@evalops/maestro 0.10.18 → 0.10.20

package/dist/safety/execpolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"execpolicy.js","sourceRoot":"","sources":["../../src/safety/execpolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EACN,cAAc,EACd,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;AA2DjD;;;GAGG;AACH,MAAM,OAAO,MAAM;IAGlB;QACC,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,KAAK;QACX,OAAO,IAAI,MAAM,EAAE,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,IAAgB;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,aAAa,CACZ,MAAgB,EAChB,QAAkB,EAClB,KAAkB,EAClB,QAAqB;QAErB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,OAAO,GAAkB;YAC9B,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;SACrD,CAAC;QACF,MAAM,IAAI,GAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAE/C,0BAA0B;QAC1B,IAAI,KAAK,EAAE,CAAC;YACX,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;oBAC7C,MAAM,IAAI,KAAK,CACd,sBAAsB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CACtD,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,8BAA8B;QAC9B,IAAI,QAAQ,EAAE,CAAC;YACd,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAChC,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;oBAC5C,MAAM,IAAI,KAAK,CACd,0BAA0B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CACvD,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAEO,kBAAkB,CAAC,IAAgB,EAAE,GAAa;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpD,OAAO,OAAO,KAAK,IAAI,CAAC;IACzB,CAAC;IAEO,WAAW,CAAC,OAAsB,EAAE,GAAa;QACxD,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC;QACb,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,YAAY,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC7C,OAAO,IAAI,CAAC;YACb,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACb,CAAC;QACF,CAAC;QAED,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACpC,CAAC;IAEO,YAAY,CAAC,OAAqB,EAAE,KAAa;QACxD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC;QAChC,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CACJ,GAAa,EACb,kBAAgD;QAEhD,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACjD,CAAC;IAED,aAAa,CACZ,QAAoB,EACpB,kBAAgD;QAEhD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAC7C,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAC/C,CAAC;QACF,OAAO,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACjD,CAAC;IAEO,iBAAiB,CACxB,GAAa,EACb,kBAAgD;QAEhD,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACX,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAErD,MAAM,OAAO,GAAgB,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC1D,IAAI,aAAa,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,QAAQ;oBACd,aAAa;oBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACvB,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,kBAAkB,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,GAAG;gBACZ,QAAQ,EAAE,kBAAkB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,qBAAqB,CAAC,YAAyB;QACtD,gDAAgD;QAChD,MAAM,aAAa,GAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAEnE,IAAI,eAAe,GAAa,OAAO,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1D,IAAI,GAAG,GAAG,UAAU,EAAE,CAAC;gBACtB,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC;YAClC,CAAC;QACF,CAAC;QAED,OAAO;YACN,QAAQ,EAAE,eAAe;YACzB,YAAY;SACZ,CAAC;IACH,CAAC;IAED,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,cAAc,CAAC;IAC5B,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,UAAkB;IAC9D,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IAE5B,kDAAkD;IAClD,MAAM,SAAS,GACd,kEAAkE,CAAC;IAEpE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAEzC,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,OAAO,GAAkB;gBAC9B,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;wBAC3B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAkB,CAAC;oBACrD,CAAC;oBACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACpB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAkB,CAAC;oBACxD,CAAC;oBACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAkB,CAAC;gBACpD,CAAC,CAAC;aACF,CAAC;YAEF,gEAAgE;YAChE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACxD,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAe;oBACxB,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;oBACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBACzB,CAAC;gBAEF,0BAA0B;gBAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACpC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;wBAC3C,MAAM,IAAI,KAAK,CACd,sBAAsB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CACtD,CAAC;oBACH,CAAC;gBACF,CAAC;gBAED,8BAA8B;gBAC9B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACvC,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;wBAC1C,MAAM,IAAI,KAAK,CACd,0BAA0B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CACvD,CAAC;oBACH,CAAC;gBACF,CAAC;gBAED,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,2BAA2B,UAAU,EAAE,EAAE;gBACpD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACxB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAwB;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAwB;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,OAAsB,EAAE,GAAa;IAC3D,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9C,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,YAAY,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACd,CAAC;QAED,IAAI,YAAY,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,YAAY,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7C,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AASD,SAAS,mBAAmB,CAAC,IAAY;IACxC,MAAM,MAAM,GAAqB;QAChC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,EAAE;KACZ,CAAC;IAEF,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAChE,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,qBAAqB;IACrB,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3D,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,CAAC;IACF,CAAC;IAED,kBAAkB;IAClB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC7E,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,sBAAsB;IACtB,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnE,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,QAAQ,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACrC,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAExC,sCAAsC;IACtC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3B,6BAA6B;QAC7B,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM;QAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,eAAe;YACf,MAAM,KAAK,GAAG,IAAI,CAAC;YACnB,CAAC,EAAE,CAAC;YACJ,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC1C,CAAC,EAAE,CAAC;oBACJ,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACP,KAAK,IAAI,CAAC,CAAC;gBACZ,CAAC;gBACD,CAAC,EAAE,CAAC;YACL,CAAC;YACD,CAAC,EAAE,CAAC,CAAC,qBAAqB;YAC1B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,qBAAqB;YACrB,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;qBAClB,IAAI,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;gBAC5B,CAAC,EAAE,CAAC;YACL,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAExC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM;QAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC;YACnB,CAAC,EAAE,CAAC;YACJ,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC1C,CAAC,EAAE,CAAC;oBACJ,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACP,KAAK,IAAI,CAAC,CAAC;gBACZ,CAAC;gBACD,CAAC,EAAE,CAAC;YACL,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACtC,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAExC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM;QAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;qBAClB,IAAI,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;gBAC5B,CAAC,EAAE,CAAC;YACL,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzC,8CAA8C;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC;YACnB,CAAC,EAAE,CAAC;YACJ,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC1C,CAAC,EAAE,CAAC;oBACJ,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACP,KAAK,IAAI,CAAC,CAAC;gBACZ,CAAC;gBACD,CAAC,EAAE,CAAC;YACL,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,0BAA0B;YAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,gEAAgE;AAChE,iBAAiB;AACjB,gEAAgE;AAEhE,IAAI,YAAY,GAAkB,IAAI,CAAC;AACvC,IAAI,kBAAkB,GAAkB,IAAI,CAAC;AAE7C;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,YAAoB;IAC9C,IAAI,YAAY,IAAI,kBAAkB,KAAK,YAAY,EAAE,CAAC;QACzD,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IAE5B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAEjE,qBAAqB;IACrB,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAChD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBAC1B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;YACF,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC/C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACjD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBAC1B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;YACF,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBAChD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,YAAY,GAAG,MAAM,CAAC;IACtB,kBAAkB,GAAG,YAAY,CAAC;IAClC,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC/B,YAAY,GAAG,IAAI,CAAC;IACpB,kBAAkB,GAAG,IAAI,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACpC,UAAkB,EAClB,MAAgB;IAEhB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACzC,MAAM,IAAI,GAAG,uBAAuB,OAAO,qBAAqB,CAAC;IAEjE,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,iDAAiD;IACjD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,cAAc,CAAC,UAAU,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACP,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,mCAAmC;IACnC,gBAAgB,EAAE,CAAC;IAEnB,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,gEAAgE;AAChE,wBAAwB;AACxB,gEAAgE;AAEhE;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,IAAI,CAAC;YAChB,SAAS,GAAG,KAAK,CAAC;YAClB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACV,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACjD,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACV,CAAC;QAED,IAAI,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACpC,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS,GAAG,EAAE,CAAC;YACf,SAAS;QACV,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,IAAI,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrB,OAAO,GAAG,EAAE,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QAED,OAAO,IAAI,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC3B,OAAe,EACf,YAAoB,EACpB,kBAAgD;IAEhD,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC/B,OAAe,EACf,YAAoB;IAEpB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAAe,EACf,YAAoB;IAEpB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB,EAAE,OAAe;IACrE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAChE,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9C,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,qBAAqB,UAAU,SAAS,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACP,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CAAC,WAAW,UAAU,GAAG,EAAE,aAAa,CAAC,CAAC;gBACpD,MAAM;YACP,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,KAAK,IAAI,EAAE;oBAAE,MAAM;gBACvB,MAAM,OAAO,GAAG;oBACf,IAAI,CAAC,OAAO,CAAC,KAAK;oBAClB,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9B,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CACzD;iBACD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC;gBAC3D,KAAK,EAAE,CAAC;YACT,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC","sourcesContent":["/**\n * Execution Policy System - Pattern-based command approval policies.\n *\n * Ported from OpenAI Codex (MIT License):\n * https://github.com/openai/codex/tree/main/codex-rs/execpolicy\n *\n * Policies are defined in `.execpolicy` files using a Starlark-like syntax:\n *\n * ```starlark\n * prefix_rule(\n *     pattern=[\"git\", \"status\"],\n *     decision=\"allow\",\n * )\n *\n * prefix_rule(\n *     pattern=[\"git\", [\"push\", \"fetch\"]],\n *     decision=\"prompt\",\n *     match=[[\"git\", \"push\", \"origin\", \"main\"]],\n *     not_match=[[\"git\", \"status\"]],\n * )\n *\n * prefix_rule(\n *     pattern=[\"rm\", \"-rf\"],\n *     decision=\"forbidden\",\n * )\n * ```\n *\n * Configuration paths:\n * - ~/.maestro/execpolicy (global)\n * - .maestro/execpolicy (project - evaluated after global)\n */\n\nimport {\n\tappendFileSync,\n\texistsSync,\n\tmkdirSync,\n\treadFileSync,\n\twriteFileSync,\n} from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { PATHS } from \"../config/constants.js\";\nimport { createLogger } from \"../utils/logger.js\";\n\nconst logger = createLogger(\"safety:execpolicy\");\n\n/**\n * Decision for a command execution.\n * Based on Codex's Decision enum.\n */\nexport type Decision = \"allow\" | \"prompt\" | \"forbidden\";\n\n/**\n * Pattern token - either a single string or alternatives.\n * Based on Codex's PatternToken.\n */\nexport type PatternToken =\n\t| { type: \"single\"; value: string }\n\t| { type: \"alts\"; values: string[] };\n\n/**\n * A prefix pattern for matching commands.\n * Based on Codex's PrefixPattern.\n */\nexport interface PrefixPattern {\n\tfirst: string;\n\trest: PatternToken[];\n}\n\n/**\n * A prefix rule that matches commands.\n * Based on Codex's PrefixRule.\n */\nexport interface PrefixRule {\n\tpattern: PrefixPattern;\n\tdecision: Decision;\n}\n\n/**\n * A rule match result.\n * Based on Codex's RuleMatch.\n */\nexport type RuleMatch =\n\t| {\n\t\t\ttype: \"prefix\";\n\t\t\tmatchedPrefix: string[];\n\t\t\tdecision: Decision;\n\t  }\n\t| {\n\t\t\ttype: \"heuristics\";\n\t\t\tcommand: string[];\n\t\t\tdecision: Decision;\n\t  };\n\n/**\n * Policy evaluation result.\n * Based on Codex's Evaluation.\n */\nexport interface Evaluation {\n\tdecision: Decision;\n\tmatchedRules: RuleMatch[];\n}\n\n/**\n * Policy containing multiple rules indexed by program name.\n * Based on Codex's Policy.\n */\nexport class Policy {\n\tprivate rulesByProgram: Map<string, PrefixRule[]>;\n\n\tconstructor() {\n\t\tthis.rulesByProgram = new Map();\n\t}\n\n\tstatic empty(): Policy {\n\t\treturn new Policy();\n\t}\n\n\taddRule(rule: PrefixRule): void {\n\t\tconst program = rule.pattern.first;\n\t\tconst existing = this.rulesByProgram.get(program) ?? [];\n\t\texisting.push(rule);\n\t\tthis.rulesByProgram.set(program, existing);\n\t}\n\n\taddPrefixRule(\n\t\tprefix: string[],\n\t\tdecision: Decision,\n\t\tmatch?: string[][],\n\t\tnotMatch?: string[][],\n\t): void {\n\t\tif (prefix.length === 0) {\n\t\t\tthrow new Error(\"prefix cannot be empty\");\n\t\t}\n\n\t\tconst [first, ...rest] = prefix;\n\t\tif (!first) {\n\t\t\tthrow new Error(\"prefix cannot be empty\");\n\t\t}\n\t\tconst pattern: PrefixPattern = {\n\t\t\tfirst,\n\t\t\trest: rest.map((t) => ({ type: \"single\", value: t })),\n\t\t};\n\t\tconst rule: PrefixRule = { pattern, decision };\n\n\t\t// Validate match examples\n\t\tif (match) {\n\t\t\tfor (const example of match) {\n\t\t\t\tif (!this.ruleMatchesCommand(rule, example)) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Rule should match [${example.join(\" \")}] but doesn't`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// Validate not_match examples\n\t\tif (notMatch) {\n\t\t\tfor (const example of notMatch) {\n\t\t\t\tif (this.ruleMatchesCommand(rule, example)) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Rule should NOT match [${example.join(\" \")}] but does`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tthis.addRule(rule);\n\t}\n\n\tprivate ruleMatchesCommand(rule: PrefixRule, cmd: string[]): boolean {\n\t\tconst matched = this.matchPrefix(rule.pattern, cmd);\n\t\treturn matched !== null;\n\t}\n\n\tprivate matchPrefix(pattern: PrefixPattern, cmd: string[]): string[] | null {\n\t\tconst patternLength = pattern.rest.length + 1;\n\t\tif (cmd.length < patternLength || cmd[0] !