@evalops/maestro 0.10.17 → 0.10.20

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (930) hide show
  1. package/README.md +56 -1
  2. package/dist/agent/action-approval.d.ts +12 -2
  3. package/dist/agent/action-approval.d.ts.map +1 -1
  4. package/dist/agent/action-approval.js +19 -32
  5. package/dist/agent/action-approval.js.map +1 -1
  6. package/dist/agent/agent.d.ts +1 -0
  7. package/dist/agent/agent.d.ts.map +1 -1
  8. package/dist/agent/agent.js +26 -0
  9. package/dist/agent/agent.js.map +1 -1
  10. package/dist/agent/compaction.d.ts +2 -0
  11. package/dist/agent/compaction.d.ts.map +1 -1
  12. package/dist/agent/compaction.js +4 -2
  13. package/dist/agent/compaction.js.map +1 -1
  14. package/dist/agent/index.d.ts +1 -1
  15. package/dist/agent/index.d.ts.map +1 -1
  16. package/dist/agent/index.js +1 -1
  17. package/dist/agent/index.js.map +1 -1
  18. package/dist/agent/modes.d.ts +56 -4
  19. package/dist/agent/modes.d.ts.map +1 -1
  20. package/dist/agent/modes.js +163 -2
  21. package/dist/agent/modes.js.map +1 -1
  22. package/dist/agent/prompt-recovery.d.ts.map +1 -1
  23. package/dist/agent/prompt-recovery.js +1 -3
  24. package/dist/agent/prompt-recovery.js.map +1 -1
  25. package/dist/agent/providers/anthropic.d.ts.map +1 -1
  26. package/dist/agent/providers/anthropic.js +9 -1
  27. package/dist/agent/providers/anthropic.js.map +1 -1
  28. package/dist/agent/providers/codex-app-server.d.ts +12 -0
  29. package/dist/agent/providers/codex-app-server.d.ts.map +1 -0
  30. package/dist/agent/providers/codex-app-server.js +788 -0
  31. package/dist/agent/providers/codex-app-server.js.map +1 -0
  32. package/dist/agent/providers/google-gemini-cli.js +14 -3
  33. package/dist/agent/providers/google.js +22 -3
  34. package/dist/agent/providers/scripted.d.ts +11 -0
  35. package/dist/agent/providers/scripted.d.ts.map +1 -0
  36. package/dist/agent/providers/scripted.js +399 -0
  37. package/dist/agent/providers/scripted.js.map +1 -0
  38. package/dist/agent/providers/vertex.js +14 -3
  39. package/dist/agent/scenario-source.d.ts +19 -0
  40. package/dist/agent/scenario-source.d.ts.map +1 -0
  41. package/dist/agent/scenario-source.js +112 -0
  42. package/dist/agent/scenario-source.js.map +1 -0
  43. package/dist/agent/subagent-specs.d.ts +1 -1
  44. package/dist/agent/subagent-specs.js +1 -1
  45. package/dist/agent/subagent-specs.js.map +1 -1
  46. package/dist/agent/swarm/executor.d.ts +25 -0
  47. package/dist/agent/swarm/executor.d.ts.map +1 -1
  48. package/dist/agent/swarm/executor.js +795 -20
  49. package/dist/agent/swarm/executor.js.map +1 -1
  50. package/dist/agent/swarm/runtime-events.d.ts +11 -0
  51. package/dist/agent/swarm/runtime-events.d.ts.map +1 -0
  52. package/dist/agent/swarm/runtime-events.js +26 -0
  53. package/dist/agent/swarm/runtime-events.js.map +1 -0
  54. package/dist/agent/swarm/types.d.ts +78 -0
  55. package/dist/agent/swarm/types.d.ts.map +1 -1
  56. package/dist/agent/swarm/types.js.map +1 -1
  57. package/dist/agent/tracing.d.ts +1 -1
  58. package/dist/agent/tracing.d.ts.map +1 -1
  59. package/dist/agent/tracing.js +17 -9
  60. package/dist/agent/tracing.js.map +1 -1
  61. package/dist/agent/transport/create-provider-stream.d.ts.map +1 -1
  62. package/dist/agent/transport/create-provider-stream.js +14 -0
  63. package/dist/agent/transport/create-provider-stream.js.map +1 -1
  64. package/dist/agent/transport/stable-stringify.d.ts +2 -0
  65. package/dist/agent/transport/stable-stringify.d.ts.map +1 -0
  66. package/dist/agent/transport/stable-stringify.js +14 -0
  67. package/dist/agent/transport/stable-stringify.js.map +1 -0
  68. package/dist/agent/transport/tool-execution-bridge.d.ts.map +1 -1
  69. package/dist/agent/transport/tool-execution-bridge.js +2 -15
  70. package/dist/agent/transport/tool-execution-bridge.js.map +1 -1
  71. package/dist/agent/transport/tool-safety-pipeline.d.ts +5 -1
  72. package/dist/agent/transport/tool-safety-pipeline.d.ts.map +1 -1
  73. package/dist/agent/transport/tool-safety-pipeline.js +184 -36
  74. package/dist/agent/transport/tool-safety-pipeline.js.map +1 -1
  75. package/dist/agent/transport.d.ts +8 -0
  76. package/dist/agent/transport.d.ts.map +1 -1
  77. package/dist/agent/transport.js +1613 -68
  78. package/dist/agent/transport.js.map +1 -1
  79. package/dist/agent/types.d.ts +170 -2
  80. package/dist/agent/types.d.ts.map +1 -1
  81. package/dist/agent/types.js.map +1 -1
  82. package/dist/api/enterprise-routes.d.ts.map +1 -1
  83. package/dist/api/enterprise-routes.js +34 -3
  84. package/dist/api/enterprise-routes.js.map +1 -1
  85. package/dist/app-server/in-process-client.d.ts +32 -0
  86. package/dist/app-server/in-process-client.d.ts.map +1 -0
  87. package/dist/app-server/in-process-client.js +73 -0
  88. package/dist/app-server/in-process-client.js.map +1 -0
  89. package/dist/app-server/session-api.d.ts +36 -0
  90. package/dist/app-server/session-api.d.ts.map +1 -0
  91. package/dist/app-server/session-api.js +713 -0
  92. package/dist/app-server/session-api.js.map +1 -0
  93. package/dist/approvals/platform-action-approval.d.ts +3 -1
  94. package/dist/approvals/platform-action-approval.d.ts.map +1 -1
  95. package/dist/approvals/platform-action-approval.js +16 -9
  96. package/dist/approvals/platform-action-approval.js.map +1 -1
  97. package/dist/approvals/service-client.d.ts.map +1 -1
  98. package/dist/approvals/service-client.js +7 -7
  99. package/dist/approvals/service-client.js.map +1 -1
  100. package/dist/audit/logger.d.ts +4 -4
  101. package/dist/bootstrap/agent-creation-setup.d.ts +4 -0
  102. package/dist/bootstrap/agent-creation-setup.d.ts.map +1 -1
  103. package/dist/bootstrap/agent-creation-setup.js +3 -1
  104. package/dist/bootstrap/agent-creation-setup.js.map +1 -1
  105. package/dist/bootstrap/auth-setup.js +1 -1
  106. package/dist/bootstrap/auth-setup.js.map +1 -1
  107. package/dist/bootstrap/event-subscriptions-setup.d.ts +6 -0
  108. package/dist/bootstrap/event-subscriptions-setup.d.ts.map +1 -1
  109. package/dist/bootstrap/event-subscriptions-setup.js +26 -2
  110. package/dist/bootstrap/event-subscriptions-setup.js.map +1 -1
  111. package/dist/bootstrap/model-resolution-setup.d.ts.map +1 -1
  112. package/dist/bootstrap/model-resolution-setup.js +4 -1
  113. package/dist/bootstrap/model-resolution-setup.js.map +1 -1
  114. package/dist/bootstrap/tools-setup.d.ts +2 -1
  115. package/dist/bootstrap/tools-setup.d.ts.map +1 -1
  116. package/dist/bootstrap/tools-setup.js +5 -1
  117. package/dist/bootstrap/tools-setup.js.map +1 -1
  118. package/dist/cli/args.d.ts +9 -1
  119. package/dist/cli/args.d.ts.map +1 -1
  120. package/dist/cli/args.js +130 -5
  121. package/dist/cli/args.js.map +1 -1
  122. package/dist/cli/commands/a2a.d.ts +9 -0
  123. package/dist/cli/commands/a2a.d.ts.map +1 -0
  124. package/dist/cli/commands/a2a.js +1714 -0
  125. package/dist/cli/commands/a2a.js.map +1 -0
  126. package/dist/cli/commands/agents.d.ts +16 -2
  127. package/dist/cli/commands/agents.d.ts.map +1 -1
  128. package/dist/cli/commands/agents.js +223 -35
  129. package/dist/cli/commands/agents.js.map +1 -1
  130. package/dist/cli/commands/codex.d.ts +1 -1
  131. package/dist/cli/commands/codex.d.ts.map +1 -1
  132. package/dist/cli/commands/codex.js +145 -39
  133. package/dist/cli/commands/codex.js.map +1 -1
  134. package/dist/cli/commands/context.d.ts +10 -0
  135. package/dist/cli/commands/context.d.ts.map +1 -0
  136. package/dist/cli/commands/context.js +176 -0
  137. package/dist/cli/commands/context.js.map +1 -0
  138. package/dist/cli/commands/hosted-runner.d.ts +1 -0
  139. package/dist/cli/commands/hosted-runner.d.ts.map +1 -1
  140. package/dist/cli/commands/hosted-runner.js +9 -1
  141. package/dist/cli/commands/hosted-runner.js.map +1 -1
  142. package/dist/cli/commands/init.d.ts.map +1 -1
  143. package/dist/cli/commands/init.js +6 -0
  144. package/dist/cli/commands/init.js.map +1 -1
  145. package/dist/cli/commands/modes.d.ts +8 -0
  146. package/dist/cli/commands/modes.d.ts.map +1 -0
  147. package/dist/cli/commands/modes.js +151 -0
  148. package/dist/cli/commands/modes.js.map +1 -0
  149. package/dist/cli/commands/operating-plane.d.ts +14 -0
  150. package/dist/cli/commands/operating-plane.d.ts.map +1 -0
  151. package/dist/cli/commands/operating-plane.js +160 -0
  152. package/dist/cli/commands/operating-plane.js.map +1 -0
  153. package/dist/cli/commands/run.d.ts +87 -0
  154. package/dist/cli/commands/run.d.ts.map +1 -0
  155. package/dist/cli/commands/run.js +356 -0
  156. package/dist/cli/commands/run.js.map +1 -0
  157. package/dist/cli/commands/scenario.d.ts +7 -0
  158. package/dist/cli/commands/scenario.d.ts.map +1 -0
  159. package/dist/cli/commands/scenario.js +195 -0
  160. package/dist/cli/commands/scenario.js.map +1 -0
  161. package/dist/cli/commands/skill.d.ts +7 -0
  162. package/dist/cli/commands/skill.d.ts.map +1 -0
  163. package/dist/cli/commands/skill.js +286 -0
  164. package/dist/cli/commands/skill.js.map +1 -0
  165. package/dist/cli/headless-protocol.d.ts +55 -1
  166. package/dist/cli/headless-protocol.d.ts.map +1 -1
  167. package/dist/cli/headless-protocol.js +446 -7
  168. package/dist/cli/headless-protocol.js.map +1 -1
  169. package/dist/cli/headless-runtime-selection.d.ts +38 -0
  170. package/dist/cli/headless-runtime-selection.d.ts.map +1 -0
  171. package/dist/cli/headless-runtime-selection.js +48 -0
  172. package/dist/cli/headless-runtime-selection.js.map +1 -0
  173. package/dist/cli/headless.d.ts +5 -1
  174. package/dist/cli/headless.d.ts.map +1 -1
  175. package/dist/cli/headless.js +11 -1
  176. package/dist/cli/headless.js.map +1 -1
  177. package/dist/cli/help.d.ts +3 -1
  178. package/dist/cli/help.d.ts.map +1 -1
  179. package/dist/cli/help.js +136 -30
  180. package/dist/cli/help.js.map +1 -1
  181. package/dist/cli/system-prompt.d.ts +22 -4
  182. package/dist/cli/system-prompt.d.ts.map +1 -1
  183. package/dist/cli/system-prompt.js +224 -127
  184. package/dist/cli/system-prompt.js.map +1 -1
  185. package/dist/cli-tui/commands/a2a-handlers.d.ts +7 -0
  186. package/dist/cli-tui/commands/a2a-handlers.d.ts.map +1 -0
  187. package/dist/cli-tui/commands/a2a-handlers.js +160 -0
  188. package/dist/cli-tui/commands/a2a-handlers.js.map +1 -0
  189. package/dist/cli-tui/commands/command-catalog.d.ts.map +1 -1
  190. package/dist/cli-tui/commands/command-catalog.js +15 -0
  191. package/dist/cli-tui/commands/command-catalog.js.map +1 -1
  192. package/dist/cli-tui/commands/command-registry-adapter.js +10 -1
  193. package/dist/cli-tui/commands/command-registry-adapter.js.map +1 -1
  194. package/dist/cli-tui/commands/handlers/mode-handler.d.ts.map +1 -1
  195. package/dist/cli-tui/commands/handlers/mode-handler.js +22 -10
  196. package/dist/cli-tui/commands/handlers/mode-handler.js.map +1 -1
  197. package/dist/cli-tui/commands/mcp-handlers.d.ts.map +1 -1
  198. package/dist/cli-tui/commands/mcp-handlers.js +6 -5
  199. package/dist/cli-tui/commands/mcp-handlers.js.map +1 -1
  200. package/dist/cli-tui/commands/types.d.ts +1 -0
  201. package/dist/cli-tui/commands/types.d.ts.map +1 -1
  202. package/dist/cli-tui/commands/types.js.map +1 -1
  203. package/dist/cli-tui/commands/utility-handlers.d.ts +4 -0
  204. package/dist/cli-tui/commands/utility-handlers.d.ts.map +1 -1
  205. package/dist/cli-tui/commands/utility-handlers.js +45 -6
  206. package/dist/cli-tui/commands/utility-handlers.js.map +1 -1
  207. package/dist/cli-tui/run/run-shell-command.d.ts.map +1 -1
  208. package/dist/cli-tui/run/run-shell-command.js +14 -5
  209. package/dist/cli-tui/run/run-shell-command.js.map +1 -1
  210. package/dist/cli-tui/run/streaming-shell-command.d.ts.map +1 -1
  211. package/dist/cli-tui/run/streaming-shell-command.js +14 -5
  212. package/dist/cli-tui/run/streaming-shell-command.js.map +1 -1
  213. package/dist/cli-tui/selectors/model-selector.d.ts +1 -0
  214. package/dist/cli-tui/selectors/model-selector.d.ts.map +1 -1
  215. package/dist/cli-tui/selectors/model-selector.js +6 -2
  216. package/dist/cli-tui/selectors/model-selector.js.map +1 -1
  217. package/dist/cli-tui/tui-renderer/command-registry-options.d.ts.map +1 -1
  218. package/dist/cli-tui/tui-renderer/command-registry-options.js +5 -0
  219. package/dist/cli-tui/tui-renderer/command-registry-options.js.map +1 -1
  220. package/dist/cli-tui/utils/commands/review-prompt.d.ts +1 -1
  221. package/dist/cli-tui/utils/commands/review-prompt.d.ts.map +1 -1
  222. package/dist/cli-tui/utils/commands/review-prompt.js +8 -3
  223. package/dist/cli-tui/utils/commands/review-prompt.js.map +1 -1
  224. package/dist/cli-tui/utils/runtime-badges.d.ts +1 -0
  225. package/dist/cli-tui/utils/runtime-badges.d.ts.map +1 -1
  226. package/dist/cli-tui/utils/runtime-badges.js +7 -0
  227. package/dist/cli-tui/utils/runtime-badges.js.map +1 -1
  228. package/dist/cli-tui/utils/text-formatting.d.ts +1 -0
  229. package/dist/cli-tui/utils/text-formatting.d.ts.map +1 -1
  230. package/dist/cli-tui/utils/text-formatting.js +5 -0
  231. package/dist/cli-tui/utils/text-formatting.js.map +1 -1
  232. package/dist/cli.js +49209 -26165
  233. package/dist/cli.js.map +1 -1
  234. package/dist/codex/app-server-client.d.ts +139 -0
  235. package/dist/codex/app-server-client.d.ts.map +1 -0
  236. package/dist/codex/app-server-client.js +352 -0
  237. package/dist/codex/app-server-client.js.map +1 -0
  238. package/dist/codex/compatibility.d.ts +48 -0
  239. package/dist/codex/compatibility.d.ts.map +1 -0
  240. package/dist/codex/compatibility.js +344 -0
  241. package/dist/codex/compatibility.js.map +1 -0
  242. package/dist/codex/subagent-dispatch-table.d.ts +66 -0
  243. package/dist/codex/subagent-dispatch-table.d.ts.map +1 -0
  244. package/dist/codex/subagent-dispatch-table.js +127 -0
  245. package/dist/codex/subagent-dispatch-table.js.map +1 -0
  246. package/dist/codex/subagent-workgraph.d.ts +56 -0
  247. package/dist/codex/subagent-workgraph.d.ts.map +1 -0
  248. package/dist/codex/subagent-workgraph.js +89 -0
  249. package/dist/codex/subagent-workgraph.js.map +1 -0
  250. package/dist/config/constants.d.ts +3 -1
  251. package/dist/config/constants.d.ts.map +1 -1
  252. package/dist/config/constants.js +9 -0
  253. package/dist/config/constants.js.map +1 -1
  254. package/dist/config/feature-flags.d.ts +10 -1
  255. package/dist/config/feature-flags.d.ts.map +1 -1
  256. package/dist/config/feature-flags.js +17 -6
  257. package/dist/config/feature-flags.js.map +1 -1
  258. package/dist/config/index.d.ts +1 -1
  259. package/dist/config/index.d.ts.map +1 -1
  260. package/dist/config/index.js +1 -1
  261. package/dist/config/index.js.map +1 -1
  262. package/dist/config/toml-config.d.ts +32 -0
  263. package/dist/config/toml-config.d.ts.map +1 -1
  264. package/dist/config/toml-config.js +152 -43
  265. package/dist/config/toml-config.js.map +1 -1
  266. package/dist/connectors/service-client.d.ts.map +1 -1
  267. package/dist/connectors/service-client.js +4 -7
  268. package/dist/connectors/service-client.js.map +1 -1
  269. package/dist/context/manifest-types.d.ts +59 -0
  270. package/dist/context/manifest-types.d.ts.map +1 -0
  271. package/dist/context/manifest-types.js +2 -0
  272. package/dist/context/manifest-types.js.map +1 -0
  273. package/dist/context/manifest.d.ts +16 -0
  274. package/dist/context/manifest.d.ts.map +1 -0
  275. package/dist/context/manifest.js +503 -0
  276. package/dist/context/manifest.js.map +1 -0
  277. package/dist/db/schema.d.ts +10 -1
  278. package/dist/db/schema.d.ts.map +1 -1
  279. package/dist/db/schema.js.map +1 -1
  280. package/dist/evalops/agent-bootstrap.d.ts +1 -0
  281. package/dist/evalops/agent-bootstrap.d.ts.map +1 -1
  282. package/dist/evalops/agent-bootstrap.js +41 -1
  283. package/dist/evalops/agent-bootstrap.js.map +1 -1
  284. package/dist/evalops/env-aliases.d.ts +13 -0
  285. package/dist/evalops/env-aliases.d.ts.map +1 -0
  286. package/dist/evalops/env-aliases.js +60 -0
  287. package/dist/evalops/env-aliases.js.map +1 -0
  288. package/dist/evalops/managed-context.d.ts.map +1 -1
  289. package/dist/evalops/managed-context.js +28 -62
  290. package/dist/evalops/managed-context.js.map +1 -1
  291. package/dist/guardian/config.d.ts.map +1 -1
  292. package/dist/guardian/config.js +1 -0
  293. package/dist/guardian/config.js.map +1 -1
  294. package/dist/guardian/runner.d.ts +2 -0
  295. package/dist/guardian/runner.d.ts.map +1 -1
  296. package/dist/guardian/runner.js +105 -2
  297. package/dist/guardian/runner.js.map +1 -1
  298. package/dist/guardian/types.d.ts +1 -0
  299. package/dist/guardian/types.d.ts.map +1 -1
  300. package/dist/guardian/types.js.map +1 -1
  301. package/dist/index.d.ts +6 -1
  302. package/dist/index.d.ts.map +1 -1
  303. package/dist/index.js +6 -1
  304. package/dist/index.js.map +1 -1
  305. package/dist/main.d.ts.map +1 -1
  306. package/dist/main.js +267 -55
  307. package/dist/main.js.map +1 -1
  308. package/dist/mcp/config.d.ts.map +1 -1
  309. package/dist/mcp/config.js +89 -7
  310. package/dist/mcp/config.js.map +1 -1
  311. package/dist/mcp/manager.d.ts +5 -1
  312. package/dist/mcp/manager.d.ts.map +1 -1
  313. package/dist/mcp/manager.js +159 -4
  314. package/dist/mcp/manager.js.map +1 -1
  315. package/dist/mcp/platform-plugin.d.ts.map +1 -1
  316. package/dist/mcp/platform-plugin.js +9 -26
  317. package/dist/mcp/platform-plugin.js.map +1 -1
  318. package/dist/mcp/schema.d.ts +15 -0
  319. package/dist/mcp/schema.d.ts.map +1 -1
  320. package/dist/mcp/schema.js +24 -0
  321. package/dist/mcp/schema.js.map +1 -1
  322. package/dist/mcp/tool-bridge.d.ts +39 -10
  323. package/dist/mcp/tool-bridge.d.ts.map +1 -1
  324. package/dist/mcp/tool-bridge.js +101 -24
  325. package/dist/mcp/tool-bridge.js.map +1 -1
  326. package/dist/mcp/types.d.ts +27 -0
  327. package/dist/mcp/types.d.ts.map +1 -1
  328. package/dist/mcp/types.js.map +1 -1
  329. package/dist/mcp/workspace-trust.d.ts +10 -0
  330. package/dist/mcp/workspace-trust.d.ts.map +1 -0
  331. package/dist/mcp/workspace-trust.js +295 -0
  332. package/dist/mcp/workspace-trust.js.map +1 -0
  333. package/dist/memory/service-client.d.ts +1 -0
  334. package/dist/memory/service-client.d.ts.map +1 -1
  335. package/dist/memory/service-client.js +194 -9
  336. package/dist/memory/service-client.js.map +1 -1
  337. package/dist/models/builtin.d.ts.map +1 -1
  338. package/dist/models/builtin.js +66 -25
  339. package/dist/models/builtin.js.map +1 -1
  340. package/dist/models/config-loader.d.ts +10 -10
  341. package/dist/models/config-loader.d.ts.map +1 -1
  342. package/dist/models/config-loader.js +2 -0
  343. package/dist/models/config-loader.js.map +1 -1
  344. package/dist/models/registry.d.ts +1 -0
  345. package/dist/models/registry.d.ts.map +1 -1
  346. package/dist/models/registry.js +1 -0
  347. package/dist/models/registry.js.map +1 -1
  348. package/dist/oauth/device-identity.d.ts.map +1 -1
  349. package/dist/oauth/device-identity.js +1 -3
  350. package/dist/oauth/device-identity.js.map +1 -1
  351. package/dist/oauth/evalops.d.ts.map +1 -1
  352. package/dist/oauth/evalops.js +2 -5
  353. package/dist/oauth/evalops.js.map +1 -1
  354. package/dist/opentelemetry.d.ts.map +1 -1
  355. package/dist/opentelemetry.js +12 -12
  356. package/dist/opentelemetry.js.map +1 -1
  357. package/dist/package-version.d.ts +2 -0
  358. package/dist/package-version.d.ts.map +1 -0
  359. package/dist/package-version.js +11 -0
  360. package/dist/package-version.js.map +1 -0
  361. package/dist/packages/constants.d.ts +3 -0
  362. package/dist/packages/constants.d.ts.map +1 -0
  363. package/dist/packages/constants.js +3 -0
  364. package/dist/packages/constants.js.map +1 -0
  365. package/dist/packages/inspection.d.ts.map +1 -1
  366. package/dist/packages/inspection.js +2 -1
  367. package/dist/packages/inspection.js.map +1 -1
  368. package/dist/packages/search.d.ts.map +1 -1
  369. package/dist/packages/search.js +1 -1
  370. package/dist/packages/search.js.map +1 -1
  371. package/dist/platform/a2a-capability-market.d.ts +21 -0
  372. package/dist/platform/a2a-capability-market.d.ts.map +1 -0
  373. package/dist/platform/a2a-capability-market.js +176 -0
  374. package/dist/platform/a2a-capability-market.js.map +1 -0
  375. package/dist/platform/a2a-client.d.ts +217 -0
  376. package/dist/platform/a2a-client.d.ts.map +1 -0
  377. package/dist/platform/a2a-client.js +589 -0
  378. package/dist/platform/a2a-client.js.map +1 -0
  379. package/dist/platform/a2a-fleet.d.ts +41 -0
  380. package/dist/platform/a2a-fleet.d.ts.map +1 -0
  381. package/dist/platform/a2a-fleet.js +109 -0
  382. package/dist/platform/a2a-fleet.js.map +1 -0
  383. package/dist/platform/a2a-maestro-peer.d.ts +20 -0
  384. package/dist/platform/a2a-maestro-peer.d.ts.map +1 -0
  385. package/dist/platform/a2a-maestro-peer.js +176 -0
  386. package/dist/platform/a2a-maestro-peer.js.map +1 -0
  387. package/dist/platform/a2a-peer-pairing.d.ts +107 -0
  388. package/dist/platform/a2a-peer-pairing.d.ts.map +1 -0
  389. package/dist/platform/a2a-peer-pairing.js +489 -0
  390. package/dist/platform/a2a-peer-pairing.js.map +1 -0
  391. package/dist/platform/a2a-peer-registry.d.ts +68 -0
  392. package/dist/platform/a2a-peer-registry.d.ts.map +1 -0
  393. package/dist/platform/a2a-peer-registry.js +320 -0
  394. package/dist/platform/a2a-peer-registry.js.map +1 -0
  395. package/dist/platform/a2a-task-ledger.d.ts +86 -0
  396. package/dist/platform/a2a-task-ledger.d.ts.map +1 -0
  397. package/dist/platform/a2a-task-ledger.js +546 -0
  398. package/dist/platform/a2a-task-ledger.js.map +1 -0
  399. package/dist/platform/a2a-work-graph.d.ts +43 -0
  400. package/dist/platform/a2a-work-graph.d.ts.map +1 -0
  401. package/dist/platform/a2a-work-graph.js +267 -0
  402. package/dist/platform/a2a-work-graph.js.map +1 -0
  403. package/dist/platform/agent-registry-client.d.ts +327 -0
  404. package/dist/platform/agent-registry-client.d.ts.map +1 -0
  405. package/dist/platform/agent-registry-client.js +803 -0
  406. package/dist/platform/agent-registry-client.js.map +1 -0
  407. package/dist/platform/agent-runtime-client.d.ts +135 -1
  408. package/dist/platform/agent-runtime-client.d.ts.map +1 -1
  409. package/dist/platform/agent-runtime-client.js +467 -10
  410. package/dist/platform/agent-runtime-client.js.map +1 -1
  411. package/dist/platform/cerebro-facts-client.d.ts.map +1 -1
  412. package/dist/platform/cerebro-facts-client.js +4 -7
  413. package/dist/platform/cerebro-facts-client.js.map +1 -1
  414. package/dist/platform/client.d.ts +2 -0
  415. package/dist/platform/client.d.ts.map +1 -1
  416. package/dist/platform/client.js +7 -14
  417. package/dist/platform/client.js.map +1 -1
  418. package/dist/platform/core-services.d.ts +68 -0
  419. package/dist/platform/core-services.d.ts.map +1 -1
  420. package/dist/platform/core-services.js +68 -0
  421. package/dist/platform/core-services.js.map +1 -1
  422. package/dist/platform/fermata-eval-client.d.ts +195 -0
  423. package/dist/platform/fermata-eval-client.d.ts.map +1 -0
  424. package/dist/platform/fermata-eval-client.js +146 -0
  425. package/dist/platform/fermata-eval-client.js.map +1 -0
  426. package/dist/platform/fermata-scenario-suite.d.ts +99 -0
  427. package/dist/platform/fermata-scenario-suite.d.ts.map +1 -0
  428. package/dist/platform/fermata-scenario-suite.js +459 -0
  429. package/dist/platform/fermata-scenario-suite.js.map +1 -0
  430. package/dist/platform/maestro-timeline-client.d.ts.map +1 -1
  431. package/dist/platform/maestro-timeline-client.js +5 -11
  432. package/dist/platform/maestro-timeline-client.js.map +1 -1
  433. package/dist/platform/operating-plane-client.d.ts +156 -0
  434. package/dist/platform/operating-plane-client.d.ts.map +1 -0
  435. package/dist/platform/operating-plane-client.js +131 -0
  436. package/dist/platform/operating-plane-client.js.map +1 -0
  437. package/dist/platform/operating-plane-summary.d.ts +47 -0
  438. package/dist/platform/operating-plane-summary.d.ts.map +1 -0
  439. package/dist/platform/operating-plane-summary.js +209 -0
  440. package/dist/platform/operating-plane-summary.js.map +1 -0
  441. package/dist/platform/tool-execution-client.d.ts.map +1 -1
  442. package/dist/platform/tool-execution-client.js +4 -11
  443. package/dist/platform/tool-execution-client.js.map +1 -1
  444. package/dist/prompts/service-client.d.ts.map +1 -1
  445. package/dist/prompts/service-client.js +3 -5
