@evalops/maestro 0.10.50 → 0.10.53

package/dist/safety/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/safety/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,OAAO,EAEN,UAAU,EACV,SAAS,EACT,YAAY,EACZ,KAAK,GACL,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,IAAI,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EACN,eAAe,EACf,sBAAsB,GACtB,MAAM,uCAAuC,CAAC;AAE/C,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AA+E7C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACnC,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KAClD,CAAC,CACF;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7C,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;KAC9C,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjD,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACvD,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KACnD,CAAC,CACF;CACD,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAY1D,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAChF,MAAM,uBAAuB,GAAG,GAAW,EAAE,CAC5C,IAAI,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAEhD,SAAS,2BAA2B;IACnC,OAAO,WAAW,CAAC;QAClB,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC1D,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC/C,iBAAiB,EAAE;QACnB,uBAAuB,EAAE;KACzB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IAClC,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,GAAkB,EAAE;IAClD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC9D,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAEF,IAAI,YAAY,GAA4B,IAAI,CAAC;AACjD,IAAI,eAAe,GAAkB,IAAI,CAAC;AAC1C,IAAI,kBAAkB,GAAuB,EAAE,CAAC;AAChD,IAAI,cAAc,GAAgB,EAAE,CAAC;AAErC,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,gBAAgB;IACxB,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,cAAc,GAAG,0BAA0B,EAAE,CAAC;IACpD,IAAI,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,mBAAmB,GAAG,sBAAsB,EAAE,CAAC;IACrD,IAAI,mBAAmB,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,WAAW;SAClB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB;IACjD,OAAO,OAAO;SACZ,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;SAClE,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB;IAC3B,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IACD,cAAc,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAuB;IACnD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,gCAAgC;YAChC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAEzC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;gBAChD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC5B,0BAA0B;oBAC1B,YAAY,GAAG,IAAI,CAAC;oBACpB,eAAe,GAAG,IAAI,CAAC;oBACvB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChC,mBAAmB,EAAE,CAAC;oBACvB,CAAC;gBACF,CAAC;qBAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBACnC,gEAAgE;oBAChE,gFAAgF;oBAChF,YAAY,GAAG,IAAI,CAAC;oBACpB,eAAe,GAAG,IAAI,CAAC;gBACxB,CAAC;YACF,CAAC,CAAC,CAAC;YACH,qDAAqD;YACrD,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,oDAAoD;YACpD,4CAA4C;QAC7C,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CACvB,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACjD,CAAC;QACF,MAAM,IAAI,KAAK,CACd,yBAAyB,GAAG,+BAA+B,CAC3D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAC3B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,qBAAqB,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,mBAAmB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAe;IACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IACf,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,SAAS,uBAAuB,CAC/B,MAAqB,EACrB,SAAiB,EACjB,QAAgB,EAChB,OAAe;IAEf,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IAC1C,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,CAChB,CAAC;IACF,MAAM,aAAa,GAAG,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,CAChB,CAAC;IACF,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,MAAM,GAAG;YACf,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAC7C,MAAM,EACN,OAAO,EACP,SAAS,EACT,iBAAiB,CACjB,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,uBAAuB,CAClD,MAAM,EACN,cAAc,EACd,SAAS,EACT,sBAAsB,CACtB,CAAC;IACF,MAAM,mBAAmB,GAAG,uBAAuB,CAClD,MAAM,EACN,cAAc,EACd,SAAS,EACT,sBAAsB,CACtB,CAAC;IACF,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,CAAC,YAAY,GAAG;YACrB,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;SACN,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAC7C,MAAM,EACN,QAAQ,EACR,UAAU,EACV,iBAAiB,CACjB,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC1E,IACC,YAAY,KAAK,SAAS;YAC1B,YAAY,KAAK,SAAS;YAC1B,cAAc,KAAK,SAAS;YAC5B,eAAe,KAAK,SAAS,EAC5B,CAAC;YACF,MAAM,CAAC,OAAO,GAAG;gBAChB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,mBAAmB,GAAG,kBAAkB,CAC7C,MAAM,EACN,wBAAwB,CACxB,CAAC;IACF,MAAM,yBAAyB,GAAG,kBAAkB,CACnD,MAAM,EACN,8BAA8B,CAC9B,CAAC;IACF,MAAM,qBAAqB,GAAG,kBAAkB,CAC/C,MAAM,EACN,yBAAyB,CACzB,CAAC;IACF,IACC,mBAAmB,KAAK,SAAS;QACjC,yBAAyB,KAAK,SAAS;QACvC,qBAAqB,KAAK,SAAS,EAClC,CAAC;QACF,MAAM,CAAC,MAAM,GAAG;YACf,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,yBAAyB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CACnB,IAA0B,EAC1B,KAA2B;IAE3B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CACzB,IAAwB,EACxB,KAAyB;IAEzB,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,CAClC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,CAC5D,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,IAAI,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,yBAAyB,CACjC,UAAkE,EAClE,eAAuE;IAEvE,MAAM,OAAO,GAAG,eAAe,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,CAAC;IAChE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO;QACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAC1B,UAAuC,EACvC,eAA4C;IAE5C,MAAM,YAAY,GACjB,eAAe,EAAE,YAAY,IAAI,UAAU,EAAE,YAAY,CAAC;IAC3D,MAAM,YAAY,GAAG,WAAW,CAC/B,UAAU,EAAE,YAAY,EACxB,eAAe,EAAE,YAAY,CAC7B,CAAC;IACF,MAAM,cAAc,GACnB,UAAU,EAAE,cAAc,KAAK,IAAI;QACnC,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;IAC1C,MAAM,eAAe,GACpB,UAAU,EAAE,eAAe,KAAK,IAAI;QACpC,eAAe,EAAE,eAAe,KAAK,IAAI,CAAC;IAE3C,IACC,YAAY,KAAK,SAAS;QAC1B,YAAY,KAAK,SAAS;QAC1B,CAAC,cAAc;QACf,CAAC,eAAe,EACf,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACzB,UAAsC,EACtC,eAA2C;IAE3C,MAAM,mBAAmB,GAAG,iBAAiB,CAC5C,UAAU,EAAE,mBAAmB,EAC/B,eAAe,EAAE,mBAAmB,CACpC,CAAC;IACF,MAAM,yBAAyB,GAAG,iBAAiB,CAClD,UAAU,EAAE,yBAAyB,EACrC,eAAe,EAAE,yBAAyB,CAC1C,CAAC;IACF,MAAM,qBAAqB,GAAG,iBAAiB,CAC9C,UAAU,EAAE,qBAAqB,EACjC,eAAe,EAAE,qBAAqB,CACtC,CAAC;IAEF,IACC,mBAAmB,KAAK,SAAS;QACjC,yBAAyB,KAAK,SAAS;QACvC,qBAAqB,KAAK,SAAS,EAClC,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,yBAAyB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE;YAC/B,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,UAAmC,EACnC,eAAwC;IAExC,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC;IACxC,IAAI,CAAC,eAAe;QAAE,OAAO,UAAU,CAAC;IAExC,MAAM,MAAM,GAAqB;QAChC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK;YAC5C,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;IAEF,MAAM,KAAK,GAAG,yBAAyB,CACtC,UAAU,CAAC,KAAK,EAChB,eAAe,CAAC,KAAK,CACrB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAEhC,MAAM,YAAY,GAAG,yBAAyB,CAC7C,UAAU,CAAC,YAAY,EACvB,eAAe,CAAC,YAAY,CAC5B,CAAC;IACF,IAAI,YAAY;QAAE,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAErD,MAAM,MAAM,GAAG,yBAAyB,CACvC,UAAU,CAAC,MAAM,EACjB,eAAe,CAAC,MAAM,CACtB,CAAC;IACF,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,MAAM,KAAK,GAAG,yBAAyB,CACtC,UAAU,CAAC,KAAK,EAChB,eAAe,CAAC,KAAK,CACrB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG,WAAW,CACjC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAC3B,eAAe,CAAC,MAAM,EAAE,QAAQ,CAChC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CACjC,UAAU,CAAC,OAAO,EAClB,eAAe,CAAC,OAAO,CACvB,CAAC;IACF,