@evalops/maestro 0.10.17 → 0.10.20

package/dist/rpc/rpc-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-types.d.ts","sourceRoot":"","sources":["../../src/rpc/rpc-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACX,UAAU,EACV,GAAG,EAEH,OAAO,EACP,KAAK,EACL,MAAM,mBAAmB,CAAC;AAM3B;;GAEG;AACH,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,EAAE,CAAC,EAAE,MAAM,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACvD,IAAI,EAAE,QAAQ,CAAC;IACf,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,WAAW,CAAC,EAAE,KAAK,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACtD,IAAI,EAAE,OAAO,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,cAAc;IAC5D,IAAI,EAAE,cAAc,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACzD,IAAI,EAAE,WAAW,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACzD,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,CAAC,EAAE;QACT,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACxD,IAAI,EAAE,SAAS,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GACnB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,kBAAkB,GAClB,kBAAkB,GAClB,iBAAiB,CAAC;AAMrB;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,EAAE,CAAC,EAAE,MAAM,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC3D,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACxD,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE;QACN,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpB,WAAW,EAAE,OAAO,CAAC;QACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzB,kBAAkB,EAAE,MAAM,CAAC;KAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACxD,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC7D,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GACpB,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,GAChB,qBAAqB,GACrB,UAAU,CAAC;AAMd;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;AAEnD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,QAAQ,IAAI,UAAU,CAe1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC9B,QAAQ,EAAE,WAAW,GACnB,QAAQ,IAAI,gBAAgB,CAE9B"}
+{"version":3,"file":"rpc-types.d.ts","sourceRoot":"","sources":["../../src/rpc/rpc-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACX,UAAU,EACV,GAAG,EAEH,OAAO,EACP,KAAK,EACL,MAAM,mBAAmB,CAAC;AAM3B;;GAEG;AACH,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,EAAE,CAAC,EAAE,MAAM,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACvD,IAAI,EAAE,QAAQ,CAAC;IACf,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,WAAW,CAAC,EAAE,KAAK,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACtD,IAAI,EAAE,OAAO,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,cAAc;IAC5D,IAAI,EAAE,cAAc,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACzD,IAAI,EAAE,WAAW,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACzD,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,CAAC,EAAE;QACT,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACxD,IAAI,EAAE,SAAS,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GACnB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,kBAAkB,GAClB,kBAAkB,GAClB,iBAAiB,CAAC;AAMrB;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,EAAE,CAAC,EAAE,MAAM,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC3D,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACxD,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE;QACN,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpB,WAAW,EAAE,OAAO,CAAC;QACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACzB,kBAAkB,EAAE,MAAM,CAAC;KAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACxD,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC7D,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GACpB,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,GAChB,qBAAqB,GACrB,UAAU,CAAC;AAMd;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;AAEnD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,QAAQ,IAAI,UAAU,CAgB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC9B,QAAQ,EAAE,WAAW,GACnB,QAAQ,IAAI,gBAAgB,CAE9B"}

package/dist/rpc/rpc-types.js

@@ -19,6 +19,7 @@ export function isAgentEvent(response) {
         "tool_execution_update",
         "tool_execution_end",
         "tool_batch_summary",
+        "tool_phase_summary",
         "tool_retry_required",
         "tool_retry_resolved",
         "error",

package/dist/rpc/rpc-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-types.js","sourceRoot":"","sources":["../../src/rpc/rpc-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAwKH;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAqB;IACjD,OAAO;QACN,eAAe;QACf,gBAAgB;QAChB,aAAa;QACb,aAAa;QACb,WAAW;QACX,sBAAsB;QACtB,uBAAuB;QACvB,oBAAoB;QACpB,oBAAoB;QACpB,qBAAqB;QACrB,qBAAqB;QACrB,OAAO;KACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC9B,QAAqB;IAErB,OAAO,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC;AAClC,CAAC","sourcesContent":["/**\n * RPC Types for Composer Agent\n *\n * Defines the typed protocol for JSON-over-stdio RPC communication.\n *\n * @module rpc/rpc-types\n */\n\nimport type {\n\tAgentEvent,\n\tApi,\n\tAppMessage,\n\tMessage,\n\tModel,\n} from \"../agent/types.js\";\n\n// ============================================================================\n// RPC Commands (Client -> Server)\n// ============================================================================\n\n/**\n * Base interface for all RPC commands.\n */\nexport interface RpcCommandBase {\n\ttype: string;\n\t/** Optional request ID for response correlation */\n\tid?: string;\n}\n\n/**\n * Send a prompt to the agent.\n */\nexport interface RpcPromptCommand extends RpcCommandBase {\n\ttype: \"prompt\";\n\t/** The message to send */\n\tmessage: string;\n\t/** Optional attachments */\n\tattachments?: Array<{\n\t\tid: string;\n\t\ttype: \"image\" | \"document\";\n\t\tfileName: string;\n\t\tmimeType: string;\n\t\tsize: number;\n\t\tcontent: string;\n\t}>;\n}\n\n/**\n * Abort the current agent operation.\n */\nexport interface RpcAbortCommand extends RpcCommandBase {\n\ttype: \"abort\";\n}\n\n/**\n * Get the current conversation messages.\n */\nexport interface RpcGetMessagesCommand extends RpcCommandBase {\n\ttype: \"get_messages\";\n}\n\n/**\n * Get the full agent state.\n */\nexport interface RpcGetStateCommand extends RpcCommandBase {\n\ttype: \"get_state\";\n}\n\n/**\n * Continue the conversation without a new user message.\n */\nexport interface RpcContinueCommand extends RpcCommandBase {\n\ttype: \"continue\";\n\toptions?: {\n\t\tsystemPromptOverride?: string;\n\t};\n}\n\n/**\n * Trigger context compaction.\n */\nexport interface RpcCompactCommand extends RpcCommandBase {\n\ttype: \"compact\";\n\tcustomInstructions?: string;\n}\n\n/**\n * Union of all RPC commands.\n */\nexport type RpcCommand =\n\t| RpcPromptCommand\n\t| RpcAbortCommand\n\t| RpcGetMessagesCommand\n\t| RpcGetStateCommand\n\t| RpcContinueCommand\n\t| RpcCompactCommand;\n\n// ============================================================================\n// RPC Responses (Server -> Client)\n// ============================================================================\n\n/**\n * Base interface for all RPC responses.\n */\nexport interface RpcResponseBase {\n\ttype: string;\n\t/** Request ID if provided in command */\n\tid?: string;\n}\n\n/**\n * Response containing conversation messages.\n */\nexport interface RpcMessagesResponse extends RpcResponseBase {\n\ttype: \"messages\";\n\tmessages: Message[];\n}\n\n/**\n * Response containing agent state.\n */\nexport interface RpcStateResponse extends RpcResponseBase {\n\ttype: \"state\";\n\tstate: {\n\t\tmodel: Model<Api>;\n\t\tmessages: Message[];\n\t\tisStreaming: boolean;\n\t\terror: string | null;\n\t\tthinkingLevel: number;\n\t\tsession?: { id: string };\n\t\tqueuedMessageCount: number;\n\t};\n}\n\n/**\n * Error response.\n */\nexport interface RpcErrorResponse extends RpcResponseBase {\n\ttype: \"error\";\n\terror: string;\n}\n\n/**\n * Compaction event response.\n */\nexport interface RpcCompactionResponse extends RpcResponseBase {\n\ttype: \"compaction\";\n\tsummary: string;\n\tfirstKeptEntryIndex: number;\n\ttokensBefore: number;\n\tauto: boolean;\n\tcustomInstructions?: string;\n\ttimestamp: string;\n}\n\n/**\n * Union of all RPC responses.\n */\nexport type RpcResponse =\n\t| RpcMessagesResponse\n\t| RpcStateResponse\n\t| RpcErrorResponse\n\t| RpcCompactionResponse\n\t| AgentEvent;\n\n// ============================================================================\n// Utility Types\n// ============================================================================\n\n/**\n * Agent event types that can be received over RPC.\n */\nexport type RpcAgentEventType = AgentEvent[\"type\"];\n\n/**\n * Check if an RPC response is an agent event.\n */\nexport function isAgentEvent(response: RpcResponse): response is AgentEvent {\n\treturn [\n\t\t\"message_start\",\n\t\t\"message_update\",\n\t\t\"message_end\",\n\t\t\"agent_start\",\n\t\t\"agent_end\",\n\t\t\"tool_execution_start\",\n\t\t\"tool_execution_update\",\n\t\t\"tool_execution_end\",\n\t\t\"tool_batch_summary\",\n\t\t\"tool_retry_required\",\n\t\t\"tool_retry_resolved\",\n\t\t\"error\",\n\t].includes(response.type);\n}\n\n/**\n * Check if an RPC response is an error.\n */\nexport function isErrorResponse(\n\tresponse: RpcResponse,\n): response is RpcErrorResponse {\n\treturn response.type === \"error\";\n}\n"]}
+{"version":3,"file":"rpc-types.js","sourceRoot":"","sources":["../../src/rpc/rpc-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAwKH;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAqB;IACjD,OAAO;QACN,eAAe;QACf,gBAAgB;QAChB,aAAa;QACb,aAAa;QACb,WAAW;QACX,sBAAsB;QACtB,uBAAuB;QACvB,oBAAoB;QACpB,oBAAoB;QACpB,oBAAoB;QACpB,qBAAqB;QACrB,qBAAqB;QACrB,OAAO;KACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC9B,QAAqB;IAErB,OAAO,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC;AAClC,CAAC","sourcesContent":["/**\n * RPC Types for Composer Agent\n *\n * Defines the typed protocol for JSON-over-stdio RPC communication.\n *\n * @module rpc/rpc-types\n */\n\nimport type {\n\tAgentEvent,\n\tApi,\n\tAppMessage,\n\tMessage,\n\tModel,\n} from \"../agent/types.js\";\n\n// ============================================================================\n// RPC Commands (Client -> Server)\n// ============================================================================\n\n/**\n * Base interface for all RPC commands.\n */\nexport interface RpcCommandBase {\n\ttype: string;\n\t/** Optional request ID for response correlation */\n\tid?: string;\n}\n\n/**\n * Send a prompt to the agent.\n */\nexport interface RpcPromptCommand extends RpcCommandBase {\n\ttype: \"prompt\";\n\t/** The message to send */\n\tmessage: string;\n\t/** Optional attachments */\n\tattachments?: Array<{\n\t\tid: string;\n\t\ttype: \"image\" | \"document\";\n\t\tfileName: string;\n\t\tmimeType: string;\n\t\tsize: number;\n\t\tcontent: string;\n\t}>;\n}\n\n/**\n * Abort the current agent operation.\n */\nexport interface RpcAbortCommand extends RpcCommandBase {\n\ttype: \"abort\";\n}\n\n/**\n * Get the current conversation messages.\n */\nexport interface RpcGetMessagesCommand extends RpcCommandBase {\n\ttype: \"get_messages\";\n}\n\n/**\n * Get the full agent state.\n */\nexport interface RpcGetStateCommand extends RpcCommandBase {\n\ttype: \"get_state\";\n}\n\n/**\n * Continue the conversation without a new user message.\n */\nexport interface RpcContinueCommand extends RpcCommandBase {\n\ttype: \"continue\";\n\toptions?: {\n\t\tsystemPromptOverride?: string;\n\t};\n}\n\n/**\n * Trigger context compaction.\n */\nexport interface RpcCompactCommand extends RpcCommandBase {\n\ttype: \"compact\";\n\tcustomInstructions?: string;\n}\n\n/**\n * Union of all RPC commands.\n */\nexport type RpcCommand =\n\t| RpcPromptCommand\n\t| RpcAbortCommand\n\t| RpcGetMessagesCommand\n\t| RpcGetStateCommand\n\t| RpcContinueCommand\n\t| RpcCompactCommand;\n\n// ============================================================================\n// RPC Responses (Server -> Client)\n// ============================================================================\n\n/**\n * Base interface for all RPC responses.\n */\nexport interface RpcResponseBase {\n\ttype: string;\n\t/** Request ID if provided in command */\n\tid?: string;\n}\n\n/**\n * Response containing conversation messages.\n */\nexport interface RpcMessagesResponse extends RpcResponseBase {\n\ttype: \"messages\";\n\tmessages: Message[];\n}\n\n/**\n * Response containing agent state.\n */\nexport interface RpcStateResponse extends RpcResponseBase {\n\ttype: \"state\";\n\tstate: {\n\t\tmodel: Model<Api>;\n\t\tmessages: Message[];\n\t\tisStreaming: boolean;\n\t\terror: string | null;\n\t\tthinkingLevel: number;\n\t\tsession?: { id: string };\n\t\tqueuedMessageCount: number;\n\t};\n}\n\n/**\n * Error response.\n */\nexport interface RpcErrorResponse extends RpcResponseBase {\n\ttype: \"error\";\n\terror: string;\n}\n\n/**\n * Compaction event response.\n */\nexport interface RpcCompactionResponse extends RpcResponseBase {\n\ttype: \"compaction\";\n\tsummary: string;\n\tfirstKeptEntryIndex: number;\n\ttokensBefore: number;\n\tauto: boolean;\n\tcustomInstructions?: string;\n\ttimestamp: string;\n}\n\n/**\n * Union of all RPC responses.\n */\nexport type RpcResponse =\n\t| RpcMessagesResponse\n\t| RpcStateResponse\n\t| RpcErrorResponse\n\t| RpcCompactionResponse\n\t| AgentEvent;\n\n// ============================================================================\n// Utility Types\n// ============================================================================\n\n/**\n * Agent event types that can be received over RPC.\n */\nexport type RpcAgentEventType = AgentEvent[\"type\"];\n\n/**\n * Check if an RPC response is an agent event.\n */\nexport function isAgentEvent(response: RpcResponse): response is AgentEvent {\n\treturn [\n\t\t\"message_start\",\n\t\t\"message_update\",\n\t\t\"message_end\",\n\t\t\"agent_start\",\n\t\t\"agent_end\",\n\t\t\"tool_execution_start\",\n\t\t\"tool_execution_update\",\n\t\t\"tool_execution_end\",\n\t\t\"tool_batch_summary\",\n\t\t\"tool_phase_summary\",\n\t\t\"tool_retry_required\",\n\t\t\"tool_retry_resolved\",\n\t\t\"error\",\n\t].includes(response.type);\n}\n\n/**\n * Check if an RPC response is an error.\n */\nexport function isErrorResponse(\n\tresponse: RpcResponse,\n): response is RpcErrorResponse {\n\treturn response.type === \"error\";\n}\n"]}

