@defai.digital/ax-cli 3.5.2 → 3.6.0

package/dist/utils/audit-logger.js

@@ -0,0 +1,374 @@
+/**
+ * Security Audit Logging System (REQ-SEC-008)
+ *
+ * Provides tamper-proof logging for security-critical events
+ * Implements:
+ * - Cryptographic log integrity verification
+ * - Automatic log retention (90 days)
+ * - SIEM-ready structured logging
+ * - Critical event alerting
+ *
+ * Security: CVSS 6.1 (Medium Priority)
+ */
+import { createHash } from 'crypto';
+import { writeFileSync, readFileSync, existsSync, mkdirSync, readdirSync, unlinkSync, statSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+/**
+ * Security event severity levels
+ */
+export var AuditSeverity;
+(function (AuditSeverity) {
+    AuditSeverity["INFO"] = "INFO";
+    AuditSeverity["WARNING"] = "WARNING";
+    AuditSeverity["ERROR"] = "ERROR";
+    AuditSeverity["CRITICAL"] = "CRITICAL";
+})(AuditSeverity || (AuditSeverity = {}));
+/**
+ * Security event categories
+ */
+export var AuditCategory;
+(function (AuditCategory) {
+    AuditCategory["AUTHENTICATION"] = "AUTHENTICATION";
+    AuditCategory["AUTHORIZATION"] = "AUTHORIZATION";
+    AuditCategory["DATA_ACCESS"] = "DATA_ACCESS";
+    AuditCategory["DATA_MODIFICATION"] = "DATA_MODIFICATION";
+    AuditCategory["COMMAND_EXECUTION"] = "COMMAND_EXECUTION";
+    AuditCategory["API_CALL"] = "API_CALL";
+    AuditCategory["RATE_LIMIT"] = "RATE_LIMIT";
+    AuditCategory["INPUT_VALIDATION"] = "INPUT_VALIDATION";
+    AuditCategory["ENCRYPTION"] = "ENCRYPTION";
+    AuditCategory["MCP_OPERATION"] = "MCP_OPERATION";
+    AuditCategory["FILE_OPERATION"] = "FILE_OPERATION";
+    AuditCategory["SYSTEM_EVENT"] = "SYSTEM_EVENT";
+})(AuditCategory || (AuditCategory = {}));
+/**
+ * Default configuration
+ */
+const DEFAULT_CONFIG = {
+    logDirectory: join(homedir(), '.ax-cli', 'audit-logs'),
+    retentionDays: 90,
+    enableAlerts: true,
+    enableChaining: true,
+    maxFileSize: 10 * 1024 * 1024, // 10MB
+};
+/**
+ * Audit Logger
+ *
+ * Provides tamper-proof audit logging with cryptographic verification
+ *
+ * @example
+ * ```typescript
+ * const logger = AuditLogger.getInstance();
+ *
+ * // Log a security event
+ * logger.log({
+ *   severity: AuditSeverity.WARNING,
+ *   category: AuditCategory.RATE_LIMIT,
+ *   action: 'rate_limit_exceeded',
+ *   actor: 'user-123',
+ *   outcome: 'failure',
+ *   details: { limit: 20, attempts: 25 },
+ * });
+ *
+ * // Log critical event (triggers alert)
+ * logger.logCritical({
+ *   category: AuditCategory.COMMAND_EXECUTION,
+ *   action: 'shell_injection_attempt',
+ *   outcome: 'failure',
+ *   details: { command: 'ls; rm -rf /' },
+ * });
+ * ```
+ */
+export class AuditLogger {
+    static instance = null;
+    config;
+    currentLogFile;
+    lastHash = null;
+    eventCount = 0;
+    alertCallbacks = [];
+    constructor(config = {}) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+        // Ensure log directory exists
+        if (!existsSync(this.config.logDirectory)) {
+            mkdirSync(this.config.logDirectory, { recursive: true });
+        }
+        // Initialize log file
+        this.currentLogFile = this.getCurrentLogFile();
+        // Load last hash for chaining
+        if (this.config.enableChaining) {
+            this.lastHash = this.loadLastHash();
+        }
+        // Start retention cleanup (run once on init)
+        this.cleanupOldLogs();
+    }
+    /**
+     * Get singleton instance
+     */
+    static getInstance(config) {
+        if (!AuditLogger.instance) {
+            AuditLogger.instance = new AuditLogger(config);
+        }
+        return AuditLogger.instance;
+    }
+    /**
+     * Reset singleton (for testing)
+     */
+    static resetInstance() {
+        AuditLogger.instance = null;
+    }
+    /**
+     * Register alert callback for critical events
+     */
+    onCriticalEvent(callback) {
+        this.alertCallbacks.push(callback);
+    }
+    /**
+     * Log an audit event
+     */
+    log(event) {
+        const fullEvent = {
+            id: this.generateEventId(),
+            timestamp: new Date().toISOString(),
+            ...event,
