@cybedefend/vibedefend 1.2.4 → 1.3.0

package/dist/hooks/runtime/near-miss.js

@@ -0,0 +1,362 @@
+const RE_CLASS_ESCAPES = new Set([
+    's',
+    'S',
+    'd',
+    'D',
+    'w',
+    'W',
+    'b',
+    'B',
+    'n',
+    'r',
+    't',
+    'f',
+    'v',
+    'A',
+    'Z',
+    'z',
+    'G',
+]);
+// Characters that are literal inside a command/path token (regex metachars are
+// handled separately and act as token separators).
+const TOKEN_CHARS = /[A-Za-z0-9_\-/=:.@]/;
+function dedupe(xs) {
+    return [...new Set(xs.filter((x) => x.length > 0))];
+}
+function basename(p) {
+    const parts = p.split('/');
+    return parts[parts.length - 1] ?? p;
+}
+function expandTilde(p, homeDir) {
+    if (p === '~')
+        return homeDir;
+    if (p.startsWith('~/'))
+        return `${homeDir}/${p.slice(2)}`;
+    return p;
+}
+// ---------------------------------------------------------------------------
+// Anchor extraction
+// ---------------------------------------------------------------------------
+/**
+ * Pull literal anchors out of a command regex WITHOUT compiling it. Walks the
+ * source char-by-char, flushing a literal buffer on any regex metacharacter,
+ * and honouring `\.`, `\/`, `\-` as literal escapes while treating `\s`, `\b`,
+ * etc. as separators. Alternation `(a|b)` yields multiple tokens. Anchors that
+ * cannot be extracted (pure `.*`, lookaheads only) yield empty arrays — the
+ * caller then treats the rule as NOT a near-miss (favouring a low call rate).
+ */
+export function extractCommandAnchors(src) {
+    const tokens = [];
+    // Escaped shell operators (`\|`, `\>`, `\<`, `\&`) are strong structural
+    // anchors — "pipe to shell", "redirect to device" — kept even though they
+    // are single chars that the length filter would otherwise drop.
+    const opLiterals = [];
+    let buf = '';
+    const flush = () => {
+        if (buf)
+            tokens.push(buf);
+        buf = '';
+    };
+    for (let i = 0; i < src.length; i++) {
+        const c = src[i];
+        if (c === '\\') {
+            const nxt = src[i + 1] ?? '';
+            i++;
+            if ('|><&'.includes(nxt)) {
+                flush();
+                opLiterals.push(nxt); // structural operator, e.g. curl ... \| bash
+            }
+            else if (RE_CLASS_ESCAPES.has(nxt)) {
+                flush(); // \s \b \d ... — a separator, not a literal
+            }
+            else {
+                buf += nxt; // \. \/ \- ... — the escaped char is a literal
+            }
+            continue;
+        }
+        if (c === '[') {
+            // Skip a character class entirely — its contents are not literal anchors.
+            flush();
+            while (i < src.length && src[i] !== ']')
+                i++;
+            continue;
+        }
+        if (c === '.') {
+            // Bare dot = wildcard → separator (escaped dot handled above).
+            flush();
+            continue;
+        }
+        if (TOKEN_CHARS.test(c)) {
+            buf += c;
+            continue;
+        }
+        // Any other metachar: ^ $ * + ? ( ) | { } < > whitespace, etc.
+        flush();
+    }
+    flush();
+    const commands = [];
+    const flags = [];
+    const literals = [];
+    for (const raw of tokens) {
+        // Strip a leading/trailing quantifier remnant like a bare '=' with nothing.
+        const t = raw;
+        if (/^--?[A-Za-z][A-Za-z0-9-]*$/.test(t)) {
+            flags.push(t);
+        }
+        else if (/[/=:@]/.test(t) || /\d{1,3}(\.\d{1,3}){2,}/.test(t)) {
+            // Contains a path/kv/host separator or looks like an IP → a context literal.