== pattern.first) {\n\t\t\treturn null;\n\t\t}\n\n\t\tfor (let i = 0; i < pattern.rest.length; i++) {\n\t\t\tconst patternToken = pattern.rest[i];\n\t\t\tconst cmdToken = cmd[i + 1];\n\t\t\tif (!patternToken || cmdToken === undefined) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tif (!this.tokenMatches(patternToken, cmdToken)) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t}\n\n\t\treturn cmd.slice(0, patternLength);\n\t}\n\n\tprivate tokenMatches(pattern: PatternToken, token: string): boolean {\n\t\tif (pattern.type === \"single\") {\n\t\t\treturn pattern.value === token;\n\t\t}\n\t\treturn pattern.values.includes(token);\n\t}\n\n\tcheck(\n\t\tcmd: string[],\n\t\theuristicsFallback?: (cmd: string[]) => Decision,\n\t): Evaluation {\n\t\tconst matchedRules = this.matchesForCommand(cmd, heuristicsFallback);\n\t\treturn this.evaluationFromMatches(matchedRules);\n\t}\n\n\tcheckMultiple(\n\t\tcommands: string[][],\n\t\theuristicsFallback?: (cmd: string[]) => Decision,\n\t): Evaluation {\n\t\tconst matchedRules = commands.flatMap((cmd) =>\n\t\t\tthis.matchesForCommand(cmd, heuristicsFallback),\n\t\t);\n\t\treturn this.evaluationFromMatches(matchedRules);\n\t}\n\n\tprivate matchesForCommand(\n\t\tcmd: string[],\n\t\theuristicsFallback?: (cmd: string[]) => Decision,\n\t): RuleMatch[] {\n\t\tconst program = cmd[0];\n\t\tif (!program) {\n\t\t\treturn [];\n\t\t}\n\n\t\tconst rules = this.rulesByProgram.get(program) ?? [];\n\n\t\tconst matched: RuleMatch[] = [];\n\t\tfor (const rule of rules) {\n\t\t\tconst matchedPrefix = this.matchPrefix(rule.pattern, cmd);\n\t\t\tif (matchedPrefix) {\n\t\t\t\tmatched.push({\n\t\t\t\t\ttype: \"prefix\",\n\t\t\t\t\tmatchedPrefix,\n\t\t\t\t\tdecision: rule.decision,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\tif (matched.length === 0 && heuristicsFallback) {\n\t\t\tmatched.push({\n\t\t\t\ttype: \"heuristics\",\n\t\t\t\tcommand: cmd,\n\t\t\t\tdecision: heuristicsFallback(cmd),\n\t\t\t});\n\t\t}\n\n\t\treturn matched;\n\t}\n\n\tprivate evaluationFromMatches(matchedRules: RuleMatch[]): Evaluation {\n\t\t// Decision priority: forbidden > prompt > allow\n\t\tconst decisionOrder: Decision[] = [\"allow\", \"prompt\", \"forbidden\"];\n\n\t\tlet highestDecision: Decision = \"allow\";\n\t\tfor (const match of matchedRules) {\n\t\t\tconst idx = decisionOrder.indexOf(match.decision);\n\t\t\tconst currentIdx = decisionOrder.indexOf(highestDecision);\n\t\t\tif (idx > currentIdx) {\n\t\t\t\thighestDecision = match.decision;\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tdecision: highestDecision,\n\t\t\tmatchedRules,\n\t\t};\n\t}\n\n\tget rules(): Map<string, PrefixRule[]> {\n\t\treturn this.rulesByProgram;\n\t}\n}\n\n/**\n * Parse a Starlark-like policy file.\n * Supports the `prefix_rule()` function with pattern, decision, match, and not_match.\n */\nexport function parsePolicy(content: string, identifier: string): Policy {\n\tconst policy = new Policy();\n\n\t// Simple regex-based parser for prefix_rule calls\n\tconst ruleRegex =\n\t\t/prefix_rule\\s*\\(\\s*([\\s\\S]*?)\\s*\\)\\s*(?:,?\\s*(?=prefix_rule|$))/g;\n\n\tfor (const match of content.matchAll(ruleRegex)) {\n\t\tconst args = match[1];\n\t\tif (!args) continue;\n\n\t\ttry {\n\t\t\tconst parsed = parsePrefixRuleArgs(args);\n\n\t\t\tconst [first, ...rest] = parsed.pattern;\n\t\t\tif (!first) {\n\t\t\t\tthrow new Error(\"pattern cannot be empty\");\n\t\t\t}\n\t\t\tconst pattern: PrefixPattern = {\n\t\t\t\tfirst: getPatternString(first),\n\t\t\t\trest: rest.map((t) => {\n\t\t\t\t\tif (typeof t === \"string\") {\n\t\t\t\t\t\treturn { type: \"single\", value: t } as PatternToken;\n\t\t\t\t\t}\n\t\t\t\t\tif (t.length === 1) {\n\t\t\t\t\t\treturn { type: \"single\", value: t[0] } as PatternToken;\n\t\t\t\t\t}\n\t\t\t\t\treturn { type: \"alts\", values: t } as PatternToken;\n\t\t\t\t}),\n\t\t\t};\n\n\t\t\t// Handle alternatives in first token (first is validated above)\n\t\t\tconst firstAlternatives = getPatternAlternatives(first);\n\t\t\tfor (const firstAlt of firstAlternatives) {\n\t\t\t\tconst rule: PrefixRule = {\n\t\t\t\t\tpattern: { ...pattern, first: firstAlt },\n\t\t\t\t\tdecision: parsed.decision,\n\t\t\t\t};\n\n\t\t\t\t// Validate match examples\n\t\t\t\tfor (const example of parsed.match) {\n\t\t\t\t\tif (!matchesPrefix(rule.pattern, example)) {\n\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t`Rule should match [${example.join(\" \")}] but doesn't`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// Validate not_match examples\n\t\t\t\tfor (const example of parsed.notMatch) {\n\t\t\t\t\tif (matchesPrefix(rule.pattern, example)) {\n\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t`Rule should NOT match [${example.join(\" \")}] but does`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tpolicy.addRule(rule);\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tlogger.warn(`Failed to parse rule in ${identifier}`, {\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t\targs: args.slice(0, 100),\n\t\t\t});\n\t\t}\n\t}\n\n\treturn policy;\n}\n\nfunction getPatternString(token: string | string[]): string {\n\tif (typeof token === \"string\") {\n\t\treturn token;\n\t}\n\tconst first = token[0];\n\tif (!first) {\n\t\tthrow new Error(\"pattern array cannot be empty\");\n\t}\n\treturn first;\n}\n\nfunction getPatternAlternatives(token: string | string[]): string[] {\n\treturn typeof token === \"string\" ? [token] : token;\n}\n\nfunction matchesPrefix(pattern: PrefixPattern, cmd: string[]): boolean {\n\tconst patternLength = pattern.rest.length + 1;\n\tif (cmd.length < patternLength || cmd[0] !== pattern.first) {\n\t\treturn false;\n\t}\n\n\tfor (let i = 0; i < pattern.rest.length; i++) {\n\t\tconst patternToken = pattern.rest[i];\n\t\tconst cmdToken = cmd[i + 1];\n\t\tif (!patternToken || cmdToken === undefined) {\n\t\t\treturn false;\n\t\t}\n\n\t\tif (patternToken.type === \"single\") {\n\t\t\tif (patternToken.value !== cmdToken) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t} else {\n\t\t\tif (!patternToken.values.includes(cmdToken)) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn true;\n}\n\ninterface ParsedPrefixRule {\n\tpattern: (string | string[])[];\n\tdecision: Decision;\n\tmatch: string[][];\n\tnotMatch: string[][];\n}\n\nfunction parsePrefixRuleArgs(args: string): ParsedPrefixRule {\n\tconst result: ParsedPrefixRule = {\n\t\tpattern: [],\n\t\tdecision: \"allow\",\n\t\tmatch: [],\n\t\tnotMatch: [],\n\t};\n\n\t// Parse pattern=...\n\tconst patternMatch = args.match(/pattern\\s*=\\s*(\\[[\\s\\S]*?\\])/);\n\tif (patternMatch?.[1]) {\n\t\tresult.pattern = parsePatternArray(patternMatch[1]);\n\t}\n\n\t// Parse decision=...\n\tconst decisionMatch = args.match(/decision\\s*=\\s*\"(\\w+)\"/);\n\tif (decisionMatch?.[1]) {\n\t\tconst d = decisionMatch[1];\n\t\tif (d === \"allow\" || d === \"prompt\" || d === \"forbidden\") {\n\t\t\tresult.decision = d;\n\t\t}\n\t}\n\n\t// Parse match=...\n\tconst matchMatch = args.match(/(?<![_])match\\s*=\\s*(\\[[\\s\\S]*?\\](?:\\s*,)?)/);\n\tif (matchMatch?.[1]) {\n\t\tresult.match = parseExamplesArray(matchMatch[1]);\n\t}\n\n\t// Parse not_match=...\n\tconst notMatchMatch = args.match(/not_match\\s*=\\s*(\\[[\\s\\S]*?\\])/);\n\tif (notMatchMatch?.[1]) {\n\t\tresult.notMatch = parseExamplesArray(notMatchMatch[1]);\n\t}\n\n\tif (result.pattern.length === 0) {\n\t\tthrow new Error(\"pattern is required\");\n\t}\n\n\treturn result;\n}\n\nfunction parsePatternArray(str: string): (string | string[])[] {\n\tconst result: (string | string[])[] = [];\n\tconst content = str.slice(1, -1).trim();\n\n\t// Simple tokenizer for pattern arrays\n\tlet i = 0;\n\twhile (i < content.length) {\n\t\t// Skip whitespace and commas\n\t\twhile (i < content.length && /[\\s,]/.test(content.charAt(i))) i++;\n\t\tif (i >= content.length) break;\n\n\t\tconst char = content.charAt(i);\n\t\tif (char === '\"' || char === \"'\") {\n\t\t\t// String token\n\t\t\tconst quote = char;\n\t\t\ti++;\n\t\t\tlet value = \"\";\n\t\t\twhile (i < content.length && content.charAt(i) !== quote) {\n\t\t\t\tconst c = content.charAt(i);\n\t\t\t\tif (c === \"\\\\\" && i + 1 < content.length) {\n\t\t\t\t\ti++;\n\t\t\t\t\tvalue += content.charAt(i);\n\t\t\t\t} else {\n\t\t\t\t\tvalue += c;\n\t\t\t\t}\n\t\t\t\ti++;\n\t\t\t}\n\t\t\ti++; // skip closing quote\n\t\t\tresult.push(value);\n\t\t} else if (char === \"[\") {\n\t\t\t// Alternatives array\n\t\t\tconst start = i;\n\t\t\tlet depth = 1;\n\t\t\ti++;\n\t\t\twhile (i < content.length && depth > 0) {\n\t\t\t\tconst c = content.charAt(i);\n\t\t\t\tif (c === \"[\") depth++;\n\t\t\t\telse if (c === \"]\") depth--;\n\t\t\t\ti++;\n\t\t\t}\n\t\t\tconst nestedStr = content.slice(start, i);\n\t\t\tconst nested = parseStringArray(nestedStr);\n\t\t\tresult.push(nested);\n\t\t}\n\t}\n\n\treturn result;\n}\n\nfunction parseStringArray(str: string): string[] {\n\tconst result: string[] = [];\n\tconst content = str.slice(1, -1).trim();\n\n\tlet i = 0;\n\twhile (i < content.length) {\n\t\twhile (i < content.length && /[\\s,]/.test(content.charAt(i))) i++;\n\t\tif (i >= content.length) break;\n\n\t\tconst char = content.charAt(i);\n\t\tif (char === '\"' || char === \"'\") {\n\t\t\tconst quote = char;\n\t\t\ti++;\n\t\t\tlet value = \"\";\n\t\t\twhile (i < content.length && content.charAt(i) !== quote) {\n\t\t\t\tconst c = content.charAt(i);\n\t\t\t\tif (c === \"\\\\\" && i + 1 < content.length) {\n\t\t\t\t\ti++;\n\t\t\t\t\tvalue += content.charAt(i);\n\t\t\t\t} else {\n\t\t\t\t\tvalue += c;\n\t\t\t\t}\n\t\t\t\ti++;\n\t\t\t}\n\t\t\ti++;\n\t\t\tresult.push(value);\n\t\t}\n\t}\n\n\treturn result;\n}\n\nfunction parseExamplesArray(str: string): string[][] {\n\tconst result: string[][] = [];\n\tconst content = str.slice(1, -1).trim();\n\n\tlet i = 0;\n\twhile (i < content.length) {\n\t\twhile (i < content.length && /[\\s,]/.test(content.charAt(i))) i++;\n\t\tif (i >= content.length) break;\n\n\t\tconst char = content.charAt(i);\n\t\tif (char === \"[\") {\n\t\t\tconst start = i;\n\t\t\tlet depth = 1;\n\t\t\ti++;\n\t\t\twhile (i < content.length && depth > 0) {\n\t\t\t\tconst c = content.charAt(i);\n\t\t\t\tif (c === \"[\") depth++;\n\t\t\t\telse if (c === \"]\") depth--;\n\t\t\t\ti++;\n\t\t\t}\n\t\t\tconst nestedStr = content.slice(start, i);\n\t\t\tresult.push(parseStringArray(nestedStr));\n\t\t} else if (char === '\"' || char === \"'\") {\n\t\t\t// Shell command string that needs to be split\n\t\t\tconst quote = char;\n\t\t\ti++;\n\t\t\tlet value = \"\";\n\t\t\twhile (i < content.length && content.charAt(i) !== quote) {\n\t\t\t\tconst c = content.charAt(i);\n\t\t\t\tif (c === \"\\\\\" && i + 1 < content.length) {\n\t\t\t\t\ti++;\n\t\t\t\t\tvalue += content.charAt(i);\n\t\t\t\t} else {\n\t\t\t\t\tvalue += c;\n\t\t\t\t}\n\t\t\t\ti++;\n\t\t\t}\n\t\t\ti++;\n\t\t\t// Simple shell-like split\n\t\t\tconst tokens = value.split(/\\s+/).filter(Boolean);\n\t\t\tif (tokens.length > 0) {\n\t\t\t\tresult.push(tokens);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn result;\n}\n\n// ─────────────────────────────────────────────────────────────\n// Policy Loading\n// ─────────────────────────────────────────────────────────────\n\nlet cachedPolicy: Policy | null = null;\nlet cachedWorkspaceDir: string | null = null;\n\n/**\n * Load policy from execpolicy files.\n */\nexport function loadPolicy(workspaceDir: string): Policy {\n\tif (cachedPolicy && cachedWorkspaceDir === workspaceDir) {\n\t\treturn cachedPolicy;\n\t}\n\n\tconst policy = new Policy();\n\n\tconst globalPath = join(PATHS.MAESTRO_HOME, \"execpolicy\");\n\tconst projectPath = join(workspaceDir, \".maestro\", \"execpolicy\");\n\n\t// Load global policy\n\tif (existsSync(globalPath)) {\n\t\ttry {\n\t\t\tconst content = readFileSync(globalPath, \"utf-8\");\n\t\t\tconst parsed = parsePolicy(content, globalPath);\n\t\t\tfor (const [program, rules] of parsed.rules) {\n\t\t\t\tfor (const rule of rules) {\n\t\t\t\t\tpolicy.addRule(rule);\n\t\t\t\t}\n\t\t\t}\n\t\t\tlogger.debug(\"Loaded global execpolicy\", { path: globalPath });\n\t\t} catch (error) {\n\t\t\tlogger.warn(\"Failed to load global execpolicy\", {\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t}\n\t}\n\n\t// Load project policy (evaluated after global, so takes precedence)\n\tif (existsSync(projectPath)) {\n\t\ttry {\n\t\t\tconst content = readFileSync(projectPath, \"utf-8\");\n\t\t\tconst parsed = parsePolicy(content, projectPath);\n\t\t\tfor (const [program, rules] of parsed.rules) {\n\t\t\t\tfor (const rule of rules) {\n\t\t\t\t\tpolicy.addRule(rule);\n\t\t\t\t}\n\t\t\t}\n\t\t\tlogger.debug(\"Loaded project execpolicy\", { path: projectPath });\n\t\t} catch (error) {\n\t\t\tlogger.warn(\"Failed to load project execpolicy\", {\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t}\n\t}\n\n\tcachedPolicy = policy;\n\tcachedWorkspaceDir = workspaceDir;\n\treturn policy;\n}\n\n/**\n * Clear policy cache.\n */\nexport function clearPolicyCache(): void {\n\tcachedPolicy = null;\n\tcachedWorkspaceDir = null;\n}\n\n/**\n * Append an allow rule to the project's execpolicy file.\n * Based on Codex's amend.rs blocking_append_allow_prefix_rule.\n */\nexport function appendAllowPrefixRule(\n\tpolicyPath: string,\n\tprefix: string[],\n): void {\n\tif (prefix.length === 0) {\n\t\tthrow new Error(\"prefix cannot be empty\");\n\t}\n\n\tconst tokens = prefix.map((t) => JSON.stringify(t));\n\tconst pattern = `[${tokens.join(\", \")}]`;\n\tconst rule = `prefix_rule(pattern=${pattern}, decision=\"allow\")`;\n\n\tconst dir = dirname(policyPath);\n\tif (!existsSync(dir)) {\n\t\tmkdirSync(dir, { recursive: true });\n\t}\n\n\t// Ensure file ends with newline before appending\n\tif (existsSync(policyPath)) {\n\t\tconst content = readFileSync(policyPath, \"utf-8\");\n\t\tif (content.length > 0 && !content.endsWith(\"\\n\")) {\n\t\t\tappendFileSync(policyPath, \"\\n\");\n\t\t}\n\t\tappendFileSync(policyPath, `${rule}\\n`);\n\t} else {\n\t\twriteFileSync(policyPath, `${rule}\\n`);\n\t}\n\n\t// Clear cache since policy changed\n\tclearPolicyCache();\n\n\tlogger.debug(\"Appended allow rule\", { path: policyPath, prefix });\n}\n\n// ─────────────────────────────────────────────────────────────\n// Convenience Functions\n// ─────────────────────────────────────────────────────────────\n\n/**\n * Parse a command string into tokens.\n */\nexport function parseCommand(command: string): string[] {\n\tconst tokens: string[] = [];\n\tlet current = \"\";\n\tlet inQuotes = false;\n\tlet quoteChar = \"\";\n\tlet isEscaped = false;\n\n\tfor (const char of command) {\n\t\tif (isEscaped) {\n\t\t\tcurrent += char;\n\t\t\tisEscaped = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"\\\\\") {\n\t\t\tisEscaped = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (!inQuotes && (char === '\"' || char === \"'\")) {\n\t\t\tinQuotes = true;\n\t\t\tquoteChar = char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (inQuotes && char === quoteChar) {\n\t\t\tinQuotes = false;\n\t\t\tquoteChar = \"\";\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (!inQuotes && /\\s/.test(char)) {\n\t\t\tif (current) {\n\t\t\t\ttokens.push(current);\n\t\t\t\tcurrent = \"\";\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tcurrent += char;\n\t}\n\n\tif (current) {\n\t\ttokens.push(current);\n\t}\n\n\treturn tokens;\n}\n\n/**\n * Check a command and return the evaluation result.\n */\nexport function checkCommand(\n\tcommand: string,\n\tworkspaceDir: string,\n\theuristicsFallback?: (cmd: string[]) => Decision,\n): Evaluation {\n\tconst policy = loadPolicy(workspaceDir);\n\tconst tokens = parseCommand(command);\n\treturn policy.check(tokens, heuristicsFallback);\n}\n\n/**\n * Check if a command is allowed without prompting.\n */\nexport function isCommandAllowed(\n\tcommand: string,\n\tworkspaceDir: string,\n): boolean {\n\tconst result = checkCommand(command, workspaceDir);\n\treturn result.decision === \"allow\";\n}\n\n/**\n * Check if a command is forbidden.\n */\nexport function isCommandForbidden(\n\tcommand: string,\n\tworkspaceDir: string,\n): boolean {\n\tconst result = checkCommand(command, workspaceDir);\n\treturn result.decision === \"forbidden\";\n}\n\n/**\n * Whitelist a command by adding an allow rule to the project policy.\n */\nexport function whitelistCommand(workspaceDir: string, command: string): void {\n\tconst tokens = parseCommand(command);\n\tconst policyPath = join(workspaceDir, \".maestro\", \"execpolicy\");\n\tappendAllowPrefixRule(policyPath, tokens);\n}\n\n/**\n * Get policy summary for display.\n */\nexport function getPolicySummary(workspaceDir: string): string {\n\tconst policy = loadPolicy(workspaceDir);\n\tconst lines: string[] = [];\n\n\tlet totalRules = 0;\n\tfor (const [_program, rules] of policy.rules) {\n\t\ttotalRules += rules.length;\n\t}\n\n\tlines.push(`Execution Policy (${totalRules} rules)`);\n\tlines.push(\"\");\n\n\tif (totalRules === 0) {\n\t\tlines.push(\"No rules defined. All commands will be prompted.\");\n\t\tlines.push(\"\");\n\t\tlines.push(\"Create ~/.maestro/execpolicy or .maestro/execpolicy\");\n\t\tlines.push(\"to define command approval policies.\");\n\t} else {\n\t\tlet count = 0;\n\t\tfor (const [program, rules] of policy.rules) {\n\t\t\tif (count >= 10) {\n\t\t\t\tlines.push(`... and ${totalRules - 10} more rules`);\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tfor (const rule of rules) {\n\t\t\t\tif (count >= 10) break;\n\t\t\t\tconst pattern = [\n\t\t\t\t\trule.pattern.first,\n\t\t\t\t\t...rule.pattern.rest.map((t) =>\n\t\t\t\t\t\tt.type === \"single\" ? t.value : `[${t.values.join(\"|\")}]`,\n\t\t\t\t\t),\n\t\t\t\t].join(\" \");\n\t\t\t\tlines.push(`  ${rule.decision.toUpperCase()}: ${pattern}`);\n\t\t\t\tcount++;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn lines.join(\"\\n\");\n}\n"]}