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAEtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAwB,EAAE,UAAkB;IACzE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACd,qBAAqB,UAAU,KAAK,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAoB;IAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAmB,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACd,uBAAuB,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC7D,CAAC;QACH,CAAC;QACD,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,oBAAoB,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAK,GAAG,KAAK;IACvC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,mEAAmE;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,YAAY,GAAG,IAAI,CAAC;QACpB,eAAe,GAAG,IAAI,CAAC;QACvB,kBAAkB,GAAG,EAAE,CAAC;QACxB,mBAAmB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,YAAY,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7D,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YACnC,mBAAmB,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,UAAU,GAA4B,IAAI,CAAC;QAC/C,IAAI,eAAe,GAA4B,IAAI,CAAC;QAEpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC7B,UAAU,GAAG,YAAY,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACP,eAAe,GAAG,YAAY,CAAC;YAChC,CAAC;QACF,CAAC;QAED,YAAY,GAAG,aAAa,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC1D,kBAAkB,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,MAAM,CACxD,CAAC,MAAM,EAA8B,EAAE,CAAC,MAAM,KAAK,IAAI,CACvD,CAAC;QACF,eAAe,GAAG,SAAS,CAAC;QAC5B,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,YAAY,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACX,4CAA4C,EAC5C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;QACF,kFAAkF;QAClF,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CACrB,OAA8B;IAE9B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,OAAO,CAAC,IAAgC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACpB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,OAA8B;IACpD,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAChC,MAAwB;IAExB,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAgB;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAwB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC1D,OAAO,CACN,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CACzE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC7B,MAAwB,EACxB,OAA8B;IAE9B,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gEAAgE;SACxE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4DAA4D;SACpE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,8EAA8E;aAC/E,CAAC;QACH,CAAC;IACF,CAAC;IAED,IACC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9B,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EACrC,CAAC;QACF,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EACL,+EAA+E;SAChF,CAAC;IACH,CAAC;IAED,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;QAC7C,IAAI,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC3E,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,yEAAyE;aAC1E,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA8B;IAI/D,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,mBAAmB;SAC/G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAwB,EACxB,OAA8B;IAK9B,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjE,IAAI,iBAAiB,EAAE,CAAC;QACvB,OAAO,iBAAiB,CAAC;IAC1B,CAAC;IAED,gCAAgC;IAChC,IACC,MAAM,CAAC,KAAK;QACZ,OAAO,CAAC,IAAI,EAAE,KAAK;QACnB,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,EAClC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC3C,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;SAC7B,CAAC,CAAC;QACH,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,qDAAqD,MAAM,CAAC,KAAK,8BAA8B,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG;SAC5H,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,sCAAsC;aACvE,CAAC;QACH,CAAC;QACD,IAAI,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,+CAA+C;aAChF,CAAC;QACH,CAAC;IACF,CAAC;IAED,iDAAiD;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACb,+CAA+C;YAC/C,MAAM,mBAAmB,GAAG;gBAC3B,sBAAsB,CAAC,YAAY;gBACnC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,OAAO;gBAC9B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;aAC/B,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,yIAAyI;qBAC1I,CAAC;gBACH,CAAC;YACF,CAAC;YAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBAE1C,iEAAiE;gBACjE,2EAA2E;gBAC3E,qDAAqD;gBACrD,MAAM,uBAAuB,GAC5B,mFAAmF,CAAC,IAAI,CACvF,OAAO,CACP,CAAC;gBACH,IACC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,CAAC;oBAC5C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1B,CAAC;oBACF,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,+GAA+G;qBAChH,CAAC;gBACH,CAAC;gBAED,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;gBAEjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACxB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvC,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,6CAA6C;yBACvE,CAAC;oBACH,CAAC;oBACD,IAAI,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5B,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,+CAA+C;yBACzE,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IAED,yBAAyB;IACzB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,YAAY,CAAC;QACrB,CAAC;IACF,CAAC;IAED,oBAAoB;IACpB,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACpD,IAAI,yBAAyB,IAAI,yBAAyB,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YAChE,IAAI,eAAe,GAAG,yBAAyB,EAAE,CAAC;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,yBAAyB,wCAAwC;iBAC5I,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACrC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC3B,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAI/C,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,kBAAkB;SAC9G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAA4B,EAC5B,KAA4D;IAK5D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEtC,uBAAuB;QACvB,IACC,MAAM,CAAC,yBAAyB;YAChC,MAAM,CAAC,yBAAyB,GAAG,CAAC,EACnC,CAAC;YACF,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YACxD,IAAI,eAAe,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACxD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,yBAAyB,wCAAwC;iBACnJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,oBAAoB;QACpB,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,KAAK,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBACnD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,iCAAiC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,mBAAmB,uCAAuC;qBAC9H,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,sDAAsD;gBACtD,gGAAgG;gBAChG,qGAAqG;gBACrG,2EAA2E;gBAC3E,4DAA4D;gBAC5D,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,kCAAkC,MAAM,CAAC,mBAAmB,mEAAmE;iBACvI,CAAC;YACH,CAAC;QACF,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,KAAK,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBAC7C,IAAI,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;oBAC7D,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,sCAAsC,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,qBAAqB,8DAA8D;qBACpK,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,iDAAiD;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uCAAuC,MAAM,CAAC,qBAAqB,qEAAqE;iBAChJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yCAAyC,KAAK,EAAE;SACxD,CAAC;IACH,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC9B,wEAAwE;IACxE,wFAAwF;IACxF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC/B,IAAI,CAAC;QACJ,OAAO,UAAU,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC","sourcesContent":["/**\n * Enterprise Policy System - Access Control and Safety Enforcement\n *\n * This module implements enterprise-grade policy enforcement for the Maestro CLI,\n * enabling organizations to control what tools, models, paths, and network hosts\n * can be accessed during agent execution.