@evalops/maestro 0.10.23 → 0.10.25

package/dist/safety/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/safety/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,OAAO,EAEN,UAAU,EACV,SAAS,EACT,YAAY,EACZ,KAAK,GACL,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,IAAI,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EACN,eAAe,EACf,sBAAsB,GACtB,MAAM,uCAAuC,CAAC;AAE/C,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AA+E7C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACnC,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KAClD,CAAC,CACF;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7C,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;KAC9C,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjD,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACvD,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KACnD,CAAC,CACF;CACD,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAY1D,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAChF,MAAM,uBAAuB,GAAG,GAAW,EAAE,CAC5C,IAAI,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAEhD,SAAS,2BAA2B;IACnC,OAAO,WAAW,CAAC;QAClB,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC1D,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC/C,iBAAiB,EAAE;QACnB,uBAAuB,EAAE;KACzB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IAClC,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,GAAkB,EAAE;IAClD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC9D,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAEF,IAAI,YAAY,GAA4B,IAAI,CAAC;AACjD,IAAI,eAAe,GAAkB,IAAI,CAAC;AAC1C,IAAI,kBAAkB,GAAuB,EAAE,CAAC;AAChD,IAAI,cAAc,GAAgB,EAAE,CAAC;AAErC,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,gBAAgB;IACxB,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,cAAc,GAAG,0BAA0B,EAAE,CAAC;IACpD,IAAI,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,mBAAmB,GAAG,sBAAsB,EAAE,CAAC;IACrD,IAAI,mBAAmB,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,WAAW;SAClB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB;IACjD,OAAO,OAAO;SACZ,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;SAClE,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB;IAC3B,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IACD,cAAc,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAuB;IACnD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,gCAAgC;YAChC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAEzC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;gBAChD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC5B,0BAA0B;oBAC1B,YAAY,GAAG,IAAI,CAAC;oBACpB,eAAe,GAAG,IAAI,CAAC;oBACvB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChC,mBAAmB,EAAE,CAAC;oBACvB,CAAC;gBACF,CAAC;qBAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBACnC,gEAAgE;oBAChE,gFAAgF;oBAChF,YAAY,GAAG,IAAI,CAAC;oBACpB,eAAe,GAAG,IAAI,CAAC;gBACxB,CAAC;YACF,CAAC,CAAC,CAAC;YACH,qDAAqD;YACrD,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,oDAAoD;YACpD,4CAA4C;QAC7C,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CACvB,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACjD,CAAC;QACF,MAAM,IAAI,KAAK,CACd,yBAAyB,GAAG,+BAA+B,CAC3D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAC3B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,qBAAqB,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,mBAAmB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAe;IACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IACf,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,SAAS,uBAAuB,CAC/B,MAAqB,EACrB,SAAiB,EACjB,QAAgB,EAChB,OAAe;IAEf,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IAC1C,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,CAChB,CAAC;IACF,MAAM,aAAa,GAAG,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,CAChB,CAAC;IACF,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,MAAM,GAAG;YACf,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAC7C,MAAM,EACN,OAAO,EACP,SAAS,EACT,iBAAiB,CACjB,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,uBAAuB,CAClD,MAAM,EACN,cAAc,EACd,SAAS,EACT,sBAAsB,CACtB,CAAC;IACF,MAAM,mBAAmB,GAAG,uBAAuB,CAClD,MAAM,EACN,cAAc,EACd,SAAS,EACT,sBAAsB,CACtB,CAAC;IACF,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,CAAC,YAAY,GAAG;YACrB,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;SACN,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAC7C,MAAM,EACN,QAAQ,EACR,UAAU,EACV,iBAAiB,CACjB,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC1E,IACC,YAAY,KAAK,SAAS;YAC1B,YAAY,KAAK,SAAS;YAC1B,cAAc,KAAK,SAAS;YAC5B,eAAe,KAAK,SAAS,EAC5B,CAAC;YACF,MAAM,CAAC,OAAO,GAAG;gBAChB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,mBAAmB,GAAG,kBAAkB,CAC7C,MAAM,EACN,wBAAwB,CACxB,CAAC;IACF,MAAM,yBAAyB,GAAG,kBAAkB,CACnD,MAAM,EACN,8BAA8B,CAC9B,CAAC;IACF,MAAM,qBAAqB,GAAG,kBAAkB,CAC/C,MAAM,EACN,yBAAyB,CACzB,CAAC;IACF,IACC,mBAAmB,KAAK,SAAS;QACjC,yBAAyB,KAAK,SAAS;QACvC,qBAAqB,KAAK,SAAS,EAClC,CAAC;QACF,MAAM,CAAC,MAAM,GAAG;YACf,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,yBAAyB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CACnB,IAA0B,EAC1B,KAA2B;IAE3B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CACzB,IAAwB,EACxB,KAAyB;IAEzB,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,CAClC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,CAC5D,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,IAAI,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,yBAAyB,CACjC,UAAkE,EAClE,eAAuE;IAEvE,MAAM,OAAO,GAAG,eAAe,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,CAAC;IAChE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO;QACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAC1B,UAAuC,EACvC,eAA4C;IAE5C,MAAM,YAAY,GACjB,eAAe,EAAE,YAAY,IAAI,UAAU,EAAE,YAAY,CAAC;IAC3D,MAAM,YAAY,GAAG,WAAW,CAC/B,UAAU,EAAE,YAAY,EACxB,eAAe,EAAE,YAAY,CAC7B,CAAC;IACF,MAAM,cAAc,GACnB,UAAU,EAAE,cAAc,KAAK,IAAI;QACnC,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;IAC1C,MAAM,eAAe,GACpB,UAAU,EAAE,eAAe,KAAK,IAAI;QACpC,eAAe,EAAE,eAAe,KAAK,IAAI,CAAC;IAE3C,IACC,YAAY,KAAK,SAAS;QAC1B,YAAY,KAAK,SAAS;QAC1B,CAAC,cAAc;QACf,CAAC,eAAe,EACf,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACzB,UAAsC,EACtC,eAA2C;IAE3C,MAAM,mBAAmB,GAAG,iBAAiB,CAC5C,UAAU,EAAE,mBAAmB,EAC/B,eAAe,EAAE,mBAAmB,CACpC,CAAC;IACF,MAAM,yBAAyB,GAAG,iBAAiB,CAClD,UAAU,EAAE,yBAAyB,EACrC,eAAe,EAAE,yBAAyB,CAC1C,CAAC;IACF,MAAM,qBAAqB,GAAG,iBAAiB,CAC9C,UAAU,EAAE,qBAAqB,EACjC,eAAe,EAAE,qBAAqB,CACtC,CAAC;IAEF,IACC,mBAAmB,KAAK,SAAS;QACjC,yBAAyB,KAAK,SAAS;QACvC,qBAAqB,KAAK,SAAS,EAClC,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,yBAAyB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE;YAC/B,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,UAAmC,EACnC,eAAwC;IAExC,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC;IACxC,IAAI,CAAC,eAAe;QAAE,OAAO,UAAU,CAAC;IAExC,MAAM,MAAM,GAAqB;QAChC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK;YAC5C,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;IAEF,MAAM,KAAK,GAAG,yBAAyB,CACtC,UAAU,CAAC,KAAK,EAChB,eAAe,CAAC,KAAK,CACrB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAEhC,MAAM,YAAY,GAAG,yBAAyB,CAC7C,UAAU,CAAC,YAAY,EACvB,eAAe,CAAC,YAAY,CAC5B,CAAC;IACF,IAAI,YAAY;QAAE,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAErD,MAAM,MAAM,GAAG,yBAAyB,CACvC,UAAU,CAAC,MAAM,EACjB,eAAe,CAAC,MAAM,CACtB,CAAC;IACF,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,MAAM,KAAK,GAAG,yBAAyB,CACtC,UAAU,CAAC,KAAK,EAChB,eAAe,CAAC,KAAK,CACrB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG,WAAW,CACjC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAC3B,eAAe,CAAC,MAAM,EAAE,QAAQ,CAChC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CACjC,UAAU,CAAC,OAAO,EAClB,eAAe,CAAC,OAAO,CACvB,CAAC;IACF,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAEtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAwB,EAAE,UAAkB;IACzE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACd,qBAAqB,UAAU,KAAK,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAoB;IAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAmB,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACd,uBAAuB,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC7D,CAAC;QACH,CAAC;QACD,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,oBAAoB,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAK,GAAG,KAAK;IACvC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,mEAAmE;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,YAAY,GAAG,IAAI,CAAC;QACpB,eAAe,GAAG,IAAI,CAAC;QACvB,kBAAkB,GAAG,EAAE,CAAC;QACxB,mBAAmB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,YAAY,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7D,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YACnC,mBAAmB,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,UAAU,GAA4B,IAAI,CAAC;QAC/C,IAAI,eAAe,GAA4B,IAAI,CAAC;QAEpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC7B,UAAU,GAAG,YAAY,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACP,eAAe,GAAG,YAAY,CAAC;YAChC,CAAC;QACF,CAAC;QAED,YAAY,GAAG,aAAa,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC1D,kBAAkB,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,MAAM,CACxD,CAAC,MAAM,EAA8B,EAAE,CAAC,MAAM,KAAK,IAAI,CACvD,CAAC;QACF,eAAe,GAAG,SAAS,CAAC;QAC5B,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,YAAY,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACX,4CAA4C,EAC5C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;QACF,kFAAkF;QAClF,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CACrB,OAA8B;IAE9B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,OAAO,CAAC,IAAgC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACpB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,OAA8B;IACpD,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAChC,MAAwB;IAExB,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAgB;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAwB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC1D,OAAO,CACN,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CACzE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC7B,MAAwB,EACxB,OAA8B;IAE9B,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gEAAgE;SACxE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4DAA4D;SACpE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,8EAA8E;aAC/E,CAAC;QACH,CAAC;IACF,CAAC;IAED,IACC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9B,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EACrC,CAAC;QACF,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EACL,+EAA+E;SAChF,CAAC;IACH,CAAC;IAED,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;QAC7C,IAAI,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC3E,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,yEAAyE;aAC1E,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA8B;IAI/D,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,mBAAmB;SAC/G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAwB,EACxB,OAA8B;IAK9B,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjE,IAAI,iBAAiB,EAAE,CAAC;QACvB,OAAO,iBAAiB,CAAC;IAC1B,CAAC;IAED,gCAAgC;IAChC,IACC,MAAM,CAAC,KAAK;QACZ,OAAO,CAAC,IAAI,EAAE,KAAK;QACnB,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,EAClC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC3C,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;SAC7B,CAAC,CAAC;QACH,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,qDAAqD,MAAM,CAAC,KAAK,8BAA8B,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG;SAC5H,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,sCAAsC;aACvE,CAAC;QACH,CAAC;QACD,IAAI,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,+CAA+C;aAChF,CAAC;QACH,CAAC;IACF,CAAC;IAED,iDAAiD;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACb,+CAA+C;YAC/C,MAAM,mBAAmB,GAAG;gBAC3B,sBAAsB,CAAC,YAAY;gBACnC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,OAAO;gBAC9B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;aAC/B,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,yIAAyI;qBAC1I,CAAC;gBACH,CAAC;YACF,CAAC;YAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBAE1C,iEAAiE;gBACjE,2EAA2E;gBAC3E,qDAAqD;gBACrD,MAAM,uBAAuB,GAC5B,mFAAmF,CAAC,IAAI,CACvF,OAAO,CACP,CAAC;gBACH,IACC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,CAAC;oBAC5C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1B,CAAC;oBACF,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,+GAA+G;qBAChH,CAAC;gBACH,CAAC;gBAED,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;gBAEjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACxB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvC,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,6CAA6C;yBACvE,CAAC;oBACH,CAAC;oBACD,IAAI,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5B,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,+CAA+C;yBACzE,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IAED,yBAAyB;IACzB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,YAAY,CAAC;QACrB,CAAC;IACF,CAAC;IAED,oBAAoB;IACpB,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACpD,IAAI,yBAAyB,IAAI,yBAAyB,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YAChE,IAAI,eAAe,GAAG,yBAAyB,EAAE,CAAC;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,yBAAyB,wCAAwC;iBAC5I,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACrC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC3B,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAI/C,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,kBAAkB;SAC9G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAA4B,EAC5B,KAA4D;IAK5D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEtC,uBAAuB;QACvB,IACC,MAAM,CAAC,yBAAyB;YAChC,MAAM,CAAC,yBAAyB,GAAG,CAAC,EACnC,CAAC;YACF,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YACxD,IAAI,eAAe,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACxD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,yBAAyB,wCAAwC;iBACnJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,oBAAoB;QACpB,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,KAAK,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBACnD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,iCAAiC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,mBAAmB,uCAAuC;qBAC9H,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,sDAAsD;gBACtD,gGAAgG;gBAChG,qGAAqG;gBACrG,2EAA2E;gBAC3E,4DAA4D;gBAC5D,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,kCAAkC,MAAM,CAAC,mBAAmB,mEAAmE;iBACvI,CAAC;YACH,CAAC;QACF,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,KAAK,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBAC7C,IAAI,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;oBAC7D,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,sCAAsC,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,qBAAqB,8DAA8D;qBACpK,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,iDAAiD;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uCAAuC,MAAM,CAAC,qBAAqB,qEAAqE;iBAChJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yCAAyC,KAAK,EAAE;SACxD,CAAC;IACH,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC9B,wEAAwE;IACxE,wFAAwF;IACxF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC/B,IAAI,CAAC;QACJ,OAAO,UAAU,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC","sourcesContent":["/**\n * Enterprise Policy System - Access Control and Safety Enforcement\n *\n * This module implements enterprise-grade policy enforcement for the Composer CLI,\n * enabling organizations to control what tools, models, paths, and network hosts\n * can be accessed during agent execution.\n *\n * ## Policy File Location\n *\n * Policies are loaded from `~/.maestro/policy.json` (or the legacy Composer\n * policy file as a fallback) and `.maestro/workspace.toml` in the current\n * workspace. The global JSON file is typically deployed by enterprise IT and\n * should be protected with appropriate permissions. Workspace TOML applies a\n * stricter project-specific layer.\n *\n * ## Policy Structure\n *\n * ```json\n * {\n *   \"orgId\": \"org-12345\",\n *   \"tools\": {\n *     \"allowed\": [\"Read\", \"Grep\", \"Glob\"],\n *     \"blocked\": [\"Bash\", \"Write\"]\n *   },\n *   \"models\": {\n *     \"allowed\": [\"anthropic/claude-*\"],\n *     \"blocked\": [\"openai/*\"]\n *   },\n *   \"paths\": {\n *     \"allowed\": [\"/home/user/projects/**\"],\n *     \"blocked\": [\"/etc/**\", \"/root/**\"]\n *   },\n *   \"network\": {\n *     \"allowedHosts\": [\"api.github.com\"],\n *     \"blockedHosts\": [\"*.internal.corp\"],\n *     \"blockLocalhost\": true,\n *     \"blockPrivateIPs\": true\n *   },\n *   \"limits\": {\n *     \"maxTokensPerSession\": 100000,\n *     \"maxSessionDurationMinutes\": 60,\n *     \"maxConcurrentSessions\": 3\n *   }\n * }\n * ```\n *\n * Workspace policies use TOML keys such as `allowed_models`, `blocked_tools`,\n * `file_boundaries`, and `max_tokens_per_session`.\n *\n * ## Rule Evaluation\n *\n * Policies use an allow/block list pattern with the following evaluation order:\n *\n * 1. If `blocked` list exists and matches → **DENY**\n * 2. If `allowed` list exists and doesn't match → **DENY**\n * 3. Otherwise → **ALLOW**\n *\n * This means:\n * - If only `allowed` is specified, everything else is blocked\n * - If only `blocked` is specified, everything else is allowed\n * - If both are specified, blocked takes precedence\n *\n * ## Pattern Matching\n *\n * Patterns support glob syntax via the `minimatch` library:\n *\n * | Pattern             | Matches                              |\n * |---------------------|--------------------------------------|\n * | `*`                 | Any single segment                   |\n * | `**`                | Any number of segments               |\n * | `*.md`              | Any file ending in .md               |\n * | `src/** (all .ts)`  | Any .ts file under src/              |\n *\n * ## Network Safety\n *\n * Network policies can block:\n * - Specific hosts by name or pattern\n * - Localhost (127.0.0.1, ::1)\n * - Private IP ranges (10.x, 172.16-31.x, 192.168.x)\n *\n * DNS resolution is performed to validate hosts before connection.\n *\n * ## Hot Reloading\n *\n * The policy file is watched for changes and automatically reloaded.\n * This enables policy updates without restarting active sessions.\n *\n * ## Error Handling\n *\n * Policy violations throw `PolicyError` which includes:\n * - The violated rule type (tool, model, path, network)\n * - A user-friendly error message\n * - Context about what was blocked\n *\n * @module safety/policy\n */\n\nimport {\n\ttype FSWatcher,\n\texistsSync,\n\tlstatSync,\n\treadFileSync,\n\twatch,\n} from \"node:fs\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { Type } from \"@sinclair/typebox\";\nimport { parse as parseTOML } from \"smol-toml\";\nimport type { ActionApprovalContext } from \"../agent/action-approval.js\";\nimport { PATHS } from \"../config/constants.js\";\nimport { extractDependencies } from \"../utils/dependency-extractor.js\";\nimport { safeJsonParse } from \"../utils/json.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { getHomeDir, resolveEnvPath } from \"../utils/path-expansion.js\";\nimport { expandHomeDir, resolveRealPath } from \"../utils/path-matcher.js\";\nimport { uniquePaths } from \"../utils/path-utils.js\";\nimport { compileTypeboxSchema } from \"../utils/typebox-ajv.js\";\nimport { dangerousPatterns as shellDangerousPatterns } from \"./bash-safety-analyzer.js\";\nimport { checkModelAccess } from \"./validators/model-policy-validator.js\";\nimport { checkNetworkPolicy } from \"./validators/network-policy-validator.js\";\nimport {\n\tcheckPathPolicy,\n\textractPolicyFilePaths,\n} from \"./validators/path-policy-validator.js\";\n\nconst logger = createLogger(\"safety:policy\");\n\n/**\n * Enterprise policy configuration interface.\n *\n * Defines all available policy controls that organizations can configure\n * to restrict agent behavior according to their security requirements.