+{"version":3,"file":"execpolicy.js","sourceRoot":"","sources":["../../src/safety/execpolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EACN,cAAc,EACd,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;AAkEjD;;;GAGG;AACH,MAAM,OAAO,MAAM;IAIlB;QACC,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,EAAE,CAAC;QAChC,IAAI,CAAC,eAAe,GAAG,IAAI,GAAG,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,KAAK;QACX,OAAO,IAAI,MAAM,EAAE,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,IAAgB;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,aAAa,CACZ,MAAgB,EAChB,QAAkB,EAClB,KAAkB,EAClB,QAAqB,EACrB,aAAsB;QAEtB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,OAAO,GAAkB;YAC9B,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;SACrD,CAAC;QACF,MAAM,IAAI,GAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;QAE9D,0BAA0B;QAC1B,IAAI,KAAK,EAAE,CAAC;YACX,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;oBAC7C,MAAM,IAAI,KAAK,CACd,sBAAsB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CACtD,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,8BAA8B;QAC9B,IAAI,QAAQ,EAAE,CAAC;YACd,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAChC,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;oBAC5C,MAAM,IAAI,KAAK,CACd,0BAA0B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CACvD,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,iBAAiB,CAAC,IAAY,EAAE,KAAe;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAEO,kBAAkB,CAAC,IAAgB,EAAE,GAAa;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpD,OAAO,OAAO,KAAK,IAAI,CAAC;IACzB,CAAC;IAEO,WAAW,CAAC,OAAsB,EAAE,GAAa;QACxD,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC;QACb,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,YAAY,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC7C,OAAO,IAAI,CAAC;YACb,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACb,CAAC;QACF,CAAC;QAED,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACpC,CAAC;IAEO,YAAY,CAAC,OAAqB,EAAE,KAAa;QACxD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC;QAChC,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CACJ,GAAa,EACb,kBAAgD,EAChD,UAA8B,EAAE;QAEhC,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAC1C,GAAG,EACH,kBAAkB,EAClB,OAAO,CACP,CAAC;QACF,OAAO,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACjD,CAAC;IAED,aAAa,CACZ,QAAoB,EACpB,kBAAgD,EAChD,UAA8B,EAAE;QAEhC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAC7C,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,EAAE,OAAO,CAAC,CACxD,CAAC;QACF,OAAO,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACjD,CAAC;IAEO,iBAAiB,CACxB,GAAa,EACb,kBAAgD,EAChD,UAA8B,EAAE;QAEhC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACX,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAE1D,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC3D,IACC,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,OAAO,CAAC,sBAAsB;YAC9B,iBAAiB,CAAC,OAAO,CAAC,EACzB,CAAC;YACF,MAAM,eAAe,GAAG,OAAO,CAAC;YAChC,KAAK,MAAM,eAAe,IAAI,IAAI,CAAC,8BAA8B,CAChE,eAAe,CACf,EAAE,CAAC;gBACH,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;gBACrE,IACC,aAAa,CAAC,MAAM,GAAG,CAAC;oBACxB,IAAI,CAAC,4BAA4B,CAAC,eAAe,EAAE,eAAe,CAAC,EAClE,CAAC;oBACF,OAAO,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,oBAAoB,CAC3B,aAAa,EACb,CAAC,eAAe,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAClC,eAAe,CACf,CACD,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,kBAAkB,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,GAAG;gBACZ,QAAQ,EAAE,kBAAkB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,8BAA8B,CAAC,eAAuB;QAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;gBAChC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACF,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IACtB,CAAC;IAEO,oBAAoB,CAC3B,KAAmB,EACnB,GAAa,EACb,eAAwB;QAExB,MAAM,OAAO,GAAgB,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC1D,IAAI,aAAa,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,QAAQ;oBACd,aAAa;oBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,eAAe;iBACf,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,4BAA4B,CACnC,IAAY,EACZ,eAAuB;QAEvB,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,KAAK,IAAI,CAAC;IACpD,CAAC;IAEO,qBAAqB,CAAC,YAAyB;QACtD,gDAAgD;QAChD,MAAM,aAAa,GAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAEnE,IAAI,eAAe,GAAa,OAAO,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1D,IAAI,GAAG,GAAG,UAAU,EAAE,CAAC;gBACtB,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC;YAClC,CAAC;QACF,CAAC;QAED,OAAO;YACN,QAAQ,EAAE,eAAe;YACzB,YAAY;SACZ,CAAC;IACH,CAAC;IAED,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,cAAc,CAAC;IAC5B,CAAC;IAED,IAAI,mBAAmB;QACtB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC7B,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,UAAkB;IAC9D,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IAE5B,MAAM,mBAAmB,GACxB,sFAAsF,CAAC;IACxF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,sCAAsC,UAAU,EAAE,EAAE;gBAC/D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACxB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,kDAAkD;IAClD,MAAM,SAAS,GACd,kFAAkF,CAAC;IAEpF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAEzC,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,OAAO,GAAkB;gBAC9B,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;wBAC3B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAkB,CAAC;oBACrD,CAAC;oBACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACpB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAkB,CAAC;oBACxD,CAAC;oBACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAkB,CAAC;gBACpD,CAAC,CAAC;aACF,CAAC;YAEF,gEAAgE;YAChE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACxD,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAe;oBACxB,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;oBACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,aAAa,EAAE,MAAM,CAAC,aAAa;iBACnC,CAAC;gBAEF,0BAA0B;gBAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACpC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;wBAC3C,MAAM,IAAI,KAAK,CACd,sBAAsB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CACtD,CAAC;oBACH,CAAC;gBACF,CAAC;gBAED,8BAA8B;gBAC9B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACvC,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;wBAC1C,MAAM,IAAI,KAAK,CACd,0BAA0B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CACvD,CAAC;oBACH,CAAC;gBACF,CAAC;gBAED,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,2BAA2B,UAAU,EAAE,EAAE;gBACpD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACxB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAwB;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAwB;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,OAAsB,EAAE,GAAa;IAC3D,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9C,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,YAAY,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACd,CAAC;QAED,IAAI,YAAY,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,YAAY,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7C,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAUD,SAAS,mBAAmB,CAAC,IAAY;IACxC,MAAM,MAAM,GAAqB;QAChC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,EAAE;KACZ,CAAC;IAEF,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAChE,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,qBAAqB;IACrB,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3D,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,CAAC;IACF,CAAC;IAED,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACjE,IAAI,aAAa,EAAE,CAAC;QACnB,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC;IACtC,CAAC;IAED,kBAAkB;IAClB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC7E,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,sBAAsB;IACtB,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnE,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,QAAQ,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAOD,SAAS,uBAAuB,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,OAAO;QACN,IAAI;QACJ,KAAK;KACL,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,IAAY;IACtD,MAAM,YAAY,GAAG,IAAI,MAAM,CAC9B,GAAG,IAAI,2CAA2C,CAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,MAAM,CAC9B,GAAG,IAAI,2CAA2C,CAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACrC,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAExC,sCAAsC;IACtC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3B,6BAA6B;QAC7B,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM;QAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,eAAe;YACf,MAAM,KAAK,GAAG,IAAI,CAAC;YACnB,CAAC,EAAE,CAAC;YACJ,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC1C,CAAC,EAAE,CAAC;oBACJ,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACP,KAAK,IAAI,CAAC,CAAC;gBACZ,CAAC;gBACD,CAAC,EAAE,CAAC;YACL,CAAC;YACD,CAAC,EAAE,CAAC,CAAC,qBAAqB;YAC1B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,qBAAqB;YACrB,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;qBAClB,IAAI,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;gBAC5B,CAAC,EAAE,CAAC;YACL,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAExC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM;QAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC;YACnB,CAAC,EAAE,CAAC;YACJ,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC1C,CAAC,EAAE,CAAC;oBACJ,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACP,KAAK,IAAI,CAAC,CAAC;gBACZ,CAAC;gBACD,CAAC,EAAE,CAAC;YACL,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACtC,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAExC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM;QAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;qBAClB,IAAI,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;gBAC5B,CAAC,EAAE,CAAC;YACL,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzC,8CAA8C;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC;YACnB,CAAC,EAAE,CAAC;YACJ,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC1C,CAAC,EAAE,CAAC;oBACJ,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACP,KAAK,IAAI,CAAC,CAAC;gBACZ,CAAC;gBACD,CAAC,EAAE,CAAC;YACL,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;QACF,CAAC;aAAM,CAAC;YACP,CAAC,EAAE,CAAC;QACL,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,gEAAgE;AAChE,iBAAiB;AACjB,gEAAgE;AAEhE,IAAI,YAAY,GAAkB,IAAI,CAAC;AACvC,IAAI,kBAAkB,GAAkB,IAAI,CAAC;AAE7C;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,YAAoB;IAC9C,IAAI,YAAY,IAAI,kBAAkB,KAAK,YAAY,EAAE,CAAC;QACzD,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IAE5B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAEjE,qBAAqB;IACrB,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAChD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBAC1B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;YACF,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBACxD,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC/C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACjD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBAC1B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;YACF,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBACxD,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBAChD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,YAAY,GAAG,MAAM,CAAC;IACtB,kBAAkB,GAAG,YAAY,CAAC;IAClC,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC/B,YAAY,GAAG,IAAI,CAAC;IACpB,kBAAkB,GAAG,IAAI,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACpC,UAAkB,EAClB,MAAgB;IAEhB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACzC,MAAM,IAAI,GAAG,uBAAuB,OAAO,qBAAqB,CAAC;IAEjE,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,iDAAiD;IACjD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,cAAc,CAAC,UAAU,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACP,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,mCAAmC;IACnC,gBAAgB,EAAE,CAAC;IAEnB,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,gEAAgE;AAChE,wBAAwB;AACxB,gEAAgE;AAEhE;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC3C,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC5C,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,EAAE,CAAC;IAEnB,MAAM,UAAU,GAAG,GAAG,EAAE;QACvB,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,GAAG,EAAE,CAAC;QACd,CAAC;IACF,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,EAAE;QACzB,UAAU,EAAE,CAAC;QACb,MAAM,aAAa,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACnB,CAAC,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACvC,IAAI,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC1D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACvB,OAAO,IAAI,QAAQ,CAAC;gBACrB,CAAC;gBACD,CAAC,EAAE,CAAC;YACL,CAAC;iBAAM,CAAC;gBACP,OAAO,IAAI,IAAI,CAAC;YACjB,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,uBAAuB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;YACtD,YAAY,EAAE,CAAC;YACf,IACC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAC5D,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAC3D,CAAC;gBACF,CAAC,EAAE,CAAC;YACL,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACjD,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACV,CAAC;QAED,IAAI,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACpC,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS,GAAG,EAAE,CAAC;YACf,SAAS;QACV,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,UAAU,EAAE,CAAC;YACb,SAAS;QACV,CAAC;QAED,OAAO,IAAI,IAAI,CAAC;IACjB,CAAC;IAED,YAAY,EAAE,CAAC;IAEf,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe,EAAE,KAAa;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;IAC1C,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,CACN,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CACjC,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,MAAgB;IACpD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACzB,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,WAAW,EAAE,CAAC;YACjB,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;gBACnC,CAAC,EAAE,CAAC;YACL,CAAC;YACD,SAAS;QACV,CAAC;QACD,IAAI,CAAC,cAAc,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,SAAS;QACV,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,cAAc,GAAG,IAAI,CAAC;IACvB,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACvC,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,gBAAgB,CACxB,KAAa;IAEb,IAAI,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,yCAAyC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACzC,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC9C,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,qBAAqB,CAC7B,QAAgB,EAChB,QAAiB,EACjB,SAAiB;IAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CACN,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,IAAI;QACjB,QAAQ,KAAK,IAAI;QACjB,QAAQ,KAAK,GAAG;QAChB,QAAQ,KAAK,GAAG,CAChB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC3B,OAAe,EACf,YAAoB,EACpB,kBAAgD;IAEhD,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,kBAAkB,EAAE;QACzD,sBAAsB,EAAE,IAAI;KAC5B,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC/B,OAAe,EACf,YAAoB;IAEpB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAAe,EACf,YAAoB;IAEpB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB,EAAE,OAAe;IACrE,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC/B,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9C,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,qBAAqB,UAAU,SAAS,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACP,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CAAC,WAAW,UAAU,GAAG,EAAE,aAAa,CAAC,CAAC;gBACpD,MAAM;YACP,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,KAAK,IAAI,EAAE;oBAAE,MAAM;gBACvB,MAAM,OAAO,GAAG;oBACf,IAAI,CAAC,OAAO,CAAC,KAAK;oBAClB,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9B,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CACzD;iBACD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC;gBAC3D,KAAK,EAAE,CAAC;YACT,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC","sourcesContent":["/**\n * Execution Policy System - Pattern-based command approval policies.