\n *\n * ## Policy File Location\n *\n * Policies are loaded from `~/.maestro/policy.json` (or the legacy `.composer`\n * policy file as a fallback) and `.maestro/workspace.toml` in the current\n * workspace. The global JSON file is typically deployed by enterprise IT and\n * should be protected with appropriate permissions. Workspace TOML applies a\n * stricter project-specific layer.\n *\n * ## Policy Structure\n *\n * ```json\n * {\n *   \"orgId\": \"org-12345\",\n *   \"tools\": {\n *     \"allowed\": [\"Read\", \"Grep\", \"Glob\"],\n *     \"blocked\": [\"Bash\", \"Write\"]\n *   },\n *   \"models\": {\n *     \"allowed\": [\"anthropic/claude-*\"],\n *     \"blocked\": [\"openai/*\"]\n *   },\n *   \"paths\": {\n *     \"allowed\": [\"/home/user/projects/**\"],\n *     \"blocked\": [\"/etc/**\", \"/root/**\"]\n *   },\n *   \"network\": {\n *     \"allowedHosts\": [\"api.github.com\"],\n *     \"blockedHosts\": [\"*.internal.corp\"],\n *     \"blockLocalhost\": true,\n *     \"blockPrivateIPs\": true\n *   },\n *   \"limits\": {\n *     \"maxTokensPerSession\": 100000,\n *     \"maxSessionDurationMinutes\": 60,\n *     \"maxConcurrentSessions\": 3\n *   }\n * }\n * ```\n *\n * Workspace policies use TOML keys such as `allowed_models`, `blocked_tools`,\n * `file_boundaries`, and `max_tokens_per_session`.\n *\n * ## Rule Evaluation\n *\n * Policies use an allow/block list pattern with the following evaluation order:\n *\n * 1. If `blocked` list exists and matches → **DENY**\n * 2. If `allowed` list exists and doesn't match → **DENY**\n * 3. Otherwise → **ALLOW**\n *\n * This means:\n * - If only `allowed` is specified, everything else is blocked\n * - If only `blocked` is specified, everything else is allowed\n * - If both are specified, blocked takes precedence\n *\n * ## Pattern Matching\n *\n * Patterns support glob syntax via the `minimatch` library:\n *\n * | Pattern             | Matches                              |\n * |---------------------|--------------------------------------|\n * | `*`                 | Any single segment                   |\n * | `**`                | Any number of segments               |\n * | `*.md`              | Any file ending in .md               |\n * | `src/** (all .ts)`  | Any .ts file under src/              |\n *\n * ## Network Safety\n *\n * Network policies can block:\n * - Specific hosts by name or pattern\n * - Localhost (127.0.0.1, ::1)\n * - Private IP ranges (10.x, 172.16-31.x, 192.168.x)\n *\n * DNS resolution is performed to validate hosts before connection.\n *\n * ## Hot Reloading\n *\n * The policy file is watched for changes and automatically reloaded.\n * This enables policy updates without restarting active sessions.\n *\n * ## Error Handling\n *\n * Policy violations throw `PolicyError` which includes:\n * - The violated rule type (tool, model, path, network)\n * - A user-friendly error message\n * - Context about what was blocked\n *\n * @module safety/policy\n */\n\nimport {\n\ttype FSWatcher,\n\texistsSync,\n\tlstatSync,\n\treadFileSync,\n\twatch,\n} from \"node:fs\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { Type } from \"@sinclair/typebox\";\nimport { parse as parseTOML } from \"smol-toml\";\nimport type { ActionApprovalContext } from \"../agent/action-approval.js\";\nimport { PATHS } from \"../config/constants.js\";\nimport { extractDependencies } from \"../utils/dependency-extractor.js\";\nimport { safeJsonParse } from \"../utils/json.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { getHomeDir, resolveEnvPath } from \"../utils/path-expansion.js\";\nimport { expandHomeDir, resolveRealPath } from \"../utils/path-matcher.js\";\nimport { uniquePaths } from \"../utils/path-utils.js\";\nimport { compileTypeboxSchema } from \"../utils/typebox-ajv.js\";\nimport { dangerousPatterns as shellDangerousPatterns } from \"./bash-safety-analyzer.js\";\nimport { checkModelAccess } from \"./validators/model-policy-validator.js\";\nimport { checkNetworkPolicy } from \"./validators/network-policy-validator.js\";\nimport {\n\tcheckPathPolicy,\n\textractPolicyFilePaths,\n} from \"./validators/path-policy-validator.js\";\n\nconst logger = createLogger(\"safety:policy\");\n\n/**\n * Enterprise policy configuration interface.\n *\n * Defines all available policy controls that organizations can configure\n * to restrict agent behavior according to their security requirements.\n */\nexport interface EnterprisePolicy {\n\t/** Organization identifier for audit logging and policy association */\n\torgId?: string;\n\n\t/** Tool execution restrictions (e.g., block Bash, allow only Read) */\n\ttools?: {\n\t\t/** Whitelist of allowed tool names (glob patterns supported) */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked tool names (takes precedence over allowed) */\n\t\tblocked?: string[];\n\t};\n\n\t/** Package/dependency installation restrictions */\n\tdependencies?: {\n\t\t/** Whitelist of allowed package patterns */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked package patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Model access restrictions (format: \"provider/model-id\") */\n\tmodels?: {\n\t\t/** Whitelist of allowed model patterns (e.g., \"anthropic/*\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked model patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Required skill names for workspace-controlled workflows */\n\tskills?: {\n\t\t/** Skills that must be available for this workspace */\n\t\trequired?: string[];\n\t};\n\n\t/** File system path restrictions */\n\tpaths?: {\n\t\t/** Whitelist of allowed path patterns (e.g., \"/home/user/projects/**\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked path patterns (e.g., \"/etc/**\") */\n\t\tblocked?: string[];\n\t};\n\n\t/** Network access restrictions */\n\tnetwork?: {\n\t\t/** Whitelist of allowed hostnames (e.g., \"api.github.com\") */\n\t\tallowedHosts?: string[];\n\t\t/** Blacklist of blocked hostnames (e.g., \"*.internal.corp\") */\n\t\tblockedHosts?: string[];\n\t\t/** Block access to localhost (127.0.0.1, ::1) */\n\t\tblockLocalhost?: boolean;\n\t\t/** Block access to private IP ranges (10.x, 172.16-31.x, 192.168.x) */\n\t\tblockPrivateIPs?: boolean;\n\t};\n\n\t/**\n\t * Session limits for resource control.\n\t *\n\t * NOTE: These are schema definitions for policy configuration.\n\t * Actual enforcement requires integration with the billing/token-tracker system.\n\t * Currently exposed via getPolicyLimits() for consumers that want to implement limits.