+        };
+        // Add hash chain for tamper detection
+        if (this.config.enableChaining) {
+            fullEvent.previousHash = this.lastHash || undefined;
+            fullEvent.hash = this.calculateHash(fullEvent);
+            this.lastHash = fullEvent.hash;
+        }
+        // Write to log file
+        this.writeEvent(fullEvent);
+        // Emit alert for critical events
+        if (this.config.enableAlerts && fullEvent.severity === AuditSeverity.CRITICAL) {
+            this.emitAlert(fullEvent);
+        }
+        // Check if we need to rotate log file
+        this.checkLogRotation();
+        this.eventCount++;
+    }
+    /**
+     * Log critical security event (convenience method)
+     */
+    logCritical(event) {
+        this.log({
+            ...event,
+            severity: AuditSeverity.CRITICAL,
+        });
+    }
+    /**
+     * Log warning event (convenience method)
+     */
+    logWarning(event) {
+        this.log({
+            ...event,
+            severity: AuditSeverity.WARNING,
+        });
+    }
+    /**
+     * Log error event (convenience method)
+     */
+    logError(event) {
+        this.log({
+            ...event,
+            severity: AuditSeverity.ERROR,
+        });
+    }
+    /**
+     * Log info event (convenience method)
+     */
+    logInfo(event) {
+        this.log({
+            ...event,
+            severity: AuditSeverity.INFO,
+        });
+    }
+    /**
+     * Verify log integrity
+     *
+     * Checks the hash chain to detect tampering
+     */
+    verifyIntegrity(logFile) {
+        const file = logFile || this.currentLogFile;
+        if (!existsSync(file)) {
+            return { valid: false, errors: ['Log file does not exist'] };
+        }
+        const errors = [];
+        const lines = readFileSync(file, 'utf8').split('\n').filter(l => l.trim());
+        let previousHash = null;
+        for (let i = 0; i < lines.length; i++) {
+            try {
+                const event = JSON.parse(lines[i]);
+                // Verify hash chain (normalize undefined to null for comparison)
+                const eventPrevHash = event.previousHash || null;
+                if (eventPrevHash !== previousHash) {
+                    errors.push(`Event ${event.id} (line ${i + 1}): Hash chain broken. ` +
+                        `Expected previous hash: ${previousHash}, got: ${eventPrevHash}`);
+                }
+                // Verify event hash
+                const calculatedHash = this.calculateHash(event);
+                if (event.hash !== calculatedHash) {
+                    errors.push(`Event ${event.id} (line ${i + 1}): Hash mismatch. ` +
+                        `Event may have been tampered with.`);
+                }
+                previousHash = event.hash || null;
+            }
+            catch (error) {
+                errors.push(`Line ${i + 1}: Invalid JSON - ${error instanceof Error ? error.message : 'Unknown error'}`);
+            }
+        }
+        return {
+            valid: errors.length === 0,
+            errors,
+        };
+    }
+    /**
+     * Get audit statistics
+     */
+    getStats() {
+        return {
+            totalEvents: this.eventCount,
+            logDirectory: this.config.logDirectory,
+            currentLogFile: this.currentLogFile,
+            retentionDays: this.config.retentionDays,
+        };
+    }
+    /**
+     * Generate unique event ID
+     */
+    generateEventId() {
+        const timestamp = Date.now();
+        const random = Math.random().toString(36).substring(2, 11);
+        return `evt_${timestamp}_${random}`;
+    }
+    /**
+     * Calculate SHA-256 hash of event (excluding hash field itself)
+     */
+    calculateHash(event) {
+        // Create copy without hash field
+        const { hash, ...eventWithoutHash } = event;
+        // Sort keys for consistent hashing, filter out undefined values
+        const sortedKeys = Object.keys(eventWithoutHash)
+            .filter(key => eventWithoutHash[key] !== undefined)
+            .sort();
+        const data = sortedKeys.map(key => {
+            const value = eventWithoutHash[key];
