@ddtcorex/dsh-maestro-guard 0.1.0 → 0.2.0

package/cordis.patch.yml

@@ -2,3 +2,4 @@
 - insert:
     - id: dsh-maestro-guard
       name: '@ddtcorex/dsh-maestro-guard'
+      channel: /dsh-maestro-guard

package/lib/approval-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-store.d.ts","sourceRoot":"","sources":["../src/approval-store.ts"],"names":[],"mappings":"AAKA,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,UAA8E;AAC5H,eAAO,MAAM,OAAO,sBAAgB,CAAA;AASpC,qBAAa,aAAa;IACZ,OAAO,CAAC,OAAO,CAAC;gBAAR,OAAO,CAAC,EAAE,MAAM,YAAA;IAC9B,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAGxC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1C,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAS1C"}
+{"version":3,"file":"approval-store.d.ts","sourceRoot":"","sources":["../src/host/approval-store.ts"],"names":[],"mappings":"AAKA,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,UAA8E;AAC5H,eAAO,MAAM,OAAO,sBAAgB,CAAA;AASpC,qBAAa,aAAa;IACZ,OAAO,CAAC,OAAO,CAAC;gBAAR,OAAO,CAAC,EAAE,MAAM,YAAA;IAC9B,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAGxC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1C,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAS1C"}

package/lib/approval-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-store.js","sourceRoot":"","sources":["../src/approval-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,SAAS,WAAW,CAAC,OAAgB,IAAI,OAAO,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA,CAAC,CAAC;AAC5G,MAAM,UAAU,aAAa,CAAC,OAAgB,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAA,CAAC,CAAC;AAC5H,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAA;AAEpC,IAAI,MAAM,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAA;AAChD,SAAS,OAAO,CAAI,EAAoB;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAe,CAAA;IAC3C,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC1B,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,OAAO,aAAa;IACJ;IAApB,YAAoB,OAAgB;QAAhB,YAAO,GAAP,OAAO,CAAS;IAAG,CAAC;IACxC,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,CAAA;QAAC,CAAC;IACrG,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,IAAY,IAAsB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC;IAClG,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC3B,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;YACd,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YACzD,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAClF,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACvB,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YACzD,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAClF,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACvB,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"approval-store.js","sourceRoot":"","sources":["../src/host/approval-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,SAAS,WAAW,CAAC,OAAgB,IAAI,OAAO,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA,CAAC,CAAC;AAC5G,MAAM,UAAU,aAAa,CAAC,OAAgB,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAA,CAAC,CAAC;AAC5H,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAA;AAEpC,IAAI,MAAM,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAA;AAChD,SAAS,OAAO,CAAI,EAAoB;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAe,CAAA;IAC3C,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC1B,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,OAAO,aAAa;IACJ;IAApB,YAAoB,OAAgB;QAAhB,YAAO,GAAP,OAAO,CAAS;IAAG,CAAC;IACxC,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,CAAA;QAAC,CAAC;IACrG,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,IAAY,IAAsB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC;IAClG,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC3B,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;YACd,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YACzD,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAClF,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACvB,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YACzD,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAClF,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACvB,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/lib/approve-tool.d.ts

@@ -0,0 +1,25 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { PendingRequest, PendingStore } from './pending.js';
+export declare const name = "maestro-guard-approve-tools";
+export declare const inject: readonly ["tools"];
+export interface ApproveResult {
+    ok: boolean;
+    requestId: string;
+    scope: string;
+    status: string;
+    message?: string;
+}
+export interface ListResult {
+    ok: true;
+    requests: PendingRequest[];
+}
+export declare function createApproveTools(deps: {
+    pending: PendingStore;
+}): {
+    approve(requestId: string): Promise<ApproveResult>;
+    list(): Promise<ListResult>;
+};
+export declare function applyApproveTools(ctx: Context, deps: {
+    pending: PendingStore;
+}): void;
+//# sourceMappingURL=approve-tool.d.ts.map

package/lib/approve-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve-tool.d.ts","sourceRoot":"","sources":["../src/host/approve-tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhE,eAAO,MAAM,IAAI,gCAAgC,CAAA;AACjD,eAAO,MAAM,MAAM,oBAAqB,CAAA;AAExC,MAAM,WAAW,aAAa;IAAG,EAAE,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE;AAClH,MAAM,WAAW,UAAU;IAAG,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE;AAEpE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,YAAY,CAAA;CAAE;uBAErC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;YAU1C,OAAO,CAAC,UAAU,CAAC;EAIpC;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,OAAO,EAAE,YAAY,CAAA;CAAE,GAAG,IAAI,CAgCrF"}