  446. package/dist/prompts/service-client.js.map +1 -1
  447. package/dist/prompts/system-prompt.d.ts +3 -0
  448. package/dist/prompts/system-prompt.d.ts.map +1 -1
  449. package/dist/prompts/system-prompt.js +13 -3
  450. package/dist/prompts/system-prompt.js.map +1 -1
  451. package/dist/prompts/types.d.ts +2 -0
  452. package/dist/prompts/types.d.ts.map +1 -1
  453. package/dist/prompts/types.js.map +1 -1
  454. package/dist/providers/api-keys.d.ts +1 -1
  455. package/dist/providers/api-keys.d.ts.map +1 -1
  456. package/dist/providers/api-keys.js +2 -1
  457. package/dist/providers/api-keys.js.map +1 -1
  458. package/dist/providers/auth.d.ts.map +1 -1
  459. package/dist/providers/auth.js +48 -25
  460. package/dist/providers/auth.js.map +1 -1
  461. package/dist/remote-runner/attach-client.d.ts.map +1 -1
  462. package/dist/remote-runner/attach-client.js +1 -0
  463. package/dist/remote-runner/attach-client.js.map +1 -1
  464. package/dist/remote-runner/client.d.ts.map +1 -1
  465. package/dist/remote-runner/client.js +4 -7
  466. package/dist/remote-runner/client.js.map +1 -1
  467. package/dist/rpc/rpc-types.d.ts.map +1 -1
  468. package/dist/rpc/rpc-types.js +1 -0
  469. package/dist/rpc/rpc-types.js.map +1 -1
  470. package/dist/safety/action-firewall.d.ts.map +1 -1
  471. package/dist/safety/action-firewall.js +69 -6
  472. package/dist/safety/action-firewall.js.map +1 -1
  473. package/dist/safety/attack-patterns.d.ts.map +1 -1
  474. package/dist/safety/attack-patterns.js +31 -14
  475. package/dist/safety/attack-patterns.js.map +1 -1
  476. package/dist/safety/bash-parser.d.ts.map +1 -1
  477. package/dist/safety/bash-parser.js +4 -3
  478. package/dist/safety/bash-parser.js.map +1 -1
  479. package/dist/safety/execpolicy.d.ts +15 -3
  480. package/dist/safety/execpolicy.d.ts.map +1 -1
  481. package/dist/safety/execpolicy.js +248 -37
  482. package/dist/safety/execpolicy.js.map +1 -1
  483. package/dist/safety/governance-service-client.d.ts.map +1 -1
  484. package/dist/safety/governance-service-client.js +4 -7
  485. package/dist/safety/governance-service-client.js.map +1 -1
  486. package/dist/safety/guarded-files.d.ts +34 -0
  487. package/dist/safety/guarded-files.d.ts.map +1 -0
  488. package/dist/safety/guarded-files.js +372 -0
  489. package/dist/safety/guarded-files.js.map +1 -0
  490. package/dist/safety/loop-detector.d.ts.map +1 -1
  491. package/dist/safety/loop-detector.js +6 -1
  492. package/dist/safety/loop-detector.js.map +1 -1
  493. package/dist/safety/permission-profile.d.ts +47 -0
  494. package/dist/safety/permission-profile.d.ts.map +1 -0
  495. package/dist/safety/permission-profile.js +349 -0
  496. package/dist/safety/permission-profile.js.map +1 -0
  497. package/dist/safety/safety-middleware.d.ts +5 -1
  498. package/dist/safety/safety-middleware.d.ts.map +1 -1
  499. package/dist/safety/safety-middleware.js +3 -2
  500. package/dist/safety/safety-middleware.js.map +1 -1
  501. package/dist/safety/suspicious-patterns.d.ts.map +1 -1
  502. package/dist/safety/suspicious-patterns.js +12 -7
  503. package/dist/safety/suspicious-patterns.js.map +1 -1
  504. package/dist/safety/tool-categorization.js +1 -1
  505. package/dist/safety/tool-categorization.js.map +1 -1
  506. package/dist/safety/validators/path-policy-validator.d.ts.map +1 -1
  507. package/dist/safety/validators/path-policy-validator.js +7 -0
  508. package/dist/safety/validators/path-policy-validator.js.map +1 -1
  509. package/dist/sandbox/index.d.ts +6 -1
  510. package/dist/sandbox/index.d.ts.map +1 -1
  511. package/dist/sandbox/index.js +30 -4
  512. package/dist/sandbox/index.js.map +1 -1
  513. package/dist/sandbox/native-sandbox.d.ts +3 -0
  514. package/dist/sandbox/native-sandbox.d.ts.map +1 -1
  515. package/dist/sandbox/native-sandbox.js +139 -18
  516. package/dist/sandbox/native-sandbox.js.map +1 -1
  517. package/dist/sentry.d.ts +17 -0
  518. package/dist/sentry.d.ts.map +1 -0
  519. package/dist/sentry.js +91 -0
  520. package/dist/sentry.js.map +1 -0
  521. package/dist/server/agent-runtime-ledger.d.ts +141 -0
  522. package/dist/server/agent-runtime-ledger.d.ts.map +1 -0
  523. package/dist/server/agent-runtime-ledger.js +334 -0
  524. package/dist/server/agent-runtime-ledger.js.map +1 -0
  525. package/dist/server/agent-trajectory-inspection.d.ts +104 -0
  526. package/dist/server/agent-trajectory-inspection.d.ts.map +1 -0
  527. package/dist/server/agent-trajectory-inspection.js +168 -0
  528. package/dist/server/agent-trajectory-inspection.js.map +1 -0
  529. package/dist/server/agent-trajectory-replay.d.ts +56 -0
  530. package/dist/server/agent-trajectory-replay.d.ts.map +1 -0
  531. package/dist/server/agent-trajectory-replay.js +214 -0
  532. package/dist/server/agent-trajectory-replay.js.map +1 -0
  533. package/dist/server/agent-trajectory-scenarios.d.ts +109 -0
  534. package/dist/server/agent-trajectory-scenarios.d.ts.map +1 -0
  535. package/dist/server/agent-trajectory-scenarios.js +822 -0
  536. package/dist/server/agent-trajectory-scenarios.js.map +1 -0
  537. package/dist/server/agent-trajectory-scorers.d.ts +61 -0
  538. package/dist/server/agent-trajectory-scorers.d.ts.map +1 -0
  539. package/dist/server/agent-trajectory-scorers.js +162 -0
  540. package/dist/server/agent-trajectory-scorers.js.map +1 -0
  541. package/dist/server/agent-trajectory-validation.d.ts +7 -0
  542. package/dist/server/agent-trajectory-validation.d.ts.map +1 -0
  543. package/dist/server/agent-trajectory-validation.js +101 -0
  544. package/dist/server/agent-trajectory-validation.js.map +1 -0
  545. package/dist/server/agent-trajectory.d.ts +50 -0
  546. package/dist/server/agent-trajectory.d.ts.map +1 -0
  547. package/dist/server/agent-trajectory.js +159 -0
  548. package/dist/server/agent-trajectory.js.map +1 -0
  549. package/dist/server/app-context.d.ts +18 -0
  550. package/dist/server/app-context.d.ts.map +1 -1
  551. package/dist/server/app-context.js.map +1 -1
  552. package/dist/server/handlers/headless-sessions.d.ts.map +1 -1
  553. package/dist/server/handlers/headless-sessions.js +64 -27
  554. package/dist/server/handlers/headless-sessions.js.map +1 -1
  555. package/dist/server/handlers/health.d.ts +6 -0
  556. package/dist/server/handlers/health.d.ts.map +1 -1
  557. package/dist/server/handlers/health.js +6 -0
  558. package/dist/server/handlers/health.js.map +1 -1
  559. package/dist/server/handlers/hosted-runner-drain.d.ts +69 -1
  560. package/dist/server/handlers/hosted-runner-drain.d.ts.map +1 -1
  561. package/dist/server/handlers/hosted-runner-drain.js +309 -18
  562. package/dist/server/handlers/hosted-runner-drain.js.map +1 -1
  563. package/dist/server/handlers/hosted-runner-identity.d.ts +16 -0
  564. package/dist/server/handlers/hosted-runner-identity.d.ts.map +1 -1
  565. package/dist/server/handlers/hosted-runner-identity.js +43 -0
  566. package/dist/server/handlers/hosted-runner-identity.js.map +1 -1
  567. package/dist/server/handlers/mode.d.ts.map +1 -1
  568. package/dist/server/handlers/mode.js +3 -1
  569. package/dist/server/handlers/mode.js.map +1 -1
  570. package/dist/server/handlers/pending-requests.d.ts.map +1 -1
  571. package/dist/server/handlers/pending-requests.js +336 -51
  572. package/dist/server/handlers/pending-requests.js.map +1 -1
  573. package/dist/server/handlers/platform-a2a-push.d.ts +6 -0
  574. package/dist/server/handlers/platform-a2a-push.d.ts.map +1 -0
  575. package/dist/server/handlers/platform-a2a-push.js +136 -0
  576. package/dist/server/handlers/platform-a2a-push.js.map +1 -0
  577. package/dist/server/handlers/sessions.d.ts.map +1 -1
  578. package/dist/server/handlers/sessions.js +21 -1
  579. package/dist/server/handlers/sessions.js.map +1 -1
  580. package/dist/server/headless-runtime-service.d.ts +9 -2
  581. package/dist/server/headless-runtime-service.d.ts.map +1 -1
  582. package/dist/server/headless-runtime-service.js +39 -0
  583. package/dist/server/headless-runtime-service.js.map +1 -1
  584. package/dist/server/hosted-agent-runtime-progress.d.ts +144 -0
  585. package/dist/server/hosted-agent-runtime-progress.d.ts.map +1 -0
  586. package/dist/server/hosted-agent-runtime-progress.js +1650 -0
  587. package/dist/server/hosted-agent-runtime-progress.js.map +1 -0
  588. package/dist/server/hosted-runner-lease.d.ts +41 -0
  589. package/dist/server/hosted-runner-lease.d.ts.map +1 -0
  590. package/dist/server/hosted-runner-lease.js +140 -0
  591. package/dist/server/hosted-runner-lease.js.map +1 -0
  592. package/dist/server/hosted-session-manager.d.ts +16 -8
  593. package/dist/server/hosted-session-manager.d.ts.map +1 -1
  594. package/dist/server/hosted-session-manager.js +98 -76
  595. package/dist/server/hosted-session-manager.js.map +1 -1
  596. package/dist/server/junit-xml.d.ts +2 -0
  597. package/dist/server/junit-xml.d.ts.map +1 -0
  598. package/dist/server/junit-xml.js +9 -0
  599. package/dist/server/junit-xml.js.map +1 -0
  600. package/dist/server/routes.d.ts.map +1 -1
  601. package/dist/server/routes.js +6 -0
  602. package/dist/server/routes.js.map +1 -1
  603. package/dist/server/scenario-recorder.d.ts +56 -0
  604. package/dist/server/scenario-recorder.d.ts.map +1 -0
  605. package/dist/server/scenario-recorder.js +109 -0
  606. package/dist/server/scenario-recorder.js.map +1 -0
  607. package/dist/server/scripted-scenario-runner.d.ts +46 -0
  608. package/dist/server/scripted-scenario-runner.d.ts.map +1 -0
  609. package/dist/server/scripted-scenario-runner.js +190 -0
  610. package/dist/server/scripted-scenario-runner.js.map +1 -0
  611. package/dist/server/server-middlewares.d.ts +6 -2
  612. package/dist/server/server-middlewares.d.ts.map +1 -1
  613. package/dist/server/server-middlewares.js +8 -2
  614. package/dist/server/server-middlewares.js.map +1 -1
  615. package/dist/server/server-request-manager.d.ts +9 -1
  616. package/dist/server/server-request-manager.d.ts.map +1 -1
  617. package/dist/server/server-request-manager.js +49 -4
  618. package/dist/server/server-request-manager.js.map +1 -1
  619. package/dist/services/intelligent-router/service.d.ts +2 -0
  620. package/dist/services/intelligent-router/service.d.ts.map +1 -1
  621. package/dist/services/intelligent-router/service.js +4 -0
  622. package/dist/services/intelligent-router/service.js.map +1 -1
  623. package/dist/services/service-authority.d.ts +25 -0
  624. package/dist/services/service-authority.d.ts.map +1 -0
  625. package/dist/services/service-authority.js +143 -0
  626. package/dist/services/service-authority.js.map +1 -0
  627. package/dist/services/workspace-config/service.d.ts +2 -0
  628. package/dist/services/workspace-config/service.d.ts.map +1 -1
  629. package/dist/services/workspace-config/service.js +4 -0
  630. package/dist/services/workspace-config/service.js.map +1 -1
  631. package/dist/session/manager.d.ts +8 -2
  632. package/dist/session/manager.d.ts.map +1 -1
  633. package/dist/session/manager.js +19 -4
  634. package/dist/session/manager.js.map +1 -1
  635. package/dist/session/session-branch.d.ts.map +1 -1
  636. package/dist/session/session-branch.js +5 -1
  637. package/dist/session/session-branch.js.map +1 -1
  638. package/dist/session/session-catalog.d.ts +7 -2
  639. package/dist/session/session-catalog.d.ts.map +1 -1
  640. package/dist/session/session-catalog.js +13 -2
  641. package/dist/session/session-catalog.js.map +1 -1
  642. package/dist/session/session-context.d.ts +6 -2
  643. package/dist/session/session-context.d.ts.map +1 -1
  644. package/dist/session/session-context.js +44 -4
  645. package/dist/session/session-context.js.map +1 -1
  646. package/dist/session/session-graph-projection.d.ts +32 -0
  647. package/dist/session/session-graph-projection.d.ts.map +1 -0
  648. package/dist/session/session-graph-projection.js +133 -0
  649. package/dist/session/session-graph-projection.js.map +1 -0
  650. package/dist/session/types.d.ts +18 -0
  651. package/dist/session/types.d.ts.map +1 -1
  652. package/dist/session/types.js +8 -0
  653. package/dist/session/types.js.map +1 -1
  654. package/dist/session/wire-format.generated.d.ts +3 -0
  655. package/dist/session/wire-format.generated.d.ts.map +1 -1
  656. package/dist/session/wire-format.generated.js +20 -0
  657. package/dist/session/wire-format.generated.js.map +1 -1
  658. package/dist/skills/eval-harness.d.ts +38 -0
  659. package/dist/skills/eval-harness.d.ts.map +1 -0
  660. package/dist/skills/eval-harness.js +112 -0
  661. package/dist/skills/eval-harness.js.map +1 -0
  662. package/dist/skills/index.d.ts +5 -1
  663. package/dist/skills/index.d.ts.map +1 -1
  664. package/dist/skills/index.js +5 -1
  665. package/dist/skills/index.js.map +1 -1
  666. package/dist/skills/linter.d.ts +36 -0
  667. package/dist/skills/linter.d.ts.map +1 -0
  668. package/dist/skills/linter.js +398 -0
  669. package/dist/skills/linter.js.map +1 -0
  670. package/dist/skills/loader.d.ts +36 -6
  671. package/dist/skills/loader.d.ts.map +1 -1
  672. package/dist/skills/loader.js +169 -86
  673. package/dist/skills/loader.js.map +1 -1
  674. package/dist/skills/package-contract.d.ts +45 -0
  675. package/dist/skills/package-contract.d.ts.map +1 -0
  676. package/dist/skills/package-contract.js +153 -0
  677. package/dist/skills/package-contract.js.map +1 -0
  678. package/dist/skills/runtime-activation.d.ts +68 -0
  679. package/dist/skills/runtime-activation.d.ts.map +1 -0
  680. package/dist/skills/runtime-activation.js +228 -0
  681. package/dist/skills/runtime-activation.js.map +1 -0
  682. package/dist/skills/service-client.d.ts.map +1 -1
  683. package/dist/skills/service-client.js +3 -4
  684. package/dist/skills/service-client.js.map +1 -1
  685. package/dist/skills/tool.d.ts.map +1 -1
  686. package/dist/skills/tool.js +2 -0
  687. package/dist/skills/tool.js.map +1 -1
  688. package/dist/skills/types.d.ts +14 -0
  689. package/dist/skills/types.d.ts.map +1 -1
  690. package/dist/skills/types.js.map +1 -1
  691. package/dist/telemetry/agent-operating-plane-context.d.ts +24 -0
  692. package/dist/telemetry/agent-operating-plane-context.d.ts.map +1 -0
  693. package/dist/telemetry/agent-operating-plane-context.js +54 -0
  694. package/dist/telemetry/agent-operating-plane-context.js.map +1 -0
  695. package/dist/telemetry/beacon.d.ts +24 -0
  696. package/dist/telemetry/beacon.d.ts.map +1 -0
  697. package/dist/telemetry/beacon.js +115 -0
  698. package/dist/telemetry/beacon.js.map +1 -0
  699. package/dist/telemetry/cli-command-aggregator.d.ts +36 -0
  700. package/dist/telemetry/cli-command-aggregator.d.ts.map +1 -0
  701. package/dist/telemetry/cli-command-aggregator.js +251 -0
  702. package/dist/telemetry/cli-command-aggregator.js.map +1 -0
  703. package/dist/telemetry/cli-startup.d.ts +21 -0
  704. package/dist/telemetry/cli-startup.d.ts.map +1 -0
  705. package/dist/telemetry/cli-startup.js +83 -0
  706. package/dist/telemetry/cli-startup.js.map +1 -0
  707. package/dist/telemetry/disablement.d.ts +13 -0
  708. package/dist/telemetry/disablement.d.ts.map +1 -0
  709. package/dist/telemetry/disablement.js +19 -0
  710. package/dist/telemetry/disablement.js.map +1 -0
  711. package/dist/telemetry/index.d.ts +6 -2
  712. package/dist/telemetry/index.d.ts.map +1 -1
  713. package/dist/telemetry/index.js +6 -2
  714. package/dist/telemetry/index.js.map +1 -1
  715. package/dist/telemetry/maestro-event-bus.d.ts +52 -0
  716. package/dist/telemetry/maestro-event-bus.d.ts.map +1 -1
  717. package/dist/telemetry/maestro-event-bus.js +179 -3
  718. package/dist/telemetry/maestro-event-bus.js.map +1 -1
  719. package/dist/telemetry/maestro-event-catalog.d.ts +3 -1
  720. package/dist/telemetry/maestro-event-catalog.d.ts.map +1 -1
  721. package/dist/telemetry/maestro-event-catalog.js +2 -0
  722. package/dist/telemetry/maestro-event-catalog.js.map +1 -1
  723. package/dist/telemetry/maestro-platform-replay-fixture.d.ts.map +1 -1
  724. package/dist/telemetry/maestro-platform-replay-fixture.js +74 -9
  725. package/dist/telemetry/maestro-platform-replay-fixture.js.map +1 -1
  726. package/dist/telemetry/maestro-publisher-conformance-fixture.d.ts +1 -1
  727. package/dist/telemetry/maestro-publisher-conformance-fixture.d.ts.map +1 -1
  728. package/dist/telemetry/maestro-publisher-conformance-fixture.js +46 -11
  729. package/dist/telemetry/maestro-publisher-conformance-fixture.js.map +1 -1
  730. package/dist/telemetry/mcp-beacon.d.ts +20 -0
  731. package/dist/telemetry/mcp-beacon.d.ts.map +1 -0
  732. package/dist/telemetry/mcp-beacon.js +54 -0
  733. package/dist/telemetry/mcp-beacon.js.map +1 -0
  734. package/dist/telemetry/metadata-normalization.d.ts +7 -0
  735. package/dist/telemetry/metadata-normalization.d.ts.map +1 -0
  736. package/dist/telemetry/metadata-normalization.js +189 -0
  737. package/dist/telemetry/metadata-normalization.js.map +1 -0
  738. package/dist/telemetry/meter-service-client.d.ts.map +1 -1
  739. package/dist/telemetry/meter-service-client.js +5 -10
  740. package/dist/telemetry/meter-service-client.js.map +1 -1
  741. package/dist/telemetry/metrics.d.ts +123 -0
  742. package/dist/telemetry/metrics.d.ts.map +1 -0
  743. package/dist/telemetry/metrics.js +184 -0
  744. package/dist/telemetry/metrics.js.map +1 -0
  745. package/dist/telemetry/turn-tracker.d.ts +1 -0
  746. package/dist/telemetry/turn-tracker.d.ts.map +1 -1
  747. package/dist/telemetry/turn-tracker.js +22 -1
  748. package/dist/telemetry/turn-tracker.js.map +1 -1
  749. package/dist/telemetry/wide-events.d.ts +31 -1
  750. package/dist/telemetry/wide-events.d.ts.map +1 -1
  751. package/dist/telemetry/wide-events.js +229 -1
  752. package/dist/telemetry/wide-events.js.map +1 -1
  753. package/dist/telemetry.d.ts +39 -3
  754. package/dist/telemetry.d.ts.map +1 -1
  755. package/dist/telemetry.js +160 -3
  756. package/dist/telemetry.js.map +1 -1
  757. package/dist/testing/test-verification-hook.d.ts.map +1 -1
  758. package/dist/testing/test-verification-hook.js +34 -21
  759. package/dist/testing/test-verification-hook.js.map +1 -1
  760. package/dist/tools/apply-patch-parser.d.ts +26 -0
  761. package/dist/tools/apply-patch-parser.d.ts.map +1 -0
  762. package/dist/tools/apply-patch-parser.js +146 -0
  763. package/dist/tools/apply-patch-parser.js.map +1 -0
  764. package/dist/tools/apply-patch.d.ts +42 -0
  765. package/dist/tools/apply-patch.d.ts.map +1 -0
  766. package/dist/tools/apply-patch.js +648 -0
  767. package/dist/tools/apply-patch.js.map +1 -0
  768. package/dist/tools/ask-user.d.ts +1 -0
  769. package/dist/tools/ask-user.d.ts.map +1 -1
  770. package/dist/tools/background/tool-handler.d.ts +1 -0
  771. package/dist/tools/background/tool-handler.d.ts.map +1 -1
  772. package/dist/tools/bash.d.ts +1 -0
  773. package/dist/tools/bash.d.ts.map +1 -1
  774. package/dist/tools/codesearch.d.ts +1 -0
  775. package/dist/tools/codesearch.d.ts.map +1 -1
  776. package/dist/tools/conductor-client.d.ts +1 -0
  777. package/dist/tools/conductor-client.d.ts.map +1 -1
  778. package/dist/tools/conductor-client.js +63 -0
  779. package/dist/tools/conductor-client.js.map +1 -1
  780. package/dist/tools/diff.d.ts +1 -0
  781. package/dist/tools/diff.d.ts.map +1 -1
  782. package/dist/tools/edit.d.ts +1 -0
  783. package/dist/tools/edit.d.ts.map +1 -1
  784. package/dist/tools/extract-document.d.ts +1 -0
  785. package/dist/tools/extract-document.d.ts.map +1 -1
  786. package/dist/tools/find.d.ts +10 -0
  787. package/dist/tools/find.d.ts.map +1 -1
  788. package/dist/tools/find.js +236 -27
  789. package/dist/tools/find.js.map +1 -1
  790. package/dist/tools/gh.d.ts +3 -0
  791. package/dist/tools/gh.d.ts.map +1 -1
  792. package/dist/tools/index.d.ts +50 -0
  793. package/dist/tools/index.d.ts.map +1 -1
  794. package/dist/tools/index.js +4 -0
  795. package/dist/tools/index.js.map +1 -1
  796. package/dist/tools/list.d.ts +1 -0
  797. package/dist/tools/list.d.ts.map +1 -1
  798. package/dist/tools/notebook.d.ts +1 -0
  799. package/dist/tools/notebook.d.ts.map +1 -1
  800. package/dist/tools/oracle.d.ts +1 -0
  801. package/dist/tools/oracle.d.ts.map +1 -1
  802. package/dist/tools/oracle.js +17 -32
  803. package/dist/tools/oracle.js.map +1 -1
  804. package/dist/tools/parallel-execution.d.ts +13 -2
  805. package/dist/tools/parallel-execution.d.ts.map +1 -1
  806. package/dist/tools/parallel-execution.js +178 -7
  807. package/dist/tools/parallel-execution.js.map +1 -1
  808. package/dist/tools/parallel-ripgrep.d.ts +1 -0
  809. package/dist/tools/parallel-ripgrep.d.ts.map +1 -1
  810. package/dist/tools/pipeline.d.ts +4 -0
  811. package/dist/tools/pipeline.d.ts.map +1 -1
  812. package/dist/tools/read.d.ts +1 -0
  813. package/dist/tools/read.d.ts.map +1 -1
  814. package/dist/tools/search.d.ts +1 -0
  815. package/dist/tools/search.d.ts.map +1 -1
  816. package/dist/tools/status.d.ts +1 -0
  817. package/dist/tools/status.d.ts.map +1 -1
  818. package/dist/tools/todo.d.ts +1 -0
  819. package/dist/tools/todo.d.ts.map +1 -1
  820. package/dist/tools/tool-dsl.d.ts +5 -1
  821. package/dist/tools/tool-dsl.d.ts.map +1 -1
  822. package/dist/tools/tool-dsl.js +1 -0
  823. package/dist/tools/tool-dsl.js.map +1 -1
  824. package/dist/tools/tool-result-cache.d.ts.map +1 -1
  825. package/dist/tools/tool-result-cache.js +1 -0
  826. package/dist/tools/tool-result-cache.js.map +1 -1
  827. package/dist/tools/typebox-tool.d.ts.map +1 -1
  828. package/dist/tools/typebox-tool.js +3 -0
  829. package/dist/tools/typebox-tool.js.map +1 -1
  830. package/dist/tools/webfetch.d.ts +1 -0
  831. package/dist/tools/webfetch.d.ts.map +1 -1
  832. package/dist/tools/websearch.d.ts +1 -0
  833. package/dist/tools/websearch.d.ts.map +1 -1
  834. package/dist/tools/write.d.ts +1 -0
  835. package/dist/tools/write.d.ts.map +1 -1
  836. package/dist/utils/abort-error.d.ts +2 -0
  837. package/dist/utils/abort-error.d.ts.map +1 -0
  838. package/dist/utils/abort-error.js +7 -0
  839. package/dist/utils/abort-error.js.map +1 -0
  840. package/dist/utils/downstream.d.ts.map +1 -1
  841. package/dist/utils/downstream.js +4 -0
  842. package/dist/utils/downstream.js.map +1 -1
  843. package/dist/utils/logger.d.ts +3 -0
  844. package/dist/utils/logger.d.ts.map +1 -1
  845. package/dist/utils/logger.js +14 -3
  846. package/dist/utils/logger.js.map +1 -1
  847. package/dist/utils/path-containment.d.ts +2 -0
  848. package/dist/utils/path-containment.d.ts.map +1 -0
  849. package/dist/utils/path-containment.js +14 -0
  850. package/dist/utils/path-containment.js.map +1 -0
  851. package/dist/utils/prompt-safe-text.d.ts +7 -0
  852. package/dist/utils/prompt-safe-text.d.ts.map +1 -0
  853. package/dist/utils/prompt-safe-text.js +44 -0
  854. package/dist/utils/prompt-safe-text.js.map +1 -0
  855. package/dist/version.json +2 -2
  856. package/dist/web-server.d.ts.map +1 -1
  857. package/dist/web-server.js +32 -7
  858. package/dist/web-server.js.map +1 -1
  859. package/dist/workspace/root-resolver.d.ts +4 -1
  860. package/dist/workspace/root-resolver.d.ts.map +1 -1
  861. package/dist/workspace/root-resolver.js +16 -6
  862. package/dist/workspace/root-resolver.js.map +1 -1
  863. package/node_modules/@evalops/contracts/dist/advisor-effort.d.ts +8 -0
  864. package/node_modules/@evalops/contracts/dist/advisor-effort.d.ts.map +1 -0
  865. package/node_modules/@evalops/contracts/dist/advisor-effort.js +35 -0
  866. package/node_modules/@evalops/contracts/dist/advisor-effort.js.map +1 -0
  867. package/node_modules/@evalops/contracts/dist/delegation-prompt.d.ts +10 -0
  868. package/node_modules/@evalops/contracts/dist/delegation-prompt.d.ts.map +1 -0
  869. package/node_modules/@evalops/contracts/dist/delegation-prompt.js +48 -0
  870. package/node_modules/@evalops/contracts/dist/delegation-prompt.js.map +1 -0
  871. package/node_modules/@evalops/contracts/dist/guarded-files-settings.d.ts +20 -0
  872. package/node_modules/@evalops/contracts/dist/guarded-files-settings.d.ts.map +1 -0
  873. package/node_modules/@evalops/contracts/dist/guarded-files-settings.js +147 -0
  874. package/node_modules/@evalops/contracts/dist/guarded-files-settings.js.map +1 -0
  875. package/node_modules/@evalops/contracts/dist/headless-protocol-generated.d.ts +2 -0
  876. package/node_modules/@evalops/contracts/dist/headless-protocol-generated.d.ts.map +1 -1
  877. package/node_modules/@evalops/contracts/dist/headless-protocol-generated.js +1 -0
  878. package/node_modules/@evalops/contracts/dist/headless-protocol-generated.js.map +1 -1