\n\t */\n\tlimits?: {\n\t\t/** Maximum tokens per session before termination */\n\t\tmaxTokensPerSession?: number;\n\t\t/** Maximum session duration in minutes */\n\t\tmaxSessionDurationMinutes?: number;\n\t\t/** Maximum concurrent active sessions */\n\t\tmaxConcurrentSessions?: number;\n\t};\n}\n\nconst PolicySchema = Type.Object({\n\torgId: Type.Optional(Type.String()),\n\ttools: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tdependencies: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tmodels: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tskills: Type.Optional(\n\t\tType.Object({\n\t\t\trequired: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tpaths: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tnetwork: Type.Optional(\n\t\tType.Object({\n\t\t\tallowedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockLocalhost: Type.Optional(Type.Boolean()),\n\t\t\tblockPrivateIPs: Type.Optional(Type.Boolean()),\n\t\t}),\n\t),\n\tlimits: Type.Optional(\n\t\tType.Object({\n\t\t\tmaxTokensPerSession: Type.Optional(Type.Number()),\n\t\t\tmaxSessionDurationMinutes: Type.Optional(Type.Number()),\n\t\t\tmaxConcurrentSessions: Type.Optional(Type.Number()),\n\t\t}),\n\t),\n});\n\nconst validatePolicy = compileTypeboxSchema(PolicySchema);\n\ntype PolicyFormat = \"json\" | \"toml\";\ntype PolicyScope = \"user\" | \"workspace\";\ntype UnknownRecord = Record<string, unknown>;\n\ninterface PolicySource {\n\tpath: string;\n\tformat: PolicyFormat;\n\tscope: PolicyScope;\n}\n\nconst getUserPolicyPath = (): string => join(PATHS.MAESTRO_HOME, \"policy.json\");\nconst getLegacyUserPolicyPath = (): string =>\n\tjoin(getHomeDir(), \".composer\", \"policy.json\");\n\nfunction getUserPolicyPathCandidates(): string[] {\n\treturn uniquePaths([\n\t\tresolveEnvPath(process.env.MAESTRO_ENTERPRISE_POLICY_PATH),\n\t\tresolveEnvPath(process.env.MAESTRO_POLICY_PATH),\n\t\tgetUserPolicyPath(),\n\t\tgetLegacyUserPolicyPath(),\n\t]);\n}\n\nfunction getEffectiveUserPolicyPath(): string | null {\n\tconst candidates = getUserPolicyPathCandidates();\n\treturn candidates.find(isPolicyFile) ?? null;\n}\n\nconst isPolicyFile = (path: string): boolean => {\n\tif (!existsSync(path)) return false;\n\ttry {\n\t\treturn lstatSync(path).isFile();\n\t} catch {\n\t\treturn false;\n\t}\n};\n\nconst getWorkspacePolicyPath = (): string | null => {\n\tlet current = resolve(process.cwd());\n\twhile (true) {\n\t\tconst candidate = join(current, \".maestro\", \"workspace.toml\");\n\t\tif (isPolicyFile(candidate)) {\n\t\t\treturn candidate;\n\t\t}\n\t\tconst parent = dirname(current);\n\t\tif (parent === current) {\n\t\t\treturn null;\n\t\t}\n\t\tcurrent = parent;\n\t}\n};\n\nlet cachedPolicy: EnterprisePolicy | null = null;\nlet cachedPolicyKey: string | null = null;\nlet cachedPolicyLayers: EnterprisePolicy[] = [];\nlet policyWatchers: FSWatcher[] = [];\n\nfunction isRecord(value: unknown): value is UnknownRecord {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getPolicySources(): PolicySource[] {\n\tconst sources: PolicySource[] = [];\n\tconst userPolicyPath = getEffectiveUserPolicyPath();\n\tif (userPolicyPath) {\n\t\tsources.push({ path: userPolicyPath, format: \"json\", scope: \"user\" });\n\t}\n\n\tconst workspacePolicyPath = getWorkspacePolicyPath();\n\tif (workspacePolicyPath) {\n\t\tsources.push({\n\t\t\tpath: workspacePolicyPath,\n\t\t\tformat: \"toml\",\n\t\t\tscope: \"workspace\",\n\t\t});\n\t}\n\treturn sources;\n}\n\nfunction getPolicyCacheKey(sources: PolicySource[]): string {\n\treturn sources\n\t\t.map((source) => `${source.scope}:${source.format}:${source.path}`)\n\t\t.join(\"|\");\n}\n\nfunction closePolicyWatchers() {\n\tfor (const watcher of policyWatchers) {\n\t\twatcher.close();\n\t}\n\tpolicyWatchers = [];\n}\n\nfunction startPolicyWatchers(sources: PolicySource[]) {\n\tif (policyWatchers.length > 0) return;\n\n\tfor (const source of sources) {\n\t\ttry {\n\t\t\t// Only watch if the file exists\n\t\t\tif (!isPolicyFile(source.path)) continue;\n\n\t\t\tconst watcher = watch(source.path, (eventType) => {\n\t\t\t\tif (eventType === \"rename\") {\n\t\t\t\t\t// File deleted or renamed\n\t\t\t\t\tcachedPolicy = null;\n\t\t\t\t\tcachedPolicyKey = null;\n\t\t\t\t\tif (!isPolicyFile(source.path)) {\n\t\t\t\t\t\tclosePolicyWatchers();\n\t\t\t\t\t}\n\t\t\t\t} else if (eventType === \"change\") {\n\t\t\t\t\t// File modified - invalidate cache so next loadPolicy() reloads\n\t\t\t\t\t// We don't proactively reload here to avoid race conditions with partial writes\n\t\t\t\t\tcachedPolicy = null;\n\t\t\t\t\tcachedPolicyKey = null;\n\t\t\t\t}\n\t\t\t});\n\t\t\t// Prevent the watcher from keeping the process alive\n\t\t\twatcher.unref();\n\t\t\tpolicyWatchers.push(watcher);\n\t\t} catch (error) {\n\t\t\t// Ignore watcher errors (e.g. system limit reached)\n\t\t\t// We fall back to standard caching behavior\n\t\t}\n\t}\n}\n\nfunction readStringArray(\n\tsource: UnknownRecord,\n\tkey: string,\n): string[] | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (\n\t\t!Array.isArray(value) ||\n\t\t!value.every((entry) => typeof entry === \"string\")\n\t) {\n\t\tthrow new Error(\n\t\t\t`Workspace policy key \"${key}\" must be an array of strings`,\n\t\t);\n\t}\n\treturn value;\n}\n\nfunction readOptionalString(\n\tsource: UnknownRecord,\n\tkey: string,\n): string | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"string\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a string`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalNumber(\n\tsource: UnknownRecord,\n\tkey: string,\n): number | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"number\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a number`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalBoolean(\n\tsource: UnknownRecord,\n\tkey: string,\n): boolean | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"boolean\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a boolean`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalRecord(\n\tsource: UnknownRecord,\n\tkey: string,\n): UnknownRecord | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (!isRecord(value)) {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a table`);\n\t}\n\treturn value;\n}\n\nfunction selectWorkspacePolicyRoot(parsed: unknown): UnknownRecord {\n\tif (!isRecord(parsed)) {\n\t\tthrow new Error(\"Workspace policy must be a TOML table\");\n\t}\n\n\tconst nestedPolicy = parsed.policy;\n\tif (nestedPolicy === undefined) {\n\t\treturn parsed;\n\t}\n\tif (!isRecord(nestedPolicy)) {\n\t\tthrow new Error('Workspace policy key \"policy\" must be a table');\n\t}\n\treturn nestedPolicy;\n}\n\nfunction getWorkspaceStringArray(\n\tsource: UnknownRecord,\n\ttableName: string,\n\ttableKey: string,\n\tflatKey: string,\n): string[] | undefined {\n\tconst flatValue = readStringArray(source, flatKey);\n\tif (flatValue !== undefined) return flatValue;\n\n\tconst table = readOptionalRecord(source, tableName);\n\treturn table ? readStringArray(table, tableKey) : undefined;\n}\n\nfunction mapWorkspacePolicy(parsed: unknown): EnterprisePolicy {\n\tconst source = selectWorkspacePolicyRoot(parsed);\n\tconst policy: EnterprisePolicy = {};\n\n\tconst orgId = readOptionalString(source, \"org_id\");\n\tif (orgId !== undefined) {\n\t\tpolicy.orgId = orgId;\n\t}\n\n\tconst allowedTools = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"tools\",\n\t\t\"allowed\",\n\t\t\"allowed_tools\",\n\t);\n\tconst blockedTools = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"tools\",\n\t\t\"blocked\",\n\t\t\"blocked_tools\",\n\t);\n\tif (allowedTools !== undefined || blockedTools !== undefined) {\n\t\tpolicy.tools = {\n\t\t\t...(allowedTools !== undefined ? { allowed: allowedTools } : {}),\n\t\t\t...(blockedTools !== undefined ? { blocked: blockedTools } : {}),\n\t\t};\n\t}\n\n\tconst allowedModels = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"models\",\n\t\t\"allowed\",\n\t\t\"allowed_models\",\n\t);\n\tconst blockedModels = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"models\",\n\t\t\"blocked\",\n\t\t\"blocked_models\",\n\t);\n\tif (allowedModels !== undefined || blockedModels !== undefined) {\n\t\tpolicy.models = {\n\t\t\t...(allowedModels !== undefined ? { allowed: allowedModels } : {}),\n\t\t\t...(blockedModels !== undefined ? { blocked: blockedModels } : {}),\n\t\t};\n\t}\n\n\tconst fileBoundaries = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"paths\",\n\t\t\"allowed\",\n\t\t\"file_boundaries\",\n\t);\n\tconst blockedPaths = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"paths\",\n\t\t\"blocked\",\n\t\t\"blocked_paths\",\n\t);\n\tif (fileBoundaries !== undefined || blockedPaths !