package/lib/approve-tool.js

@@ -0,0 +1,54 @@
+import { defineTool } from '@deepseek-ai/dsh-tools';
+export const name = 'maestro-guard-approve-tools';
+export const inject = ['tools'];
+export function createApproveTools(deps) {
+    return {
+        async approve(requestId) {
+            if (typeof requestId !== 'string' || requestId.length === 0) {
+                return { ok: false, requestId: '', scope: '', status: 'error', message: 'requestId (string) is required' };
+            }
+            const req = await deps.pending.approve(requestId);
+            if (!req) {
+                return { ok: false, requestId, scope: '', status: 'error', message: `no pending request with id ${requestId}` };
+            }
+            return { ok: true, requestId: req.id, scope: req.scope, status: req.status };
+        },
+        async list() {
+            return { ok: true, requests: await deps.pending.list() };
+        },
+    };
+}
+export function applyApproveTools(ctx, deps) {
+    const tools = createApproveTools(deps);
+    ctx.effect(() => ctx.tools.register(defineTool({
+        name: 'maestro_guard_approve',
+        description: 'Approve one recorded guard request so its exact blocked operation may run once. Call after the human approves the operation in the conversation.',
+        parameters: { requestId: { type: 'string', description: 'the request id from the guard block message or maestro_guard_list' } },
+        output: {
+            schema: {
+                type: 'object', additionalProperties: true,
+                properties: { ok: { type: 'boolean', required: true }, requestId: { type: 'string', required: true }, scope: { type: 'string', required: true }, status: { type: 'string', required: true }, message: { type: 'string' } },
+            },
+            render: (_a, v) => [{ type: 'text', text: v.ok ? `approved request ${v.requestId} (scope ${v.scope})` : `approve failed: ${v.message ?? v.status}` }],
+        },
+        async execute(args) {
+            return tools.approve(args?.requestId);
+        },
+    })));
+    ctx.effect(() => ctx.tools.register(defineTool({
+        name: 'maestro_guard_list',
+        description: 'List guard tickets (pending/approved/consumed) with redacted commands. Read-only.',
+        parameters: {},
+        output: {
+            schema: {
+                type: 'object', additionalProperties: true,
+                properties: { ok: { type: 'boolean', required: true }, requests: { type: 'array', required: true, items: { type: 'object', additionalProperties: true } } },
+            },
+            render: (_a, v) => [{ type: 'text', text: (v.requests ?? []).map((r) => `${r.status} ${r.id} ${r.scope} @${r.requestedAt} ${String(r.command ?? '').slice(0, 80)}`).join('\n') || 'no guard requests' }],
+        },
+        async execute() {
+            return tools.list();
+        },
+    })));
+}
+//# sourceMappingURL=approve-tool.js.map

package/lib/approve-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve-tool.js","sourceRoot":"","sources":["../src/host/approve-tool.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGnD,MAAM,CAAC,MAAM,IAAI,GAAG,6BAA6B,CAAA;AACjD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAU,CAAA;AAKxC,MAAM,UAAU,kBAAkB,CAAC,IAA+B;IAChE,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAA;YAC5G,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YACjD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,8BAA8B,SAAS,EAAE,EAAE,CAAA;YACjH,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;QAC9E,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAA;QAC1D,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAY,EAAE,IAA+B;IAC7E,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACtC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7C,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EAAE,kJAAkJ;QAC/J,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mEAAmE,EAAE,EAAE;QAC/H,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI;gBAC1C,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;aAC3N;YACD,MAAM,EAAE,CAAC,EAAW,EAAE,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,SAAS,WAAW,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SACpK;QACD,KAAK,CAAC,OAAO,CAAC,IAAS;YACrB,OAAO,KAAK,CAAC,OAAO,CAAE,IAAY,EAAE,SAAS,CAAQ,CAAA;QACvD,CAAC;KACF,CAAC,CAAC,CAAC,CAAA;IACJ,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7C,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,mFAAmF;QAChG,UAAU,EAAE,EAAE;QACd,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI;gBAC1C,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,EAAE;aAC5J;YACD,MAAM,EAAE,CAAC,EAAW,EAAE,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,EAAE,CAAC;SAC5N;QACD,KAAK,CAAC,OAAO;YACX,OAAO,KAAK,CAAC,IAAI,EAAS,CAAA;QAC5B,CAAC;KACF,CAAC,CAAC,CAAC,CAAA;AACN,CAAC"}

package/lib/full-scan-tool.d.ts

@@ -0,0 +1,7 @@
+import type { Context } from '@deepseek-ai/cordis';
+export declare const name = "maestro-full-scan-tool";
+export declare const inject: readonly ["tools"];
+export declare function apply(ctx: Context, config?: {
+    rootPath?: string;
+}): void;
+//# sourceMappingURL=full-scan-tool.d.ts.map

package/lib/full-scan-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"full-scan-tool.d.ts","sourceRoot":"","sources":["../src/host/full-scan-tool.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,eAAO,MAAM,IAAI,2BAA2B,CAAA;AAC5C,eAAO,MAAM,MAAM,oBAAqB,CAAA;AAkCxC,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAC;IAAC,QAAQ,CAAC,EAAC,MAAM,CAAA;CAAI,QA8B/D"}

package/lib/full-scan-tool.js

@@ -0,0 +1,79 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import { defineTool } from '@deepseek-ai/dsh-tools';
+export const name = 'maestro-full-scan-tool';
+export const inject = ['tools'];
+function workspaceRootFor(c, e) {
+    if (c)
+        return c;
+    const cwd = e?.agent?.session?.header?.cwd;
+    return typeof cwd === 'string' && cwd ? cwd : process.cwd();
+}
+function resolveScript(root) {
+    const direct = join(root, 'scripts/enforce-rules.mjs');
+    if (existsSync(direct))
+        return direct;
+    // fallback: walk up from root and from process.cwd() to find workspace root containing scripts/enforce-rules.mjs
+    const candidates = [];
+    // try ancestors of root
+    let cur = resolve(root);
+    for (let i = 0; i < 8; i++) {
+        const cand = join(cur, 'scripts/enforce-rules.mjs');
+        if (existsSync(cand))
+            return cand;
+        candidates.push(cand);
+        const parent = resolve(cur, '..');
+        if (parent === cur)
+            break;
+        cur = parent;
+    }
+    // try ancestors of process.cwd()
+    cur = process.cwd();
+    for (let i = 0; i < 8; i++) {
+        const cand = join(cur, 'scripts/enforce-rules.mjs');
+        if (existsSync(cand))
+            return cand;
+        const parent = resolve(cur, '..');
+        if (parent === cur)
+            break;
+        cur = parent;
+    }
+    // try maestro-harness workspace root resolved via __dirname ancestor search for packages/dsh-maestro-guard
+    // last resort: return direct (will error but report will contain command)
+    return direct;
+}
+export function apply(ctx, config = {}) {
+    ctx.effect(() => ctx.tools.register(defineTool({
+        name: 'maestro_full_scan',
+        description: 'Run full enforce-rules scan (blacklist + protection + publish gate) and return report. No approval needed; read-only.',
+        parameters: { rootPath: { type: 'string', description: 'workspace root override' } },
+        output: { schema: { type: 'object', additionalProperties: true, properties: { ok: { type: 'boolean', required: true }, report: { type: 'string', required: true }, code: { type: 'number', required: true } } }, render: (_a, v) => [{ type: 'text', text: v.report.slice(0, 4000) }] },
+        async execute(args, exec) {
+            const root = workspaceRootFor(args?.rootPath ?? config.rootPath, exec);
+            const script = resolveScript(root);
+            if (!existsSync(script)) {
+                return { ok: true, report: `enforce-rules: no script found at ${script} (standalone repo, skipping)`, code: 0 };
+            }
+            const run = (extra) => {
+                const r = spawnSync('node', [script, ...extra], { encoding: 'utf-8', timeout: 30000 });
+                return { code: r.status ?? 0, out: (r.stdout ?? '') + (r.stderr ?? '') };
+            };
+            let combined = '';
+            let ok = true;
+            const a = run([]);
+            combined += `$ node scripts/enforce-rules.mjs\n${a.out}\n`;
+            if (a.code !== 0)
+                ok = false;
+            const b = run(['--check-protection']);
+            combined += `$ node scripts/enforce-rules.mjs --check-protection\n${b.out}\n`;
+            if (b.code !== 0)
+                combined += `[warn] --check-protection non-zero (may need gh auth)\n`;
+            const c = run(['--check-publish']);
+            combined += `$ node scripts/enforce-rules.mjs --check-publish\n${c.out}\n`;
+            // do not fail on --check-publish when no tag
+            return { ok, report: combined.slice(0, 12000), code: ok ? 0 : 1 };
+        }
+    })));
+}
+//# sourceMappingURL=full-scan-tool.js.map