+            literals.push(t);
+        }
+        else if (/^[A-Za-z][A-Za-z0-9_-]{1,}$/.test(t)) {
+            // A word ≥2 chars → candidate command name.
+            commands.push(t);
+        }
+        else if (t.length >= 3) {
+            literals.push(t);
+        }
+    }
+    // Coarsen over-specific path literals: `of=/dev/sd` also yields `/dev/` so a
+    // near-miss fires on `/dev/nvme0n1`, `/dev/sda`, etc. — not only the exact
+    // device the rule spelled out.
+    const subLiterals = [];
+    for (const lit of literals) {
+        const m = lit.match(/\/[A-Za-z]{2,}\//g);
+        if (m)
+            subLiterals.push(...m);
+    }
+    return {
+        commands: dedupe(commands),
+        flags: dedupe(flags),
+        literals: dedupe([...literals, ...subLiterals, ...opLiterals]),
+    };
+}
+/**
+ * Pull literal anchors out of a single file-path glob WITHOUT expanding it.
+ * `**` / `*` segments are dropped; distinctive dotfiles (".env"), extensions
+ * ("*.pem" → ".pem") and named segments ("id_rsa", "shadow") are kept.
+ */
+// Common directory/file-name segments that carry NO secret signal. Keeping them
+// as anchors would make ordinary files (`config.yaml`, `src/…`) near-miss a
+// sensitive-path rule. Dotfiles ("." prefix) and extensions bypass this list.
+const GENERIC_SEGMENTS = new Set([
+    'config',
+    'conf',
+    'configs',
+    'settings',
+    'data',
+    'home',
+    'user',
+    'users',
+    'usr',
+    'var',
+    'tmp',
+    'opt',
+    'etc',
+    'app',
+    'apps',
+    'src',
+    'lib',
+    'bin',
+    'dist',
+    'build',
+    'out',
+    'target',
+    'public',
+    'static',
+    'assets',
+    'main',
+    'index',
+    'test',
+    'tests',
+    'docs',
+    'node_modules',
+    'vendor',
+    'project',
+]);
+export function extractGlobAnchors(glob) {
+    const segs = glob.split('/');
+    const literals = [];
+    let ext = null;
+    for (const seg of segs) {
+        if (!seg || seg === '**' || seg === '*')
+            continue;
+        const bare = seg.replace(/[*?]/g, '');
+        if (!bare)
+            continue;
+        if (bare.startsWith('.') && !bare.slice(1).includes('.')) {
+            // A dotfile or a star-dot-ext remnant: ".env", ".pem", ".key".
+            literals.push(bare);
+            if (bare.length <= 6)
+                ext = bare;
+        }
+        else if (bare.includes('.')) {
+            // A specific/compound filename (`terraform.tfstate.backup`, `config.json`)
+            // — anchor on the FULL literal (basename match), NOT on the trailing
+            // extension: `.backup`/`.json` are too generic and would near-miss every
+            // such file. Only pure `*.ext` / dotfile globs contribute an ext anchor.