\n *\n * Ported from OpenAI Codex (MIT License):\n * https://github.com/openai/codex/tree/main/codex-rs/execpolicy\n *\n * Policies are defined in `.execpolicy` files using a Starlark-like syntax:\n *\n * ```starlark\n * prefix_rule(\n *     pattern=[\"git\", \"status\"],\n *     decision=\"allow\",\n * )\n *\n * prefix_rule(\n *     pattern=[\"git\", [\"push\", \"fetch\"]],\n *     decision=\"prompt\",\n *     match=[[\"git\", \"push\", \"origin\", \"main\"]],\n *     not_match=[[\"git\", \"status\"]],\n * )\n *\n * prefix_rule(\n *     pattern=[\"rm\", \"-rf\"],\n *     decision=\"forbidden\",\n * )\n * ```\n *\n * Configuration paths:\n * - ~/.maestro/execpolicy (global)\n * - .maestro/execpolicy (project - evaluated after global)\n */\n\nimport {\n\tappendFileSync,\n\texistsSync,\n\tmkdirSync,\n\treadFileSync,\n\twriteFileSync,\n} from \"node:fs\";\nimport { basename, dirname, join, win32 } from \"node:path\";\nimport { PATHS } from \"../config/constants.js\";\nimport { createLogger } from \"../utils/logger.js\";\n\nconst logger = createLogger(\"safety:execpolicy\");\n\n/**\n * Decision for a command execution.\n * Based on Codex's Decision enum.\n */\nexport type Decision = \"allow\" | \"prompt\" | \"forbidden\";\n\n/**\n * Pattern token - either a single string or alternatives.\n * Based on Codex's PatternToken.\n */\nexport type PatternToken =\n\t| { type: \"single\"; value: string }\n\t| { type: \"alts\"; values: string[] };\n\n/**\n * A prefix pattern for matching commands.\n * Based on Codex's PrefixPattern.\n */\nexport interface PrefixPattern {\n\tfirst: string;\n\trest: PatternToken[];\n}\n\n/**\n * A prefix rule that matches commands.\n * Based on Codex's PrefixRule.\n */\nexport interface PrefixRule {\n\tpattern: PrefixPattern;\n\tdecision: Decision;\n\tjustification?: string;\n}\n\n/**\n * A rule match result.\n * Based on Codex's RuleMatch.\n */\nexport type RuleMatch =\n\t| {\n\t\t\ttype: \"prefix\";\n\t\t\tmatchedPrefix: string[];\n\t\t\tdecision: Decision;\n\t\t\tjustification?: string;\n\t\t\tresolvedProgram?: string;\n\t  }\n\t| {\n\t\t\ttype: \"heuristics\";\n\t\t\tcommand: string[];\n\t\t\tdecision: Decision;\n\t  };\n\n/**\n * Policy evaluation result.\n * Based on Codex's Evaluation.\n */\nexport interface Evaluation {\n\tdecision: Decision;\n\tmatchedRules: RuleMatch[];\n}\n\nexport interface PolicyCheckOptions {\n\tresolveHostExecutables?: boolean;\n}\n\n/**\n * Policy containing multiple rules indexed by program name.\n * Based on Codex's Policy.\n */\nexport class Policy {\n\tprivate rulesByProgram: Map<string, PrefixRule[]>;\n\tprivate hostExecutables: Map<string, Set<string>>;\n\n\tconstructor() {\n\t\tthis.rulesByProgram = new Map();\n\t\tthis.hostExecutables = new Map();\n\t}\n\n\tstatic empty(): Policy {\n\t\treturn new Policy();\n\t}\n\n\taddRule(rule: PrefixRule): void {\n\t\tconst program = rule.pattern.first;\n\t\tconst existing = this.rulesByProgram.get(program) ?? [];\n\t\texisting.push(rule);\n\t\tthis.rulesByProgram.set(program, existing);\n\t}\n\n\taddPrefixRule(\n\t\tprefix: string[],\n\t\tdecision: Decision,\n\t\tmatch?: string[][],\n\t\tnotMatch?: string[][],\n\t\tjustification?: string,\n\t): void {\n\t\tif (prefix.length === 0) {\n\t\t\tthrow new Error(\"prefix cannot be empty\");\n\t\t}\n\n\t\tconst [first, ...rest] = prefix;\n\t\tif (!first) {\n\t\t\tthrow new Error(\"prefix cannot be empty\");\n\t\t}\n\t\tconst pattern: PrefixPattern = {\n\t\t\tfirst,\n\t\t\trest: rest.map((t) => ({ type: \"single\", value: t })),\n\t\t};\n\t\tconst rule: PrefixRule = { pattern, decision, justification };\n\n\t\t// Validate match examples\n\t\tif (match) {\n\t\t\tfor (const example of match) {\n\t\t\t\tif (!this.ruleMatchesCommand(rule, example)) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Rule should match [${example.join(\" \")}] but doesn't`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// Validate not_match examples\n\t\tif (notMatch) {\n\t\t\tfor (const example of notMatch) {\n\t\t\t\tif (this.ruleMatchesCommand(rule, example)) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Rule should NOT match [${example.join(\" \")}] but does`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tthis.addRule(rule);\n\t}\n\n\taddHostExecutable(name: string, paths: string[]): void {\n\t\tif (!name) {\n\t\t\tthrow new Error(\"host executable name cannot be empty\");\n\t\t}\n\t\tconst existing = this.hostExecutables.get(name) ?? new Set<string>();\n\t\tfor (const path of paths) {\n\t\t\texisting.add(path);\n\t\t}\n\t\tthis.hostExecutables.set(name, existing);\n\t}\n\n\tprivate ruleMatchesCommand(rule: PrefixRule, cmd: string[]): boolean {\n\t\tconst matched = this.matchPrefix(rule.pattern, cmd);\n\t\treturn matched !== null;\n\t}\n\n\tprivate matchPrefix(pattern: PrefixPattern, cmd: string[]): string[] | null {\n\t\tconst patternLength = pattern.rest.length + 1;\n\t\tif (cmd.length < patternLength || cmd[0] !== pattern.first) {\n\t\t\treturn null;\n\t\t}\n\n\t\tfor (let i = 0; i < pattern.rest.length; i++) {\n\t\t\tconst patternToken = pattern.rest[i];\n\t\t\tconst cmdToken = cmd[i + 1];\n\t\t\tif (!patternToken || cmdToken === undefined) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tif (!this.tokenMatches(patternToken, cmdToken)) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t}\n\n\t\treturn cmd.slice(0, patternLength);\n\t}\n\n\tprivate tokenMatches(pattern: PatternToken, token: string): boolean {\n\t\tif (pattern.type === \"single\") {\n\t\t\treturn pattern.value === token;\n\t\t}\n\t\treturn pattern.values.includes(token);\n\t}\n\n\tcheck(\n\t\tcmd: string[],\n\t\theuristicsFallback?: (cmd: string[]) => Decision,\n\t\toptions: PolicyCheckOptions = {},\n\t): Evaluation {\n\t\tconst matchedRules = this.matchesForCommand(\n\t\t\tcmd,\n\t\t\theuristicsFallback,\n\t\t\toptions,\n\t\t);\n\t\treturn this.evaluationFromMatches(matchedRules);\n\t}\n\n\tcheckMultiple(\n\t\tcommands: string[][],\n\t\theuristicsFallback?: (cmd: string[]) => Decision,\n\t\toptions: PolicyCheckOptions = {},\n\t): Evaluation {\n\t\tconst matchedRules = commands.flatMap((cmd) =>\n\t\t\tthis.matchesForCommand(cmd, heuristicsFallback, options),\n\t\t);\n\t\treturn this.evaluationFromMatches(matchedRules);\n\t}\n\n\tprivate matchesForCommand(\n\t\tcmd: string[],\n\t\theuristicsFallback?: (cmd: string[]) => Decision,\n\t\toptions: PolicyCheckOptions = {},\n\t): RuleMatch[] {\n\t\tconst program = cmd[0];\n\t\tif (!program) {\n\t\t\treturn [];\n\t\t}\n\n\t\tconst exactRules = this.rulesByProgram.get(program) ?? [];\n\n\t\tconst matched = this.collectPrefixMatches(exactRules, cmd);\n\t\tif (\n\t\t\tmatched.length === 0 &&\n\t\t\toptions.resolveHostExecutables &&\n\t\t\tisPathLikeProgram(program)\n\t\t) {\n\t\t\tconst resolvedProgram = program;\n\t\t\tfor (const fallbackProgram of this.hostExecutableFallbackPrograms(\n\t\t\t\tresolvedProgram,\n\t\t\t)) {\n\t\t\t\tconst fallbackRules = this.rulesByProgram.get(fallbackProgram) ?? [];\n\t\t\t\tif (\n\t\t\t\t\tfallbackRules.length > 0 &&\n\t\t\t\t\tthis.canUseHostExecutableFallback(fallbackProgram, resolvedProgram)\n\t\t\t\t) {\n\t\t\t\t\tmatched.push(\n\t\t\t\t\t\t...this.collectPrefixMatches(\n\t\t\t\t\t\t\tfallbackRules,\n\t\t\t\t\t\t\t[fallbackProgram, ...cmd.slice(1)],\n\t\t\t\t\t\t\tresolvedProgram,\n\t\t\t\t\t\t),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (matched.length === 0 && heuristicsFallback) {\n\t\t\tmatched.push({\n\t\t\t\ttype: \"heuristics\",\n\t\t\t\tcommand: cmd,\n\t\t\t\tdecision: heuristicsFallback(cmd),\n\t\t\t});\n\t\t}\n\n\t\treturn matched;\n\t}\n\n\tprivate hostExecutableFallbackPrograms(resolvedProgram: string): string[] {\n\t\tconst programs = new Set<string>();\n\t\tfor (const [name, paths] of this.hostExecutables) {\n\t\t\tif (paths.has(resolvedProgram)) {\n\t\t\t\tprograms.add(name);\n\t\t\t}\n\t\t}\n\t\tprograms.add(hostExecutableBasename(resolvedProgram));\n\t\treturn [...programs];\n\t}\n\n\tprivate collectPrefixMatches(\n\t\trules: PrefixRule[],\n\t\tcmd: string[],\n\t\tresolvedProgram?: string,\n\t): RuleMatch[] {\n\t\tconst matched: RuleMatch[] = [];\n\t\tfor (const rule of rules) {\n\t\t\tconst matchedPrefix = this.matchPrefix(rule.pattern, cmd);\n\t\t\tif (matchedPrefix) {\n\t\t\t\tmatched.push({\n\t\t\t\t\ttype: \"prefix\",\n\t\t\t\t\tmatchedPrefix,\n\t\t\t\t\tdecision: rule.decision,\n\t\t\t\t\tjustification: rule.justification,\n\t\t\t\t\tresolvedProgram,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\treturn matched;\n\t}\n\n\tprivate canUseHostExecutableFallback(\n\t\tname: string,\n\t\tresolvedProgram: string,\n\t): boolean {\n\t\tconst allowedPaths = this.hostExecutables.get(name);\n\t\treturn allowedPaths?.has(resolvedProgram) === true;\n\t}\n\n\tprivate evaluationFromMatches(matchedRules: RuleMatch[]): Evaluation {\n\t\t// Decision priority: forbidden > prompt > allow\n\t\tconst decisionOrder: Decision[] = [\"allow\", \"prompt\", \"forbidden\"];\n\n\t\tlet highestDecision: Decision = \"allow\";\n\t\tfor (const match of matchedRules) {\n\t\t\tconst idx = decisionOrder.indexOf(match.decision);\n\t\t\tconst currentIdx = decisionOrder.indexOf(highestDecision);\n\t\t\tif (idx > currentIdx) {\n\t\t\t\thighestDecision = match.decision;\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tdecision: highestDecision,\n\t\t\tmatchedRules,\n\t\t};\n\t}\n\n\tget rules(): Map<string, PrefixRule[]> {\n\t\treturn this.rulesByProgram;\n\t}\n\n\tget hostExecutablePaths(): Map<string, Set<string>> {\n\t\treturn this.hostExecutables;\n\t}\n}\n\n/**\n * Parse a Starlark-like policy file.\n * Supports the `prefix_rule()` function with pattern, decision, match, and not_match.\n */\nexport function parsePolicy(content: string, identifier: string): Policy {\n\tconst policy = new Policy();\n\n\tconst hostExecutableRegex =\n\t\t/host_executable\\s*\\(\\s*([\\s\\S]*?)\\s*\\)\\s*(?:,?\\s*(?=host_executable|prefix_rule|$))/g;\n\tfor (const match of content.matchAll(hostExecutableRegex)) {\n\t\tconst args = match[1];\n\t\tif (!args) continue;\n\t\ttry {\n\t\t\tconst parsed = parseHostExecutableArgs(args);\n\t\t\tpolicy.addHostExecutable(parsed.name, parsed.paths);\n\t\t} catch (error) {\n\t\t\tlogger.warn(`Failed to parse host executable in ${identifier}`, {\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t\targs: args.slice(0, 100),\n\t\t\t});\n\t\t}\n\t}\n\n\t// Simple regex-based parser for prefix_rule calls\n\tconst ruleRegex =\n\t\t/prefix_rule\\s*\\(\\s*([\\s\\S]*?)\\s*\\)\\s*(?:,?\\s*(?=host_executable|prefix_rule|$))/g;\n\n\tfor (const match of content.matchAll(ruleRegex)) {\n\t\tconst args = match[1];\n\t\tif (!args) continue;\n\n\t\ttry {\n\t\t\tconst parsed = parsePrefixRuleArgs(args);\n\n\t\t\tconst [first, ...rest] = parsed.pattern;\n\t\t\tif (!first) {\n\t\t\t\tthrow new Error(\"pattern cannot be empty\");\n\t\t\t}\n\t\t\tconst pattern: PrefixPattern = {\n\t\t\t\tfirst: getPatternString(first),\n\t\t\t\trest: rest.map((t) => {\n\t\t\t\t\tif (typeof t === \"string\") {\n\t\t\t\t\t\treturn { type: \"single\", value: t } as PatternToken;\n\t\t\t\t\t}\n\t\t\t\t\tif (t.length === 1) {\n\t\t\t\t\t\treturn { type: \"single\", value: t[0] } as PatternToken;\n\t\t\t\t\t}\n\t\t\t\t\treturn { type: \"alts\", values: t } as PatternToken;\n\t\t\t\t}),\n\t\t\t};\n\n\t\t\t// Handle alternatives in first token (first is validated above)\n\t\t\tconst firstAlternatives = getPatternAlternatives(first);\n\t\t\tfor (const firstAlt of firstAlternatives) {\n\t\t\t\tconst rule: PrefixRule = {\n\t\t\t\t\tpattern: { ...pattern, first: firstAlt },\n\t\t\t\t\tdecision: parsed.decision,\n\t\t\t\t\tjustification: parsed.justification,\n\t\t\t\t};\n\n\t\t\t\t// Validate match examples\n\t\t\t\tfor (const example of parsed.match) {\n\t\t\t\t\tif (!matchesPrefix(rule.pattern, example)) {\n\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t`Rule should match [${example.join(\" \")}] but doesn't`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// Validate not_match examples\n\t\t\t\tfor (const example of parsed.notMatch) {\n\t\t\t\t\tif (matchesPrefix(rule.pattern, example)) {\n\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t`Rule should NOT match [${example.join(\" \")}] but does`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tpolicy.addRule(rule);\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tlogger.warn(`Failed to parse rule in ${identifier}`, {\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t\targs: args.slice(0, 100),\n\t\t\t});\n\t\t}\n\t}\n\n\treturn policy;\n}\n\nfunction getPatternString(token: string | string[]): string {\n\tif (typeof token === \"string\") {\n\t\treturn token;\n\t}\n\tconst first = token[0];\n\tif (!first) {\n\t\tthrow new Error(\"pattern array cannot be empty\");\n\t}\n\treturn first;\n}\n\nfunction getPatternAlternatives(token: string | string[]): string[] {\n\treturn typeof token === \"string\" ? [token] : token;\n}\n\nfunction matchesPrefix(pattern: PrefixPattern, cmd: string[]): boolean {\n\tconst patternLength = pattern.rest.length + 1;\n\tif (cmd.length < patternLength || cmd[0] !== pattern.first) {\n\t\treturn false;\n\t}\n\n\tfor (let i = 0; i < pattern.rest.length; i++) {\n\t\tconst patternToken = pattern.rest[i];\n\t\tconst cmdToken = cmd[i + 1];\n\t\tif (!patternToken || cmdToken === undefined) {\n\t\t\treturn false;\n\t\t}\n\n\t\tif (patternToken.type === \"single\") {\n\t\t\tif (patternToken.value !== cmdToken) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t} else {\n\t\t\tif (!patternToken.values.includes(cmdToken)) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn true;\n}\n\ninterface ParsedPrefixRule {\n\tpattern: (string | string[])[];\n\tdecision: Decision;\n\tjustification?: string;\n\tmatch: string[][];\n\tnotMatch: string[][];\n}\n\nfunction parsePrefixRuleArgs(args: string): ParsedPrefixRule {\n\tconst result: ParsedPrefixRule = {\n\t\tpattern: [],\n\t\tdecision: \"allow\",\n\t\tmatch: [],\n\t\tnotMatch: [],\n\t};\n\n\t// Parse pattern=...\n\tconst patternMatch = args.match(/pattern\\s*=\\s*(\\[[\\s\\S]*?\\])/);\n\tif (patternMatch?.[1]) {\n\t\tresult.pattern = parsePatternArray(patternMatch[1]);\n\t}\n\n\t// Parse decision=...\n\tconst decisionMatch = args.match(/decision\\s*=\\s*\"(\\w+)\"/);\n\tif (decisionMatch?.[1]) {\n\t\tconst d = decisionMatch[1];\n\t\tif (d === \"allow\" || d === \"prompt\" || d === \"forbidden\") {\n\t\t\tresult.decision = d;\n\t\t}\n\t}\n\n\tconst justification = parseNamedStringArg(args, \"justification\");\n\tif (justification) {\n\t\tresult.justification = justification;\n\t}\n\n\t// Parse match=...\n\tconst matchMatch = args.match(/(?<![_])match\\s*=\\s*(\\[[\\s\\S]*?\\](?:\\s*,)?)/);\n\tif (matchMatch?.[1]) {\n\t\tresult.match = parseExamplesArray(matchMatch[1]);\n\t}\n\n\t// Parse not_match=...\n\tconst notMatchMatch = args.match(/not_match\\s*=\\s*(\\[[\\s\\S]*?\\])/);\n\tif (notMatchMatch?.[1]) {\n\t\tresult.notMatch = parseExamplesArray(notMatchMatch[1]);\n\t}\n\n\tif (result.pattern.length === 0) {\n\t\tthrow new Error(\"pattern is required\");\n\t}\n\n\treturn result;\n}\n\ninterface ParsedHostExecutable {\n\tname: string;\n\tpaths: string[];\n}\n\nfunction parseHostExecutableArgs(args: string): ParsedHostExecutable {\n\tconst name = parseNamedStringArg(args, \"name\");\n\tif (!name) {\n\t\tthrow new Error(\"host_executable name is required\");\n\t}\n\n\tconst pathsMatch = args.match(/paths\\s*=\\s*(\\[[\\s\\S]*?\\])/);\n\tconst paths = pathsMatch?.[1] ? parseStringArray(pathsMatch[1]) : [];\n\treturn {\n\t\tname,\n\t\tpaths,\n\t};\n}\n\nfunction parseNamedStringArg(args: string, name: string): string | undefined {\n\tconst doubleQuoted = new RegExp(\n\t\t`${name}\\\\s*=\\\\s*\"([^\"\\\\\\\\]*(?:\\\\\\\\.[^\"\\\\\\\\]*)*)\"`,\n\t).exec(args);\n\tif (doubleQuoted?.[1] !== undefined) {\n\t\treturn unescapePolicyString(doubleQuoted[1]);\n\t}\n\n\tconst singleQuoted = new RegExp(\n\t\t`${name}\\\\s*=\\\\s*'([^'\\\\\\\\]*(?:\\\\\\\\.[^'\\\\\\\\]*)*)'`,\n\t).exec(args);\n\tif (singleQuoted?.[1] !