package/lib/full-scan-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"full-scan-tool.js","sourceRoot":"","sources":["../src/host/full-scan-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnD,MAAM,CAAC,MAAM,IAAI,GAAG,wBAAwB,CAAA;AAC5C,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAU,CAAA;AACxC,SAAS,gBAAgB,CAAC,CAAkB,EAAE,CAAS;IACrD,IAAI,CAAC;QAAE,OAAO,CAAC,CAAA;IACf,MAAM,GAAG,GAAE,CAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAA;IACjD,OAAO,OAAO,GAAG,KAAG,QAAQ,IAAE,GAAG,CAAA,CAAC,CAAA,GAAG,CAAA,CAAC,CAAA,OAAO,CAAC,GAAG,EAAE,CAAA;AACrD,CAAC;AACD,SAAS,aAAa,CAAC,IAAW;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAA;IACtD,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IACrC,iHAAiH;IACjH,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,wBAAwB;IACxB,IAAI,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvB,KAAK,IAAI,CAAC,GAAC,CAAC,EAAC,CAAC,GAAC,CAAC,EAAC,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAA;QACnD,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACjC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACjC,IAAI,MAAM,KAAG,GAAG;YAAE,MAAK;QACvB,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IACD,iCAAiC;IACjC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACnB,KAAK,IAAI,CAAC,GAAC,CAAC,EAAC,CAAC,GAAC,CAAC,EAAC,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAA;QACnD,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACjC,IAAI,MAAM,KAAG,GAAG;YAAE,MAAK;QACvB,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;IACD,2GAA2G;IAC3G,0EAA0E;IAC1E,OAAO,MAAM,CAAA;AACf,CAAC;AACD,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAA0B,EAAE;IAC9D,GAAG,CAAC,MAAM,CAAC,GAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5C,IAAI,EAAC,mBAAmB;QACxB,WAAW,EAAC,uHAAuH;QACnI,UAAU,EAAC,EAAE,QAAQ,EAAC,EAAC,IAAI,EAAC,QAAQ,EAAE,WAAW,EAAC,yBAAyB,EAAC,EAAE;QAC9E,MAAM,EAAC,EAAE,MAAM,EAAC,EAAC,IAAI,EAAC,QAAQ,EAAE,oBAAoB,EAAC,IAAI,EAAE,UAAU,EAAC,EAAC,EAAE,EAAC,EAAC,IAAI,EAAC,SAAS,EAAE,QAAQ,EAAC,IAAI,EAAC,EAAE,MAAM,EAAC,EAAC,IAAI,EAAC,QAAQ,EAAE,QAAQ,EAAC,IAAI,EAAC,EAAE,IAAI,EAAC,EAAC,IAAI,EAAC,QAAQ,EAAE,QAAQ,EAAC,IAAI,EAAC,EAAC,EAAC,EAAE,MAAM,EAAC,CAAC,EAAM,EAAC,CAAK,EAAC,EAAE,CAAA,CAAC,EAAC,IAAI,EAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAC,IAAI,CAAC,EAAC,CAAC,EAAE;QAC/P,KAAK,CAAC,OAAO,CAAC,IAAQ,EAAE,IAAY;YAClC,MAAM,IAAI,GAAG,gBAAgB,CAAE,IAAY,EAAE,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YAC/E,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxB,OAAO,EAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,qCAAqC,MAAM,8BAA8B,EAAE,IAAI,EAAE,CAAC,EAAC,CAAA;YAC/G,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,KAAc,EAAC,EAAE;gBAC5B,MAAM,CAAC,GAAC,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,EAAC,QAAQ,EAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAC,CAAC,CAAA;gBACjF,OAAO,EAAC,IAAI,EAAE,CAAC,CAAC,MAAM,IAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,IAAE,EAAE,CAAC,GAAC,CAAC,CAAC,CAAC,MAAM,IAAE,EAAE,CAAC,EAAC,CAAA;YAChE,CAAC,CAAA;YACD,IAAI,QAAQ,GAAC,EAAE,CAAA;YACf,IAAI,EAAE,GAAC,IAAI,CAAA;YACX,MAAM,CAAC,GAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACf,QAAQ,IAAE,qCAAqC,CAAC,CAAC,GAAG,IAAI,CAAA;YACxD,IAAI,CAAC,CAAC,IAAI,KAAG,CAAC;gBAAE,EAAE,GAAC,KAAK,CAAA;YACxB,MAAM,CAAC,GAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAA;YACnC,QAAQ,IAAE,wDAAwD,CAAC,CAAC,GAAG,IAAI,CAAA;YAC3E,IAAI,CAAC,CAAC,IAAI,KAAG,CAAC;gBAAE,QAAQ,IAAE,yDAAyD,CAAA;YACnF,MAAM,CAAC,GAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAA;YAChC,QAAQ,IAAE,qDAAqD,CAAC,CAAC,GAAG,IAAI,CAAA;YACxE,6CAA6C;YAC7C,OAAO,EAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAA,CAAC,CAAA,CAAC,CAAA,CAAC,CAAA,CAAC,EAAC,CAAA;QAC5D,CAAC;KACF,CAAC,CAAC,CAAC,CAAA;AACN,CAAC"}