  879. package/node_modules/@evalops/contracts/dist/headless-protocol-schemas.generated.d.ts +280 -5
  880. package/node_modules/@evalops/contracts/dist/headless-protocol-schemas.generated.d.ts.map +1 -1
  881. package/node_modules/@evalops/contracts/dist/headless-protocol-schemas.generated.js +36 -1
  882. package/node_modules/@evalops/contracts/dist/headless-protocol-schemas.generated.js.map +1 -1
  883. package/node_modules/@evalops/contracts/dist/index.d.ts +15 -1
  884. package/node_modules/@evalops/contracts/dist/index.d.ts.map +1 -1
  885. package/node_modules/@evalops/contracts/dist/index.js +6 -0
  886. package/node_modules/@evalops/contracts/dist/index.js.map +1 -1
  887. package/node_modules/@evalops/contracts/dist/maestro-app-server.d.ts +593 -0
  888. package/node_modules/@evalops/contracts/dist/maestro-app-server.d.ts.map +1 -0
  889. package/node_modules/@evalops/contracts/dist/maestro-app-server.js +218 -0
  890. package/node_modules/@evalops/contracts/dist/maestro-app-server.js.map +1 -0
  891. package/node_modules/@evalops/contracts/dist/proto/maestro/v1/headless_pb.d.ts +91 -0
  892. package/node_modules/@evalops/contracts/dist/proto/maestro/v1/headless_pb.d.ts.map +1 -1
  893. package/node_modules/@evalops/contracts/dist/proto/maestro/v1/headless_pb.js +92 -61
  894. package/node_modules/@evalops/contracts/dist/proto/maestro/v1/headless_pb.js.map +1 -1
  895. package/node_modules/@evalops/contracts/dist/runtime-app-server.d.ts +3 -0
  896. package/node_modules/@evalops/contracts/dist/runtime-app-server.d.ts.map +1 -1
  897. package/node_modules/@evalops/contracts/dist/runtime-constraints.d.ts +28 -0
  898. package/node_modules/@evalops/contracts/dist/runtime-constraints.d.ts.map +1 -0
  899. package/node_modules/@evalops/contracts/dist/runtime-constraints.js +71 -0
  900. package/node_modules/@evalops/contracts/dist/runtime-constraints.js.map +1 -0
  901. package/node_modules/@evalops/contracts/dist/runtime-server-request.d.ts +7 -0
  902. package/node_modules/@evalops/contracts/dist/runtime-server-request.d.ts.map +1 -1
  903. package/node_modules/@evalops/contracts/dist/runtime-server-request.js +2 -0
  904. package/node_modules/@evalops/contracts/dist/runtime-server-request.js.map +1 -1
  905. package/node_modules/@evalops/contracts/dist/scenario.d.ts +191 -0
  906. package/node_modules/@evalops/contracts/dist/scenario.d.ts.map +1 -0
  907. package/node_modules/@evalops/contracts/dist/scenario.js +4 -0
  908. package/node_modules/@evalops/contracts/dist/scenario.js.map +1 -0
  909. package/node_modules/@evalops/contracts/dist/schemas.d.ts +17 -3
  910. package/node_modules/@evalops/contracts/dist/schemas.d.ts.map +1 -1
  911. package/node_modules/@evalops/contracts/dist/schemas.js +16 -0
  912. package/node_modules/@evalops/contracts/dist/schemas.js.map +1 -1
  913. package/node_modules/@evalops/contracts/package.json +1 -1
  914. package/node_modules/@evalops/tui/package.json +1 -1
  915. package/package.json +41 -7
  916. package/skills/incident-triage/SKILL.md +40 -0
  917. package/skills/incident-triage/mcp.json +14 -0
  918. package/skills/incident-triage/reference/triage.md +20 -0
  919. package/skills/incident-triage/toolbox/incident-timeline +22 -0
  920. package/skills/incident-triage/toolbox/incident-timeline.cmd +16 -0
  921. package/skills/pr-review/SKILL.md +40 -0
  922. package/skills/pr-review/mcp.json +14 -0
  923. package/skills/pr-review/reference/rubric.md +20 -0
  924. package/skills/pr-review/toolbox/review-summary +20 -0
  925. package/skills/pr-review/toolbox/review-summary.cmd +14 -0
  926. package/skills/release-verification/SKILL.md +40 -0
  927. package/skills/release-verification/mcp.json +15 -0
  928. package/skills/release-verification/reference/checklist.md +21 -0
  929. package/skills/release-verification/toolbox/release-readiness +18 -0
  930. package/skills/release-verification/toolbox/release-readiness.cmd +12 -0
package/dist/safety/attack-patterns.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"attack-patterns.js","sourceRoot":"","sources":["../../src/safety/attack-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA6BH;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA0C;IAC7E,yBAAyB,EAAE;QAC1B,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,wHAAwH;QACzH,IAAI,EAAE,CAAC,uBAAuB,EAAE,6BAA6B,EAAE,WAAW,CAAC;KAC3E;IACD,0BAA0B,EAAE;QAC3B,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,gGAAgG;QACjG,IAAI,EAAE,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,oBAAoB,CAAC;KACzE;IACD,kBAAkB,EAAE;QACnB,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,iFAAiF;QAClF,IAAI,EAAE,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;KAC3D;IACD,uBAAuB,EAAE;QACxB,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,gFAAgF;QACjF,IAAI,EAAE,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;KACrD;IACD,sBAAsB,EAAE;QACvB,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,mFAAmF;QACpF,IAAI,EAAE,CAAC,kBAAkB,EAAE,aAAa,EAAE,kBAAkB,CAAC;KAC7D;IACD,eAAe,EAAE;QAChB,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAChB,qFAAqF;QACtF,IAAI,EAAE,CAAC,eAAe,EAAE,sBAAsB,EAAE,YAAY,CAAC;KAC7D;IACD,iBAAiB,EAAE;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAChB,uEAAuE;QACxE,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,mBAAmB,CAAC;KACvD;IACD,qBAAqB,EAAE;QACtB,QAAQ,EAAE,sBAAsB;QAChC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,4FAA4F;QAC7F,IAAI,EAAE,CAAC,aAAa,EAAE,wBAAwB,EAAE,kBAAkB,CAAC;KACnE;IACD,qBAAqB,EAAE;QACtB,QAAQ,EAAE,sBAAsB;QAChC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,+EAA+E;QAChF,IAAI,EAAE,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;KACtD;IACD,oBAAoB,EAAE;QACrB,QAAQ,EAAE,gBAAgB;QAC1B,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAChB,gEAAgE;QACjE,IAAI,EAAE,CAAC,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,CAAC;KACnE;IACD,iBAAiB,EAAE;QAClB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,+DAA+D;QAChE,IAAI,EAAE,CAAC,8BAA8B,EAAE,kBAAkB,CAAC;KAC1D;IACD,uBAAuB,EAAE;QACxB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,0EAA0E;QAC3E,IAAI,EAAE,CAAC,4BAA4B,EAAE,YAAY,CAAC;KAClD;IACD,iBAAiB,EAAE;QAClB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,mEAAmE;QACpE,IAAI,EAAE,CAAC,uBAAuB,EAAE,sBAAsB,CAAC;KACvD;IACD,mBAAmB,EAAE;QACpB,QAAQ,EAAE,iBAAiB;QAC3B,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,6DAA6D;QAC9D,IAAI,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,wBAAwB,CAAC;KACtE;IACD,qBAAqB,EAAE;QACtB,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,oFAAoF;QACrF,IAAI,EAAE,CAAC,wBAAwB,EAAE,wBAAwB,EAAE,cAAc,CAAC;KAC1E;IACD,sBAAsB,EAAE;QACvB,QAAQ,EAAE,gBAAgB;QAC1B,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAChB,yEAAyE;QAC1E,IAAI,EAAE,CAAC,gBAAgB,EAAE,0BAA0B,EAAE,kBAAkB,CAAC;KACxE;IACD,uBAAuB,EAAE;QACxB,QAAQ,EAAE,sBAAsB;QAChC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,6EAA6E;QAC9E,IAAI,EAAE,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,sBAAsB,CAAC;KACxE;IACD,oBAAoB,EAAE;QACrB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,yEAAyE;QAC1E,IAAI,EAAE;YACL,sBAAsB;YACtB,0BAA0B;YAC1B,sBAAsB;SACtB;KACD;IACD,kBAAkB,EAAE;QACnB,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,0EAA0E;QAC3E,IAAI,EAAE,CAAC,uBAAuB,EAAE,YAAY,EAAE,kBAAkB,CAAC;KACjE;IACD,mBAAmB,EAAE;QACpB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,8EAA8E;QAC/E,IAAI,EAAE,CAAC,wBAAwB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC;KACzE;IACD,sBAAsB,EAAE;QACvB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,yEAAyE;QAC1E,IAAI,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,uBAAuB,CAAC;KACxE;CACD,CAAC;AAEF;;GAEG;AACH,SAAS,cAAc,CACtB,IAA6B,EAC7B,OAAe;IAEf,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;IACnD,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,IAA6B,EAAE,OAAe;IAClE,MAAM,IAAI,GACR,IAAI,CAAC,IAAe;QACpB,IAAI,CAAC,SAAoB;QACzB,IAAI,CAAC,MAAiB,CAAC;IACzB,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB;IAChE;QACC,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,sDAAsD;QACnE,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,+CAA+C;YAC/C,IACC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACjC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAChC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,4BAA4B;YAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAClC,MAAM,GAAG,GAAI,CAAC,CAAC,IAAI,CAAC,OAAkB,IAAI,EAAE,CAAC;gBAC7C,OAAO,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5D,CAAC,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,qFAAqF;oBACtF,eAAe,EAAE,QAAQ;iBACzB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,0BAA0B;QAC9B,WAAW,EAAE,2CAA2C;QACxD,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,IACC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACjC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,eAAe,GACpB,6DAA6D,CAAC;YAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAClC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;YAEH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,kDAAkD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC5H,eAAe,EAAE,SAAS;iBAC1B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,kBAAkB;QACtB,WAAW,EAAE,kCAAkC;QAC/C,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,IACC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACjC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,cAAc,GAAG,8CAA8C,CAAC;YACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAClC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,8CAA8C;oBACtD,eAAe,EAAE,QAAQ;iBACzB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,mCAAmC;QAChD,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,eAAe,GACpB,8DAA8D,CAAC;YAChE,IAAI,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;gBAClD,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,+CAA+C;iBACvD,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,+CAA+C;QAC5D,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,6DAA6D;YAC7D,MAAM,eAAe,GACpB,iEAAiE,CAAC;YAEnE,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,IAAI,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;oBAClD,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,oEAAoE;qBACrE,CAAC;gBACH,CAAC;YACF,CAAC;YAED,2BAA2B;YAC3B,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzE,MAAM,GAAG,GAAG,WAAW,CAAC,GAAa,CAAC;gBACtC,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtC,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,oEAAoE;qBACrE,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,kBAAkB;QACtB,WAAW,EAAE,yCAAyC;QACtD,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,uCAAuC;YACvC,MAAM,cAAc,GACnB,wEAAwE,CAAC;YAC1E,IAAI,cAAc,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;gBACjD,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,iEAAiE;iBAClE,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC5D;QACC,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,sCAAsC;QACnD,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,IACC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACjC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAChC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,cAAc,GAAG,8CAA8C,CAAC;YACtE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAClC,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;YAEH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,oEAAoE;oBACrE,eAAe,EAAE,UAAU;iBAC3B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,eAAe;QACnB,WAAW,EAAE,4CAA4C;QACzD,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,IACC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACjC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,aAAa,GAClB,8DAA8D,CAAC;YAChE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAClC,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,sEAAsE;oBACvE,eAAe,EAAE,OAAO;iBACxB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,oCAAoC;QACjD,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC7C,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,eAAe,GAAG,8CAA8C,CAAC;YACvE,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;gBACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;YACvE,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAClC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACpE,CAAC,CAAC,CAAC;YAEH,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,4EAA4E;oBAC7E,eAAe,EAAE,cAAc;iBAC/B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB;IAC/D;QACC,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,qCAAqC;QAClD,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,WAAW,GAAG,gCAAgC,CAAC;YACrD,IAAI,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC9C,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,4EAA4E;iBAC7E,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,6CAA6C;QAC1D,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,yCAAyC,CAAC;YAC9D,IACC,WAAW,CAAC,WAAW,EAAE,KAAK,OAAO;gBACrC,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EACnC,CAAC;gBACF,IAAI,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC3C,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,+EAA+E;qBAChF,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EACV,mEAAmE;QACpE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,8BAA8B;YAC9B,MAAM,mBAAmB,GACxB,2EAA2E,CAAC;YAE7E,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,IAAI,cAAc,CAAC,WAAW,EAAE,mBAAmB,CAAC,EAAE,CAAC;oBACtD,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,mFAAmF;qBACpF,CAAC;gBACH,CAAC;YACF,CAAC;YAED,oDAAoD;YACpD,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,MAAM,WAAW,GAAG,kCAAkC,CAAC;gBACvD,IAAI,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC3C,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,6DAA6D;qBAC9D,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACzD;QACC,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,kCAAkC;QAC/C,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,kBAAkB,GAAG,4CAA4C,CAAC;YACxE,IAAI,cAAc,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,CAAC;gBACrD,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,8DAA8D;iBAC/D,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,oDAAoD;QACjE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC7C,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,6CAA6C;YAC7C,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;YAC5D,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,gCAAgC;YAChC,MAAM,aAAa,GAAG,yCAAyC,CAAC;YAChE,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAClC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YACjE,CAAC,CAAC,CAAC;YAEH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,2EAA2E;oBAC5E,eAAe,EAAE,WAAW;iBAC5B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACtD;QACC,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,8BAA8B;QAC3C,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,MAAM,UAAU,GAAG,oCAAoC,CAAC;YACxD,IACC,WAAW,CAAC,WAAW,EAAE,KAAK,OAAO;gBACrC,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EACnC,CAAC;gBACF,IAAI,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC1C,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,0EAA0E;qBAC3E,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,4BAA4B;QACzC,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,MAAM,cAAc,GACnB,yDAAyD,CAAC;YAC3D,IACC,WAAW,CAAC,WAAW,EAAE,KAAK,OAAO;gBACrC,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EACnC,CAAC;gBACF,IAAI,WAAW,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;oBAC9C,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,iEAAiE;qBAClE,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,wCAAwC;QACrD,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,MAAM,cAAc,GAAG,8CAA8C,CAAC;YACtE,IACC,WAAW,CAAC,WAAW,EAAE,KAAK,OAAO;gBACrC,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EACnC,CAAC;gBACF,IAAI,WAAW,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;oBAC9C,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,oEAAoE;qBACrE,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,qDAAqD;QAClE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,sDAAsD;YACtD,IACC,WAAW,CAAC,WAAW,EAAE,KAAK,OAAO;gBACrC,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM;gBACpC,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EACnC,CAAC;gBACF,kDAAkD;gBAClD,MAAM,gBAAgB,GAAG,aAAa,CAAC;gBACvC,MAAM,cAAc,GACnB,sFAAsF,CAAC;gBAExF,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;oBAC1C,IAAI,cAAc,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;wBACnD,OAAO;4BACN,OAAO,EAAE,IAAI;4BACb,MAAM,EACL,wEAAwE;yBACzE,CAAC;oBACH,CAAC;gBACF,CAAC;qBAAM,IAAI,WAAW,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;oBACrD,+DAA+D;oBAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAiB,CAAC;oBAC9C,IAAI,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC/C,OAAO;4BACN,OAAO,EAAE,IAAI;4BACb,MAAM,EACL,sEAAsE;yBACvE,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,qCAAqC;QAClD,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,MAAM,eAAe,GAAG,iBAAiB,CAAC;YAC1C,IACC,WAAW,CAAC,WAAW,EAAE,KAAK,OAAO;gBACrC,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EACnC,CAAC;gBACF,IAAI,WAAW,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;oBAC/C,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,kEAAkE;qBACnE,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,oDAAoD;QACjE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,MAAM,UAAU,GAAG,8CAA8C,CAAC;YAClE,IACC,WAAW,CAAC,WAAW,EAAE,KAAK,OAAO;gBACrC,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EACnC,CAAC;gBACF,IAAI,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC1C,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,4EAA4E;qBAC7E,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IAC1D;QACC,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,8BAA8B;QAC3C,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,eAAe,GACpB,oEAAoE,CAAC;YACtE,IAAI,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;gBAClD,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,+DAA+D;iBAChE,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACrD,GAAG,8BAA8B;IACjC,GAAG,0BAA0B;IAC7B,GAAG,6BAA6B;IAChC,GAAG,uBAAuB;IAC1B,GAAG,oBAAoB;IACvB,GAAG,wBAAwB;CAC3B,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,SAAiB;IAEjB,OAAO,uBAAuB,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACpC,QAAwB;IAExB,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3C,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACpC,QAAgD;IAEhD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AACnE,CAAC","sourcesContent":["/**\n * Attack Patterns - Sophisticated threat detection patterns\n *\n * Defines multi-step attack patterns for credential harvesting,\n * data exfiltration, privilege escalation, and reconnaissance.\n *\n * These patterns extend the base tool-sequence-analyzer with\n * more sophisticated detection logic.\n *\n * @module safety/attack-patterns\n */\n\nimport type { SequencePattern } from \"./tool-sequence-analyzer.js\";\n\n/**\n * Attack pattern categories\n */\nexport type AttackCategory =\n\t| \"credential_harvesting\"\n\t| \"data_exfiltration\"\n\t| \"privilege_escalation\"\n\t| \"reconnaissance\"\n\t| \"persistence\"\n\t| \"defense_evasion\";\n\n/**\n * Extended metadata for attack patterns\n */\nexport interface AttackPatternMetadata {\n\t/** Attack category */\n\tcategory: AttackCategory;\n\t/** MITRE ATT&CK technique ID (if applicable) */\n\tmitreId?: string;\n\t/** Detailed description of the attack */\n\tattackDescription: string;\n\t/** Indicators of compromise */\n\tiocs: string[];\n}\n\n/**\n * Registry mapping pattern IDs to their metadata\n */\nexport const ATTACK_PATTERN_METADATA: Record<string, AttackPatternMetadata> = {\n\t\"cred-harvest-env-egress\": {\n\t\tcategory: \"credential_harvesting\",\n\t\tmitreId: \"T1552.001\",\n\t\tattackDescription:\n\t\t\t\"Attacker reads environment variables containing API keys or credentials, then attempts to exfiltrate via HTTP request.\",\n\t\tiocs: [\"env command execution\", \"environment variable access\", \"HTTP POST\"],\n\t},\n\t\"cred-harvest-config-file\": {\n\t\tcategory: \"credential_harvesting\",\n\t\tmitreId: \"T1552.001\",\n\t\tattackDescription:\n\t\t\t\"Attacker reads configuration files known to contain credentials, then exfiltrates via network.\",\n\t\tiocs: [\".env file access\", \"credentials file read\", \"config enumeration\"],\n\t},\n\t\"cred-harvest-git\": {\n\t\tcategory: \"credential_harvesting\",\n\t\tmitreId: \"T1552.001\",\n\t\tattackDescription:\n\t\t\t\"Attacker extracts Git credentials or repository tokens for unauthorized access.\",\n\t\tiocs: [\"git config access\", \"credential helper extraction\"],\n\t},\n\t\"cred-harvest-keychain\": {\n\t\tcategory: \"credential_harvesting\",\n\t\tmitreId: \"T1555.001\",\n\t\tattackDescription:\n\t\t\t\"Attacker attempts to extract credentials from system keychain or secret store.\",\n\t\tiocs: [\"keychain access\", \"credential manager query\"],\n\t},\n\t\"exfil-archive-egress\": {\n\t\tcategory: \"data_exfiltration\",\n\t\tmitreId: \"T1560.001\",\n\t\tattackDescription:\n\t\t\t\"Attacker creates compressed archive of collected data, then exfiltrates via HTTP.\",\n\t\tiocs: [\"archive creation\", \"compression\", \"network transfer\"],\n\t},\n\t\"exfil-db-dump\": {\n\t\tcategory: \"data_exfiltration\",\n\t\tmitreId: \"T1005\",\n\t\tattackDescription:\n\t\t\t\"Attacker dumps database contents for exfiltration. May contain sensitive user data.\",\n\t\tiocs: [\"database dump\", \"bulk data extraction\", \"SQL export\"],\n\t},\n\t\"exfil-curl-post\": {\n\t\tcategory: \"data_exfiltration\",\n\t\tmitreId: \"T1041\",\n\t\tattackDescription:\n\t\t\t\"Attacker reads sensitive files and exfiltrates via curl POST request.\",\n\t\tiocs: [\"curl POST\", \"data upload\", \"external transfer\"],\n\t},\n\t\"privesc-suid-search\": {\n\t\tcategory: \"privilege_escalation\",\n\t\tmitreId: \"T1548.001\",\n\t\tattackDescription:\n\t\t\t\"Attacker searches for SUID/SGID binaries that could be exploited for privilege escalation.\",\n\t\tiocs: [\"SUID search\", \"permission enumeration\", \"binary discovery\"],\n\t},\n\t\"privesc-cron-modify\": {\n\t\tcategory: \"privilege_escalation\",\n\t\tmitreId: \"T1053.003\",\n\t\tattackDescription:\n\t\t\t\"Attacker writes to cron directories to schedule privileged command execution.\",\n\t\tiocs: [\"cron modification\", \"scheduled task creation\"],\n\t},\n\t\"recon-network-scan\": {\n\t\tcategory: \"reconnaissance\",\n\t\tmitreId: \"T1046\",\n\t\tattackDescription:\n\t\t\t\"Attacker scans network to discover other systems and services.\",\n\t\tiocs: [\"port scanning\", \"network enumeration\", \"service discovery\"],\n\t},\n\t\"persist-ssh-key\": {\n\t\tcategory: \"persistence\",\n\t\tmitreId: \"T1098.004\",\n\t\tattackDescription:\n\t\t\t\"Attacker installs SSH key for persistent unauthorized access.\",\n\t\tiocs: [\"authorized_keys modification\", \"SSH key creation\"],\n\t},\n\t\"persist-shell-profile\": {\n\t\tcategory: \"persistence\",\n\t\tmitreId: \"T1546.004\",\n\t\tattackDescription:\n\t\t\t\"Attacker modifies shell startup files to execute commands on user login.\",\n\t\tiocs: [\"shell profile modification\", \"login hook\"],\n\t},\n\t\"persist-systemd\": {\n\t\tcategory: \"persistence\",\n\t\tmitreId: \"T1543.002\",\n\t\tattackDescription:\n\t\t\t\"Attacker creates systemd service for automatic execution on boot.\",\n\t\tiocs: [\"systemd unit creation\", \"service installation\"],\n\t},\n\t\"evasion-log-clear\": {\n\t\tcategory: \"defense_evasion\",\n\t\tmitreId: \"T1070.002\",\n\t\tattackDescription:\n\t\t\t\"Attacker attempts to clear logs to hide malicious activity.\",\n\t\tiocs: [\"log truncation\", \"history clearing\", \"audit log modification\"],\n\t},\n\t\"cred-cloud-metadata\": {\n\t\tcategory: \"credential_harvesting\",\n\t\tmitreId: \"T1552.005\",\n\t\tattackDescription:\n\t\t\t\"Attacker accesses cloud metadata service to steal instance credentials or secrets.\",\n\t\tiocs: [\"169.254.169.254 access\", \"metadata service query\", \"IMDSv1 abuse\"],\n\t},\n\t\"lateral-ssh-movement\": {\n\t\tcategory: \"reconnaissance\",\n\t\tmitreId: \"T1570\",\n\t\tattackDescription:\n\t\t\t\"Attacker reads SSH keys and attempts lateral movement to other systems.\",\n\t\tiocs: [\"SSH key access\", \"multiple SSH connections\", \"lateral movement\"],\n\t},\n\t\"privesc-docker-socket\": {\n\t\tcategory: \"privilege_escalation\",\n\t\tmitreId: \"T1552.003\",\n\t\tattackDescription:\n\t\t\t\"Attacker accesses Docker socket to escape container or escalate privileges.\",\n\t\tiocs: [\"docker.sock access\", \"container escape\", \"privileged container\"],\n\t},\n\t\"persist-ld-preload\": {\n\t\tcategory: \"persistence\",\n\t\tmitreId: \"T1574.006\",\n\t\tattackDescription:\n\t\t\t\"Attacker sets LD_PRELOAD to inject malicious shared library at runtime.