\n */\nexport interface EnterprisePolicy {\n\t/** Organization identifier for audit logging and policy association */\n\torgId?: string;\n\n\t/** Tool execution restrictions (e.g., block Bash, allow only Read) */\n\ttools?: {\n\t\t/** Whitelist of allowed tool names (glob patterns supported) */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked tool names (takes precedence over allowed) */\n\t\tblocked?: string[];\n\t};\n\n\t/** Package/dependency installation restrictions */\n\tdependencies?: {\n\t\t/** Whitelist of allowed package patterns */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked package patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Model access restrictions (format: \"provider/model-id\") */\n\tmodels?: {\n\t\t/** Whitelist of allowed model patterns (e.g., \"anthropic/*\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked model patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Required skill names for workspace-controlled workflows */\n\tskills?: {\n\t\t/** Skills that must be available for this workspace */\n\t\trequired?: string[];\n\t};\n\n\t/** File system path restrictions */\n\tpaths?: {\n\t\t/** Whitelist of allowed path patterns (e.g., \"/home/user/projects/**\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked path patterns (e.g., \"/etc/**\") */\n\t\tblocked?: string[];\n\t};\n\n\t/** Network access restrictions */\n\tnetwork?: {\n\t\t/** Whitelist of allowed hostnames (e.g., \"api.github.com\") */\n\t\tallowedHosts?: string[];\n\t\t/** Blacklist of blocked hostnames (e.g., \"*.internal.corp\") */\n\t\tblockedHosts?: string[];\n\t\t/** Block access to localhost (127.0.0.1, ::1) */\n\t\tblockLocalhost?: boolean;\n\t\t/** Block access to private IP ranges (10.x, 172.16-31.x, 192.168.x) */\n\t\tblockPrivateIPs?: boolean;\n\t};\n\n\t/**\n\t * Session limits for resource control.\n\t *\n\t * NOTE: These are schema definitions for policy configuration.\n\t * Actual enforcement requires integration with the billing/token-tracker system.\n\t * Currently exposed via getPolicyLimits() for consumers that want to implement limits.\n\t */\n\tlimits?: {\n\t\t/** Maximum tokens per session before termination */\n\t\tmaxTokensPerSession?: number;\n\t\t/** Maximum session duration in minutes */\n\t\tmaxSessionDurationMinutes?: number;\n\t\t/** Maximum concurrent active sessions */\n\t\tmaxConcurrentSessions?: number;\n\t};\n}\n\nconst PolicySchema = Type.Object({\n\torgId: Type.Optional(Type.String()),\n\ttools: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tdependencies: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tmodels: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tskills: Type.Optional(\n\t\tType.Object({\n\t\t\trequired: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tpaths: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tnetwork: Type.Optional(\n\t\tType.Object({\n\t\t\tallowedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockLocalhost: Type.Optional(Type.Boolean()),\n\t\t\tblockPrivateIPs: Type.Optional(Type.Boolean()),\n\t\t}),\n\t),\n\tlimits: Type.Optional(\n\t\tType.Object({\n\t\t\tmaxTokensPerSession: Type.Optional(Type.Number()),\n\t\t\tmaxSessionDurationMinutes: Type.Optional(Type.Number()),\n\t\t\tmaxConcurrentSessions: Type.Optional(Type.Number()),\n\t\t}),\n\t),\n});\n\nconst validatePolicy = compileTypeboxSchema(PolicySchema);\n\ntype PolicyFormat = \"json\" | \"toml\";\ntype PolicyScope = \"user\" | \"workspace\";\ntype UnknownRecord = Record<string, unknown>;\n\ninterface PolicySource {\n\tpath: string;\n\tformat: PolicyFormat;\n\tscope: PolicyScope;\n}\n\nconst getUserPolicyPath = (): string => join(PATHS.MAESTRO_HOME, \"policy.json\");\nconst getLegacyUserPolicyPath = (): string =>\n\tjoin(getHomeDir(), \".composer\", \"policy.json\");\n\nfunction getUserPolicyPathCandidates(): string[] {\n\treturn uniquePaths([\n\t\tresolveEnvPath(process.env.MAESTRO_ENTERPRISE_POLICY_PATH),\n\t\tresolveEnvPath(process.env.MAESTRO_POLICY_PATH),\n\t\tgetUserPolicyPath(),\n\t\tgetLegacyUserPolicyPath(),\n\t]);\n}\n\nfunction getEffectiveUserPolicyPath(): string | null {\n\tconst candidates = getUserPolicyPathCandidates();\n\treturn candidates.find(isPolicyFile) ?? null;\n}\n\nconst isPolicyFile = (path: string): boolean => {\n\tif (!existsSync(path)) return false;\n\ttry {\n\t\treturn lstatSync(path).isFile();\n\t} catch {\n\t\treturn false;\n\t}\n};\n\nconst getWorkspacePolicyPath = (): string | null => {\n\tlet current = resolve(process.cwd());\n\twhile (true) {\n\t\tconst candidate = join(current, \".maestro\", \"workspace.toml\");\n\t\tif (isPolicyFile(candidate)) {\n\t\t\treturn candidate;\n\t\t}\n\t\tconst parent = dirname(current);\n\t\tif (parent === current) {\n\t\t\treturn null;\n\t\t}\n\t\tcurrent = parent;\n\t}\n};\n\nlet cachedPolicy: EnterprisePolicy | null = null;\nlet cachedPolicyKey: string | null = null;\nlet cachedPolicyLayers: EnterprisePolicy[] = [];\nlet policyWatchers: FSWatcher[] = [];\n\nfunction isRecord(value: unknown): value is UnknownRecord {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getPolicySources(): PolicySource[] {\n\tconst sources: PolicySource[] = [];\n\tconst userPolicyPath = getEffectiveUserPolicyPath();\n\tif (userPolicyPath) {\n\t\tsources.push({ path: userPolicyPath, format: \"json\", scope: \"user\" });\n\t}\n\n\tconst workspacePolicyPath = getWorkspacePolicyPath();\n\tif (workspacePolicyPath) {\n\t\tsources.push({\n\t\t\tpath: workspacePolicyPath,\n\t\t\tformat: \"toml\",\n\t\t\tscope: \"workspace\",\n\t\t});\n\t}\n\treturn sources;\n}\n\nfunction getPolicyCacheKey(sources: PolicySource[]): string {\n\treturn sources\n\t\t.map((source) => `${source.scope}:${source.format}:${source.path}`)\n\t\t.join(\"|\");\n}\n\nfunction closePolicyWatchers() {\n\tfor (const watcher of policyWatchers) {\n\t\twatcher.close();\n\t}\n\tpolicyWatchers = [];\n}\n\nfunction startPolicyWatchers(sources: PolicySource[]) {\n\tif (policyWatchers.length > 0) return;\n\n\tfor (const source of sources) {\n\t\ttry {\n\t\t\t// Only watch if the file exists\n\t\t\tif (!isPolicyFile(source.path)) continue;\n\n\t\t\tconst watcher = watch(source.path, (eventType) => {\n\t\t\t\tif (eventType === \"rename\") {\n\t\t\t\t\t// File deleted or renamed\n\t\t\t\t\tcachedPolicy = null;\n\t\t\t\t\tcachedPolicyKey = null;\n\t\t\t\t\tif (!isPolicyFile(source.path)) {\n\t\t\t\t\t\tclosePolicyWatchers();\n\t\t\t\t\t}\n\t\t\t\t} else if (eventType === \"change\") {\n\t\t\t\t\t// File modified - invalidate cache so next loadPolicy() reloads\n\t\t\t\t\t// We don't proactively reload here to avoid race conditions with partial writes\n\t\t\t\t\tcachedPolicy = null;\n\t\t\t\t\tcachedPolicyKey = null;\n\t\t\t\t}\n\t\t\t});\n\t\t\t// Prevent the watcher from keeping the process alive\n\t\t\twatcher.unref();\n\t\t\tpolicyWatchers.push(watcher);\n\t\t} catch (error) {\n\t\t\t// Ignore watcher errors (e.g. system limit reached)\n\t\t\t// We fall back to standard caching behavior\n\t\t}\n\t}\n}\n\nfunction readStringArray(\n\tsource: UnknownRecord,\n\tkey: string,\n): string[] | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (\n\t\t!Array.isArray(value) ||\n\t\t!value.every((entry) => typeof entry === \"string\")\n\t) {\n\t\tthrow new Error(\n\t\t\t`Workspace policy key \"${key}\" must be an array of strings`,\n\t\t);\n\t}\n\treturn value;\n}\n\nfunction readOptionalString(\n\tsource: UnknownRecord,\n\tkey: string,\n): string | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"string\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a string`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalNumber(\n\tsource: UnknownRecord,\n\tkey: string,\n): number | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"number\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a number`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalBoolean(\n\tsource: UnknownRecord,\n\tkey: string,\n): boolean | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"boolean\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a boolean`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalRecord(\n\tsource: UnknownRecord,\n\tkey: string,\n): UnknownRecord | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (!isRecord(value)) {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a table`);\n\t}\n\treturn value;\n}\n\nfunction selectWorkspacePolicyRoot(parsed: unknown): UnknownRecord {\n\tif (!isRecord(parsed)) {\n\t\tthrow new Error(\"Workspace policy must be a TOML table\");\n\t}\n\n\tconst nestedPolicy = parsed.policy;\n\tif (nestedPolicy === undefined) {\n\t\treturn parsed;\n\t}\n\tif (!isRecord(nestedPolicy)) {\n\t\tthrow new Error('Workspace policy key \"policy\" must be a table');\n\t}\n\treturn nestedPolicy;\n}\n\nfunction getWorkspaceStringArray(\n\tsource: UnknownRecord,\n\ttableName: string,\n\ttableKey: string,\n\tflatKey: string,\n): string[] | undefined {\n\tconst flatValue = readStringArray(source, flatKey);\n\tif (flatValue !== undefined) return flatValue;\n\n\tconst table = readOptionalRecord(source, tableName);\n\treturn table ? readStringArray(table, tableKey) : undefined;\n}\n\nfunction mapWorkspacePolicy(parsed: unknown): EnterprisePolicy {\n\tconst source = selectWorkspacePolicyRoot(parsed);\n\tconst policy: EnterprisePolicy = {};\n\n\tconst orgId = readOptionalString(source, \"org_id\");\n\tif (orgId !== undefined) {\n\t\tpolicy.orgId = orgId;\n\t}\n\n\tconst allowedTools = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"tools\",\n\t\t\"allowed\",\n\t\t\"allowed_tools\",\n\t);\n\tconst blockedTools = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"tools\",\n\t\t\"blocked\",\n\t\t\"blocked_tools\",\n\t);\n\tif (allowedTools !== undefined || blockedTools !== undefined) {\n\t\tpolicy.tools = {\n\t\t\t...(allowedTools !== undefined ? { allowed: allowedTools } : {}),\n\t\t\t...(blockedTools !== undefined ? { blocked: blockedTools } : {}),\n\t\t};\n\t}\n\n\tconst allowedModels = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"models\",\n\t\t\"allowed\",\n\t\t\"allowed_models\",\n\t);\n\tconst blockedModels = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"models\",\n\t\t\"blocked\",\n\t\t\"blocked_models\",\n\t);\n\tif (allowedModels !== undefined || blockedModels !== undefined) {\n\t\tpolicy.models = {\n\t\t\t...(allowedModels !== undefined ? { allowed: allowedModels } : {}),\n\t\t\t...(blockedModels !== undefined ? { blocked: blockedModels } : {}),\n\t\t};\n\t}\n\n\tconst fileBoundaries = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"paths\",\n\t\t\"allowed\",\n\t\t\"file_boundaries\",\n\t);\n\tconst blockedPaths = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"paths\",\n\t\t\"blocked\",\n\t\t\"blocked_paths\",\n\t);\n\tif (fileBoundaries !== undefined || blockedPaths !== undefined) {\n\t\tpolicy.paths = {\n\t\t\t...(fileBoundaries !== undefined ? { allowed: fileBoundaries } : {}),\n\t\t\t...(blockedPaths !== undefined ? { blocked: blockedPaths } : {}),\n\t\t};\n\t}\n\n\tconst allowedDependencies = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"dependencies\",\n\t\t\"allowed\",\n\t\t\"allowed_dependencies\",\n\t);\n\tconst blockedDependencies = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"dependencies\",\n\t\t\"blocked\",\n\t\t\"blocked_dependencies\",\n\t);\n\tif (allowedDependencies !== undefined || blockedDependencies !== undefined) {\n\t\tpolicy.dependencies = {\n\t\t\t...(allowedDependencies !== undefined\n\t\t\t\t? { allowed: allowedDependencies }\n\t\t\t\t: {}),\n\t\t\t...(blockedDependencies !== undefined\n\t\t\t\t? { blocked: blockedDependencies }\n\t\t\t\t: {}),\n\t\t};\n\t}\n\n\tconst requiredSkills = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"skills\",\n\t\t\"required\",\n\t\t\"required_skills\",\n\t);\n\tif (requiredSkills !== undefined) {\n\t\tpolicy.skills = { required: requiredSkills };\n\t}\n\n\tconst network = readOptionalRecord(source, \"network\");\n\tif (network) {\n\t\tconst allowedHosts = readStringArray(network, \"allowed_hosts\");\n\t\tconst blockedHosts = readStringArray(network, \"blocked_hosts\");\n\t\tconst blockLocalhost = readOptionalBoolean(network, \"block_localhost\");\n\t\tconst blockPrivateIPs = readOptionalBoolean(network, \"block_private_ips\");\n\t\tif (\n\t\t\tallowedHosts !== undefined ||\n\t\t\tblockedHosts !== undefined ||\n\t\t\tblockLocalhost !== undefined ||\n\t\t\tblockPrivateIPs !== undefined\n\t\t) {\n\t\t\tpolicy.network = {\n\t\t\t\t...(allowedHosts !== undefined ? { allowedHosts } : {}),\n\t\t\t\t...(blockedHosts !== undefined ? { blockedHosts } : {}),\n\t\t\t\t...(blockLocalhost !== undefined ? { blockLocalhost } : {}),\n\t\t\t\t...(blockPrivateIPs !== undefined ? { blockPrivateIPs } : {}),\n\t\t\t};\n\t\t}\n\t}\n\n\tconst maxTokensPerSession = readOptionalNumber(\n\t\tsource,\n\t\t\"max_tokens_per_session\",\n\t);\n\tconst maxSessionDurationMinutes = readOptionalNumber(\n\t\tsource,\n\t\t\"max_session_duration_minutes\",\n\t);\n\tconst maxConcurrentSessions = readOptionalNumber(\n\t\tsource,\n\t\t\"max_concurrent_sessions\",\n\t);\n\tif (\n\t\tmaxTokensPerSession !== undefined ||\n\t\tmaxSessionDurationMinutes !== undefined ||\n\t\tmaxConcurrentSessions !== undefined\n\t) {\n\t\tpolicy.limits = {\n\t\t\t...(maxTokensPerSession !== undefined ? { maxTokensPerSession } : {}),\n\t\t\t...(maxSessionDurationMinutes !== undefined\n\t\t\t\t? { maxSessionDurationMinutes }\n\t\t\t\t: {}),\n\t\t\t...(maxConcurrentSessions !== undefined ? { maxConcurrentSessions } : {}),\n\t\t};\n\t}\n\n\treturn policy;\n}\n\nfunction uniqueUnion(\n\tleft: string[] | undefined,\n\tright: string[] | undefined,\n): string[] | undefined {\n\tconst values = [...(left ?? []), ...(right ?? [])];\n\treturn values.length > 0 ? [...new Set(values)] : undefined;\n}\n\nfunction minPositiveNumber(\n\tleft: number | undefined,\n\tright: number | undefined,\n): number | undefined {\n\tconst values = [left, right].filter(\n\t\t(value): value is number => value !== undefined && value > 0,\n\t);\n\tif (values.length === 0) {\n\t\treturn left ?? right;\n\t}\n\treturn Math.min(...values);\n}\n\nfunction mergeAllowedBlockedPolicy(\n\tuserPolicy: { allowed?: string[]; blocked?: string[] } | undefined,\n\tworkspacePolicy: { allowed?: string[]; blocked?: string[] } | undefined,\n): { allowed?: string[]; blocked?: string[] } | undefined {\n\tconst allowed = workspacePolicy?.allowed ?? userPolicy?.allowed;\n\tconst blocked = uniqueUnion(userPolicy?.blocked, workspacePolicy?.blocked);\n\tif (allowed === undefined && blocked === undefined) return undefined;\n\treturn {\n\t\t...(allowed !== undefined ? { allowed } : {}),\n\t\t...(blocked !== undefined ? { blocked } : {}),\n\t};\n}\n\nfunction mergeNetworkPolicy(\n\tuserPolicy: EnterprisePolicy[\"network\"],\n\tworkspacePolicy: EnterprisePolicy[\"network\"],\n): EnterprisePolicy[\"network\"] {\n\tconst allowedHosts =\n\t\tworkspacePolicy?.allowedHosts ?? userPolicy?.allowedHosts;\n\tconst blockedHosts = uniqueUnion(\n\t\tuserPolicy?.blockedHosts,\n\t\tworkspacePolicy?.blockedHosts,\n\t);\n\tconst blockLocalhost =\n\t\tuserPolicy?.blockLocalhost === true ||\n\t\tworkspacePolicy?.blockLocalhost === true;\n\tconst blockPrivateIPs =\n\t\tuserPolicy?.blockPrivateIPs === true ||\n\t\tworkspacePolicy?.blockPrivateIPs === true;\n\n\tif (\n\t\tallowedHosts === undefined &&\n\t\tblockedHosts === undefined &&\n\t\t!blockLocalhost &&\n\t\t!blockPrivateIPs\n\t) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\t...(allowedHosts !== undefined ? { allowedHosts } : {}),\n\t\t...(blockedHosts !== undefined ? { blockedHosts } : {}),\n\t\t...(blockLocalhost ? { blockLocalhost } : {}),\n\t\t...(blockPrivateIPs ? { blockPrivateIPs } : {}),\n\t};\n}\n\nfunction mergePolicyLimits(\n\tuserPolicy: EnterprisePolicy[\"limits\"],\n\tworkspacePolicy: EnterprisePolicy[\"limits\"],\n): EnterprisePolicy[\"limits\"] {\n\tconst maxTokensPerSession = minPositiveNumber(\n\t\tuserPolicy?.maxTokensPerSession,\n\t\tworkspacePolicy?.maxTokensPerSession,\n\t);\n\tconst maxSessionDurationMinutes = minPositiveNumber(\n\t\tuserPolicy?.maxSessionDurationMinutes,\n\t\tworkspacePolicy?.maxSessionDurationMinutes,\n\t);\n\tconst maxConcurrentSessions = minPositiveNumber(\n\t\tuserPolicy?.maxConcurrentSessions,\n\t\tworkspacePolicy?.maxConcurrentSessions,\n\t);\n\n\tif (\n\t\tmaxTokensPerSession === undefined &&\n\t\tmaxSessionDurationMinutes === undefined &&\n\t\tmaxConcurrentSessions === undefined\n\t) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\t...(maxTokensPerSession !== undefined ? { maxTokensPerSession } : {}),\n\t\t...(maxSessionDurationMinutes !== undefined\n\t\t\t? { maxSessionDurationMinutes }\n\t\t\t: {}),\n\t\t...(maxConcurrentSessions !== undefined ? { maxConcurrentSessions } : {}),\n\t};\n}\n\nfunction mergePolicies(\n\tuserPolicy: EnterprisePolicy | null,\n\tworkspacePolicy: EnterprisePolicy | null,\n): EnterprisePolicy | null {\n\tif (!userPolicy) return workspacePolicy;\n\tif (!workspacePolicy) return userPolicy;\n\n\tconst policy: EnterprisePolicy = {\n\t\t...(userPolicy.orgId || workspacePolicy.orgId\n\t\t\t? { orgId: workspacePolicy.orgId ?? userPolicy.orgId }\n\t\t\t: {}),\n\t};\n\n\tconst tools = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.tools,\n\t\tworkspacePolicy.tools,\n\t);\n\tif (tools) policy.tools = tools;\n\n\tconst dependencies = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.dependencies,\n\t\tworkspacePolicy.dependencies,\n\t);\n\tif (dependencies) policy.dependencies = dependencies;\n\n\tconst models = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.models,\n\t\tworkspacePolicy.models,\n\t);\n\tif (models) policy.models = models;\n\n\tconst paths = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.paths,\n\t\tworkspacePolicy.paths,\n\t);\n\tif (paths) policy.paths = paths;\n\n\tconst requiredSkills = uniqueUnion(\n\t\tuserPolicy.skills?.required,\n\t\tworkspacePolicy.skills?.required,\n\t);\n\tif (requiredSkills) {\n\t\tpolicy.skills = { required: requiredSkills };\n\t}\n\n\tconst network = mergeNetworkPolicy(\n\t\tuserPolicy.network,\n\t\tworkspacePolicy.network,\n\t);\n\tif (network) policy.network = network;\n\n\tconst limits = mergePolicyLimits(userPolicy.limits, workspacePolicy.limits);\n\tif (limits) policy.limits = limits;\n\n\treturn policy;\n}\n\nfunction validateLoadedPolicy(policy: EnterprisePolicy, sourcePath: string) {\n\tif (!validatePolicy(policy)) {\n\t\tthrow new Error(\n\t\t\t`Invalid schema in ${sourcePath}: ${validatePolicy.errors?.map((e) => e.message).join(\", \")}`,\n\t\t);\n\t}\n}\n\nfunction loadPolicySource(source: PolicySource): EnterprisePolicy {\n\tconst raw = readFileSync(source.path, \"utf8\");\n\tif (source.format === \"json\") {\n\t\tconst result = safeJsonParse<EnterprisePolicy>(raw);\n\t\tif (!result.success) {\n\t\t\tthrow new Error(\n\t\t\t\t`JSON parse error in ${source.path}: ${result.error.message}`,\n\t\t\t);\n\t\t}\n\t\tvalidateLoadedPolicy(result.data, source.path);\n\t\treturn result.data;\n\t}\n\n\tconst workspacePolicy = mapWorkspacePolicy(parseTOML(raw));\n\tvalidateLoadedPolicy(workspacePolicy, source.path);\n\treturn workspacePolicy;\n}\n\nexport function loadPolicy(force = false): EnterprisePolicy | null {\n\tconst sources = getPolicySources();\n\t// Check if file exists first - if not, clear cache and return null\n\tif (sources.length === 0) {\n\t\tcachedPolicy = null;\n\t\tcachedPolicyKey = null;\n\t\tcachedPolicyLayers = [];\n\t\tclosePolicyWatchers();\n\t\treturn null;\n\t}\n\n\tconst policyKey = getPolicyCacheKey(sources);\n\tif (cachedPolicy && cachedPolicyKey === policyKey && !force) {\n\t\treturn cachedPolicy;\n\t}\n\n\ttry {\n\t\tif (cachedPolicyKey !== policyKey) {\n\t\t\tclosePolicyWatchers();\n\t\t}\n\n\t\tlet userPolicy: EnterprisePolicy | null = null;\n\t\tlet workspacePolicy: EnterprisePolicy | null = null;\n\n\t\tfor (const source of sources) {\n\t\t\tconst loadedPolicy = loadPolicySource(source);\n\t\t\tif (source.scope === \"user\") {\n\t\t\t\tuserPolicy = loadedPolicy;\n\t\t\t} else {\n\t\t\t\tworkspacePolicy = loadedPolicy;\n\t\t\t}\n\t\t}\n\n\t\tcachedPolicy = mergePolicies(userPolicy, workspacePolicy);\n\t\tcachedPolicyLayers = [userPolicy, workspacePolicy].filter(\n\t\t\t(policy): policy is EnterprisePolicy => policy !== null,\n\t\t);\n\t\tcachedPolicyKey = policyKey;\n\t\tstartPolicyWatchers(sources);\n\t\treturn cachedPolicy;\n\t} catch (error) {\n\t\tlogger.error(\n\t\t\t\"Critical: Failed to load enterprise policy\",\n\t\t\terror instanceof Error ? error : new Error(String(error)),\n\t\t);\n\t\t// Throw to ensure we fail closed (block access) rather than treating as no policy\n\t\tthrow error;\n\t}\n}\n\nfunction getArgsObject(\n\tcontext: ActionApprovalContext,\n): Record<string, unknown> | null {\n\treturn context.args && typeof context.args === \"object\"\n\t\t? (context.args as Record<string, unknown>)\n\t\t: null;\n}\n\nfunction getStringArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): string | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"string\" ? value : null;\n}\n\nfunction getCommandArg(context: ActionApprovalContext): string | null {\n\treturn getStringArg(context, \"command\");\n}\n\nfunction getEffectivePolicyLayers(\n\tpolicy: EnterprisePolicy,\n): EnterprisePolicy[] {\n\treturn cachedPolicyLayers.length > 0 ? cachedPolicyLayers : [policy];\n}\n\nfunction hasOwnKey(value: object, key: PropertyKey): boolean {\n\treturn Object.prototype.hasOwnProperty.call(value, key);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n\treturn typeof value === \"string\" && value.trim().length > 0;\n}\n\nfunction hasActiveDurationLimit(policy: EnterprisePolicy): boolean {\n\tconst duration = policy.limits?.maxSessionDurationMinutes;\n\treturn (\n\t\ttypeof duration === \"number\" && Number.isFinite(duration) && duration > 0\n\t);\n}\n\nfunction validatePolicyContext(\n\tpolicy: EnterprisePolicy,\n\tcontext: ActionApprovalContext,\n): { allowed: false; reason: string } | null {\n\tif (!isNonEmptyString(context.toolName)) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Policy evaluation context is missing required field: toolName.