== undefined) {\n\t\tpolicy.paths = {\n\t\t\t...(fileBoundaries !== undefined ? { allowed: fileBoundaries } : {}),\n\t\t\t...(blockedPaths !== undefined ? { blocked: blockedPaths } : {}),\n\t\t};\n\t}\n\n\tconst allowedDependencies = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"dependencies\",\n\t\t\"allowed\",\n\t\t\"allowed_dependencies\",\n\t);\n\tconst blockedDependencies = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"dependencies\",\n\t\t\"blocked\",\n\t\t\"blocked_dependencies\",\n\t);\n\tif (allowedDependencies !== undefined || blockedDependencies !== undefined) {\n\t\tpolicy.dependencies = {\n\t\t\t...(allowedDependencies !== undefined\n\t\t\t\t? { allowed: allowedDependencies }\n\t\t\t\t: {}),\n\t\t\t...(blockedDependencies !== undefined\n\t\t\t\t? { blocked: blockedDependencies }\n\t\t\t\t: {}),\n\t\t};\n\t}\n\n\tconst requiredSkills = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"skills\",\n\t\t\"required\",\n\t\t\"required_skills\",\n\t);\n\tif (requiredSkills !== undefined) {\n\t\tpolicy.skills = { required: requiredSkills };\n\t}\n\n\tconst network = readOptionalRecord(source, \"network\");\n\tif (network) {\n\t\tconst allowedHosts = readStringArray(network, \"allowed_hosts\");\n\t\tconst blockedHosts = readStringArray(network, \"blocked_hosts\");\n\t\tconst blockLocalhost = readOptionalBoolean(network, \"block_localhost\");\n\t\tconst blockPrivateIPs = readOptionalBoolean(network, \"block_private_ips\");\n\t\tif (\n\t\t\tallowedHosts !== undefined ||\n\t\t\tblockedHosts !== undefined ||\n\t\t\tblockLocalhost !== undefined ||\n\t\t\tblockPrivateIPs !== undefined\n\t\t) {\n\t\t\tpolicy.network = {\n\t\t\t\t...(allowedHosts !== undefined ? { allowedHosts } : {}),\n\t\t\t\t...(blockedHosts !== undefined ? { blockedHosts } : {}),\n\t\t\t\t...(blockLocalhost !== undefined ? { blockLocalhost } : {}),\n\t\t\t\t...(blockPrivateIPs !== undefined ? { blockPrivateIPs } : {}),\n\t\t\t};\n\t\t}\n\t}\n\n\tconst maxTokensPerSession = readOptionalNumber(\n\t\tsource,\n\t\t\"max_tokens_per_session\",\n\t);\n\tconst maxSessionDurationMinutes = readOptionalNumber(\n\t\tsource,\n\t\t\"max_session_duration_minutes\",\n\t);\n\tconst maxConcurrentSessions = readOptionalNumber(\n\t\tsource,\n\t\t\"max_concurrent_sessions\",\n\t);\n\tif (\n\t\tmaxTokensPerSession !== undefined ||\n\t\tmaxSessionDurationMinutes !== undefined ||\n\t\tmaxConcurrentSessions !== undefined\n\t) {\n\t\tpolicy.limits = {\n\t\t\t...(maxTokensPerSession !== undefined ? { maxTokensPerSession } : {}),\n\t\t\t...(maxSessionDurationMinutes !== undefined\n\t\t\t\t? { maxSessionDurationMinutes }\n\t\t\t\t: {}),\n\t\t\t...(maxConcurrentSessions !== undefined ? { maxConcurrentSessions } : {}),\n\t\t};\n\t}\n\n\treturn policy;\n}\n\nfunction uniqueUnion(\n\tleft: string[] | undefined,\n\tright: string[] | undefined,\n): string[] | undefined {\n\tconst values = [...(left ?? []), ...(right ?? [])];\n\treturn values.length > 0 ? [...new Set(values)] : undefined;\n}\n\nfunction minPositiveNumber(\n\tleft: number | undefined,\n\tright: number | undefined,\n): number | undefined {\n\tconst values = [left, right].filter(\n\t\t(value): value is number => value !== undefined && value > 0,\n\t);\n\tif (values.length === 0) {\n\t\treturn left ?? right;\n\t}\n\treturn Math.min(...values);\n}\n\nfunction mergeAllowedBlockedPolicy(\n\tuserPolicy: { allowed?: string[]; blocked?: string[] } | undefined,\n\tworkspacePolicy: { allowed?: string[]; blocked?: string[] } | undefined,\n): { allowed?: string[]; blocked?: string[] } | undefined {\n\tconst allowed = workspacePolicy?.allowed ?? userPolicy?.allowed;\n\tconst blocked = uniqueUnion(userPolicy?.blocked, workspacePolicy?.blocked);\n\tif (allowed === undefined && blocked === undefined) return undefined;\n\treturn {\n\t\t...(allowed !== undefined ? { allowed } : {}),\n\t\t...(blocked !== undefined ? { blocked } : {}),\n\t};\n}\n\nfunction mergeNetworkPolicy(\n\tuserPolicy: EnterprisePolicy[\"network\"],\n\tworkspacePolicy: EnterprisePolicy[\"network\"],\n): EnterprisePolicy[\"network\"] {\n\tconst allowedHosts =\n\t\tworkspacePolicy?.allowedHosts ?? userPolicy?.allowedHosts;\n\tconst blockedHosts = uniqueUnion(\n\t\tuserPolicy?.blockedHosts,\n\t\tworkspacePolicy?.blockedHosts,\n\t);\n\tconst blockLocalhost =\n\t\tuserPolicy?.blockLocalhost === true ||\n\t\tworkspacePolicy?.blockLocalhost === true;\n\tconst blockPrivateIPs =\n\t\tuserPolicy?.blockPrivateIPs === true ||\n\t\tworkspacePolicy?.blockPrivateIPs === true;\n\n\tif (\n\t\tallowedHosts === undefined &&\n\t\tblockedHosts === undefined &&\n\t\t!blockLocalhost &&\n\t\t!blockPrivateIPs\n\t) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\t...(allowedHosts !== undefined ? { allowedHosts } : {}),\n\t\t...(blockedHosts !== undefined ? { blockedHosts } : {}),\n\t\t...(blockLocalhost ? { blockLocalhost } : {}),\n\t\t...(blockPrivateIPs ? { blockPrivateIPs } : {}),\n\t};\n}\n\nfunction mergePolicyLimits(\n\tuserPolicy: EnterprisePolicy[\"limits\"],\n\tworkspacePolicy: EnterprisePolicy[\"limits\"],\n): EnterprisePolicy[\"limits\"] {\n\tconst maxTokensPerSession = minPositiveNumber(\n\t\tuserPolicy?.maxTokensPerSession,\n\t\tworkspacePolicy?.maxTokensPerSession,\n\t);\n\tconst maxSessionDurationMinutes = minPositiveNumber(\n\t\tuserPolicy?.maxSessionDurationMinutes,\n\t\tworkspacePolicy?.maxSessionDurationMinutes,\n\t);\n\tconst maxConcurrentSessions = minPositiveNumber(\n\t\tuserPolicy?.maxConcurrentSessions,\n\t\tworkspacePolicy?.maxConcurrentSessions,\n\t);\n\n\tif (\n\t\tmaxTokensPerSession === undefined &&\n\t\tmaxSessionDurationMinutes === undefined &&\n\t\tmaxConcurrentSessions === undefined\n\t) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\t...(maxTokensPerSession !== undefined ? { maxTokensPerSession } : {}),\n\t\t...(maxSessionDurationMinutes !== undefined\n\t\t\t? { maxSessionDurationMinutes }\n\t\t\t: {}),\n\t\t...(maxConcurrentSessions !== undefined ? { maxConcurrentSessions } : {}),\n\t};\n}\n\nfunction mergePolicies(\n\tuserPolicy: EnterprisePolicy | null,\n\tworkspacePolicy: EnterprisePolicy | null,\n): EnterprisePolicy | null {\n\tif (!userPolicy) return workspacePolicy;\n\tif (!workspacePolicy) return userPolicy;\n\n\tconst policy: EnterprisePolicy = {\n\t\t...(userPolicy.orgId || workspacePolicy.orgId\n\t\t\t? { orgId: workspacePolicy.orgId ?? userPolicy.orgId }\n\t\t\t: {}),\n\t};\n\n\tconst tools = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.tools,\n\t\tworkspacePolicy.tools,\n\t);\n\tif (tools) policy.tools = tools;\n\n\tconst dependencies = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.dependencies,\n\t\tworkspacePolicy.dependencies,\n\t);\n\tif (dependencies) policy.dependencies = dependencies;\n\n\tconst models = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.models,\n\t\tworkspacePolicy.models,\n\t);\n\tif (models) policy.models = models;\n\n\tconst paths = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.paths,\n\t\tworkspacePolicy.paths,\n\t);\n\tif (paths) policy.paths = paths;\n\n\tconst requiredSkills = uniqueUnion(\n\t\tuserPolicy.skills?.required,\n\t\tworkspacePolicy.skills?.required,\n\t);\n\tif (requiredSkills) {\n\t\tpolicy.skills = { required: requiredSkills };\n\t}\n\n\tconst network = mergeNetworkPolicy(\n\t\tuserPolicy.network,\n\t\tworkspacePolicy.network,\n\t);\n\tif (network) policy.network = network;\n\n\tconst limits = mergePolicyLimits(userPolicy.limits, workspacePolicy.limits);\n\tif (limits) policy.limits = limits;\n\n\treturn policy;\n}\n\nfunction validateLoadedPolicy(policy: EnterprisePolicy, sourcePath: string) {\n\tif (!validatePolicy(policy)) {\n\t\tthrow new Error(\n\t\t\t`Invalid