package/lib/index.d.ts

@@ -1,8 +1,9 @@
 import type { Context } from '@deepseek-ai/cordis';
 import { ApprovalStore } from './approval-store.js';
 import { PermissionPolicy } from './permission-policy.js';
+import { PendingStore } from './pending.js';
 import type { GuardToolExecution, GuardPreToolDecision } from './augment.js';
-export declare function createGuardHandler(store: ApprovalStore, policy: PermissionPolicy): (exec: GuardToolExecution, next: () => Promise<GuardPreToolDecision>) => Promise<GuardPreToolDecision>;
+export declare function createGuardHandler(store: ApprovalStore, policy: PermissionPolicy, pending: PendingStore, readConfig?: () => Promise<Record<string, unknown>>): (exec: GuardToolExecution, next: () => Promise<GuardPreToolDecision>) => Promise<GuardPreToolDecision>;
 declare const _default: {
     inject: readonly ["tools"];
     apply(ctx: Context): void;

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAE5E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,IACjE,MAAM,kBAAkB,EAAE,MAAM,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAG,OAAO,CAAC,oBAAoB,CAAC,CAmBlH;;;eAIY,OAAO;;AAFpB,wBAQC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/host/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAc,MAAM,cAAc,CAAA;AAKvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAmD5E,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,YAAY,EACrB,UAAU,GAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAmB,IAEtD,MAAM,kBAAkB,EAAE,MAAM,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAG,OAAO,CAAC,oBAAoB,CAAC,CAuGlH;;;eAIY,OAAO;;AAFpB,wBAYC"}