package/dist/safety/action-firewall.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-firewall.d.ts","sourceRoot":"","sources":["../../src/safety/action-firewall.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EACX,qBAAqB,EACrB,qBAAqB,EAErB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAczE,OAAO,EACN,KAAK,qCAAqC,EAG1C,MAAM,gCAAgC,CAAC;AAMxC,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,qBAAqB,CAAC;AA+C/E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,KAAK,WAAW,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IAClC,6DAA6D;IAC7D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,MAAM,CAAC,EAAE,OAAO,GAAG,kBAAkB,GAAG,OAAO,CAAC;IAChD,yCAAyC;IACzC,QAAQ,CAAC,EAAE,CACV,OAAO,EAAE,qBAAqB,KAC1B,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACxC,kCAAkC;IAClC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,gEAAgE;IAChE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtE;AAGD,eAAO,MAAM,wBAAwB,sCAAsC,CAAC;AA+Q5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,eAAO,MAAM,oBAAoB,EAAE,kBAAkB,EAoNpD,CAAC;AAEF,qBAAa,cAAc;IAQzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAPvB,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAGrB;gBAGK,KAAK,GAAE,kBAAkB,EAAyB,EACnE,OAAO,CAAC,EAAE;QACT,iBAAiB,CAAC,EAAE,qCAAqC,GAAG,KAAK,CAAC;KAClE;IAKF,gBAAgB,CAAC,KAAK,EAAE,aAAa;IAI/B,QAAQ,CACb,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;YAoFnB,6BAA6B;CAoC3C;AAED,eAAO,MAAM,qBAAqB,gBAAuB,CAAC"}
+{"version":3,"file":"action-firewall.d.ts","sourceRoot":"","sources":["../../src/safety/action-firewall.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EACX,qBAAqB,EACrB,qBAAqB,EAErB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAezE,OAAO,EACN,KAAK,qCAAqC,EAG1C,MAAM,gCAAgC,CAAC;AAWxC,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,qBAAqB,CAAC;AA+C/E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,KAAK,WAAW,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IAClC,6DAA6D;IAC7D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,MAAM,CAAC,EAAE,OAAO,GAAG,kBAAkB,GAAG,OAAO,CAAC;IAChD,yCAAyC;IACzC,QAAQ,CAAC,EAAE,CACV,OAAO,EAAE,qBAAqB,KAC1B,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACxC,kCAAkC;IAClC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,gEAAgE;IAChE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtE;AAGD,eAAO,MAAM,wBAAwB,sCAAsC,CAAC;AAsR5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,eAAO,MAAM,oBAAoB,EAAE,kBAAkB,EA2QpD,CAAC;AAEF,qBAAa,cAAc;IAQzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAPvB,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAGrB;gBAGK,KAAK,GAAE,kBAAkB,EAAyB,EACnE,OAAO,CAAC,EAAE;QACT,iBAAiB,CAAC,EAAE,qCAAqC,GAAG,KAAK,CAAC;KAClE;IAKF,gBAAgB,CAAC,KAAK,EAAE,aAAa;IAI/B,QAAQ,CACb,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;YAqFnB,6BAA6B;CAoC3C;AAED,eAAO,MAAM,qBAAqB,gBAAuB,CAAC"}

package/dist/safety/action-firewall.js

@@ -46,10 +46,12 @@
  *
  * @module safety/action-firewall
  */
+import { parseApplyPatchPaths } from "../tools/apply-patch-parser.js";
 import { createLogger } from "../utils/logger.js";
 import { isCommandAllowlisted } from "./bash-allowlist.js";
 import { analyzeCommandSafety, dangerousPatternDescriptions, dangerousPatterns, hasEgressPrimitives, isDestructiveSimpleCommand, isParserAvailable, isSimpleBenignBash, tokenizeSimple, unwrapShellCommand, } from "./bash-safety-analyzer.js";
 import { evaluateActionWithActionFirewallGovernanceService, resolveActionFirewallGovernanceServiceConfig, } from "./governance-service-client.js";
+import { DEFAULT_GUARDED_FILE_RULE_ID, describeDefaultGuardedFileMatch, findGuardedToolCallMatch, } from "./guarded-files.js";
 import { isContainedInWorkspace, isSystemPath } from "./path-containment.js";
 import { checkPolicy } from "./policy.js";
 import { RuleCache } from "./rule-cache.js";
@@ -279,21 +281,28 @@ function extractFilePaths(context) {
     if (!args)
         return [];
     const paths = [];
+    const toolName = context.toolName.toLowerCase();
     // Simple extraction for standard file tools
     // Note: deeper extraction is done in policy.ts, this is for quick system protection
-    if (context.toolName === "write" || context.toolName === "edit") {
+    if (toolName === "write" || toolName === "edit") {
         const p = getStringArg(context, "file_path") || getStringArg(context, "path");
         if (p)
             paths.push(p);
     }
-    if (context.toolName === "delete_file") {
+    if (toolName === "apply_patch") {
+        const patch = getStringArg(context, "patch");
+        if (patch) {
+            paths.push(...parseApplyPatchPaths(patch));
+        }
+    }
+    if (toolName === "delete_file") {
         const p = getStringArg(context, "file_path") ||
             getStringArg(context, "target_file");
         if (p)
             paths.push(p);
     }
     // Handle move_file and copy_file - extract both source and destination
-    if (context.toolName === "move_file" || context.toolName === "copy_file") {
+    if (toolName === "move_file" || toolName === "copy_file") {
         const source = getStringArg(context, "source") ||
             getStringArg(context, "source_path") ||
             getStringArg(context, "from");
@@ -371,7 +380,14 @@ export const defaultFirewallRules = [
         action: "block", // HARD BLOCK for system paths
         evaluate: (ctx) => {
             // Only check file mutation tools
-            if (!["write", "edit", "delete_file", "move_file", "copy_file"].includes(ctx.toolName)) {
+            if (![
+                "write",
+                "edit",
+                "apply_patch",
+                "delete_file",
+                "move_file",
+                "copy_file",
+            ].includes(ctx.toolName)) {
                 return { allowed: true };
             }
             const paths = extractFilePaths(ctx);
@@ -390,13 +406,55 @@ export const defaultFirewallRules = [
         },
         remediation: () => "Do not modify critical system paths. If you need to write a file, use the current workspace directory or a temporary folder.",
     },
+    {
+        id: DEFAULT_GUARDED_FILE_RULE_ID,
+        description: "Block guarded user and editor configuration files when policy requires a hard block",
+        action: "block",
+        evaluate: (ctx) => {
+            const match = findGuardedToolCallMatch(ctx.toolName, ctx.args, {
+                policy: ctx.metadata?.guardedFiles,
+            });
+            if (match?.defaultBehavior === "block") {
+                return {
+                    allowed: false,
+                    reason: describeDefaultGuardedFileMatch(match),
+                    remediation: "Remove the matching custom guard or change its defaultBehavior to ask if this access should be approval-gated instead of blocked.",
+                };
+            }
+            return { allowed: true };
+        },
+    },
+    {
+        id: DEFAULT_GUARDED_FILE_RULE_ID,
+        description: "Require explicit approval before reading or mutating guarded user and editor configuration files",
+        action: "require_approval",
+        evaluate: (ctx) => {
+            const match = findGuardedToolCallMatch(ctx.toolName, ctx.args, {
+                policy: ctx.metadata?.guardedFiles,
+            });
+            if (match) {
+                return {
+                    allowed: false,
+                    reason: describeDefaultGuardedFileMatch(match),
+                };
+            }
+            return { allowed: true };
+        },
+    },
     {
         name: "workspace-containment",
         description: "Require approval for file modifications outside the workspace",
         action: "require_approval",
         evaluate: (ctx) => {
             // Only check file mutation tools
-            if (!["write", "edit", "delete_file", "move_file", "copy_file"].includes(ctx.toolName)) {
+            if (![
+                "write",
+                "edit",
+                "apply_patch",
+                "delete_file",
+                "move_file",
+                "copy_file",
+            ].includes(ctx.toolName)) {
                 return { allowed: true };
             }
             const paths = extractFilePaths(ctx);
@@ -455,8 +513,12 @@ export const defaultFirewallRules = [
             if (process.env.MAESTRO_PLAN_MODE !== "1")
                 return false;
             const name = ctx.toolName;
-            if (name === "write" || name === "edit" || name === "bash")
+            if (name === "write" ||
+                name === "edit" ||
+                name === "apply_patch" ||
+                name === "bash") {
                 return true;
+            }
             if (name === "todo")
                 return true;
             if (name === "gh_pr") {
@@ -589,6 +651,7 @@ export class ActionFirewall {
                 "bash",
                 "write",
                 "edit",
+                "apply_patch",
                 "delete_file",
                 "background_tasks",
             ];

package/dist/safety/action-firewall.js.map

@@ -1 +1 @@
-{"version":3,"file":"action-firewall.js","sourceRoot":"","sources":["../../src/safety/action-firewall.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAQH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACN,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,GAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEN,iDAAiD,EACjD,4CAA4C,GAC5C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAIjE,MAAM,MAAM,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AACtD,iFAAiF;AACjF,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACnC,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,GAAG,CAAC;AAClD,MAAM,wBAAwB,GAAG,GAAG,EAAE,CACrC,OAAO,CAAC,GAAG,CAAC,gCAAgC,KAAK,GAAG,CAAC;AACtD,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG,CAAC;AACtE,MAAM,aAAa,GAAG,GAAG,EAAE,CAC1B,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,MAAM;IACtC,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,CAAC;AAC5C,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACnC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAC3B,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CACzD,CAAC;AACH,MAAM,uBAAuB,GAAG,GAAG,EAAE,CACpC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAC3B,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAC5D,CAAC;AAUH;;;;;;;;;;;;GAYG;AACH,MAAM,gBAAgB,GAAG,IAAI,SAAS,EAGnC,CAAC;AAkDJ,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;AACjD,MAAM,CAAC,MAAM,wBAAwB,GAAG,mCAAmC,CAAC;AAE5E,SAAS,aAAa,CACrB,OAA8B;IAE9B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,OAAO,CAAC,IAAgC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACpB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CACrB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,OAA8B;IACpD,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,0BAA0B,CAAC,OAA8B;IACjE,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CACxB,OAA8B;IAE9B,OAAO,OAAO,CAAC,QAAQ,EAAE,aAAa,IAAI,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,uBAAuB,CAC/B,OAA8B;IAE9B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC3C,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO;IACR,CAAC;IACD,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,CACV,4FAA4F,EAC5F,EAAE,QAAQ,EAAE,CACZ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,QAAQ,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,OAA8B;IACrD,OAAO,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC;AACtC,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IAClC,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,qBAAqB,GAAyB,MAAM,CAAC,OAAO,CACjE,iBAAiB,CACjB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1B,IAAI,EAAE,WAAW,GAAG,EAAE;IACtB,WAAW,EACV,4BAA4B,CAC3B,GAAgD,CAChD;IACF,MAAM,EAAE,kBAAkB;IAC1B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;QACjB,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;QACzD,IAAI,oBAAoB,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,YAAY,4BAA4B,CAAC,GAAgD,CAAC,KAAK,SAAS,CAAC,IAAI,EAAE,EAAE;SACzH,CAAC;IACH,CAAC;CACD,CAAC,CAAC,CAAC;AAEJ,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,CAAC;AACnE,MAAM,kBAAkB,GAAG,GAAG,EAAE;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,WAAW,EAAE,EAAE,CAAC;IAC7D,IAAI,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,sFAAsF;IACtF,IAAI,iBAAiB,EAAE,IAAI,aAAa,EAAE,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,qBAAqB,GAAuB;IACjD,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,2CAA2C;IACxD,MAAM,EAAE,kBAAkB;IAC1B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;QACjB,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEvC,6CAA6C;QAC7C,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,GAAG,SAAS,CAAC;QACrB,CAAC;QAED,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,0BAA0B,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9C,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,wEAAwE;aACzE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,mFAAmF;QACnF,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAC1B,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,8EAA8E;aAC/E,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,4CAA4C;SACvE,CAAC;IACH,CAAC;CACD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,SAAS,gBAAgB,CAAC,OAA8B;IACvD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,4CAA4C;IAC5C,oFAAoF;IACpF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACjE,MAAM,CAAC,GACN,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACxC,MAAM,CAAC,GACN,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC;YAClC,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACtC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,uEAAuE;IACvE,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC1E,MAAM,MAAM,GACX,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC;YAC/B,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC;YACpC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,IAAI,GACT,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC;YACpC,YAAY,CAAC,OAAO,EAAE,kBAAkB,CAAC;YACzC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;YAC7B,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAyB;IACzD;QACC,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,uDAAuD;QACpE,MAAM,EAAE,OAAO,EAAE,mCAAmC;QACpD,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACvB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,CAAC,OAAO;oBACpB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;oBACnB,CAAC,CAAC;wBACA,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,qCAAqC;qBAC9D,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC7C,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,qCAAqC;aAC9D,CAAC;QACH,CAAC;KACD;IACD;QACC,