\",\n\t\tiocs: [\n\t\t\t\"LD_PRELOAD injection\",\n\t\t\t\"shared library hijacking\",\n\t\t\t\"profile modification\",\n\t\t],\n\t},\n\t\"cred-proc-memory\": {\n\t\tcategory: \"credential_harvesting\",\n\t\tmitreId: \"T1552.001\",\n\t\tattackDescription:\n\t\t\t\"Attacker extracts credentials from process memory using debugging tools.\",\n\t\tiocs: [\"process memory access\", \"gdb attach\", \"/proc/*/mem read\"],\n\t},\n\t\"persist-git-hooks\": {\n\t\tcategory: \"persistence\",\n\t\tmitreId: \"T1547.010\",\n\t\tattackDescription:\n\t\t\t\"Attacker installs malicious git hooks that execute on repository operations.\",\n\t\tiocs: [\"git hooks modification\", \"post-checkout hook\", \"pre-commit hook\"],\n\t},\n\t\"persist-pam-backdoor\": {\n\t\tcategory: \"persistence\",\n\t\tmitreId: \"T1556.003\",\n\t\tattackDescription:\n\t\t\t\"Attacker modifies PAM configuration to install authentication backdoor.\",\n\t\tiocs: [\"PAM modification\", \"/etc/pam.d access\", \"authentication bypass\"],\n\t},\n};\n\n/**\n * Helper to check if a command contains certain patterns\n */\nfunction commandMatches(\n\targs: Record<string, unknown>,\n\tpattern: RegExp,\n): boolean {\n\tconst command = args.command as string | undefined;\n\treturn command ? pattern.test(command) : false;\n}\n\n/**\n * Helper to check if a path matches sensitive patterns\n */\nfunction pathMatches(args: Record<string, unknown>, pattern: RegExp): boolean {\n\tconst path =\n\t\t(args.path as string) ||\n\t\t(args.file_path as string) ||\n\t\t(args.target as string);\n\treturn path ? pattern.test(path) : false;\n}\n\n/**\n * Credential Harvesting Patterns\n */\nexport const CREDENTIAL_HARVESTING_PATTERNS: SequencePattern[] = [\n\t{\n\t\tid: \"cred-harvest-env-egress\",\n\t\tdescription: \"Environment variable read followed by network egress\",\n\t\tseverity: \"high\",\n\t\taction: \"block\",\n\t\twindowMs: 120_000,\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\t// Check if current operation is network egress\n\t\t\tif (\n\t\t\t\t!normalizedTool.includes(\"fetch\") &&\n\t\t\t\t!normalizedTool.includes(\"http\") &&\n\t\t\t\t!normalizedTool.includes(\"curl\")\n\t\t\t) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for recent env reads\n\t\t\tconst envReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 120_000) return false;\n\t\t\t\tconst cmd = (r.args.command as string) || \"\";\n\t\t\t\treturn /\\benv\\b|printenv|export|echo.*\\$[A-Z_]+/.test(cmd);\n\t\t\t});\n\n\t\t\tif (envReads.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Network egress after environment variable access - possible credential exfiltration\",\n\t\t\t\t\tmatchingRecords: envReads,\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"cred-harvest-config-file\",\n\t\tdescription: \"Read credential files then network egress\",\n\t\tseverity: \"high\",\n\t\taction: \"block\",\n\t\twindowMs: 180_000,\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tif (\n\t\t\t\t!normalizedTool.includes(\"fetch\") &&\n\t\t\t\t!normalizedTool.includes(\"http\")\n\t\t\t) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst credFilePattern =\n\t\t\t\t/\\.env|credentials|\\.aws\\/|\\.ssh\\/|\\.netrc|\\.npmrc|\\.pypirc/i;\n\t\t\tconst credReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 180_000) return false;\n\t\t\t\treturn r.tags.has(\"read\") && pathMatches(r.args, credFilePattern);\n\t\t\t});\n\n\t\t\tif (credReads.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Network egress after reading credential files: ${credReads.map((r) => r.args.path || r.args.file_path).join(\", \")}`,\n\t\t\t\t\tmatchingRecords: credReads,\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"cred-harvest-git\",\n\t\tdescription: \"Read git credentials then egress\",\n\t\tseverity: \"high\",\n\t\taction: \"block\",\n\t\twindowMs: 120_000,\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tif (\n\t\t\t\t!normalizedTool.includes(\"fetch\") &&\n\t\t\t\t!normalizedTool.includes(\"http\")\n\t\t\t) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst gitCredPattern = /\\.git\\/config|\\.gitconfig|\\.git-credentials/i;\n\t\t\tconst gitReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 120_000) return false;\n\t\t\t\treturn r.tags.has(\"read\") && pathMatches(r.args, gitCredPattern);\n\t\t\t});\n\n\t\t\tif (gitReads.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: \"Network egress after reading git credentials\",\n\t\t\t\t\tmatchingRecords: gitReads,\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"cred-harvest-keychain\",\n\t\tdescription: \"Attempt to access system keychain\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tif (currentTool.toLowerCase() !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst keychainPattern =\n\t\t\t\t/security\\s+find-generic-password|secret-tool|keyctl|kwallet/i;\n\t\t\tif (commandMatches(currentArgs, keychainPattern)) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: \"Keychain/secret store access attempt detected\",\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"cred-cloud-metadata\",\n\t\tdescription: \"Access cloud metadata service for credentials\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\t// Check for metadata service access in URLs or curl commands\n\t\t\tconst metadataPattern =\n\t\t\t\t/169\\.254\\.169\\.254|metadata\\.google\\.internal|169\\.254\\.170\\.2/i;\n\n\t\t\tif (currentTool.toLowerCase() === \"bash\") {\n\t\t\t\tif (commandMatches(currentArgs, metadataPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Cloud metadata service access detected - possible credential theft\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Also check WebFetch URLs\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tif (normalizedTool.includes(\"fetch\") || normalizedTool.includes(\"http\")) {\n\t\t\t\tconst url = currentArgs.url as string;\n\t\t\t\tif (url && metadataPattern.test(url)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Cloud metadata service access via HTTP - possible credential theft\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"cred-proc-memory\",\n\t\tdescription: \"Extract credentials from process memory\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tif (currentTool.toLowerCase() !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Detect process memory theft attempts\n\t\t\tconst procMemPattern =\n\t\t\t\t/gdb\\s+(attach|-p)|\\/proc\\/\\d+\\/mem|strings\\s+\\/proc|cat\\s+\\/proc\\/\\d+/i;\n\t\t\tif (commandMatches(currentArgs, procMemPattern)) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Process memory access detected - possible credential extraction\",\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n];\n\n/**\n * Data Exfiltration Patterns\n */\nexport const DATA_EXFILTRATION_PATTERNS: SequencePattern[] = [\n\t{\n\t\tid: \"exfil-archive-egress\",\n\t\tdescription: \"Create archive then network transfer\",\n\t\tseverity: \"high\",\n\t\taction: \"block\",\n\t\twindowMs: 180_000,\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tif (\n\t\t\t\t!normalizedTool.includes(\"fetch\") &&\n\t\t\t\t!normalizedTool.includes(\"http\") &&\n\t\t\t\t!normalizedTool.includes(\"curl\")\n\t\t\t) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst archivePattern = /\\b(tar|zip|7z|gzip|bzip2|xz)\\b.*-[a-z]*[cf]/i;\n\t\t\tconst archiveOps = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 180_000) return false;\n\t\t\t\treturn commandMatches(r.args, archivePattern);\n\t\t\t});\n\n\t\t\tif (archiveOps.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Network egress after creating archive - possible data exfiltration\",\n\t\t\t\t\tmatchingRecords: archiveOps,\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"exfil-db-dump\",\n\t\tdescription: \"Database dump followed by network transfer\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 300_000,\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tif (\n\t\t\t\t!normalizedTool.includes(\"fetch\") &&\n\t\t\t\t!normalizedTool.includes(\"http\")\n\t\t\t) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst dbDumpPattern =\n\t\t\t\t/pg_dump|mysqldump|mongodump|sqlite3.*\\.dump|redis-cli.*save/i;\n\t\t\tconst dbDumps = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 300_000) return false;\n\t\t\t\treturn commandMatches(r.args, dbDumpPattern);\n\t\t\t});\n\n\t\t\tif (dbDumps.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Network egress after database dump - critical data exfiltration risk\",\n\t\t\t\t\tmatchingRecords: dbDumps,\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"exfil-curl-post\",\n\t\tdescription: \"Read sensitive data then curl POST\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 120_000,\n\t\tdetect: (records, currentTool, currentArgs) => {\n\t\t\tif (currentTool.toLowerCase() !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst curlPostPattern = /curl.*(-X\\s*POST|--data|--data-binary|-d\\s)/i;\n\t\t\tif (!commandMatches(currentArgs, curlPostPattern)) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst sensitivePattern = /\\.env|secret|credential|password|key|token/i;\n\t\t\tconst sensitiveReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 120_000) return false;\n\t\t\t\treturn r.tags.has(\"read\") && pathMatches(r.args, sensitivePattern);\n\t\t\t});\n\n\t\t\tif (sensitiveReads.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Curl POST after reading sensitive files - possible credential exfiltration\",\n\t\t\t\t\tmatchingRecords: sensitiveReads,\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n];\n\n/**\n * Privilege Escalation Patterns\n */\nexport const PRIVILEGE_ESCALATION_PATTERNS: SequencePattern[] = [\n\t{\n\t\tid: \"privesc-suid-search\",\n\t\tdescription: \"Find SUID binaries for exploitation\",\n\t\tseverity: \"high\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tif (currentTool.toLowerCase() !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst suidPattern = /find.*-perm.*(4000|2000|-u=s)/i;\n\t\t\tif (commandMatches(currentArgs, suidPattern)) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"SUID binary search detected - possible privilege escalation reconnaissance\",\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"privesc-cron-modify\",\n\t\tdescription: \"Modify cron jobs for persistence/escalation\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tconst cronPattern = /\\/etc\\/cron|crontab|\\/var\\/spool\\/cron/i;\n\t\t\tif (\n\t\t\t\tcurrentTool.toLowerCase() === \"write\" ||\n\t\t\t\tcurrentTool.toLowerCase() === \"edit\"\n\t\t\t) {\n\t\t\t\tif (pathMatches(currentArgs, cronPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Cron job modification detected - possible privilege escalation or persistence\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"privesc-docker-socket\",\n\t\tdescription:\n\t\t\t\"Access Docker socket for container escape or privilege escalation\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\t// Detect Docker socket access\n\t\t\tconst dockerSocketPattern =\n\t\t\t\t/docker\\.sock|\\/var\\/run\\/docker|docker\\s+run.*--privileged|docker\\s+exec/i;\n\n\t\t\tif (currentTool.toLowerCase() === \"bash\") {\n\t\t\t\tif (commandMatches(currentArgs, dockerSocketPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Docker socket access detected - possible container escape or privilege escalation\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Also check for direct file reads of docker socket\n\t\t\tif (currentTool.toLowerCase() === \"read\") {\n\t\t\t\tconst sockPattern = /docker\\.sock|\\/var\\/run\\/docker/i;\n\t\t\t\tif (pathMatches(currentArgs, sockPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Docker socket read detected - possible privilege escalation\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n];\n\n/**\n * Reconnaissance Patterns\n */\nexport const RECONNAISSANCE_PATTERNS: SequencePattern[] = [\n\t{\n\t\tid: \"recon-network-scan\",\n\t\tdescription: \"Network scanning and enumeration\",\n\t\tseverity: \"high\",\n\t\taction: \"block\",\n\t\twindowMs: 120_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tif (currentTool.toLowerCase() !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst networkScanPattern = /\\b(nmap|netstat|ss\\s+-|lsof\\s+-i|arp\\s)\\b/i;\n\t\t\tif (commandMatches(currentArgs, networkScanPattern)) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Network scanning detected - possible reconnaissance activity\",\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"lateral-ssh-movement\",\n\t\tdescription: \"SSH key access followed by SSH connection attempts\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 180_000,\n\t\tdetect: (records, currentTool, currentArgs) => {\n\t\t\tif (currentTool.toLowerCase() !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Check if current command is SSH connection\n\t\t\tconst sshConnectPattern = /\\bssh\\s+[^-]|ssh\\s+-[^-]*\\s+\\w/i;\n\t\t\tif (!commandMatches(currentArgs, sshConnectPattern)) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for recent SSH key reads\n\t\t\tconst sshKeyPattern = /\\.ssh\\/id_|\\.ssh\\/.*_key|\\.ssh\\/config/i;\n\t\t\tconst sshKeyReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 180_000) return false;\n\t\t\t\treturn r.tags.has(\"read\") && pathMatches(r.args, sshKeyPattern);\n\t\t\t});\n\n\t\t\tif (sshKeyReads.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"SSH connection attempt after reading SSH keys - possible lateral movement\",\n\t\t\t\t\tmatchingRecords: sshKeyReads,\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n];\n\n/**\n * Persistence Patterns\n */\nexport const PERSISTENCE_PATTERNS: SequencePattern[] = [\n\t{\n\t\tid: \"persist-ssh-key\",\n\t\tdescription: \"Write to SSH authorized_keys\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tconst sshPattern = /\\.ssh\\/authorized_keys|\\.ssh\\/id_/i;\n\t\t\tif (\n\t\t\t\tcurrentTool.toLowerCase() === \"write\" ||\n\t\t\t\tcurrentTool.toLowerCase() === \"edit\"\n\t\t\t) {\n\t\t\t\tif (pathMatches(currentArgs, sshPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"SSH key installation detected - possible unauthorized access persistence\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"persist-shell-profile\",\n\t\tdescription: \"Modify shell startup files\",\n\t\tseverity: \"high\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tconst profilePattern =\n\t\t\t\t/\\.bashrc|\\.bash_profile|\\.zshrc|\\.profile|\\.bash_login/i;\n\t\t\tif (\n\t\t\t\tcurrentTool.toLowerCase() === \"write\" ||\n\t\t\t\tcurrentTool.toLowerCase() === \"edit\"\n\t\t\t) {\n\t\t\t\tif (pathMatches(currentArgs, profilePattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Shell profile modification detected - may establish persistence\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"persist-systemd\",\n\t\tdescription: \"Create systemd service for persistence\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tconst systemdPattern = /\\/etc\\/systemd|\\.config\\/systemd|\\.service$/i;\n\t\t\tif (\n\t\t\t\tcurrentTool.toLowerCase() === \"write\" ||\n\t\t\t\tcurrentTool.toLowerCase() === \"edit\"\n\t\t\t) {\n\t\t\t\tif (pathMatches(currentArgs, systemdPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Systemd service creation detected - possible persistence mechanism\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"persist-ld-preload\",\n\t\tdescription: \"LD_PRELOAD injection via shell profile modification\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\t// Check for LD_PRELOAD being written to profile files\n\t\t\tif (\n\t\t\t\tcurrentTool.toLowerCase() === \"write\" ||\n\t\t\t\tcurrentTool.toLowerCase() === \"edit\" ||\n\t\t\t\tcurrentTool.toLowerCase() === \"bash\"\n\t\t\t) {\n\t\t\t\t// Check for LD_PRELOAD in command or file content\n\t\t\t\tconst ldPreloadPattern = /LD_PRELOAD/i;\n\t\t\t\tconst profilePattern =\n\t\t\t\t\t/\\.bashrc|\\.bash_profile|\\.zshrc|\\.profile|\\/etc\\/environment|\\/etc\\/ld\\.so\\.preload/i;\n\n\t\t\t\tif (currentTool.toLowerCase() === \"bash\") {\n\t\t\t\t\tif (commandMatches(currentArgs, ldPreloadPattern)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\t\"LD_PRELOAD injection attempt detected - possible persistence mechanism\",\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t} else if (pathMatches(currentArgs, profilePattern)) {\n\t\t\t\t\t// If writing to profile files, check for LD_PRELOAD in content\n\t\t\t\t\tconst content = currentArgs.content as string;\n\t\t\t\t\tif (content && ldPreloadPattern.test(content)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\t\"LD_PRELOAD written to shell profile - possible persistence mechanism\",\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"persist-git-hooks\",\n\t\tdescription: \"Modify git hooks for code execution\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tconst gitHooksPattern = /\\.git\\/hooks\\//i;\n\t\t\tif (\n\t\t\t\tcurrentTool.toLowerCase() === \"write\" ||\n\t\t\t\tcurrentTool.toLowerCase() === \"edit\"\n\t\t\t) {\n\t\t\t\tif (pathMatches(currentArgs, gitHooksPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Git hooks modification detected - possible persistence mechanism\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"persist-pam-backdoor\",\n\t\tdescription: \"Modify PAM configuration for authentication bypass\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tconst pamPattern = /\\/etc\\/pam\\.d\\/|\\/etc\\/pam\\.conf|pam_.*\\.so/i;\n\t\t\tif (\n\t\t\t\tcurrentTool.toLowerCase() === \"write\" ||\n\t\t\t\tcurrentTool.toLowerCase() === \"edit\"\n\t\t\t) {\n\t\t\t\tif (pathMatches(currentArgs, pamPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"PAM configuration modification detected - possible authentication backdoor\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n];\n\n/**\n * Defense Evasion Patterns\n */\nexport const DEFENSE_EVASION_PATTERNS: SequencePattern[] = [\n\t{\n\t\tid: \"evasion-log-clear\",\n\t\tdescription: \"Attempt to clear system logs\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tif (currentTool.toLowerCase() !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst logClearPattern =\n\t\t\t\t/>\\s*\\/var\\/log|rm\\s.*\\/var\\/log|truncate.*\\/var\\/log|history\\s+-c/i;\n\t\t\tif (commandMatches(currentArgs, logClearPattern)) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Log clearing attempt detected - possible evidence destruction\",\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n];\n\n/**\n * All attack patterns combined\n */\nexport const ALL_ATTACK_PATTERNS: SequencePattern[] = [\n\t...CREDENTIAL_HARVESTING_PATTERNS,\n\t...DATA_EXFILTRATION_PATTERNS,\n\t...PRIVILEGE_ESCALATION_PATTERNS,\n\t...RECONNAISSANCE_PATTERNS,\n\t...PERSISTENCE_PATTERNS,\n\t...DEFENSE_EVASION_PATTERNS,\n];\n\n/**\n * Get metadata for an attack pattern\n */\nexport function getPatternMetadata(\n\tpatternId: string,\n): AttackPatternMetadata | undefined {\n\treturn ATTACK_PATTERN_METADATA[patternId];\n}\n\n/**\n * Get patterns by category\n */\nexport function getPatternsByCategory(\n\tcategory: AttackCategory,\n): SequencePattern[] {\n\treturn ALL_ATTACK_PATTERNS.filter((p) => {\n\t\tconst meta = ATTACK_PATTERN_METADATA[p.id];\n\t\treturn meta?.category === category;\n\t});\n}\n\n/**\n * Get patterns by severity\n */\nexport function getPatternsBySeverity(\n\tseverity: \"low\" | \"medium\" | \"high\" | \"critical\",\n): SequencePattern[] {\n\treturn ALL_ATTACK_PATTERNS.filter((p) => p.severity === severity);\n}\n"]}
1
+ {"version":3,"file":"attack-patterns.js","sourceRoot":"","sources":["../../src/safety/attack-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AA4BtE;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA0C;IAC7E,yBAAyB,EAAE;QAC1B,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,wHAAwH;QACzH,IAAI,EAAE,CAAC,uBAAuB,EAAE,6BAA6B,EAAE,WAAW,CAAC;KAC3E;IACD,0BAA0B,EAAE;QAC3B,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,gGAAgG;QACjG,IAAI,EAAE,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,oBAAoB,CAAC;KACzE;IACD,kBAAkB,EAAE;QACnB,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,iFAAiF;QAClF,IAAI,EAAE,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;KAC3D;IACD,uBAAuB,EAAE;QACxB,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,gFAAgF;QACjF,IAAI,EAAE,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;KACrD;IACD,sBAAsB,EAAE;QACvB,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,mFAAmF;QACpF,IAAI,EAAE,CAAC,kBAAkB,EAAE,aAAa,EAAE,kBAAkB,CAAC;KAC7D;IACD,eAAe,EAAE;QAChB,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAChB,qFAAqF;QACtF,IAAI,EAAE,CAAC,eAAe,EAAE,sBAAsB,EAAE,YAAY,CAAC;KAC7D;IACD,iBAAiB,EAAE;QAClB,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAChB,uEAAuE;QACxE,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,mBAAmB,CAAC;KACvD;IACD,qBAAqB,EAAE;QACtB,QAAQ,EAAE,sBAAsB;QAChC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,4FAA4F;QAC7F,IAAI,EAAE,CAAC,aAAa,EAAE,wBAAwB,EAAE,kBAAkB,CAAC;KACnE;IACD,qBAAqB,EAAE;QACtB,QAAQ,EAAE,sBAAsB;QAChC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,+EAA+E;QAChF,IAAI,EAAE,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;KACtD;IACD,oBAAoB,EAAE;QACrB,QAAQ,EAAE,gBAAgB;QAC1B,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAChB,gEAAgE;QACjE,IAAI,EAAE,CAAC,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,CAAC;KACnE;IACD,iBAAiB,EAAE;QAClB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,+DAA+D;QAChE,IAAI,EAAE,CAAC,8BAA8B,EAAE,kBAAkB,CAAC;KAC1D;IACD,uBAAuB,EAAE;QACxB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,0EAA0E;QAC3E,IAAI,EAAE,CAAC,4BAA4B,EAAE,YAAY,CAAC;KAClD;IACD,iBAAiB,EAAE;QAClB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,mEAAmE;QACpE,IAAI,EAAE,CAAC,uBAAuB,EAAE,sBAAsB,CAAC;KACvD;IACD,mBAAmB,EAAE;QACpB,QAAQ,EAAE,iBAAiB;QAC3B,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,6DAA6D;QAC9D,IAAI,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,wBAAwB,CAAC;KACtE;IACD,qBAAqB,EAAE;QACtB,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,oFAAoF;QACrF,IAAI,EAAE,CAAC,wBAAwB,EAAE,wBAAwB,EAAE,cAAc,CAAC;KAC1E;IACD,sBAAsB,EAAE;QACvB,QAAQ,EAAE,gBAAgB;QAC1B,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAChB,yEAAyE;QAC1E,IAAI,EAAE,CAAC,gBAAgB,EAAE,0BAA0B,EAAE,kBAAkB,CAAC;KACxE;IACD,uBAAuB,EAAE;QACxB,QAAQ,EAAE,sBAAsB;QAChC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,6EAA6E;QAC9E,IAAI,EAAE,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,sBAAsB,CAAC;KACxE;IACD,oBAAoB,EAAE;QACrB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,yEAAyE;QAC1E,IAAI,EAAE;YACL,sBAAsB;YACtB,0BAA0B;YAC1B,sBAAsB;SACtB;KACD;IACD,kBAAkB,EAAE;QACnB,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,0EAA0E;QAC3E,IAAI,EAAE,CAAC,uBAAuB,EAAE,YAAY,EAAE,kBAAkB,CAAC;KACjE;IACD,mBAAmB,EAAE;QACpB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,8EAA8E;QAC/E,IAAI,EAAE,CAAC,wBAAwB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC;KACzE;IACD,sBAAsB,EAAE;QACvB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW;QACpB,iBAAiB,EAChB,yEAAyE;QAC1E,IAAI,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,uBAAuB,CAAC;KACxE;CACD,CAAC;AAEF;;GAEG;AACH,SAAS,cAAc,CACtB,IAA6B,EAC7B,OAAe;IAEf,MAAM,OAAO,GAAG,IAAI,CAAC,OAA6B,CAAC;IACnD,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,IAA6B,EAAE,OAAe;IAClE,MAAM,IAAI,GACR,IAAI,CAAC,IAAe;QACpB,IAAI,CAAC,SAAoB;QACzB,IAAI,CAAC,MAAiB,CAAC;IACzB,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACrD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CACvB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAmB;IAC5C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,CACN,cAAc,KAAK,OAAO;QAC1B,cAAc,KAAK,MAAM;QACzB,cAAc,KAAK,aAAa,CAChC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAA6B;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB;IAChE;QACC,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,sDAAsD;QACnE,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,+CAA+C;YAC/C,IACC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACjC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAChC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,4BAA4B;YAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAClC,MAAM,GAAG,GAAI,CAAC,CAAC,IAAI,CAAC,OAAkB,IAAI,EAAE,CAAC;gBAC7C,OAAO,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5D,CAAC,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,qFAAqF;oBACtF,eAAe,EAAE,QAAQ;iBACzB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,0BAA0B;QAC9B,WAAW,EAAE,2CAA2C;QACxD,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,IACC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACjC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,eAAe,GACpB,6DAA6D,CAAC;YAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAClC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;YAEH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,kDAAkD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC5H,eAAe,EAAE,SAAS;iBAC1B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,kBAAkB;QACtB,WAAW,EAAE,kCAAkC;QAC/C,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,IACC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACjC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,cAAc,GAAG,8CAA8C,CAAC;YACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAClC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,8CAA8C;oBACtD,eAAe,EAAE,QAAQ;iBACzB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,mCAAmC;QAChD,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,eAAe,GACpB,8DAA8D,CAAC;YAChE,IAAI,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;gBAClD,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,+CAA+C;iBACvD,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,+CAA+C;QAC5D,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,6DAA6D;YAC7D,MAAM,eAAe,GACpB,iEAAiE,CAAC;YAEnE,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,IAAI,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;oBAClD,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,oEAAoE;qBACrE,CAAC;gBACH,CAAC;YACF,CAAC;YAED,2BAA2B;YAC3B,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzE,MAAM,GAAG,GAAG,WAAW,CAAC,GAAa,CAAC;gBACtC,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtC,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,oEAAoE;qBACrE,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,kBAAkB;QACtB,WAAW,EAAE,yCAAyC;QACtD,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,uCAAuC;YACvC,MAAM,cAAc,GACnB,wEAAwE,CAAC;YAC1E,IAAI,cAAc,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;gBACjD,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,iEAAiE;iBAClE,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC5D;QACC,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,sCAAsC;QACnD,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,IACC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACjC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAChC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,cAAc,GAAG,8CAA8C,CAAC;YACtE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAClC,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;YAEH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,oEAAoE;oBACrE,eAAe,EAAE,UAAU;iBAC3B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,eAAe;QACnB,WAAW,EAAE,4CAA4C;QACzD,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;YAC9C,MAAM,cAAc,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YACjD,IACC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACjC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,aAAa,GAClB,8DAA8D,CAAC;YAChE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAClC,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,sEAAsE;oBACvE,eAAe,EAAE,OAAO;iBACxB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,oCAAoC;QACjD,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC7C,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,eAAe,GAAG,8CAA8C,CAAC;YACvE,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;gBACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;YACvE,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAClC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACpE,CAAC,CAAC,CAAC;YAEH,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,4EAA4E;oBAC7E,eAAe,EAAE,cAAc;iBAC/B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB;IAC/D;QACC,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,qCAAqC;QAClD,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,WAAW,GAAG,gCAAgC,CAAC;YACrD,IAAI,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC9C,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,4EAA4E;iBAC7E,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,6CAA6C;QAC1D,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,yCAAyC,CAAC;YAC9D,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,IAAI,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC3C,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,+EAA+E;qBAChF,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EACV,mEAAmE;QACpE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,8BAA8B;YAC9B,MAAM,mBAAmB,GACxB,2EAA2E,CAAC;YAE7E,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,IAAI,cAAc,CAAC,WAAW,EAAE,mBAAmB,CAAC,EAAE,CAAC;oBACtD,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,mFAAmF;qBACpF,CAAC;gBACH,CAAC;YACF,CAAC;YAED,oDAAoD;YACpD,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,MAAM,WAAW,GAAG,kCAAkC,CAAC;gBACvD,IAAI,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC3C,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,6DAA6D;qBAC9D,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACzD;QACC,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,kCAAkC;QAC/C,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,kBAAkB,GAAG,4CAA4C,CAAC;YACxE,IAAI,cAAc,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,CAAC;gBACrD,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,8DAA8D;iBAC/D,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,oDAAoD;QACjE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC7C,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,6CAA6C;YAC7C,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;YAC5D,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,gCAAgC;YAChC,MAAM,aAAa,GAAG,yCAAyC,CAAC;YAChE,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;gBACvC,IAAI,KAAK,GAAG,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAClC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YACjE,CAAC,CAAC,CAAC;YAEH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,2EAA2E;oBAC5E,eAAe,EAAE,WAAW;iBAC5B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACtD;QACC,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,8BAA8B;QAC3C,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,MAAM,UAAU,GAAG,oCAAoC,CAAC;YACxD,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,IAAI,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC1C,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,0EAA0E;qBAC3E,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,4BAA4B;QACzC,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,MAAM,cAAc,GACnB,yDAAyD,CAAC;YAC3D,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,IAAI,WAAW,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;oBAC9C,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,iEAAiE;qBAClE,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,wCAAwC;QACrD,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,MAAM,cAAc,GAAG,8CAA8C,CAAC;YACtE,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,IAAI,WAAW,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;oBAC9C,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,oEAAoE;qBACrE,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,qDAAqD;QAClE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,sDAAsD;YACtD,IACC,WAAW,CAAC,WAAW,EAAE,KAAK,OAAO;gBACrC,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM;gBACpC,WAAW,CAAC,WAAW,EAAE,KAAK,aAAa;gBAC3C,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EACnC,CAAC;gBACF,kDAAkD;gBAClD,MAAM,gBAAgB,GAAG,aAAa,CAAC;gBACvC,MAAM,cAAc,GACnB,sFAAsF,CAAC;gBAExF,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;oBAC1C,IAAI,cAAc,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;wBACnD,OAAO;4BACN,OAAO,EAAE,IAAI;4BACb,MAAM,EACL,wEAAwE;yBACzE,CAAC;oBACH,CAAC;gBACF,CAAC;qBAAM,IAAI,WAAW,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;oBACrD,+DAA+D;oBAC/D,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;oBAC7C,IAAI,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC/C,OAAO;4BACN,OAAO,EAAE,IAAI;4BACb,MAAM,EACL,sEAAsE;yBACvE,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,qCAAqC;QAClD,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,MAAM,eAAe,GAAG,iBAAiB,CAAC;YAC1C,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,IAAI,WAAW,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;oBAC/C,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,kEAAkE;qBACnE,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,oDAAoD;QACjE,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,MAAM,UAAU,GAAG,8CAA8C,CAAC;YAClE,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,IAAI,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC1C,OAAO;wBACN,OAAO,EAAE,IAAI;wBACb,MAAM,EACL,4EAA4E;qBAC7E,CAAC;gBACH,CAAC;YACF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IAC1D;QACC,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,8BAA8B;QAC3C,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE;YAC9C,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,eAAe,GACpB,oEAAoE,CAAC;YACtE,IAAI,cAAc,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;gBAClD,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EACL,+DAA+D;iBAChE,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;KACD;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACrD,GAAG,8BAA8B;IACjC,GAAG,0BAA0B;IAC7B,GAAG,6BAA6B;IAChC,GAAG,uBAAuB;IAC1B,GAAG,oBAAoB;IACvB,GAAG,wBAAwB;CAC3B,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,SAAiB;IAEjB,OAAO,uBAAuB,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACpC,QAAwB;IAExB,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3C,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACpC,QAAgD;IAEhD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AACnE,CAAC","sourcesContent":["/**\n * Attack Patterns - Sophisticated threat detection patterns\n *\n * Defines multi-step attack patterns for credential harvesting,\n * data exfiltration, privilege escalation, and reconnaissance.\n *\n * These patterns extend the base tool-sequence-analyzer with\n * more sophisticated detection logic.\n *\n * @module safety/attack-patterns\n */\n\nimport { parseApplyPatchPaths } from \"../tools/apply-patch-parser.js\";\nimport type { SequencePattern } from \"./tool-sequence-analyzer.js\";\n\n/**\n * Attack pattern categories\n */\nexport type AttackCategory =\n\t| \"credential_harvesting\"\n\t| \"data_exfiltration\"\n\t| \"privilege_escalation\"\n\t| \"reconnaissance\"\n\t| \"persistence\"\n\t| \"defense_evasion\";\n\n/**\n * Extended metadata for attack patterns\n */\nexport interface AttackPatternMetadata {\n\t/** Attack category */\n\tcategory: AttackCategory;\n\t/** MITRE ATT&CK technique ID (if applicable) */\n\tmitreId?: string;\n\t/** Detailed description of the attack */\n\tattackDescription: string;\n\t/** Indicators of compromise */\n\tiocs: string[];\n}\n\n/**\n * Registry mapping pattern IDs to their metadata\n */\nexport const ATTACK_PATTERN_METADATA: Record<string, AttackPatternMetadata> = {\n\t\"cred-harvest-env-egress\": {\n\t\tcategory: \"credential_harvesting\",\n\t\tmitreId: \"T1552.001\",\n\t\tattackDescription:\n\t\t\t\"Attacker reads environment variables containing API keys or credentials, then attempts to exfiltrate via HTTP request.\",\n\t\tiocs: [\"env command execution\", \"environment variable access\", \"HTTP POST\"],\n\t},\n\t\"cred-harvest-config-file\": {\n\t\tcategory: \"credential_harvesting\",\n\t\tmitreId: \"T1552.001\",\n\t\tattackDescription:\n\t\t\t\"Attacker reads configuration files known to contain credentials, then exfiltrates via network.\",\n\t\tiocs: [\".env file access\", \"credentials file read\", \"config enumeration\"],\n\t},\n\t\"cred-harvest-git\": {\n\t\tcategory: \"credential_harvesting\",\n\t\tmitreId: \"T1552.001\",\n\t\tattackDescription:\n\t\t\t\"Attacker extracts Git credentials or repository tokens for unauthorized access.\",\n\t\tiocs: [\"git config access\", \"credential helper extraction\"],\n\t},\n\t\"cred-harvest-keychain\": {\n\t\tcategory: \"credential_harvesting\",\n\t\tmitreId: \"T1555.001\",\n\t\tattackDescription:\n\t\t\t\"Attacker attempts to extract credentials from system keychain or secret store.\",\n\t\tiocs: [\"keychain access\", \"credential manager query\"],\n\t},\n\t\"exfil-archive-egress\": {\n\t\tcategory: \"data_exfiltration\",\n\t\tmitreId: \"T1560.001\",\n\t\tattackDescription:\n\t\t\t\"Attacker creates compressed archive of collected data, then exfiltrates via HTTP.\",\n\t\tiocs: [\"archive creation\", \"compression\", \"network transfer\"],\n\t},\n\t\"exfil-db-dump\": {\n\t\tcategory: \"data_exfiltration\",\n\t\tmitreId: \"T1005\",\n\t\tattackDescription:\n\t\t\t\"Attacker dumps database contents for exfiltration. May contain sensitive user data.\",\n\t\tiocs: [\"database dump\", \"bulk data extraction\", \"SQL export\"],\n\t},\n\t\"exfil-curl-post\": {\n\t\tcategory: \"data_exfiltration\",\n\t\tmitreId: \"T1041\",\n\t\tattackDescription:\n\t\t\t\"Attacker reads sensitive files and exfiltrates via curl POST request.\",\n\t\tiocs: [\"curl POST\", \"data upload\", \"external transfer\"],\n\t},\n\t\"privesc-suid-search\": {\n\t\tcategory: \"privilege_escalation\",\n\t\tmitreId: \"T1548.001\",\n\t\tattackDescription:\n\t\t\t\"Attacker searches for SUID/SGID binaries that could be exploited for privilege escalation.\",\n\t\tiocs: [\"SUID search\", \"permission enumeration\", \"binary discovery\"],\n\t},\n\t\"privesc-cron-modify\": {\n\t\tcategory: \"privilege_escalation\",\n\t\tmitreId: \"T1053.003\",\n\t\tattackDescription:\n\t\t\t\"Attacker writes to cron directories to schedule privileged command execution.\",\n\t\tiocs: [\"cron modification\", \"scheduled task creation\"],\n\t},\n\t\"recon-network-scan\": {\n\t\tcategory: \"reconnaissance\",\n\t\tmitreId: \"T1046\",\n\t\tattackDescription:\n\t\t\t\"Attacker scans network to discover other systems and services.\",\n\t\tiocs: [\"port scanning\", \"network enumeration\", \"service discovery\"],\n\t},\n\t\"persist-ssh-key\": {\n\t\tcategory: \"persistence\",\n\t\tmitreId: \"T1098.004\",\n\t\tattackDescription:\n\t\t\t\"Attacker installs SSH key for persistent unauthorized access.\",\n\t\tiocs: [\"authorized_keys modification\", \"SSH key creation\"],\n\t},\n\t\"persist-shell-profile\": {\n\t\tcategory: \"persistence\",\n\t\tmitreId: \"T1546.004\",\n\t\tattackDescription:\n\t\t\t\"Attacker modifies shell startup files to execute commands on user login.\",\n\t\tiocs: [\"shell profile modification\", \"login hook\"],\n\t},\n\t\"persist-systemd\": {\n\t\tcategory: \"persistence\",\n\t\tmitreId: \"T1543.002\",\n\t\tattackDescription:\n\t\t\t\"Attacker creates systemd service for automatic execution on boot.\",\n\t\tiocs: [\"systemd unit creation\", \"service installation\"],\n\t},\n\t\"evasion-log-clear\": {\n\t\tcategory: \"defense_evasion\",\n\t\tmitreId: \"T1070.002\",\n\t\tattackDescription:\n\t\t\t\"Attacker attempts to clear logs to hide malicious activity.\",\n\t\tiocs: [\"log truncation\", \"history clearing\", \"audit log modification\"],\n\t},\n\t\"cred-cloud-metadata\": {\n\t\tcategory: \"credential_harvesting\",\n\t\tmitreId: \"T1552.005\",\n\t\tattackDescription:\n\t\t\t\"Attacker accesses cloud metadata service to steal instance credentials or secrets.\",\n\t\tiocs: [\"169.254.169.254 access\", \"metadata service query\", \"IMDSv1 abuse\"],\n\t},\n\t\"lateral-ssh-movement\": {\n\t\tcategory: \"reconnaissance\",\n\t\tmitreId: \"T1570\",\n\t\tattackDescription:\n\t\t\t\"Attacker reads SSH keys and attempts lateral movement to other systems.\",\n\t\tiocs: [\"SSH key access\", \"multiple SSH connections\", \"lateral movement\"],\n\t},\n\t\"privesc-docker-socket\": {\n\t\tcategory: \"privilege_escalation\",\n\t\tmitreId: \"T1552.003\",\n\t\tattackDescription:\n\t\t\t\"Attacker accesses Docker socket to escape container or escalate privileges.\",\n\t\tiocs: [\"docker.sock access\", \"container escape\", \"privileged container\"],\n\t},\n\t\"persist-ld-preload\": {\n\t\tcategory: \"persistence\",\n\t\tmitreId: \"T1574.006\",\n\t\tattackDescription:\n\t\t\t\"Attacker sets LD_PRELOAD to inject malicious shared library at runtime.\",\n\t\tiocs: [\n\t\t\t\"LD_PRELOAD injection\",\n\t\t\t\"shared library hijacking\",\n\t\t\t\"profile modification\",\n\t\t],\n\t},\n\t\"cred-proc-memory\": {\n\t\tcategory: \"credential_harvesting\",\n\t\tmitreId: \"T1552.001\",\n\t\tattackDescription:\n\t\t\t\"Attacker extracts credentials from process memory using debugging tools.\",\n\t\tiocs: [\"process memory access\", \"gdb attach\", \"/proc/*/mem read\"],\n\t},\n\t\"persist-git-hooks\": {\n\t\tcategory: \"persistence\",\n\t\tmitreId: \"T1547.010\",\n\t\tattackDescription:\n\t\t\t\"Attacker installs malicious git hooks that execute on repository operations.\",\n\t\tiocs: [\"git hooks modification\", \"post-checkout hook\", \"pre-commit hook\"],\n\t},\n\t\"persist-pam-backdoor\": {\n\t\tcategory: \"persistence\",\n\t\tmitreId: \"T1556.003\",\n\t\tattackDescription:\n\t\t\t\"Attacker modifies PAM configuration to install authentication backdoor.\",\n\t\tiocs: [\"PAM modification\", \"/etc/pam.d access\", \"authentication bypass\"],\n\t},\n};\n\n/**\n * Helper to check if a command contains certain patterns\n */\nfunction commandMatches(\n\targs: Record<string, unknown>,\n\tpattern: RegExp,\n): boolean {\n\tconst command = args.command as string | undefined;\n\treturn command ? pattern.test(command) : false;\n}\n\n/**\n * Helper to check if a path matches sensitive patterns\n */\nfunction pathMatches(args: Record<string, unknown>, pattern: RegExp): boolean {\n\tconst path =\n\t\t(args.path as string) ||\n\t\t(args.file_path as string) ||\n\t\t(args.target as string);\n\tif (path && pattern.test(path)) {\n\t\treturn true;\n\t}\n\tconst patch = args.patch;\n\tif (typeof patch === \"string\") {\n\t\treturn parseApplyPatchPaths(patch).some((patchPath) =>\n\t\t\tpattern.test(patchPath),\n\t\t);\n\t}\n\treturn false;\n}\n\nfunction toolMutatesFiles(currentTool: string): boolean {\n\tconst normalizedTool = currentTool.toLowerCase();\n\treturn (\n\t\tnormalizedTool === \"write\" ||\n\t\tnormalizedTool === \"edit\" ||\n\t\tnormalizedTool === \"apply_patch\"\n\t);\n}\n\nfunction mutationContent(args: Record<string, unknown>): string {\n\tconst content = args.content;\n\tif (typeof content === \"string\") {\n\t\treturn content;\n\t}\n\tconst patch = args.patch;\n\treturn typeof patch === \"string\" ? patch : \"\";\n}\n\n/**\n * Credential Harvesting Patterns\n */\nexport const CREDENTIAL_HARVESTING_PATTERNS: SequencePattern[] = [\n\t{\n\t\tid: \"cred-harvest-env-egress\",\n\t\tdescription: \"Environment variable read followed by network egress\",\n\t\tseverity: \"high\",\n\t\taction: \"block\",\n\t\twindowMs: 120_000,\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\t// Check if current operation is network egress\n\t\t\tif (\n\t\t\t\t!normalizedTool.includes(\"fetch\") &&\n\t\t\t\t!normalizedTool.includes(\"http\") &&\n\t\t\t\t!normalizedTool.includes(\"curl\")\n\t\t\t) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for recent env reads\n\t\t\tconst envReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 120_000) return false;\n\t\t\t\tconst cmd = (r.args.command as string) || \"\";\n\t\t\t\treturn /\\benv\\b|printenv|export|echo.*\\$[A-Z_]+/.test(cmd);\n\t\t\t});\n\n\t\t\tif (envReads.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Network egress after environment variable access - possible credential exfiltration\",\n\t\t\t\t\tmatchingRecords: envReads,\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"cred-harvest-config-file\",\n\t\tdescription: \"Read credential files then network egress\",\n\t\tseverity: \"high\",\n\t\taction: \"block\",\n\t\twindowMs: 180_000,\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tif (\n\t\t\t\t!normalizedTool.includes(\"fetch\") &&\n\t\t\t\t!normalizedTool.includes(\"http\")\n\t\t\t) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst credFilePattern =\n\t\t\t\t/\\.env|credentials|\\.aws\\/|\\.ssh\\/|\\.netrc|\\.npmrc|\\.pypirc/i;\n\t\t\tconst credReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 180_000) return false;\n\t\t\t\treturn r.tags.has(\"read\") && pathMatches(r.args, credFilePattern);\n\t\t\t});\n\n\t\t\tif (credReads.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: `Network egress after reading credential files: ${credReads.map((r) => r.args.path || r.args.file_path).join(\", \")}`,\n\t\t\t\t\tmatchingRecords: credReads,\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"cred-harvest-git\",\n\t\tdescription: \"Read git credentials then egress\",\n\t\tseverity: \"high\",\n\t\taction: \"block\",\n\t\twindowMs: 120_000,\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tif (\n\t\t\t\t!normalizedTool.includes(\"fetch\") &&\n\t\t\t\t!normalizedTool.includes(\"http\")\n\t\t\t) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst gitCredPattern = /\\.git\\/config|\\.gitconfig|\\.git-credentials/i;\n\t\t\tconst gitReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 120_000) return false;\n\t\t\t\treturn r.tags.has(\"read\") && pathMatches(r.args, gitCredPattern);\n\t\t\t});\n\n\t\t\tif (gitReads.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: \"Network egress after reading git credentials\",\n\t\t\t\t\tmatchingRecords: gitReads,\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"cred-harvest-keychain\",\n\t\tdescription: \"Attempt to access system keychain\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tif (currentTool.toLowerCase() !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst keychainPattern =\n\t\t\t\t/security\\s+find-generic-password|secret-tool|keyctl|kwallet/i;\n\t\t\tif (commandMatches(currentArgs, keychainPattern)) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason: \"Keychain/secret store access attempt detected\",\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"cred-cloud-metadata\",\n\t\tdescription: \"Access cloud metadata service for credentials\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\t// Check for metadata service access in URLs or curl commands\n\t\t\tconst metadataPattern =\n\t\t\t\t/169\\.254\\.169\\.254|metadata\\.google\\.internal|169\\.254\\.170\\.2/i;\n\n\t\t\tif (currentTool.toLowerCase() === \"bash\") {\n\t\t\t\tif (commandMatches(currentArgs, metadataPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Cloud metadata service access detected - possible credential theft\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Also check WebFetch URLs\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tif (normalizedTool.includes(\"fetch\") || normalizedTool.includes(\"http\")) {\n\t\t\t\tconst url = currentArgs.url as string;\n\t\t\t\tif (url && metadataPattern.test(url)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Cloud metadata service access via HTTP - possible credential theft\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"cred-proc-memory\",\n\t\tdescription: \"Extract credentials from process memory\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tif (currentTool.toLowerCase() !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Detect process memory theft attempts\n\t\t\tconst procMemPattern =\n\t\t\t\t/gdb\\s+(attach|-p)|\\/proc\\/\\d+\\/mem|strings\\s+\\/proc|cat\\s+\\/proc\\/\\d+/i;\n\t\t\tif (commandMatches(currentArgs, procMemPattern)) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Process memory access detected - possible credential extraction\",\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n];\n\n/**\n * Data Exfiltration Patterns\n */\nexport const DATA_EXFILTRATION_PATTERNS: SequencePattern[] = [\n\t{\n\t\tid: \"exfil-archive-egress\",\n\t\tdescription: \"Create archive then network transfer\",\n\t\tseverity: \"high\",\n\t\taction: \"block\",\n\t\twindowMs: 180_000,\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tif (\n\t\t\t\t!normalizedTool.includes(\"fetch\") &&\n\t\t\t\t!normalizedTool.includes(\"http\") &&\n\t\t\t\t!normalizedTool.includes(\"curl\")\n\t\t\t) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst archivePattern = /\\b(tar|zip|7z|gzip|bzip2|xz)\\b.*-[a-z]*[cf]/i;\n\t\t\tconst archiveOps = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 180_000) return false;\n\t\t\t\treturn commandMatches(r.args, archivePattern);\n\t\t\t});\n\n\t\t\tif (archiveOps.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Network egress after creating archive - possible data exfiltration\",\n\t\t\t\t\tmatchingRecords: archiveOps,\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"exfil-db-dump\",\n\t\tdescription: \"Database dump followed by network transfer\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 300_000,\n\t\tdetect: (records, currentTool, _currentArgs) => {\n\t\t\tconst normalizedTool = currentTool.toLowerCase();\n\t\t\tif (\n\t\t\t\t!normalizedTool.includes(\"fetch\") &&\n\t\t\t\t!normalizedTool.includes(\"http\")\n\t\t\t) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst dbDumpPattern =\n\t\t\t\t/pg_dump|mysqldump|mongodump|sqlite3.