== undefined) {\n\t\treturn unescapePolicyString(singleQuoted[1]);\n\t}\n\treturn undefined;\n}\n\nfunction unescapePolicyString(value: string): string {\n\treturn value.replace(/\\\\([\"'\\\\])/g, \"$1\");\n}\n\nfunction parsePatternArray(str: string): (string | string[])[] {\n\tconst result: (string | string[])[] = [];\n\tconst content = str.slice(1, -1).trim();\n\n\t// Simple tokenizer for pattern arrays\n\tlet i = 0;\n\twhile (i < content.length) {\n\t\t// Skip whitespace and commas\n\t\twhile (i < content.length && /[\\s,]/.test(content.charAt(i))) i++;\n\t\tif (i >= content.length) break;\n\n\t\tconst char = content.charAt(i);\n\t\tif (char === '\"' || char === \"'\") {\n\t\t\t// String token\n\t\t\tconst quote = char;\n\t\t\ti++;\n\t\t\tlet value = \"\";\n\t\t\twhile (i < content.length && content.charAt(i) !== quote) {\n\t\t\t\tconst c = content.charAt(i);\n\t\t\t\tif (c === \"\\\\\" && i + 1 < content.length) {\n\t\t\t\t\ti++;\n\t\t\t\t\tvalue += content.charAt(i);\n\t\t\t\t} else {\n\t\t\t\t\tvalue += c;\n\t\t\t\t}\n\t\t\t\ti++;\n\t\t\t}\n\t\t\ti++; // skip closing quote\n\t\t\tresult.push(value);\n\t\t} else if (char === \"[\") {\n\t\t\t// Alternatives array\n\t\t\tconst start = i;\n\t\t\tlet depth = 1;\n\t\t\ti++;\n\t\t\twhile (i < content.length && depth > 0) {\n\t\t\t\tconst c = content.charAt(i);\n\t\t\t\tif (c === \"[\") depth++;\n\t\t\t\telse if (c === \"]\") depth--;\n\t\t\t\ti++;\n\t\t\t}\n\t\t\tconst nestedStr = content.slice(start, i);\n\t\t\tconst nested = parseStringArray(nestedStr);\n\t\t\tresult.push(nested);\n\t\t}\n\t}\n\n\treturn result;\n}\n\nfunction parseStringArray(str: string): string[] {\n\tconst result: string[] = [];\n\tconst content = str.slice(1, -1).trim();\n\n\tlet i = 0;\n\twhile (i < content.length) {\n\t\twhile (i < content.length && /[\\s,]/.test(content.charAt(i))) i++;\n\t\tif (i >= content.length) break;\n\n\t\tconst char = content.charAt(i);\n\t\tif (char === '\"' || char === \"'\") {\n\t\t\tconst quote = char;\n\t\t\ti++;\n\t\t\tlet value = \"\";\n\t\t\twhile (i < content.length && content.charAt(i) !== quote) {\n\t\t\t\tconst c = content.charAt(i);\n\t\t\t\tif (c === \"\\\\\" && i + 1 < content.length) {\n\t\t\t\t\ti++;\n\t\t\t\t\tvalue += content.charAt(i);\n\t\t\t\t} else {\n\t\t\t\t\tvalue += c;\n\t\t\t\t}\n\t\t\t\ti++;\n\t\t\t}\n\t\t\ti++;\n\t\t\tresult.push(value);\n\t\t}\n\t}\n\n\treturn result;\n}\n\nfunction parseExamplesArray(str: string): string[][] {\n\tconst result: string[][] = [];\n\tconst content = str.slice(1, -1).trim();\n\n\tlet i = 0;\n\twhile (i < content.length) {\n\t\twhile (i < content.length && /[\\s,]/.test(content.charAt(i))) i++;\n\t\tif (i >= content.length) break;\n\n\t\tconst char = content.charAt(i);\n\t\tif (char === \"[\") {\n\t\t\tconst start = i;\n\t\t\tlet depth = 1;\n\t\t\ti++;\n\t\t\twhile (i < content.length && depth > 0) {\n\t\t\t\tconst c = content.charAt(i);\n\t\t\t\tif (c === \"[\") depth++;\n\t\t\t\telse if (c === \"]\") depth--;\n\t\t\t\ti++;\n\t\t\t}\n\t\t\tconst nestedStr = content.slice(start, i);\n\t\t\tresult.push(parseStringArray(nestedStr));\n\t\t} else if (char === '\"' || char === \"'\") {\n\t\t\t// Shell command string that needs to be split\n\t\t\tconst quote = char;\n\t\t\ti++;\n\t\t\tlet value = \"\";\n\t\t\twhile (i < content.length && content.charAt(i) !== quote) {\n\t\t\t\tconst c = content.charAt(i);\n\t\t\t\tif (c === \"\\\\\" && i + 1 < content.length) {\n\t\t\t\t\ti++;\n\t\t\t\t\tvalue += content.charAt(i);\n\t\t\t\t} else {\n\t\t\t\t\tvalue += c;\n\t\t\t\t}\n\t\t\t\ti++;\n\t\t\t}\n\t\t\ti++;\n\t\t\tconst tokens = parseCommand(value);\n\t\t\tif (tokens.length > 0) {\n\t\t\t\tresult.push(tokens);\n\t\t\t}\n\t\t} else {\n\t\t\ti++;\n\t\t}\n\t}\n\n\treturn result;\n}\n\n// ─────────────────────────────────────────────────────────────\n// Policy Loading\n// ─────────────────────────────────────────────────────────────\n\nlet cachedPolicy: Policy | null = null;\nlet cachedWorkspaceDir: string | null = null;\n\n/**\n * Load policy from execpolicy files.\n */\nexport function loadPolicy(workspaceDir: string): Policy {\n\tif (cachedPolicy && cachedWorkspaceDir === workspaceDir) {\n\t\treturn cachedPolicy;\n\t}\n\n\tconst policy = new Policy();\n\n\tconst globalPath = join(PATHS.MAESTRO_HOME, \"execpolicy\");\n\tconst projectPath = join(workspaceDir, \".maestro\", \"execpolicy\");\n\n\t// Load global policy\n\tif (existsSync(globalPath)) {\n\t\ttry {\n\t\t\tconst content = readFileSync(globalPath, \"utf-8\");\n\t\t\tconst parsed = parsePolicy(content, globalPath);\n\t\t\tfor (const [program, rules] of parsed.rules) {\n\t\t\t\tfor (const rule of rules) {\n\t\t\t\t\tpolicy.addRule(rule);\n\t\t\t\t}\n\t\t\t}\n\t\t\tfor (const [name, paths] of parsed.hostExecutablePaths) {\n\t\t\t\tpolicy.addHostExecutable(name, [...paths]);\n\t\t\t}\n\t\t\tlogger.debug(\"Loaded global execpolicy\", { path: globalPath });\n\t\t} catch (error) {\n\t\t\tlogger.warn(\"Failed to load global execpolicy\", {\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t}\n\t}\n\n\t// Load project policy (evaluated after global, so takes precedence)\n\tif (existsSync(projectPath)) {\n\t\ttry {\n\t\t\tconst content = readFileSync(projectPath, \"utf-8\");\n\t\t\tconst parsed = parsePolicy(content, projectPath);\n\t\t\tfor (const [program, rules] of parsed.rules) {\n\t\t\t\tfor (const rule of rules) {\n\t\t\t\t\tpolicy.addRule(rule);\n\t\t\t\t}\n\t\t\t}\n\t\t\tfor (const [name, paths] of parsed.hostExecutablePaths) {\n\t\t\t\tpolicy.addHostExecutable(name, [...paths]);\n\t\t\t}\n\t\t\tlogger.debug(\"Loaded project execpolicy\", { path: projectPath });\n\t\t} catch (error) {\n\t\t\tlogger.warn(\"Failed to load project execpolicy\", {\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t}\n\t}\n\n\tcachedPolicy = policy;\n\tcachedWorkspaceDir = workspaceDir;\n\treturn policy;\n}\n\n/**\n * Clear policy cache.\n */\nexport function clearPolicyCache(): void {\n\tcachedPolicy = null;\n\tcachedWorkspaceDir = null;\n}\n\n/**\n * Append an allow rule to the project's execpolicy file.\n * Based on Codex's amend.rs blocking_append_allow_prefix_rule.\n */\nexport function appendAllowPrefixRule(\n\tpolicyPath: string,\n\tprefix: string[],\n): void {\n\tif (prefix.length === 0) {\n\t\tthrow new Error(\"prefix cannot be empty\");\n\t}\n\n\tconst tokens = prefix.map((t) => JSON.stringify(t));\n\tconst pattern = `[${tokens.join(\", \")}]`;\n\tconst rule = `prefix_rule(pattern=${pattern}, decision=\"allow\")`;\n\n\tconst dir = dirname(policyPath);\n\tif (!existsSync(dir)) {\n\t\tmkdirSync(dir, { recursive: true });\n\t}\n\n\t// Ensure file ends with newline before appending\n\tif (existsSync(policyPath)) {\n\t\tconst content = readFileSync(policyPath, \"utf-8\");\n\t\tif (content.length > 0 && !content.endsWith(\"\\n\")) {\n\t\t\tappendFileSync(policyPath, \"\\n\");\n\t\t}\n\t\tappendFileSync(policyPath, `${rule}\\n`);\n\t} else {\n\t\twriteFileSync(policyPath, `${rule}\\n`);\n\t}\n\n\t// Clear cache since policy changed\n\tclearPolicyCache();\n\n\tlogger.debug(\"Appended allow rule\", { path: policyPath, prefix });\n}\n\n// ─────────────────────────────────────────────────────────────\n// Convenience Functions\n// ─────────────────────────────────────────────────────────────\n\n/**\n * Parse a command string into tokens.\n */\nexport function parseCommand(command: string): string[] {\n\treturn parseCommandSequence(command)[0] ?? [];\n}\n\nfunction parseCommandSequence(command: string): string[][] {\n\tconst commands: string[][] = [];\n\tconst tokens: string[] = [];\n\tlet current = \"\";\n\tlet inQuotes = false;\n\tlet quoteChar = \"\";\n\n\tconst flushToken = () => {\n\t\tif (current) {\n\t\t\ttokens.push(current);\n\t\t\tcurrent = \"\";\n\t\t}\n\t};\n\tconst flushCommand = () => {\n\t\tflushToken();\n\t\tconst commandTokens = normalizeShellCommandTokens(tokens);\n\t\tif (commandTokens.length > 0) {\n\t\t\tcommands.push(commandTokens);\n\t\t}\n\t\ttokens.length = 0;\n\t};\n\n\tfor (let i = 0; i < command.length; i++) {\n\t\tconst char = command.charAt(i);\n\t\tif (char === \"\\\\\") {\n\t\t\tconst nextChar = command.charAt(i + 1);\n\t\t\tif (shouldEscapeBackslash(nextChar, inQuotes, quoteChar)) {\n\t\t\t\tif (nextChar !== \"\\n\") {\n\t\t\t\t\tcurrent += nextChar;\n\t\t\t\t}\n\t\t\t\ti++;\n\t\t\t} else {\n\t\t\t\tcurrent += char;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (!inQuotes && isShellCommandSeparator(command, i)) {\n\t\t\tflushCommand();\n\t\t\tif (\n\t\t\t\t(command.charAt(i) === \"&\" && command.charAt(i + 1) === \"&\") ||\n\t\t\t\t(command.charAt(i) === \"|\" && command.charAt(i + 1) === \"|\")\n\t\t\t) {\n\t\t\t\ti++;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (!inQuotes && (char === '\"' || char === \"'\")) {\n\t\t\tinQuotes = true;\n\t\t\tquoteChar = char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (inQuotes && char === quoteChar) {\n\t\t\tinQuotes = false;\n\t\t\tquoteChar = \"\";\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (!inQuotes && /\\s/.test(char)) {\n\t\t\tflushToken();\n\t\t\tcontinue;\n\t\t}\n\n\t\tcurrent += char;\n\t}\n\n\tflushCommand();\n\n\treturn commands;\n}\n\nfunction isShellCommandSeparator(command: string, index: number): boolean {\n\tconst char = command.charAt(index);\n\tif (char === \";\") {\n\t\treturn true;\n\t}\n\tif (char === \"|\") {\n\t\treturn command.charAt(index - 1) !== \">\";\n\t}\n\tif (char !== \"&\") {\n\t\treturn false;\n\t}\n\tif (command.charAt(index + 1) === \"&\") {\n\t\treturn true;\n\t}\n\treturn (\n\t\tcommand.charAt(index - 1) !== \">\" &&\n\t\tcommand.charAt(index - 1) !== \"<\" &&\n\t\tcommand.charAt(index + 1) !== \">\"\n\t);\n}\n\nfunction normalizeShellCommandTokens(tokens: string[]): string[] {\n\tconst normalized: string[] = [];\n\tlet commandStarted = false;\n\tfor (let i = 0; i < tokens.length; i++) {\n\t\tconst token = tokens[i]!;\n\t\tconst redirection = shellRedirection(token);\n\t\tif (redirection) {\n\t\t\tif (redirection.consumesNextToken) {\n\t\t\t\ti++;\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\t\tif (!commandStarted && isShellAssignment(token)) {\n\t\t\tcontinue;\n\t\t}\n\t\tnormalized.push(token);\n\t\tcommandStarted = true;\n\t}\n\treturn normalized;\n}\n\nfunction isShellAssignment(token: string): boolean {\n\treturn /^[A-Za-z_][A-Za-z0-9_]*=/.test(token);\n}\n\nfunction shellRedirection(\n\ttoken: string,\n): { consumesNextToken: boolean } | undefined {\n\tif (/^(?:\\d*)?(?:<>|>>|>\\||>|<|<&|>&|<<-?)$/.test(token)) {\n\t\treturn { consumesNextToken: true };\n\t}\n\tif (/^&>>?$/.test(token)) {\n\t\treturn { consumesNextToken: true };\n\t}\n\tif (/^(?:\\d*)?(?:<>|>>|>\\||>|<|<&|>&|<<-?).+/.test(token)) {\n\t\treturn { consumesNextToken: false };\n\t}\n\tif (/^&>>?.+/.test(token)) {\n\t\treturn { consumesNextToken: false };\n\t}\n\treturn undefined;\n}\n\nfunction isPathLikeProgram(program: string): boolean {\n\treturn program.includes(\"/\") || program.includes(\"\\\\\");\n}\n\nfunction hostExecutableBasename(program: string): string {\n\treturn program.includes(\"\\\\\") ? win32.basename(program) : basename(program);\n}\n\nfunction shouldEscapeBackslash(\n\tnextChar: string,\n\tinQuotes: boolean,\n\tquoteChar: string,\n): boolean {\n\tif (!nextChar) {\n\t\treturn false;\n\t}\n\tif (!inQuotes) {\n\t\treturn true;\n\t}\n\tif (quoteChar === \"'\") {\n\t\treturn false;\n\t}\n\treturn (\n\t\tnextChar === quoteChar ||\n\t\tnextChar === \"\\\\\" ||\n\t\tnextChar === \"\\n\" ||\n\t\tnextChar === \"$\" ||\n\t\tnextChar === \"`\"\n\t);\n}\n\n/**\n * Check a command and return the evaluation result.\n */\nexport function checkCommand(\n\tcommand: string,\n\tworkspaceDir: string,\n\theuristicsFallback?: (cmd: string[]) => Decision,\n): Evaluation {\n\tconst policy = loadPolicy(workspaceDir);\n\tconst commands = parseCommandSequence(command);\n\treturn policy.checkMultiple(commands, heuristicsFallback, {\n\t\tresolveHostExecutables: true,\n\t});\n}\n\n/**\n * Check if a command is allowed without prompting.\n */\nexport function isCommandAllowed(\n\tcommand: string,\n\tworkspaceDir: string,\n): boolean {\n\tconst result = checkCommand(command, workspaceDir);\n\treturn result.decision === \"allow\";\n}\n\n/**\n * Check if a command is forbidden.\n */\nexport function isCommandForbidden(\n\tcommand: string,\n\tworkspaceDir: string,\n): boolean {\n\tconst result = checkCommand(command, workspaceDir);\n\treturn result.decision === \"forbidden\";\n}\n\n/**\n * Whitelist a command by adding an allow rule to the project policy.\n */\nexport function whitelistCommand(workspaceDir: string, command: string): void {\n\tconst policyPath = join(workspaceDir, \".maestro\", \"execpolicy\");\n\tconst commands = parseCommandSequence(command);\n\tif (commands.length === 0) {\n\t\tthrow new Error(\"prefix cannot be empty\");\n\t}\n\tfor (const tokens of commands) {\n\t\tappendAllowPrefixRule(policyPath, tokens);\n\t}\n}\n\n/**\n * Get policy summary for display.\n */\nexport function getPolicySummary(workspaceDir: string): string {\n\tconst policy = loadPolicy(workspaceDir);\n\tconst lines: string[] = [];\n\n\tlet totalRules = 0;\n\tfor (const [_program, rules] of policy.rules) {\n\t\ttotalRules += rules.length;\n\t}\n\n\tlines.push(`Execution Policy (${totalRules} rules)`);\n\tlines.push(\"\");\n\n\tif (totalRules === 0) {\n\t\tlines.push(\"No rules defined. All commands will be prompted.\");\n\t\tlines.push(\"\");\n\t\tlines.push(\"Create ~/.maestro/execpolicy or .maestro/execpolicy\");\n\t\tlines.push(\"to define command approval policies.\");\n\t} else {\n\t\tlet count = 0;\n\t\tfor (const [program, rules] of policy.rules) {\n\t\t\tif (count >= 10) {\n\t\t\t\tlines.push(`... and ${totalRules - 10} more rules`);\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tfor (const rule of rules) {\n\t\t\t\tif (count >= 10) break;\n\t\t\t\tconst pattern = [\n\t\t\t\t\trule.pattern.first,\n\t\t\t\t\t...rule.pattern.rest.map((t) =>\n\t\t\t\t\t\tt.type === \"single\" ? t.value : `[${t.values.join(\"|\")}]`,\n\t\t\t\t\t),\n\t\t\t\t].join(\" \");\n\t\t\t\tlines.push(`  ${rule.decision.toUpperCase()}: ${pattern}`);\n\t\t\t\tcount++;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn lines.join(\"\\n\");\n}\n"]}

package/dist/safety/governance-service-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"governance-service-client.d.ts","sourceRoot":"","sources":["../../src/safety/governance-service-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,qBAAqB,EACrB,qBAAqB,EACrB,MAAM,6BAA6B,CAAC;AASrC,OAAO,EACN,KAAK,qBAAqB,IAAI,yBAAyB,EAEvD,MAAM,6BAA6B,CAAC;AAUrC,eAAO,MAAM,6BAA6B;;;;;CAKhC,CAAC;AAIX,MAAM,WAAW,qCAAqC;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,6CAA6C;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,yBAAyB,CAAC;CACvC;AA+ED,wBAAgB,4CAA4C,CAC3D,MAAM,EAAE,qCAAqC,GAAG,KAAK,GAAG,SAAS,EACjE,OAAO,EAAE,qBAAqB,GAC5B,6CAA6C,GAAG,IAAI,CAmGtD;AAqID,wBAAsB,iDAAiD,CACtE,MAAM,EAAE,6CAA6C,EACrD,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CA0CvC;AAED,wBAAgB,+CAA+C,IAAI,IAAI,CAEtE"}
+{"version":3,"file":"governance-service-client.d.ts","sourceRoot":"","sources":["../../src/safety/governance-service-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,qBAAqB,EACrB,qBAAqB,EACrB,MAAM,6BAA6B,CAAC;AAcrC,OAAO,EACN,KAAK,qBAAqB,IAAI,yBAAyB,EAEvD,MAAM,6BAA6B,CAAC;AAUrC,eAAO,MAAM,6BAA6B;;;;;CAKhC,CAAC;AAIX,MAAM,WAAW,qCAAqC;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,6CAA6C;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,yBAAyB,CAAC;CACvC;AA4ED,wBAAgB,4CAA4C,CAC3D,MAAM,EAAE,qCAAqC,GAAG,KAAK,GAAG,SAAS,EACjE,OAAO,EAAE,qBAAqB,GAC5B,6CAA6C,GAAG,IAAI,CAkGtD;AAqID,wBAAsB,iDAAiD,CACtE,MAAM,EAAE,6CAA6C,EACrD,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CA0CvC;AAED,wBAAgB,+CAA+C,IAAI,IAAI,CAEtE"}

package/dist/safety/governance-service-client.js

@@ -1,4 +1,5 @@
 import { Buffer } from "node:buffer";
+import { EVALOPS_ACCESS_TOKEN_ENV_VARS, EVALOPS_ORGANIZATION_ID_ENV_VARS, EVALOPS_WORKSPACE_ID_ENV_VARS, } from "../evalops/env-aliases.js";
 import { loadOAuthCredentials } from "../oauth/storage.js";
 import { CONNECT_PROTOCOL_VERSION } from "../platform/client.js";
 import { PLATFORM_CONNECT_METHODS, PLATFORM_CONNECT_SERVICES, platformConnectMethodPath, platformConnectServicePath, } from "../platform/core-services.js";
@@ -52,11 +53,8 @@ function resolveWorkspaceId(config, context) {
     const envWorkspaceId = getEnvValue([
         "GOVERNANCE_SERVICE_WORKSPACE_ID",
         "MAESTRO_GOVERNANCE_WORKSPACE_ID",
-        "MAESTRO_EVALOPS_WORKSPACE_ID",
-        "MAESTRO_WORKSPACE_ID",
-        "MAESTRO_EVALOPS_ORG_ID",
-        "EVALOPS_ORGANIZATION_ID",
-        "MAESTRO_ENTERPRISE_ORG_ID",
+        ...EVALOPS_WORKSPACE_ID_ENV_VARS,
+        ...EVALOPS_ORGANIZATION_ID_ENV_VARS,
     ]);
     if (configuredWorkspaceId ??
         trimString(context.user?.orgId) ??