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,qDAAqD;QAClE,MAAM,EAAE,OAAO,EAAE,8BAA8B;QAC/C,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YACjB,iCAAiC;YACjC,IACC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CACnE,GAAG,CAAC,QAAQ,CACZ,EACA,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACpC,6GAA6G;YAC7G,8HAA8H;YAE9H,0FAA0F;YAC1F,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;YAEpE,sDAAsD;YACtD,IAAI,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EACL,oEAAoE;iBACrE,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,WAAW,EAAE,GAAG,EAAE,CACjB,8HAA8H;KAC/H;IACD;QACC,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACV,+DAA+D;QAChE,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YACjB,iCAAiC;YACjC,IACC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CACnE,GAAG,CAAC,QAAQ,CACZ,EACA,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACpC,wDAAwD;YACxD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;YACrE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACxD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,iDAAiD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC;aACpH,CAAC;QACH,CAAC;QACD,WAAW,EAAE,GAAG,EAAE,CACjB,oNAAoN;KACrN;IACD;QACC,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EACV,kGAAkG;QACnG,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YACd,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtC,OAAO,KAAK,CAAC;YACd,CAAC;YACD,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;QAC9C,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CACZ,sHAAsH;QACvH,WAAW,EAAE,GAAG,EAAE,CACjB,kFAAkF;KACnF;IACD;QACC,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,4DAA4D;QACzE,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CACd,wBAAwB,EAAE,IAAI,0BAA0B,CAAC,GAAG,CAAC,KAAK,IAAI;QACvE,MAAM,EAAE,GAAG,EAAE,CACZ,mHAAmH;KACpH;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,kDAAkD;QAC/D,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YACd,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACxC,2EAA2E;YAC3E,OAAO,CACN,WAAW,EAAE,eAAe,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,YAAY,CACnE,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,aAAa,GAAG,CAAC,QAAQ,kDAAkD;KAC5E;IACD;QACC,EAAE,EAAE,mBAAmB;QACvB,WAAW,EACV,sEAAsE;QACvE,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YACd,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAC;YACxD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1B,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YACxE,IAAI,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC3C,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC3C,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;gBAChC,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;gBAC5B,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC;gBACnC,OAAO,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC;YACpC,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,oDAAoD,GAAG,CAAC,QAAQ,kDAAkD;KACnH;IACD;QACC,EAAE,EAAE,iBAAiB;QACrB,WAAW,EACV,4EAA4E;QAC7E,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YACjB,IAAI,CAAC,sBAAsB,EAAE,IAAI,uBAAuB,EAAE,EAAE,CAAC;gBAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;YACjD,IAAI,oBAAoB,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9D,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,iLAAiL;aAClL,CAAC;QACH,CAAC;KACD;IACD,GAAG,qBAAqB;IACxB,qBAAqB;IACrB;QACC,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,6BAA6B;QAC1C,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC;QAC/C,MAAM,EAAE,GAAG,EAAE,CACZ,oGAAoG;KACrG;IACD;QACC,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,wDAAwD;QACrE,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YACd,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtC,OAAO,KAAK,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC7C,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,SAAS,GACd,OAAO;iBACL,GAAG,CACH,CAAC,QAAQ,EAAE,EAAE,CACZ,GAAG,QAAQ,CAAC,KAAK,eAAe,QAAQ,CAAC,EAAE,aAAa,QAAQ,CAAC,gBAAgB,GAAG,CACrF;iBACA,IAAI,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC;YACxC,OAAO,mBAAmB,SAAS,kDAAkD,GAAG,CAAC,QAAQ,iEAAiE,CAAC;QACpK,CAAC;KACD;CACD,CAAC;AAEF,MAAM,OAAO,cAAc;IAO1B,YACkB,QAA8B,oBAAoB,EACnE,OAEC;QAHgB,UAAK,GAAL,KAAK,CAA6C;QAKnE,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;IACrD,CAAC;IAED,gBAAgB,CAAC,KAAoB;QACpC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,OAA8B;QAE9B,MAAM,wBAAwB,GAC7B,MAAM,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,wBAAwB,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;YAClD,OAAO,wBAAwB,CAAC;QACjC,CAAC;QACD,IAAI,wBAAwB,EAAE,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAC7D,OAAO,wBAAwB,CAAC;QACjC,CAAC;QAED,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC/B,MAAM,UAAU,GAAgB,IAAI,CAAC,QAAQ;oBAC5C,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAC9B,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC;wBAC9B,CAAC,CAAC;4BACA,OAAO,EAAE,KAAK;4BACd,MAAM,EACL,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;gCAC9B,wBAAwB,IAAI,CAAC,WAAW,EAAE;yBAC3C;wBACF,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAEtB,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC;oBACjD,MAAM,MAAM,GACX,UAAU,CAAC,MAAM;wBACjB,wBAAwB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACzD,MAAM,WAAW,GAChB,UAAU,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC/D,MAAM,MAAM,GACV,IAAwB,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC;oBAE7D,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;wBACxB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC5B,CAAC;oBAED,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;wBACxB,OAAO;4BACN,MAAM;4BACN,MAAM;4BACN,MAAM;4BACN,WAAW;yBACX,CAAC;oBACH,CAAC;oBAED,OAAO;wBACN,MAAM;wBACN,MAAM;wBACN,MAAM;qBACN,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,iDAAiD;QACjD,IAAI,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC9C,MAAM,eAAe,GAAG;gBACvB,MAAM;gBACN,OAAO;gBACP,MAAM;gBACN,aAAa;gBACb,kBAAkB;aAClB,CAAC;YACF,IAAI,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;oBAClD,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,IAAI;iBACtB,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACpB,OAAO;wBACN,MAAM,EAAE,kBAAkB;wBAC1B,MAAM,EAAE,gBAAgB;wBACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;qBACvB,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,6BAA6B,CAC1C,OAA8B;QAE9B,MAAM,MAAM,GAAG,4CAA4C,CAC1D,IAAI,CAAC,iBAAiB,EACtB,OAAO,CACP,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,iDAAiD,CACtE,MAAM,EACN,OAAO,CACP,CAAC;YACF,OAAO,OAAO,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACvC,OAAO;oBACN,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,gCAAgC;oBACxC,MAAM,EAAE,mCAAmC,OAAO,EAAE;iBACpD,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,CACV,yFAAyF,EACzF;gBACC,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC1B,CACD,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;CACD;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,cAAc,EAAE,CAAC","sourcesContent":["/**\n * Action Firewall - Rule-based safety enforcement for tool execution\n *\n * The action firewall is the central decision point for tool safety. Before\n * any tool executes, it passes through the firewall which evaluates a series\n * of rules and returns a verdict: allow, require_approval, or block.\n *\n * ## Architecture\n *\n * ```\n * Tool Call → ActionFirewall.evaluate() → Rules (sequential) → Verdict\n *                      ↓                        ↓\n *              Context Object           Match + Reason + Remediation\n * ```\n *\n * ## Verdict Types\n *\n * - **allow**: Tool executes immediately without user interaction\n * - **require_approval**: User must explicitly approve before execution\n * - **block**: Tool is prevented from executing entirely (hard block)\n *\n * ## Rule Evaluation Order\n *\n * Rules are evaluated sequentially in priority order. The first matching\n * rule determines the verdict. This means:\n *\n * 1. Enterprise policy rules (hard blocks) come first\n * 2. System path protection (hard blocks) second\n * 3. Workspace containment (soft approval) third\n * 4. Dangerous command patterns (soft approval) later\n *\n * ## Caching Strategy\n *\n * Policy checks and tree-sitter analysis can be expensive. We use WeakMaps\n * keyed by the context object to cache results within a single evaluation.\n * The WeakMap ensures entries are garbage collected when the context is\n * no longer referenced.\n *\n * ## Integration Points\n *\n * The firewall integrates with:\n * - **Enterprise Policy**: Organizational restrictions on tools/paths\n * - **Workflow State**: PII tracking for egress prevention\n * - **Bash Parser**: Structured command analysis\n * - **Semantic Judge**: LLM-based intent analysis (optional, slow path)\n *\n * @module safety/action-firewall\n */\n\nimport type {\n\tActionApprovalContext,\n\tActionFirewallVerdict,\n\tWorkflowStateSnapshot,\n} from \"../agent/action-approval.js\";\nexport type { ActionApprovalContext } from \"../agent/action-approval.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { isCommandAllowlisted } from \"./bash-allowlist.js\";\nimport {\n\tanalyzeCommandSafety,\n\tdangerousPatternDescriptions,\n\tdangerousPatterns,\n\thasEgressPrimitives,\n\tisDestructiveSimpleCommand,\n\tisParserAvailable,\n\tisSimpleBenignBash,\n\ttokenizeSimple,\n\tunwrapShellCommand,\n} from \"./bash-safety-analyzer.js\";\nimport {\n\ttype ActionFirewallGovernanceServiceConfig,\n\tevaluateActionWithActionFirewallGovernanceService,\n\tresolveActionFirewallGovernanceServiceConfig,\n} from \"./governance-service-client.js\";\nimport { isContainedInWorkspace, isSystemPath } from \"./path-containment.js\";\nimport { checkPolicy } from \"./policy.js\";\nimport { RuleCache } from \"./rule-cache.js\";\nimport { TOOL_TAGS, looksLikeEgress } from \"./workflow-state.js\";\n\nimport type { SemanticJudge, SemanticJudgeContext } from \"./semantic-judge.js\";\n\nconst logger = createLogger(\"safety:action-firewall\");\n// Evaluate env flags lazily to honor profile overrides set after initial import.\nconst isStrictUntaggedEgress = () =>\n\tprocess.env.MAESTRO_FAIL_UNTAGGED_EGRESS === \"1\";\nconst isBackgroundShellBlocked = () =>\n\tprocess.env.MAESTRO_BACKGROUND_SHELL_DISABLE === \"1\";\nconst isSafeModeEnabled = () => process.env.MAESTRO_SAFE_MODE === \"1\";\nconst isProdProfile = () =>\n\tprocess.env.MAESTRO_PROFILE === \"prod\" ||\n\tprocess.env.MAESTRO_WEB_PROFILE === \"prod\";\nconst isNoEgressShellEnabled = () =>\n\t[\"1\", \"true\", \"on\"].includes(\n\t\t(process.env.MAESTRO_NO_EGRESS_SHELL ?? \"\").toLowerCase(),\n\t);\nconst isEgressOverrideAllowed = () =>\n\t[\"1\", \"true\", \"on\"].includes(\n\t\t(process.env.MAESTRO_ALLOW_EGRESS_SHELL ?? \"\").toLowerCase(),\n\t);\n\n/**\n * Policy Check Result - Cached result of enterprise policy evaluation\n */\ninterface PolicyCheckResult {\n\tallowed: boolean;\n\treason?: string;\n}\n\n/**\n * Policy Check Cache - Avoids redundant policy evaluations\n *\n * The firewall evaluation flow calls match() to check if a rule applies,\n * then reason() to get the human-readable explanation. For policy checks,\n * both need the same expensive async evaluation.\n *\n * We cache the result on match() and reuse it in reason(). The WeakMap\n * key is the context object itself, ensuring:\n * 1. Each context gets its own cached result\n * 2. Cache entries are automatically garbage collected when context is freed\n * 3. No memory leaks from long-running processes\n */\nconst policyCheckCache = new RuleCache<\n\tActionApprovalContext,\n\tPolicyCheckResult\n>();\n\n/**\n * Action Firewall Rule Interface\n *\n * Defines the structure of a firewall rule. Rules are the building blocks\n * of the firewall; each rule checks for a specific condition and returns\n * a verdict if matched.\n *\n * ## Rule Anatomy\n *\n * - **id**: Unique identifier for logging and debugging\n * - **description**: Human-readable explanation of what the rule checks\n * - **action**: What happens if rule matches (default: require_approval)\n * - **match()**: Predicate that returns true if rule applies\n * - **reason()**: Optional function returning why rule matched\n * - **remediation()**: Optional function suggesting how to fix the issue\n *\n * ## Match Evaluation\n *\n * The match function receives the full tool context including:\n * - toolName: Name of the tool being called\n * - args: Arguments passed to the tool\n * - metadata: Additional context (workflow state, annotations)\n * - user/session: Authentication context\n *\n * Rules can be sync or async. Async rules are awaited during evaluation.\n */\ntype RuleOutcome = { allowed: boolean; reason?: string; remediation?: string };\n\nexport interface ActionFirewallRule {\n\t/** Optional legacy identifier used in existing logs/tests */\n\tid?: string;\n\t/** Optional name for logging */\n\tname?: string;\n\t/** Human-readable description */\n\tdescription: string;\n\t/** Verdict override */\n\taction?: \"allow\" | \"require_approval\" | \"block\";\n\t/** Modern evaluation hook (preferred) */\n\tevaluate?: (\n\t\tcontext: ActionApprovalContext,\n\t) => RuleOutcome | Promise<RuleOutcome>;\n\t/** Optional remediation helper */\n\tremediation?: (context: ActionApprovalContext) => string | Promise<string>;\n\t/** Legacy match/reason hooks kept for backward compatibility */\n\tmatch?: (context: ActionApprovalContext) => boolean | Promise<boolean>;\n\treason?: (context: ActionApprovalContext) => string | Promise<string>;\n}\n\nconst untaggedEgressWarnings = new Set<string>();\nexport const HUMAN_EGRESS_PII_RULE_ID = \"pii-redaction-before-human-egress\";\n\nfunction getArgsObject(\n\tcontext: ActionApprovalContext,\n): Record<string, unknown> | null {\n\treturn context.args && typeof context.args === \"object\"\n\t\t? (context.args as Record<string, unknown>)\n\t\t: null;\n}\n\nfunction getStringArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): string | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"string\" ? value : null;\n}\n\nfunction getBooleanArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): boolean | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"boolean\" ? value : null;\n}\n\nfunction getCommandArg(context: ActionApprovalContext): string | null {\n\treturn getStringArg(context, \"command\");\n}\n\nfunction isBackgroundTaskShellStart(context: ActionApprovalContext): boolean {\n\tif (context.toolName !== \"background_tasks\") {\n\t\treturn false;\n\t}\n\tconst action = getStringArg(context, \"action\");\n\tif (action !