\",\n\t\t};\n\t}\n\n\tif (!hasOwnKey(context, \"args\")) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Policy evaluation context is missing required field: args.\",\n\t\t};\n\t}\n\n\tif (context.user) {\n\t\tif (!isNonEmptyString(context.user.orgId)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Policy evaluation context has invalid user context: missing organization id.\",\n\t\t\t};\n\t\t}\n\t}\n\n\tif (\n\t\tisNonEmptyString(policy.orgId) &&\n\t\t!isNonEmptyString(context.user?.orgId)\n\t) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason:\n\t\t\t\t\"Organization-bound policy requires user organization context. Access blocked.\",\n\t\t};\n\t}\n\n\tif (hasActiveDurationLimit(policy)) {\n\t\tconst startedAt = context.session?.startedAt;\n\t\tif (!(startedAt instanceof Date) || !Number.isFinite(startedAt.getTime())) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Session duration policy requires session start context. Access blocked.\",\n\t\t\t};\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport async function checkPolicy(context: ActionApprovalContext): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Access blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\tfor (const policyLayer of getEffectivePolicyLayers(policy)) {\n\t\tconst result = await checkPolicyLayer(policyLayer, context);\n\t\tif (!result.allowed) {\n\t\t\treturn result;\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nasync function checkPolicyLayer(\n\tpolicy: EnterprisePolicy,\n\tcontext: ActionApprovalContext,\n): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tconst contextValidation = validatePolicyContext(policy, context);\n\tif (contextValidation) {\n\t\treturn contextValidation;\n\t}\n\n\t// 0. Organization Context Check\n\tif (\n\t\tpolicy.orgId &&\n\t\tcontext.user?.orgId &&\n\t\tpolicy.orgId !== context.user.orgId\n\t) {\n\t\tlogger.warn(\"Org mismatch, action blocked\", {\n\t\t\tpolicyOrgId: policy.orgId,\n\t\t\tuserOrgId: context.user.orgId,\n\t\t});\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Organization mismatch: This machine is managed by ${policy.orgId}, but you are signed in to ${context.user.orgId}.`,\n\t\t};\n\t}\n\n\t// 1. Tool Constraints\n\tif (policy.tools) {\n\t\tconst { allowed, blocked } = policy.tools;\n\t\tif (allowed && !allowed.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is not in the approved tools list.`,\n\t\t\t};\n\t\t}\n\t\tif (blocked?.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is explicitly blocked by enterprise policy.`,\n\t\t\t};\n\t\t}\n\t}\n\n\t// 2. Dangerous Patterns & Dependency Constraints\n\tif (context.toolName === \"bash\" || context.toolName === \"background_tasks\") {\n\t\tconst command = getCommandArg(context);\n\t\tif (command) {\n\t\t\t// Check for obfuscation and dangerous patterns\n\t\t\tconst obfuscationPatterns = [\n\t\t\t\tshellDangerousPatterns.base64Decode,\n\t\t\t\tshellDangerousPatterns.opensslEnc,\n\t\t\t\tshellDangerousPatterns.pythonEval,\n\t\t\t\tshellDangerousPatterns.perlEval,\n\t\t\t\tshellDangerousPatterns.nodeEval,\n\t\t\t\tshellDangerousPatterns.phpEval,\n\t\t\t\tshellDangerousPatterns.rubyEval,\n\t\t\t\tshellDangerousPatterns.evalCall,\n\t\t\t\tshellDangerousPatterns.execCall,\n\t\t\t];\n\t\t\tfor (const pattern of obfuscationPatterns) {\n\t\t\t\tif (pattern.test(command)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains obfuscated or dangerous patterns (e.g. base64 decoding, inline code execution) which are blocked by enterprise policy.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (policy.dependencies) {\n\t\t\t\tconst deps = extractDependencies(command);\n\n\t\t\t\t// Check for shell metacharacters in any package install command,\n\t\t\t\t// even when no explicit package names are extracted (e.g., \"npm install\").\n\t\t\t\t// This prevents bypass via \"npm install && rm -rf /\"\n\t\t\t\tconst isPackageInstallCommand =\n\t\t\t\t\t/(?:npm|yarn|pnpm|bun|pip|pip3|gem|cargo|go\\s+get|composer)\\s+(?:install|add|i\\b)/i.test(\n\t\t\t\t\t\tcommand,\n\t\t\t\t\t);\n\t\t\t\tif (\n\t\t\t\t\t(deps.length > 0 || isPackageInstallCommand) &&\n\t\t\t\t\t/[;&|`$()<>]/.test(command)\n\t\t\t\t) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains shell metacharacters which are not allowed by enterprise policy during package installation.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\tconst { allowed, blocked } = policy.dependencies;\n\n\t\t\t\tfor (const dep of deps) {\n\t\t\t\t\tif (allowed && !allowed.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is not in the approved dependencies list.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t\tif (blocked?.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is explicitly blocked by enterprise policy.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\t// 3. Path Constraints\n\tif (policy.paths) {\n\t\tconst filePaths = extractPolicyFilePaths(context);\n\t\tconst pathCheck = checkPathPolicy(filePaths, policy.paths);\n\t\tif (!pathCheck.allowed) {\n\t\t\treturn pathCheck;\n\t\t}\n\t}\n\n\t// 4. Network Constraints\n\tif (policy.network) {\n\t\tconst networkCheck = await checkNetworkPolicy(context, policy.network);\n\t\tif (!networkCheck.allowed) {\n\t\t\treturn networkCheck;\n\t\t}\n\t}\n\n\t// 5. Session Limits\n\tif (policy.limits && context.session) {\n\t\tconst { maxSessionDurationMinutes } = policy.limits;\n\t\tif (maxSessionDurationMinutes && maxSessionDurationMinutes > 0) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - context.session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nexport class PolicyError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"PolicyError\";\n\t}\n}\n\n/**\n * Check if a model is allowed by policy\n * Called separately from tool checks since model selection happens at a different time\n */\nexport function checkModelPolicy(modelId: string): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Model blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\tfor (const policyLayer of getEffectivePolicyLayers(policy)) {\n\t\tif (!policyLayer.models) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst result = checkModelAccess(modelId, policyLayer.models);\n\t\tif (!result.allowed) {\n\t\t\treturn result;\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\n/**\n * Check if the current session has exceeded policy limits\n */\nexport function checkSessionLimits(\n\tsession: { startedAt: Date },\n\tusage?: { tokenCount?: number; activeSessionCount?: number },\n): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\ttry {\n\t\tconst limits = getPolicyLimits();\n\t\tif (!limits) return { allowed: true };\n\n\t\t// Check duration limit\n\t\tif (\n\t\t\tlimits.maxSessionDurationMinutes &&\n\t\t\tlimits.maxSessionDurationMinutes > 0\n\t\t) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > limits.maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${limits.maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check token limit\n\t\tif (limits.maxTokensPerSession && limits.maxTokensPerSession > 0) {\n\t\t\tif (usage?.tokenCount !== undefined) {\n\t\t\t\tif (usage.tokenCount > limits.maxTokensPerSession) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Session token limit exceeded (${usage.tokenCount}/${limits.maxTokensPerSession} tokens). Please start a new session.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Usage undefined but limit is set - should we block?\n\t\t\t\t// To be safe (fail-closed) for strict limits, we probably should if we can't verify compliance.\n\t\t\t\t// However, if usage is undefined because metrics are disabled/failing, this might be too aggressive.\n\t\t\t\t// Given user feedback \"Fail-Open Error Handling\", we should warn or block.\n\t\t\t\t// Let's block if we can't verify usage against a set limit.\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session token limit is active (${limits.maxTokensPerSession}) but token usage data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check concurrent sessions limit\n\t\tif (limits.maxConcurrentSessions && limits.maxConcurrentSessions > 0) {\n\t\t\tif (usage?.activeSessionCount !== undefined) {\n\t\t\t\tif (usage.activeSessionCount > limits.maxConcurrentSessions) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Concurrent session limit exceeded (${usage.activeSessionCount}/${limits.maxConcurrentSessions}). Please close existing sessions before starting a new one.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Same fail-closed logic for concurrent sessions\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Concurrent session limit is active (${limits.maxConcurrentSessions}) but session count data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn { allowed: true };\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Policy error checking session limits: ${error}`,\n\t\t};\n\t}\n}\n\n/**\n * Get the current policy limits\n */\nexport function getPolicyLimits(): EnterprisePolicy[\"limits\"] | null {\n\t// Catch errors and return null (no limits) to prevent crashing callers.\n\t// Strict enforcement should rely on checkSessionLimits() which handles its own loading.\n\ttry {\n\t\tconst policy = loadPolicy();\n\t\treturn policy?.limits ?? null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Get the full loaded policy (for admin UI display)\n */\nexport function getCurrentPolicy(): EnterprisePolicy | null {\n\ttry {\n\t\treturn loadPolicy();\n\t} catch {\n\t\treturn null;\n\t}\n}\n"]}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/safety/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,OAAO,EAEN,UAAU,EACV,SAAS,EACT,YAAY,EACZ,KAAK,GACL,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,IAAI,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EACN,eAAe,EACf,sBAAsB,GACtB,MAAM,uCAAuC,CAAC;AAE/C,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AA+E7C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACnC,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KAClD,CAAC,CACF;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7C,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;KAC9C,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjD,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACvD,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KACnD,CAAC,CACF;CACD,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAY1D,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAChF,MAAM,uBAAuB,GAAG,GAAW,EAAE,CAC5C,IAAI,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAEhD,SAAS,2BAA2B;IACnC,OAAO,WAAW,CAAC;QAClB,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC1D,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC/C,iBAAiB,EAAE;QACnB,uBAAuB,EAAE;KACzB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IAClC,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,GAAkB,EAAE;IAClD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC9D,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAEF,IAAI,YAAY,GAA4B,IAAI,CAAC;AACjD,IAAI,eAAe,GAAkB,IAAI,CAAC;AAC1C,IAAI,kBAAkB,GAAuB,EAAE,CAAC;AAChD,IAAI,cAAc,GAAgB,EAAE,CAAC;AAErC,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,gBAAgB;IACxB,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,cAAc,GAAG,0BAA0B,EAAE,CAAC;IACpD,IAAI,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,mBAAmB,GAAG,sBAAsB,EAAE,CAAC;IACrD,IAAI,mBAAmB,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,WAAW;SAClB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB;IACjD,OAAO,OAAO;SACZ,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;SAClE,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB;IAC3B,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IACD,cAAc,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAuB;IACnD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,gCAAgC;YAChC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAEzC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;gBAChD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC5B,0BAA0B;oBAC1B,YAAY,GAAG,IAAI,CAAC;oBACpB,eAAe,GAAG,IAAI,CAAC;oBACvB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChC,mBAAmB,EAAE,CAAC;oBACvB,CAAC;gBACF,CAAC;qBAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBACnC,gEAAgE;oBAChE,gFAAgF;oBAChF,YAAY,GAAG,IAAI,CAAC;oBACpB,eAAe,GAAG,IAAI,CAAC;gBACxB,CAAC;YACF,CAAC,CAAC,CAAC;YACH,qDAAqD;YACrD,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,oDAAoD;YACpD,4CAA4C;QAC7C,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CACvB,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACjD,CAAC;QACF,MAAM,IAAI,KAAK,CACd,yBAAyB,GAAG,+BAA+B,CAC3D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAC3B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,qBAAqB,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,mBAAmB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAe;IACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IACf,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,SAAS,uBAAuB,CAC/B,MAAqB,EACrB,SAAiB,EACjB,QAAgB,EAChB,OAAe;IAEf,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IAC1C,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,CAChB,CAAC;IACF,MAAM,aAAa,GAAG,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,CAChB,CAAC;IACF,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,MAAM,GAAG;YACf,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAC7C,MAAM,EACN,OAAO,EACP,SAAS,EACT,iBAAiB,CACjB,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,uBAAuB,CAClD,MAAM,EACN,cAAc,EACd,SAAS,EACT,sBAAsB,CACtB,CAAC;IACF,MAAM,mBAAmB,GAAG,uBAAuB,CAClD,MAAM,EACN,cAAc,EACd,SAAS,EACT,sBAAsB,CACtB,CAAC;IACF,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,CAAC,YAAY,GAAG;YACrB,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;SACN,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAC7C,MAAM,EACN,QAAQ,EACR,UAAU,EACV,iBAAiB,CACjB,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC1E,IACC,YAAY,KAAK,SAAS;YAC1B,YAAY,KAAK,SAAS;YAC1B,cAAc,KAAK,SAAS;YAC5B,eAAe,KAAK,SAAS,EAC5B,CAAC;YACF,MAAM,CAAC,OAAO,GAAG;gBAChB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,mBAAmB,GAAG,kBAAkB,CAC7C,MAAM,EACN,wBAAwB,CACxB,CAAC;IACF,MAAM,yBAAyB,GAAG,kBAAkB,CACnD,MAAM,EACN,8BAA8B,CAC9B,CAAC;IACF,MAAM,qBAAqB,GAAG,kBAAkB,CAC/C,MAAM,EACN,yBAAyB,CACzB,CAAC;IACF,IACC,mBAAmB,KAAK,SAAS;QACjC,yBAAyB,KAAK,SAAS;QACvC,qBAAqB,KAAK,SAAS,EAClC,CAAC;QACF,MAAM,CAAC,MAAM,GAAG;YACf,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,yBAAyB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CACnB,IAA0B,EAC1B,KAA2B;IAE3B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CACzB,IAAwB,EACxB,KAAyB;IAEzB,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,CAClC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,CAC5D,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,IAAI,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,yBAAyB,CACjC,UAAkE,EAClE,eAAuE;IAEvE,MAAM,OAAO,GAAG,eAAe,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,CAAC;IAChE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO;QACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAC1B,UAAuC,EACvC,eAA4C;IAE5C,MAAM,YAAY,GACjB,eAAe,EAAE,YAAY,IAAI,UAAU,EAAE,YAAY,CAAC;IAC3D,MAAM,YAAY,GAAG,WAAW,CAC/B,UAAU,EAAE,YAAY,EACxB,eAAe,EAAE,YAAY,CAC7B,CAAC;IACF,MAAM,cAAc,GACnB,UAAU,EAAE,cAAc,KAAK,IAAI;QACnC,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;IAC1C,MAAM,eAAe,GACpB,UAAU,EAAE,eAAe,KAAK,IAAI;QACpC,eAAe,EAAE,eAAe,KAAK,IAAI,CAAC;IAE3C,IACC,YAAY,KAAK,SAAS;QAC1B,YAAY,KAAK,SAAS;QAC1B,CAAC,cAAc;QACf,CAAC,eAAe,EACf,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACzB,UAAsC,EACtC,eAA2C;IAE3C,MAAM,mBAAmB,GAAG,iBAAiB,CAC5C,UAAU,EAAE,mBAAmB,EAC/B,eAAe,EAAE,mBAAmB,CACpC,CAAC;IACF,MAAM,yBAAyB,GAAG,iBAAiB,CAClD,UAAU,EAAE,yBAAyB,EACrC,eAAe,EAAE,yBAAyB,CAC1C,CAAC;IACF,MAAM,qBAAqB,GAAG,iBAAiB,CAC9C,UAAU,EAAE,qBAAqB,EACjC,eAAe,EAAE,qBAAqB,CACtC,CAAC;IAEF,IACC,mBAAmB,KAAK,SAAS;QACjC,yBAAyB,KAAK,SAAS;QACvC,qBAAqB,KAAK,SAAS,EAClC,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,yBAAyB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE;YAC/B,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,UAAmC,EACnC,eAAwC;IAExC,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC;IACxC,IAAI,CAAC,eAAe;QAAE,OAAO,UAAU,CAAC;IAExC,MAAM,MAAM,GAAqB;QAChC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK;YAC5C,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;IAEF,MAAM,KAAK,GAAG,yBAAyB,CACtC,UAAU,CAAC,KAAK,EAChB,eAAe,CAAC,KAAK,CACrB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAEhC,MAAM,YAAY,GAAG,yBAAyB,CAC7C,UAAU,CAAC,YAAY,EACvB,eAAe,CAAC,YAAY,CAC5B,CAAC;IACF,IAAI,YAAY;QAAE,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAErD,MAAM,MAAM,GAAG,yBAAyB,CACvC,UAAU,CAAC,MAAM,EACjB,eAAe,CAAC,MAAM,CACtB,CAAC;IACF,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,MAAM,KAAK,GAAG,yBAAyB,CACtC,UAAU,CAAC,KAAK,EAChB,eAAe,CAAC,KAAK,CACrB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG,WAAW,CACjC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAC3B,eAAe,CAAC,MAAM,EAAE,QAAQ,CAChC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CACjC,UAAU,CAAC,OAAO,EAClB,eAAe,CAAC,OAAO,CACvB,CAAC;IACF,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAEtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAwB,EAAE,UAAkB;IACzE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACd,qBAAqB,UAAU,KAAK,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAoB;IAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAmB,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACd,uBAAuB,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC7D,CAAC;QACH,CAAC;QACD,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,oBAAoB,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAK,GAAG,KAAK;IACvC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,mEAAmE;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,YAAY,GAAG,IAAI,CAAC;QACpB,eAAe,GAAG,IAAI,CAAC;QACvB,kBAAkB,GAAG,EAAE,CAAC;QACxB,mBAAmB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,YAAY,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7D,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YACnC,mBAAmB,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,UAAU,GAA4B,IAAI,CAAC;QAC/C,IAAI,eAAe,GAA4B,IAAI,CAAC;QAEpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC7B,UAAU,GAAG,YAAY,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACP,eAAe,GAAG,YAAY,CAAC;YAChC,CAAC;QACF,CAAC;QAED,YAAY,GAAG,aAAa,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC1D,kBAAkB,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,MAAM,CACxD,CAAC,MAAM,EAA8B,EAAE,CAAC,MAAM,KAAK,IAAI,CACvD,CAAC;QACF,eAAe,GAAG,SAAS,CAAC;QAC5B,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,YAAY,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACX,4CAA4C,EAC5C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;QACF,kFAAkF;QAClF,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CACrB,OAA8B;IAE9B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,OAAO,CAAC,IAAgC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACpB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,OAA8B;IACpD,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAChC,MAAwB;IAExB,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAgB;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAwB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC1D,OAAO,CACN,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CACzE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC7B,MAAwB,EACxB,OAA8B;IAE9B,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gEAAgE;SACxE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4DAA4D;SACpE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,8EAA8E;aAC/E,CAAC;QACH,CAAC;IACF,CAAC;IAED,IACC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9B,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EACrC,CAAC;QACF,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EACL,+EAA+E;SAChF,CAAC;IACH,CAAC;IAED,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;QAC7C,IAAI,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC3E,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,yEAAyE;aAC1E,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA8B;IAI/D,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,mBAAmB;SAC/G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAwB,EACxB,OAA8B;IAK9B,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjE,IAAI,iBAAiB,EAAE,CAAC;QACvB,OAAO,iBAAiB,CAAC;IAC1B,CAAC;IAED,gCAAgC;IAChC,IACC,MAAM,CAAC,KAAK;QACZ,OAAO,CAAC,IAAI,EAAE,KAAK;QACnB,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,EAClC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC3C,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;SAC7B,CAAC,CAAC;QACH,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,qDAAqD,MAAM,CAAC,KAAK,8BAA8B,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG;SAC5H,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,sCAAsC;aACvE,CAAC;QACH,CAAC;QACD,IAAI,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,+CAA+C;aAChF,CAAC;QACH,CAAC;IACF,CAAC;IAED,iDAAiD;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACb,+CAA+C;YAC/C,MAAM,mBAAmB,GAAG;gBAC3B,sBAAsB,CAAC,YAAY;gBACnC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,OAAO;gBAC9B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;aAC/B,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,yIAAyI;qBAC1I,CAAC;gBACH,CAAC;YACF,CAAC;YAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBAE1C,iEAAiE;gBACjE,2EAA2E;gBAC3E,qDAAqD;gBACrD,MAAM,uBAAuB,GAC5B,mFAAmF,CAAC,IAAI,CACvF,OAAO,CACP,CAAC;gBACH,IACC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,CAAC;oBAC5C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1B,CAAC;oBACF,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,+GAA+G;qBAChH,CAAC;gBACH,CAAC;gBAED,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;gBAEjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACxB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvC,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,6CAA6C;yBACvE,CAAC;oBACH,CAAC;oBACD,IAAI,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5B,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,+CAA+C;yBACzE,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IAED,yBAAyB;IACzB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,YAAY,CAAC;QACrB,CAAC;IACF,CAAC;IAED,oBAAoB;IACpB,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACpD,IAAI,yBAAyB,IAAI,yBAAyB,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YAChE,IAAI,eAAe,GAAG,yBAAyB,EAAE,CAAC;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,yBAAyB,wCAAwC;iBAC5I,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACrC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC3B,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAI/C,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,kBAAkB;SAC9G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAA4B,EAC5B,KAA4D;IAK5D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEtC,uBAAuB;QACvB,IACC,MAAM,CAAC,yBAAyB;YAChC,MAAM,CAAC,yBAAyB,GAAG,CAAC,EACnC,CAAC;YACF,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YACxD,IAAI,eAAe,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACxD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,yBAAyB,wCAAwC;iBACnJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,oBAAoB;QACpB,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,KAAK,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBACnD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,iCAAiC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,mBAAmB,uCAAuC;qBAC9H,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,sDAAsD;gBACtD,gGAAgG;gBAChG,qGAAqG;gBACrG,2EAA2E;gBAC3E,4DAA4D;gBAC5D,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,kCAAkC,MAAM,CAAC,mBAAmB,mEAAmE;iBACvI,CAAC;YACH,CAAC;QACF,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,KAAK,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBAC7C,IAAI,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;oBAC7D,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,sCAAsC,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,qBAAqB,8DAA8D;qBACpK,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,iDAAiD;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uCAAuC,MAAM,CAAC,qBAAqB,qEAAqE;iBAChJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yCAAyC,KAAK,EAAE;SACxD,CAAC;IACH,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC9B,wEAAwE;IACxE,wFAAwF;IACxF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC/B,IAAI,CAAC;QACJ,OAAO,UAAU,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC","sourcesContent":["/**\n * Enterprise Policy System - Access Control and Safety Enforcement\n *\n * This module implements enterprise-grade policy enforcement for the Maestro CLI,\n * enabling organizations to control what tools, models, paths, and network hosts\n * can be accessed during agent execution.\n *\n * ## Policy File Location\n *\n * Policies are loaded from `~/.maestro/policy.json` (or the legacy `.composer`\n * policy file as a fallback) and `.maestro/workspace.toml` in the current\n * workspace. The global JSON file is typically deployed by enterprise IT and\n * should be protected with appropriate permissions. Workspace TOML applies a\n * stricter project-specific layer.\n *\n * ## Policy Structure\n *\n * ```json\n * {\n *   \"orgId\": \"org-12345\",\n *   \"tools\": {\n *     \"allowed\": [\"Read\", \"Grep\", \"Glob\"],\n *     \"blocked\": [\"Bash\", \"Write\"]\n *   },\n *   \"models\": {\n *     \"allowed\": [\"anthropic/claude-*\"],\n *     \"blocked\": [\"openai/*\"]\n *   },\n *   \"paths\": {\n *     \"allowed\": [\"/home/user/projects/**\"],\n *     \"blocked\": [\"/etc/**\", \"/root/**\"]\n *   },\n *   \"network\": {\n *     \"allowedHosts\": [\"api.github.com\"],\n *     \"blockedHosts\": [\"*.internal.corp\"],\n *     \"blockLocalhost\": true,\n *     \"blockPrivateIPs\": true\n *   },\n *   \"limits\": {\n *     \"maxTokensPerSession\": 100000,\n *     \"maxSessionDurationMinutes\": 60,\n *     \"maxConcurrentSessions\": 3\n *   }\n * }\n * ```\n *\n * Workspace policies use TOML keys such as `allowed_models`, `blocked_tools`,\n * `file_boundaries`, and `max_tokens_per_session`.\n *\n * ## Rule Evaluation\n *\n * Policies use an allow/block list pattern with the following evaluation order:\n *\n * 1. If `blocked` list exists and matches → **DENY**\n * 2. If `allowed` list exists and doesn't match → **DENY**\n * 3. Otherwise → **ALLOW**\n *\n * This means:\n * - If only `allowed` is specified, everything else is blocked\n * - If only `blocked` is specified, everything else is allowed\n * - If both are specified, blocked takes precedence\n *\n * ## Pattern Matching\n *\n * Patterns support glob syntax via the `minimatch` library:\n *\n * | Pattern             | Matches                              |\n * |---------------------|--------------------------------------|\n * | `*`                 | Any single segment                   |\n * | `**`                | Any number of segments               |\n * | `*.md`              | Any file ending in .md               |\n * | `src/** (all .ts)`  | Any .ts file under src/              |\n *\n * ## Network Safety\n *\n * Network policies can block:\n * - Specific hosts by name or pattern\n * - Localhost (127.0.0.1, ::1)\n * - Private IP ranges (10.x, 172.16-31.x, 192.168.x)\n *\n * DNS resolution is performed to validate hosts before connection.\n *\n * ## Hot Reloading\n *\n * The policy file is watched for changes and automatically reloaded.\n * This enables policy updates without restarting active sessions.\n *\n * ## Error Handling\n *\n * Policy violations throw `PolicyError` which includes:\n * - The violated rule type (tool, model, path, network)\n * - A user-friendly error message\n * - Context about what was blocked\n *\n * @module safety/policy\n */\n\nimport {\n\ttype FSWatcher,\n\texistsSync,\n\tlstatSync,\n\treadFileSync,\n\twatch,\n} from \"node:fs\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { Type } from \"@sinclair/typebox\";\nimport { parse as parseTOML } from \"smol-toml\";\nimport type { ActionApprovalContext } from \"../agent/action-approval.js\";\nimport { PATHS } from \"../config/constants.js\";\nimport { extractDependencies } from \"../utils/dependency-extractor.js\";\nimport { safeJsonParse } from \"../utils/json.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { getHomeDir, resolveEnvPath } from \"../utils/path-expansion.js\";\nimport { expandHomeDir, resolveRealPath } from \"../utils/path-matcher.js\";\nimport { uniquePaths } from \"../utils/path-utils.js\";\nimport { compileTypeboxSchema } from \"../utils/typebox-ajv.js\";\nimport { dangerousPatterns as shellDangerousPatterns } from \"./bash-safety-analyzer.js\";\nimport { checkModelAccess } from \"./validators/model-policy-validator.js\";\nimport { checkNetworkPolicy } from \"./validators/network-policy-validator.js\";\nimport {\n\tcheckPathPolicy,\n\textractPolicyFilePaths,\n} from \"./validators/path-policy-validator.js\";\n\nconst logger = createLogger(\"safety:policy\");\n\n/**\n * Enterprise policy configuration interface.\n *\n * Defines all available policy controls that organizations can configure\n * to restrict agent behavior according to their security requirements.\n */\nexport interface EnterprisePolicy {\n\t/** Organization identifier for audit logging and policy association */\n\torgId?: string;\n\n\t/** Tool execution restrictions (e.g., block Bash, allow only Read) */\n\ttools?: {\n\t\t/** Whitelist of allowed tool names (glob patterns supported) */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked tool names (takes precedence over allowed) */\n\t\tblocked?: string[];\n\t};\n\n\t/** Package/dependency installation restrictions */\n\tdependencies?: {\n\t\t/** Whitelist of allowed package patterns */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked package patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Model access restrictions (format: \"provider/model-id\") */\n\tmodels?: {\n\t\t/** Whitelist of allowed model patterns (e.g., \"anthropic/*\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked model patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Required skill names for workspace-controlled workflows */\n\tskills?: {\n\t\t/** Skills that must be available for this workspace */\n\t\trequired?: string[];\n\t};\n\n\t/** File system path restrictions */\n\tpaths?: {\n\t\t/** Whitelist of allowed path patterns (e.g., \"/home/user/projects/**\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked path patterns (e.g., \"/etc/**\") */\n\t\tblocked?: string[];\n\t};\n\n\t/** Network access restrictions */\n\tnetwork?: {\n\t\t/** Whitelist of allowed hostnames (e.g., \"api.github.com\") */\n\t\tallowedHosts?: string[];\n\t\t/** Blacklist of blocked hostnames (e.g., \"*.internal.corp\") */\n\t\tblockedHosts?: string[];\n\t\t/** Block access to localhost (127.0.0.1, ::1) */\n\t\tblockLocalhost?: boolean;\n\t\t/** Block access to private IP ranges (10.x, 172.16-31.x, 192.168.x) */\n\t\tblockPrivateIPs?: boolean;\n\t};\n\n\t/**\n\t * Session limits for resource control.\n\t *\n\t * NOTE: These are schema definitions for policy configuration.\n\t * Actual enforcement requires integration with the billing/token-tracker system.\n\t * Currently exposed via getPolicyLimits() for consumers that want to implement limits.\n\t */\n\tlimits?: {\n\t\t/** Maximum tokens per session before termination */\n\t\tmaxTokensPerSession?: number;\n\t\t/** Maximum session duration in minutes */\n\t\tmaxSessionDurationMinutes?: number;\n\t\t/** Maximum concurrent active sessions */\n\t\tmaxConcurrentSessions?: number;\n\t};\n}\n\nconst PolicySchema = Type.Object({\n\torgId: Type.Optional(Type.String()),\n\ttools: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tdependencies: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tmodels: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tskills: Type.Optional(\n\t\tType.Object({\n\t\t\trequired: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tpaths: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tnetwork: Type.Optional(\n\t\tType.Object({\n\t\t\tallowedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockLocalhost: Type.Optional(Type.Boolean()),\n\t\t\tblockPrivateIPs: Type.Optional(Type.Boolean()),\n\t\t}),\n\t),\n\tlimits: Type.Optional(\n\t\tType.Object({\n\t\t\tmaxTokensPerSession: Type.Optional(Type.Number()),\n\t\t\tmaxSessionDurationMinutes: Type.Optional(Type.Number()),\n\t\t\tmaxConcurrentSessions: Type.Optional(Type.Number()),\n\t\t}),\n\t),\n});\n\nconst validatePolicy = compileTypeboxSchema(PolicySchema);\n\ntype PolicyFormat = \"json\" | \"toml\";\ntype PolicyScope = \"user\" | \"workspace\";\ntype UnknownRecord = Record<string, unknown>;\n\ninterface PolicySource {\n\tpath: string;\n\tformat: PolicyFormat;\n\tscope: PolicyScope;\n}\n\nconst getUserPolicyPath = (): string => join(PATHS.MAESTRO_HOME, \"policy.json\");\nconst getLegacyUserPolicyPath = (): string =>\n\tjoin(getHomeDir(), \".composer\", \"policy.json\");\n\nfunction getUserPolicyPathCandidates(): string[] {\n\treturn uniquePaths([\n\t\tresolveEnvPath(process.env.MAESTRO_ENTERPRISE_POLICY_PATH),\n\t\tresolveEnvPath(process.env.MAESTRO_POLICY_PATH),\n\t\tgetUserPolicyPath(),\n\t\tgetLegacyUserPolicyPath(),\n\t]);\n}\n\nfunction getEffectiveUserPolicyPath(): string | null {\n\tconst candidates = getUserPolicyPathCandidates();\n\treturn candidates.find(isPolicyFile) ?? null;\n}\n\nconst isPolicyFile = (path: string): boolean => {\n\tif (!existsSync(path)) return false;\n\ttry {\n\t\treturn lstatSync(path).isFile();\n\t} catch {\n\t\treturn false;\n\t}\n};\n\nconst getWorkspacePolicyPath = (): string | null => {\n\tlet current = resolve(process.cwd());\n\twhile (true) {\n\t\tconst candidate = join(current, \".maestro\", \"workspace.toml\");\n\t\tif (isPolicyFile(candidate)) {\n\t\t\treturn candidate;\n\t\t}\n\t\tconst parent = dirname(current);\n\t\tif (parent === current) {\n\t\t\treturn null;\n\t\t}\n\t\tcurrent = parent;\n\t}\n};\n\nlet cachedPolicy: EnterprisePolicy | null = null;\nlet cachedPolicyKey: string | null = null;\nlet cachedPolicyLayers: EnterprisePolicy[] = [];\nlet policyWatchers: FSWatcher[] = [];\n\nfunction isRecord(value: unknown): value is UnknownRecord {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getPolicySources(): PolicySource[] {\n\tconst sources: PolicySource[] = [];\n\tconst userPolicyPath = getEffectiveUserPolicyPath();\n\tif (userPolicyPath) {\n\t\tsources.push({ path: userPolicyPath, format: \"json\", scope: \"user\" });\n\t}\n\n\tconst workspacePolicyPath = getWorkspacePolicyPath();\n\tif (workspacePolicyPath) {\n\t\tsources.push({\n\t\t\tpath: workspacePolicyPath,\n\t\t\tformat: \"toml\",\n\t\t\tscope: \"workspace\",\n\t\t});\n\t}\n\treturn sources;\n}\n\nfunction getPolicyCacheKey(sources: PolicySource[]): string {\n\treturn sources\n\t\t.map((source) => `${source.scope}:${source.format}:${source.path}`)\n\t\t.join(\"|\");\n}\n\nfunction closePolicyWatchers() {\n\tfor (const watcher of policyWatchers) {\n\t\twatcher.close();\n\t}\n\tpolicyWatchers = [];\n}\n\nfunction startPolicyWatchers(sources: PolicySource[]) {\n\tif (policyWatchers.length > 0) return;\n\n\tfor (const source of sources) {\n\t\ttry {\n\t\t\t// Only watch if the file exists\n\t\t\tif (!isPolicyFile(source.path)) continue;\n\n\t\t\tconst watcher = watch(source.path, (eventType) => {\n\t\t\t\tif (eventType === \"rename\") {\n\t\t\t\t\t// File deleted or renamed\n\t\t\t\t\tcachedPolicy = null;\n\t\t\t\t\tcachedPolicyKey = null;\n\t\t\t\t\tif (!isPolicyFile(source.path)) {\n\t\t\t\t\t\tclosePolicyWatchers();\n\t\t\t\t\t}\n\t\t\t\t} else if (eventType === \"change\") {\n\t\t\t\t\t// File modified - invalidate cache so next loadPolicy() reloads\n\t\t\t\t\t// We don't proactively reload here to avoid race conditions with partial writes\n\t\t\t\t\tcachedPolicy = null;\n\t\t\t\t\tcachedPolicyKey = null;\n\t\t\t\t}\n\t\t\t});\n\t\t\t// Prevent the watcher from keeping the process alive\n\t\t\twatcher.unref();\n\t\t\tpolicyWatchers.push(watcher);\n\t\t} catch (error) {\n\t\t\t// Ignore watcher errors (e.g. system limit reached)\n\t\t\t// We fall back to standard caching behavior\n\t\t}\n\t}\n}\n\nfunction readStringArray(\n\tsource: UnknownRecord,\n\tkey: string,\n): string[] | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (\n\t\t!Array.isArray(value) ||\n\t\t!value.every((entry) => typeof entry === \"string\")\n\t) {\n\t\tthrow new Error(\n\t\t\t`Workspace policy key \"${key}\" must be an array of strings`,\n\t\t);\n\t}\n\treturn value;\n}\n\nfunction readOptionalString(\n\tsource: UnknownRecord,\n\tkey: string,\n): string | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"string\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a string`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalNumber(\n\tsource: UnknownRecord,\n\tkey: string,\n): number | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"number\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a number`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalBoolean(\n\tsource: UnknownRecord,\n\tkey: string,\n): boolean | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"boolean\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a boolean`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalRecord(\n\tsource: UnknownRecord,\n\tkey: string,\n): UnknownRecord | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (!isRecord(value)) {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a table`);\n\t}\n\treturn value;\n}\n\nfunction selectWorkspacePolicyRoot(parsed: unknown): UnknownRecord {\n\tif (!isRecord(parsed)) {\n\t\tthrow new Error(\"Workspace policy must be a TOML table\");\n\t}\n\n\tconst nestedPolicy = parsed.policy;\n\tif (nestedPolicy === undefined) {\n\t\treturn parsed;\n\t}\n\tif (!isRecord(nestedPolicy)) {\n\t\tthrow new Error('Workspace policy key \"policy\" must be a table');\n\t}\n\treturn nestedPolicy;\n}\n\nfunction getWorkspaceStringArray(\n\tsource: UnknownRecord,\n\ttableName: string,\n\ttableKey: string,\n\tflatKey: string,\n): string[] | undefined {\n\tconst flatValue = readStringArray(source, flatKey);\n\tif (flatValue !== undefined) return flatValue;\n\n\tconst table = readOptionalRecord(source, tableName);\n\treturn table ? readStringArray(table, tableKey) : undefined;\n}\n\nfunction mapWorkspacePolicy(parsed: unknown): EnterprisePolicy {\n\tconst source = selectWorkspacePolicyRoot(parsed);\n\tconst policy: EnterprisePolicy = {};\n\n\tconst orgId = readOptionalString(source, \"org_id\");\n\tif (orgId !== undefined) {\n\t\tpolicy.orgId = orgId;\n\t}\n\n\tconst allowedTools = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"tools\",\n\t\t\"allowed\",\n\t\t\"allowed_tools\",\n\t);\n\tconst blockedTools = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"tools\",\n\t\t\"blocked\",\n\t\t\"blocked_tools\",\n\t);\n\tif (allowedTools !== undefined || blockedTools !== undefined) {\n\t\tpolicy.tools = {\n\t\t\t...(allowedTools !== undefined ? { allowed: allowedTools } : {}),\n\t\t\t...(blockedTools !== undefined ? { blocked: blockedTools } : {}),\n\t\t};\n\t}\n\n\tconst allowedModels = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"models\",\n\t\t\"allowed\",\n\t\t\"allowed_models\",\n\t);\n\tconst blockedModels = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"models\",\n\t\t\"blocked\",\n\t\t\"blocked_models\",\n\t);\n\tif (allowedModels !== undefined || blockedModels !== undefined) {\n\t\tpolicy.models = {\n\t\t\t...(allowedModels !== undefined ? { allowed: allowedModels } : {}),\n\t\t\t...(blockedModels !== undefined ? { blocked: blockedModels } : {}),\n\t\t};\n\t}\n\n\tconst fileBoundaries = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"paths\",\n\t\t\"allowed\",\n\t\t\"file_boundaries\",\n\t);\n\tconst blockedPaths = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"paths\",\n\t\t\"blocked\",\n\t\t\"blocked_paths\",\n\t);\n\tif (fileBoundaries !== undefined || blockedPaths !== undefined) {\n\t\tpolicy.paths = {\n\t\t\t...(fileBoundaries !== undefined ? { allowed: fileBoundaries } : {}),\n\t\t\t...(blockedPaths !