+            literals.push(bare);
+        }
+        else if (bare.length >= 3 && !GENERIC_SEGMENTS.has(bare.toLowerCase())) {
+            literals.push(bare);
+        }
+    }
+    return { ext, literals: dedupe(literals) };
+}
+// ---------------------------------------------------------------------------
+// Per-bucket near-miss checks
+// ---------------------------------------------------------------------------
+function nearMissCommand(target, rule) {
+    if (!rule.commandRegex)
+        return false;
+    const { commands, flags, literals } = extractCommandAnchors(rule.commandRegex);
+    if (commands.length === 0 && flags.length === 0 && literals.length === 0)
+        return false;
+    const cmd = target.command;
+    const base = basename(cmd);
+    const joined = [cmd, ...target.argv].join(' ');
+    const flagHits = (fl) => {
+        if (fl.startsWith('--'))
+            return joined.includes(fl); // long flag: exact substring
+        // short combinable flag, e.g. -rf ≡ -fr ≡ -rvf: any dash-token carrying all letters
+        const letters = fl.replace(/^-+/, '').split('');
+        if (letters.length === 0)
+            return false;
+        return target.argv.some((t) => t.startsWith('-') && letters.every((ch) => t.includes(ch)));
+    };
+    const cmdHitCount = commands.filter((a) => cmd === a || base === a || target.argv.includes(a)).length;
+    const flagHitCount = flags.filter(flagHits).length;
+    const litHitCount = literals.filter((l) => joined.includes(l)).length;
+    // A "core" signal (command name or context literal) is required; a lone flag
+    // is never enough. When the rule carries ≥2 anchors overall, at least 2
+    // distinct signals must hit — so `rm file.txt` (only the `rm` command anchor
+    // of an `rm -rf /` rule) is NOT a near-miss, while `rm -rf ~/x` (command +
+    // flag) and `wget … && sh …` (downloader + shell) both are.
+    const core = cmdHitCount > 0 || litHitCount > 0;
+    const totalAnchors = commands.length + flags.length + literals.length;
+    const signalCount = cmdHitCount + flagHitCount + litHitCount;
+    const threshold = totalAnchors >= 2 ? 2 : 1;
+    return core && signalCount >= threshold;
+}
+function nearMissFile(target, rule, homeDir) {
+    const globs = rule.filePathGlobs;
+    if (!globs || globs.length === 0)
+        return false;
+    const path = expandTilde(target.path, homeDir);
+    const base = basename(path);
+    const segs = path.split('/');
+    for (const g of globs) {
+        const { ext, literals } = extractGlobAnchors(g);
+        if (ext && path.endsWith(ext))
+            return true;
+        for (const l of literals) {
+            if (l.startsWith('.')) {
+                // Dotfile/extension literal — must appear as a real ".env"-style token.
+                if (base.includes(l) || path.includes(`/${l}`) || path.endsWith(l))
+                    return true;
+            }
+            else if (segs.includes(l) || base.includes(l)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function literalsFromGlobList(globs) {
+    const out = [];
+    for (const g of globs) {
+        for (const part of g.split(/[*?]/)) {
+            const p = part.replace(/^[._-]+|[._-]+$/g, '');
+            if (p.length >= 3)
+                out.push(part.length >= 3 ? part : p);
+        }
+    }
+    return dedupe(out);
+}
+function nearMissEnv(target, rule) {
+    const globs = rule.envNameGlobs;
+    if (!globs || globs.length === 0)
+        return false;
+    const name = target.name;
+    for (const g of globs) {
+        const lead = g.startsWith('*');
+        const trail = g.endsWith('*');
+        const core = g.replace(/[*?]/g, '');
+        if (core.length < 3)
+            continue; // too generic to anchor on
+        // Honour the glob's wildcard position: `AWS_*` is a PREFIX (not a
+        // substring), `*_KEY` a SUFFIX, `*SECRET*` a contains, `SECRET_KEY` exact.
+        if (lead && trail) {
+            if (name.includes(core))
+                return true;
+        }
+        else if (trail) {
+            if (name.startsWith(core))
+                return true;
+        }
+        else if (lead) {
+            if (name.endsWith(core))
+                return true;
+        }
+        else if (name === core) {
+            return true;
+        }
+    }
+    return false;
+}
+function nearMissHttp(target, rule) {
+    const globs = rule.httpHostGlobs;
+    if (!globs || globs.length === 0)
+        return false;
+    let hostname;
+    try {
+        hostname = new URL(target.url).hostname;
+    }
+    catch {
+        hostname = target.url;
+    }
+    const literals = literalsFromGlobList(globs);
+    // For IP-literal host rules, also anchor on the /16 prefix so a near-miss
+    // fires across the link-local metadata range (169.254.170.2, ...), not only
+    // the exact address the rule spelled out.