*\\.dump|redis-cli.*save/i;\n\t\t\tconst dbDumps = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 300_000) return false;\n\t\t\t\treturn commandMatches(r.args, dbDumpPattern);\n\t\t\t});\n\n\t\t\tif (dbDumps.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Network egress after database dump - critical data exfiltration risk\",\n\t\t\t\t\tmatchingRecords: dbDumps,\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"exfil-curl-post\",\n\t\tdescription: \"Read sensitive data then curl POST\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 120_000,\n\t\tdetect: (records, currentTool, currentArgs) => {\n\t\t\tif (currentTool.toLowerCase() !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst curlPostPattern = /curl.*(-X\\s*POST|--data|--data-binary|-d\\s)/i;\n\t\t\tif (!commandMatches(currentArgs, curlPostPattern)) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst sensitivePattern = /\\.env|secret|credential|password|key|token/i;\n\t\t\tconst sensitiveReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 120_000) return false;\n\t\t\t\treturn r.tags.has(\"read\") && pathMatches(r.args, sensitivePattern);\n\t\t\t});\n\n\t\t\tif (sensitiveReads.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Curl POST after reading sensitive files - possible credential exfiltration\",\n\t\t\t\t\tmatchingRecords: sensitiveReads,\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n];\n\n/**\n * Privilege Escalation Patterns\n */\nexport const PRIVILEGE_ESCALATION_PATTERNS: SequencePattern[] = [\n\t{\n\t\tid: \"privesc-suid-search\",\n\t\tdescription: \"Find SUID binaries for exploitation\",\n\t\tseverity: \"high\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tif (currentTool.toLowerCase() !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst suidPattern = /find.*-perm.*(4000|2000|-u=s)/i;\n\t\t\tif (commandMatches(currentArgs, suidPattern)) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"SUID binary search detected - possible privilege escalation reconnaissance\",\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"privesc-cron-modify\",\n\t\tdescription: \"Modify cron jobs for persistence/escalation\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tconst cronPattern = /\\/etc\\/cron|crontab|\\/var\\/spool\\/cron/i;\n\t\t\tif (toolMutatesFiles(currentTool)) {\n\t\t\t\tif (pathMatches(currentArgs, cronPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Cron job modification detected - possible privilege escalation or persistence\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"privesc-docker-socket\",\n\t\tdescription:\n\t\t\t\"Access Docker socket for container escape or privilege escalation\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\t// Detect Docker socket access\n\t\t\tconst dockerSocketPattern =\n\t\t\t\t/docker\\.sock|\\/var\\/run\\/docker|docker\\s+run.*--privileged|docker\\s+exec/i;\n\n\t\t\tif (currentTool.toLowerCase() === \"bash\") {\n\t\t\t\tif (commandMatches(currentArgs, dockerSocketPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Docker socket access detected - possible container escape or privilege escalation\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Also check for direct file reads of docker socket\n\t\t\tif (currentTool.toLowerCase() === \"read\") {\n\t\t\t\tconst sockPattern = /docker\\.sock|\\/var\\/run\\/docker/i;\n\t\t\t\tif (pathMatches(currentArgs, sockPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Docker socket read detected - possible privilege escalation\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n];\n\n/**\n * Reconnaissance Patterns\n */\nexport const RECONNAISSANCE_PATTERNS: SequencePattern[] = [\n\t{\n\t\tid: \"recon-network-scan\",\n\t\tdescription: \"Network scanning and enumeration\",\n\t\tseverity: \"high\",\n\t\taction: \"block\",\n\t\twindowMs: 120_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tif (currentTool.toLowerCase() !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst networkScanPattern = /\\b(nmap|netstat|ss\\s+-|lsof\\s+-i|arp\\s)\\b/i;\n\t\t\tif (commandMatches(currentArgs, networkScanPattern)) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Network scanning detected - possible reconnaissance activity\",\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"lateral-ssh-movement\",\n\t\tdescription: \"SSH key access followed by SSH connection attempts\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 180_000,\n\t\tdetect: (records, currentTool, currentArgs) => {\n\t\t\tif (currentTool.toLowerCase() !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Check if current command is SSH connection\n\t\t\tconst sshConnectPattern = /\\bssh\\s+[^-]|ssh\\s+-[^-]*\\s+\\w/i;\n\t\t\tif (!commandMatches(currentArgs, sshConnectPattern)) {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\t// Look for recent SSH key reads\n\t\t\tconst sshKeyPattern = /\\.ssh\\/id_|\\.ssh\\/.*_key|\\.ssh\\/config/i;\n\t\t\tconst sshKeyReads = records.filter((r) => {\n\t\t\t\tconst ageMs = Date.now() - r.timestamp;\n\t\t\t\tif (ageMs > 180_000) return false;\n\t\t\t\treturn r.tags.has(\"read\") && pathMatches(r.args, sshKeyPattern);\n\t\t\t});\n\n\t\t\tif (sshKeyReads.length > 0) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"SSH connection attempt after reading SSH keys - possible lateral movement\",\n\t\t\t\t\tmatchingRecords: sshKeyReads,\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n];\n\n/**\n * Persistence Patterns\n */\nexport const PERSISTENCE_PATTERNS: SequencePattern[] = [\n\t{\n\t\tid: \"persist-ssh-key\",\n\t\tdescription: \"Write to SSH authorized_keys\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tconst sshPattern = /\\.ssh\\/authorized_keys|\\.ssh\\/id_/i;\n\t\t\tif (toolMutatesFiles(currentTool)) {\n\t\t\t\tif (pathMatches(currentArgs, sshPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"SSH key installation detected - possible unauthorized access persistence\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"persist-shell-profile\",\n\t\tdescription: \"Modify shell startup files\",\n\t\tseverity: \"high\",\n\t\taction: \"require_approval\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tconst profilePattern =\n\t\t\t\t/\\.bashrc|\\.bash_profile|\\.zshrc|\\.profile|\\.bash_login/i;\n\t\t\tif (toolMutatesFiles(currentTool)) {\n\t\t\t\tif (pathMatches(currentArgs, profilePattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Shell profile modification detected - may establish persistence\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"persist-systemd\",\n\t\tdescription: \"Create systemd service for persistence\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tconst systemdPattern = /\\/etc\\/systemd|\\.config\\/systemd|\\.service$/i;\n\t\t\tif (toolMutatesFiles(currentTool)) {\n\t\t\t\tif (pathMatches(currentArgs, systemdPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Systemd service creation detected - possible persistence mechanism\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"persist-ld-preload\",\n\t\tdescription: \"LD_PRELOAD injection via shell profile modification\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\t// Check for LD_PRELOAD being written to profile files\n\t\t\tif (\n\t\t\t\tcurrentTool.toLowerCase() === \"write\" ||\n\t\t\t\tcurrentTool.toLowerCase() === \"edit\" ||\n\t\t\t\tcurrentTool.toLowerCase() === \"apply_patch\" ||\n\t\t\t\tcurrentTool.toLowerCase() === \"bash\"\n\t\t\t) {\n\t\t\t\t// Check for LD_PRELOAD in command or file content\n\t\t\t\tconst ldPreloadPattern = /LD_PRELOAD/i;\n\t\t\t\tconst profilePattern =\n\t\t\t\t\t/\\.bashrc|\\.bash_profile|\\.zshrc|\\.profile|\\/etc\\/environment|\\/etc\\/ld\\.so\\.preload/i;\n\n\t\t\t\tif (currentTool.toLowerCase() === \"bash\") {\n\t\t\t\t\tif (commandMatches(currentArgs, ldPreloadPattern)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\t\"LD_PRELOAD injection attempt detected - possible persistence mechanism\",\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t} else if (pathMatches(currentArgs, profilePattern)) {\n\t\t\t\t\t// If writing to profile files, check for LD_PRELOAD in content\n\t\t\t\t\tconst content = mutationContent(currentArgs);\n\t\t\t\t\tif (content && ldPreloadPattern.test(content)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\t\"LD_PRELOAD written to shell profile - possible persistence mechanism\",\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"persist-git-hooks\",\n\t\tdescription: \"Modify git hooks for code execution\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tconst gitHooksPattern = /\\.git\\/hooks\\//i;\n\t\t\tif (toolMutatesFiles(currentTool)) {\n\t\t\t\tif (pathMatches(currentArgs, gitHooksPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Git hooks modification detected - possible persistence mechanism\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n\t{\n\t\tid: \"persist-pam-backdoor\",\n\t\tdescription: \"Modify PAM configuration for authentication bypass\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tconst pamPattern = /\\/etc\\/pam\\.d\\/|\\/etc\\/pam\\.conf|pam_.*\\.so/i;\n\t\t\tif (toolMutatesFiles(currentTool)) {\n\t\t\t\tif (pathMatches(currentArgs, pamPattern)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tmatched: true,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"PAM configuration modification detected - possible authentication backdoor\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n];\n\n/**\n * Defense Evasion Patterns\n */\nexport const DEFENSE_EVASION_PATTERNS: SequencePattern[] = [\n\t{\n\t\tid: \"evasion-log-clear\",\n\t\tdescription: \"Attempt to clear system logs\",\n\t\tseverity: \"critical\",\n\t\taction: \"block\",\n\t\twindowMs: 60_000,\n\t\tdetect: (_records, currentTool, currentArgs) => {\n\t\t\tif (currentTool.toLowerCase() !== \"bash\") {\n\t\t\t\treturn { matched: false };\n\t\t\t}\n\n\t\t\tconst logClearPattern =\n\t\t\t\t/>\\s*\\/var\\/log|rm\\s.*\\/var\\/log|truncate.*\\/var\\/log|history\\s+-c/i;\n\t\t\tif (commandMatches(currentArgs, logClearPattern)) {\n\t\t\t\treturn {\n\t\t\t\t\tmatched: true,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Log clearing attempt detected - possible evidence destruction\",\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { matched: false };\n\t\t},\n\t},\n];\n\n/**\n * All attack patterns combined\n */\nexport const ALL_ATTACK_PATTERNS: SequencePattern[] = [\n\t...CREDENTIAL_HARVESTING_PATTERNS,\n\t...DATA_EXFILTRATION_PATTERNS,\n\t...PRIVILEGE_ESCALATION_PATTERNS,\n\t...RECONNAISSANCE_PATTERNS,\n\t...PERSISTENCE_PATTERNS,\n\t...DEFENSE_EVASION_PATTERNS,\n];\n\n/**\n * Get metadata for an attack pattern\n */\nexport function getPatternMetadata(\n\tpatternId: string,\n): AttackPatternMetadata | undefined {\n\treturn ATTACK_PATTERN_METADATA[patternId];\n}\n\n/**\n * Get patterns by category\n */\nexport function getPatternsByCategory(\n\tcategory: AttackCategory,\n): SequencePattern[] {\n\treturn ALL_ATTACK_PATTERNS.filter((p) => {\n\t\tconst meta = ATTACK_PATTERN_METADATA[p.id];\n\t\treturn meta?.category === category;\n\t});\n}\n\n/**\n * Get patterns by severity\n */\nexport function getPatternsBySeverity(\n\tseverity: \"low\" | \"medium\" | \"high\" | \"critical\",\n): SequencePattern[] {\n\treturn ALL_ATTACK_PATTERNS.filter((p) => p.severity === severity);\n}\n"]}
package/dist/safety/bash-parser.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"bash-parser.d.ts","sourceRoot":"","sources":["../../src/safety/bash-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AA0FH;;;GAGG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE1D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,sBAAsB,EAAE,OAAO,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAyKD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CA4FjE;AAkCD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG;IACtD,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,eAAe,CAAC;CACxB,CAuFA;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAkC3D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiCjE"}
1
+ {"version":3,"file":"bash-parser.d.ts","sourceRoot":"","sources":["../../src/safety/bash-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AA2GH;;;GAGG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE1D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,sBAAsB,EAAE,OAAO,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAyKD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CA4FjE;AAkCD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG;IACtD,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,eAAe,CAAC;CACxB,CAuFA;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAkC3D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiCjE"}
package/dist/safety/bash-parser.js CHANGED
@@ -49,6 +49,8 @@ import { basename } from "node:path";
49
49
  import { createLogger } from "../utils/logger.js";
50
50
  const logger = createLogger("safety:bash-parser");
51
51
  const isTestEnv = process.env.VITEST === "true" || process.env.NODE_ENV === "test";
52
+ const treeSitterModuleName = "tree-sitter";
53
+ const treeSitterBashModuleName = "tree-sitter-bash";
52
54
  /**
53
55
  * Parser State - Lazy initialization with singleton pattern
54
56
  *
@@ -92,11 +94,10 @@ async function initParser() {
92
94
  try {
93
95
  // Dynamic imports for native modules - may fail if bindings missing
94
96
  const [Parser, BashLanguage] = await Promise.all([
95
- import("tree-sitter").then((m) => m.default),
96
- import("tree-sitter-bash").then((m) => m.default),
97
+ import(treeSitterModuleName).then((m) => (m.default ?? m)),
98
+ import(treeSitterBashModuleName).then((m) => m.default ?? m),
97
99
  ]);
98
100
  parser = new Parser();
99
- // Type cast needed because tree-sitter-bash types don't perfectly align
100
101
  parser.setLanguage(BashLanguage);
101
102
  parserAvailable = true;
102
103
  logger.debug("Tree-sitter bash parser initialized successfully");
package/dist/safety/bash-parser.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"bash-parser.js","sourceRoot":"","sources":["../../src/safety/bash-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;AAClD,MAAM,SAAS,GACd,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;AAMlE;;;;;;;;;;GAUG;AACH,IAAI,MAAM,GAAsB,IAAI,CAAC;AACrC,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAC9B,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,KAAK,UAAU,UAAU;IACxB,6CAA6C;IAC7C,IAAI,iBAAiB;QAAE,OAAO,eAAe,CAAC;IAC9C,iBAAiB,GAAG,IAAI,CAAC;IAEzB,IAAI,CAAC;QACJ,oEAAoE;QACpE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5C,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACjD,CAAC,CAAC;QACH,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACtB,wEAAwE;QACxE,MAAM,CAAC,WAAW,CAAC,YAA8C,CAAC,CAAC;QACnE,eAAe,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,0DAA0D;QAC1D,MAAM,OAAO,GACZ,iEAAiE,CAAC;QACnE,MAAM,OAAO,GAAG;YACf,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,eAAe,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED,iEAAiE;AACjE,0DAA0D;AAC1D,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC1B,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;QAC5C,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;KACvD,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACtC,OAAO,UAAU,EAAE,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAChC,OAAO,eAAe,CAAC;AACxB,CAAC;AAmBD,SAAS,kBAAkB,CAAC,KAAa;IACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,IAAI,IAAI,KAAK,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC7B,eAAe;IACf,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,uBAAuB;IACvB,MAAM;IACN,IAAI;IACJ,MAAM;IACN,oBAAoB;IACpB,IAAI;IACJ,KAAK;IACL,MAAM;IACN,oBAAoB;IACpB,MAAM;IACN,QAAQ;IACR,8BAA8B;IAC9B,IAAI;IACJ,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,IAAI;IACJ,KAAK;IACL,KAAK,EAAE,8BAA8B;IACrC,gBAAgB;IAChB,MAAM;IACN,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,iBAAiB;IACjB,OAAO;IACP,SAAS;IACT,MAAM;IACN,gBAAgB;IAChB,KAAK;IACL,MAAM;IACN,cAAc;IACd,MAAM;IACN,KAAK;IACL,QAAQ;IACR,IAAI;IACJ,QAAQ;IACR,UAAU;IACV,OAAO;IACP,KAAK;IACL,UAAU;IACV,eAAe;IACf,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,qBAAqB;IACrB,KAAK;IACL,OAAO;CACP,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACpC,QAAQ,EAAE,sBAAsB;IAChC,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,gCAAgC;IACxC,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,gCAAgC;IAC1C,KAAK,EAAE,yBAAyB;IAChC,QAAQ,EAAE,eAAe;IACzB,QAAQ,EAAE,qBAAqB;IAC/B,UAAU,EAAE,8BAA8B;IAC1C,WAAW,EAAE,gCAAgC;IAC7C,UAAU,EAAE,qBAAqB;IACjC,SAAS,EAAE,qBAAqB;IAChC,OAAO,EAAE,+BAA+B;IACxC,UAAU,EAAE,uBAAuB;IACnC,QAAQ,EAAE,iBAAiB;IAC3B,OAAO,EAAE,iCAAiC;CAC1C,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACzC,OAAO,EAAE,+BAA+B;IACxC,OAAO,EAAE,0BAA0B;IACnC,IAAI,EAAE,kCAAkC;IACxC,MAAM,EAAE,6BAA6B;IACrC,QAAQ,EAAE,mBAAmB;IAC7B,OAAO,EAAE,wBAAwB;IACjC,aAAa,EAAE,kBAAkB;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IAClC,8BAA8B;IAC9B,IAAI;IACJ,OAAO;IACP,OAAO;IACP,4BAA4B;IAC5B,MAAM;IACN,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,2BAA2B;IAC3B,OAAO;IACP,OAAO;IACP,sBAAsB;IACtB,MAAM;IACN,SAAS;IACT,OAAO;IACP,iBAAiB;IACjB,QAAQ;IACR,UAAU;IACV,MAAM;IACN,UAAU;IACV,MAAM;IACN,WAAW;IACX,SAAS;CACT,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,KAAK;YAClB,gBAAgB,EAAE,KAAK;YACvB,sBAAsB,EAAE,KAAK;YAC7B,KAAK,EAAE,sBAAsB;SAC7B,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE3B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,KAAK;gBACnB,WAAW,EAAE,KAAK;gBAClB,gBAAgB,EAAE,KAAK;gBACvB,sBAAsB,EAAE,KAAK;gBAC7B,KAAK,EAAE,wBAAwB;aAC/B,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAoB;YAC/B,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,KAAK;YAClB,gBAAgB,EAAE,KAAK;YACvB,sBAAsB,EAAE,KAAK;SAC7B,CAAC;QAEF,uCAAuC;QACvC,uEAAuE;QACvE,MAAM,IAAI,GAAG,CAAC,IAAgB,EAAE,EAAE;YACjC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,UAAU;oBACd,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;oBACvB,MAAM;gBACP,KAAK,sBAAsB,CAAC;gBAC5B,KAAK,eAAe,CAAC;gBACrB,KAAK,kBAAkB;oBACtB,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;oBAC3B,MAAM;gBACP,KAAK,UAAU;oBACd,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;oBAC1B,MAAM;gBACP,KAAK,sBAAsB;oBAC1B,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC;oBACrC,MAAM;gBACP,KAAK,SAAS,CAAC,CAAC,CAAC;oBAChB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAC7C,IAAI,MAAM,EAAE,CAAC;wBACZ,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC9B,CAAC;oBACD,MAAM;gBACP,CAAC;YACF,CAAC;YAED,+BAA+B;YAC/B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAChC,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnC,IAAI,CAAC,KAAK,CAAC,CAAC;YACb,CAAC;QACF,CAAC,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,CAAC;QACX,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,KAAK;YAClB,gBAAgB,EAAE,KAAK;YACvB,sBAAsB,EAAE,KAAK;YAC7B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC;IACH,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CACtB,IAAgB,EAChB,MAAc;IAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnC,IACC,KAAK,CAAC,IAAI,KAAK,MAAM;YACrB,KAAK,CAAC,IAAI,KAAK,QAAQ;YACvB,KAAK,CAAC,IAAI,KAAK,YAAY,EAC1B,CAAC;YACF,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3D,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO;QACN,OAAO;QACP,IAAI;QACJ,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;KACjD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAKnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO;YACN,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,yBAAyB;YACjD,MAAM;SACN,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,8DAA8D;YACtE,MAAM;SACN,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEhD,wBAAwB;QACxB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO;gBACN,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,yCAAyC;gBACjD,MAAM;aACN,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,mEAAmE;YACnE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAC1D,CAAC;gBACF,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;gBACvE,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;oBAC9B,OAAO;wBACN,IAAI,EAAE,KAAK;wBACX,MAAM,EAAE,6BAA6B,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,IAAI,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ;wBAChJ,MAAM;qBACN,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,OAAO;oBACN,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,kCAAkC,OAAO,EAAE;oBACnD,MAAM;iBACN,CAAC;YACH,CAAC;QACF,CAAC;QAED,qBAAqB;QACrB,IAAI,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YAChC,IAAI,yBAAyB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/C,OAAO;oBACN,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,OAAO,UAAU,8BAA8B;oBACvD,MAAM;iBACN,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,gEAAgE;IAChE,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,KAAK,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO;gBACN,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,uDAAuD;gBAC/D,MAAM;aACN,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IACjD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,qCAAqC;IACrC,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACd,CAAC;IAED,qBAAqB;IACrB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEhD,qCAAqC;QACrC,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,SAAS;QACV,CAAC;QAED,mCAAmC;QACnC,IAAI,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YAChC,IAAI,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC1C,SAAS;YACV,CAAC;QACF,CAAC;QAED,2BAA2B;QAC3B,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IACjD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEhD,qCAAqC;IACrC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;QACpE,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACnD,yDAAyD;YACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IACC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACpD,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACnD,CAAC;gBACF,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC","sourcesContent":["/**\n * Bash Command Parser - Tree-sitter based shell command analysis for safety\n *\n * This module provides structured parsing of shell commands using tree-sitter,\n * enabling accurate detection of dangerous patterns that regex-based approaches\n * often miss or incorrectly flag.\n *\n * ## Why Tree-Sitter?\n *\n * Regex-based command detection is fundamentally limited:\n * - `rm -rf /` is dangerous, but `echo \"rm -rf /\"` is not\n * - `git push --force` is dangerous, but only in certain contexts\n * - Command substitution `$(...)` can hide dangerous commands\n *\n * Tree-sitter produces a proper AST, letting us:\n * - Distinguish command names from arguments and strings\n * - Detect pipes, redirects, and subshells structurally\n * - Unwrap shell wrappers (`bash -c \"...\"`) for inner analysis\n *\n * ## Lazy Initialization\n *\n * Tree-sitter requires native bindings that may not be available:\n * - Development: Usually available via npm install\n * - Production: May be stripped in minimal deployments\n * - CI/CD: May not have build tools for native compilation\n *\n * We use lazy initialization with graceful fallback:\n * 1. Try to load native modules on first use\n * 2. Cache the result (available or not)\n * 3. Fall back to regex-based checks if unavailable\n *\n * ## Parse Result Structure\n *\n * ```typescript\n * {\n * success: true,\n * commands: [{ program: \"rm\", args: [\"-rf\", \"/tmp/foo\"], raw: \"rm -rf /tmp/foo\" }],\n * hasPipes: false,\n * hasRedirects: true,\n * hasSubshell: false,\n * hasBackgroundJob: false,\n * hasCommandSubstitution: false\n * }\n * ```\n *\n * @module safety/bash-parser\n */\n\nimport { basename } from \"node:path\";\nimport { createLogger } from \"../utils/logger.js\";\n\nconst logger = createLogger(\"safety:bash-parser\");\nconst isTestEnv =\n\tprocess.env.VITEST === \"true\" || process.env.NODE_ENV === \"test\";\n\n// Dynamic import types - tree-sitter is loaded at runtime to handle missing bindings\ntype ParserType = InstanceType<typeof import(\"tree-sitter\")>;\ntype SyntaxNode = import(\"tree-sitter\").SyntaxNode;\n\n/**\n * Parser State - Lazy initialization with singleton pattern\n *\n * We use three variables to track initialization state:\n * - parser: The tree-sitter parser instance (null if not available)\n * - parserInitialized: Whether we've attempted initialization\n * - parserAvailable: Whether initialization succeeded\n *\n * This pattern ensures we only try to load native modules once,\n * even if multiple code paths check for parser availability.