== \"start\") {\n\t\treturn false;\n\t}\n\treturn getBooleanArg(context, \"shell\") === true;\n}\n\nfunction getWorkflowState(\n\tcontext: ActionApprovalContext,\n): WorkflowStateSnapshot | null {\n\treturn context.metadata?.workflowState ?? null;\n}\n\nfunction getPendingUnredactedPii(\n\tcontext: ActionApprovalContext,\n): WorkflowStateSnapshot[\"pendingPii\"] {\n\tconst snapshot = getWorkflowState(context);\n\tif (!snapshot) {\n\t\treturn [];\n\t}\n\treturn snapshot.pendingPii.filter((artifact) => artifact.redacted !== true);\n}\n\nfunction warnUntaggedEgress(toolName: string): void {\n\tif (untaggedEgressWarnings.has(toolName)) {\n\t\treturn;\n\t}\n\tuntaggedEgressWarnings.add(toolName);\n\tlogger.warn(\n\t\t\"Untagged egress-like tool encountered; treating as human-facing until TOOL_TAGS is updated\",\n\t\t{ toolName },\n\t);\n}\n\nfunction isHumanFacingTool(toolName: string): boolean {\n\tconst toolTags = TOOL_TAGS[toolName];\n\tif (toolTags?.egress === \"human\") {\n\t\treturn true;\n\t}\n\tif (!toolTags && looksLikeEgress(toolName)) {\n\t\twarnUntaggedEgress(toolName);\n\t\treturn true;\n\t}\n\treturn false;\n}\n\nfunction getAnnotations(context: ActionApprovalContext) {\n\treturn context.metadata?.annotations;\n}\n\nfunction isMcpTool(toolName: string): boolean {\n\treturn toolName.startsWith(\"mcp_\");\n}\n\n/**\n * Generate rules from dangerous patterns (regex-based)\n */\nconst dangerousCommandRules: ActionFirewallRule[] = Object.entries(\n\tdangerousPatterns,\n).map(([key, pattern]) => ({\n\tname: `command-${key}`,\n\tdescription:\n\t\tdangerousPatternDescriptions[\n\t\t\tkey as keyof typeof dangerousPatternDescriptions\n\t\t],\n\taction: \"require_approval\",\n\tevaluate: (ctx) => {\n\t\tif (!isBashGuardEnabled()) {\n\t\t\treturn { allowed: true };\n\t\t}\n\t\tconst command = getCommandArg(ctx);\n\t\tif (!command) return { allowed: true };\n\t\tconst unwrapped = unwrapShellCommand(command) ?? command;\n\t\tif (isCommandAllowlisted(unwrapped)) return { allowed: true };\n\t\tif (!pattern.test(unwrapped)) {\n\t\t\treturn { allowed: true };\n\t\t}\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Detected ${dangerousPatternDescriptions[key as keyof typeof dangerousPatternDescriptions]}: ${unwrapped.trim()}`,\n\t\t};\n\t},\n}));\n\nconst isBashStrict = () => process.env.MAESTRO_BASH_STRICT === \"1\";\nconst isBashGuardEnabled = () => {\n\tconst flag = process.env.MAESTRO_BASH_GUARD?.toLowerCase?.();\n\tif (flag) {\n\t\treturn ![\"0\", \"off\", \"false\", \"disabled\", \"no\"].includes(flag);\n\t}\n\t// Default: guard ON (previous behavior). Explicitly set MAESTRO_BASH_GUARD=0 to YOLO.\n\tif (isSafeModeEnabled() || isProdProfile()) {\n\t\treturn true;\n\t}\n\treturn true;\n};\n\n/**\n * Tree-sitter based command safety rule.\n * Provides more accurate analysis than regex patterns.\n */\nconst treeSitterCommandRule: ActionFirewallRule = {\n\tname: \"command-treesitter-analysis\",\n\tdescription: \"Tree-sitter based command safety analysis\",\n\taction: \"require_approval\",\n\tevaluate: (ctx) => {\n\t\tif (!isBashGuardEnabled()) {\n\t\t\treturn { allowed: true };\n\t\t}\n\t\tif (ctx.toolName !== \"bash\" && !isBackgroundTaskShellStart(ctx)) {\n\t\t\treturn { allowed: true };\n\t\t}\n\t\tlet command = getCommandArg(ctx);\n\t\tif (!command) return { allowed: true };\n\n\t\t// Try to unwrap bash -c \"...\" style commands\n\t\tconst unwrapped = unwrapShellCommand(command);\n\t\tif (unwrapped) {\n\t\t\tcommand = unwrapped;\n\t\t}\n\n\t\tif (isCommandAllowlisted(command)) {\n\t\t\treturn { allowed: true };\n\t\t}\n\n\t\tconst simpleTokens = tokenizeSimple(command);\n\t\tif (isDestructiveSimpleCommand(simpleTokens)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Command requires approval (destructive or mutating operation detected)\",\n\t\t\t};\n\t\t}\n\n\t\tif (!isBashStrict() && isSimpleBenignBash(command)) {\n\t\t\treturn { allowed: true };\n\t\t}\n\n\t\t// Only run tree-sitter if the parser is available; otherwise fall back to approval\n\t\tif (!isParserAvailable()) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Command requires approval (bash parser unavailable; unable to fully analyze)\",\n\t\t\t};\n\t\t}\n\n\t\tconst analysis = analyzeCommandSafety(command);\n\t\tif (analysis.safe) {\n\t\t\treturn { allowed: true };\n\t\t}\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: analysis.reason ?? \"Command failed tree-sitter safety analysis\",\n\t\t};\n\t},\n};\n\n/**\n * Critical System Paths - Directories that should never be modified\n *\n * These paths are protected with a HARD BLOCK (not just approval required).\n * Modifying files in these directories can:\n * - Break the operating system\n * - Compromise system security\n * - Affect other users on the system\n *\n * ## Linux Paths\n *\n * - /etc: System configuration\n * - /usr: System programs and libraries\n * - /var: Variable data (logs, databases)\n * - /boot: Bootloader and kernel\n * - /sys, /proc: Kernel virtual filesystems\n * - /dev: Device files\n * - /bin, /sbin: Essential system binaries\n * - /lib, /lib64: Shared libraries\n * - /opt: Optional/third-party software\n *\n * ## macOS Paths\n *\n * - /System: System files\n * - /Library: System libraries\n * - /private/etc, /private/var: Private system configuration/data\n * - /dev: Device files\n *\n * ## Windows Paths\n *\n * - C:\\Windows: Operating system\n * - C:\\Program Files: Installed applications\n *\n * Note: /var/folders (macOS temp) and /tmp are explicitly allowed\n * through the isContainedInWorkspace check before system path blocking.\n */\nfunction extractFilePaths(context: ActionApprovalContext): string[] {\n\tconst args = getArgsObject(context);\n\tif (!args) return [];\n\tconst paths: string[] = [];\n\n\t// Simple extraction for standard file tools\n\t// Note: deeper extraction is done in policy.ts, this is for quick system protection\n\tif (context.toolName === \"write\" || context.toolName === \"edit\") {\n\t\tconst p =\n\t\t\tgetStringArg(context, \"file_path\") || getStringArg(context, \"path\");\n\t\tif (p) paths.push(p);\n\t}\n\tif (context.toolName === \"delete_file\") {\n\t\tconst p =\n\t\t\tgetStringArg(context, \"file_path\") ||\n\t\t\tgetStringArg(context, \"target_file\");\n\t\tif (p) paths.push(p);\n\t}\n\t// Handle move_file and copy_file - extract both source and destination\n\tif (context.toolName === \"move_file\" || context.toolName === \"copy_file\") {\n\t\tconst source =\n\t\t\tgetStringArg(context, \"source\") ||\n\t\t\tgetStringArg(context, \"source_path\") ||\n\t\t\tgetStringArg(context, \"from\");\n\t\tconst dest =\n\t\t\tgetStringArg(context, \"destination\") ||\n\t\t\tgetStringArg(context, \"destination_path\") ||\n\t\t\tgetStringArg(context, \"dest\") ||\n\t\t\tgetStringArg(context, \"to\");\n\t\tif (source) paths.push(source);\n\t\tif (dest) paths.push(dest);\n\t}\n\treturn paths;\n}\n\n/**\n * Workspace Containment Check - Determines if a path is in a \"safe zone\"\n *\n * The firewall uses containment to prevent accidental writes outside the\n * project directory. This function checks if a file path is within one of\n * the allowed zones.\n *\n * ## Safe Zones (in order of check)\n *\n * 1. **Workspace root**: Current working directory and subdirectories\n * 2. **System temp directory**: /tmp, /var/folders, etc.\n * 3. **Trusted paths**: User-configured paths in firewall.json\n *\n * ## Path Resolution Complexity\n *\n * We must handle several path edge cases:\n *\n * - **Symlinks**: macOS /tmp → /private/tmp, so we resolve real paths\n * - **Non-existent files**: Can't realpath a file being created, use logical path\n * - **Relative paths**: Convert to absolute before comparison\n * - **Path traversal**: Detect ../ escapes using relative() output\n *\n * ## Detection Method\n *\n * For each safe zone, we compute relative(zone, targetPath). If the result:\n * - Starts with \"..\" → path escapes the zone (unsafe)\n * - Is an absolute path → completely outside (unsafe)\n * - Otherwise → contained within zone (safe)\n *\n * @param filePath - The path to check (may be relative or absolute)\n * @returns true if path is contained in a safe zone, false otherwise\n */\n\nexport const defaultFirewallRules: ActionFirewallRule[] = [\n\t{\n\t\tname: \"enterprise-policy\",\n\t\tdescription: \"Enforce enterprise policies on tools and dependencies\",\n\t\taction: \"block\", // HARD BLOCK for policy violations\n\t\tevaluate: async (ctx) => {\n\t\t\tconst cached = policyCheckCache.get(ctx);\n\t\t\tif (cached) {\n\t\t\t\treturn cached.allowed\n\t\t\t\t\t? { allowed: true }\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: cached.reason ?? \"Action blocked by enterprise policy\",\n\t\t\t\t\t\t};\n\t\t\t}\n\t\t\tconst result = await checkPolicy(ctx);\n\t\t\tpolicyCheckCache.set(ctx, result);\n\t\t\tif (result.allowed) return { allowed: true };\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: result.reason ?? \"Action blocked by enterprise policy\",\n\t\t\t};\n\t\t},\n\t},\n\t{\n\t\tname: \"system-path-protection\",\n\t\tdescription: \"Prevent modification of critical system directories\",\n\t\taction: \"block\", // HARD BLOCK for system paths\n\t\tevaluate: (ctx) => {\n\t\t\t// Only check file mutation tools\n\t\t\tif (\n\t\t\t\t![\"write\", \"edit\", \"delete_file\", \"move_file\", \"copy_file\"].includes(\n\t\t\t\t\tctx.toolName,\n\t\t\t\t)\n\t\t\t) {\n\t\t\t\treturn { allowed: true };\n\t\t\t}\n\t\t\tconst paths = extractFilePaths(ctx);\n\t\t\t// We check system paths first, but if it's in workspace, temp, or a trusted path (safe), we should allow it.\n\t\t\t// System paths like /var include /var/folders (temp on mac), so we need to exclude safe temp paths from system path blocking.\n\n\t\t\t// Filter out paths that are inside the workspace, temp, or trusted paths (which are safe)\n\t\t\tconst unsafePaths = paths.filter((p) => !isContainedInWorkspace(p));\n\n\t\t\t// Only check remaining paths against system blocklist\n\t\t\tif (unsafePaths.some(isSystemPath)) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Modification of critical system directories is blocked for safety.\",\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { allowed: true };\n\t\t},\n\t\tremediation: () =>\n\t\t\t\"Do not modify critical system paths. If you need to write a file, use the current workspace directory or a temporary folder.\",\n\t},\n\t{\n\t\tname: \"workspace-containment\",\n\t\tdescription:\n\t\t\t\"Require approval for file modifications outside the workspace\",\n\t\taction: \"require_approval\",\n\t\tevaluate: (ctx) => {\n\t\t\t// Only check file mutation tools\n\t\t\tif (\n\t\t\t\t![\"write\", \"edit\", \"delete_file\", \"move_file\", \"copy_file\"].includes(\n\t\t\t\t\tctx.toolName,\n\t\t\t\t)\n\t\t\t) {\n\t\t\t\treturn { allowed: true };\n\t\t\t}\n\t\t\tconst paths = extractFilePaths(ctx);\n\t\t\t// Return true (match rule) if ANY path is NOT contained\n\t\t\tconst outsidePaths = paths.filter((p) => !isContainedInWorkspace(p));\n\t\t\tif (outsidePaths.length === 0) return { allowed: true };\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `File modification outside workspace detected: ${outsidePaths.join(\", \")}. This requires explicit approval.`,\n\t\t\t};\n\t\t},\n\t\tremediation: () =>\n\t\t\t\"The file path is outside the allowed workspace. Please use a path within the current project or a temporary directory, or ask the user to add this path to 'containment.trustedPaths' in ~/.maestro/firewall.json.\",\n\t},\n\t{\n\t\tid: \"untagged-human-egress\",\n\t\tdescription:\n\t\t\t\"Block human-facing tool calls without explicit TOOL_TAGS annotations when strict mode is enabled\",\n\t\taction: \"block\",\n\t\tmatch: (ctx) => {\n\t\t\tif (!isStrictUntaggedEgress()) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tif (!isHumanFacingTool(ctx.toolName)) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\treturn TOOL_TAGS[ctx.toolName] === undefined;\n\t\t},\n\t\treason: () =>\n\t\t\t\"Human-facing tool is missing TOOL_TAGS; annotate the tool or disable strict mode via MAESTRO_FAIL_UNTAGGED_EGRESS=0.\",\n\t\tremediation: () =>\n\t\t\t\"Add TOOL_TAGS entry marking egress intent (human/http) before invoking the tool.\",\n\t},\n\t{\n\t\tid: \"background-shell-block\",\n\t\tdescription: \"Block shell-based background tasks when disabled by policy\",\n\t\taction: \"block\",\n\t\tmatch: (ctx) =>\n\t\t\tisBackgroundShellBlocked() && isBackgroundTaskShellStart(ctx) === true,\n\t\treason: () =>\n\t\t\t\"Starting background_tasks with shell=true is disabled by policy. Set MAESTRO_BACKGROUND_SHELL_DISABLE=0 to allow.\",\n\t},\n\t{\n\t\tid: \"mcp-destructive-tool\",\n\t\tdescription: \"MCP tools marked as destructive require approval\",\n\t\taction: \"require_approval\",\n\t\tmatch: (ctx) => {\n\t\t\tif (!isMcpTool(ctx.toolName)) return false;\n\t\t\tconst annotations = getAnnotations(ctx);\n\t\t\t// Require approval if destructiveHint is true and readOnlyHint is not true\n\t\t\treturn (\n\t\t\t\tannotations?.destructiveHint === true && !annotations?.readOnlyHint\n\t\t\t);\n\t\t},\n\t\treason: (ctx) =>\n\t\t\t`MCP tool \"${ctx.toolName}\" is marked as destructive and requires approval`,\n\t},\n\t{\n\t\tid: \"plan-mode-confirm\",\n\t\tdescription:\n\t\t\t\"When plan mode is enabled, require approval before mutating commands\",\n\t\taction: \"require_approval\",\n\t\tmatch: (ctx) => {\n\t\t\tif (process.env.MAESTRO_PLAN_MODE !== \"1\") return false;\n\t\t\tconst name = ctx.toolName;\n\t\t\tif (name === \"write\" || name === \"edit\" || name === \"bash\") return true;\n\t\t\tif (name === \"todo\") return true;\n\t\t\tif (name === \"gh_pr\") {\n\t\t\t\tconst action = getStringArg(ctx, \"action\");\n\t\t\t\treturn !action || ![\"list\", \"view\", \"checks\", \"diff\"].includes(action);\n\t\t\t}\n\t\t\tif (name === \"gh_issue\") {\n\t\t\t\tconst action = getStringArg(ctx, \"action\");\n\t\t\t\treturn !action || ![\"list\", \"view\"].includes(action);\n\t\t\t}\n\t\t\tif (name === \"background_tasks\") {\n\t\t\t\tconst args = getArgsObject(ctx);\n\t\t\t\tconst action = args?.action;\n\t\t\t\tconst shell = args?.shell === true;\n\t\t\t\treturn action === \"start\" && shell;\n\t\t\t}\n\t\t\treturn false;\n\t\t},\n\t\treason: (ctx) =>\n\t\t\t`Plan mode requires confirmation before executing ${ctx.toolName}. Toggle with /plan-mode or MAESTRO_PLAN_MODE=0.