package/lib/index.js

@@ -1,10 +1,148 @@
+import { execSync } from 'node:child_process';
 import { ApprovalStore } from './approval-store.js';
 import { PermissionPolicy } from './permission-policy.js';
+import { PendingStore, ticketHash } from './pending.js';
 import { containsSecret, redact } from './secret-redactor.js';
-export function createGuardHandler(store, policy) {
+import { checkSandbox, extractCommandText, isBlockedCommand, isBlockedGitCommand, resolveCurrentBranch } from './sandbox.js';
+import { apply as applyFullScan } from './full-scan-tool.js';
+import { applyApproveTools } from './approve-tool.js';
+function getCurrentBranch(cwd) {
+    if (!cwd)
+        return undefined;
+    try {
+        return execSync('git branch --show-current', { cwd, timeout: 800, encoding: 'utf-8' }).trim() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function getSessionCwd(exec) {
+    const e = exec;
+    return (e?.agent?.session?.header?.cwd ??
+        e?.session?.header?.cwd ??
+        e?.header?.cwd ??
+        e?.cwd ??
+        undefined);
+}
+async function readGuardConfig() {
+    try {
+        const mod = await import('@ddtcorex/dsh-maestro-config-lib');
+        if (typeof mod.load === 'function') {
+            try {
+                const doc = await mod.load();
+                if (doc?.domains?.guard && typeof doc.domains.guard === 'object' && !Array.isArray(doc.domains.guard)) {
+                    return doc.domains.guard;
+                }
+            }
+            catch { }
+        }
+        if (typeof mod.get === 'function') {
+            try {
+                const g = await mod.get('guard');
+                if (g && typeof g === 'object' && !Array.isArray(g))
+                    return g;
+            }
+            catch { }
+        }
+        if (typeof mod.readFlat === 'function') {
+            try {
+                const flat = await mod.readFlat();
+                if (flat && typeof flat === 'object' && flat.guard && typeof flat.guard === 'object') {
+                    return flat.guard;
+                }
+            }
+            catch { }
+        }
+    }
+    catch { }
+    return {};
+}
+export function createGuardHandler(store, policy, pending, readConfig = readGuardConfig) {
     return async (exec, next) => {
         const tool = exec.name ?? exec.tool ?? '';
         const rawArgs = exec?.args ?? exec?.arguments;
+        // Sandbox hard gate: credential paths, ~/.cloudflared, NPM_TOKEN, git-protection, publish, cwd (via checkSandbox)
+        const cwd = getSessionCwd(exec);
+        // Branch detection follows the repo the command actually targets (cd / git -C),
+        // not the session cwd — a session whose cwd repo sits on master must not block
+        // feature-branch pushes inside sub-repos (fix/guard-protection-precision).
+        const commandText = extractCommandText(rawArgs);
+        // Resolve the current branch lazily, only when the executed command could
+        // plausibly be a git/gh operation — otherwise every tool call (reads,
+        // writes, memory, unrelated bash) would spawn `git branch --show-current`
+        // for nothing.
+        const branchRelevant = commandText != null && /\b(git|gh)\b/i.test(commandText);
+        const currentBranch = branchRelevant ? resolveCurrentBranch(commandText, cwd, getCurrentBranch) : undefined;
+        const asTextForSandbox = rawArgs != null ? JSON.stringify(rawArgs) : '';
+        const combinedForCheck = `${tool} ${asTextForSandbox}`;
+        // Read guard config at runtime (injected lists) — fallback to defaults when empty
+        const guardCfg = await readConfig().catch(() => ({}));
+        const credentialPaths = Array.isArray(guardCfg.credentialPaths) ? guardCfg.credentialPaths : undefined;
+        const gitProtection = guardCfg.gitProtection && typeof guardCfg.gitProtection === 'object' ? guardCfg.gitProtection : undefined;
+        const publishBlocked = typeof guardCfg.publishBlocked === 'boolean' ? guardCfg.publishBlocked : undefined;
+        const cwdContainment = typeof guardCfg.cwdContainment === 'boolean' ? guardCfg.cwdContainment : undefined;
+        const publishBlockedEffective = publishBlocked ?? true;
+        const gitEnabled = gitProtection?.enabled ?? true;
+        const branches = gitProtection?.branches ?? ['master', 'main'];
+        const isPublish = publishBlockedEffective && commandText ? isBlockedCommand(commandText) : false;
+        let approvedForPublish = false;
+        if (isPublish) {
+            approvedForPublish =
+                (await store.isApproved('publish')) ||
+                    (await store.isApproved('pnpm-publish')) ||
+                    (await store.isApproved('pnpm publish')) ||
+                    (await store.isApproved(tool));
+        }
+        const isGitProtected = gitEnabled && commandText ? isBlockedGitCommand(commandText, currentBranch, branches) : false;
+        let approvedForGit = false;
+        if (isGitProtected) {
+            approvedForGit =
+                (await store.isApproved('git-protection')) ||
+                    (await store.isApproved('publish')) ||
+                    (await store.isApproved(tool));
+        }
+        const sandboxRes = checkSandbox(tool, rawArgs, {
+            cwd,
+            currentBranch,
+            approved: isGitProtected ? approvedForGit : approvedForPublish,
+            credentialPaths,
+            gitProtection,
+            publishBlocked,
+            cwdContainment,
+        });
+        if (sandboxRes.blocked) {
+            const scope = sandboxRes.reason?.includes('publish') ? 'publish' : 'git-protection';
+            const sessionId = exec?.agent?.session?.id ?? undefined;
+            // Hash over the executed command when available, not the full (tool + args)
+            // serialization — cosmetic arg fields (description, timeoutMs) must not
+            // mint a fresh ticket for a re-run of the same command (fix/guard-protection-precision).
+            const canonical = commandText ?? combinedForCheck;
+            const cmdText = redact(canonical.slice(0, 300));
+            const hash = ticketHash(scope, cmdText);
+            const approved = await pending.findApprovedByHash(scope, hash, sessionId);
+            if (approved) {
+                await pending.consume(approved.id); // exactly one retry passes (consume is mutex-serialized)
+            }
+            if (!approved) {
+                try {
+                    const req = await pending.record({
+                        scope,
+                        tool,
+                        command: cmdText,
+                        reason: sandboxRes.reason ?? 'blocked',
+                        sessionId,
+                        cwd,
+                    });
+                    throw new Error(`Guard: ${sandboxRes.reason} — request ${req.id}; present this exact operation in the conversation, then approve via the approve tool after the human consents`);
+                }
+                catch (e) {
+                    if (e instanceof Error && e.message.startsWith('Guard:'))
+                        throw e;
+                    throw new Error(`Guard: ${sandboxRes.reason}`);
+                }
+            }
+            // approved: fall through to the shared tail (policy check, secret redaction, next())
+        }
         if (!policy.isAllowed(tool, rawArgs)) {
             throw new Error(`Guard: tool ${tool} denied by policy`);
         }
@@ -28,9 +166,13 @@ export default {
     inject: ['tools'],