\n */\nlet parser: ParserType | null = null;\nlet parserInitialized = false;\nlet parserAvailable = false;\n\n/**\n * Initialize Tree-Sitter Parser\n *\n * Attempts to load tree-sitter and the bash grammar. This is async because\n * dynamic imports are promises, and we want to handle errors gracefully.\n *\n * ## Initialization Steps\n *\n * 1. Check if already initialized (return cached result)\n * 2. Dynamically import tree-sitter and tree-sitter-bash\n * 3. Create parser instance and set language\n * 4. Cache result for future calls\n *\n * ## Error Handling\n *\n * If native modules aren't available, we log a warning and set\n * parserAvailable=false. All subsequent parsing attempts will\n * return {success: false} and callers should fall back to regex.\n *\n * @returns Promise resolving to whether parser is available\n */\nasync function initParser(): Promise<boolean> {\n\t// Already initialized - return cached result\n\tif (parserInitialized) return parserAvailable;\n\tparserInitialized = true;\n\n\ttry {\n\t\t// Dynamic imports for native modules - may fail if bindings missing\n\t\tconst [Parser, BashLanguage] = await Promise.all([\n\t\t\timport(\"tree-sitter\").then((m) => m.default),\n\t\t\timport(\"tree-sitter-bash\").then((m) => m.default),\n\t\t]);\n\t\tparser = new Parser();\n\t\t// Type cast needed because tree-sitter-bash types don't perfectly align\n\t\tparser.setLanguage(BashLanguage as import(\"tree-sitter\").Language);\n\t\tparserAvailable = true;\n\t\tlogger.debug(\"Tree-sitter bash parser initialized successfully\");\n\t} catch (error) {\n\t\t// Graceful degradation - parser features will be disabled\n\t\tconst message =\n\t\t\t\"Tree-sitter bash parser not available (native bindings missing)\";\n\t\tconst context = {\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t};\n\t\tif (isTestEnv) {\n\t\t\tlogger.debug(message, context);\n\t\t} else {\n\t\t\tlogger.warn(message, context);\n\t\t}\n\t\tparserAvailable = false;\n\t}\n\treturn parserAvailable;\n}\n\n// Kick off initialization eagerly but don't block module loading\n// This way the parser may be ready by the time we need it\ninitParser().catch((err) => {\n\tlogger.debug(\"Parser initialization failed\", {\n\t\terror: err instanceof Error ? err.message : String(err),\n\t});\n});\n\n/**\n * Ensure the parser is ready. Call this before using parser functions in tests.\n * Returns true if parser is available, false otherwise.\n */\nexport async function ensureParserReady(): Promise<boolean> {\n\treturn initParser();\n}\n\n/**\n * Check if the parser is available (for sync checks).\n */\nexport function isParserAvailable(): boolean {\n\treturn parserAvailable;\n}\n\nexport interface ParsedCommand {\n\tprogram: string;\n\targs: string[];\n\traw: string;\n}\n\nexport interface BashParseResult {\n\tsuccess: boolean;\n\tcommands: ParsedCommand[];\n\thasPipes: boolean;\n\thasRedirects: boolean;\n\thasSubshell: boolean;\n\thasBackgroundJob: boolean;\n\thasCommandSubstitution: boolean;\n\terror?: string;\n}\n\nfunction resolveProgramName(value: string): string {\n\tconst name = basename(value);\n\treturn name || value;\n}\n\n/**\n * Safe Command Allowlist - Read-only commands that don't modify system state\n *\n * These commands are considered safe for autonomous execution without approval\n * because they only read data, never write. This enables the agent to explore\n * the filesystem and gather information freely.\n *\n * ## Criteria for inclusion\n *\n * 1. Command is purely read-only by default\n * 2. No common flags that enable writing (or we check for them separately)\n * 3. Cannot be used to exfiltrate sensitive data in dangerous ways\n *\n * ## Notable edge cases\n *\n * - `sed`: Listed here because it's read-only without -i flag. We check for\n * -i separately in analyzeCommandSafety().\n * - `tee`: Can write to files, but primarily used for reading in pipelines.\n * Included because blocking it breaks common patterns.\n * - `xargs`: Executes other commands, but the executed command is analyzed.\n */\nconst SAFE_COMMANDS = new Set([\n\t// File reading\n\t\"cat\",\n\t\"head\",\n\t\"tail\",\n\t\"less\",\n\t\"more\",\n\t// Search and filtering\n\t\"grep\",\n\t\"rg\",\n\t\"find\",\n\t// Directory listing\n\t\"ls\",\n\t\"pwd\",\n\t\"tree\",\n\t// Output formatting\n\t\"echo\",\n\t\"printf\",\n\t// Text processing (read-only)\n\t\"wc\",\n\t\"sort\",\n\t\"uniq\",\n\t\"diff\",\n\t\"cut\",\n\t\"tr\",\n\t\"awk\",\n\t\"sed\", // read-only when not using -i\n\t// File metadata\n\t\"file\",\n\t\"stat\",\n\t\"du\",\n\t\"df\",\n\t// Command lookup\n\t\"which\",\n\t\"whereis\",\n\t\"type\",\n\t// Documentation\n\t\"man\",\n\t\"help\",\n\t// System info\n\t\"date\",\n\t\"cal\",\n\t\"whoami\",\n\t\"id\",\n\t\"groups\",\n\t\"hostname\",\n\t\"uname\",\n\t\"env\",\n\t\"printenv\",\n\t// Modern tools\n\t\"bat\",\n\t\"jq\",\n\t\"yq\",\n\t// Pipeline utilities\n\t\"tee\",\n\t\"xargs\",\n]);\n\n/**\n * Safe Git Subcommands - Read-only git operations\n *\n * These git subcommands don't modify repository state and are safe for\n * autonomous execution. The agent can freely explore git history.\n */\nconst SAFE_GIT_SUBCOMMANDS = new Set([\n\t\"status\", // Working tree status\n\t\"log\", // Commit history\n\t\"diff\", // Changes between commits/trees\n\t\"show\", // Show objects\n\t\"branch\", // List branches (without -d/-D)\n\t\"tag\", // List tags (without -d)\n\t\"remote\", // List remotes\n\t\"config\", // Read config values\n\t\"describe\", // Find tag/commit description\n\t\"rev-parse\", // Parse revision specifications\n\t\"ls-files\", // List tracked files\n\t\"ls-tree\", // List tree contents\n\t\"blame\", // Show line-by-line authorship\n\t\"shortlog\", // Summarize log output\n\t\"reflog\", // Reference logs\n\t\"stash\", // When just listing (stash list)\n]);\n\n/**\n * Dangerous Git Subcommands - Operations that modify repository state\n *\n * These require approval because they can lose work or affect remote state.\n */\nconst DANGEROUS_GIT_SUBCOMMANDS = new Set([\n\t\"reset\", // Can lose uncommitted changes\n\t\"clean\", // Removes untracked files\n\t\"rm\", // Removes files from working tree\n\t\"push\", // Modifies remote repository\n\t\"rebase\", // Rewrites history\n\t\"merge\", // Creates merge commits\n\t\"cherry-pick\", // Applies commits\n]);\n\n/**\n * Dangerous Commands - Operations that should always require approval\n *\n * These commands can cause data loss, system damage, or security issues.\n * They require explicit user approval before execution.\n *\n * ## Categories\n *\n * - **Destructive**: rm, rmdir, shred - delete files/directories\n * - **Disk operations**: mkfs, dd, fdisk, parted, format - modify disks\n * - **Permissions**: chmod, chown - modify file access controls\n * - **Process control**: kill, killall, pkill - terminate processes\n * - **System control**: reboot, shutdown, halt, poweroff, init - system state\n * - **Service management**: systemctl, service - modify running services\n */\nconst DANGEROUS_COMMANDS = new Set([\n\t// Destructive file operations\n\t\"rm\",\n\t\"rmdir\",\n\t\"shred\",\n\t// Low-level disk operations\n\t\"mkfs\",\n\t\"dd\",\n\t\"fdisk\",\n\t\"parted\",\n\t\"format\",\n\t// Permission modifications\n\t\"chmod\",\n\t\"chown\",\n\t// Process termination\n\t\"kill\",\n\t\"killall\",\n\t\"pkill\",\n\t// System control\n\t\"reboot\",\n\t\"shutdown\",\n\t\"halt\",\n\t\"poweroff\",\n\t\"init\",\n\t\"systemctl\",\n\t\"service\",\n]);\n\n/**\n * Parse a bash command string into structured components.\n * Returns a result indicating parser unavailability if tree-sitter isn't loaded.\n */\nexport function parseBashCommand(command: string): BashParseResult {\n\tif (!parser || !parserAvailable) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\tcommands: [],\n\t\t\thasPipes: false,\n\t\t\thasRedirects: false,\n\t\t\thasSubshell: false,\n\t\t\thasBackgroundJob: false,\n\t\t\thasCommandSubstitution: false,\n\t\t\terror: \"Parser not available\",\n\t\t};\n\t}\n\n\ttry {\n\t\tconst tree = parser.parse(command);\n\t\tconst root = tree.rootNode;\n\n\t\tif (root.hasError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\tcommands: [],\n\t\t\t\thasPipes: false,\n\t\t\t\thasRedirects: false,\n\t\t\t\thasSubshell: false,\n\t\t\t\thasBackgroundJob: false,\n\t\t\t\thasCommandSubstitution: false,\n\t\t\t\terror: \"Parse error in command\",\n\t\t\t};\n\t\t}\n\n\t\tconst result: BashParseResult = {\n\t\t\tsuccess: true,\n\t\t\tcommands: [],\n\t\t\thasPipes: false,\n\t\t\thasRedirects: false,\n\t\t\thasSubshell: false,\n\t\t\thasBackgroundJob: false,\n\t\t\thasCommandSubstitution: false,\n\t\t};\n\n\t\t// Walk the tree to extract information\n\t\t// Using 'any' here since the SyntaxNode type comes from dynamic import\n\t\tconst walk = (node: SyntaxNode) => {\n\t\t\tswitch (node.type) {\n\t\t\t\tcase \"pipeline\":\n\t\t\t\t\tresult.hasPipes = true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"redirected_statement\":\n\t\t\t\tcase \"file_redirect\":\n\t\t\t\tcase \"heredoc_redirect\":\n\t\t\t\t\tresult.hasRedirects = true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"subshell\":\n\t\t\t\t\tresult.hasSubshell = true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"command_substitution\":\n\t\t\t\t\tresult.hasCommandSubstitution = true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"command\": {\n\t\t\t\t\tconst parsed = extractCommand(node, command);\n\t\t\t\t\tif (parsed) {\n\t\t\t\t\t\tresult.commands.push(parsed);\n\t\t\t\t\t}\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Check for background job (&)\n\t\t\tif (node.type === \"list\" && command.includes(\"&\")) {\n\t\t\t\tresult.hasBackgroundJob = true;\n\t\t\t}\n\n\t\t\tfor (const child of node.children) {\n\t\t\t\twalk(child);\n\t\t\t}\n\t\t};\n\n\t\twalk(root);\n\t\treturn result;\n\t} catch (error) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\tcommands: [],\n\t\t\thasPipes: false,\n\t\t\thasRedirects: false,\n\t\t\thasSubshell: false,\n\t\t\thasBackgroundJob: false,\n\t\t\thasCommandSubstitution: false,\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t};\n\t}\n}\n\n/**\n * Extract command name and arguments from a command node.\n */\nfunction extractCommand(\n\tnode: SyntaxNode,\n\tsource: string,\n): ParsedCommand | null {\n\tconst nameNode = node.childForFieldName(\"name\");\n\tif (!nameNode) return null;\n\n\tconst program = source.slice(nameNode.startIndex, nameNode.endIndex);\n\tconst args: string[] = [];\n\n\tfor (const child of node.children) {\n\t\tif (\n\t\t\tchild.type === \"word\" ||\n\t\t\tchild.type === \"string\" ||\n\t\t\tchild.type === \"raw_string\"\n\t\t) {\n\t\t\tif (child !== nameNode) {\n\t\t\t\targs.push(source.slice(child.startIndex, child.endIndex));\n\t\t\t}\n\t\t}\n\t}\n\n\treturn {\n\t\tprogram,\n\t\targs,\n\t\traw: source.slice(node.startIndex, node.endIndex),\n\t};\n}\n\n/**\n * Analyze a command for safety.\n */\nexport function analyzeCommandSafety(command: string): {\n\tsafe: boolean;\n\treason?: string;\n\tparsed: BashParseResult;\n} {\n\tconst parsed = parseBashCommand(command);\n\n\tif (!parsed.success) {\n\t\treturn {\n\t\t\tsafe: false,\n\t\t\treason: parsed.error || \"Failed to parse command\",\n\t\t\tparsed,\n\t\t};\n\t}\n\n\t// Check for dangerous constructs\n\tif (parsed.hasCommandSubstitution) {\n\t\treturn {\n\t\t\tsafe: false,\n\t\t\treason: \"Command contains command substitution ($(...) or backticks)\",\n\t\t\tparsed,\n\t\t};\n\t}\n\n\t// Analyze each command in the pipeline\n\tfor (const cmd of parsed.commands) {\n\t\tconst program = resolveProgramName(cmd.program);\n\n\t\t// Check for sudo prefix\n\t\tif (program === \"sudo\") {\n\t\t\treturn {\n\t\t\t\tsafe: false,\n\t\t\t\treason: \"Command uses sudo (elevated privileges)\",\n\t\t\t\tparsed,\n\t\t\t};\n\t\t}\n\n\t\t// Check for dangerous commands\n\t\tif (DANGEROUS_COMMANDS.has(program)) {\n\t\t\t// Special case: rm without -r or -f might be okay for single files\n\t\t\tif (program === \"rm\") {\n\t\t\t\tconst hasRecursive = cmd.args.some(\n\t\t\t\t\t(a) => a.includes(\"-r\") || a.includes(\"-R\") || a === \"-rf\",\n\t\t\t\t);\n\t\t\t\tconst hasForce = cmd.args.some((a) => a.includes(\"-f\") || a === \"-rf\");\n\t\t\t\tif (hasRecursive || hasForce) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsafe: false,\n\t\t\t\t\t\treason: `Dangerous rm command with ${hasRecursive ? \"recursive\" : \"\"}${hasRecursive && hasForce ? \" and \" : \"\"}${hasForce ? \"force\" : \"\"} flags`,\n\t\t\t\t\t\tparsed,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\treturn {\n\t\t\t\t\tsafe: false,\n\t\t\t\t\treason: `Potentially dangerous command: ${program}`,\n\t\t\t\t\tparsed,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check git commands\n\t\tif (program === \"git\" && cmd.args.length > 0) {\n\t\t\tconst subcommand = cmd.args[0]!;\n\t\t\tif (DANGEROUS_GIT_SUBCOMMANDS.has(subcommand)) {\n\t\t\t\treturn {\n\t\t\t\t\tsafe: false,\n\t\t\t\t\treason: `Git ${subcommand} can modify repository state`,\n\t\t\t\t\tparsed,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\t// If we have pipes or redirects with non-safe commands, flag it\n\tif (parsed.hasPipes || parsed.hasRedirects) {\n\t\tconst allSafe = parsed.commands.every((cmd) => {\n\t\t\tconst program = resolveProgramName(cmd.program);\n\t\t\treturn SAFE_COMMANDS.has(program) || program === \"git\";\n\t\t});\n\n\t\tif (!allSafe) {\n\t\t\treturn {\n\t\t\t\tsafe: false,\n\t\t\t\treason: \"Command pipeline contains potentially unsafe commands\",\n\t\t\t\tparsed,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn { safe: true, parsed };\n}\n\n/**\n * Check if a command is known to be safe (read-only).\n */\nexport function isKnownSafeCommand(command: string): boolean {\n\tconst parsed = parseBashCommand(command);\n\n\tif (!parsed.success || parsed.commands.length === 0) {\n\t\treturn false;\n\t}\n\n\t// Command substitution is never safe\n\tif (parsed.hasCommandSubstitution) {\n\t\treturn false;\n\t}\n\n\t// Check each command\n\tfor (const cmd of parsed.commands) {\n\t\tconst program = resolveProgramName(cmd.program);\n\n\t\t// Check if it's a known safe command\n\t\tif (SAFE_COMMANDS.has(program)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Check if it's a safe git command\n\t\tif (program === \"git\" && cmd.args.length > 0) {\n\t\t\tconst subcommand = cmd.args[0]!;\n\t\t\tif (SAFE_GIT_SUBCOMMANDS.has(subcommand)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t}\n\n\t\t// Not a known safe command\n\t\treturn false;\n\t}\n\n\treturn true;\n}\n\n/**\n * Extract the inner command from bash -c or similar wrappers.\n */\nexport function unwrapShellCommand(command: string): string | null {\n\tconst parsed = parseBashCommand(command);\n\n\tif (!parsed.success || parsed.commands.length !== 1) {\n\t\treturn null;\n\t}\n\n\tconst cmd = parsed.commands[0];\n\tif (!cmd) {\n\t\treturn null;\n\t}\n\tconst program = resolveProgramName(cmd.program);\n\n\t// Check for bash/sh/zsh with -c flag\n\tif ([\"bash\", \"sh\", \"zsh\"].includes(program)) {\n\t\tconst cIndex = cmd.args.findIndex((a) => a === \"-c\" || a === \"-lc\");\n\t\tif (cIndex !== -1 && cIndex + 1 < cmd.args.length) {\n\t\t\t// Return the command string (removing quotes if present)\n\t\t\tconst innerCmd = cmd.args[cIndex + 1];\n\t\t\tif (!innerCmd) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tif (\n\t\t\t\t(innerCmd.startsWith('\"') && innerCmd.endsWith('\"')) ||\n\t\t\t\t(innerCmd.startsWith(\"'\") && innerCmd.endsWith(\"'\"))\n\t\t\t) {\n\t\t\t\treturn innerCmd.slice(1, -1);\n\t\t\t}\n\t\t\treturn innerCmd;\n\t\t}\n\t}\n\n\treturn null;\n}\n"]}
1
+ {"version":3,"file":"bash-parser.js","sourceRoot":"","sources":["../../src/safety/bash-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;AAClD,MAAM,SAAS,GACd,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;AAmBlE,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAC3C,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,IAAI,MAAM,GAAsB,IAAI,CAAC;AACrC,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAC9B,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,KAAK,UAAU,UAAU;IACxB,6CAA6C;IAC7C,IAAI,iBAAiB;QAAE,OAAO,eAAe,CAAC;IAC9C,iBAAiB,GAAG,IAAI,CAAC;IAEzB,IAAI,CAAC;QACJ,oEAAoE;QACpE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAsB,CAC5C;YACD,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;SAC5D,CAAC,CAAC;QACH,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACjC,eAAe,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,0DAA0D;QAC1D,MAAM,OAAO,GACZ,iEAAiE,CAAC;QACnE,MAAM,OAAO,GAAG;YACf,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,eAAe,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED,iEAAiE;AACjE,0DAA0D;AAC1D,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC1B,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;QAC5C,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;KACvD,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACtC,OAAO,UAAU,EAAE,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAChC,OAAO,eAAe,CAAC;AACxB,CAAC;AAmBD,SAAS,kBAAkB,CAAC,KAAa;IACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,IAAI,IAAI,KAAK,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC7B,eAAe;IACf,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,uBAAuB;IACvB,MAAM;IACN,IAAI;IACJ,MAAM;IACN,oBAAoB;IACpB,IAAI;IACJ,KAAK;IACL,MAAM;IACN,oBAAoB;IACpB,MAAM;IACN,QAAQ;IACR,8BAA8B;IAC9B,IAAI;IACJ,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,IAAI;IACJ,KAAK;IACL,KAAK,EAAE,8BAA8B;IACrC,gBAAgB;IAChB,MAAM;IACN,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,iBAAiB;IACjB,OAAO;IACP,SAAS;IACT,MAAM;IACN,gBAAgB;IAChB,KAAK;IACL,MAAM;IACN,cAAc;IACd,MAAM;IACN,KAAK;IACL,QAAQ;IACR,IAAI;IACJ,QAAQ;IACR,UAAU;IACV,OAAO;IACP,KAAK;IACL,UAAU;IACV,eAAe;IACf,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,qBAAqB;IACrB,KAAK;IACL,OAAO;CACP,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACpC,QAAQ,EAAE,sBAAsB;IAChC,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,gCAAgC;IACxC,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,gCAAgC;IAC1C,KAAK,EAAE,yBAAyB;IAChC,QAAQ,EAAE,eAAe;IACzB,QAAQ,EAAE,qBAAqB;IAC/B,UAAU,EAAE,8BAA8B;IAC1C,WAAW,EAAE,gCAAgC;IAC7C,UAAU,EAAE,qBAAqB;IACjC,SAAS,EAAE,qBAAqB;IAChC,OAAO,EAAE,+BAA+B;IACxC,UAAU,EAAE,uBAAuB;IACnC,QAAQ,EAAE,iBAAiB;IAC3B,OAAO,EAAE,iCAAiC;CAC1C,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACzC,OAAO,EAAE,+BAA+B;IACxC,OAAO,EAAE,0BAA0B;IACnC,IAAI,EAAE,kCAAkC;IACxC,MAAM,EAAE,6BAA6B;IACrC,QAAQ,EAAE,mBAAmB;IAC7B,OAAO,EAAE,wBAAwB;IACjC,aAAa,EAAE,kBAAkB;CACjC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IAClC,8BAA8B;IAC9B,IAAI;IACJ,OAAO;IACP,OAAO;IACP,4BAA4B;IAC5B,MAAM;IACN,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,2BAA2B;IAC3B,OAAO;IACP,OAAO;IACP,sBAAsB;IACtB,MAAM;IACN,SAAS;IACT,OAAO;IACP,iBAAiB;IACjB,QAAQ;IACR,UAAU;IACV,MAAM;IACN,UAAU;IACV,MAAM;IACN,WAAW;IACX,SAAS;CACT,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,KAAK;YAClB,gBAAgB,EAAE,KAAK;YACvB,sBAAsB,EAAE,KAAK;YAC7B,KAAK,EAAE,sBAAsB;SAC7B,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE3B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,KAAK;gBACnB,WAAW,EAAE,KAAK;gBAClB,gBAAgB,EAAE,KAAK;gBACvB,sBAAsB,EAAE,KAAK;gBAC7B,KAAK,EAAE,wBAAwB;aAC/B,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAoB;YAC/B,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,KAAK;YAClB,gBAAgB,EAAE,KAAK;YACvB,sBAAsB,EAAE,KAAK;SAC7B,CAAC;QAEF,uCAAuC;QACvC,uEAAuE;QACvE,MAAM,IAAI,GAAG,CAAC,IAAgB,EAAE,EAAE;YACjC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,UAAU;oBACd,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;oBACvB,MAAM;gBACP,KAAK,sBAAsB,CAAC;gBAC5B,KAAK,eAAe,CAAC;gBACrB,KAAK,kBAAkB;oBACtB,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;oBAC3B,MAAM;gBACP,KAAK,UAAU;oBACd,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;oBAC1B,MAAM;gBACP,KAAK,sBAAsB;oBAC1B,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC;oBACrC,MAAM;gBACP,KAAK,SAAS,CAAC,CAAC,CAAC;oBAChB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAC7C,IAAI,MAAM,EAAE,CAAC;wBACZ,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC9B,CAAC;oBACD,MAAM;gBACP,CAAC;YACF,CAAC;YAED,+BAA+B;YAC/B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAChC,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnC,IAAI,CAAC,KAAK,CAAC,CAAC;YACb,CAAC;QACF,CAAC,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,CAAC;QACX,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,KAAK;YAClB,gBAAgB,EAAE,KAAK;YACvB,sBAAsB,EAAE,KAAK;YAC7B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7D,CAAC;IACH,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CACtB,IAAgB,EAChB,MAAc;IAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnC,IACC,KAAK,CAAC,IAAI,KAAK,MAAM;YACrB,KAAK,CAAC,IAAI,KAAK,QAAQ;YACvB,KAAK,CAAC,IAAI,KAAK,YAAY,EAC1B,CAAC;YACF,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3D,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO;QACN,OAAO;QACP,IAAI;QACJ,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;KACjD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAKnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO;YACN,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,yBAAyB;YACjD,MAAM;SACN,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,8DAA8D;YACtE,MAAM;SACN,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEhD,wBAAwB;QACxB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO;gBACN,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,yCAAyC;gBACjD,MAAM;aACN,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,mEAAmE;YACnE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAC1D,CAAC;gBACF,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;gBACvE,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;oBAC9B,OAAO;wBACN,IAAI,EAAE,KAAK;wBACX,MAAM,EAAE,6BAA6B,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,IAAI,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ;wBAChJ,MAAM;qBACN,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,OAAO;oBACN,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,kCAAkC,OAAO,EAAE;oBACnD,MAAM;iBACN,CAAC;YACH,CAAC;QACF,CAAC;QAED,qBAAqB;QACrB,IAAI,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YAChC,IAAI,yBAAyB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/C,OAAO;oBACN,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,OAAO,UAAU,8BAA8B;oBACvD,MAAM;iBACN,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,gEAAgE;IAChE,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,KAAK,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO;gBACN,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,uDAAuD;gBAC/D,MAAM;aACN,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IACjD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,qCAAqC;IACrC,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACd,CAAC;IAED,qBAAqB;IACrB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEhD,qCAAqC;QACrC,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,SAAS;QACV,CAAC;QAED,mCAAmC;QACnC,IAAI,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YAChC,IAAI,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC1C,SAAS;YACV,CAAC;QACF,CAAC;QAED,2BAA2B;QAC3B,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IACjD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEhD,qCAAqC;IACrC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;QACpE,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACnD,yDAAyD;YACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IACC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACpD,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACnD,CAAC;gBACF,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC","sourcesContent":["/**\n * Bash Command Parser - Tree-sitter based shell command analysis for safety\n *\n * This module provides structured parsing of shell commands using tree-sitter,\n * enabling accurate detection of dangerous patterns that regex-based approaches\n * often miss or incorrectly flag.\n *\n * ## Why Tree-Sitter?\n *\n * Regex-based command detection is fundamentally limited:\n * - `rm -rf /` is dangerous, but `echo \"rm -rf /\"` is not\n * - `git push --force` is dangerous, but only in certain contexts\n * - Command substitution `$(...)` can hide dangerous commands\n *\n * Tree-sitter produces a proper AST, letting us:\n * - Distinguish command names from arguments and strings\n * - Detect pipes, redirects, and subshells structurally\n * - Unwrap shell wrappers (`bash -c \"...