== undefined ? { blocked: blockedPaths } : {}),\n\t\t};\n\t}\n\n\tconst allowedDependencies = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"dependencies\",\n\t\t\"allowed\",\n\t\t\"allowed_dependencies\",\n\t);\n\tconst blockedDependencies = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"dependencies\",\n\t\t\"blocked\",\n\t\t\"blocked_dependencies\",\n\t);\n\tif (allowedDependencies !== undefined || blockedDependencies !== undefined) {\n\t\tpolicy.dependencies = {\n\t\t\t...(allowedDependencies !== undefined\n\t\t\t\t? { allowed: allowedDependencies }\n\t\t\t\t: {}),\n\t\t\t...(blockedDependencies !== undefined\n\t\t\t\t? { blocked: blockedDependencies }\n\t\t\t\t: {}),\n\t\t};\n\t}\n\n\tconst requiredSkills = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"skills\",\n\t\t\"required\",\n\t\t\"required_skills\",\n\t);\n\tif (requiredSkills !== undefined) {\n\t\tpolicy.skills = { required: requiredSkills };\n\t}\n\n\tconst network = readOptionalRecord(source, \"network\");\n\tif (network) {\n\t\tconst allowedHosts = readStringArray(network, \"allowed_hosts\");\n\t\tconst blockedHosts = readStringArray(network, \"blocked_hosts\");\n\t\tconst blockLocalhost = readOptionalBoolean(network, \"block_localhost\");\n\t\tconst blockPrivateIPs = readOptionalBoolean(network, \"block_private_ips\");\n\t\tif (\n\t\t\tallowedHosts !== undefined ||\n\t\t\tblockedHosts !== undefined ||\n\t\t\tblockLocalhost !== undefined ||\n\t\t\tblockPrivateIPs !== undefined\n\t\t) {\n\t\t\tpolicy.network = {\n\t\t\t\t...(allowedHosts !== undefined ? { allowedHosts } : {}),\n\t\t\t\t...(blockedHosts !== undefined ? { blockedHosts } : {}),\n\t\t\t\t...(blockLocalhost !== undefined ? { blockLocalhost } : {}),\n\t\t\t\t...(blockPrivateIPs !== undefined ? { blockPrivateIPs } : {}),\n\t\t\t};\n\t\t}\n\t}\n\n\tconst maxTokensPerSession = readOptionalNumber(\n\t\tsource,\n\t\t\"max_tokens_per_session\",\n\t);\n\tconst maxSessionDurationMinutes = readOptionalNumber(\n\t\tsource,\n\t\t\"max_session_duration_minutes\",\n\t);\n\tconst maxConcurrentSessions = readOptionalNumber(\n\t\tsource,\n\t\t\"max_concurrent_sessions\",\n\t);\n\tif (\n\t\tmaxTokensPerSession !== undefined ||\n\t\tmaxSessionDurationMinutes !== undefined ||\n\t\tmaxConcurrentSessions !== undefined\n\t) {\n\t\tpolicy.limits = {\n\t\t\t...(maxTokensPerSession !== undefined ? { maxTokensPerSession } : {}),\n\t\t\t...(maxSessionDurationMinutes !== undefined\n\t\t\t\t? { maxSessionDurationMinutes }\n\t\t\t\t: {}),\n\t\t\t...(maxConcurrentSessions !== undefined ? { maxConcurrentSessions } : {}),\n\t\t};\n\t}\n\n\treturn policy;\n}\n\nfunction uniqueUnion(\n\tleft: string[] | undefined,\n\tright: string[] | undefined,\n): string[] | undefined {\n\tconst values = [...(left ?? []), ...(right ?? [])];\n\treturn values.length > 0 ? [...new Set(values)] : undefined;\n}\n\nfunction minPositiveNumber(\n\tleft: number | undefined,\n\tright: number | undefined,\n): number | undefined {\n\tconst values = [left, right].filter(\n\t\t(value): value is number => value !== undefined && value > 0,\n\t);\n\tif (values.length === 0) {\n\t\treturn left ?? right;\n\t}\n\treturn Math.min(...values);\n}\n\nfunction mergeAllowedBlockedPolicy(\n\tuserPolicy: { allowed?: string[]; blocked?: string[] } | undefined,\n\tworkspacePolicy: { allowed?: string[]; blocked?: string[] } | undefined,\n): { allowed?: string[]; blocked?: string[] } | undefined {\n\tconst allowed = workspacePolicy?.allowed ?? userPolicy?.allowed;\n\tconst blocked = uniqueUnion(userPolicy?.blocked, workspacePolicy?.blocked);\n\tif (allowed === undefined && blocked === undefined) return undefined;\n\treturn {\n\t\t...(allowed !== undefined ? { allowed } : {}),\n\t\t...(blocked !== undefined ? { blocked } : {}),\n\t};\n}\n\nfunction mergeNetworkPolicy(\n\tuserPolicy: EnterprisePolicy[\"network\"],\n\tworkspacePolicy: EnterprisePolicy[\"network\"],\n): EnterprisePolicy[\"network\"] {\n\tconst allowedHosts =\n\t\tworkspacePolicy?.allowedHosts ?? userPolicy?.allowedHosts;\n\tconst blockedHosts = uniqueUnion(\n\t\tuserPolicy?.blockedHosts,\n\t\tworkspacePolicy?.blockedHosts,\n\t);\n\tconst blockLocalhost =\n\t\tuserPolicy?.blockLocalhost === true ||\n\t\tworkspacePolicy?.blockLocalhost === true;\n\tconst blockPrivateIPs =\n\t\tuserPolicy?.blockPrivateIPs === true ||\n\t\tworkspacePolicy?.blockPrivateIPs === true;\n\n\tif (\n\t\tallowedHosts === undefined &&\n\t\tblockedHosts === undefined &&\n\t\t!blockLocalhost &&\n\t\t!blockPrivateIPs\n\t) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\t...(allowedHosts !== undefined ? { allowedHosts } : {}),\n\t\t...(blockedHosts !== undefined ? { blockedHosts } : {}),\n\t\t...(blockLocalhost ? { blockLocalhost } : {}),\n\t\t...(blockPrivateIPs ? { blockPrivateIPs } : {}),\n\t};\n}\n\nfunction mergePolicyLimits(\n\tuserPolicy: EnterprisePolicy[\"limits\"],\n\tworkspacePolicy: EnterprisePolicy[\"limits\"],\n): EnterprisePolicy[\"limits\"] {\n\tconst maxTokensPerSession = minPositiveNumber(\n\t\tuserPolicy?.maxTokensPerSession,\n\t\tworkspacePolicy?.maxTokensPerSession,\n\t);\n\tconst maxSessionDurationMinutes = minPositiveNumber(\n\t\tuserPolicy?.maxSessionDurationMinutes,\n\t\tworkspacePolicy?.maxSessionDurationMinutes,\n\t);\n\tconst maxConcurrentSessions = minPositiveNumber(\n\t\tuserPolicy?.maxConcurrentSessions,\n\t\tworkspacePolicy?.maxConcurrentSessions,\n\t);\n\n\tif (\n\t\tmaxTokensPerSession === undefined &&\n\t\tmaxSessionDurationMinutes === undefined &&\n\t\tmaxConcurrentSessions === undefined\n\t) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\t...(maxTokensPerSession !== undefined ? { maxTokensPerSession } : {}),\n\t\t...(maxSessionDurationMinutes !== undefined\n\t\t\t? { maxSessionDurationMinutes }\n\t\t\t: {}),\n\t\t...(maxConcurrentSessions !== undefined ? { maxConcurrentSessions } : {}),\n\t};\n}\n\nfunction mergePolicies(\n\tuserPolicy: EnterprisePolicy | null,\n\tworkspacePolicy: EnterprisePolicy | null,\n): EnterprisePolicy | null {\n\tif (!userPolicy) return workspacePolicy;\n\tif (!workspacePolicy) return userPolicy;\n\n\tconst policy: EnterprisePolicy = {\n\t\t...(userPolicy.orgId || workspacePolicy.orgId\n\t\t\t? { orgId: workspacePolicy.orgId ?? userPolicy.orgId }\n\t\t\t: {}),\n\t};\n\n\tconst tools = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.tools,\n\t\tworkspacePolicy.tools,\n\t);\n\tif (tools) policy.tools = tools;\n\n\tconst dependencies = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.dependencies,\n\t\tworkspacePolicy.dependencies,\n\t);\n\tif (dependencies) policy.dependencies = dependencies;\n\n\tconst models = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.models,\n\t\tworkspacePolicy.models,\n\t);\n\tif (models) policy.models = models;\n\n\tconst paths = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.paths,\n\t\tworkspacePolicy.paths,\n\t);\n\tif (paths) policy.paths = paths;\n\n\tconst requiredSkills = uniqueUnion(\n\t\tuserPolicy.skills?.required,\n\t\tworkspacePolicy.skills?.required,\n\t);\n\tif (requiredSkills) {\n\t\tpolicy.skills = { required: requiredSkills };\n\t}\n\n\tconst network = mergeNetworkPolicy(\n\t\tuserPolicy.network,\n\t\tworkspacePolicy.network,\n\t);\n\tif (network) policy.network = network;\n\n\tconst limits = mergePolicyLimits(userPolicy.limits, workspacePolicy.limits);\n\tif (limits) policy.limits = limits;\n\n\treturn policy;\n}\n\nfunction validateLoadedPolicy(policy: EnterprisePolicy, sourcePath: string) {\n\tif (!validatePolicy(policy)) {\n\t\tthrow new Error(\n\t\t\t`Invalid schema in ${sourcePath}: ${validatePolicy.errors?.map((e) => e.message).join(\", \")}`,\n\t\t);\n\t}\n}\n\nfunction loadPolicySource(source: PolicySource): EnterprisePolicy {\n\tconst raw = readFileSync(source.path, \"utf8\");\n\tif (source.format === \"json\") {\n\t\tconst result = safeJsonParse<EnterprisePolicy>(raw);\n\t\tif (!result.success) {\n\t\t\tthrow new Error(\n\t\t\t\t`JSON parse error in ${source.path}: ${result.error.message}`,\n\t\t\t);\n\t\t}\n\t\tvalidateLoadedPolicy(result.data, source.path);\n\t\treturn result.data;\n\t}\n\n\tconst workspacePolicy = mapWorkspacePolicy(parseTOML(raw));\n\tvalidateLoadedPolicy(workspacePolicy, source.path);\n\treturn workspacePolicy;\n}\n\nexport function loadPolicy(force = false): EnterprisePolicy | null {\n\tconst sources = getPolicySources();\n\t// Check if file exists first - if not, clear cache and return null\n\tif (sources.length === 0) {\n\t\tcachedPolicy = null;\n\t\tcachedPolicyKey = null;\n\t\tcachedPolicyLayers = [];\n\t\tclosePolicyWatchers();\n\t\treturn null;\n\t}\n\n\tconst policyKey = getPolicyCacheKey(sources);\n\tif (cachedPolicy && cachedPolicyKey === policyKey && !force) {\n\t\treturn cachedPolicy;\n\t}\n\n\ttry {\n\t\tif (cachedPolicyKey !== policyKey) {\n\t\t\tclosePolicyWatchers();\n\t\t}\n\n\t\tlet userPolicy: EnterprisePolicy | null = null;\n\t\tlet workspacePolicy: EnterprisePolicy | null = null;\n\n\t\tfor (const source of sources) {\n\t\t\tconst loadedPolicy = loadPolicySource(source);\n\t\t\tif (source.scope === \"user\") {\n\t\t\t\tuserPolicy = loadedPolicy;\n\t\t\t} else {\n\t\t\t\tworkspacePolicy = loadedPolicy;\n\t\t\t}\n\t\t}\n\n\t\tcachedPolicy = mergePolicies(userPolicy, workspacePolicy);\n\t\tcachedPolicyLayers = [userPolicy, workspacePolicy].filter(\n\t\t\t(policy): policy is EnterprisePolicy => policy !== null,\n\t\t);\n\t\tcachedPolicyKey = policyKey;\n\t\tstartPolicyWatchers(sources);\n\t\treturn cachedPolicy;\n\t} catch (error) {\n\t\tlogger.error(\n\t\t\t\"Critical: Failed to load enterprise policy\",\n\t\t\terror instanceof Error ? error : new Error(String(error)),\n\t\t);\n\t\t// Throw to ensure we fail closed (block access) rather than treating as no policy\n\t\tthrow error;\n\t}\n}\n\nfunction getArgsObject(\n\tcontext: ActionApprovalContext,\n): Record<string, unknown> | null {\n\treturn context.args && typeof context.args === \"object\"\n\t\t? (context.args as Record<string, unknown>)\n\t\t: null;\n}\n\nfunction getStringArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): string | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"string\" ? value : null;\n}\n\nfunction getCommandArg(context: ActionApprovalContext): string | null {\n\treturn getStringArg(context, \"command\");\n}\n\nfunction getEffectivePolicyLayers(\n\tpolicy: EnterprisePolicy,\n): EnterprisePolicy[] {\n\treturn cachedPolicyLayers.length > 0 ? cachedPolicyLayers : [policy];\n}\n\nfunction hasOwnKey(value: object, key: PropertyKey): boolean {\n\treturn Object.prototype.hasOwnProperty.call(value, key);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n\treturn typeof value === \"string\" && value.trim().length > 0;\n}\n\nfunction hasActiveDurationLimit(policy: EnterprisePolicy): boolean {\n\tconst duration = policy.limits?.maxSessionDurationMinutes;\n\treturn (\n\t\ttypeof duration === \"number\" && Number.isFinite(duration) && duration > 0\n\t);\n}\n\nfunction validatePolicyContext(\n\tpolicy: EnterprisePolicy,\n\tcontext: ActionApprovalContext,\n): { allowed: false; reason: string } | null {\n\tif (!isNonEmptyString(context.toolName)) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Policy evaluation context is missing required field: toolName.\",\n\t\t};\n\t}\n\n\tif (!hasOwnKey(context, \"args\")) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Policy evaluation context is missing required field: args.\",\n\t\t};\n\t}\n\n\tif (context.user) {\n\t\tif (!isNonEmptyString(context.user.orgId)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Policy evaluation context has invalid user context: missing organization id.\",\n\t\t\t};\n\t\t}\n\t}\n\n\tif (\n\t\tisNonEmptyString(policy.orgId) &&\n\t\t!isNonEmptyString(context.user?.orgId)\n\t) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason:\n\t\t\t\t\"Organization-bound policy requires user organization context. Access blocked.\",\n\t\t};\n\t}\n\n\tif (hasActiveDurationLimit(policy)) {\n\t\tconst startedAt = context.session?.startedAt;\n\t\tif (!(startedAt instanceof Date) || !Number.isFinite(startedAt.getTime())) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Session duration policy requires session start context. Access blocked.\",\n\t\t\t};\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport async function checkPolicy(context: ActionApprovalContext): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Access blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\tfor (const policyLayer of getEffectivePolicyLayers(policy)) {\n\t\tconst result = await checkPolicyLayer(policyLayer, context);\n\t\tif (!result.allowed) {\n\t\t\treturn result;\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nasync function checkPolicyLayer(\n\tpolicy: EnterprisePolicy,\n\tcontext: ActionApprovalContext,\n): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tconst contextValidation = validatePolicyContext(policy, context);\n\tif (contextValidation) {\n\t\treturn contextValidation;\n\t}\n\n\t// 0. Organization Context Check\n\tif (\n\t\tpolicy.orgId &&\n\t\tcontext.user?.orgId &&\n\t\tpolicy.orgId !== context.user.orgId\n\t) {\n\t\tlogger.warn(\"Org mismatch, action blocked\", {\n\t\t\tpolicyOrgId: policy.orgId,\n\t\t\tuserOrgId: context.user.orgId,\n\t\t});\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Organization mismatch: This machine is managed by ${policy.orgId}, but you are signed in to ${context.user.orgId}.`,\n\t\t};\n\t}\n\n\t// 1. Tool Constraints\n\tif (policy.tools) {\n\t\tconst { allowed, blocked } = policy.tools;\n\t\tif (allowed && !allowed.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is not in the approved tools list.`,\n\t\t\t};\n\t\t}\n\t\tif (blocked?.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is explicitly blocked by enterprise policy.`,\n\t\t\t};\n\t\t}\n\t}\n\n\t// 2. Dangerous Patterns & Dependency Constraints\n\tif (context.toolName === \"bash\" || context.toolName === \"background_tasks\") {\n\t\tconst command = getCommandArg(context);\n\t\tif (command) {\n\t\t\t// Check for obfuscation and dangerous patterns\n\t\t\tconst obfuscationPatterns = [\n\t\t\t\tshellDangerousPatterns.base64Decode,\n\t\t\t\tshellDangerousPatterns.opensslEnc,\n\t\t\t\tshellDangerousPatterns.pythonEval,\n\t\t\t\tshellDangerousPatterns.perlEval,\n\t\t\t\tshellDangerousPatterns.nodeEval,\n\t\t\t\tshellDangerousPatterns.phpEval,\n\t\t\t\tshellDangerousPatterns.rubyEval,\n\t\t\t\tshellDangerousPatterns.evalCall,\n\t\t\t\tshellDangerousPatterns.execCall,\n\t\t\t];\n\t\t\tfor (const pattern of obfuscationPatterns) {\n\t\t\t\tif (pattern.test(command)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains obfuscated or dangerous patterns (e.g. base64 decoding, inline code execution) which are blocked by enterprise policy.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (policy.dependencies) {\n\t\t\t\tconst deps = extractDependencies(command);\n\n\t\t\t\t// Check for shell metacharacters in any package install command,\n\t\t\t\t// even when no explicit package names are extracted (e.g., \"npm install\").\n\t\t\t\t// This prevents bypass via \"npm install && rm -rf /\"\n\t\t\t\tconst isPackageInstallCommand =\n\t\t\t\t\t/(?:npm|yarn|pnpm|bun|pip|pip3|gem|cargo|go\\s+get|composer)\\s+(?:install|add|i\\b)/i.test(\n\t\t\t\t\t\tcommand,\n\t\t\t\t\t);\n\t\t\t\tif (\n\t\t\t\t\t(deps.length > 0 || isPackageInstallCommand) &&\n\t\t\t\t\t/[;&|`$()<>]/.test(command)\n\t\t\t\t) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains shell metacharacters which are not allowed by enterprise policy during package installation.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\tconst { allowed, blocked } = policy.dependencies;\n\n\t\t\t\tfor (const dep of deps) {\n\t\t\t\t\tif (allowed && !allowed.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is not in the approved dependencies list.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t\tif (blocked?.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is explicitly blocked by enterprise policy.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\t// 3. Path Constraints\n\tif (policy.paths) {\n\t\tconst filePaths = extractPolicyFilePaths(context);\n\t\tconst pathCheck = checkPathPolicy(filePaths, policy.paths);\n\t\tif (!pathCheck.allowed) {\n\t\t\treturn pathCheck;\n\t\t}\n\t}\n\n\t// 4. Network Constraints\n\tif (policy.network) {\n\t\tconst networkCheck = await checkNetworkPolicy(context, policy.network);\n\t\tif (!networkCheck.allowed) {\n\t\t\treturn networkCheck;\n\t\t}\n\t}\n\n\t// 5. Session Limits\n\tif (policy.limits && context.session) {\n\t\tconst { maxSessionDurationMinutes } = policy.limits;\n\t\tif (maxSessionDurationMinutes && maxSessionDurationMinutes > 0) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - context.session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nexport class PolicyError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"PolicyError\";\n\t}\n}\n\n/**\n * Check if a model is allowed by policy\n * Called separately from tool checks since model selection happens at a different time\n */\nexport function checkModelPolicy(modelId: string): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Model blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\tfor (const policyLayer of getEffectivePolicyLayers(policy)) {\n\t\tif (!policyLayer.models) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst result = checkModelAccess(modelId, policyLayer.models);\n\t\tif (!result.allowed) {\n\t\t\treturn result;\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\n/**\n * Check if the current session has exceeded policy limits\n */\nexport function checkSessionLimits(\n\tsession: { startedAt: Date },\n\tusage?: { tokenCount?: number; activeSessionCount?: number },\n): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\ttry {\n\t\tconst limits = getPolicyLimits();\n\t\tif (!limits) return { allowed: true };\n\n\t\t// Check duration limit\n\t\tif (\n\t\t\tlimits.maxSessionDurationMinutes &&\n\t\t\tlimits.maxSessionDurationMinutes > 0\n\t\t) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > limits.maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${limits.maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check token limit\n\t\tif (limits.maxTokensPerSession && limits.maxTokensPerSession > 0) {\n\t\t\tif (usage?.tokenCount !== undefined) {\n\t\t\t\tif (usage.tokenCount > limits.maxTokensPerSession) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Session token limit exceeded (${usage.tokenCount}/${limits.maxTokensPerSession} tokens). Please start a new session.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Usage undefined but limit is set - should we block?\n\t\t\t\t// To be safe (fail-closed) for strict limits, we probably should if we can't verify compliance.\n\t\t\t\t// However, if usage is undefined because metrics are disabled/failing, this might be too aggressive.\n\t\t\t\t// Given user feedback \"Fail-Open Error Handling\", we should warn or block.\n\t\t\t\t// Let's block if we can't verify usage against a set limit.\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session token limit is active (${limits.maxTokensPerSession}) but token usage data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check concurrent sessions limit\n\t\tif (limits.maxConcurrentSessions && limits.maxConcurrentSessions > 0) {\n\t\t\tif (usage?.activeSessionCount !== undefined) {\n\t\t\t\tif (usage.activeSessionCount > limits.maxConcurrentSessions) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Concurrent session limit exceeded (${usage.activeSessionCount}/${limits.maxConcurrentSessions}). Please close existing sessions before starting a new one.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Same fail-closed logic for concurrent sessions\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Concurrent session limit is active (${limits.maxConcurrentSessions}) but session count data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn { allowed: true };\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Policy error checking session limits: ${error}`,\n\t\t};\n\t}\n}\n\n/**\n * Get the current policy limits\n */\nexport function getPolicyLimits(): EnterprisePolicy[\"limits\"] | null {\n\t// Catch errors and return null (no limits) to prevent crashing callers.\n\t// Strict enforcement should rely on checkSessionLimits() which handles its own loading.\n\ttry {\n\t\tconst policy = loadPolicy();\n\t\treturn policy?.limits ?? null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Get the full loaded policy (for admin UI display)\n */\nexport function getCurrentPolicy(): EnterprisePolicy | null {\n\ttry {\n\t\treturn loadPolicy();\n\t} catch {\n\t\treturn null;\n\t}\n}\n"]}