+    const prefixes = [];
+    for (const l of literals) {
+        const m = l.match(/^(\d{1,3}\.\d{1,3})\.\d/);
+        if (m)
+            prefixes.push(`${m[1]}.`);
+    }
+    return [...literals, ...prefixes].some((l) => hostname.includes(l));
+}
+function nearMissGit(target, rule) {
+    if (rule.gitSubcommand && rule.gitSubcommand.length > 0) {
+        return rule.gitSubcommand.includes(target.subcommand);
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Public entry point
+// ---------------------------------------------------------------------------
+/**
+ * Is `req`'s action a near-miss of the (unmatched, catch-eligible) `deny`
+ * `rule`? Pure and cheap: no LLM, no regex compile, no glob expansion.
+ */
+export function nearMiss(req, rule) {
+    if (rule.toolMatch &&
+        rule.toolMatch.length > 0 &&
+        !rule.toolMatch.includes(req.tool)) {
+        return false;
+    }
+    const { target, homeDir } = req;
+    switch (target.type) {
+        case 'command':
+            return nearMissCommand(target, rule);
+        case 'file':
+            return nearMissFile(target, rule, homeDir);
+        case 'env':
+            return nearMissEnv(target, rule);
+        case 'http':
+            return nearMissHttp(target, rule);
+        case 'git':
+            return nearMissGit(target, rule);
+    }
+}
+//# sourceMappingURL=near-miss.js.map

package/dist/hooks/runtime/near-miss.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"near-miss.js","sourceRoot":"","sources":["../../../src/hooks/runtime/near-miss.ts"],"names":[],"mappings":"AAwCA,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;CACJ,CAAC,CAAC;AACH,+EAA+E;AAC/E,mDAAmD;AACnD,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAE1C,SAAS,MAAM,CAAC,EAAY;IAC1B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,OAAe;IAC7C,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC;IAC9B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,yEAAyE;IACzE,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,GAAG,GAAG,EAAE,CAAC;IACX,CAAC,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC,EAAE,CAAC;YACJ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,KAAK,EAAE,CAAC;gBACR,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,6CAA6C;YACrE,CAAC;iBAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,KAAK,EAAE,CAAC,CAAC,4CAA4C;YACvD,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,GAAG,CAAC,CAAC,+CAA+C;YAC7D,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,0EAA0E;YAC1E,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,+DAA+D;YAC/D,KAAK,EAAE,CAAC;YACR,SAAS;QACX,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,GAAG,IAAI,CAAC,CAAC;YACT,SAAS;QACX,CAAC;QACD,+DAA+D;QAC/D,KAAK,EAAE,CAAC;IACV,CAAC;IACD,KAAK,EAAE,CAAC;IAER,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,4EAA4E;QAC5E,MAAM,CAAC,GAAG,GAAG,CAAC;QACd,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,6EAA6E;YAC7E,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;aAAM,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,4CAA4C;YAC5C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACzC,IAAI,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC1B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,gFAAgF;AAChF,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,QAAQ;IACR,MAAM;IACN,SAAS;IACT,UAAU;IACV,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,cAAc;IACd,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG;YAAE,SAAS;QAClD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,+DAA+D;YAC/D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;gBAAE,GAAG,GAAG,IAAI,CAAC;QACnC,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,2EAA2E;YAC3E,qEAAqE;YACrE,yEAAyE;YACzE,yEAAyE;YACzE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACzE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,SAAS,eAAe,CACtB,MAA4C,EAC5C,IAAU;IAEV,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,qBAAqB,CACzD,IAAI,CAAC,YAAY,CAClB,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QACtE,OAAO,KAAK,CAAC;IAEf,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE/C,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAW,EAAE;QACvC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,6BAA6B;QAClF,oFAAoF;QACpF,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAClE,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC1D,CAAC,MAAM,CAAC;IACT,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IACnD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAEtE,6EAA6E;IAC7E,wEAAwE;IACxE,6EAA6E;IAC7E,2EAA2E;IAC3E,