@@ -133,8 +131,7 @@ export function resolveActionFirewallGovernanceServiceConfig(config, context) {
             getEnvValue([
                 "GOVERNANCE_SERVICE_TOKEN",
                 "MAESTRO_GOVERNANCE_SERVICE_TOKEN",
-                "MAESTRO_EVALOPS_ACCESS_TOKEN",
-                "EVALOPS_TOKEN",
+                ...EVALOPS_ACCESS_TOKEN_ENV_VARS,
             ]) ??
             storedToken,
         workspaceId,

package/dist/safety/governance-service-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"governance-service-client.js","sourceRoot":"","sources":["../../src/safety/governance-service-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAKrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,eAAe,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAErD,MAAM,gBAAgB,GAAG,SAAS,CAAC;AACnC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,oBAAoB,GAAG,yBAAyB,CACrD,wBAAwB,CAAC,UAAU,CAAC,cAAc,CAClD,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC5C,cAAc,EAAE;QACf,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,UAAU,CAAC,UAAU;KAC/B;CACQ,CAAC;AAsCX,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAuC,CAAC;AAEzE,SAAS,UAAU,CAAC,KAAyB;IAC5C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB,EAAE,QAAgB;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACxC,IAAI,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,KAAK,MAAM,MAAM,IAAI;QACpB,oBAAoB;QACpB,0BAA0B,CAAC,yBAAyB,CAAC,UAAU,CAAC;KAChE,EAAE,CAAC;QACH,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,UAAU,GAAG,oBAAoB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAyD,EACzD,OAA8B;IAE9B,MAAM,qBAAqB,GAAG,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,WAAW,CAAC;QAClC,iCAAiC;QACjC,iCAAiC;QACjC,8BAA8B;QAC9B,sBAAsB;QACtB,wBAAwB;QACxB,yBAAyB;QACzB,2BAA2B;KAC3B,CAAC,CAAC;IACH,IACC,qBAAqB;QACrB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;QAC/B,cAAc,EACb,CAAC;QACF,OAAO,CACN,qBAAqB,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,cAAc,CAC1E,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC;IACzE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC5D,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QACf,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC3D,MAAiE,EACjE,OAA8B;IAE9B,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GACZ,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC;QAC3B,WAAW,CAAC;YACX,wBAAwB;YACxB,gCAAgC;YAChC,2BAA2B;YAC3B,0BAA0B;YAC1B,kBAAkB;SAClB,CAAC,CAAC;IACJ,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,MAAM,QAAQ,GACb,MAAM,EAAE,QAAQ;QAChB,WAAW,CAAC;YACX,6BAA6B;YAC7B,qCAAqC;SACrC,CAAC,KAAK,GAAG,CAAC;IAEZ,OAAO;QACN,OAAO,EACN,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC;YAC3B,WAAW,CAAC;gBACX,6BAA6B;gBAC7B,6BAA6B;gBAC7B,0BAA0B;gBAC1B,kBAAkB;aAClB,CAAC;YACF,gBAAgB;QACjB,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAClC,uBAAuB,EACtB,MAAM,EAAE,uBAAuB;YAC/B,gBAAgB,CACf,WAAW,CAAC;gBACX,8CAA8C;gBAC9C,sDAAsD;aACtD,CAAC,EACF,CAAC,CACD;QACF,qBAAqB,EACpB,MAAM,EAAE,qBAAqB;YAC7B,gBAAgB,CACf,WAAW,CAAC;gBACX,6CAA6C;gBAC7C,qDAAqD;aACrD,CAAC,EACF,MAAM,CACN;QACF,uBAAuB,EACtB,MAAM,EAAE,uBAAuB;YAC/B,gBAAgB,CACf,WAAW,CAAC;gBACX,8CAA8C;gBAC9C,sDAAsD;aACtD,CAAC,EACF,CAAC,CACD;QACF,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;QAC/C,WAAW,EACV,MAAM,EAAE,WAAW;YACnB,gBAAgB,CACf,WAAW,CAAC;gBACX,iCAAiC;gBACjC,yCAAyC;aACzC,CAAC,EACF,oBAAoB,CACpB;QACF,SAAS,EACR,MAAM,EAAE,SAAS;YACjB,gBAAgB,CACf,WAAW,CAAC;gBACX,+BAA+B;gBAC/B,uCAAuC;aACvC,CAAC,EACF,kBAAkB,CAClB;QACF,KAAK,EACJ,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC;YACzB,WAAW,CAAC;gBACX,0BAA0B;gBAC1B,kCAAkC;gBAClC,8BAA8B;gBAC9B,eAAe;aACf,CAAC;YACF,WAAW;QACZ,WAAW;KACX,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC3B,MAAqD,EACrD,EAAkB;IAElB,MAAM,WAAW,GAAG,6BAA6B,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW;QACX,EAAE;QACF,KAAK,EAAE,MAAM,CAAC,qBAAqB;QACnC,OAAO,EAAE,MAAM,CAAC,uBAAuB;QACvC,SAAS,EAAE,MAAM,CAAC,uBAAuB;KACzC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE;QACjD,WAAW;QACX,OAAO,EAAE;YACR,gBAAgB,EAAE,MAAM,CAAC,uBAAuB;YAChD,cAAc,EAAE,MAAM,CAAC,qBAAqB;YAC5C,gBAAgB,EAAE,MAAM,CAAC,uBAAuB;YAChD,QAAQ,EAAE,cAAc,EAAE,EAAE;SAC5B;KACD,CAAC,CAAC;IACH,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACzB,MAAmC;IAEnC,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CACpB,MAAqD;IAErD,OAAO;QACN,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,0BAA0B,EAAE,wBAAwB;QACpD,cAAc,EAAE,kBAAkB;KAClC,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB;IAC1B,MAAM,WAAW,GAAG,WAAW,CAAC;QAC/B,gCAAgC;QAChC,UAAU;KACV,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA8B;IAC1D,OAAO,MAAM,CAAC,IAAI,CACjB,IAAI,CAAC,SAAS,CAAC;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACvB,CAAC,CAAC;gBACA,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;gBACtB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;aAClD;YACF,CAAC,CAAC,SAAS;QACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC9B,CAAC,EACF,MAAM,CACN,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CACzB,QAAqC;IAErC,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,uBAAuB,CAAC;QAC7B,KAAK,OAAO,CAAC;QACb,KAAK,CAAC;YACL,OAAO,OAAO,CAAC;QAChB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,MAAM,CAAC;QACZ,KAAK,CAAC;YACL,OAAO,OAAO,CAAC;QAChB,KAAK,kCAAkC,CAAC;QACxC,KAAK,kBAAkB,CAAC;QACxB,KAAK,CAAC;YACL,OAAO,kBAAkB,CAAC;QAC3B;YACC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;AACF,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA2B;IACxD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAS,2BAA2B,CACnC,OAA+B;IAE/B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,oBAAoB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qCAAqC,CAAC;IAC3E,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO;YACN,MAAM;YACN,MAAM;YACN,MAAM;SACN,CAAC;IACH,CAAC;IACD,OAAO;QACN,MAAM,EAAE,kBAAkB;QAC1B,MAAM;QACN,MAAM;KACN,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iDAAiD,CACtE,MAAqD,EACrD,OAA8B;IAE9B,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC,MAAM,CACvB,MAAM,EACN,gBAAgB,EAChB,KAAK,IAAI,EAAE;QACV,MAAM,QAAQ,GAAG,MAAM,eAAe,CACrC,GAAG,MAAM,CAAC,OAAO,GAAG,oBAAoB,EAAE,EAC1C;YACC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,UAAU,EAAE,OAAO,CAAC,QAAQ;gBAC5B,aAAa,EAAE,mBAAmB,CAAC,OAAO,CAAC;gBAC3C,OAAO,EAAE,kBAAkB,EAAE;aAC7B,CAAC;SACF,EACD;YACC,WAAW,EAAE,oBAAoB;YACjC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;YACtC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;SAC/B,CACD,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACd,+BAA+B,QAAQ,CAAC,MAAM,KAC7C,IAAI,IAAI,QAAQ,CAAC,UAClB,EAAE,CACF,CAAC;QACH,CAAC;QAED,OAAO,2BAA2B,CACjC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CACjD,CAAC;IACH,CAAC,EACD,GAAG,EAAE,CAAC,IAAI,CACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+CAA+C;IAC9D,iBAAiB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC","sourcesContent":["import { Buffer } from \"node:buffer\";\nimport type {\n\tActionApprovalContext,\n\tActionFirewallVerdict,\n} from \"../agent/action-approval.js\";\nimport { loadOAuthCredentials } from \"../oauth/storage.js\";\nimport { CONNECT_PROTOCOL_VERSION } from \"../platform/client.js\";\nimport {\n\tPLATFORM_CONNECT_METHODS,\n\tPLATFORM_CONNECT_SERVICES,\n\tplatformConnectMethodPath,\n\tplatformConnectServicePath,\n} from \"../platform/core-services.js\";\nimport {\n\ttype DownstreamFailureMode as DownstreamHttpFailureMode,\n\tfetchDownstream,\n} from \"../utils/downstream-http.js\";\nimport * as downstream from \"../utils/downstream.js\";\n\nconst DEFAULT_AGENT_ID = \"maestro\";\nconst DEFAULT_MAX_ATTEMPTS = 2;\nconst DEFAULT_TIMEOUT_MS = 2_000;\nconst EVALUATE_ACTION_PATH = platformConnectMethodPath(\n\tPLATFORM_CONNECT_METHODS.governance.evaluateAction,\n);\n\nexport const GOVERNANCE_CALL_FAILURE_MODES = {\n\tevaluateAction: {\n\t\toptional: downstream.FailOpen,\n\t\trequired: downstream.FailClosed,\n\t},\n} as const;\n\ntype GovernanceCall = keyof typeof GOVERNANCE_CALL_FAILURE_MODES;\n\nexport interface ActionFirewallGovernanceServiceConfig {\n\tbaseUrl?: string;\n\ttoken?: string;\n\tworkspaceId?: string;\n\tagentId?: string;\n\ttimeoutMs?: number;\n\tmaxAttempts?: number;\n\tcircuitFailureThreshold?: number;\n\tcircuitResetTimeoutMs?: number;\n\tcircuitSuccessThreshold?: number;\n\trequired?: boolean;\n}\n\nexport interface ResolvedActionFirewallGovernanceServiceConfig {\n\tbaseUrl: string;\n\ttoken?: string;\n\tworkspaceId: string;\n\tagentId: string;\n\ttimeoutMs: number;\n\tmaxAttempts: number;\n\tcircuitFailureThreshold: number;\n\tcircuitResetTimeoutMs: number;\n\tcircuitSuccessThreshold: number;\n\tfailureMode: DownstreamHttpFailureMode;\n}\n\ninterface EvaluateActionResponse {\n\tevaluation?: {\n\t\tdecision?: string | number;\n\t\treasons?: string[];\n\t\tmatchedRules?: string[];\n\t};\n}\n\nconst downstreamClients = new Map<string, downstream.DownstreamClient>();\n\nfunction trimString(value: string | undefined): string | undefined {\n\tconst trimmed = value?.trim();\n\treturn trimmed ? trimmed : undefined;\n}\n\nfunction getEnvValue(names: string[]): string | undefined {\n\tfor (const name of names) {\n\t\tconst value = trimString(process.env[name]);\n\t\tif (value) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction parsePositiveInt(value: string | undefined, fallback: number): number {\n\tconst parsed = Number.parseInt(value ?? \"\", 10);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\nfunction stripTrailingSlashes(value: string): string {\n\treturn value.replace(/\\/+$/, \"\");\n}\n\nfunction normalizeBaseUrl(baseUrl: string): string {\n\tlet normalized = stripTrailingSlashes(baseUrl.trim());\n\tfor (const suffix of [\n\t\tEVALUATE_ACTION_PATH,\n\t\tplatformConnectServicePath(PLATFORM_CONNECT_SERVICES.governance),\n\t]) {\n\t\tif (normalized.endsWith(suffix)) {\n\t\t\tnormalized = stripTrailingSlashes(normalized.slice(0, -suffix.length));\n\t\t}\n\t}\n\treturn normalized;\n}\n\nfunction resolveWorkspaceId(\n\tconfig: ActionFirewallGovernanceServiceConfig | undefined,\n\tcontext: ActionApprovalContext,\n): string | undefined {\n\tconst configuredWorkspaceId = trimString(config?.workspaceId);\n\tconst envWorkspaceId = getEnvValue([\n\t\t\"GOVERNANCE_SERVICE_WORKSPACE_ID\",\n\t\t\"MAESTRO_GOVERNANCE_WORKSPACE_ID\",\n\t\t\"MAESTRO_EVALOPS_WORKSPACE_ID\",\n\t\t\"MAESTRO_WORKSPACE_ID\",\n\t\t\"MAESTRO_EVALOPS_ORG_ID\",\n\t\t\"EVALOPS_ORGANIZATION_ID\",\n\t\t\"MAESTRO_ENTERPRISE_ORG_ID\",\n\t]);\n\tif (\n\t\tconfiguredWorkspaceId ??\n\t\ttrimString(context.user?.orgId) ??\n\t\tenvWorkspaceId\n\t) {\n\t\treturn (\n\t\t\tconfiguredWorkspaceId ?? trimString(context.user?.orgId) ?? envWorkspaceId\n\t\t);\n\t}\n\n\tconst stored = loadOAuthCredentials(\"evalops\")?.metadata?.organizationId;\n\treturn typeof stored === \"string\" && stored.trim().length > 0\n\t\t? stored.trim()\n\t\t: undefined;\n}\n\nexport function resolveActionFirewallGovernanceServiceConfig(\n\tconfig: ActionFirewallGovernanceServiceConfig | false | undefined,\n\tcontext: ActionApprovalContext,\n): ResolvedActionFirewallGovernanceServiceConfig | null {\n\tif (config === false) {\n\t\treturn null;\n\t}\n\n\tconst baseUrl =\n\t\ttrimString(config?.baseUrl) ??\n\t\tgetEnvValue([\n\t\t\t\"GOVERNANCE_SERVICE_URL\",\n\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_URL\",\n\t\t\t\"MAESTRO_PLATFORM_BASE_URL\",\n\t\t\t\"MAESTRO_EVALOPS_BASE_URL\",\n\t\t\t\"EVALOPS_BASE_URL\",\n\t\t]);\n\tif (!baseUrl) {\n\t\treturn null;\n\t}\n\n\tconst workspaceId = resolveWorkspaceId(config, context);\n\tif (!workspaceId) {\n\t\treturn null;\n\t}\n\n\tconst storedToken = trimString(loadOAuthCredentials(\"evalops\")?.access);\n\tconst required =\n\t\tconfig?.required ??\n\t\tgetEnvValue([\n\t\t\t\"GOVERNANCE_SERVICE_REQUIRED\",\n\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_REQUIRED\",\n\t\t]) === \"1\";\n\n\treturn {\n\t\tagentId:\n\t\t\ttrimString(config?.agentId) ??\n\t\t\tgetEnvValue([\n\t\t\t\t\"GOVERNANCE_SERVICE_AGENT_ID\",\n\t\t\t\t\"MAESTRO_GOVERNANCE_AGENT_ID\",\n\t\t\t\t\"MAESTRO_EVALOPS_AGENT_ID\",\n\t\t\t\t\"MAESTRO_AGENT_ID\",\n\t\t\t]) ??\n\t\t\tDEFAULT_AGENT_ID,\n\t\tbaseUrl: normalizeBaseUrl(baseUrl),\n\t\tcircuitFailureThreshold:\n\t\t\tconfig?.circuitFailureThreshold ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_CIRCUIT_FAILURE_THRESHOLD\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_CIRCUIT_FAILURE_THRESHOLD\",\n\t\t\t\t]),\n\t\t\t\t5,\n\t\t\t),\n\t\tcircuitResetTimeoutMs:\n\t\t\tconfig?.circuitResetTimeoutMs ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_CIRCUIT_RESET_TIMEOUT_MS\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_CIRCUIT_RESET_TIMEOUT_MS\",\n\t\t\t\t]),\n\t\t\t\t30_000,\n\t\t\t),\n\t\tcircuitSuccessThreshold:\n\t\t\tconfig?.circuitSuccessThreshold ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_CIRCUIT_SUCCESS_THRESHOLD\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_CIRCUIT_SUCCESS_THRESHOLD\",\n\t\t\t\t]),\n\t\t\t\t2,\n\t\t\t),\n\t\tfailureMode: required ? \"required\" : \"optional\",\n\t\tmaxAttempts:\n\t\t\tconfig?.maxAttempts ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_MAX_ATTEMPTS\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_MAX_ATTEMPTS\",\n\t\t\t\t]),\n\t\t\t\tDEFAULT_MAX_ATTEMPTS,\n\t\t\t),\n\t\ttimeoutMs:\n\t\t\tconfig?.timeoutMs ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_TIMEOUT_MS\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_TIMEOUT_MS\",\n\t\t\t\t]),\n\t\t\t\tDEFAULT_TIMEOUT_MS,\n\t\t\t),\n\t\ttoken:\n\t\t\ttrimString(config?.token) ??\n\t\t\tgetEnvValue([\n\t\t\t\t\"GOVERNANCE_SERVICE_TOKEN\",\n\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_TOKEN\",\n\t\t\t\t\"MAESTRO_EVALOPS_ACCESS_TOKEN\",\n\t\t\t\t\"EVALOPS_TOKEN\",\n\t\t\t]) ??