schema in ${sourcePath}: ${validatePolicy.errors?.map((e) => e.message).join(\", \")}`,\n\t\t);\n\t}\n}\n\nfunction loadPolicySource(source: PolicySource): EnterprisePolicy {\n\tconst raw = readFileSync(source.path, \"utf8\");\n\tif (source.format === \"json\") {\n\t\tconst result = safeJsonParse<EnterprisePolicy>(raw);\n\t\tif (!result.success) {\n\t\t\tthrow new Error(\n\t\t\t\t`JSON parse error in ${source.path}: ${result.error.message}`,\n\t\t\t);\n\t\t}\n\t\tvalidateLoadedPolicy(result.data, source.path);\n\t\treturn result.data;\n\t}\n\n\tconst workspacePolicy = mapWorkspacePolicy(parseTOML(raw));\n\tvalidateLoadedPolicy(workspacePolicy, source.path);\n\treturn workspacePolicy;\n}\n\nexport function loadPolicy(force = false): EnterprisePolicy | null {\n\tconst sources = getPolicySources();\n\t// Check if file exists first - if not, clear cache and return null\n\tif (sources.length === 0) {\n\t\tcachedPolicy = null;\n\t\tcachedPolicyKey = null;\n\t\tcachedPolicyLayers = [];\n\t\tclosePolicyWatchers();\n\t\treturn null;\n\t}\n\n\tconst policyKey = getPolicyCacheKey(sources);\n\tif (cachedPolicy && cachedPolicyKey === policyKey && !force) {\n\t\treturn cachedPolicy;\n\t}\n\n\ttry {\n\t\tif (cachedPolicyKey !== policyKey) {\n\t\t\tclosePolicyWatchers();\n\t\t}\n\n\t\tlet userPolicy: EnterprisePolicy | null = null;\n\t\tlet workspacePolicy: EnterprisePolicy | null = null;\n\n\t\tfor (const source of sources) {\n\t\t\tconst loadedPolicy = loadPolicySource(source);\n\t\t\tif (source.scope === \"user\") {\n\t\t\t\tuserPolicy = loadedPolicy;\n\t\t\t} else {\n\t\t\t\tworkspacePolicy = loadedPolicy;\n\t\t\t}\n\t\t}\n\n\t\tcachedPolicy = mergePolicies(userPolicy, workspacePolicy);\n\t\tcachedPolicyLayers = [userPolicy, workspacePolicy].filter(\n\t\t\t(policy): policy is EnterprisePolicy => policy !== null,\n\t\t);\n\t\tcachedPolicyKey = policyKey;\n\t\tstartPolicyWatchers(sources);\n\t\treturn cachedPolicy;\n\t} catch (error) {\n\t\tlogger.error(\n\t\t\t\"Critical: Failed to load enterprise policy\",\n\t\t\terror instanceof Error ? error : new Error(String(error)),\n\t\t);\n\t\t// Throw to ensure we fail closed (block access) rather than treating as no policy\n\t\tthrow error;\n\t}\n}\n\nfunction getArgsObject(\n\tcontext: ActionApprovalContext,\n): Record<string, unknown> | null {\n\treturn context.args && typeof context.args === \"object\"\n\t\t? (context.args as Record<string, unknown>)\n\t\t: null;\n}\n\nfunction getStringArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): string | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"string\" ? value : null;\n}\n\nfunction getCommandArg(context: ActionApprovalContext): string | null {\n\treturn getStringArg(context, \"command\");\n}\n\nfunction getEffectivePolicyLayers(\n\tpolicy: EnterprisePolicy,\n): EnterprisePolicy[] {\n\treturn cachedPolicyLayers.length > 0 ? cachedPolicyLayers : [policy];\n}\n\nfunction hasOwnKey(value: object, key: PropertyKey): boolean {\n\treturn Object.prototype.hasOwnProperty.call(value, key);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n\treturn typeof value === \"string\" && value.trim().length > 0;\n}\n\nfunction hasActiveDurationLimit(policy: EnterprisePolicy): boolean {\n\tconst duration = policy.limits?.maxSessionDurationMinutes;\n\treturn (\n\t\ttypeof duration === \"number\" && Number.isFinite(duration) && duration > 0\n\t);\n}\n\nfunction validatePolicyContext(\n\tpolicy: EnterprisePolicy,\n\tcontext: ActionApprovalContext,\n): { allowed: false; reason: string } | null {\n\tif (!isNonEmptyString(context.toolName)) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Policy evaluation context is missing required field: toolName.\",\n\t\t};\n\t}\n\n\tif (!hasOwnKey(context, \"args\")) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Policy evaluation context is missing required field: args.\",\n\t\t};\n\t}\n\n\tif (context.user) {\n\t\tif (!isNonEmptyString(context.user.orgId)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Policy evaluation context has invalid user context: missing organization id.\",\n\t\t\t};\n\t\t}\n\t}\n\n\tif (\n\t\tisNonEmptyString(policy.orgId) &&\n\t\t!isNonEmptyString(context.user?.orgId)\n\t) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason:\n\t\t\t\t\"Organization-bound policy requires user organization context. Access blocked.\",\n\t\t};\n\t}\n\n\tif (hasActiveDurationLimit(policy)) {\n\t\tconst startedAt = context.session?.startedAt;\n\t\tif (!(startedAt instanceof Date) || !Number.isFinite(startedAt.getTime())) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Session duration policy requires session start context. Access blocked.\",\n\t\t\t};\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport async function checkPolicy(context: ActionApprovalContext): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Access blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\tfor (const policyLayer of getEffectivePolicyLayers(policy)) {\n\t\tconst result = await checkPolicyLayer(policyLayer, context);\n\t\tif (!result.allowed) {\n\t\t\treturn result;\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nasync function checkPolicyLayer(\n\tpolicy: EnterprisePolicy,\n\tcontext: ActionApprovalContext,\n): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tconst contextValidation = validatePolicyContext(policy, context);\n\tif (contextValidation) {\n\t\treturn contextValidation;\n\t}\n\n\t// 0. Organization Context Check\n\tif (\n\t\tpolicy.orgId &&\n\t\tcontext.user?.orgId &&\n\t\tpolicy.orgId !== context.user.orgId\n\t) {\n\t\tlogger.warn(\"Org mismatch, action blocked\", {\n\t\t\tpolicyOrgId: policy.orgId,\n\t\t\tuserOrgId: context.user.orgId,\n\t\t});\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Organization mismatch: This machine is managed by ${policy.orgId}, but you are signed in to ${context.user.orgId}.`,\n\t\t};\n\t}\n\n\t// 1. Tool Constraints\n\tif (policy.tools) {\n\t\tconst { allowed, blocked } = policy.tools;\n\t\tif (allowed && !allowed.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is not in the approved tools list.`,\n\t\t\t};\n\t\t}\n\t\tif (blocked?.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is explicitly blocked by enterprise policy.`,\n\t\t\t};\n\t\t}\n\t}\n\n\t// 2. Dangerous Patterns & Dependency Constraints\n\tif (context.toolName === \"bash\" || context.toolName === \"background_tasks\") {\n\t\tconst command = getCommandArg(context);\n\t\tif (command) {\n\t\t\t// Check for obfuscation and dangerous patterns\n\t\t\tconst obfuscationPatterns = [\n\t\t\t\tshellDangerousPatterns.base64Decode,\n\t\t\t\tshellDangerousPatterns.opensslEnc,\n\t\t\t\tshellDangerousPatterns.pythonEval,\n\t\t\t\tshellDangerousPatterns.perlEval,\n\t\t\t\tshellDangerousPatterns.nodeEval,\n\t\t\t\tshellDangerousPatterns.phpEval,\n\t\t\t\tshellDangerousPatterns.rubyEval,\n\t\t\t\tshellDangerousPatterns.evalCall,\n\t\t\t\tshellDangerousPatterns.execCall,\n\t\t\t];\n\t\t\tfor (const pattern of obfuscationPatterns) {\n\t\t\t\tif (pattern.test(command)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains obfuscated or dangerous patterns (e.g. base64 decoding, inline code execution) which are blocked by enterprise policy.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (policy.dependencies) {\n\t\t\t\tconst deps = extractDependencies(command);\n\n\t\t\t\t// Check for shell metacharacters in any package install command,\n\t\t\t\t// even when no explicit package names are extracted (e.g., \"npm install\").