4DAA4D;IAC5D,MAAM,IAAI,GAAG,WAAW,GAAG,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IACtE,MAAM,WAAW,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,CAAC;IAC7D,MAAM,SAAS,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,IAAI,IAAI,WAAW,IAAI,SAAS,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CACnB,MAAyC,EACzC,IAAU,EACV,OAAe;IAEf,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC;IACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE7B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,wEAAwE;gBACxE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAChE,OAAO,IAAI,CAAC;YAChB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAe;IAC3C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,WAAW,CAClB,MAAwC,EACxC,IAAU;IAEV,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS,CAAC,2BAA2B;QAC1D,kEAAkE;QAClE,2EAA2E;QAC3E,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACvC,CAAC;aAAM,IAAI,KAAK,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACzC,CAAC;aAAM,IAAI,IAAI,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACvC,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CACnB,MAAyC,EACzC,IAAU;IAEV,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC;IACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC;IACxB,CAAC;IACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,WAAW,CAClB,MAAwC,EACxC,IAAU;IAEV,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAiB,EAAE,IAAU;IACpD,IACE,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAChC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,KAAK,MAAM;YACT,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7C,KAAK,KAAK;YACR,OAAO,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,KAAK,MAAM;YACT,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpC,KAAK,KAAK;YACR,OAAO,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/hooks/runtime/resolve.js

@@ -162,45 +162,58 @@ function resolveTokenLinux(mcpName) {
         return null;
     }
 }
-// ─── Async token resolution with transparent refresh ─────────────────────────
 /**
  * Async variant of `resolveToken` that transparently refreshes the access_token
  * when near expiry using the stored refresh_token.
  *
- * Falls back to the synchronous `resolveToken` path (legacy keychain lookup) if
- * the new OAuth store has no entry for this MCP name — this ensures backward
- * compatibility during the migration period.
+ * Resolution order (first hit wins):
+ *   1. CYBEDEFEND_TOKEN env var (CI / scripted use).
+ *   2. The new OAuth store via getValidAccessToken (transparent refresh).
+ *   3. The legacy keychain lookup (resolveToken) — reached BOTH on a transient
+ *      OAuth-store error AND when the store requires login (LoginRequiredError:
+ *      no `vibedefend login` yet, or a rejected refresh token). The MCP server
+ *      may have been authenticated through the agent's OWN native OAuth (Claude
+ *      Code / Codex keychain), which is a perfectly valid bearer token. See
+ *      BACK-124: short-circuiting to null on LoginRequiredError silently
+ *      disabled every Action Guard for keychain-only users.
  *
- * Returns null when:
- *   - No credentials of any kind are stored (CYBEDEFEND_TOKEN env, keychain,
- *     or OAuth store), OR
- *   - The refresh_token was rejected by Logto (LoginRequiredError) — in this
- *     case local credentials are already cleared; the caller should trigger
- *     the UNVERIFIED banner.
+ * Returns null ONLY when no source yields a token. The caller then surfaces the
+ * loud UNVERIFIED banner (fail-open) instead of hard-blocking the session.
  *
  * Never throws — all errors are converted to null so hook callers remain
  * fail-open.
  */
-export async function resolveTokenWithRefresh(mcpName) {
+export async function resolveTokenWithRefresh(mcpName, deps = {}) {
+    const getValidAccessTokenFn = deps.getValidAccessToken ?? getValidAccessToken;
+    const resolveTokenFn = deps.resolveTokenFn ?? resolveToken;
     // 1. Env var takes highest precedence (CI / scripted use).
     const envToken = process.env.CYBEDEFEND_TOKEN;
     if (envToken && envToken.length > 0)
         return envToken;
     // 2. Try the new OAuth-store path (includes transparent refresh).
     try {
-        const token = await getValidAccessToken(mcpName);
+        const token = await getValidAccessTokenFn(mcpName);
         if (token)
             return token;
     }
     catch (e) {
         if (e instanceof LoginRequiredError) {
-            // Refresh token rejected — caller triggers UNVERIFIED banner.