+            return `${key}:${JSON.stringify(value)}`;
+        }).join('|');
+        return createHash('sha256').update(data).digest('hex');
+    }
+    /**
+     * Write event to log file
+     */
+    writeEvent(event) {
+        const logLine = JSON.stringify(event) + '\n';
+        try {
+            writeFileSync(this.currentLogFile, logLine, { flag: 'a' });
+        }
+        catch (error) {
+            // Fallback: If current log file is locked/corrupted, create new one
+            console.error('Failed to write to audit log:', error);
+            this.rotateLogFile();
+            writeFileSync(this.currentLogFile, logLine, { flag: 'a' });
+        }
+    }
+    /**
+     * Get current log file path
+     */
+    getCurrentLogFile() {
+        const date = new Date().toISOString().split('T')[0]; // YYYY-MM-DD
+        return join(this.config.logDirectory, `audit-${date}.jsonl`);
+    }
+    /**
+     * Load last hash from current log file
+     */
+    loadLastHash() {
+        if (!existsSync(this.currentLogFile)) {
+            return null;
+        }
+        try {
+            const lines = readFileSync(this.currentLogFile, 'utf8').split('\n').filter(l => l.trim());
+            if (lines.length === 0)
+                return null;
+            const lastEvent = JSON.parse(lines[lines.length - 1]);
+            return lastEvent.hash || null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Check if log file needs rotation
+     */
+    checkLogRotation() {
+        try {
+            const stats = statSync(this.currentLogFile);
+            if (stats.size >= this.config.maxFileSize) {
+                this.rotateLogFile();
+            }
+        }
+        catch {
+            // File doesn't exist or can't be read - will be created on next write
+        }
+        // Check if date changed (new day)
+        const expectedFile = this.getCurrentLogFile();
+        if (expectedFile !== this.currentLogFile) {
+            this.rotateLogFile();
+        }
+    }
+    /**
+     * Rotate log file
+     */
+    rotateLogFile() {
+        this.currentLogFile = this.getCurrentLogFile();
+        this.lastHash = this.loadLastHash();
+    }
+    /**
+     * Clean up old log files (retention policy)
+     */
+    cleanupOldLogs() {
+        try {
+            if (!existsSync(this.config.logDirectory)) {
+                return;
+            }
+            const files = readdirSync(this.config.logDirectory);
+            const now = Date.now();
+            const retentionMs = this.config.retentionDays * 24 * 60 * 60 * 1000;
+            for (const file of files) {
+                if (!file.startsWith('audit-') || !file.endsWith('.jsonl')) {
+                    continue;
+                }
+                const filePath = join(this.config.logDirectory, file);
+                const stats = statSync(filePath);
+                const age = now - stats.mtimeMs;
+                if (age > retentionMs) {
+                    unlinkSync(filePath);
+                }
+            }
+        }
+        catch (error) {
+            console.error('Failed to clean up old audit logs:', error);
+        }
+    }
+    /**
+     * Emit alert for critical events
+     */
+    emitAlert(event) {
+        for (const callback of this.alertCallbacks) {
+            try {
+                callback(event);
+            }
+            catch (error) {
+                console.error('Alert callback failed:', error);
+            }
+        }
+    }
+}
+/**
+ * Get audit logger singleton
+ */
+export function getAuditLogger(config) {
+    return AuditLogger.getInstance(config);
+}
+//# sourceMappingURL=audit-logger.js.map