\n\t\t\t\t// This prevents bypass via \"npm install && rm -rf /\"\n\t\t\t\tconst isPackageInstallCommand =\n\t\t\t\t\t/(?:npm|yarn|pnpm|bun|pip|pip3|gem|cargo|go\\s+get|composer)\\s+(?:install|add|i\\b)/i.test(\n\t\t\t\t\t\tcommand,\n\t\t\t\t\t);\n\t\t\t\tif (\n\t\t\t\t\t(deps.length > 0 || isPackageInstallCommand) &&\n\t\t\t\t\t/[;&|`$()<>]/.test(command)\n\t\t\t\t) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains shell metacharacters which are not allowed by enterprise policy during package installation.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\tconst { allowed, blocked } = policy.dependencies;\n\n\t\t\t\tfor (const dep of deps) {\n\t\t\t\t\tif (allowed && !allowed.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is not in the approved dependencies list.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t\tif (blocked?.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is explicitly blocked by enterprise policy.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\t// 3. Path Constraints\n\tif (policy.paths) {\n\t\tconst filePaths = extractPolicyFilePaths(context);\n\t\tconst pathCheck = checkPathPolicy(filePaths, policy.paths);\n\t\tif (!pathCheck.allowed) {\n\t\t\treturn pathCheck;\n\t\t}\n\t}\n\n\t// 4. Network Constraints\n\tif (policy.network) {\n\t\tconst networkCheck = await checkNetworkPolicy(context, policy.network);\n\t\tif (!networkCheck.allowed) {\n\t\t\treturn networkCheck;\n\t\t}\n\t}\n\n\t// 5. Session Limits\n\tif (policy.limits && context.session) {\n\t\tconst { maxSessionDurationMinutes } = policy.limits;\n\t\tif (maxSessionDurationMinutes && maxSessionDurationMinutes > 0) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - context.session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nexport class PolicyError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"PolicyError\";\n\t}\n}\n\n/**\n * Check if a model is allowed by policy\n * Called separately from tool checks since model selection happens at a different time\n */\nexport function checkModelPolicy(modelId: string): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Model blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\tfor (const policyLayer of getEffectivePolicyLayers(policy)) {\n\t\tif (!policyLayer.models) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst result = checkModelAccess(modelId, policyLayer.models);\n\t\tif (!result.allowed) {\n\t\t\treturn result;\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\n/**\n * Check if the current session has exceeded policy limits\n */\nexport function checkSessionLimits(\n\tsession: { startedAt: Date },\n\tusage?: { tokenCount?: number; activeSessionCount?: number },\n): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\ttry {\n\t\tconst limits = getPolicyLimits();\n\t\tif (!limits) return { allowed: true };\n\n\t\t// Check duration limit\n\t\tif (\n\t\t\tlimits.maxSessionDurationMinutes &&\n\t\t\tlimits.maxSessionDurationMinutes > 0\n\t\t) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > limits.maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${limits.maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check token limit\n\t\tif (limits.maxTokensPerSession && limits.maxTokensPerSession > 0) {\n\t\t\tif (usage?.tokenCount !== undefined) {\n\t\t\t\tif (usage.tokenCount > limits.maxTokensPerSession) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Session token limit exceeded (${usage.tokenCount}/${limits.maxTokensPerSession} tokens). Please start a new session.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Usage undefined but limit is set - should we block?\n\t\t\t\t// To be safe (fail-closed) for strict limits, we probably should if we can't verify compliance.\n\t\t\t\t// However, if usage is undefined because metrics are disabled/failing, this might be too aggressive.\n\t\t\t\t// Given user feedback \"Fail-Open Error Handling\", we should warn or block.\n\t\t\t\t// Let's block if we can't verify usage against a set limit.\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session token limit is active (${limits.maxTokensPerSession}) but token usage data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check concurrent sessions limit\n\t\tif (limits.maxConcurrentSessions && limits.maxConcurrentSessions > 0) {\n\t\t\tif (usage?.activeSessionCount !== undefined) {\n\t\t\t\tif (usage.activeSessionCount > limits.maxConcurrentSessions) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Concurrent session limit exceeded (${usage.activeSessionCount}/${limits.maxConcurrentSessions}). Please close existing sessions before starting a new one.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Same fail-closed logic for concurrent sessions\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Concurrent session limit is active (${limits.maxConcurrentSessions}) but session count data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn { allowed: true };\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Policy error checking session limits: ${error}`,\n\t\t};\n\t}\n}\n\n/**\n * Get the current policy limits\n */\nexport function getPolicyLimits(): EnterprisePolicy[\"limits\"] | null {\n\t// Catch errors and return null (no limits) to prevent crashing callers.\n\t// Strict enforcement should rely on checkSessionLimits() which handles its own loading.\n\ttry {\n\t\tconst policy = loadPolicy();\n\t\treturn policy?.limits ?? null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Get the full loaded policy (for admin UI display)\n */\nexport function getCurrentPolicy(): EnterprisePolicy | null {\n\ttry {\n\t\treturn loadPolicy();\n\t} catch {\n\t\treturn null;\n\t}\n}\n"]}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/safety/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,OAAO,EAEN,UAAU,EACV,SAAS,EACT,YAAY,EACZ,KAAK,GACL,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,IAAI,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EACN,eAAe,EACf,sBAAsB,GACtB,MAAM,uCAAuC,CAAC;AAE/C,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AA+E7C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACnC,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KAClD,CAAC,CACF;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KACjD,CAAC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7C,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;KAC9C,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjD,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACvD,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KACnD,CAAC,CACF;CACD,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAY1D,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAChF,MAAM,uBAAuB,GAAG,GAAW,EAAE,CAC5C,IAAI,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAEhD,SAAS,2BAA2B;IACnC,OAAO,WAAW,CAAC;QAClB,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC1D,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC/C,iBAAiB,EAAE;QACnB,uBAAuB,EAAE;KACzB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IAClC,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC;QACJ,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,GAAkB,EAAE;IAClD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC9D,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAEF,IAAI,YAAY,GAA4B,IAAI,CAAC;AACjD,IAAI,eAAe,GAAkB,IAAI,CAAC;AAC1C,IAAI,kBAAkB,GAAuB,EAAE,CAAC;AAChD,IAAI,cAAc,GAAgB,EAAE,CAAC;AAErC,SAAS,gBAAgB;IACxB,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,cAAc,GAAG,0BAA0B,EAAE,CAAC;IACpD,IAAI,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,mBAAmB,GAAG,sBAAsB,EAAE,CAAC;IACrD,IAAI,mBAAmB,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,WAAW;SAClB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB;IACjD,OAAO,OAAO;SACZ,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