`,\n\t},\n\t{\n\t\tid: \"no-egress-shell\",\n\t\tdescription:\n\t\t\t\"Require approval when shell egress is disabled via MAESTRO_NO_EGRESS_SHELL\",\n\t\taction: \"require_approval\",\n\t\tevaluate: (ctx) => {\n\t\t\tif (!isNoEgressShellEnabled() || isEgressOverrideAllowed()) {\n\t\t\t\treturn { allowed: true };\n\t\t\t}\n\t\t\tif (ctx.toolName !== \"bash\" && !isBackgroundTaskShellStart(ctx)) {\n\t\t\t\treturn { allowed: true };\n\t\t\t}\n\t\t\tconst raw = getCommandArg(ctx);\n\t\t\tif (!raw) return { allowed: true };\n\t\t\tconst unwrapped = unwrapShellCommand(raw) ?? raw;\n\t\t\tif (isCommandAllowlisted(unwrapped)) return { allowed: true };\n\t\t\tif (!hasEgressPrimitives(unwrapped)) return { allowed: true };\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Shell egress (curl/wget/ssh/nc/dev/tcp) requires approval because MAESTRO_NO_EGRESS_SHELL=1. Allow temporarily with MAESTRO_ALLOW_EGRESS_SHELL=1 or add a bash allowlist entry.\",\n\t\t\t};\n\t\t},\n\t},\n\t...dangerousCommandRules,\n\ttreeSitterCommandRule,\n\t{\n\t\tid: \"background-shell-mode\",\n\t\tdescription: \"Shell mode background tasks\",\n\t\taction: \"require_approval\",\n\t\tmatch: (ctx) => isBackgroundTaskShellStart(ctx),\n\t\treason: () =>\n\t\t\t\"Background task shell mode requires manual approval (pipes, redirects, and globbing are high risk)\",\n\t},\n\t{\n\t\tid: HUMAN_EGRESS_PII_RULE_ID,\n\t\tdescription: \"PII must be redacted before human-facing tools execute\",\n\t\taction: \"require_approval\",\n\t\tmatch: (ctx) => {\n\t\t\tif (!isHumanFacingTool(ctx.toolName)) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tconst pending = getPendingUnredactedPii(ctx);\n\t\t\treturn pending.length > 0;\n\t\t},\n\t\treason: (ctx) => {\n\t\t\tconst pending = getPendingUnredactedPii(ctx);\n\t\t\tconst offenders =\n\t\t\t\tpending\n\t\t\t\t\t.map(\n\t\t\t\t\t\t(artifact) =>\n\t\t\t\t\t\t\t`${artifact.label} (artifact: ${artifact.id}, source: ${artifact.sourceToolCallId})`,\n\t\t\t\t\t)\n\t\t\t\t\t.join(\"; \") || \"unredacted artifacts\";\n\t\t\treturn `Unredacted PII (${offenders}) detected before executing human-facing tool \"${ctx.toolName}\". Run your redaction tool on the listed artifacts, then retry.`;\n\t\t},\n\t},\n];\n\nexport class ActionFirewall {\n\tprivate semanticJudge?: SemanticJudge;\n\tprivate readonly governanceService:\n\t\t| ActionFirewallGovernanceServiceConfig\n\t\t| false\n\t\t| undefined;\n\n\tconstructor(\n\t\tprivate readonly rules: ActionFirewallRule[] = defaultFirewallRules,\n\t\toptions?: {\n\t\t\tgovernanceService?: ActionFirewallGovernanceServiceConfig | false;\n\t\t},\n\t) {\n\t\tthis.governanceService = options?.governanceService;\n\t}\n\n\tsetSemanticJudge(judge: SemanticJudge) {\n\t\tthis.semanticJudge = judge;\n\t}\n\n\tasync evaluate(\n\t\tcontext: ActionApprovalContext,\n\t): Promise<ActionFirewallVerdict> {\n\t\tconst governanceServiceVerdict =\n\t\t\tawait this.evaluateWithGovernanceService(context);\n\t\tif (governanceServiceVerdict?.action === \"block\") {\n\t\t\treturn governanceServiceVerdict;\n\t\t}\n\t\tif (governanceServiceVerdict?.action === \"require_approval\") {\n\t\t\treturn governanceServiceVerdict;\n\t\t}\n\n\t\tif (!governanceServiceVerdict) {\n\t\t\tfor (const rule of this.rules) {\n\t\t\t\tconst evaluation: RuleOutcome = rule.evaluate\n\t\t\t\t\t? await rule.evaluate(context)\n\t\t\t\t\t: (await rule.match?.(context))\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\t\t(await rule.reason?.(context)) ??\n\t\t\t\t\t\t\t\t\t`Action matched rule: ${rule.description}`,\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: { allowed: true };\n\n\t\t\t\tif (!evaluation.allowed) {\n\t\t\t\t\tconst action = rule.action ?? \"require_approval\";\n\t\t\t\t\tconst reason =\n\t\t\t\t\t\tevaluation.reason ??\n\t\t\t\t\t\t`Action matched rule: ${rule.description ?? rule.name}`;\n\t\t\t\t\tconst remediation =\n\t\t\t\t\t\tevaluation.remediation ?? (await rule.remediation?.(context));\n\t\t\t\t\tconst ruleId =\n\t\t\t\t\t\t(rule as { id?: string }).id ?? rule.name ?? \"unknown-rule\";\n\n\t\t\t\t\tif (action === \"allow\") {\n\t\t\t\t\t\treturn { action: \"allow\" };\n\t\t\t\t\t}\n\n\t\t\t\t\tif (action === \"block\") {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\taction,\n\t\t\t\t\t\t\truleId,\n\t\t\t\t\t\t\treason,\n\t\t\t\t\t\t\tremediation,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\taction,\n\t\t\t\t\t\truleId,\n\t\t\t\t\t\treason,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// 2. Run semantic judge if available (slow path)\n\t\tif (this.semanticJudge && context.userIntent) {\n\t\t\tconst SENSITIVE_TOOLS = [\n\t\t\t\t\"bash\",\n\t\t\t\t\"write\",\n\t\t\t\t\"edit\",\n\t\t\t\t\"delete_file\",\n\t\t\t\t\"background_tasks\",\n\t\t\t];\n\t\t\tif (SENSITIVE_TOOLS.includes(context.toolName)) {\n\t\t\t\tconst judgment = await this.semanticJudge.evaluate({\n\t\t\t\t\tuserIntent: context.userIntent,\n\t\t\t\t\ttoolName: context.toolName,\n\t\t\t\t\ttoolArgs: context.args,\n\t\t\t\t});\n\n\t\t\t\tif (!judgment.safe) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\taction: \"require_approval\",\n\t\t\t\t\t\truleId: \"semantic-judge\",\n\t\t\t\t\t\treason: judgment.reason,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn { action: \"allow\" };\n\t}\n\n\tprivate async evaluateWithGovernanceService(\n\t\tcontext: ActionApprovalContext,\n\t): Promise<ActionFirewallVerdict | null> {\n\t\tconst config = resolveActionFirewallGovernanceServiceConfig(\n\t\t\tthis.governanceService,\n\t\t\tcontext,\n\t\t);\n\t\tif (!config) {\n\t\t\treturn null;\n\t\t}\n\n\t\ttry {\n\t\t\tconst verdict = await evaluateActionWithActionFirewallGovernanceService(\n\t\t\t\tconfig,\n\t\t\t\tcontext,\n\t\t\t);\n\t\t\treturn verdict;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tif (config.failureMode === \"required\") {\n\t\t\t\treturn {\n\t\t\t\t\taction: \"block\",\n\t\t\t\t\truleId: \"governance-service-unavailable\",\n\t\t\t\t\treason: `Governance service unavailable: ${message}`,\n\t\t\t\t};\n\t\t\t}\n\t\t\tlogger.warn(\n\t\t\t\t\"Failed to evaluate action with governance service; falling back to local firewall rules\",\n\t\t\t\t{\n\t\t\t\t\terror: message,\n\t\t\t\t\ttoolName: context.toolName,\n\t\t\t\t},\n\t\t\t);\n\t\t\treturn null;\n\t\t}\n\t}\n}\n\nexport const defaultActionFirewall = new ActionFirewall();\n"]}
+{"version":3,"file":"action-firewall.js","sourceRoot":"","sources":["../../src/safety/action-firewall.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAQH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACN,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,GAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEN,iDAAiD,EACjD,4CAA4C,GAC5C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,4BAA4B,EAC5B,+BAA+B,EAC/B,wBAAwB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAIjE,MAAM,MAAM,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AACtD,iFAAiF;AACjF,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACnC,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,GAAG,CAAC;AAClD,MAAM,wBAAwB,GAAG,GAAG,EAAE,CACrC,OAAO,CAAC,GAAG,CAAC,gCAAgC,KAAK,GAAG,CAAC;AACtD,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG,CAAC;AACtE,MAAM,aAAa,GAAG,GAAG,EAAE,CAC1B,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,MAAM;IACtC,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,CAAC;AAC5C,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACnC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAC3B,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CACzD,CAAC;AACH,MAAM,uBAAuB,GAAG,GAAG,EAAE,CACpC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAC3B,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAC5D,CAAC;AAUH;;;;;;;;;;;;GAYG;AACH,MAAM,gBAAgB,GAAG,IAAI,SAAS,EAGnC,CAAC;AAkDJ,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;AACjD,MAAM,CAAC,MAAM,wBAAwB,GAAG,mCAAmC,CAAC;AAE5E,SAAS,aAAa,CACrB,OAA8B;IAE9B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,OAAO,CAAC,IAAgC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACpB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CACrB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,OAA8B;IACpD,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,0BAA0B,CAAC,OAA8B;IACjE,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CACxB,OAA8B;IAE9B,OAAO,OAAO,CAAC,QAAQ,EAAE,aAAa,IAAI,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,uBAAuB,CAC/B,OAA8B;IAE9B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC3C,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO;IACR,CAAC;IACD,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,CACV,4FAA4F,EAC5F,EAAE,QAAQ,EAAE,CACZ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,QAAQ,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,OAA8B;IACrD,OAAO,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC;AACtC,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IAClC,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,qBAAqB,GAAyB,MAAM,CAAC,OAAO,CACjE,iBAAiB,CACjB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1B,IAAI,EAAE,WAAW,GAAG,EAAE;IACtB,WAAW,EACV,4BAA4B,CAC3B,GAAgD,CAChD;IACF,MAAM,EAAE,kBAAkB;IAC1B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;QACjB,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;QACzD,IAAI,oBAAoB,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,YAAY,4BAA4B,CAAC,GAAgD,CAAC,KAAK,SAAS,CAAC,IAAI,EAAE,EAAE;SACzH,CAAC;IACH,CAAC;CACD,CAAC,CAAC,CAAC;AAEJ,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,CAAC;AACnE,MAAM,kBAAkB,GAAG,GAAG,EAAE;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,WAAW,EAAE,EAAE,CAAC;IAC7D,IAAI,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,sFAAsF;IACtF,IAAI,iBAAiB,EAAE,IAAI,aAAa,EAAE,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,qBAAqB,GAAuB;IACjD,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,2CAA2C;IACxD,MAAM,EAAE,kBAAkB;IAC1B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;QACjB,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEvC,6CAA6C;QAC7C,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,GAAG,SAAS,CAAC;QACrB,CAAC;QAED,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,0BAA0B,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9C,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,wEAAwE;aACzE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,mFAAmF;QACnF,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAC1B,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,8EAA8E;aAC/E,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,4CAA4C;SACvE,CAAC;IACH,CAAC;CACD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,SAAS,gBAAgB,CAAC,OAA8B;IACvD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAEhD,4CAA4C;IAC5C,oFAAoF;IACpF,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACjD,MAAM,CAAC,GACN,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAChC,MAAM,CAAC,GACN,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC;YAClC,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACtC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,uEAAuE;IACvE,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC1D,MAAM,MAAM,GACX,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC;YAC/B,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC;YACpC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,IAAI,GACT,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC;YACpC,YAAY,CAAC,OAAO,EAAE,kBAAkB,CAAC;YACzC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;YAC7B,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAyB;IACzD;QACC,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,uDAAuD;QACpE,MAAM,EAAE,OAAO,EAAE,mCAAmC;QACpD,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACvB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,CAAC,OAAO;oBACpB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;oBACnB,CAAC,CAAC;wBACA,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,qCAAqC;qBAC9D,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC7C,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,qCAAqC;aAC9D,CAAC;QACH,CAAC;KACD;IACD;QACC,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,qDAAqD;QAClE,MAAM,EAAE,OAAO,EAAE,8BAA8B;QAC/C,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YACjB,iCAAiC;YACjC,IACC,CAAC;gBACA,OAAO;gBACP,MAAM;gBACN,aAAa;gBACb,aAAa;gBACb,WAAW;gBACX,WAAW;aACX,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EACvB,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACpC,6GAA6G;YAC7G,8HAA8H;YAE9H,0FAA0F;YAC1F,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;YAEpE,sDAAsD;YACtD,IAAI,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EACL,oEAAoE;iBACrE,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,WAAW,EAAE,GAAG,EAAE,CACjB,8HAA8H;KAC/H;IACD;QACC,EAAE,EAAE,4BAA4B;QAChC,WAAW,EACV,qFAAqF;QACtF,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YACjB,MAAM,KAAK,GAAG,wBAAwB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE;gBAC9D,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,YAAY;aAClC,CAAC,CAAC;YACH,IAAI,KAAK,EAAE,eAAe,KAAK,OAAO,EAAE,CAAC;gBACxC,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,+BAA+B,CAAC,KAAK,CAAC;oBAC9C,WAAW,EACV,mIAAmI;iBACpI,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;KACD;IACD;QACC,EAAE,EAAE,4BAA4B;QAChC,WAAW,EACV,kGAAkG;QACnG,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YACjB,MAAM,KAAK,GAAG,wBAAwB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE;gBAC9D,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,YAAY;aAClC,CAAC,CAAC;YACH,IAAI,KAAK,EAAE,CAAC;gBACX,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,+BAA+B,CAAC,KAAK,CAAC;iBAC9C,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;KACD;IACD;QACC,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACV,+DAA+D;QAChE,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YACjB,iCAAiC;YACjC,IACC,CAAC;gBACA,OAAO;gBACP,MAAM;gBACN,aAAa;gBACb,aAAa;gBACb,WAAW;gBACX,WAAW;aACX,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EACvB,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACpC,wDAAwD;YACxD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;YACrE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACxD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,iDAAiD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC;aACpH,CAAC;QACH,CAAC;QACD,WAAW,EAAE,GAAG,EAAE,CACjB,oNAAoN;KACrN;IACD;QACC,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EACV,kGAAkG;QACnG,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YACd,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtC,OAAO,KAAK,CAAC;YACd,CAAC;YACD,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;QAC9C,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CACZ,sHAAsH;QACvH,WAAW,EAAE,GAAG,EAAE,CACjB,kFAAkF;KACnF;IACD;QACC,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,4DAA4D;QACzE,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CACd,wBAAwB,EAAE,IAAI,0BAA0B,CAAC,GAAG,CAAC,KAAK,IAAI;QACvE,MAAM,EAAE,GAAG,EAAE,CACZ,mHAAmH;KACpH;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,kDAAkD;QAC/D,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YACd,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACxC,2EAA2E;YAC3E,OAAO,CACN,WAAW,EAAE,eAAe,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,YAAY,CACnE,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,aAAa,GAAG,CAAC,QAAQ,kDAAkD;KAC5E;IACD;QACC,EAAE,EAAE,mBAAmB;QACvB,WAAW,EACV,sEAAsE;QACvE,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YACd,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAC;YACxD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1B,IACC,IAAI,KAAK,OAAO;gBAChB,IAAI,KAAK,MAAM;gBACf,IAAI,KAAK,aAAa;gBACtB,IAAI,KAAK,MAAM,EACd,CAAC;gBACF,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IAAI,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC3C,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC3C,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;gBAChC,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;gBAC5B,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC;gBACnC,OAAO,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC;YACpC,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,oDAAoD,GAAG,CAAC,QAAQ,kDAAkD;KACnH;IACD;QACC,EAAE,EAAE,iBAAiB;QACrB,WAAW,EACV,4EAA4E;QAC7E,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YACjB,IAAI,CAAC,sBAAsB,EAAE,IAAI,uBAAuB,EAAE,EAAE,CAAC;gBAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;YACjD,IAAI,oBAAoB,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9D,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,iLAAiL;aAClL,CAAC;QACH,CAAC;KACD;IACD,GAAG,qBAAqB;IACxB,qBAAqB;IACrB;QACC,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,6BAA6B;QAC1C,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC;QAC/C,MAAM,EAAE,GAAG,EAAE,CACZ,oGAAoG;KACrG;IACD;QACC,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,wDAAwD;QACrE,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YACd,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtC,OAAO,KAAK,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC7C,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,SAAS,GACd,OAAO;iBACL,GAAG,CACH,CAAC,QAAQ,EAAE,EAAE,CACZ,GAAG,QAAQ,CAAC,KAAK,eAAe,QAAQ,CAAC,EAAE,aAAa,QAAQ,CAAC,gBAAgB,GAAG,CACrF;iBACA,IAAI,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC;YACxC,OAAO,mBAAmB,SAAS,kDAAkD,GAAG,CAAC,QAAQ,iEAAiE,CAAC;QACpK,CAAC;KACD;CACD,CAAC;AAEF,MAAM,OAAO,cAAc;IAO1B,YACkB,QAA8B,oBAAoB,EACnE,OAEC;QAHgB,UAAK,GAAL,KAAK,CAA6C;QAKnE,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;IACrD,CAAC;IAED,gBAAgB,CAAC,KAAoB;QACpC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,OAA8B;QAE9B,MAAM,wBAAwB,GAC7B,MAAM,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,wBAAwB,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;YAClD,OAAO,wBAAwB,CAAC;QACjC,CAAC;QACD,IAAI,wBAAwB,EAAE,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAC7D,OAAO,wBAAwB,CAAC;QACjC,CAAC;QAED,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC/B,MAAM,UAAU,GAAgB,IAAI,CAAC,QAAQ;oBAC5C,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAC9B,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC;wBAC9B,CAAC,CAAC;4BACA,OAAO,EAAE,KAAK;4BACd,MAAM,EACL,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;gCAC9B,wBAAwB,IAAI,CAAC,WAAW,EAAE;yBAC3C;wBACF,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAEtB,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC;oBACjD,MAAM,MAAM,GACX,UAAU,CAAC,MAAM;wBACjB,wBAAwB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACzD,MAAM,WAAW,GAChB,UAAU,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC/D,MAAM,MAAM,GACV,IAAwB,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC;oBAE7D,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;wBACxB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC5B,CAAC;oBAED,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;wBACxB,OAAO;4BACN,MAAM;4BACN,MAAM;4BACN,MAAM;4BACN,WAAW;yBACX,CAAC;oBACH,CAAC;oBAED,OAAO;wBACN,MAAM;wBACN,MAAM;wBACN,MAAM;qBACN,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,iDAAiD;QACjD,IAAI,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC9C,MAAM,eAAe,GAAG;gBACvB,MAAM;gBACN,OAAO;gBACP,MAAM;gBACN,aAAa;gBACb,aAAa;gBACb,kBAAkB;aAClB,CAAC;YACF,IAAI,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;oBAClD,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,IAAI;iBACtB,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACpB,OAAO;wBACN,MAAM,EAAE,kBAAkB;wBAC1B,MAAM,EAAE,gBAAgB;wBACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;qBACvB,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,6BAA6B,CAC1C,OAA8B;QAE9B,MAAM,MAAM,GAAG,4CAA4C,CAC1D,IAAI,CAAC,iBAAiB,EACtB,OAAO,CACP,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,iDAAiD,CACtE,MAAM,EACN,OAAO,CACP,CAAC;YACF,OAAO,OAAO,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACvC,OAAO;oBACN,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,gCAAgC;oBACxC,MAAM,EAAE,mCAAmC,OAAO,EAAE;iBACpD,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,CACV,yFAAyF,EACzF;gBACC,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC1B,CACD,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;CACD;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,cAAc,EAAE,CAAC","sourcesContent":["/**\n * Action Firewall - Rule-based safety enforcement for tool execution\n *\n * The action firewall is the central decision point for tool safety. Before\n * any tool executes, it passes through the firewall which evaluates a series\n * of rules and returns a verdict: allow, require_approval, or block.\n *\n * ## Architecture\n *\n * ```\n * Tool Call → ActionFirewall.evaluate() → Rules (sequential) → Verdict\n *                      ↓                        ↓\n *              Context Object           Match + Reason + Remediation\n * ```\n *\n * ## Verdict Types\n *\n * - **allow**: Tool executes immediately without user interaction\n * - **require_approval**: User must explicitly approve before execution\n * - **block**: Tool is prevented from executing entirely (hard block)\n *\n * ## Rule Evaluation Order\n *\n * Rules are evaluated sequentially in priority order. The first matching\n * rule determines the verdict. This means:\n *\n * 1. Enterprise policy rules (hard blocks) come first\n * 2. System path protection (hard blocks) second\n * 3. Workspace containment (soft approval) third\n * 4. Dangerous command patterns (soft approval) later\n *\n * ## Caching Strategy\n *\n * Policy checks and tree-sitter analysis can be expensive. We use WeakMaps\n * keyed by the context object to cache results within a single evaluation.\n * The WeakMap ensures entries are garbage collected when the context is\n * no longer referenced.\n *\n * ## Integration Points\n *\n * The firewall integrates with:\n * - **Enterprise Policy**: Organizational restrictions on tools/paths\n * - **Workflow State**: PII tracking for egress prevention\n * - **Bash Parser**: Structured command analysis\n * - **Semantic Judge**: LLM-based intent analysis (optional, slow path)\n *\n * @module safety/action-firewall\n */\n\nimport type {\n\tActionApprovalContext,\n\tActionFirewallVerdict,\n\tWorkflowStateSnapshot,\n} from \"../agent/action-approval.js\";\nexport type { ActionApprovalContext } from \"../agent/action-approval.js\";\nimport { parseApplyPatchPaths } from \"../tools/apply-patch-parser.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { isCommandAllowlisted } from \"./bash-allowlist.js\";\nimport {\n\tanalyzeCommandSafety,\n\tdangerousPatternDescriptions,\n\tdangerousPatterns,\n\thasEgressPrimitives,\n\tisDestructiveSimpleCommand,\n\tisParserAvailable,\n\tisSimpleBenignBash,\n\ttokenizeSimple,\n\tunwrapShellCommand,\n} from \"./bash-safety-analyzer.js\";\nimport {\n\ttype ActionFirewallGovernanceServiceConfig,\n\tevaluateActionWithActionFirewallGovernanceService,\n\tresolveActionFirewallGovernanceServiceConfig,\n} from \"./governance-service-client.js\";\nimport {\n\tDEFAULT_GUARDED_FILE_RULE_ID,\n\tdescribeDefaultGuardedFileMatch,\n\tfindGuardedToolCallMatch,\n} from \"./guarded-files.js\";\nimport { isContainedInWorkspace, isSystemPath } from \"./path-containment.js\";\nimport { checkPolicy } from \"./policy.js\";\nimport { RuleCache } from \"./rule-cache.js\";\nimport { TOOL_TAGS, looksLikeEgress } from \"./workflow-state.js\";\n\nimport type { SemanticJudge, SemanticJudgeContext } from \"./semantic-judge.js\";\n\nconst logger = createLogger(\"safety:action-firewall\");\n// Evaluate env flags lazily to honor profile overrides set after initial import.\nconst isStrictUntaggedEgress = () =>\n\tprocess.env.MAESTRO_FAIL_UNTAGGED_EGRESS === \"1\";\nconst isBackgroundShellBlocked = () =>\n\tprocess.env.MAESTRO_BACKGROUND_SHELL_DISABLE === \"1\";\nconst isSafeModeEnabled = () => process.env.MAESTRO_SAFE_MODE === \"1\";\nconst isProdProfile = () =>\n\tprocess.env.MAESTRO_PROFILE === \"prod\" ||\n\tprocess.env.MAESTRO_WEB_PROFILE === \"prod\";\nconst isNoEgressShellEnabled = () =>\n\t[\"1\", \"true\", \"on\"].includes(\n\t\t(process.env.MAESTRO_NO_EGRESS_SHELL ?? \"\").toLowerCase(),\n\t);\nconst isEgressOverrideAllowed = () =>\n\t[\"1\", \"true\", \"on\"].includes(\n\t\t(process.env.MAESTRO_ALLOW_EGRESS_SHELL ?? \"\").toLowerCase(),\n\t);\n\n/**\n * Policy Check Result - Cached result of enterprise policy evaluation\n */\ninterface PolicyCheckResult {\n\tallowed: boolean;\n\treason?: string;\n}\n\n/**\n * Policy Check Cache - Avoids redundant policy evaluations\n *\n * The firewall evaluation flow calls match() to check if a rule applies,\n * then reason() to get the human-readable explanation. For policy checks,\n * both need the same expensive async evaluation.\n *\n * We cache the result on match() and reuse it in reason(). The WeakMap\n * key is the context object itself, ensuring:\n * 1. Each context gets its own cached result\n * 2. Cache entries are automatically garbage collected when context is freed\n * 3. No memory leaks from long-running processes\n */\nconst policyCheckCache = new RuleCache<\n\tActionApprovalContext,\n\tPolicyCheckResult\n>();\n\n/**\n * Action Firewall Rule Interface\n *\n * Defines the structure of a firewall rule. Rules are the building blocks\n * of the firewall; each rule checks for a specific condition and returns\n * a verdict if matched.\n *\n * ## Rule Anatomy\n *\n * - **id**: Unique identifier for logging and debugging\n * - **description**: Human-readable explanation of what the rule checks\n * - **action**: What happens if rule matches (default: require_approval)\n * - **match()**: Predicate that returns true if rule applies\n * - **reason()**: Optional function returning why rule matched\n * - **remediation()**: Optional function suggesting how to fix the issue\n *\n * ## Match Evaluation\n *\n * The match function receives the full tool context including:\n * - toolName: Name of the tool being called\n * - args: Arguments passed to the tool\n * - metadata: Additional context (workflow state, annotations)\n * - user/session: Authentication context\n *\n * Rules can be sync or async. Async rules are awaited during evaluation.\n */\ntype RuleOutcome = { allowed: boolean; reason?: string; remediation?: string };\n\nexport interface ActionFirewallRule {\n\t/** Optional legacy identifier used in existing logs/tests */\n\tid?: string;\n\t/** Optional name for logging */\n\tname?: string;\n\t/** Human-readable description */\n\tdescription: string;\n\t/** Verdict override */\n\taction?: \"allow\" | \"require_approval\" | \"block\";\n\t/** Modern evaluation hook (preferred) */\n\tevaluate?: (\n\t\tcontext: ActionApprovalContext,\n\t) => RuleOutcome | Promise<RuleOutcome>;\n\t/** Optional remediation helper */\n\tremediation?: (context: ActionApprovalContext) => string | Promise<string>;\n\t/** Legacy match/reason hooks kept for backward compatibility */\n\tmatch?: (context: ActionApprovalContext) => boolean | Promise<boolean>;\n\treason?: (context: ActionApprovalContext) => string | Promise<string>;\n}\n\nconst untaggedEgressWarnings = new Set<string>();\nexport const HUMAN_EGRESS_PII_RULE_ID = \"pii-redaction-before-human-egress\";\n\nfunction getArgsObject(\n\tcontext: ActionApprovalContext,\n): Record<string, unknown> | null {\n\treturn context.args && typeof context.args === \"object\"\n\t\t? (context.args as Record<string, unknown>)\n\t\t: null;\n}\n\nfunction getStringArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): string | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"string\" ? value : null;\n}\n\nfunction getBooleanArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): boolean | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"boolean\" ? value : null;\n}\n\nfunction getCommandArg(context: ActionApprovalContext): string | null {\n\treturn getStringArg(context, \"command\");\n}\n\nfunction isBackgroundTaskShellStart(context: ActionApprovalContext): boolean {\n\tif (context.toolName !== \"background_tasks\") {\n\t\treturn false;\n\t}\n\tconst action = getStringArg(context, \"action\");\n\tif (action !== \"start\") {\n\t\treturn false;\n\t}\n\treturn getBooleanArg(context, \"shell\") === true;\n}\n\nfunction getWorkflowState(\n\tcontext: ActionApprovalContext,\n): WorkflowStateSnapshot | null {\n\treturn context.metadata?.workflowState ?? null;\n}\n\nfunction getPendingUnredactedPii(\n\tcontext: ActionApprovalContext,\n): WorkflowStateSnapshot[\"pendingPii\"] {\n\tconst snapshot = getWorkflowState(context);\n\tif (!snapshot) {\n\t\treturn [];\n\t}\n\treturn snapshot.pendingPii.filter((artifact) => artifact.redacted !