package/dist/safety/validators/network-policy-validator.d.ts

@@ -1,5 +1,12 @@
 import type { ActionApprovalContext } from "../../agent/action-approval.js";
 import type { EnterprisePolicy } from "../policy.js";
+export interface NetworkRestrictionCheck {
+    allowed: boolean;
+    reason?: string;
+    host?: string;
+    normalizedHost?: string;
+    resolvedIPs: string[];
+}
 /**
  * Extract URLs from tool arguments (recursively checks nested objects)
  * Also extracts URLs from curl/wget commands in bash.
@@ -8,6 +15,7 @@ export declare function extractPolicyUrls(context: ActionApprovalContext): strin
 /**
  * Check if a URL/host matches network restrictions.
  */
+export declare function checkNetworkRestrictionsDetailed(url: string, network: NonNullable<EnterprisePolicy["network"]>): Promise<NetworkRestrictionCheck>;
 export declare function checkNetworkRestrictions(url: string, network: NonNullable<EnterprisePolicy["network"]>): Promise<{
     allowed: boolean;
     reason?: string;

package/dist/safety/validators/network-policy-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-policy-validator.d.ts","sourceRoot":"","sources":["../../../src/safety/validators/network-policy-validator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAY5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAsBrD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAc1E;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC7C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,GAC/C,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqFhD;AAED,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,GAC/C,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAShD"}
+{"version":3,"file":"network-policy-validator.d.ts","sourceRoot":"","sources":["../../../src/safety/validators/network-policy-validator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAY5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;CACtB;AAsBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAc1E;AAED;;GAEG;AACH,wBAAsB,gCAAgC,CACrD,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,GAC/C,OAAO,CAAC,uBAAuB,CAAC,CAwGlC;AAED,wBAAsB,wBAAwB,CAC7C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,GAC/C,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAKhD;AAED,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,GAC/C,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAShD"}

package/dist/safety/validators/network-policy-validator.js

@@ -34,7 +34,7 @@ export function extractPolicyUrls(context) {
 /**
  * Check if a URL/host matches network restrictions.
  */
-export async function checkNetworkRestrictions(url, network) {
+export async function checkNetworkRestrictionsDetailed(url, network) {
     try {
         const parsed = new URL(url);
         const host = parsed.hostname.toLowerCase();
@@ -45,14 +45,17 @@ export async function checkNetworkRestrictions(url, network) {
             normalizedHost.includes(":");
         if (!isIP) {
             try {
-                const { address } = await lookup(normalizedHost);
-                resolvedIPs.push(address);
+                const addresses = await lookup(normalizedHost, { all: true });
+                resolvedIPs.push(...addresses.map(({ address }) => address));
             }
             catch {
                 if (network.blockPrivateIPs || network.blockLocalhost) {
                     return {
                         allowed: false,
                         reason: `DNS resolution failed for "${host}" and network policy requires IP validation (blockPrivateIPs/blockLocalhost enabled). Access blocked.`,
+                        host,
+                        normalizedHost,
+                        resolvedIPs,
                     };
                 }
             }
@@ -65,6 +68,9 @@ export async function checkNetworkRestrictions(url, network) {
                 return {
                     allowed: false,
                     reason: "Access to localhost is blocked by enterprise policy.",
+                    host,
+                    normalizedHost,
+                    resolvedIPs,
                 };
             }
         }
@@ -73,6 +79,9 @@ export async function checkNetworkRestrictions(url, network) {
                 return {
                     allowed: false,
                     reason: "Access to private IP addresses is blocked by enterprise policy.",
+                    host,
+                    normalizedHost,
+                    resolvedIPs,
                 };
             }
         }
@@ -83,6 +92,9 @@ export async function checkNetworkRestrictions(url, network) {
                     return {
                         allowed: false,
                         reason: `Host "${host}" is blocked by enterprise policy.`,
+                        host,
+                        normalizedHost,
+                        resolvedIPs,
                     };
                 }
             }
@@ -92,6 +104,9 @@ export async function checkNetworkRestrictions(url, network) {
                 return {
                     allowed: false,
                     reason: `Host "${host}" is not in the allowed hosts list.`,
+                    host,
+                    normalizedHost,
+                    resolvedIPs,
                 };
             }
             const isAllowed = network.allowedHosts.some((allowedHost) => {
@@ -102,17 +117,27 @@ export async function checkNetworkRestrictions(url, network) {
                 return {
                     allowed: false,
                     reason: `Host "${host}" is not in the allowed hosts list.`,
+                    host,
+                    normalizedHost,
+                    resolvedIPs,
                 };
             }
         }
+        return { allowed: true, host, normalizedHost, resolvedIPs };
     }
     catch {
         return {
             allowed: false,
             reason: "Invalid URL format - cannot validate against network policy.",
+            resolvedIPs: [],
         };
     }
-    return { allowed: true };
+}
+export async function checkNetworkRestrictions(url, network) {
+    const check = await checkNetworkRestrictionsDetailed(url, network);
+    return check.reason
+        ? { allowed: check.allowed, reason: check.reason }
+        : { allowed: check.allowed };
 }
 export async function checkNetworkPolicy(context, network) {
     const urls = extractPolicyUrls(context);