-            return null;
+            // BACK-124: the OAuth store has no usable credential — either the user
+            // never ran `vibedefend login`, or the stored refresh token was rejected.
+            // Do NOT give up here: the MCP server may have been authenticated through
+            // the AGENT's own native OAuth (Claude Code / Codex keychain), which is a
+            // perfectly valid bearer token. Fall through to the legacy keychain lookup
+            // below. Returning null unconditionally here silently fail-opened the
+            // guard on every tool call for anyone who only authenticated via the
+            // agent's MCP OAuth (the common case) — that is the .env-not-blocked bug.
+            // Only when the legacy lookup is ALSO empty do we return null, and the
+            // caller then surfaces the loud UNVERIFIED banner.
+            return resolveTokenFn(mcpName);
         }
         // Transient error (network/DNS) — fall through to the legacy path below
         // so a stale-but-unexpired legacy token can still be used.
     }
     // 3. Fall back to the synchronous legacy keychain lookup (pre-PKCE tokens).
-    return resolveToken(mcpName);
+    return resolveTokenFn(mcpName);
 }
 //# sourceMappingURL=resolve.js.map

package/dist/hooks/runtime/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/hooks/runtime/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAQ7E,MAAM,UAAU,gBAAgB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACvD,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,GAAG,0BAA0B,CAAC;IACpD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAGzB,CAAC;YACF,OAAO;gBACL,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;aAC7B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,yDAAyD;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,iBAAiB,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CACjB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,CAAC,EAChE;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAE3B,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,KAAK,EAAE,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACvD,OAAO,KAAK,CAAC,WAAW,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,gBAAgB;QAChB,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,sBAAsB,CAAC,OAAe;IAC7C,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,8DAA8D;IAC9D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CACjB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAC7E;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,oEAAoE;QACpE,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CACjB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,CAAC,EAC9D;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,OAAO,EAAE,IAAI;aACd,CACF,CAAC,IAAI,EAAE,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAI3B,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;QACpC,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CACxB,aAAa,EACb,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,EACxD;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe;IAEf,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;YACpC,8DAA8D;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,wEAAwE;QACxE,2DAA2D;IAC7D,CAAC;IAED,4EAA4E;IAC5E,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/hooks/runtime/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAQ7E,MAAM,UAAU,gBAAgB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACvD,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,GAAG,0BAA0B,CAAC;IACpD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAGzB,CAAC;YACF,OAAO;gBACL,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;aAC7B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,yDAAyD;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,iBAAiB,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CACjB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,CAAC,EAChE;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAE3B,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,KAAK,EAAE,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACvD,OAAO,KAAK,CAAC,WAAW,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,gBAAgB;QAChB,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,sBAAsB,CAAC,OAAe;IAC7C,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,8DAA8D;IAC9D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CACjB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAC7E;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,oEAAoE;QACpE,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CACjB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,CAAC,EAC9D;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,OAAO,EAAE,IAAI;aACd,CACF,CAAC,IAAI,EAAE,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAI3B,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;QACpC,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CACxB,aAAa,EACb,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,EACxD;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,OAAyB,EAAE;IAE3B,MAAM,qBAAqB,GAAG,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,CAAC;IAC9E,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;IAE3D,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;YACpC,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,sEAAsE;YACtE,qEAAqE;YACrE,0EAA0E;YAC1E,uEAAuE;YACvE,mDAAmD;YACnD,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,wEAAwE;QACxE,2DAA2D;IAC7D,CAAC;IAED,4EAA4E;IAC5E,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC"}