== true);\n}\n\nfunction warnUntaggedEgress(toolName: string): void {\n\tif (untaggedEgressWarnings.has(toolName)) {\n\t\treturn;\n\t}\n\tuntaggedEgressWarnings.add(toolName);\n\tlogger.warn(\n\t\t\"Untagged egress-like tool encountered; treating as human-facing until TOOL_TAGS is updated\",\n\t\t{ toolName },\n\t);\n}\n\nfunction isHumanFacingTool(toolName: string): boolean {\n\tconst toolTags = TOOL_TAGS[toolName];\n\tif (toolTags?.egress === \"human\") {\n\t\treturn true;\n\t}\n\tif (!toolTags && looksLikeEgress(toolName)) {\n\t\twarnUntaggedEgress(toolName);\n\t\treturn true;\n\t}\n\treturn false;\n}\n\nfunction getAnnotations(context: ActionApprovalContext) {\n\treturn context.metadata?.annotations;\n}\n\nfunction isMcpTool(toolName: string): boolean {\n\treturn toolName.startsWith(\"mcp_\");\n}\n\n/**\n * Generate rules from dangerous patterns (regex-based)\n */\nconst dangerousCommandRules: ActionFirewallRule[] = Object.entries(\n\tdangerousPatterns,\n).map(([key, pattern]) => ({\n\tname: `command-${key}`,\n\tdescription:\n\t\tdangerousPatternDescriptions[\n\t\t\tkey as keyof typeof dangerousPatternDescriptions\n\t\t],\n\taction: \"require_approval\",\n\tevaluate: (ctx) => {\n\t\tif (!isBashGuardEnabled()) {\n\t\t\treturn { allowed: true };\n\t\t}\n\t\tconst command = getCommandArg(ctx);\n\t\tif (!command) return { allowed: true };\n\t\tconst unwrapped = unwrapShellCommand(command) ?? command;\n\t\tif (isCommandAllowlisted(unwrapped)) return { allowed: true };\n\t\tif (!pattern.test(unwrapped)) {\n\t\t\treturn { allowed: true };\n\t\t}\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Detected ${dangerousPatternDescriptions[key as keyof typeof dangerousPatternDescriptions]}: ${unwrapped.trim()}`,\n\t\t};\n\t},\n}));\n\nconst isBashStrict = () => process.env.MAESTRO_BASH_STRICT === \"1\";\nconst isBashGuardEnabled = () => {\n\tconst flag = process.env.MAESTRO_BASH_GUARD?.toLowerCase?.();\n\tif (flag) {\n\t\treturn ![\"0\", \"off\", \"false\", \"disabled\", \"no\"].includes(flag);\n\t}\n\t// Default: guard ON (previous behavior). Explicitly set MAESTRO_BASH_GUARD=0 to YOLO.\n\tif (isSafeModeEnabled() || isProdProfile()) {\n\t\treturn true;\n\t}\n\treturn true;\n};\n\n/**\n * Tree-sitter based command safety rule.\n * Provides more accurate analysis than regex patterns.\n */\nconst treeSitterCommandRule: ActionFirewallRule = {\n\tname: \"command-treesitter-analysis\",\n\tdescription: \"Tree-sitter based command safety analysis\",\n\taction: \"require_approval\",\n\tevaluate: (ctx) => {\n\t\tif (!isBashGuardEnabled()) {\n\t\t\treturn { allowed: true };\n\t\t}\n\t\tif (ctx.toolName !== \"bash\" && !isBackgroundTaskShellStart(ctx)) {\n\t\t\treturn { allowed: true };\n\t\t}\n\t\tlet command = getCommandArg(ctx);\n\t\tif (!command) return { allowed: true };\n\n\t\t// Try to unwrap bash -c \"...\" style commands\n\t\tconst unwrapped = unwrapShellCommand(command);\n\t\tif (unwrapped) {\n\t\t\tcommand = unwrapped;\n\t\t}\n\n\t\tif (isCommandAllowlisted(command)) {\n\t\t\treturn { allowed: true };\n\t\t}\n\n\t\tconst simpleTokens = tokenizeSimple(command);\n\t\tif (isDestructiveSimpleCommand(simpleTokens)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Command requires approval (destructive or mutating operation detected)\",\n\t\t\t};\n\t\t}\n\n\t\tif (!isBashStrict() && isSimpleBenignBash(command)) {\n\t\t\treturn { allowed: true };\n\t\t}\n\n\t\t// Only run tree-sitter if the parser is available; otherwise fall back to approval\n\t\tif (!isParserAvailable()) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Command requires approval (bash parser unavailable; unable to fully analyze)\",\n\t\t\t};\n\t\t}\n\n\t\tconst analysis = analyzeCommandSafety(command);\n\t\tif (analysis.safe) {\n\t\t\treturn { allowed: true };\n\t\t}\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: analysis.reason ?? \"Command failed tree-sitter safety analysis\",\n\t\t};\n\t},\n};\n\n/**\n * Critical System Paths - Directories that should never be modified\n *\n * These paths are protected with a HARD BLOCK (not just approval required).\n * Modifying files in these directories can:\n * - Break the operating system\n * - Compromise system security\n * - Affect other users on the system\n *\n * ## Linux Paths\n *\n * - /etc: System configuration\n * - /usr: System programs and libraries\n * - /var: Variable data (logs, databases)\n * - /boot: Bootloader and kernel\n * - /sys, /proc: Kernel virtual filesystems\n * - /dev: Device files\n * - /bin, /sbin: Essential system binaries\n * - /lib, /lib64: Shared libraries\n * - /opt: Optional/third-party software\n *\n * ## macOS Paths\n *\n * - /System: System files\n * - /Library: System libraries\n * - /private/etc, /private/var: Private system configuration/data\n * - /dev: Device files\n *\n * ## Windows Paths\n *\n * - C:\\Windows: Operating system\n * - C:\\Program Files: Installed applications\n *\n * Note: /var/folders (macOS temp) and /tmp are explicitly allowed\n * through the isContainedInWorkspace check before system path blocking.\n */\nfunction extractFilePaths(context: ActionApprovalContext): string[] {\n\tconst args = getArgsObject(context);\n\tif (!args) return [];\n\tconst paths: string[] = [];\n\tconst toolName = context.toolName.toLowerCase();\n\n\t// Simple extraction for standard file tools\n\t// Note: deeper extraction is done in policy.ts, this is for quick system protection\n\tif (toolName === \"write\" || toolName === \"edit\") {\n\t\tconst p =\n\t\t\tgetStringArg(context, \"file_path\") || getStringArg(context, \"path\");\n\t\tif (p) paths.push(p);\n\t}\n\tif (toolName === \"apply_patch\") {\n\t\tconst patch = getStringArg(context, \"patch\");\n\t\tif (patch) {\n\t\t\tpaths.push(...parseApplyPatchPaths(patch));\n\t\t}\n\t}\n\tif (toolName === \"delete_file\") {\n\t\tconst p =\n\t\t\tgetStringArg(context, \"file_path\") ||\n\t\t\tgetStringArg(context, \"target_file\");\n\t\tif (p) paths.push(p);\n\t}\n\t// Handle move_file and copy_file - extract both source and destination\n\tif (toolName === \"move_file\" || toolName === \"copy_file\") {\n\t\tconst source =\n\t\t\tgetStringArg(context, \"source\") ||\n\t\t\tgetStringArg(context, \"source_path\") ||\n\t\t\tgetStringArg(context, \"from\");\n\t\tconst dest =\n\t\t\tgetStringArg(context, \"destination\") ||\n\t\t\tgetStringArg(context, \"destination_path\") ||\n\t\t\tgetStringArg(context, \"dest\") ||\n\t\t\tgetStringArg(context, \"to\");\n\t\tif (source) paths.push(source);\n\t\tif (dest) paths.push(dest);\n\t}\n\treturn paths;\n}\n\n/**\n * Workspace Containment Check - Determines if a path is in a \"safe zone\"\n *\n * The firewall uses containment to prevent accidental writes outside the\n * project directory. This function checks if a file path is within one of\n * the allowed zones.\n *\n * ## Safe Zones (in order of check)\n *\n * 1. **Workspace root**: Current working directory and subdirectories\n * 2. **System temp directory**: /tmp, /var/folders, etc.\n * 3. **Trusted paths**: User-configured paths in firewall.json\n *\n * ## Path Resolution Complexity\n *\n * We must handle several path edge cases:\n *\n * - **Symlinks**: macOS /tmp → /private/tmp, so we resolve real paths\n * - **Non-existent files**: Can't realpath a file being created, use logical path\n * - **Relative paths**: Convert to absolute before comparison\n * - **Path traversal**: Detect ../ escapes using relative() output\n *\n * ## Detection Method\n *\n * For each safe zone, we compute relative(zone, targetPath). If the result:\n * - Starts with \"..\" → path escapes the zone (unsafe)\n * - Is an absolute path → completely outside (unsafe)\n * - Otherwise → contained within zone (safe)\n *\n * @param filePath - The path to check (may be relative or absolute)\n * @returns true if path is contained in a safe zone, false otherwise\n */\n\nexport const defaultFirewallRules: ActionFirewallRule[] = [\n\t{\n\t\tname: \"enterprise-policy\",\n\t\tdescription: \"Enforce enterprise policies on tools and dependencies\",\n\t\taction: \"block\", // HARD BLOCK for policy violations\n\t\tevaluate: async (ctx) => {\n\t\t\tconst cached = policyCheckCache.get(ctx);\n\t\t\tif (cached) {\n\t\t\t\treturn cached.allowed\n\t\t\t\t\t? { allowed: true }\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: cached.reason ?? \"Action blocked by enterprise policy\",\n\t\t\t\t\t\t};\n\t\t\t}\n\t\t\tconst result = await checkPolicy(ctx);\n\t\t\tpolicyCheckCache.set(ctx, result);\n\t\t\tif (result.allowed) return { allowed: true };\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: result.reason ?? \"Action blocked by enterprise policy\",\n\t\t\t};\n\t\t},\n\t},\n\t{\n\t\tname: \"system-path-protection\",\n\t\tdescription: \"Prevent modification of critical system directories\",\n\t\taction: \"block\", // HARD BLOCK for system paths\n\t\tevaluate: (ctx) => {\n\t\t\t// Only check file mutation tools\n\t\t\tif (\n\t\t\t\t![\n\t\t\t\t\t\"write\",\n\t\t\t\t\t\"edit\",\n\t\t\t\t\t\"apply_patch\",\n\t\t\t\t\t\"delete_file\",\n\t\t\t\t\t\"move_file\",\n\t\t\t\t\t\"copy_file\",\n\t\t\t\t].includes(ctx.toolName)\n\t\t\t) {\n\t\t\t\treturn { allowed: true };\n\t\t\t}\n\t\t\tconst paths = extractFilePaths(ctx);\n\t\t\t// We check system paths first, but if it's in workspace, temp, or a trusted path (safe), we should allow it.\n\t\t\t// System paths like /var include /var/folders (temp on mac), so we need to exclude safe temp paths from system path blocking.\n\n\t\t\t// Filter out paths that are inside the workspace, temp, or trusted paths (which are safe)\n\t\t\tconst unsafePaths = paths.filter((p) => !isContainedInWorkspace(p));\n\n\t\t\t// Only check remaining paths against system blocklist\n\t\t\tif (unsafePaths.some(isSystemPath)) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Modification of critical system directories is blocked for safety.\",\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { allowed: true };\n\t\t},\n\t\tremediation: () =>\n\t\t\t\"Do not modify critical system paths. If you need to write a file, use the current workspace directory or a temporary folder.\",\n\t},\n\t{\n\t\tid: DEFAULT_GUARDED_FILE_RULE_ID,\n\t\tdescription:\n\t\t\t\"Block guarded user and editor configuration files when policy requires a hard block\",\n\t\taction: \"block\",\n\t\tevaluate: (ctx) => {\n\t\t\tconst match = findGuardedToolCallMatch(ctx.toolName, ctx.args, {\n\t\t\t\tpolicy: ctx.metadata?.guardedFiles,\n\t\t\t});\n\t\t\tif (match?.defaultBehavior === \"block\") {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: describeDefaultGuardedFileMatch(match),\n\t\t\t\t\tremediation:\n\t\t\t\t\t\t\"Remove the matching custom guard or change its defaultBehavior to ask if this access should be approval-gated instead of blocked.\",\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { allowed: true };\n\t\t},\n\t},\n\t{\n\t\tid: DEFAULT_GUARDED_FILE_RULE_ID,\n\t\tdescription:\n\t\t\t\"Require explicit approval before reading or mutating guarded user and editor configuration files\",\n\t\taction: \"require_approval\",\n\t\tevaluate: (ctx) => {\n\t\t\tconst match = findGuardedToolCallMatch(ctx.toolName, ctx.args, {\n\t\t\t\tpolicy: ctx.metadata?.guardedFiles,\n\t\t\t});\n\t\t\tif (match) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: describeDefaultGuardedFileMatch(match),\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { allowed: true };\n\t\t},\n\t},\n\t{\n\t\tname: \"workspace-containment\",\n\t\tdescription:\n\t\t\t\"Require approval for file modifications outside the workspace\",\n\t\taction: \"require_approval\",\n\t\tevaluate: (ctx) => {\n\t\t\t// Only check file mutation tools\n\t\t\tif (\n\t\t\t\t![\n\t\t\t\t\t\"write\",\n\t\t\t\t\t\"edit\",\n\t\t\t\t\t\"apply_patch\",\n\t\t\t\t\t\"delete_file\",\n\t\t\t\t\t\"move_file\",\n\t\t\t\t\t\"copy_file\",\n\t\t\t\t].includes(ctx.toolName)\n\t\t\t) {\n\t\t\t\treturn { allowed: true };\n\t\t\t}\n\t\t\tconst paths = extractFilePaths(ctx);\n\t\t\t// Return true (match rule) if ANY path is NOT contained\n\t\t\tconst outsidePaths = paths.filter((p) => !isContainedInWorkspace(p));\n\t\t\tif (outsidePaths.length === 0) return { allowed: true };\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `File modification outside workspace detected: ${outsidePaths.join(\", \")}. This requires explicit approval.`,\n\t\t\t};\n\t\t},\n\t\tremediation: () =>\n\t\t\t\"The file path is outside the allowed workspace. Please use a path within the current project or a temporary directory, or ask the user to add this path to 'containment.trustedPaths' in ~/.maestro/firewall.json.\",\n\t},\n\t{\n\t\tid: \"untagged-human-egress\",\n\t\tdescription:\n\t\t\t\"Block human-facing tool calls without explicit TOOL_TAGS annotations when strict mode is enabled\",\n\t\taction: \"block\",\n\t\tmatch: (ctx) => {\n\t\t\tif (!isStrictUntaggedEgress()) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tif (!isHumanFacingTool(ctx.toolName)) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\treturn TOOL_TAGS[ctx.toolName] === undefined;\n\t\t},\n\t\treason: () =>\n\t\t\t\"Human-facing tool is missing TOOL_TAGS; annotate the tool or disable strict mode via MAESTRO_FAIL_UNTAGGED_EGRESS=0.\",\n\t\tremediation: () =>\n\t\t\t\"Add TOOL_TAGS entry marking egress intent (human/http) before invoking the tool.\",\n\t},\n\t{\n\t\tid: \"background-shell-block\",\n\t\tdescription: \"Block shell-based background tasks when disabled by policy\",\n\t\taction: \"block\",\n\t\tmatch: (ctx) =>\n\t\t\tisBackgroundShellBlocked() && isBackgroundTaskShellStart(ctx) === true,\n\t\treason: () =>\n\t\t\t\"Starting background_tasks with shell=true is disabled by policy. Set MAESTRO_BACKGROUND_SHELL_DISABLE=0 to allow.\",\n\t},\n\t{\n\t\tid: \"mcp-destructive-tool\",\n\t\tdescription: \"MCP tools marked as destructive require approval\",\n\t\taction: \"require_approval\",\n\t\tmatch: (ctx) => {\n\t\t\tif (!isMcpTool(ctx.toolName)) return false;\n\t\t\tconst annotations = getAnnotations(ctx);\n\t\t\t// Require approval if destructiveHint is true and readOnlyHint is not true\n\t\t\treturn (\n\t\t\t\tannotations?.destructiveHint === true && !annotations?.readOnlyHint\n\t\t\t);\n\t\t},\n\t\treason: (ctx) =>\n\t\t\t`MCP tool \"${ctx.toolName}\" is marked as destructive and requires approval`,\n\t},\n\t{\n\t\tid: \"plan-mode-confirm\",\n\t\tdescription:\n\t\t\t\"When plan mode is enabled, require approval before mutating commands\",\n\t\taction: \"require_approval\",\n\t\tmatch: (ctx) => {\n\t\t\tif (process.env.MAESTRO_PLAN_MODE !== \"1\") return false;\n\t\t\tconst name = ctx.toolName;\n\t\t\tif (\n\t\t\t\tname === \"write\" ||\n\t\t\t\tname === \"edit\" ||\n\t\t\t\tname === \"apply_patch\" ||\n\t\t\t\tname === \"bash\"\n\t\t\t) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\tif (name === \"todo\") return true;\n\t\t\tif (name === \"gh_pr\") {\n\t\t\t\tconst action = getStringArg(ctx, \"action\");\n\t\t\t\treturn !action || ![\"list\", \"view\", \"checks\", \"diff\"].includes(action);\n\t\t\t}\n\t\t\tif (name === \"gh_issue\") {\n\t\t\t\tconst action = getStringArg(ctx, \"action\");\n\t\t\t\treturn !action || ![\"list\", \"view\"].includes(action);\n\t\t\t}\n\t\t\tif (name === \"background_tasks\") {\n\t\t\t\tconst args = getArgsObject(ctx);\n\t\t\t\tconst action = args?.action;\n\t\t\t\tconst shell = args?.shell === true;\n\t\t\t\treturn action === \"start\" && shell;\n\t\t\t}\n\t\t\treturn false;\n\t\t},\n\t\treason: (ctx) =>\n\t\t\t`Plan mode requires confirmation before executing ${ctx.toolName}. Toggle with /plan-mode or MAESTRO_PLAN_MODE=0.