     apply(ctx) {
         const store = new ApprovalStore();
+        const pending = new PendingStore();
         const policy = new PermissionPolicy({ deny: ['danger-tool'] });
-        const handler = createGuardHandler(store, policy);
+        const handler = createGuardHandler(store, policy, pending);
         ctx.effect(() => ctx.on('tools/pre-execute', handler));
+        // register on-demand full-scan tool (Task 4) alongside guard handler
+        applyFullScan(ctx, {});
+        applyApproveTools(ctx, { pending });
     }
 };
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAG7D,MAAM,UAAU,kBAAkB,CAAC,KAAoB,EAAE,MAAwB;IAC/E,OAAO,KAAK,EAAE,IAAwB,EAAE,IAAyC,EAAiC,EAAE;QAClH,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,IAAK,IAA2B,CAAC,IAAI,IAAI,EAAE,CAAA;QACzF,MAAM,OAAO,GAAI,IAAY,EAAE,IAAI,IAAK,IAAY,EAAE,SAAS,CAAA;QAC/D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,mBAAmB,CAAC,CAAA;QACzD,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,oBAAoB,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YACtC,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;gBAC3C,IAAI,MAAM,IAAI,IAAI;oBAAG,IAAY,CAAC,IAAI,GAAG,QAAQ,CAAA;gBACjD,IAAI,WAAW,IAAI,IAAI;oBAAG,IAAY,CAAC,SAAS,GAAG,QAAQ,CAAA;YAC7D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC;AAED,eAAe;IACb,MAAM,EAAE,CAAC,OAAO,CAAU;IAC1B,KAAK,CAAC,GAAY;QAChB,MAAM,KAAK,GAAG,IAAI,aAAa,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;QAC9D,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACjD,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAA;IACxD,CAAC;CACF,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/host/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAC5H,OAAO,EAAE,KAAK,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAGrD,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,2BAA2B,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAA;IAC5G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,MAAM,CAAC,GAAQ,IAAW,CAAA;IAC1B,OAAO,CACL,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG;QAC9B,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG;QACvB,CAAC,EAAE,MAAM,EAAE,GAAG;QACd,CAAC,EAAE,GAAG;QACN,SAAS,CACV,CAAA;AACH,CAAC;AAED,KAAK,UAAU,eAAe;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAQ,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAA;QACjE,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;gBAC5B,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtG,OAAO,GAAG,CAAC,OAAO,CAAC,KAAgC,CAAA;gBACrD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAChC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;oBAAE,OAAO,CAA4B,CAAA;YAC1F,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAA;gBACjC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAK,IAAY,CAAC,KAAK,IAAI,OAAQ,IAAY,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACvG,OAAQ,IAAY,CAAC,KAAgC,CAAA;gBACvD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,EAAE,CAAA;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAoB,EACpB,MAAwB,EACxB,OAAqB,EACrB,aAAqD,eAAe;IAEpE,OAAO,KAAK,EAAE,IAAwB,EAAE,IAAyC,EAAiC,EAAE;QAClH,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,IAAK,IAA2B,CAAC,IAAI,IAAI,EAAE,CAAA;QACzF,MAAM,OAAO,GAAI,IAAY,EAAE,IAAI,IAAK,IAAY,EAAE,SAAS,CAAA;QAE/D,kHAAkH;QAClH,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;QAC/B,gFAAgF;QAChF,+EAA+E;QAC/E,2EAA2E;QAC3E,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC/C,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,eAAe;QACf,MAAM,cAAc,GAAG,WAAW,IAAI,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC/E,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC,WAAW,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC3G,MAAM,gBAAgB,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACvE,MAAM,gBAAgB,GAAG,GAAG,IAAI,IAAI,gBAAgB,EAAE,CAAA;QACtD,kFAAkF;QAClF,MAAM,QAAQ,GAAG,MAAM,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAA8B,CAAA,CAAC,CAAA;QAChF,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAE,QAAgB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAE,QAAgB,CAAC,eAA2B,CAAC,CAAC,CAAC,SAAS,CAAA;QACpI,MAAM,aAAa,GAAI,QAAgB,CAAC,aAAa,IAAI,OAAQ,QAAgB,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAgB,CAAC,aAAyD,CAAC,CAAC,CAAC,SAAS,CAAA;QACtM,MAAM,cAAc,GAAG,OAAQ,QAAgB,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAE,QAAgB,CAAC,cAAyB,CAAC,CAAC,CAAC,SAAS,CAAA;QACtI,MAAM,cAAc,GAAG,OAAQ,QAAgB,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAE,QAAgB,CAAC,cAAyB,CAAC,CAAC,CAAC,SAAS,CAAA;QAEtI,MAAM,uBAAuB,GAAG,cAAc,IAAI,IAAI,CAAA;QACtD,MAAM,UAAU,GAAG,aAAa,EAAE,OAAO,IAAI,IAAI,CAAA;QACjD,MAAM,QAAQ,GAAG,aAAa,EAAE,QAAQ,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAE9D,MAAM,SAAS,GAAG,uBAAuB,IAAI,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAChG,IAAI,kBAAkB,GAAG,KAAK,CAAA;QAC9B,IAAI,SAAS,EAAE,CAAC;YACd,kBAAkB;gBAChB,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;oBACnC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;oBACxC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;oBACxC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;QAClC,CAAC;QACD,MAAM,cAAc,GAAG,UAAU,IAAI,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACpH,IAAI,cAAc,GAAG,KAAK,CAAA;QAC1B,IAAI,cAAc,EAAE,CAAC;YACnB,cAAc;gBACZ,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;oBAC1C,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;oBACnC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;QAClC,CAAC;QACD,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE;YAC7C,GAAG;YACH,aAAa;YACb,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB;YAC9D,eAAe;YACf,aAAa;YACb,cAAc;YACd,cAAc;SACf,CAAC,CAAA;QACF,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,KAAK,GAAiC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAA;YACjH,MAAM,SAAS,GAAI,IAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,SAAS,CAAA;YAChE,4EAA4E;YAC5E,wEAAwE;YACxE,yFAAyF;YACzF,MAAM,SAAS,GAAG,WAAW,IAAI,gBAAgB,CAAA;YACjD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;YAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YACvC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;YACzE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA,CAAC,yDAAyD;YAC9F,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;wBAC/B,KAAK;wBACL,IAAI;wBACJ,OAAO,EAAE,OAAO;wBAChB,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,SAAS;wBACtC,SAAS;wBACT,GAAG;qBACJ,CAAC,CAAA;oBACF,MAAM,IAAI,KAAK,CAAC,UAAU,UAAU,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,gHAAgH,CAAC,CAAA;gBAClL,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;wBAAE,MAAM,CAAC,CAAA;oBACjE,MAAM,IAAI,KAAK,CAAC,UAAU,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;gBAChD,CAAC;YACH,CAAC;YACD,qFAAqF;QACvF,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,mBAAmB,CAAC,CAAA;QACzD,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,oBAAoB,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YACtC,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;gBAC3C,IAAI,MAAM,IAAI,IAAI;oBAAG,IAAY,CAAC,IAAI,GAAG,QAAQ,CAAA;gBACjD,IAAI,WAAW,IAAI,IAAI;oBAAG,IAAY,CAAC,SAAS,GAAG,QAAQ,CAAA;YAC7D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA;AACH,CAAC;AAED,eAAe;IACb,MAAM,EAAE,CAAC,OAAO,CAAU;IAC1B,KAAK,CAAC,GAAY;QAChB,MAAM,KAAK,GAAG,IAAI,aAAa,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,IAAI,YAAY,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;QAC9D,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;QAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,OAAc,CAAC,CAAC,CAAA;QAC7D,qEAAqE;QACrE,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QACtB,iBAAiB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACrC,CAAC;CACF,CAAA"}