package/dist/safety/validators/network-policy-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"network-policy-validator.js","sourceRoot":"","sources":["../../../src/safety/validators/network-policy-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,SAAS,EACT,kBAAkB,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,2BAA2B,EAC3B,oBAAoB,GACpB,MAAM,8BAA8B,CAAC;AAGtC,SAAS,aAAa,CACrB,OAA8B;IAE9B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,OAAO,CAAC,IAAgC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACpB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC/D,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAExC,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACjD,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,GAAW,EACX,OAAiD;IAEjD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE3C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAEpD,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GACT,SAAS,CAAC,cAAc,CAAC,KAAK,IAAI;YAClC,kBAAkB,CAAC,cAAc,CAAC,KAAK,IAAI;YAC3C,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,CAAC;gBACJ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;gBACjD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACR,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;oBACvD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,8BAA8B,IAAI,uGAAuG;qBACjJ,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;aAAM,CAAC;YACP,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,IAAI,gBAAgB,CAAC,cAAc,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxE,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,sDAAsD;iBAC9D,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EACL,iEAAiE;iBAClE,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;YAClC,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBAChD,MAAM,YAAY,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;gBAC/C,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,EAAE,CAAC;oBAChE,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,SAAS,IAAI,oCAAoC;qBACzD,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,SAAS,IAAI,qCAAqC;iBAC1D,CAAC;YACH,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;gBAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;gBAC/C,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,SAAS,IAAI,qCAAqC;iBAC1D,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,8DAA8D;SACtE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,OAA8B,EAC9B,OAAiD;IAEjD,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC","sourcesContent":["import { lookup } from \"node:dns/promises\";\nimport type { ActionApprovalContext } from \"../../agent/action-approval.js\";\nimport {\n\tisLocalhostAlias,\n\tisLoopbackIP,\n\tisPrivateIP,\n\tparseIPv4,\n\tparseIPv4MappedHex,\n} from \"../../utils/ip-address-parser.js\";\nimport {\n\textractUrlsFromShellCommand,\n\textractUrlsFromValue,\n} from \"../../utils/url-extractor.js\";\nimport type { EnterprisePolicy } from \"../policy.js\";\n\nfunction getArgsObject(\n\tcontext: ActionApprovalContext,\n): Record<string, unknown> | null {\n\treturn context.args && typeof context.args === \"object\"\n\t\t? (context.args as Record<string, unknown>)\n\t\t: null;\n}\n\nfunction getStringArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): string | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"string\" ? value : null;\n}\n\n/**\n * Extract URLs from tool arguments (recursively checks nested objects)\n * Also extracts URLs from curl/wget commands in bash.\n */\nexport function extractPolicyUrls(context: ActionApprovalContext): string[] {\n\tconst args = getArgsObject(context);\n\tif (!args) return [];\n\n\tconst urls = extractUrlsFromValue(args);\n\n\tif (context.toolName === \"bash\" || context.toolName === \"background_tasks\") {\n\t\tconst command = getStringArg(context, \"command\");\n\t\tif (command) {\n\t\t\turls.push(...extractUrlsFromShellCommand(command));\n\t\t}\n\t}\n\n\treturn urls;\n}\n\n/**\n * Check if a URL/host matches network restrictions.\n */\nexport async function checkNetworkRestrictions(\n\turl: string,\n\tnetwork: NonNullable<EnterprisePolicy[\"network\"]>,\n): Promise<{ allowed: boolean; reason?: string }> {\n\ttry {\n\t\tconst parsed = new URL(url);\n\t\tconst host = parsed.hostname.toLowerCase();\n\n\t\tconst normalizedHost = host.replace(/^\\[|\\]$/g, \"\");\n\n\t\tconst resolvedIPs: string[] = [];\n\t\tconst isIP =\n\t\t\tparseIPv4(normalizedHost) !== null ||\n\t\t\tparseIPv4MappedHex(normalizedHost) !== null ||\n\t\t\tnormalizedHost.includes(\":\");\n\n\t\tif (!isIP) {\n\t\t\ttry {\n\t\t\t\tconst { address } = await lookup(normalizedHost);\n\t\t\t\tresolvedIPs.push(address);\n\t\t\t} catch {\n\t\t\t\tif (network.blockPrivateIPs || network.blockLocalhost) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `DNS resolution failed for \"${host}\" and network policy requires IP validation (blockPrivateIPs/blockLocalhost enabled). Access blocked.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\tresolvedIPs.push(normalizedHost);\n\t\t}\n\n\t\tif (network.blockLocalhost) {\n\t\t\tif (isLocalhostAlias(normalizedHost) || resolvedIPs.some(isLoopbackIP)) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: \"Access to localhost is blocked by enterprise policy.\",\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (network.blockPrivateIPs) {\n\t\t\tif (resolvedIPs.some(isPrivateIP)) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Access to private IP addresses is blocked by enterprise policy.\",\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (network.blockedHosts?.length) {\n\t\t\tfor (const blockedHost of network.blockedHosts) {\n\t\t\t\tconst lowerBlocked = blockedHost.toLowerCase();\n\t\t\t\tif (host === lowerBlocked || host.endsWith(`.${lowerBlocked}`)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Host \"${host}\" is blocked by enterprise policy.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (network.allowedHosts) {\n\t\t\tif (network.allowedHosts.length === 0) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Host \"${host}\" is not in the allowed hosts list.`,\n\t\t\t\t};\n\t\t\t}\n\t\t\tconst isAllowed = network.allowedHosts.some((allowedHost) => {\n\t\t\t\tconst lowerAllowed = allowedHost.toLowerCase();\n\t\t\t\treturn host === lowerAllowed || host.endsWith(`.${lowerAllowed}`);\n\t\t\t});\n\t\t\tif (!isAllowed) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Host \"${host}\" is not in the allowed hosts list.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t} catch {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Invalid URL format - cannot validate against network policy.\",\n\t\t};\n\t}\n\treturn { allowed: true };\n}\n\nexport async function checkNetworkPolicy(\n\tcontext: ActionApprovalContext,\n\tnetwork: NonNullable<EnterprisePolicy[\"network\"]>,\n): Promise<{ allowed: boolean; reason?: string }> {\n\tconst urls = extractPolicyUrls(context);\n\tfor (const url of urls) {\n\t\tconst check = await checkNetworkRestrictions(url, network);\n\t\tif (!check.allowed) {\n\t\t\treturn check;\n\t\t}\n\t}\n\treturn { allowed: true };\n}\n"]}
+{"version":3,"file":"network-policy-validator.js","sourceRoot":"","sources":["../../../src/safety/validators/network-policy-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,SAAS,EACT,kBAAkB,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,2BAA2B,EAC3B,oBAAoB,GACpB,MAAM,8BAA8B,CAAC;AAWtC,SAAS,aAAa,CACrB,OAA8B;IAE9B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,OAAO,CAAC,IAAgC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACpB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC/D,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAExC,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACjD,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACrD,GAAW,EACX,OAAiD;IAEjD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE3C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAEpD,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GACT,SAAS,CAAC,cAAc,CAAC,KAAK,IAAI;YAClC,kBAAkB,CAAC,cAAc,CAAC,KAAK,IAAI;YAC3C,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,CAAC;gBACJ,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9D,WAAW,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACR,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;oBACvD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,8BAA8B,IAAI,uGAAuG;wBACjJ,IAAI;wBACJ,cAAc;wBACd,WAAW;qBACX,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;aAAM,CAAC;YACP,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,IAAI,gBAAgB,CAAC,cAAc,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxE,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,sDAAsD;oBAC9D,IAAI;oBACJ,cAAc;oBACd,WAAW;iBACX,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EACL,iEAAiE;oBAClE,IAAI;oBACJ,cAAc;oBACd,WAAW;iBACX,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;YAClC,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBAChD,MAAM,YAAY,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;gBAC/C,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,EAAE,CAAC;oBAChE,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,SAAS,IAAI,oCAAoC;wBACzD,IAAI;wBACJ,cAAc;wBACd,WAAW;qBACX,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,SAAS,IAAI,qCAAqC;oBAC1D,IAAI;oBACJ,cAAc;oBACd,WAAW;iBACX,CAAC;YACH,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;gBAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;gBAC/C,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,SAAS,IAAI,qCAAqC;oBAC1D,IAAI;oBACJ,cAAc;oBACd,WAAW;iBACX,CAAC;YACH,CAAC;QACF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,8DAA8D;YACtE,WAAW,EAAE,EAAE;SACf,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,GAAW,EACX,OAAiD;IAEjD,MAAM,KAAK,GAAG,MAAM,gCAAgC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,MAAM;QAClB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QAClD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,OAA8B,EAC9B,OAAiD;IAEjD,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC","sourcesContent":["import { lookup } from \"node:dns/promises\";\nimport type { ActionApprovalContext } from \"../../agent/action-approval.js\";\nimport {\n\tisLocalhostAlias,\n\tisLoopbackIP,\n\tisPrivateIP,\n\tparseIPv4,\n\tparseIPv4MappedHex,\n} from \"../../utils/ip-address-parser.js\";\nimport {\n\textractUrlsFromShellCommand,\n\textractUrlsFromValue,\n} from \"../../utils/url-extractor.js\";\nimport type { EnterprisePolicy } from \"../policy.js\";\n\nexport interface NetworkRestrictionCheck {\n\tallowed: boolean;\n\treason?: string;\n\thost?: string;\n\tnormalizedHost?: string;\n\tresolvedIPs: string[];\n}\n\nfunction getArgsObject(\n\tcontext: ActionApprovalContext,\n): Record<string, unknown> | null {\n\treturn context.args && typeof context.args === \"object\"\n\t\t? (context.args as Record<string, unknown>)\n\t\t: null;\n}\n\nfunction getStringArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): string | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"string\" ? value : null;\n}\n\n/**\n * Extract URLs from tool arguments (recursively checks nested objects)\n * Also extracts URLs from curl/wget commands in bash.\n */\nexport function extractPolicyUrls(context: ActionApprovalContext): string[] {\n\tconst args = getArgsObject(context);\n\tif (!args) return [];\n\n\tconst urls = extractUrlsFromValue(args);\n\n\tif (context.toolName === \"bash\" || context.toolName === \"background_tasks\") {\n\t\tconst command = getStringArg(context, \"command\");\n\t\tif (command) {\n\t\t\turls.push(...extractUrlsFromShellCommand(command));\n\t\t}\n\t}\n\n\treturn urls;\n}\n\n/**\n * Check if a URL/host matches network restrictions.\n */\nexport async function checkNetworkRestrictionsDetailed(\n\turl: string,\n\tnetwork: NonNullable<EnterprisePolicy[\"network\"]>,\n): Promise<NetworkRestrictionCheck> {\n\ttry {\n\t\tconst parsed = new URL(url);\n\t\tconst host = parsed.hostname.toLowerCase();\n\n\t\tconst normalizedHost = host.replace(/^\\[|\\]$/g, \"\");\n\n\t\tconst resolvedIPs: string[] = [];\n\t\tconst isIP =\n\t\t\tparseIPv4(normalizedHost) !== null ||\n\t\t\tparseIPv4MappedHex(normalizedHost) !== null ||\n\t\t\tnormalizedHost.includes(\":\");\n\n\t\tif (!isIP) {\n\t\t\ttry {\n\t\t\t\tconst addresses = await lookup(normalizedHost, { all: true });\n\t\t\t\tresolvedIPs.push(...addresses.map(({ address }) => address));\n\t\t\t} catch {\n\t\t\t\tif (network.blockPrivateIPs || network.blockLocalhost) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `DNS resolution failed for \"${host}\" and network policy requires IP validation (blockPrivateIPs/blockLocalhost enabled). Access blocked.`,\n\t\t\t\t\t\thost,\n\t\t\t\t\t\tnormalizedHost,\n\t\t\t\t\t\tresolvedIPs,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\tresolvedIPs.push(normalizedHost);\n\t\t}\n\n\t\tif (network.blockLocalhost) {\n\t\t\tif (isLocalhostAlias(normalizedHost) || resolvedIPs.some(isLoopbackIP)) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: \"Access to localhost is blocked by enterprise policy.\",\n\t\t\t\t\thost,\n\t\t\t\t\tnormalizedHost,\n\t\t\t\t\tresolvedIPs,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (network.blockPrivateIPs) {\n\t\t\tif (resolvedIPs.some(isPrivateIP)) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Access to private IP addresses is blocked by enterprise policy.\",\n\t\t\t\t\thost,\n\t\t\t\t\tnormalizedHost,\n\t\t\t\t\tresolvedIPs,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (network.blockedHosts?.length) {\n\t\t\tfor (const blockedHost of network.blockedHosts) {\n\t\t\t\tconst lowerBlocked = blockedHost.toLowerCase();\n\t\t\t\tif (host === lowerBlocked || host.endsWith(`.${lowerBlocked}`)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Host \"${host}\" is blocked by enterprise policy.`,\n\t\t\t\t\t\thost,\n\t\t\t\t\t\tnormalizedHost,\n\t\t\t\t\t\tresolvedIPs,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (network.allowedHosts) {\n\t\t\tif (network.allowedHosts.length === 0) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Host \"${host}\" is not in the allowed hosts list.`,\n\t\t\t\t\thost,\n\t\t\t\t\tnormalizedHost,\n\t\t\t\t\tresolvedIPs,\n\t\t\t\t};\n\t\t\t}\n\t\t\tconst isAllowed = network.allowedHosts.some((allowedHost) => {\n\t\t\t\tconst lowerAllowed = allowedHost.toLowerCase();\n\t\t\t\treturn host === lowerAllowed || host.endsWith(`.${lowerAllowed}`);\n\t\t\t});\n\t\t\tif (!isAllowed) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Host \"${host}\" is not in the allowed hosts list.`,\n\t\t\t\t\thost,\n\t\t\t\t\tnormalizedHost,\n\t\t\t\t\tresolvedIPs,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t\treturn { allowed: true, host, normalizedHost, resolvedIPs };\n\t} catch {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Invalid URL format - cannot validate against network policy.\",\n\t\t\tresolvedIPs: [],\n\t\t};\n\t}\n}\n\nexport async function checkNetworkRestrictions(\n\turl: string,\n\tnetwork: NonNullable<EnterprisePolicy[\"network\"]>,\n): Promise<{ allowed: boolean; reason?: string }> {\n\tconst check = await checkNetworkRestrictionsDetailed(url, network);\n\treturn check.reason\n\t\t? { allowed: check.allowed, reason: check.reason }\n\t\t: { allowed: check.allowed };\n}\n\nexport async function checkNetworkPolicy(\n\tcontext: ActionApprovalContext,\n\tnetwork: NonNullable<EnterprisePolicy[\"network\"]>,\n): Promise<{ allowed: boolean; reason?: string }> {\n\tconst urls = extractPolicyUrls(context);\n\tfor (const url of urls) {\n\t\tconst check = await checkNetworkRestrictions(url, network);\n\t\tif (!check.allowed) {\n\t\t\treturn check;\n\t\t}\n\t}\n\treturn { allowed: true };\n}\n"]}

package/dist/sandbox/local-sandbox.d.ts

@@ -24,7 +24,7 @@
  * ## Security Note
  *
  * This sandbox provides NO isolation. Commands run with the same
- * permissions as the Composer process. Use DockerSandbox for
+ * permissions as the Maestro process. Use DockerSandbox for
  * isolated execution in untrusted environments.
  *
  * @module sandbox/local-sandbox

package/dist/sandbox/local-sandbox.js

@@ -24,7 +24,7 @@
  * ## Security Note
  *
  * This sandbox provides NO isolation. Commands run with the same
- * permissions as the Composer process. Use DockerSandbox for
+ * permissions as the Maestro process. Use DockerSandbox for
  * isolated execution in untrusted environments.
  *
  * @module sandbox/local-sandbox