package/dist/utils/audit-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/utils/audit-logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC3G,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAE7B;;GAEG;AACH,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,8BAAa,CAAA;IACb,oCAAmB,CAAA;IACnB,gCAAe,CAAA;IACf,sCAAqB,CAAA;AACvB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,aAaX;AAbD,WAAY,aAAa;IACvB,kDAAiC,CAAA;IACjC,gDAA+B,CAAA;IAC/B,4CAA2B,CAAA;IAC3B,wDAAuC,CAAA;IACvC,wDAAuC,CAAA;IACvC,sCAAqB,CAAA;IACrB,0CAAyB,CAAA;IACzB,sDAAqC,CAAA;IACrC,0CAAyB,CAAA;IACzB,gDAA+B,CAAA;IAC/B,kDAAiC,CAAA;IACjC,8CAA6B,CAAA;AAC/B,CAAC,EAbW,aAAa,KAAb,aAAa,QAaxB;AAsGD;;GAEG;AACH,MAAM,cAAc,GAA6B;IAC/C,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC;IACtD,aAAa,EAAE,EAAE;IACjB,YAAY,EAAE,IAAI;IAClB,cAAc,EAAE,IAAI;IACpB,WAAW,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;CACvC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,OAAO,WAAW;IACd,MAAM,CAAC,QAAQ,GAAuB,IAAI,CAAC;IAC3C,MAAM,CAA2B;IACjC,cAAc,CAAS;IACvB,QAAQ,GAAkB,IAAI,CAAC;IAC/B,UAAU,GAAW,CAAC,CAAC;IACvB,cAAc,GAAuC,EAAE,CAAC;IAEhE,YAAoB,SAAyB,EAAE;QAC7C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;QAE/C,8BAA8B;QAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1C,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/C,8BAA8B;QAC9B,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC/B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,MAAuB;QACxC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC1B,WAAW,CAAC,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,WAAW,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa;QAClB,WAAW,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,QAAqC;QACnD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,KAAqE;QACvE,MAAM,SAAS,GAAe;YAC5B,EAAE,EAAE,IAAI,CAAC,eAAe,EAAE;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,GAAG,KAAK;SACT,CAAC;QAEF,sCAAsC;QACtC,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC/B,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;YACpD,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC;QACjC,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAE3B,iCAAiC;QACjC,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC9E,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,WAAW,CACT,KAAkF;QAElF,IAAI,CAAC,GAAG,CAAC;YACP,GAAG,KAAK;YACR,QAAQ,EAAE,aAAa,CAAC,QAAQ;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,UAAU,CACR,KAAkF;QAElF,IAAI,CAAC,GAAG,CAAC;YACP,GAAG,KAAK;YACR,QAAQ,EAAE,aAAa,CAAC,OAAO;SAChC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,QAAQ,CACN,KAAkF;QAElF,IAAI,CAAC,GAAG,CAAC;YACP,GAAG,KAAK;YACR,QAAQ,EAAE,aAAa,CAAC,KAAK;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,OAAO,CACL,KAAkF;QAElF,IAAI,CAAC,GAAG,CAAC;YACP,GAAG,KAAK;YACR,QAAQ,EAAE,aAAa,CAAC,IAAI;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,OAAgB;QAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC;QAE5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAE3E,IAAI,YAAY,GAAkB,IAAI,CAAC;QAEvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAe,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAE/C,iEAAiE;gBACjE,MAAM,aAAa,GAAG,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC;gBACjD,IAAI,aAAa,KAAK,YAAY,EAAE,CAAC;oBACnC,MAAM,CAAC,IAAI,CACT,SAAS,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,wBAAwB;wBACxD,2BAA2B,YAAY,UAAU,aAAa,EAAE,CACjE,CAAC;gBACJ,CAAC;gBAED,oBAAoB;gBACpB,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBACjD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBAClC,MAAM,CAAC,IAAI,CACT,SAAS,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,oBAAoB;wBACpD,oCAAoC,CACrC,CAAC;gBACJ,CAAC;gBAED,YAAY,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;YACpC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QAMN,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,UAAU;YAC5B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACtC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;SACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,eAAe;QACrB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,OAAO,SAAS,IAAI,MAAM,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,KAAiB;QACrC,iCAAiC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,EAAE,GAAG,KAAK,CAAC;QAE5C,gEAAgE;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;aAC7C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,gBAAwB,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;aAC3D,IAAI,EAAE,CAAC;QAEV,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;YAChC,MAAM,KAAK,GAAI,gBAAwB,CAAC,GAAG,CAAC,CAAC;YAC7C,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEb,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,KAAiB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAE7C,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;OAEG;IACK,iBAAiB;QACvB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,IAAI,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAEpC,MAAM,SAAS,GAAe,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAClE,OAAO,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,gBAAgB;QACtB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;QAED,kCAAkC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC9C,IAAI,YAAY,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa;QACnB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,cAAc;QACpB,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1C,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC3D,SAAS;gBACX,CAAC;gBAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACjC,MAAM,GAAG,GAAG,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;gBAEhC,IAAI,GAAG,GAAG,WAAW,EAAE,CAAC;oBACtB,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,KAAiB;QACjC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;;AAGH;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAAuB;IACpD,OAAO,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC"}

package/dist/utils/command-security.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Command Security Utilities
+ *
+ * Provides secure command execution with whitelisting and validation.
+ * Prevents command injection vulnerabilities (REQ-SEC-001).
+ *
+ * @module command-security
+ */
+import type { ToolResult } from '../types/index.js';
+/**
+ * Whitelist of safe commands allowed for execution.
+ * Only these commands can be executed via the BashTool.
+ *
+ * CRITICAL: Do not add arbitrary commands without security review.
+ */
+export declare const SAFE_COMMANDS: readonly ["ls", "grep", "find", "cat", "head", "tail", "wc", "sort", "uniq", "cut", "awk", "sed", "pwd", "echo", "date", "whoami", "hostname", "git", "rg", "fd", "rm", "mkdir", "touch", "cp", "mv"];
+export type SafeCommand = typeof SAFE_COMMANDS[number];
+/**
+ * Parsed command structure
+ */
+export interface ParsedCommand {
+    command: SafeCommand;
+    args: string[];
+}
+/**
+ * Command execution options
+ */
+export interface CommandExecutionOptions {
+    cwd?: string;
+    timeout?: number;
+    maxBuffer?: number;
+}
+/**
+ * Sanitize environment variables for child process.
+ * Only includes safe environment variables to prevent injection.
+ *
+ * @param env - Original process environment
+ * @returns Sanitized environment object
+ */
+export declare function sanitizeEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * Parse a command string into command and arguments.
+ * Validates that the command is in the whitelist.
+ *
+ * @param commandString - Full command string (e.g., "ls -la /tmp")
+ * @returns Parsed command structure
+ * @throws Error if command is not whitelisted
+ */
+export declare function parseCommand(commandString: string): ParsedCommand;
+/**
+ * Validate command arguments for shell metacharacters.
+ * Prevents command injection via argument injection.
+ *
+ * @param args - Command arguments to validate
+ * @returns Validation result
+ */
+export declare function validateArguments(args: string[]): {
+    valid: boolean;
+    errors: string[];
+};
+/**
+ * Execute a safe command with validation.
+ * Uses execFile to avoid shell invocation and command injection.
+ *
+ * SECURITY: This function uses execFile instead of spawn('bash', ['-c'])
+ * to prevent command injection attacks.
+ *
+ * @param commandString - Command to execute
+ * @param options - Execution options
+ * @returns Tool result with output or error
+ */
+export declare function executeSafeCommand(commandString: string, options?: CommandExecutionOptions): Promise<ToolResult>;
+/**
+ * Check if a command is safe to execute.
+ *
+ * @param command - Command name to check
+ * @returns True if command is in whitelist
+ */
+export declare function isSafeCommand(command: string): command is SafeCommand;
+/**
+ * Get list of safe commands (for documentation/help).