\"`) for inner analysis\n *\n * ## Lazy Initialization\n *\n * Tree-sitter requires native bindings that may not be available:\n * - Development: Usually available via npm install\n * - Production: May be stripped in minimal deployments\n * - CI/CD: May not have build tools for native compilation\n *\n * We use lazy initialization with graceful fallback:\n * 1. Try to load native modules on first use\n * 2. Cache the result (available or not)\n * 3. Fall back to regex-based checks if unavailable\n *\n * ## Parse Result Structure\n *\n * ```typescript\n * {\n * success: true,\n * commands: [{ program: \"rm\", args: [\"-rf\", \"/tmp/foo\"], raw: \"rm -rf /tmp/foo\" }],\n * hasPipes: false,\n * hasRedirects: true,\n * hasSubshell: false,\n * hasBackgroundJob: false,\n * hasCommandSubstitution: false\n * }\n * ```\n *\n * @module safety/bash-parser\n */\n\nimport { basename } from \"node:path\";\nimport { createLogger } from \"../utils/logger.js\";\n\nconst logger = createLogger(\"safety:bash-parser\");\nconst isTestEnv =\n\tprocess.env.VITEST === \"true\" || process.env.NODE_ENV === \"test\";\n\n// Tree-sitter is optional at runtime, so keep its compile-time shape local.\ninterface SyntaxNode {\n\ttype: string;\n\thasError: boolean;\n\tchildren: SyntaxNode[];\n\tstartIndex: number;\n\tendIndex: number;\n\tchildForFieldName(name: string): SyntaxNode | null;\n}\n\ninterface ParserType {\n\tparse(input: string): { rootNode: SyntaxNode };\n\tsetLanguage(language: unknown): void;\n}\n\ntype ParserConstructor = new () => ParserType;\n\nconst treeSitterModuleName = \"tree-sitter\";\nconst treeSitterBashModuleName = \"tree-sitter-bash\";\n\n/**\n * Parser State - Lazy initialization with singleton pattern\n *\n * We use three variables to track initialization state:\n * - parser: The tree-sitter parser instance (null if not available)\n * - parserInitialized: Whether we've attempted initialization\n * - parserAvailable: Whether initialization succeeded\n *\n * This pattern ensures we only try to load native modules once,\n * even if multiple code paths check for parser availability.\n */\nlet parser: ParserType | null = null;\nlet parserInitialized = false;\nlet parserAvailable = false;\n\n/**\n * Initialize Tree-Sitter Parser\n *\n * Attempts to load tree-sitter and the bash grammar. This is async because\n * dynamic imports are promises, and we want to handle errors gracefully.\n *\n * ## Initialization Steps\n *\n * 1. Check if already initialized (return cached result)\n * 2. Dynamically import tree-sitter and tree-sitter-bash\n * 3. Create parser instance and set language\n * 4. Cache result for future calls\n *\n * ## Error Handling\n *\n * If native modules aren't available, we log a warning and set\n * parserAvailable=false. All subsequent parsing attempts will\n * return {success: false} and callers should fall back to regex.\n *\n * @returns Promise resolving to whether parser is available\n */\nasync function initParser(): Promise<boolean> {\n\t// Already initialized - return cached result\n\tif (parserInitialized) return parserAvailable;\n\tparserInitialized = true;\n\n\ttry {\n\t\t// Dynamic imports for native modules - may fail if bindings missing\n\t\tconst [Parser, BashLanguage] = await Promise.all([\n\t\t\timport(treeSitterModuleName).then(\n\t\t\t\t(m) => (m.default ?? m) as ParserConstructor,\n\t\t\t),\n\t\t\timport(treeSitterBashModuleName).then((m) => m.default ?? m),\n\t\t]);\n\t\tparser = new Parser();\n\t\tparser.setLanguage(BashLanguage);\n\t\tparserAvailable = true;\n\t\tlogger.debug(\"Tree-sitter bash parser initialized successfully\");\n\t} catch (error) {\n\t\t// Graceful degradation - parser features will be disabled\n\t\tconst message =\n\t\t\t\"Tree-sitter bash parser not available (native bindings missing)\";\n\t\tconst context = {\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t};\n\t\tif (isTestEnv) {\n\t\t\tlogger.debug(message, context);\n\t\t} else {\n\t\t\tlogger.warn(message, context);\n\t\t}\n\t\tparserAvailable = false;\n\t}\n\treturn parserAvailable;\n}\n\n// Kick off initialization eagerly but don't block module loading\n// This way the parser may be ready by the time we need it\ninitParser().catch((err) => {\n\tlogger.debug(\"Parser initialization failed\", {\n\t\terror: err instanceof Error ? err.message : String(err),\n\t});\n});\n\n/**\n * Ensure the parser is ready. Call this before using parser functions in tests.\n * Returns true if parser is available, false otherwise.\n */\nexport async function ensureParserReady(): Promise<boolean> {\n\treturn initParser();\n}\n\n/**\n * Check if the parser is available (for sync checks).\n */\nexport function isParserAvailable(): boolean {\n\treturn parserAvailable;\n}\n\nexport interface ParsedCommand {\n\tprogram: string;\n\targs: string[];\n\traw: string;\n}\n\nexport interface BashParseResult {\n\tsuccess: boolean;\n\tcommands: ParsedCommand[];\n\thasPipes: boolean;\n\thasRedirects: boolean;\n\thasSubshell: boolean;\n\thasBackgroundJob: boolean;\n\thasCommandSubstitution: boolean;\n\terror?: string;\n}\n\nfunction resolveProgramName(value: string): string {\n\tconst name = basename(value);\n\treturn name || value;\n}\n\n/**\n * Safe Command Allowlist - Read-only commands that don't modify system state\n *\n * These commands are considered safe for autonomous execution without approval\n * because they only read data, never write. This enables the agent to explore\n * the filesystem and gather information freely.\n *\n * ## Criteria for inclusion\n *\n * 1. Command is purely read-only by default\n * 2. No common flags that enable writing (or we check for them separately)\n * 3. Cannot be used to exfiltrate sensitive data in dangerous ways\n *\n * ## Notable edge cases\n *\n * - `sed`: Listed here because it's read-only without -i flag. We check for\n * -i separately in analyzeCommandSafety().\n * - `tee`: Can write to files, but primarily used for reading in pipelines.\n * Included because blocking it breaks common patterns.\n * - `xargs`: Executes other commands, but the executed command is analyzed.\n */\nconst SAFE_COMMANDS = new Set([\n\t// File reading\n\t\"cat\",\n\t\"head\",\n\t\"tail\",\n\t\"less\",\n\t\"more\",\n\t// Search and filtering\n\t\"grep\",\n\t\"rg\",\n\t\"find\",\n\t// Directory listing\n\t\"ls\",\n\t\"pwd\",\n\t\"tree\",\n\t// Output formatting\n\t\"echo\",\n\t\"printf\",\n\t// Text processing (read-only)\n\t\"wc\",\n\t\"sort\",\n\t\"uniq\",\n\t\"diff\",\n\t\"cut\",\n\t\"tr\",\n\t\"awk\",\n\t\"sed\", // read-only when not using -i\n\t// File metadata\n\t\"file\",\n\t\"stat\",\n\t\"du\",\n\t\"df\",\n\t// Command lookup\n\t\"which\",\n\t\"whereis\",\n\t\"type\",\n\t// Documentation\n\t\"man\",\n\t\"help\",\n\t// System info\n\t\"date\",\n\t\"cal\",\n\t\"whoami\",\n\t\"id\",\n\t\"groups\",\n\t\"hostname\",\n\t\"uname\",\n\t\"env\",\n\t\"printenv\",\n\t// Modern tools\n\t\"bat\",\n\t\"jq\",\n\t\"yq\",\n\t// Pipeline utilities\n\t\"tee\",\n\t\"xargs\",\n]);\n\n/**\n * Safe Git Subcommands - Read-only git operations\n *\n * These git subcommands don't modify repository state and are safe for\n * autonomous execution. The agent can freely explore git history.\n */\nconst SAFE_GIT_SUBCOMMANDS = new Set([\n\t\"status\", // Working tree status\n\t\"log\", // Commit history\n\t\"diff\", // Changes between commits/trees\n\t\"show\", // Show objects\n\t\"branch\", // List branches (without -d/-D)\n\t\"tag\", // List tags (without -d)\n\t\"remote\", // List remotes\n\t\"config\", // Read config values\n\t\"describe\", // Find tag/commit description\n\t\"rev-parse\", // Parse revision specifications\n\t\"ls-files\", // List tracked files\n\t\"ls-tree\", // List tree contents\n\t\"blame\", // Show line-by-line authorship\n\t\"shortlog\", // Summarize log output\n\t\"reflog\", // Reference logs\n\t\"stash\", // When just listing (stash list)\n]);\n\n/**\n * Dangerous Git Subcommands - Operations that modify repository state\n *\n * These require approval because they can lose work or affect remote state.\n */\nconst DANGEROUS_GIT_SUBCOMMANDS = new Set([\n\t\"reset\", // Can lose uncommitted changes\n\t\"clean\", // Removes untracked files\n\t\"rm\", // Removes files from working tree\n\t\"push\", // Modifies remote repository\n\t\"rebase\", // Rewrites history\n\t\"merge\", // Creates merge commits\n\t\"cherry-pick\", // Applies commits\n]);\n\n/**\n * Dangerous Commands - Operations that should always require approval\n *\n * These commands can cause data loss, system damage, or security issues.\n * They require explicit user approval before execution.\n *\n * ## Categories\n *\n * - **Destructive**: rm, rmdir, shred - delete files/directories\n * - **Disk operations**: mkfs, dd, fdisk, parted, format - modify disks\n * - **Permissions**: chmod, chown - modify file access controls\n * - **Process control**: kill, killall, pkill - terminate processes\n * - **System control**: reboot, shutdown, halt, poweroff, init - system state\n * - **Service management**: systemctl, service - modify running services\n */\nconst DANGEROUS_COMMANDS = new Set([\n\t// Destructive file operations\n\t\"rm\",\n\t\"rmdir\",\n\t\"shred\",\n\t// Low-level disk operations\n\t\"mkfs\",\n\t\"dd\",\n\t\"fdisk\",\n\t\"parted\",\n\t\"format\",\n\t// Permission modifications\n\t\"chmod\",\n\t\"chown\",\n\t// Process termination\n\t\"kill\",\n\t\"killall\",\n\t\"pkill\",\n\t// System control\n\t\"reboot\",\n\t\"shutdown\",\n\t\"halt\",\n\t\"poweroff\",\n\t\"init\",\n\t\"systemctl\",\n\t\"service\",\n]);\n\n/**\n * Parse a bash command string into structured components.\n * Returns a result indicating parser unavailability if tree-sitter isn't loaded.\n */\nexport function parseBashCommand(command: string): BashParseResult {\n\tif (!parser || !parserAvailable) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\tcommands: [],\n\t\t\thasPipes: false,\n\t\t\thasRedirects: false,\n\t\t\thasSubshell: false,\n\t\t\thasBackgroundJob: false,\n\t\t\thasCommandSubstitution: false,\n\t\t\terror: \"Parser not available\",\n\t\t};\n\t}\n\n\ttry {\n\t\tconst tree = parser.parse(command);\n\t\tconst root = tree.rootNode;\n\n\t\tif (root.hasError) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\tcommands: [],\n\t\t\t\thasPipes: false,\n\t\t\t\thasRedirects: false,\n\t\t\t\thasSubshell: false,\n\t\t\t\thasBackgroundJob: false,\n\t\t\t\thasCommandSubstitution: false,\n\t\t\t\terror: \"Parse error in command\",\n\t\t\t};\n\t\t}\n\n\t\tconst result: BashParseResult = {\n\t\t\tsuccess: true,\n\t\t\tcommands: [],\n\t\t\thasPipes: false,\n\t\t\thasRedirects: false,\n\t\t\thasSubshell: false,\n\t\t\thasBackgroundJob: false,\n\t\t\thasCommandSubstitution: false,\n\t\t};\n\n\t\t// Walk the tree to extract information\n\t\t// Using 'any' here since the SyntaxNode type comes from dynamic import\n\t\tconst walk = (node: SyntaxNode) => {\n\t\t\tswitch (node.type) {\n\t\t\t\tcase \"pipeline\":\n\t\t\t\t\tresult.hasPipes = true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"redirected_statement\":\n\t\t\t\tcase \"file_redirect\":\n\t\t\t\tcase \"heredoc_redirect\":\n\t\t\t\t\tresult.hasRedirects = true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"subshell\":\n\t\t\t\t\tresult.hasSubshell = true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"command_substitution\":\n\t\t\t\t\tresult.hasCommandSubstitution = true;\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"command\": {\n\t\t\t\t\tconst parsed = extractCommand(node, command);\n\t\t\t\t\tif (parsed) {\n\t\t\t\t\t\tresult.commands.push(parsed);\n\t\t\t\t\t}\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Check for background job (&)\n\t\t\tif (node.type === \"list\" && command.includes(\"&\")) {\n\t\t\t\tresult.hasBackgroundJob = true;\n\t\t\t}\n\n\t\t\tfor (const child of node.children) {\n\t\t\t\twalk(child);\n\t\t\t}\n\t\t};\n\n\t\twalk(root);\n\t\treturn result;\n\t} catch (error) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\tcommands: [],\n\t\t\thasPipes: false,\n\t\t\thasRedirects: false,\n\t\t\thasSubshell: false,\n\t\t\thasBackgroundJob: false,\n\t\t\thasCommandSubstitution: false,\n\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t};\n\t}\n}\n\n/**\n * Extract command name and arguments from a command node.\n */\nfunction extractCommand(\n\tnode: SyntaxNode,\n\tsource: string,\n): ParsedCommand | null {\n\tconst nameNode = node.childForFieldName(\"name\");\n\tif (!nameNode) return null;\n\n\tconst program = source.slice(nameNode.startIndex, nameNode.endIndex);\n\tconst args: string[] = [];\n\n\tfor (const child of node.children) {\n\t\tif (\n\t\t\tchild.type === \"word\" ||\n\t\t\tchild.type === \"string\" ||\n\t\t\tchild.type === \"raw_string\"\n\t\t) {\n\t\t\tif (child !== nameNode) {\n\t\t\t\targs.push(source.slice(child.startIndex, child.endIndex));\n\t\t\t}\n\t\t}\n\t}\n\n\treturn {\n\t\tprogram,\n\t\targs,\n\t\traw: source.slice(node.startIndex, node.endIndex),\n\t};\n}\n\n/**\n * Analyze a command for safety.\n */\nexport function analyzeCommandSafety(command: string): {\n\tsafe: boolean;\n\treason?: string;\n\tparsed: BashParseResult;\n} {\n\tconst parsed = parseBashCommand(command);\n\n\tif (!parsed.success) {\n\t\treturn {\n\t\t\tsafe: false,\n\t\t\treason: parsed.error || \"Failed to parse command\",\n\t\t\tparsed,\n\t\t};\n\t}\n\n\t// Check for dangerous constructs\n\tif (parsed.hasCommandSubstitution) {\n\t\treturn {\n\t\t\tsafe: false,\n\t\t\treason: \"Command contains command substitution ($(...) or backticks)\",\n\t\t\tparsed,\n\t\t};\n\t}\n\n\t// Analyze each command in the pipeline\n\tfor (const cmd of parsed.commands) {\n\t\tconst program = resolveProgramName(cmd.program);\n\n\t\t// Check for sudo prefix\n\t\tif (program === \"sudo\") {\n\t\t\treturn {\n\t\t\t\tsafe: false,\n\t\t\t\treason: \"Command uses sudo (elevated privileges)\",\n\t\t\t\tparsed,\n\t\t\t};\n\t\t}\n\n\t\t// Check for dangerous commands\n\t\tif (DANGEROUS_COMMANDS.has(program)) {\n\t\t\t// Special case: rm without -r or -f might be okay for single files\n\t\t\tif (program === \"rm\") {\n\t\t\t\tconst hasRecursive = cmd.args.some(\n\t\t\t\t\t(a) => a.includes(\"-r\") || a.includes(\"-R\") || a === \"-rf\",\n\t\t\t\t);\n\t\t\t\tconst hasForce = cmd.args.some((a) => a.includes(\"-f\") || a === \"-rf\");\n\t\t\t\tif (hasRecursive || hasForce) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tsafe: false,\n\t\t\t\t\t\treason: `Dangerous rm command with ${hasRecursive ? \"recursive\" : \"\"}${hasRecursive && hasForce ? \" and \" : \"\"}${hasForce ? \"force\" : \"\"} flags`,\n\t\t\t\t\t\tparsed,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\treturn {\n\t\t\t\t\tsafe: false,\n\t\t\t\t\treason: `Potentially dangerous command: ${program}`,\n\t\t\t\t\tparsed,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check git commands\n\t\tif (program === \"git\" && cmd.args.length > 0) {\n\t\t\tconst subcommand = cmd.args[0]!;\n\t\t\tif (DANGEROUS_GIT_SUBCOMMANDS.has(subcommand)) {\n\t\t\t\treturn {\n\t\t\t\t\tsafe: false,\n\t\t\t\t\treason: `Git ${subcommand} can modify repository state`,\n\t\t\t\t\tparsed,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\t// If we have pipes or redirects with non-safe commands, flag it\n\tif (parsed.hasPipes || parsed.hasRedirects) {\n\t\tconst allSafe = parsed.commands.every((cmd) => {\n\t\t\tconst program = resolveProgramName(cmd.program);\n\t\t\treturn SAFE_COMMANDS.has(program) || program === \"git\";\n\t\t});\n\n\t\tif (!allSafe) {\n\t\t\treturn {\n\t\t\t\tsafe: false,\n\t\t\t\treason: \"Command pipeline contains potentially unsafe commands\",\n\t\t\t\tparsed,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn { safe: true, parsed };\n}\n\n/**\n * Check if a command is known to be safe (read-only).\n */\nexport function isKnownSafeCommand(command: string): boolean {\n\tconst parsed = parseBashCommand(command);\n\n\tif (!parsed.success || parsed.commands.length === 0) {\n\t\treturn false;\n\t}\n\n\t// Command substitution is never safe\n\tif (parsed.hasCommandSubstitution) {\n\t\treturn false;\n\t}\n\n\t// Check each command\n\tfor (const cmd of parsed.commands) {\n\t\tconst program = resolveProgramName(cmd.program);\n\n\t\t// Check if it's a known safe command\n\t\tif (SAFE_COMMANDS.has(program)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Check if it's a safe git command\n\t\tif (program === \"git\" && cmd.args.length > 0) {\n\t\t\tconst subcommand = cmd.args[0]!;\n\t\t\tif (SAFE_GIT_SUBCOMMANDS.has(subcommand)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t}\n\n\t\t// Not a known safe command\n\t\treturn false;\n\t}\n\n\treturn true;\n}\n\n/**\n * Extract the inner command from bash -c or similar wrappers.\n */\nexport function unwrapShellCommand(command: string): string | null {\n\tconst parsed = parseBashCommand(command);\n\n\tif (!parsed.success || parsed.commands.length !== 1) {\n\t\treturn null;\n\t}\n\n\tconst cmd = parsed.commands[0];\n\tif (!cmd) {\n\t\treturn null;\n\t}\n\tconst program = resolveProgramName(cmd.program);\n\n\t// Check for bash/sh/zsh with -c flag\n\tif ([\"bash\", \"sh\", \"zsh\"].includes(program)) {\n\t\tconst cIndex = cmd.args.findIndex((a) => a === \"-c\" || a === \"-lc\");\n\t\tif (cIndex !== -1 && cIndex + 1 < cmd.args.length) {\n\t\t\t// Return the command string (removing quotes if present)\n\t\t\tconst innerCmd = cmd.args[cIndex + 1];\n\t\t\tif (!innerCmd) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tif (\n\t\t\t\t(innerCmd.startsWith('\"') && innerCmd.endsWith('\"')) ||\n\t\t\t\t(innerCmd.startsWith(\"'\") && innerCmd.endsWith(\"'\"))\n\t\t\t) {\n\t\t\t\treturn innerCmd.slice(1, -1);\n\t\t\t}\n\t\t\treturn innerCmd;\n\t\t}\n\t}\n\n\treturn null;\n}\n"]}
package/dist/safety/execpolicy.d.ts CHANGED
@@ -60,6 +60,7 @@ export interface PrefixPattern {
60
60
  export interface PrefixRule {
61
61
  pattern: PrefixPattern;
62
62
  decision: Decision;
63
+ justification?: string;
63
64
  }
64
65
  /**
65
66
  * A rule match result.
@@ -69,6 +70,8 @@ export type RuleMatch = {
69
70
  type: "prefix";
70
71
  matchedPrefix: string[];
71
72
  decision: Decision;
73
+ justification?: string;
74
+ resolvedProgram?: string;
72
75
  } | {
73
76
  type: "heuristics";
74
77
  command: string[];
@@ -82,24 +85,33 @@ export interface Evaluation {
82
85
  decision: Decision;
83
86
  matchedRules: RuleMatch[];
84
87
  }
88
+ export interface PolicyCheckOptions {
89
+ resolveHostExecutables?: boolean;
90
+ }
85
91
  /**
86
92
  * Policy containing multiple rules indexed by program name.
87
93
  * Based on Codex's Policy.
88
94
  */
89
95
  export declare class Policy {
90
96
  private rulesByProgram;
97
+ private hostExecutables;
91
98
  constructor();
92
99
  static empty(): Policy;
93
100
  addRule(rule: PrefixRule): void;
94
- addPrefixRule(prefix: string[], decision: Decision, match?: string[][], notMatch?: string[][]): void;
101
+ addPrefixRule(prefix: string[], decision: Decision, match?: string[][], notMatch?: string[][], justification?: string): void;
102
+ addHostExecutable(name: string, paths: string[]): void;
95
103
  private ruleMatchesCommand;
96
104
  private matchPrefix;
97
105
  private tokenMatches;
98
- check(cmd: string[], heuristicsFallback?: (cmd: string[]) => Decision): Evaluation;
99
- checkMultiple(commands: string[][], heuristicsFallback?: (cmd: string[]) => Decision): Evaluation;
106
+ check(cmd: string[], heuristicsFallback?: (cmd: string[]) => Decision, options?: PolicyCheckOptions): Evaluation;
107
+ checkMultiple(commands: string[][], heuristicsFallback?: (cmd: string[]) => Decision, options?: PolicyCheckOptions): Evaluation;
100
108
  private matchesForCommand;
109
+ private hostExecutableFallbackPrograms;
110
+ private collectPrefixMatches;
111
+ private canUseHostExecutableFallback;
101
112
  private evaluationFromMatches;
102
113
  get rules(): Map<string, PrefixRule[]>;
114
+ get hostExecutablePaths(): Map<string, Set<string>>;
103
115
  }
104
116
  /**
105
117
  * Parse a Starlark-like policy file.
package/dist/safety/execpolicy.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"execpolicy.d.ts","sourceRoot":"","sources":["../../src/safety/execpolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAeH;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;AAExD;;;GAGG;AACH,MAAM,MAAM,YAAY,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEtC;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,EAAE,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GAClB;IACA,IAAI,EAAE,QAAQ,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,EAAE,QAAQ,CAAC;CAClB,GACD;IACA,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;CAClB,CAAC;AAEL;;;GAGG;AACH,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,SAAS,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,qBAAa,MAAM;IAClB,OAAO,CAAC,cAAc,CAA4B;;IAMlD,MAAM,CAAC,KAAK,IAAI,MAAM;IAItB,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAO/B,aAAa,CACZ,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,EAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,GACnB,IAAI;IAwCP,OAAO,CAAC,kBAAkB;IAK1B,OAAO,CAAC,WAAW;IAqBnB,OAAO,CAAC,YAAY;IAOpB,KAAK,CACJ,GAAG,EAAE,MAAM,EAAE,EACb,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,QAAQ,GAC9C,UAAU;IAKb,aAAa,CACZ,QAAQ,EAAE,MAAM,EAAE,EAAE,EACpB,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,QAAQ,GAC9C,UAAU;IAOb,OAAO,CAAC,iBAAiB;IAkCzB,OAAO,CAAC,qBAAqB;IAmB7B,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAErC;CACD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAoEvE;AAsOD;;GAEG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAiDvD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAGvC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACpC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EAAE,GACd,IAAI,CA6BN;AAMD;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA+CtD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC3B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,QAAQ,GAC9C,UAAU,CAIZ;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GAClB,OAAO,CAGT;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GAClB,OAAO,CAGT;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAI5E;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAuC7D"}
1
+ {"version":3,"file":"execpolicy.d.ts","sourceRoot":"","sources":["../../src/safety/execpolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAeH;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;AAExD;;;GAGG;AACH,MAAM,MAAM,YAAY,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEtC;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,EAAE,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GAClB;IACA,IAAI,EAAE,QAAQ,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CACxB,GACD;IACA,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;CAClB,CAAC;AAEL;;;GAGG;AACH,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,SAAS,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IAClC,sBAAsB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,MAAM;IAClB,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,eAAe,CAA2B;;IAOlD,MAAM,CAAC,KAAK,IAAI,MAAM;IAItB,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAO/B,aAAa,CACZ,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,EAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,EACrB,aAAa,CAAC,EAAE,MAAM,GACpB,IAAI;IAwCP,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAWtD,OAAO,CAAC,kBAAkB;IAK1B,OAAO,CAAC,WAAW;IAqBnB,OAAO,CAAC,YAAY;IAOpB,KAAK,CACJ,GAAG,EAAE,MAAM,EAAE,EACb,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,QAAQ,EAChD,OAAO,GAAE,kBAAuB,GAC9B,UAAU;IASb,aAAa,CACZ,QAAQ,EAAE,MAAM,EAAE,EAAE,EACpB,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,QAAQ,EAChD,OAAO,GAAE,kBAAuB,GAC9B,UAAU;IAOb,OAAO,CAAC,iBAAiB;IAiDzB,OAAO,CAAC,8BAA8B;IAWtC,OAAO,CAAC,oBAAoB;IAsB5B,OAAO,CAAC,4BAA4B;IAQpC,OAAO,CAAC,qBAAqB;IAmB7B,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAErC;IAED,IAAI,mBAAmB,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAElD;CACD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAqFvE;AAqRD;;GAEG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAuDvD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAGvC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACpC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EAAE,GACd,IAAI,CA6BN;AAMD;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAEtD;AA0KD;;GAEG;AACH,wBAAgB,YAAY,CAC3B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,QAAQ,GAC9C,UAAU,CAMZ;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GAClB,OAAO,CAGT;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GAClB,OAAO,CAGT;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAS5E;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAuC7D"}