\n\t\t\tstoredToken,\n\t\tworkspaceId,\n\t};\n}\n\nfunction getDownstreamClient(\n\tconfig: ResolvedActionFirewallGovernanceServiceConfig,\n\top: GovernanceCall,\n): downstream.DownstreamClient {\n\tconst failureMode = GOVERNANCE_CALL_FAILURE_MODES[op][config.failureMode];\n\tconst key = JSON.stringify({\n\t\tbaseUrl: config.baseUrl,\n\t\tfailureMode,\n\t\top,\n\t\treset: config.circuitResetTimeoutMs,\n\t\tsuccess: config.circuitSuccessThreshold,\n\t\tthreshold: config.circuitFailureThreshold,\n\t});\n\tconst cached = downstreamClients.get(key);\n\tif (cached) {\n\t\treturn cached;\n\t}\n\tconst client = downstream.New(`governance.${op}`, {\n\t\tfailureMode,\n\t\tbreaker: {\n\t\t\tfailureThreshold: config.circuitFailureThreshold,\n\t\t\tresetTimeoutMs: config.circuitResetTimeoutMs,\n\t\t\tsuccessThreshold: config.circuitSuccessThreshold,\n\t\t\ttoolName: `governance.${op}`,\n\t\t},\n\t});\n\tdownstreamClients.set(key, client);\n\treturn client;\n}\n\nfunction toHttpFailureMode(\n\tclient: downstream.DownstreamClient,\n): DownstreamHttpFailureMode {\n\treturn client.failureMode === downstream.FailClosed ? \"required\" : \"optional\";\n}\n\nfunction buildHeaders(\n\tconfig: ResolvedActionFirewallGovernanceServiceConfig,\n): Record<string, string> {\n\treturn {\n\t\t...(config.token ? { Authorization: `Bearer ${config.token}` } : {}),\n\t\t\"Connect-Protocol-Version\": CONNECT_PROTOCOL_VERSION,\n\t\t\"Content-Type\": \"application/json\",\n\t};\n}\n\nfunction buildActionContext(): Record<string, string> | undefined {\n\tconst environment = getEnvValue([\n\t\t\"GOVERNANCE_SERVICE_ENVIRONMENT\",\n\t\t\"NODE_ENV\",\n\t]);\n\treturn environment ? { environment } : undefined;\n}\n\nfunction encodeActionPayload(context: ActionApprovalContext): string {\n\treturn Buffer.from(\n\t\tJSON.stringify({\n\t\t\targs: context.args,\n\t\t\tmetadata: context.metadata,\n\t\t\tsession: context.session\n\t\t\t\t? {\n\t\t\t\t\t\tid: context.session.id,\n\t\t\t\t\t\tstartedAt: context.session.startedAt.toISOString(),\n\t\t\t\t\t}\n\t\t\t\t: undefined,\n\t\t\ttoolName: context.toolName,\n\t\t\tuser: context.user,\n\t\t\tuserIntent: context.userIntent,\n\t\t}),\n\t\t\"utf8\",\n\t).toString(\"base64\");\n}\n\nfunction normalizeDecision(\n\tdecision: string | number | undefined,\n): ActionFirewallVerdict[\"action\"] {\n\tswitch (decision) {\n\t\tcase \"ACTION_DECISION_ALLOW\":\n\t\tcase \"allow\":\n\t\tcase 1:\n\t\t\treturn \"allow\";\n\t\tcase \"ACTION_DECISION_DENY\":\n\t\tcase \"deny\":\n\t\tcase 2:\n\t\t\treturn \"block\";\n\t\tcase \"ACTION_DECISION_REQUIRE_APPROVAL\":\n\t\tcase \"require_approval\":\n\t\tcase 3:\n\t\t\treturn \"require_approval\";\n\t\tdefault:\n\t\t\tthrow new Error(\"governance service response did not include a decision\");\n\t}\n}\n\nfunction normalizeStringArray(value: string[] | undefined): string[] {\n\treturn Array.isArray(value)\n\t\t? value.map((item) => item.trim()).filter((item) => item.length > 0)\n\t\t: [];\n}\n\nfunction normalizeEvaluationResponse(\n\tpayload: EvaluateActionResponse,\n): ActionFirewallVerdict {\n\tconst evaluation = payload.evaluation;\n\tif (!evaluation) {\n\t\tthrow new Error(\"governance service response did not include evaluation\");\n\t}\n\n\tconst action = normalizeDecision(evaluation.decision);\n\tif (action === \"allow\") {\n\t\treturn { action };\n\t}\n\n\tconst reasons = normalizeStringArray(evaluation.reasons);\n\tconst matchedRules = normalizeStringArray(evaluation.matchedRules);\n\tconst ruleId = matchedRules[0] ?? \"governance-service\";\n\tconst reason = reasons.join(\"; \") || \"Action denied by governance service\";\n\tif (action === \"block\") {\n\t\treturn {\n\t\t\taction,\n\t\t\truleId,\n\t\t\treason,\n\t\t};\n\t}\n\treturn {\n\t\taction: \"require_approval\",\n\t\truleId,\n\t\treason,\n\t};\n}\n\nexport async function evaluateActionWithActionFirewallGovernanceService(\n\tconfig: ResolvedActionFirewallGovernanceServiceConfig,\n\tcontext: ActionApprovalContext,\n): Promise<ActionFirewallVerdict | null> {\n\tconst client = getDownstreamClient(config, \"evaluateAction\");\n\treturn downstream.CallOp(\n\t\tclient,\n\t\t\"evaluateAction\",\n\t\tasync () => {\n\t\t\tconst response = await fetchDownstream(\n\t\t\t\t`${config.baseUrl}${EVALUATE_ACTION_PATH}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: \"POST\",\n\t\t\t\t\theaders: buildHeaders(config),\n\t\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\t\tworkspaceId: config.workspaceId,\n\t\t\t\t\t\tagentId: config.agentId,\n\t\t\t\t\t\tactionType: context.toolName,\n\t\t\t\t\t\tactionPayload: encodeActionPayload(context),\n\t\t\t\t\t\tcontext: buildActionContext(),\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tserviceName: \"governance service\",\n\t\t\t\t\tfailureMode: toHttpFailureMode(client),\n\t\t\t\t\ttimeoutMs: config.timeoutMs,\n\t\t\t\t\tmaxAttempts: config.maxAttempts,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\tif (!response.ok) {\n\t\t\t\tconst text = await response.text();\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`governance service returned ${response.status}: ${\n\t\t\t\t\t\ttext || response.statusText\n\t\t\t\t\t}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn normalizeEvaluationResponse(\n\t\t\t\t(await response.json()) as EvaluateActionResponse,\n\t\t\t);\n\t\t},\n\t\t() => null,\n\t);\n}\n\nexport function resetActionFirewallGovernanceDownstreamForTests(): void {\n\tdownstreamClients.clear();\n}\n"]}
+{"version":3,"file":"governance-service-client.js","sourceRoot":"","sources":["../../src/safety/governance-service-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAKrC,OAAO,EACN,6BAA6B,EAC7B,gCAAgC,EAChC,6BAA6B,GAC7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,eAAe,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAErD,MAAM,gBAAgB,GAAG,SAAS,CAAC;AACnC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,oBAAoB,GAAG,yBAAyB,CACrD,wBAAwB,CAAC,UAAU,CAAC,cAAc,CAClD,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC5C,cAAc,EAAE;QACf,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,UAAU,CAAC,UAAU;KAC/B;CACQ,CAAC;AAsCX,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAuC,CAAC;AAEzE,SAAS,UAAU,CAAC,KAAyB;IAC5C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB,EAAE,QAAgB;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACxC,IAAI,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,KAAK,MAAM,MAAM,IAAI;QACpB,oBAAoB;QACpB,0BAA0B,CAAC,yBAAyB,CAAC,UAAU,CAAC;KAChE,EAAE,CAAC;QACH,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,UAAU,GAAG,oBAAoB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAyD,EACzD,OAA8B;IAE9B,MAAM,qBAAqB,GAAG,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,WAAW,CAAC;QAClC,iCAAiC;QACjC,iCAAiC;QACjC,GAAG,6BAA6B;QAChC,GAAG,gCAAgC;KACnC,CAAC,CAAC;IACH,IACC,qBAAqB;QACrB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;QAC/B,cAAc,EACb,CAAC;QACF,OAAO,CACN,qBAAqB,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,cAAc,CAC1E,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC;IACzE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC5D,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QACf,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC3D,MAAiE,EACjE,OAA8B;IAE9B,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GACZ,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC;QAC3B,WAAW,CAAC;YACX,wBAAwB;YACxB,gCAAgC;YAChC,2BAA2B;YAC3B,0BAA0B;YAC1B,kBAAkB;SAClB,CAAC,CAAC;IACJ,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,MAAM,QAAQ,GACb,MAAM,EAAE,QAAQ;QAChB,WAAW,CAAC;YACX,6BAA6B;YAC7B,qCAAqC;SACrC,CAAC,KAAK,GAAG,CAAC;IAEZ,OAAO;QACN,OAAO,EACN,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC;YAC3B,WAAW,CAAC;gBACX,6BAA6B;gBAC7B,6BAA6B;gBAC7B,0BAA0B;gBAC1B,kBAAkB;aAClB,CAAC;YACF,gBAAgB;QACjB,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAClC,uBAAuB,EACtB,MAAM,EAAE,uBAAuB;YAC/B,gBAAgB,CACf,WAAW,CAAC;gBACX,8CAA8C;gBAC9C,sDAAsD;aACtD,CAAC,EACF,CAAC,CACD;QACF,qBAAqB,EACpB,MAAM,EAAE,qBAAqB;YAC7B,gBAAgB,CACf,WAAW,CAAC;gBACX,6CAA6C;gBAC7C,qDAAqD;aACrD,CAAC,EACF,MAAM,CACN;QACF,uBAAuB,EACtB,MAAM,EAAE,uBAAuB;YAC/B,gBAAgB,CACf,WAAW,CAAC;gBACX,8CAA8C;gBAC9C,sDAAsD;aACtD,CAAC,EACF,CAAC,CACD;QACF,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;QAC/C,WAAW,EACV,MAAM,EAAE,WAAW;YACnB,gBAAgB,CACf,WAAW,CAAC;gBACX,iCAAiC;gBACjC,yCAAyC;aACzC,CAAC,EACF,oBAAoB,CACpB;QACF,SAAS,EACR,MAAM,EAAE,SAAS;YACjB,gBAAgB,CACf,WAAW,CAAC;gBACX,+BAA+B;gBAC/B,uCAAuC;aACvC,CAAC,EACF,kBAAkB,CAClB;QACF,KAAK,EACJ,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC;YACzB,WAAW,CAAC;gBACX,0BAA0B;gBAC1B,kCAAkC;gBAClC,GAAG,6BAA6B;aAChC,CAAC;YACF,WAAW;QACZ,WAAW;KACX,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC3B,MAAqD,EACrD,EAAkB;IAElB,MAAM,WAAW,GAAG,6BAA6B,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW;QACX,EAAE;QACF,KAAK,EAAE,MAAM,CAAC,qBAAqB;QACnC,OAAO,EAAE,MAAM,CAAC,uBAAuB;QACvC,SAAS,EAAE,MAAM,CAAC,uBAAuB;KACzC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE;QACjD,WAAW;QACX,OAAO,EAAE;YACR,gBAAgB,EAAE,MAAM,CAAC,uBAAuB;YAChD,cAAc,EAAE,MAAM,CAAC,qBAAqB;YAC5C,gBAAgB,EAAE,MAAM,CAAC,uBAAuB;YAChD,QAAQ,EAAE,cAAc,EAAE,EAAE;SAC5B;KACD,CAAC,CAAC;IACH,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACzB,MAAmC;IAEnC,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CACpB,MAAqD;IAErD,OAAO;QACN,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,0BAA0B,EAAE,wBAAwB;QACpD,cAAc,EAAE,kBAAkB;KAClC,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB;IAC1B,MAAM,WAAW,GAAG,WAAW,CAAC;QAC/B,gCAAgC;QAChC,UAAU;KACV,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA8B;IAC1D,OAAO,MAAM,CAAC,IAAI,CACjB,IAAI,CAAC,SAAS,CAAC;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACvB,CAAC,CAAC;gBACA,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;gBACtB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;aAClD;YACF,CAAC,CAAC,SAAS;QACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC9B,CAAC,EACF,MAAM,CACN,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CACzB,QAAqC;IAErC,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,uBAAuB,CAAC;QAC7B,KAAK,OAAO,CAAC;QACb,KAAK,CAAC;YACL,OAAO,OAAO,CAAC;QAChB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,MAAM,CAAC;QACZ,KAAK,CAAC;YACL,OAAO,OAAO,CAAC;QAChB,KAAK,kCAAkC,CAAC;QACxC,KAAK,kBAAkB,CAAC;QACxB,KAAK,CAAC;YACL,OAAO,kBAAkB,CAAC;QAC3B;YACC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;AACF,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA2B;IACxD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAS,2BAA2B,CACnC,OAA+B;IAE/B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,oBAAoB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qCAAqC,CAAC;IAC3E,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO;YACN,MAAM;YACN,MAAM;YACN,MAAM;SACN,CAAC;IACH,CAAC;IACD,OAAO;QACN,MAAM,EAAE,kBAAkB;QAC1B,MAAM;QACN,MAAM;KACN,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iDAAiD,CACtE,MAAqD,EACrD,OAA8B;IAE9B,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC,MAAM,CACvB,MAAM,EACN,gBAAgB,EAChB,KAAK,IAAI,EAAE;QACV,MAAM,QAAQ,GAAG,MAAM,eAAe,CACrC,GAAG,MAAM,CAAC,OAAO,GAAG,oBAAoB,EAAE,EAC1C;YACC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,UAAU,EAAE,OAAO,CAAC,QAAQ;gBAC5B,aAAa,EAAE,mBAAmB,CAAC,OAAO,CAAC;gBAC3C,OAAO,EAAE,kBAAkB,EAAE;aAC7B,CAAC;SACF,EACD;YACC,WAAW,EAAE,oBAAoB;YACjC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;YACtC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;SAC/B,CACD,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACd,+BAA+B,QAAQ,CAAC,MAAM,KAC7C,IAAI,IAAI,QAAQ,CAAC,UAClB,EAAE,CACF,CAAC;QACH,CAAC;QAED,OAAO,2BAA2B,CACjC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CACjD,CAAC;IACH,CAAC,EACD,GAAG,EAAE,CAAC,IAAI,CACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+CAA+C;IAC9D,iBAAiB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC","sourcesContent":["import { Buffer } from \"node:buffer\";\nimport type {\n\tActionApprovalContext,\n\tActionFirewallVerdict,\n} from \"../agent/action-approval.js\";\nimport {\n\tEVALOPS_ACCESS_TOKEN_ENV_VARS,\n\tEVALOPS_ORGANIZATION_ID_ENV_VARS,\n\tEVALOPS_WORKSPACE_ID_ENV_VARS,\n} from \"../evalops/env-aliases.js\";\nimport { loadOAuthCredentials } from \"../oauth/storage.js\";\nimport { CONNECT_PROTOCOL_VERSION } from \"../platform/client.js\";\nimport {\n\tPLATFORM_CONNECT_METHODS,\n\tPLATFORM_CONNECT_SERVICES,\n\tplatformConnectMethodPath,\n\tplatformConnectServicePath,\n} from \"../platform/core-services.js\";\nimport {\n\ttype DownstreamFailureMode as DownstreamHttpFailureMode,\n\tfetchDownstream,\n} from \"../utils/downstream-http.js\";\nimport * as downstream from \"../utils/downstream.js\";\n\nconst DEFAULT_AGENT_ID = \"maestro\";\nconst DEFAULT_MAX_ATTEMPTS = 2;\nconst DEFAULT_TIMEOUT_MS = 2_000;\nconst EVALUATE_ACTION_PATH = platformConnectMethodPath(\n\tPLATFORM_CONNECT_METHODS.governance.evaluateAction,\n);\n\nexport const GOVERNANCE_CALL_FAILURE_MODES = {\n\tevaluateAction: {\n\t\toptional: downstream.FailOpen,\n\t\trequired: downstream.FailClosed,\n\t},\n} as const;\n\ntype GovernanceCall = keyof typeof GOVERNANCE_CALL_FAILURE_MODES;\n\nexport interface ActionFirewallGovernanceServiceConfig {\n\tbaseUrl?: string;\n\ttoken?: string;\n\tworkspaceId?: string;\n\tagentId?: string;\n\ttimeoutMs?: number;\n\tmaxAttempts?: number;\n\tcircuitFailureThreshold?: number;\n\tcircuitResetTimeoutMs?: number;\n\tcircuitSuccessThreshold?: number;\n\trequired?: boolean;\n}\n\nexport interface ResolvedActionFirewallGovernanceServiceConfig {\n\tbaseUrl: string;\n\ttoken?: string;\n\tworkspaceId: string;\n\tagentId: string;\n\ttimeoutMs: number;\n\tmaxAttempts: number;\n\tcircuitFailureThreshold: number;\n\tcircuitResetTimeoutMs: number;\n\tcircuitSuccessThreshold: number;\n\tfailureMode: DownstreamHttpFailureMode;\n}\n\ninterface EvaluateActionResponse {\n\tevaluation?: {\n\t\tdecision?: string | number;\n\t\treasons?: string[];\n\t\tmatchedRules?: string[];\n\t};\n}\n\nconst downstreamClients = new Map<string, downstream.DownstreamClient>();\n\nfunction trimString(value: string | undefined): string | undefined {\n\tconst trimmed = value?.trim();\n\treturn trimmed ? trimmed : undefined;\n}\n\nfunction getEnvValue(names: string[]): string | undefined {\n\tfor (const name of names) {\n\t\tconst value = trimString(process.env[name]);\n\t\tif (value) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction parsePositiveInt(value: string | undefined, fallback: number): number {\n\tconst parsed = Number.parseInt(value ?? \"\", 10);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\nfunction stripTrailingSlashes(value: string): string {\n\treturn value.replace(/\\/+$/, \"\");\n}\n\nfunction normalizeBaseUrl(baseUrl: string): string {\n\tlet normalized = stripTrailingSlashes(baseUrl.trim());\n\tfor (const suffix of [\n\t\tEVALUATE_ACTION_PATH,\n\t\tplatformConnectServicePath(PLATFORM_CONNECT_SERVICES.governance),\n\t]) {\n\t\tif (normalized.endsWith(suffix)) {\n\t\t\tnormalized = stripTrailingSlashes(normalized.slice(0, -suffix.length));\n\t\t}\n\t}\n\treturn normalized;\n}\n\nfunction resolveWorkspaceId(\n\tconfig: ActionFirewallGovernanceServiceConfig | undefined,\n\tcontext: ActionApprovalContext,\n): string | undefined {\n\tconst configuredWorkspaceId = trimString(config?.workspaceId);\n\tconst envWorkspaceId = getEnvValue([\n\t\t\"GOVERNANCE_SERVICE_WORKSPACE_ID\",\n\t\t\"MAESTRO_GOVERNANCE_WORKSPACE_ID\",\n\t\t...EVALOPS_WORKSPACE_ID_ENV_VARS,\n\t\t...EVALOPS_ORGANIZATION_ID_ENV_VARS,\n\t]);\n\tif (\n\t\tconfiguredWorkspaceId ??