package/lib/pending.d.ts

@@ -0,0 +1,44 @@
+export declare function pendingPath(dshHome?: string): string;
+export declare const MAX_PENDING = 20;
+/**
+ * How long an approval (and a pending ticket) stays actionable. Approved grants
+ * must not linger indefinitely as standing one-shot passes for any later session,
+ * and superseded pending tickets should not clutter the store forever.
+ */
+export declare const APPROVAL_TTL_MS: number;
+export interface PendingRequest {
+    id: string;
+    scope: 'git-protection' | 'publish';
+    tool: string;
+    hash: string;
+    command: string;
+    reason: string;
+    sessionId?: string;
+    cwd?: string;
+    requestedAt: string;
+    expiresAt?: string;
+    status: 'pending' | 'approved' | 'consumed' | 'expired';
+}
+export declare function ticketHash(scope: string, command: string): string;
+export declare class PendingStore {
+    private dshHome?;
+    private now;
+    constructor(dshHome?: string | undefined, now?: () => number);
+    private load;
+    private save;
+    /** Mark expired pending/approved tickets as 'expired' (mutates, persists). */
+    private prune;
+    record(opts: {
+        scope: 'git-protection' | 'publish';
+        tool: string;
+        command: string;
+        reason: string;
+        sessionId?: string;
+        cwd?: string;
+    }): Promise<PendingRequest>;
+    list(): Promise<PendingRequest[]>;
+    approve(id: string): Promise<PendingRequest | undefined>;
+    consume(id: string): Promise<boolean>;
+    findApprovedByHash(scope: string, hash: string, sessionId?: string): Promise<PendingRequest | undefined>;
+}
+//# sourceMappingURL=pending.d.ts.map

package/lib/pending.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending.d.ts","sourceRoot":"","sources":["../src/host/pending.ts"],"names":[],"mappings":"AAMA,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,UAA4E;AAExH,eAAO,MAAM,WAAW,KAAK,CAAA;AAE7B;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAAiB,CAAA;AAE7C,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,gBAAgB,GAAG,SAAS,CAAA;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAA;CACxD;AASD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjE;AAMD,qBAAa,YAAY;IACX,OAAO,CAAC,OAAO,CAAC;IAAU,OAAO,CAAC,GAAG;gBAA7B,OAAO,CAAC,EAAE,MAAM,YAAA,EAAU,GAAG,GAAE,MAAM,MAAiB;YAC5D,IAAI;YAGJ,IAAI;IAMlB,8EAA8E;YAChE,KAAK;IAWb,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,gBAAgB,GAAG,SAAS,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC;IA8B/J,IAAI,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAOjC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAYxD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUrC,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;CAe/G"}

package/lib/pending.js

@@ -0,0 +1,133 @@
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { randomUUID, createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+function resolveHome(dshHome) { return dshHome ?? process.env.DSH_HOME ?? join(homedir(), '.dsh'); }
+export function pendingPath(dshHome) { return join(resolveHome(dshHome), 'dsh-maestro-guard', 'pending.json'); }
+export const MAX_PENDING = 20;
+/**
+ * How long an approval (and a pending ticket) stays actionable. Approved grants
+ * must not linger indefinitely as standing one-shot passes for any later session,
+ * and superseded pending tickets should not clutter the store forever.
+ */
+export const APPROVAL_TTL_MS = 30 * 60 * 1000;
+let _queue = Promise.resolve();
+function enqueue(fn) {
+    const p = _queue.then(fn, fn);
+    _queue = p.catch(() => { });
+    return p;
+}
+export function ticketHash(scope, command) {
+    return createHash('sha1').update(scope + '\u0000' + command).digest('hex').slice(0, 12);
+}
+function isExpired(req, nowMs) {
+    return !!req.expiresAt && nowMs > Date.parse(req.expiresAt);
+}
+export class PendingStore {
+    dshHome;
+    now;
+    constructor(dshHome, now = Date.now) {
+        this.dshHome = dshHome;
+        this.now = now;
+    }
+    async load() {
+        try {
+            return JSON.parse(await readFile(pendingPath(this.dshHome), 'utf-8'));
+        }
+        catch {
+            return { requests: [] };
+        }
+    }
+    async save(doc) {
+        const p = pendingPath(this.dshHome);
+        await mkdir(dirname(p), { recursive: true, mode: 0o700 });
+        await writeFile(p, JSON.stringify(doc, null, 2), { encoding: 'utf-8', mode: 0o600 });
+        await chmod(p, 0o600);
+    }
+    /** Mark expired pending/approved tickets as 'expired' (mutates, persists). */
+    async prune(doc) {
+        const t = this.now();
+        let changed = false;
+        for (const r of doc.requests) {
+            if ((r.status === 'pending' || r.status === 'approved') && isExpired(r, t)) {
+                r.status = 'expired';
+                changed = true;
+            }
+        }
+        if (changed)
+            await this.save(doc);
+    }
+    async record(opts) {
+        return enqueue(async () => {
+            const doc = await this.load();
+            await this.prune(doc);
+            const hash = ticketHash(opts.scope, opts.command);
+            const existing = doc.requests.find((r) => r.scope === opts.scope && r.hash === hash && (r.status === 'pending' || r.status === 'approved'));
+            if (existing)
+                return existing;
+            const req = {
+                id: `g-${randomUUID().slice(0, 8)}`,
+                scope: opts.scope,
+                tool: opts.tool,
+                hash,
+                command: opts.command,
+                reason: opts.reason,
+                sessionId: opts.sessionId,
+                cwd: opts.cwd,
+                requestedAt: new Date(this.now()).toISOString(),
+                expiresAt: new Date(this.now() + APPROVAL_TTL_MS).toISOString(),
+                status: 'pending',
+            };
+            doc.requests.push(req);
+            const pending = doc.requests.filter((r) => r.status === 'pending' || r.status === 'approved');
+            const resolved = doc.requests.filter((r) => r.status === 'consumed' || r.status === 'expired');
+            const drop = Math.max(0, resolved.length - (MAX_PENDING - pending.length));
+            await this.save({ requests: [...pending, ...resolved.slice(drop)] });
+            return req;
+        });
+    }
+    async list() {
+        return enqueue(async () => {
+            const doc = await this.load();
+            await this.prune(doc);
+            return [...doc.requests].sort((a, b) => (a.requestedAt < b.requestedAt ? 1 : -1));
+        });
+    }
+    async approve(id) {
+        return enqueue(async () => {
+            const doc = await this.load();
+            await this.prune(doc);
+            const req = doc.requests.find((r) => r.id === id);
+            if (!req || req.status !== 'pending')
+                return undefined;
+            req.status = 'approved';
+            req.expiresAt = new Date(this.now() + APPROVAL_TTL_MS).toISOString();
+            await this.save(doc);
+            return req;
+        });
+    }
+    async consume(id) {
+        return enqueue(async () => {
+            const doc = await this.load();
+            const req = doc.requests.find((r) => r.id === id);
+            if (!req || req.status !== 'approved')
+                return false;
+            req.status = 'consumed';
+            await this.save(doc);
+            return true;
+        });
+    }
+    async findApprovedByHash(scope, hash, sessionId) {
+        return enqueue(async () => {
+            const doc = await this.load();
+            await this.prune(doc);
+            const t = this.now();
+            return doc.requests.find((r) => r.scope === scope &&
+                r.hash === hash &&
+                r.status === 'approved' &&
+                !isExpired(r, t) &&
+                (r.sessionId ? r.sessionId === sessionId : true));
+        });
+    }
+}
+//# sourceMappingURL=pending.js.map

