ * Append-only audit log for git-shim boundary events (T1591).
+ *
+ * Every block (refusal) and every bypass (`CLEO_ALLOW_GIT=1`) is recorded as
+ * one JSON line at:
+ *
+ *   `<XDG_DATA_HOME ?? ~/.local/share>/cleo/audit/git-shim.jsonl`
+ *
+ * Tests override the path via `CLEO_AUDIT_LOG_PATH`.
+ *
+ * Records use a stable, project-agnostic shape so downstream tooling
+ * (`cleo audit show`, dashboards) can consume them without parsing knowledge
+ * of any particular project.
+ *
+ * @task T1591
+ */
+import { appendFileSync, mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+/**
+ * Resolve the audit log file path.
+ *
+ * Honours `CLEO_AUDIT_LOG_PATH` (test/owner override), otherwise defaults
+ * to the XDG-conformant location.
+ *
+ * @returns Absolute path to the jsonl file.
+ *
+ * @task T1591
+ */
+export function resolveAuditLogPath() {
+    const override = process.env['CLEO_AUDIT_LOG_PATH'];
+    if (override)
+        return override;
+    const xdgData = process.env['XDG_DATA_HOME'] ?? join(homedir(), '.local', 'share');
+    return join(xdgData, 'cleo', 'audit', 'git-shim.jsonl');
+}
+/**
+ * Append a single record to the audit log.
+ *
+ * Best-effort: failures are swallowed so the shim can never wedge a git
+ * invocation. The record is also echoed to stderr so operators see it
+ * even if the file write fails.
+ *
+ * @param record - The audit record to persist.
+ *
+ * @task T1591
+ */
+export function writeAuditRecord(record) {
+    const line = `${JSON.stringify(record)}\n`;
+    const path = resolveAuditLogPath();
+    try {
+        mkdirSync(dirname(path), { recursive: true });
+        appendFileSync(path, line, { encoding: 'utf-8' });
+    }
+    catch {
+        // Best-effort — shim must never block on log failure.
+    }
+    // Always echo to stderr for human visibility.
+    if (record.outcome === 'blocked') {
+        process.stderr.write(`[git-shim] AUDIT block boundary=${record.boundary} code=${record.code}\n`);
+    }
+    else {
+        process.stderr.write(`[git-shim] AUDIT bypass boundary=${record.boundary} via=${record.outcome}\n`);
+    }
+}
+//# sourceMappingURL=audit-log.js.map

package/dist/audit-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../src/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAuC1C;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACpD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAmB;IAClD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IACD,8CAA8C;IAC9C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,MAAM,CAAC,QAAQ,SAAS,MAAM,CAAC,IAAI,IAAI,CAC3E,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oCAAoC,MAAM,CAAC,QAAQ,QAAQ,MAAM,CAAC,OAAO,IAAI,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}