\n\t\ttrimString(context.user?.orgId) ??\n\t\tenvWorkspaceId\n\t) {\n\t\treturn (\n\t\t\tconfiguredWorkspaceId ?? trimString(context.user?.orgId) ?? envWorkspaceId\n\t\t);\n\t}\n\n\tconst stored = loadOAuthCredentials(\"evalops\")?.metadata?.organizationId;\n\treturn typeof stored === \"string\" && stored.trim().length > 0\n\t\t? stored.trim()\n\t\t: undefined;\n}\n\nexport function resolveActionFirewallGovernanceServiceConfig(\n\tconfig: ActionFirewallGovernanceServiceConfig | false | undefined,\n\tcontext: ActionApprovalContext,\n): ResolvedActionFirewallGovernanceServiceConfig | null {\n\tif (config === false) {\n\t\treturn null;\n\t}\n\n\tconst baseUrl =\n\t\ttrimString(config?.baseUrl) ??\n\t\tgetEnvValue([\n\t\t\t\"GOVERNANCE_SERVICE_URL\",\n\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_URL\",\n\t\t\t\"MAESTRO_PLATFORM_BASE_URL\",\n\t\t\t\"MAESTRO_EVALOPS_BASE_URL\",\n\t\t\t\"EVALOPS_BASE_URL\",\n\t\t]);\n\tif (!baseUrl) {\n\t\treturn null;\n\t}\n\n\tconst workspaceId = resolveWorkspaceId(config, context);\n\tif (!workspaceId) {\n\t\treturn null;\n\t}\n\n\tconst storedToken = trimString(loadOAuthCredentials(\"evalops\")?.access);\n\tconst required =\n\t\tconfig?.required ??\n\t\tgetEnvValue([\n\t\t\t\"GOVERNANCE_SERVICE_REQUIRED\",\n\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_REQUIRED\",\n\t\t]) === \"1\";\n\n\treturn {\n\t\tagentId:\n\t\t\ttrimString(config?.agentId) ??\n\t\t\tgetEnvValue([\n\t\t\t\t\"GOVERNANCE_SERVICE_AGENT_ID\",\n\t\t\t\t\"MAESTRO_GOVERNANCE_AGENT_ID\",\n\t\t\t\t\"MAESTRO_EVALOPS_AGENT_ID\",\n\t\t\t\t\"MAESTRO_AGENT_ID\",\n\t\t\t]) ??\n\t\t\tDEFAULT_AGENT_ID,\n\t\tbaseUrl: normalizeBaseUrl(baseUrl),\n\t\tcircuitFailureThreshold:\n\t\t\tconfig?.circuitFailureThreshold ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_CIRCUIT_FAILURE_THRESHOLD\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_CIRCUIT_FAILURE_THRESHOLD\",\n\t\t\t\t]),\n\t\t\t\t5,\n\t\t\t),\n\t\tcircuitResetTimeoutMs:\n\t\t\tconfig?.circuitResetTimeoutMs ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_CIRCUIT_RESET_TIMEOUT_MS\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_CIRCUIT_RESET_TIMEOUT_MS\",\n\t\t\t\t]),\n\t\t\t\t30_000,\n\t\t\t),\n\t\tcircuitSuccessThreshold:\n\t\t\tconfig?.circuitSuccessThreshold ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_CIRCUIT_SUCCESS_THRESHOLD\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_CIRCUIT_SUCCESS_THRESHOLD\",\n\t\t\t\t]),\n\t\t\t\t2,\n\t\t\t),\n\t\tfailureMode: required ? \"required\" : \"optional\",\n\t\tmaxAttempts:\n\t\t\tconfig?.maxAttempts ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_MAX_ATTEMPTS\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_MAX_ATTEMPTS\",\n\t\t\t\t]),\n\t\t\t\tDEFAULT_MAX_ATTEMPTS,\n\t\t\t),\n\t\ttimeoutMs:\n\t\t\tconfig?.timeoutMs ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"GOVERNANCE_SERVICE_TIMEOUT_MS\",\n\t\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_TIMEOUT_MS\",\n\t\t\t\t]),\n\t\t\t\tDEFAULT_TIMEOUT_MS,\n\t\t\t),\n\t\ttoken:\n\t\t\ttrimString(config?.token) ??\n\t\t\tgetEnvValue([\n\t\t\t\t\"GOVERNANCE_SERVICE_TOKEN\",\n\t\t\t\t\"MAESTRO_GOVERNANCE_SERVICE_TOKEN\",\n\t\t\t\t...EVALOPS_ACCESS_TOKEN_ENV_VARS,\n\t\t\t]) ??\n\t\t\tstoredToken,\n\t\tworkspaceId,\n\t};\n}\n\nfunction getDownstreamClient(\n\tconfig: ResolvedActionFirewallGovernanceServiceConfig,\n\top: GovernanceCall,\n): downstream.DownstreamClient {\n\tconst failureMode = GOVERNANCE_CALL_FAILURE_MODES[op][config.failureMode];\n\tconst key = JSON.stringify({\n\t\tbaseUrl: config.baseUrl,\n\t\tfailureMode,\n\t\top,\n\t\treset: config.circuitResetTimeoutMs,\n\t\tsuccess: config.circuitSuccessThreshold,\n\t\tthreshold: config.circuitFailureThreshold,\n\t});\n\tconst cached = downstreamClients.get(key);\n\tif (cached) {\n\t\treturn cached;\n\t}\n\tconst client = downstream.New(`governance.${op}`, {\n\t\tfailureMode,\n\t\tbreaker: {\n\t\t\tfailureThreshold: config.circuitFailureThreshold,\n\t\t\tresetTimeoutMs: config.circuitResetTimeoutMs,\n\t\t\tsuccessThreshold: config.circuitSuccessThreshold,\n\t\t\ttoolName: `governance.${op}`,\n\t\t},\n\t});\n\tdownstreamClients.set(key, client);\n\treturn client;\n}\n\nfunction toHttpFailureMode(\n\tclient: downstream.DownstreamClient,\n): DownstreamHttpFailureMode {\n\treturn client.failureMode === downstream.FailClosed ? \"required\" : \"optional\";\n}\n\nfunction buildHeaders(\n\tconfig: ResolvedActionFirewallGovernanceServiceConfig,\n): Record<string, string> {\n\treturn {\n\t\t...(config.token ? { Authorization: `Bearer ${config.token}` } : {}),\n\t\t\"Connect-Protocol-Version\": CONNECT_PROTOCOL_VERSION,\n\t\t\"Content-Type\": \"application/json\",\n\t};\n}\n\nfunction buildActionContext(): Record<string, string> | undefined {\n\tconst environment = getEnvValue([\n\t\t\"GOVERNANCE_SERVICE_ENVIRONMENT\",\n\t\t\"NODE_ENV\",\n\t]);\n\treturn environment ? { environment } : undefined;\n}\n\nfunction encodeActionPayload(context: ActionApprovalContext): string {\n\treturn Buffer.from(\n\t\tJSON.stringify({\n\t\t\targs: context.args,\n\t\t\tmetadata: context.metadata,\n\t\t\tsession: context.session\n\t\t\t\t? {\n\t\t\t\t\t\tid: context.session.id,\n\t\t\t\t\t\tstartedAt: context.session.startedAt.toISOString(),\n\t\t\t\t\t}\n\t\t\t\t: undefined,\n\t\t\ttoolName: context.toolName,\n\t\t\tuser: context.user,\n\t\t\tuserIntent: context.userIntent,\n\t\t}),\n\t\t\"utf8\",\n\t).toString(\"base64\");\n}\n\nfunction normalizeDecision(\n\tdecision: string | number | undefined,\n): ActionFirewallVerdict[\"action\"] {\n\tswitch (decision) {\n\t\tcase \"ACTION_DECISION_ALLOW\":\n\t\tcase \"allow\":\n\t\tcase 1:\n\t\t\treturn \"allow\";\n\t\tcase \"ACTION_DECISION_DENY\":\n\t\tcase \"deny\":\n\t\tcase 2:\n\t\t\treturn \"block\";\n\t\tcase \"ACTION_DECISION_REQUIRE_APPROVAL\":\n\t\tcase \"require_approval\":\n\t\tcase 3:\n\t\t\treturn \"require_approval\";\n\t\tdefault:\n\t\t\tthrow new Error(\"governance service response did not include a decision\");\n\t}\n}\n\nfunction normalizeStringArray(value: string[] | undefined): string[] {\n\treturn Array.isArray(value)\n\t\t? value.map((item) => item.trim()).filter((item) => item.length > 0)\n\t\t: [];\n}\n\nfunction normalizeEvaluationResponse(\n\tpayload: EvaluateActionResponse,\n): ActionFirewallVerdict {\n\tconst evaluation = payload.evaluation;\n\tif (!evaluation) {\n\t\tthrow new Error(\"governance service response did not include evaluation\");\n\t}\n\n\tconst action = normalizeDecision(evaluation.decision);\n\tif (action === \"allow\") {\n\t\treturn { action };\n\t}\n\n\tconst reasons = normalizeStringArray(evaluation.reasons);\n\tconst matchedRules = normalizeStringArray(evaluation.matchedRules);\n\tconst ruleId = matchedRules[0] ?? \"governance-service\";\n\tconst reason = reasons.join(\"; \") || \"Action denied by governance service\";\n\tif (action === \"block\") {\n\t\treturn {\n\t\t\taction,\n\t\t\truleId,\n\t\t\treason,\n\t\t};\n\t}\n\treturn {\n\t\taction: \"require_approval\",\n\t\truleId,\n\t\treason,\n\t};\n}\n\nexport async function evaluateActionWithActionFirewallGovernanceService(\n\tconfig: ResolvedActionFirewallGovernanceServiceConfig,\n\tcontext: ActionApprovalContext,\n): Promise<ActionFirewallVerdict | null> {\n\tconst client = getDownstreamClient(config, \"evaluateAction\");\n\treturn downstream.CallOp(\n\t\tclient,\n\t\t\"evaluateAction\",\n\t\tasync () => {\n\t\t\tconst response = await fetchDownstream(\n\t\t\t\t`${config.baseUrl}${EVALUATE_ACTION_PATH}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: \"POST\",\n\t\t\t\t\theaders: buildHeaders(config),\n\t\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\t\tworkspaceId: config.workspaceId,\n\t\t\t\t\t\tagentId: config.agentId,\n\t\t\t\t\t\tactionType: context.toolName,\n\t\t\t\t\t\tactionPayload: encodeActionPayload(context),\n\t\t\t\t\t\tcontext: buildActionContext(),\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tserviceName: \"governance service\",\n\t\t\t\t\tfailureMode: toHttpFailureMode(client),\n\t\t\t\t\ttimeoutMs: config.timeoutMs,\n\t\t\t\t\tmaxAttempts: config.maxAttempts,\n\t\t\t\t},\n\t\t\t);\n\n\t\t\tif (!response.ok) {\n\t\t\t\tconst text = await response.text();\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`governance service returned ${response.status}: ${\n\t\t\t\t\t\ttext || response.statusText\n\t\t\t\t\t}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn normalizeEvaluationResponse(\n\t\t\t\t(await response.json()) as EvaluateActionResponse,\n\t\t\t);\n\t\t},\n\t\t() => null,\n\t);\n}\n\nexport function resetActionFirewallGovernanceDownstreamForTests(): void {\n\tdownstreamClients.clear();\n}\n"]}

package/dist/safety/guarded-files.d.ts

@@ -0,0 +1,34 @@
+import { type GuardedFileDefaultBehavior, type GuardedFilesPolicySettings } from "@evalops/contracts";
+export declare const DEFAULT_GUARDED_FILE_RULE_ID = "default-guarded-file";
+export declare const GUARDED_FILES_BLOCK_POLICY_ID = "guardedFiles_block";
+export type GuardedFileAccessAction = "read" | "write" | "execute" | "unknown";
+export interface GuardedFileRule {
+    key: string;
+    category: string;
+    patterns: string[];
+}
+export interface GuardedFileMatch {
+    ruleId: typeof DEFAULT_GUARDED_FILE_RULE_ID;
+    key: string;
+    category: string;
+    pattern: string;
+    path: string;
+    defaultBehavior: GuardedFileDefaultBehavior;
+    mandatory: boolean;
+    reason?: string;
+    source: "default" | "organization" | "user";
+}
+export interface GuardedFileMatchOptions {
+    cwd?: string;
+    homeDir?: string;
+    env?: NodeJS.ProcessEnv;
+    policy?: GuardedFilesPolicySettings;
+}
+export declare function classifyGuardedFileAccessAction(toolName: string): GuardedFileAccessAction;
+export declare const DEFAULT_GUARDED_FILE_RULES: GuardedFileRule[];
+export declare function findGuardedFileMatch(path: string, options?: GuardedFileMatchOptions): GuardedFileMatch | null;
+export declare function findDefaultGuardedFileMatch(path: string, options?: GuardedFileMatchOptions): GuardedFileMatch | null;
+export declare function findGuardedToolCallMatch(toolName: string, args: unknown, options?: GuardedFileMatchOptions): GuardedFileMatch | null;
+export declare function findDefaultGuardedToolCallMatch(toolName: string, args: unknown, options?: GuardedFileMatchOptions): GuardedFileMatch | null;
+export declare function describeDefaultGuardedFileMatch(match: GuardedFileMatch): string;
+//# sourceMappingURL=guarded-files.d.ts.map

package/dist/safety/guarded-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guarded-files.d.ts","sourceRoot":"","sources":["../../src/safety/guarded-files.ts"],"names":[],"mappings":"AACA,OAAO,EAEN,KAAK,0BAA0B,EAE/B,KAAK,0BAA0B,EAE/B,MAAM,oBAAoB,CAAC;AAS5B,eAAO,MAAM,4BAA4B,yBAAyB,CAAC;AACnE,eAAO,MAAM,6BAA6B,uBAAuB,CAAC;AAElE,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/E,MAAM,WAAW,eAAe;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,OAAO,4BAA4B,CAAC;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,0BAA0B,CAAC;IAC5C,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,MAAM,CAAC;CAC5C;AAED,MAAM,WAAW,uBAAuB;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,0BAA0B,CAAC;CACpC;AAED,wBAAgB,+BAA+B,CAC9C,QAAQ,EAAE,MAAM,GACd,uBAAuB,CA+BzB;AAUD,eAAO,MAAM,0BAA0B,EAAE,eAAe,EACA,CAAC;AAuMzD,wBAAgB,oBAAoB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,uBAA4B,GACnC,gBAAgB,GAAG,IAAI,CAsDzB;AAED,wBAAgB,2BAA2B,CAC1C,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,uBAA4B,GACnC,gBAAgB,GAAG,IAAI,CAEzB;AAwLD,wBAAgB,wBAAwB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,uBAA4B,GACnC,gBAAgB,GAAG,IAAI,CAYzB;AAED,wBAAgB,+BAA+B,CAC9C,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,uBAA4B,GACnC,gBAAgB,GAAG,IAAI,CAEzB;AAED,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,gBAAgB,GACrB,MAAM,CAOR"}