package/lib/pending.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending.js","sourceRoot":"","sources":["../src/host/pending.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,SAAS,WAAW,CAAC,OAAgB,IAAI,OAAO,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA,CAAC,CAAC;AAC5G,MAAM,UAAU,WAAW,CAAC,OAAgB,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,cAAc,CAAC,CAAA,CAAC,CAAC;AAExH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAA;AAE7B;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAgB7C,IAAI,MAAM,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAA;AAChD,SAAS,OAAO,CAAI,EAAoB;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAe,CAAA;IAC3C,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC1B,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,OAAe;IACvD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACzF,CAAC;AAED,SAAS,SAAS,CAAC,GAAmB,EAAE,KAAa;IACnD,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAC7D,CAAC;AAED,MAAM,OAAO,YAAY;IACH;IAA0B;IAA9C,YAAoB,OAAgB,EAAU,MAAoB,IAAI,CAAC,GAAG;QAAtD,YAAO,GAAP,OAAO,CAAS;QAAU,QAAG,GAAH,GAAG,CAAyB;IAAG,CAAC;IACtE,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;QAAC,CAAC;IACjH,CAAC;IACO,KAAK,CAAC,IAAI,CAAC,GAAmC;QACpD,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACzD,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACpF,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACvB,CAAC;IACD,8EAA8E;IACtE,KAAK,CAAC,KAAK,CAAC,GAAmC;QACrD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACpB,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC3E,CAAC,CAAC,MAAM,GAAG,SAAS,CAAA;gBACpB,OAAO,GAAG,IAAI,CAAA;YAChB,CAAC;QACH,CAAC;QACD,IAAI,OAAO;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,IAA8H;QACzI,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;YACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CACxG,CAAA;YACD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAA;YAC7B,MAAM,GAAG,GAAmB;gBAC1B,EAAE,EAAE,KAAK,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;gBACnC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI;gBACJ,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;gBAC/C,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,CAAC,WAAW,EAAE;gBAC/D,MAAM,EAAE,SAAS;aAClB,CAAA;YACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtB,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAA;YAC7F,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAA;YAC9F,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;YAC1E,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAA;YACpE,OAAO,GAAG,CAAA;QACZ,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,CAAC,IAAI;QACR,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACrB,OAAO,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACnF,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YACjD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACtD,GAAG,CAAC,MAAM,GAAG,UAAU,CAAA;YACvB,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,CAAC,WAAW,EAAE,CAAA;YACpE,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACpB,OAAO,GAAG,CAAA;QACZ,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YACjD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAA;YACnD,GAAG,CAAC,MAAM,GAAG,UAAU,CAAA;YACvB,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACpB,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,IAAY,EAAE,SAAkB;QACtE,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACpB,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CACtB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,KAAK,KAAK,KAAK;gBACjB,CAAC,CAAC,IAAI,KAAK,IAAI;gBACf,CAAC,CAAC,MAAM,KAAK,UAAU;gBACvB,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CACnD,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/lib/permission-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-policy.d.ts","sourceRoot":"","sources":["../src/permission-policy.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAAG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE;AAClE,qBAAa,gBAAgB;IACf,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IACvC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO;IAKhD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAC,MAAM,GAAC,KAAK;CAM1C"}
+{"version":3,"file":"permission-policy.d.ts","sourceRoot":"","sources":["../src/host/permission-policy.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAAG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE;AAClE,qBAAa,gBAAgB;IACf,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IACvC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO;IAKhD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAC,MAAM,GAAC,KAAK;CAM1C"}

package/lib/permission-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-policy.js","sourceRoot":"","sources":["../src/permission-policy.ts"],"names":[],"mappings":"AACA,MAAM,OAAO,gBAAgB;IACP;IAApB,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAC3C,SAAS,CAAC,IAAY,EAAE,KAAc;QACpC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAClD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC9F,OAAO,IAAI,CAAA;IACb,CAAC;IACD,KAAK,CAAC,IAAY;QAChB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAA;QACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;QACjF,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAChE,OAAO,OAAO,CAAA;IAChB,CAAC;CACF"}
+{"version":3,"file":"permission-policy.js","sourceRoot":"","sources":["../src/host/permission-policy.ts"],"names":[],"mappings":"AACA,MAAM,OAAO,gBAAgB;IACP;IAApB,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAC3C,SAAS,CAAC,IAAY,EAAE,KAAc;QACpC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAClD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC9F,OAAO,IAAI,CAAA;IACb,CAAC;IACD,KAAK,CAAC,IAAY;QAChB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAA;QACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;QACjF,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAChE,OAAO,OAAO,CAAA;IAChB,CAAC;CACF"}