+ *
+ * @returns Array of safe command names
+ */
+export declare function getSafeCommands(): readonly string[];

package/dist/utils/command-security.js

@@ -0,0 +1,200 @@
+/**
+ * Command Security Utilities
+ *
+ * Provides secure command execution with whitelisting and validation.
+ * Prevents command injection vulnerabilities (REQ-SEC-001).
+ *
+ * @module command-security
+ */
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+const execFileAsync = promisify(execFile);
+/**
+ * Whitelist of safe commands allowed for execution.
+ * Only these commands can be executed via the BashTool.
+ *
+ * CRITICAL: Do not add arbitrary commands without security review.
+ */
+export const SAFE_COMMANDS = [
+    'ls',
+    'grep',
+    'find',
+    'cat',
+    'head',
+    'tail',
+    'wc',
+    'sort',
+    'uniq',
+    'cut',
+    'awk',
+    'sed',
+    'pwd',
+    'echo',
+    'date',
+    'whoami',
+    'hostname',
+    'git',
+    'rg',
+    'fd',
+    'rm', // File deletion (safe with validation)
+    'mkdir', // Directory creation
+    'touch', // File creation
+    'cp', // File copy
+    'mv', // File move/rename
+];
+/**
+ * Environment variables safe to pass to child processes.
+ * Only these will be included in the child process environment.
+ */
+const SAFE_ENV_VARS = [
+    'PATH',
+    'HOME',
+    'USER',
+    'LANG',
+    'LC_ALL',
+    'TERM',
+    'TMPDIR',
+    'PWD',
+];
+/**
+ * Shell metacharacters that are forbidden in command arguments.
+ * These could enable command injection if not properly validated.
+ */
+const SHELL_METACHARACTERS = /[;&|`$(){}[\]<>'"\\*?~!#]/;
+/**
+ * Sanitize environment variables for child process.
+ * Only includes safe environment variables to prevent injection.
+ *
+ * @param env - Original process environment
+ * @returns Sanitized environment object
+ */
+export function sanitizeEnv(env) {
+    const sanitized = {};
+    for (const key of SAFE_ENV_VARS) {
+        if (env[key]) {
+            sanitized[key] = env[key];
+        }
+    }
+    return sanitized;
+}
+/**
+ * Parse a command string into command and arguments.
+ * Validates that the command is in the whitelist.
+ *
+ * @param commandString - Full command string (e.g., "ls -la /tmp")
+ * @returns Parsed command structure
+ * @throws Error if command is not whitelisted
+ */
+export function parseCommand(commandString) {
+    const trimmed = commandString.trim();
+    if (!trimmed) {
+        throw new Error('Empty command string');
+    }
+    // Simple split by whitespace
+    const parts = trimmed.split(/\s+/);
+    const command = parts[0];
+    const args = parts.slice(1);
+    // Validate command is in whitelist
+    if (!SAFE_COMMANDS.includes(command)) {
+        throw new Error(`Command '${command}' not in whitelist. Allowed commands: ${SAFE_COMMANDS.join(', ')}`);
+    }
+    return {
+        command: command,
+        args,
+    };
+}
+/**
+ * Validate command arguments for shell metacharacters.
+ * Prevents command injection via argument injection.
+ *
+ * @param args - Command arguments to validate
+ * @returns Validation result
+ */
+export function validateArguments(args) {
+    const errors = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        // Check for shell metacharacters
+        if (SHELL_METACHARACTERS.test(arg)) {
+            errors.push(`Argument ${i} contains forbidden shell metacharacters: "${arg}"`);
+        }
+        // Check for null bytes
+        if (arg.includes('\0')) {
+            errors.push(`Argument ${i} contains null byte`);
+        }
+        // Check length (prevent buffer overflow)
+        if (arg.length > 10000) {
+            errors.push(`Argument ${i} exceeds maximum length (10000 chars)`);
+        }
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+    };
+}
+/**
+ * Execute a safe command with validation.
+ * Uses execFile to avoid shell invocation and command injection.