package/dist/sandbox/local-sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-sandbox.js","sourceRoot":"","sources":["../../src/sandbox/local-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAElC,MAAM,OAAO,YAAY;IACxB,KAAK,CAAC,IAAI,CACT,OAAe,EACf,GAAY,EACZ,GAA4B;QAE5B,IAAI,CAAC;YACJ,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE;gBACnD,GAAG;gBACH,GAAG,EAAE,uBAAuB,CAAC,GAAG,EAAE;oBACjC,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE;iBAC3B,CAAC;aACF,CAAC,CAAC;YACH,OAAO;gBACN,MAAM;gBACN,MAAM;gBACN,QAAQ,EAAE,CAAC,EAAE,6DAA6D;aAC1E,CAAC;QACH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,KAIjB,CAAC;YACF,OAAO;gBACN,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE;gBAC9B,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE;gBAC9B,QAAQ,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC;aAC7B,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QAC1B,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC5C,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACxB,IAAI,CAAC;YACJ,MAAM,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,wCAAwC;IACzC,CAAC;CACD","sourcesContent":["/**\n * Local Sandbox - Direct Filesystem Execution\n *\n * This module provides a non-isolated sandbox that executes commands and\n * file operations directly on the local filesystem. It implements the\n * Sandbox interface for consistency but provides no actual isolation.\n *\n * ## Use Cases\n *\n * - Default execution environment when Docker is unavailable\n * - Development and testing scenarios\n * - Trusted workspace operations\n *\n * ## Operations\n *\n * | Method     | Description                               |\n * |------------|-------------------------------------------|\n * | exec()     | Run shell command via child_process       |\n * | readFile() | Read file contents using fs.readFile      |\n * | writeFile()| Write file contents using fs.writeFile    |\n * | exists()   | Check file existence using fs.access      |\n * | list()     | List directory contents                   |\n *\n * ## Security Note\n *\n * This sandbox provides NO isolation. Commands run with the same\n * permissions as the Composer process. Use DockerSandbox for\n * isolated execution in untrusted environments.\n *\n * @module sandbox/local-sandbox\n */\n\nimport { exec } from \"node:child_process\";\nimport { constants } from \"node:fs\";\nimport { access, readFile, writeFile } from \"node:fs/promises\";\nimport { promisify } from \"node:util\";\nimport { resolveShellEnvironment } from \"../utils/shell-env.js\";\nimport type { ExecResult, Sandbox } from \"./types.js\";\n\nconst execAsync = promisify(exec);\n\nexport class LocalSandbox implements Sandbox {\n\tasync exec(\n\t\tcommand: string,\n\t\tcwd?: string,\n\t\tenv?: Record<string, string>,\n\t): Promise<ExecResult> {\n\t\ttry {\n\t\t\tconst { stdout, stderr } = await execAsync(command, {\n\t\t\t\tcwd,\n\t\t\t\tenv: resolveShellEnvironment(env, {\n\t\t\t\t\tworkspaceDir: process.cwd(),\n\t\t\t\t}),\n\t\t\t});\n\t\t\treturn {\n\t\t\t\tstdout,\n\t\t\t\tstderr,\n\t\t\t\texitCode: 0, // execAsync throws on non-zero exit, so if we're here it's 0\n\t\t\t};\n\t\t} catch (error: unknown) {\n\t\t\tconst execError = error as {\n\t\t\t\tstdout?: string;\n\t\t\t\tstderr?: string;\n\t\t\t\tcode?: number;\n\t\t\t};\n\t\t\treturn {\n\t\t\t\tstdout: execError.stdout || \"\",\n\t\t\t\tstderr: execError.stderr || \"\",\n\t\t\t\texitCode: execError.code || 1,\n\t\t\t};\n\t\t}\n\t}\n\n\tasync readFile(path: string): Promise<string> {\n\t\treturn readFile(path, \"utf-8\");\n\t}\n\n\tasync writeFile(path: string, content: string): Promise<void> {\n\t\tawait writeFile(path, content, \"utf-8\");\n\t}\n\n\tasync exists(path: string): Promise<boolean> {\n\t\ttry {\n\t\t\tawait access(path, constants.F_OK);\n\t\t\treturn true;\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t}\n\n\tasync dispose(): Promise<void> {\n\t\t// Nothing to clean up for local sandbox\n\t}\n}\n"]}
+{"version":3,"file":"local-sandbox.js","sourceRoot":"","sources":["../../src/sandbox/local-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAElC,MAAM,OAAO,YAAY;IACxB,KAAK,CAAC,IAAI,CACT,OAAe,EACf,GAAY,EACZ,GAA4B;QAE5B,IAAI,CAAC;YACJ,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE;gBACnD,GAAG;gBACH,GAAG,EAAE,uBAAuB,CAAC,GAAG,EAAE;oBACjC,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE;iBAC3B,CAAC;aACF,CAAC,CAAC;YACH,OAAO;gBACN,MAAM;gBACN,MAAM;gBACN,QAAQ,EAAE,CAAC,EAAE,6DAA6D;aAC1E,CAAC;QACH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,KAIjB,CAAC;YACF,OAAO;gBACN,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE;gBAC9B,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE;gBAC9B,QAAQ,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC;aAC7B,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QAC1B,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC5C,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACxB,IAAI,CAAC;YACJ,MAAM,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,wCAAwC;IACzC,CAAC;CACD","sourcesContent":["/**\n * Local Sandbox - Direct Filesystem Execution\n *\n * This module provides a non-isolated sandbox that executes commands and\n * file operations directly on the local filesystem. It implements the\n * Sandbox interface for consistency but provides no actual isolation.\n *\n * ## Use Cases\n *\n * - Default execution environment when Docker is unavailable\n * - Development and testing scenarios\n * - Trusted workspace operations\n *\n * ## Operations\n *\n * | Method     | Description                               |\n * |------------|-------------------------------------------|\n * | exec()     | Run shell command via child_process       |\n * | readFile() | Read file contents using fs.readFile      |\n * | writeFile()| Write file contents using fs.writeFile    |\n * | exists()   | Check file existence using fs.access      |\n * | list()     | List directory contents                   |\n *\n * ## Security Note\n *\n * This sandbox provides NO isolation. Commands run with the same\n * permissions as the Maestro process. Use DockerSandbox for\n * isolated execution in untrusted environments.\n *\n * @module sandbox/local-sandbox\n */\n\nimport { exec } from \"node:child_process\";\nimport { constants } from \"node:fs\";\nimport { access, readFile, writeFile } from \"node:fs/promises\";\nimport { promisify } from \"node:util\";\nimport { resolveShellEnvironment } from \"../utils/shell-env.js\";\nimport type { ExecResult, Sandbox } from \"./types.js\";\n\nconst execAsync = promisify(exec);\n\nexport class LocalSandbox implements Sandbox {\n\tasync exec(\n\t\tcommand: string,\n\t\tcwd?: string,\n\t\tenv?: Record<string, string>,\n\t): Promise<ExecResult> {\n\t\ttry {\n\t\t\tconst { stdout, stderr } = await execAsync(command, {\n\t\t\t\tcwd,\n\t\t\t\tenv: resolveShellEnvironment(env, {\n\t\t\t\t\tworkspaceDir: process.cwd(),\n\t\t\t\t}),\n\t\t\t});\n\t\t\treturn {\n\t\t\t\tstdout,\n\t\t\t\tstderr,\n\t\t\t\texitCode: 0, // execAsync throws on non-zero exit, so if we're here it's 0\n\t\t\t};\n\t\t} catch (error: unknown) {\n\t\t\tconst execError = error as {\n\t\t\t\tstdout?: string;\n\t\t\t\tstderr?: string;\n\t\t\t\tcode?: number;\n\t\t\t};\n\t\t\treturn {\n\t\t\t\tstdout: execError.stdout || \"\",\n\t\t\t\tstderr: execError.stderr || \"\",\n\t\t\t\texitCode: execError.code || 1,\n\t\t\t};\n\t\t}\n\t}\n\n\tasync readFile(path: string): Promise<string> {\n\t\treturn readFile(path, \"utf-8\");\n\t}\n\n\tasync writeFile(path: string, content: string): Promise<void> {\n\t\tawait writeFile(path, content, \"utf-8\");\n\t}\n\n\tasync exists(path: string): Promise<boolean> {\n\t\ttry {\n\t\t\tawait access(path, constants.F_OK);\n\t\t\treturn true;\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t}\n\n\tasync dispose(): Promise<void> {\n\t\t// Nothing to clean up for local sandbox\n\t}\n}\n"]}

package/dist/server/app-context.d.ts

@@ -2,6 +2,7 @@ import type { ActionApprovalService, ApprovalMode } from "../agent/action-approv
 import type { Agent } from "../agent/index.js";
 import type { ToolRetryService } from "../agent/tool-retry.js";
 import type { ClientToolExecutionService } from "../agent/transport.js";
+import type { PlatformToolExecutionBridge } from "../agent/transport/tool-execution-bridge.js";
 import type { ThinkingLevel } from "../agent/types.js";
 import type { RegisteredModel } from "../models/registry.js";
 import type { AuthCredential } from "../providers/auth.js";
@@ -66,6 +67,7 @@ export interface WebServerServices {
         approvalService?: ActionApprovalService;
         clientToolService?: ClientToolExecutionService;
         toolRetryService?: ToolRetryService;
+        platformToolExecutionBridge?: PlatformToolExecutionBridge | false;
     }) => Promise<Agent>;
     createBackgroundAgent: (model: RegisteredModel, options?: {
         cwd?: string;

package/dist/server/app-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-context.d.ts","sourceRoot":"","sources":["../../src/server/app-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,qBAAqB,EACrB,YAAY,EACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,YAAY,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,IAAI,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE;QACrB,IAAI,EAAE,cAAc,GAAG,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAAC;QAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACF;AAED,MAAM,WAAW,iBAAiB;IACjC,WAAW,EAAE,CACZ,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,YAAY,EACtB,OAAO,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,eAAe,CAAC,EAAE,qBAAqB,CAAC;QACxC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;QAC/C,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KACpC,KACG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpB,qBAAqB,EAAE,CACtB,KAAK,EAAE,eAAe,EACtB,OAAO,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,KACG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpB,kBAAkB,EAAE,CACnB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,KAC5B,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9B,mBAAmB,EAAE,MAAM;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAChE,iBAAiB,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IACpD,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC3C,sBAAsB,EAAE,sBAAsB,CAAC;CAC/C;AAED,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,iBAAiB,CAAC"}
+{"version":3,"file":"app-context.d.ts","sourceRoot":"","sources":["../../src/server/app-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,qBAAqB,EACrB,YAAY,EACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAC/F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,YAAY,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,IAAI,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE;QACrB,IAAI,EAAE,cAAc,GAAG,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAAC;QAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACF;AAED,MAAM,WAAW,iBAAiB;IACjC,WAAW,EAAE,CACZ,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,YAAY,EACtB,OAAO,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,eAAe,CAAC,EAAE,qBAAqB,CAAC;QACxC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;QAC/C,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;QACpC,2BAA2B,CAAC,EAAE,2BAA2B,GAAG,KAAK,CAAC;KAClE,KACG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpB,qBAAqB,EAAE,CACtB,KAAK,EAAE,eAAe,EACtB,OAAO,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,KACG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpB,kBAAkB,EAAE,CACnB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,KAC5B,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9B,mBAAmB,EAAE,MAAM;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAChE,iBAAiB,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IACpD,UAAU,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC3C,sBAAsB,EAAE,sBAAsB,CAAC;CAC/C;AAED,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,iBAAiB,CAAC"}

package/dist/server/app-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-context.js","sourceRoot":"","sources":["../../src/server/app-context.ts"],"names":[],"mappings":"","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type {\n\tActionApprovalService,\n\tApprovalMode,\n} from \"../agent/action-approval.js\";\nimport type { Agent } from \"../agent/index.js\";\nimport type { ToolRetryService } from \"../agent/tool-retry.js\";\nimport type { ClientToolExecutionService } from \"../agent/transport.js\";\nimport type { ThinkingLevel } from \"../agent/types.js\";\nimport type { RegisteredModel } from \"../models/registry.js\";\nimport type { AuthCredential } from \"../providers/auth.js\";\nimport type { HeadlessRuntimeService } from \"./headless-runtime-service.js\";\nimport type { HostedRunnerLeaseSnapshot } from \"./hosted-runner-lease.js\";\n\nexport interface WebServerConfig {\n\tcorsHeaders: Record<string, string>;\n\tstaticMaxAge: number;\n\tdefaultApprovalMode: ApprovalMode;\n\tdefaultProvider: string;\n\tdefaultModelId: string;\n\thostedRunner?: HostedRunnerContext;\n}\n\nexport interface HostedRunnerContext {\n\tenabled: true;\n\trunnerSessionId: string;\n\townerInstanceId?: string;\n\tworkspaceRoot: string;\n\tsnapshotRoot?: string;\n\trestoreManifestPath?: string;\n\tlistenHost?: string;\n\tlistenPort?: number;\n\tworkspaceId?: string;\n\tagentId?: string;\n\tagentRunId?: string;\n\tagentRuntimeLeaseToken?: string;\n\ta2aMessageId?: string;\n\ta2aTaskId?: string;\n\tlastPlatformA2APush?: {\n\t\tkind: \"statusUpdate\" | \"artifactUpdate\" | \"task\" | \"message\";\n\t\ttaskId?: string;\n\t\tcontextId?: string;\n\t\tstate?: string;\n\t\tfinal?: boolean;\n\t\treceivedAt: string;\n\t\truntimeEventId?: string;\n\t\truntimeEventType?: string;\n\t};\n\tagentRuntimeWorkerQueue?: string;\n\tagentRuntimeCorrelationPath?: string;\n\tattachAudience?: string;\n\tconfiguredMaestroSessionId?: string;\n\tactiveMaestroSessionId?: string;\n\truntimeLease?: HostedRunnerLeaseSnapshot;\n\tdraining?: boolean;\n\tlastDrain?: {\n\t\tstatus: string;\n\t\tmanifestPath: string;\n\t\tdrainedAt: string;\n\t\treason?: string;\n\t\trequestedBy?: string;\n\t};\n}\n\nexport interface WebServerServices {\n\tcreateAgent: (\n\t\tmodel: RegisteredModel,\n\t\tthinking: ThinkingLevel,\n\t\tapproval: ApprovalMode,\n\t\toptions?: {\n\t\t\tcwd?: string;\n\t\t\tenableClientTools?: boolean;\n\t\t\tuseClientAskUser?: boolean;\n\t\t\tincludeVscodeTools?: boolean;\n\t\t\tincludeJetBrainsTools?: boolean;\n\t\t\tincludeConductorTools?: boolean;\n\t\t\tapprovalService?: ActionApprovalService;\n\t\t\tclientToolService?: ClientToolExecutionService;\n\t\t\ttoolRetryService?: ToolRetryService;\n\t\t},\n\t) => Promise<Agent>;\n\tcreateBackgroundAgent: (\n\t\tmodel: RegisteredModel,\n\t\toptions?: {\n\t\t\tcwd?: string;\n\t\t\tsystemPrompt?: string;\n\t\t},\n\t) => Promise<Agent>;\n\tgetRegisteredModel: (\n\t\tinput: string | null | undefined,\n\t) => Promise<RegisteredModel>;\n\tgetCurrentSelection: () => { provider: string; modelId: string };\n\tensureCredential: (provider: string) => Promise<AuthCredential>;\n\tsetModelSelection: (model: RegisteredModel) => void;\n\tacquireSse: () => symbol | null;\n\treleaseSse: (token: symbol | null) => void;\n\theadlessRuntimeService: HeadlessRuntimeService;\n}\n\nexport type WebServerContext = WebServerConfig & WebServerServices;\n"]}
+{"version":3,"file":"app-context.js","sourceRoot":"","sources":["../../src/server/app-context.ts"],"names":[],"mappings":"","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type {\n\tActionApprovalService,\n\tApprovalMode,\n} from \"../agent/action-approval.js\";\nimport type { Agent } from \"../agent/index.js\";\nimport type { ToolRetryService } from \"../agent/tool-retry.js\";\nimport type { ClientToolExecutionService } from \"../agent/transport.js\";\nimport type { PlatformToolExecutionBridge } from \"../agent/transport/tool-execution-bridge.js\";\nimport type { ThinkingLevel } from \"../agent/types.js\";\nimport type { RegisteredModel } from \"../models/registry.js\";\nimport type { AuthCredential } from \"../providers/auth.js\";\nimport type { HeadlessRuntimeService } from \"./headless-runtime-service.js\";\nimport type { HostedRunnerLeaseSnapshot } from \"./hosted-runner-lease.js\";\n\nexport interface WebServerConfig {\n\tcorsHeaders: Record<string, string>;\n\tstaticMaxAge: number;\n\tdefaultApprovalMode: ApprovalMode;\n\tdefaultProvider: string;\n\tdefaultModelId: string;\n\thostedRunner?: HostedRunnerContext;\n}\n\nexport interface HostedRunnerContext {\n\tenabled: true;\n\trunnerSessionId: string;\n\townerInstanceId?: string;\n\tworkspaceRoot: string;\n\tsnapshotRoot?: string;\n\trestoreManifestPath?: string;\n\tlistenHost?: string;\n\tlistenPort?: number;\n\tworkspaceId?: string;\n\tagentId?: string;\n\tagentRunId?: string;\n\tagentRuntimeLeaseToken?: string;\n\ta2aMessageId?: string;\n\ta2aTaskId?: string;\n\tlastPlatformA2APush?: {\n\t\tkind: \"statusUpdate\" | \"artifactUpdate\" | \"task\" | \"message\";\n\t\ttaskId?: string;\n\t\tcontextId?: string;\n\t\tstate?: string;\n\t\tfinal?: boolean;\n\t\treceivedAt: string;\n\t\truntimeEventId?: string;\n\t\truntimeEventType?: string;\n\t};\n\tagentRuntimeWorkerQueue?: string;\n\tagentRuntimeCorrelationPath?: string;\n\tattachAudience?: string;\n\tconfiguredMaestroSessionId?: string;\n\tactiveMaestroSessionId?: string;\n\truntimeLease?: HostedRunnerLeaseSnapshot;\n\tdraining?: boolean;\n\tlastDrain?: {\n\t\tstatus: string;\n\t\tmanifestPath: string;\n\t\tdrainedAt: string;\n\t\treason?: string;\n\t\trequestedBy?: string;\n\t};\n}\n\nexport interface WebServerServices {\n\tcreateAgent: (\n\t\tmodel: RegisteredModel,\n\t\tthinking: ThinkingLevel,\n\t\tapproval: ApprovalMode,\n\t\toptions?: {\n\t\t\tcwd?: string;\n\t\t\tenableClientTools?: boolean;\n\t\t\tuseClientAskUser?: boolean;\n\t\t\tincludeVscodeTools?: boolean;\n\t\t\tincludeJetBrainsTools?: boolean;\n\t\t\tincludeConductorTools?: boolean;\n\t\t\tapprovalService?: ActionApprovalService;\n\t\t\tclientToolService?: ClientToolExecutionService;\n\t\t\ttoolRetryService?: ToolRetryService;\n\t\t\tplatformToolExecutionBridge?: PlatformToolExecutionBridge | false;\n\t\t},\n\t) => Promise<Agent>;\n\tcreateBackgroundAgent: (\n\t\tmodel: RegisteredModel,\n\t\toptions?: {\n\t\t\tcwd?: string;\n\t\t\tsystemPrompt?: string;\n\t\t},\n\t) => Promise<Agent>;\n\tgetRegisteredModel: (\n\t\tinput: string | null | undefined,\n\t) => Promise<RegisteredModel>;\n\tgetCurrentSelection: () => { provider: string; modelId: string };\n\tensureCredential: (provider: string) => Promise<AuthCredential>;\n\tsetModelSelection: (model: RegisteredModel) => void;\n\tacquireSse: () => symbol | null;\n\treleaseSse: (token: symbol | null) => void;\n\theadlessRuntimeService: HeadlessRuntimeService;\n}\n\nexport type WebServerContext = WebServerConfig & WebServerServices;\n"]}

package/dist/server/handlers/attachments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/attachments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA0BjE,wBAAsB,uBAAuB,CAC5C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBAsE5B"}
+{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/attachments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA0BjE,wBAAsB,uBAAuB,CAC5C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBAuE5B"}

package/dist/server/handlers/attachments.js

@@ -52,6 +52,7 @@ export async function handleAttachmentExtract(req, res, cors) {
         sendJson(res, 200, {
             fileName,
             format: extracted.format,
+            extractor: extracted.extractor,
             size: extracted.sizeBytes,
             truncated: extracted.truncated,
             extractedText: extracted.extractedText,