`,\n\t},\n\t{\n\t\tid: \"no-egress-shell\",\n\t\tdescription:\n\t\t\t\"Require approval when shell egress is disabled via MAESTRO_NO_EGRESS_SHELL\",\n\t\taction: \"require_approval\",\n\t\tevaluate: (ctx) => {\n\t\t\tif (!isNoEgressShellEnabled() || isEgressOverrideAllowed()) {\n\t\t\t\treturn { allowed: true };\n\t\t\t}\n\t\t\tif (ctx.toolName !== \"bash\" && !isBackgroundTaskShellStart(ctx)) {\n\t\t\t\treturn { allowed: true };\n\t\t\t}\n\t\t\tconst raw = getCommandArg(ctx);\n\t\t\tif (!raw) return { allowed: true };\n\t\t\tconst unwrapped = unwrapShellCommand(raw) ?? raw;\n\t\t\tif (isCommandAllowlisted(unwrapped)) return { allowed: true };\n\t\t\tif (!hasEgressPrimitives(unwrapped)) return { allowed: true };\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Shell egress (curl/wget/ssh/nc/dev/tcp) requires approval because MAESTRO_NO_EGRESS_SHELL=1. Allow temporarily with MAESTRO_ALLOW_EGRESS_SHELL=1 or add a bash allowlist entry.\",\n\t\t\t};\n\t\t},\n\t},\n\t...dangerousCommandRules,\n\ttreeSitterCommandRule,\n\t{\n\t\tid: \"background-shell-mode\",\n\t\tdescription: \"Shell mode background tasks\",\n\t\taction: \"require_approval\",\n\t\tmatch: (ctx) => isBackgroundTaskShellStart(ctx),\n\t\treason: () =>\n\t\t\t\"Background task shell mode requires manual approval (pipes, redirects, and globbing are high risk)\",\n\t},\n\t{\n\t\tid: HUMAN_EGRESS_PII_RULE_ID,\n\t\tdescription: \"PII must be redacted before human-facing tools execute\",\n\t\taction: \"require_approval\",\n\t\tmatch: (ctx) => {\n\t\t\tif (!isHumanFacingTool(ctx.toolName)) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tconst pending = getPendingUnredactedPii(ctx);\n\t\t\treturn pending.length > 0;\n\t\t},\n\t\treason: (ctx) => {\n\t\t\tconst pending = getPendingUnredactedPii(ctx);\n\t\t\tconst offenders =\n\t\t\t\tpending\n\t\t\t\t\t.map(\n\t\t\t\t\t\t(artifact) =>\n\t\t\t\t\t\t\t`${artifact.label} (artifact: ${artifact.id}, source: ${artifact.sourceToolCallId})`,\n\t\t\t\t\t)\n\t\t\t\t\t.join(\"; \") || \"unredacted artifacts\";\n\t\t\treturn `Unredacted PII (${offenders}) detected before executing human-facing tool \"${ctx.toolName}\". Run your redaction tool on the listed artifacts, then retry.`;\n\t\t},\n\t},\n];\n\nexport class ActionFirewall {\n\tprivate semanticJudge?: SemanticJudge;\n\tprivate readonly governanceService:\n\t\t| ActionFirewallGovernanceServiceConfig\n\t\t| false\n\t\t| undefined;\n\n\tconstructor(\n\t\tprivate readonly rules: ActionFirewallRule[] = defaultFirewallRules,\n\t\toptions?: {\n\t\t\tgovernanceService?: ActionFirewallGovernanceServiceConfig | false;\n\t\t},\n\t) {\n\t\tthis.governanceService = options?.governanceService;\n\t}\n\n\tsetSemanticJudge(judge: SemanticJudge) {\n\t\tthis.semanticJudge = judge;\n\t}\n\n\tasync evaluate(\n\t\tcontext: ActionApprovalContext,\n\t): Promise<ActionFirewallVerdict> {\n\t\tconst governanceServiceVerdict =\n\t\t\tawait this.evaluateWithGovernanceService(context);\n\t\tif (governanceServiceVerdict?.action === \"block\") {\n\t\t\treturn governanceServiceVerdict;\n\t\t}\n\t\tif (governanceServiceVerdict?.action === \"require_approval\") {\n\t\t\treturn governanceServiceVerdict;\n\t\t}\n\n\t\tif (!governanceServiceVerdict) {\n\t\t\tfor (const rule of this.rules) {\n\t\t\t\tconst evaluation: RuleOutcome = rule.evaluate\n\t\t\t\t\t? await rule.evaluate(context)\n\t\t\t\t\t: (await rule.match?.(context))\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\t\t(await rule.reason?.(context)) ??\n\t\t\t\t\t\t\t\t\t`Action matched rule: ${rule.description}`,\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: { allowed: true };\n\n\t\t\t\tif (!evaluation.allowed) {\n\t\t\t\t\tconst action = rule.action ?? \"require_approval\";\n\t\t\t\t\tconst reason =\n\t\t\t\t\t\tevaluation.reason ??\n\t\t\t\t\t\t`Action matched rule: ${rule.description ?? rule.name}`;\n\t\t\t\t\tconst remediation =\n\t\t\t\t\t\tevaluation.remediation ?? (await rule.remediation?.(context));\n\t\t\t\t\tconst ruleId =\n\t\t\t\t\t\t(rule as { id?: string }).id ?? rule.name ?? \"unknown-rule\";\n\n\t\t\t\t\tif (action === \"allow\") {\n\t\t\t\t\t\treturn { action: \"allow\" };\n\t\t\t\t\t}\n\n\t\t\t\t\tif (action === \"block\") {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\taction,\n\t\t\t\t\t\t\truleId,\n\t\t\t\t\t\t\treason,\n\t\t\t\t\t\t\tremediation,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\taction,\n\t\t\t\t\t\truleId,\n\t\t\t\t\t\treason,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// 2. Run semantic judge if available (slow path)\n\t\tif (this.semanticJudge && context.userIntent) {\n\t\t\tconst SENSITIVE_TOOLS = [\n\t\t\t\t\"bash\",\n\t\t\t\t\"write\",\n\t\t\t\t\"edit\",\n\t\t\t\t\"apply_patch\",\n\t\t\t\t\"delete_file\",\n\t\t\t\t\"background_tasks\",\n\t\t\t];\n\t\t\tif (SENSITIVE_TOOLS.includes(context.toolName)) {\n\t\t\t\tconst judgment = await this.semanticJudge.evaluate({\n\t\t\t\t\tuserIntent: context.userIntent,\n\t\t\t\t\ttoolName: context.toolName,\n\t\t\t\t\ttoolArgs: context.args,\n\t\t\t\t});\n\n\t\t\t\tif (!judgment.safe) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\taction: \"require_approval\",\n\t\t\t\t\t\truleId: \"semantic-judge\",\n\t\t\t\t\t\treason: judgment.reason,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn { action: \"allow\" };\n\t}\n\n\tprivate async evaluateWithGovernanceService(\n\t\tcontext: ActionApprovalContext,\n\t): Promise<ActionFirewallVerdict | null> {\n\t\tconst config = resolveActionFirewallGovernanceServiceConfig(\n\t\t\tthis.governanceService,\n\t\t\tcontext,\n\t\t);\n\t\tif (!config) {\n\t\t\treturn null;\n\t\t}\n\n\t\ttry {\n\t\t\tconst verdict = await evaluateActionWithActionFirewallGovernanceService(\n\t\t\t\tconfig,\n\t\t\t\tcontext,\n\t\t\t);\n\t\t\treturn verdict;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tif (config.failureMode === \"required\") {\n\t\t\t\treturn {\n\t\t\t\t\taction: \"block\",\n\t\t\t\t\truleId: \"governance-service-unavailable\",\n\t\t\t\t\treason: `Governance service unavailable: ${message}`,\n\t\t\t\t};\n\t\t\t}\n\t\t\tlogger.warn(\n\t\t\t\t\"Failed to evaluate action with governance service; falling back to local firewall rules\",\n\t\t\t\t{\n\t\t\t\t\terror: message,\n\t\t\t\t\ttoolName: context.toolName,\n\t\t\t\t},\n\t\t\t);\n\t\t\treturn null;\n\t\t}\n\t}\n}\n\nexport const defaultActionFirewall = new ActionFirewall();\n"]}

package/dist/safety/attack-patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attack-patterns.d.ts","sourceRoot":"","sources":["../../src/safety/attack-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE;;GAEG;AACH,MAAM,MAAM,cAAc,GACvB,uBAAuB,GACvB,mBAAmB,GACnB,sBAAsB,GACtB,gBAAgB,GAChB,aAAa,GACb,iBAAiB,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,sBAAsB;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+BAA+B;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;CACf;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAwJzE,CAAC;AAwBF;;GAEG;AACH,eAAO,MAAM,8BAA8B,EAAE,eAAe,EAwL3D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAuGvD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,eAAe,EAkF1D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,eAAe,EA2DpD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,eAAe,EA8JjD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,eAAe,EAwBrD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,eAAe,EAOhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CACjC,SAAS,EAAE,MAAM,GACf,qBAAqB,GAAG,SAAS,CAEnC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACpC,QAAQ,EAAE,cAAc,GACtB,eAAe,EAAE,CAKnB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACpC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAC9C,eAAe,EAAE,CAEnB"}
+{"version":3,"file":"attack-patterns.d.ts","sourceRoot":"","sources":["../../src/safety/attack-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE;;GAEG;AACH,MAAM,MAAM,cAAc,GACvB,uBAAuB,GACvB,mBAAmB,GACnB,sBAAsB,GACtB,gBAAgB,GAChB,aAAa,GACb,iBAAiB,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,sBAAsB;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+BAA+B;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;CACf;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAwJzE,CAAC;AAmDF;;GAEG;AACH,eAAO,MAAM,8BAA8B,EAAE,eAAe,EAwL3D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAuGvD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,eAAe,EA+E1D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,eAAe,EA2DpD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,eAAe,EAgJjD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,eAAe,EAwBrD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,eAAe,EAOhD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CACjC,SAAS,EAAE,MAAM,GACf,qBAAqB,GAAG,SAAS,CAEnC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACpC,QAAQ,EAAE,cAAc,GACtB,eAAe,EAAE,CAKnB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACpC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAC9C,eAAe,EAAE,CAEnB"}

package/dist/safety/attack-patterns.js

@@ -9,6 +9,7 @@
  *
  * @module safety/attack-patterns
  */
+import { parseApplyPatchPaths } from "../tools/apply-patch-parser.js";
 /**
  * Registry mapping pattern IDs to their metadata
  */
@@ -158,7 +159,28 @@ function pathMatches(args, pattern) {
     const path = args.path ||
         args.file_path ||
         args.target;
-    return path ? pattern.test(path) : false;
+    if (path && pattern.test(path)) {
+        return true;
+    }
+    const patch = args.patch;
+    if (typeof patch === "string") {
+        return parseApplyPatchPaths(patch).some((patchPath) => pattern.test(patchPath));
+    }
+    return false;
+}
+function toolMutatesFiles(currentTool) {
+    const normalizedTool = currentTool.toLowerCase();
+    return (normalizedTool === "write" ||
+        normalizedTool === "edit" ||
+        normalizedTool === "apply_patch");
+}
+function mutationContent(args) {
+    const content = args.content;
+    if (typeof content === "string") {
+        return content;
+    }
+    const patch = args.patch;
+    return typeof patch === "string" ? patch : "";
 }
 /**
  * Credential Harvesting Patterns
@@ -454,8 +476,7 @@ export const PRIVILEGE_ESCALATION_PATTERNS = [
         windowMs: 60_000,
         detect: (_records, currentTool, currentArgs) => {
             const cronPattern = /\/etc\/cron|crontab|\/var\/spool\/cron/i;
-            if (currentTool.toLowerCase() === "write" ||
-                currentTool.toLowerCase() === "edit") {
+            if (toolMutatesFiles(currentTool)) {
                 if (pathMatches(currentArgs, cronPattern)) {
                     return {
                         matched: true,
@@ -567,8 +588,7 @@ export const PERSISTENCE_PATTERNS = [
         windowMs: 60_000,
         detect: (_records, currentTool, currentArgs) => {
             const sshPattern = /\.ssh\/authorized_keys|\.ssh\/id_/i;
-            if (currentTool.toLowerCase() === "write" ||
-                currentTool.toLowerCase() === "edit") {
+            if (toolMutatesFiles(currentTool)) {
                 if (pathMatches(currentArgs, sshPattern)) {
                     return {
                         matched: true,
@@ -587,8 +607,7 @@ export const PERSISTENCE_PATTERNS = [
         windowMs: 60_000,
         detect: (_records, currentTool, currentArgs) => {
             const profilePattern = /\.bashrc|\.bash_profile|\.zshrc|\.profile|\.bash_login/i;
-            if (currentTool.toLowerCase() === "write" ||
-                currentTool.toLowerCase() === "edit") {
+            if (toolMutatesFiles(currentTool)) {
                 if (pathMatches(currentArgs, profilePattern)) {
                     return {
                         matched: true,
@@ -607,8 +626,7 @@ export const PERSISTENCE_PATTERNS = [
         windowMs: 60_000,
         detect: (_records, currentTool, currentArgs) => {
             const systemdPattern = /\/etc\/systemd|\.config\/systemd|\.service$/i;
-            if (currentTool.toLowerCase() === "write" ||
-                currentTool.toLowerCase() === "edit") {
+            if (toolMutatesFiles(currentTool)) {
                 if (pathMatches(currentArgs, systemdPattern)) {
                     return {
                         matched: true,
@@ -629,6 +647,7 @@ export const PERSISTENCE_PATTERNS = [
             // Check for LD_PRELOAD being written to profile files
             if (currentTool.toLowerCase() === "write" ||
                 currentTool.toLowerCase() === "edit" ||
+                currentTool.toLowerCase() === "apply_patch" ||
                 currentTool.toLowerCase() === "bash") {
                 // Check for LD_PRELOAD in command or file content
                 const ldPreloadPattern = /LD_PRELOAD/i;
@@ -643,7 +662,7 @@ export const PERSISTENCE_PATTERNS = [
                 }
                 else if (pathMatches(currentArgs, profilePattern)) {
                     // If writing to profile files, check for LD_PRELOAD in content
-                    const content = currentArgs.content;
+                    const content = mutationContent(currentArgs);
                     if (content && ldPreloadPattern.test(content)) {
                         return {
                             matched: true,
@@ -663,8 +682,7 @@ export const PERSISTENCE_PATTERNS = [
         windowMs: 60_000,
         detect: (_records, currentTool, currentArgs) => {
             const gitHooksPattern = /\.git\/hooks\//i;
-            if (currentTool.toLowerCase() === "write" ||
-                currentTool.toLowerCase() === "edit") {
+            if (toolMutatesFiles(currentTool)) {
                 if (pathMatches(currentArgs, gitHooksPattern)) {
                     return {
                         matched: true,
@@ -683,8 +701,7 @@ export const PERSISTENCE_PATTERNS = [
         windowMs: 60_000,
         detect: (_records, currentTool, currentArgs) => {
             const pamPattern = /\/etc\/pam\.d\/|\/etc\/pam\.conf|pam_.*\.so/i;
-            if (currentTool.toLowerCase() === "write" ||
-                currentTool.toLowerCase() === "edit") {
+            if (toolMutatesFiles(currentTool)) {
                 if (pathMatches(currentArgs, pamPattern)) {
                     return {
                         matched: true,