+ *
+ * SECURITY: This function uses execFile instead of spawn('bash', ['-c'])
+ * to prevent command injection attacks.
+ *
+ * @param commandString - Command to execute
+ * @param options - Execution options
+ * @returns Tool result with output or error
+ */
+export async function executeSafeCommand(commandString, options = {}) {
+    try {
+        // 1. Parse command into command + args
+        const parsed = parseCommand(commandString);
+        // 2. Validate arguments
+        const validation = validateArguments(parsed.args);
+        if (!validation.valid) {
+            return {
+                success: false,
+                error: `Command validation failed:\n${validation.errors.join('\n')}`,
+            };
+        }
+        // 3. Prepare execution options
+        const execOptions = {
+            cwd: options.cwd || process.cwd(),
+            env: sanitizeEnv(process.env),
+            timeout: options.timeout || 30000, // 30 second default
+            maxBuffer: options.maxBuffer || 1024 * 1024, // 1MB default
+        };
+        // 4. Execute using execFile (no shell invocation)
+        const { stdout, stderr } = await execFileAsync(parsed.command, parsed.args, execOptions);
+        // 5. Return successful result
+        return {
+            success: true,
+            output: stdout || stderr || 'Command completed successfully',
+        };
+    }
+    catch (error) {
+        // Handle execution errors
+        const errorMessage = error.message || String(error);
+        const exitCode = error.code || 'unknown';
+        return {
+            success: false,
+            error: `Command execution failed (exit code: ${exitCode}): ${errorMessage}`,
+        };
+    }
+}
+/**
+ * Check if a command is safe to execute.
+ *
+ * @param command - Command name to check
+ * @returns True if command is in whitelist
+ */
+export function isSafeCommand(command) {
+    return SAFE_COMMANDS.includes(command);
+}
+/**
+ * Get list of safe commands (for documentation/help).
+ *
+ * @returns Array of safe command names
+ */
+export function getSafeCommands() {
+    return SAFE_COMMANDS;
+}
+//# sourceMappingURL=command-security.js.map

package/dist/utils/command-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-security.js","sourceRoot":"","sources":["../../src/utils/command-security.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAGjC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI;IACJ,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,UAAU;IACV,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI,EAAO,uCAAuC;IAClD,OAAO,EAAI,qBAAqB;IAChC,OAAO,EAAI,gBAAgB;IAC3B,IAAI,EAAO,YAAY;IACvB,IAAI,EAAO,mBAAmB;CACtB,CAAC;AAIX;;;GAGG;AACH,MAAM,aAAa,GAAG;IACpB,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,KAAK;CACG,CAAC;AAEX;;;GAGG;AACH,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAmBzD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAsB;IAChD,MAAM,SAAS,GAAsB,EAAE,CAAC;IAExC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,aAAqB;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IAErC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,6BAA6B;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE5B,mCAAmC;IACnC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAsB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,yCAAyC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAsB;QAC/B,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAI9C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEpB,iCAAiC;QACjC,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CACT,YAAY,CAAC,8CAA8C,GAAG,GAAG,CAClE,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;QAClD,CAAC;QAED,yCAAyC;QACzC,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,uCAAuC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,UAAmC,EAAE;IAErC,IAAI,CAAC;QACH,uCAAuC;QACvC,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAE3C,wBAAwB;QACxB,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,+BAA+B,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACrE,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,MAAM,WAAW,GAAG;YAClB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YACjC,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK,EAAE,oBAAoB;YACvD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,GAAG,IAAI,EAAE,cAAc;SAC5D,CAAC;QAEF,kDAAkD;QAClD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAC5C,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,IAAI,EACX,WAAW,CACZ,CAAC;QAEF,8BAA8B;QAC9B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,MAAM,IAAI,MAAM,IAAI,gCAAgC;SAC7D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,0BAA0B;QAC1B,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC;QAEzC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,wCAAwC,QAAQ,MAAM,YAAY,EAAE;SAC5E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,aAAa,CAAC,QAAQ,CAAC,OAAsB,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,aAAa,CAAC;AACvB,CAAC"}