;SAClE,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB;IAC3B,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IACD,cAAc,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAuB;IACnD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,gCAAgC;YAChC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAEzC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;gBAChD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC5B,0BAA0B;oBAC1B,YAAY,GAAG,IAAI,CAAC;oBACpB,eAAe,GAAG,IAAI,CAAC;oBACvB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChC,mBAAmB,EAAE,CAAC;oBACvB,CAAC;gBACF,CAAC;qBAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBACnC,gEAAgE;oBAChE,gFAAgF;oBAChF,YAAY,GAAG,IAAI,CAAC;oBACpB,eAAe,GAAG,IAAI,CAAC;gBACxB,CAAC;YACF,CAAC,CAAC,CAAC;YACH,qDAAqD;YACrD,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,oDAAoD;YACpD,4CAA4C;QAC7C,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CACvB,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACjD,CAAC;QACF,MAAM,IAAI,KAAK,CACd,yBAAyB,GAAG,+BAA+B,CAC3D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAC3B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,qBAAqB,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAqB,EACrB,GAAW;IAEX,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,mBAAmB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAe;IACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IACf,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,SAAS,uBAAuB,CAC/B,MAAqB,EACrB,SAAiB,EACjB,QAAgB,EAChB,OAAe;IAEf,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IAC1C,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,CAChB,CAAC;IACF,MAAM,aAAa,GAAG,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,CAChB,CAAC;IACF,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,MAAM,GAAG;YACf,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAC7C,MAAM,EACN,OAAO,EACP,SAAS,EACT,iBAAiB,CACjB,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC3C,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CACf,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,KAAK,GAAG;YACd,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,uBAAuB,CAClD,MAAM,EACN,cAAc,EACd,SAAS,EACT,sBAAsB,CACtB,CAAC;IACF,MAAM,mBAAmB,GAAG,uBAAuB,CAClD,MAAM,EACN,cAAc,EACd,SAAS,EACT,sBAAsB,CACtB,CAAC;IACF,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,CAAC,YAAY,GAAG;YACrB,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;SACN,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAC7C,MAAM,EACN,QAAQ,EACR,UAAU,EACV,iBAAiB,CACjB,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC1E,IACC,YAAY,KAAK,SAAS;YAC1B,YAAY,KAAK,SAAS;YAC1B,cAAc,KAAK,SAAS;YAC5B,eAAe,KAAK,SAAS,EAC5B,CAAC;YACF,MAAM,CAAC,OAAO,GAAG;gBAChB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,mBAAmB,GAAG,kBAAkB,CAC7C,MAAM,EACN,wBAAwB,CACxB,CAAC;IACF,MAAM,yBAAyB,GAAG,kBAAkB,CACnD,MAAM,EACN,8BAA8B,CAC9B,CAAC;IACF,MAAM,qBAAqB,GAAG,kBAAkB,CAC/C,MAAM,EACN,yBAAyB,CACzB,CAAC;IACF,IACC,mBAAmB,KAAK,SAAS;QACjC,yBAAyB,KAAK,SAAS;QACvC,qBAAqB,KAAK,SAAS,EAClC,CAAC;QACF,MAAM,CAAC,MAAM,GAAG;YACf,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,yBAAyB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CACnB,IAA0B,EAC1B,KAA2B;IAE3B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CACzB,IAAwB,EACxB,KAAyB;IAEzB,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,CAClC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,CAC5D,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,IAAI,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,yBAAyB,CACjC,UAAkE,EAClE,eAAuE;IAEvE,MAAM,OAAO,GAAG,eAAe,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,CAAC;IAChE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO;QACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAC1B,UAAuC,EACvC,eAA4C;IAE5C,MAAM,YAAY,GACjB,eAAe,EAAE,YAAY,IAAI,UAAU,EAAE,YAAY,CAAC;IAC3D,MAAM,YAAY,GAAG,WAAW,CAC/B,UAAU,EAAE,YAAY,EACxB,eAAe,EAAE,YAAY,CAC7B,CAAC;IACF,MAAM,cAAc,GACnB,UAAU,EAAE,cAAc,KAAK,IAAI;QACnC,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;IAC1C,MAAM,eAAe,GACpB,UAAU,EAAE,eAAe,KAAK,IAAI;QACpC,eAAe,EAAE,eAAe,KAAK,IAAI,CAAC;IAE3C,IACC,YAAY,KAAK,SAAS;QAC1B,YAAY,KAAK,SAAS;QAC1B,CAAC,cAAc;QACf,CAAC,eAAe,EACf,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACzB,UAAsC,EACtC,eAA2C;IAE3C,MAAM,mBAAmB,GAAG,iBAAiB,CAC5C,UAAU,EAAE,mBAAmB,EAC/B,eAAe,EAAE,mBAAmB,CACpC,CAAC;IACF,MAAM,yBAAyB,GAAG,iBAAiB,CAClD,UAAU,EAAE,yBAAyB,EACrC,eAAe,EAAE,yBAAyB,CAC1C,CAAC;IACF,MAAM,qBAAqB,GAAG,iBAAiB,CAC9C,UAAU,EAAE,qBAAqB,EACjC,eAAe,EAAE,qBAAqB,CACtC,CAAC;IAEF,IACC,mBAAmB,KAAK,SAAS;QACjC,yBAAyB,KAAK,SAAS;QACvC,qBAAqB,KAAK,SAAS,EAClC,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,yBAAyB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,yBAAyB,EAAE;YAC/B,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,UAAmC,EACnC,eAAwC;IAExC,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC;IACxC,IAAI,CAAC,eAAe;QAAE,OAAO,UAAU,CAAC;IAExC,MAAM,MAAM,GAAqB;QAChC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK;YAC5C,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;IAEF,MAAM,KAAK,GAAG,yBAAyB,CACtC,UAAU,CAAC,KAAK,EAChB,eAAe,CAAC,KAAK,CACrB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAEhC,MAAM,YAAY,GAAG,yBAAyB,CAC7C,UAAU,CAAC,YAAY,EACvB,eAAe,CAAC,YAAY,CAC5B,CAAC;IACF,IAAI,YAAY;QAAE,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAErD,MAAM,MAAM,GAAG,yBAAyB,CACvC,UAAU,CAAC,MAAM,EACjB,eAAe,CAAC,MAAM,CACtB,CAAC;IACF,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,MAAM,KAAK,GAAG,yBAAyB,CACtC,UAAU,CAAC,KAAK,EAChB,eAAe,CAAC,KAAK,CACrB,CAAC;IACF,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAEhC,MAAM,cAAc,GAAG,WAAW,CACjC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAC3B,eAAe,CAAC,MAAM,EAAE,QAAQ,CAChC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CACjC,UAAU,CAAC,OAAO,EAClB,eAAe,CAAC,OAAO,CACvB,CAAC;IACF,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAEtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAwB,EAAE,UAAkB;IACzE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACd,qBAAqB,UAAU,KAAK,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAoB;IAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAmB,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACd,uBAAuB,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC7D,CAAC;QACH,CAAC;QACD,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,oBAAoB,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAK,GAAG,KAAK;IACvC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,mEAAmE;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,YAAY,GAAG,IAAI,CAAC;QACpB,eAAe,GAAG,IAAI,CAAC;QACvB,kBAAkB,GAAG,EAAE,CAAC;QACxB,mBAAmB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,YAAY,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7D,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACJ,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YACnC,mBAAmB,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,UAAU,GAA4B,IAAI,CAAC;QAC/C,IAAI,eAAe,GAA4B,IAAI,CAAC;QAEpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC7B,UAAU,GAAG,YAAY,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACP,eAAe,GAAG,YAAY,CAAC;YAChC,CAAC;QACF,CAAC;QAED,YAAY,GAAG,aAAa,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC1D,kBAAkB,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,MAAM,CACxD,CAAC,MAAM,EAA8B,EAAE,CAAC,MAAM,KAAK,IAAI,CACvD,CAAC;QACF,eAAe,GAAG,SAAS,CAAC;QAC5B,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,YAAY,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACX,4CAA4C,EAC5C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;QACF,kFAAkF;QAClF,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CACrB,OAA8B;IAE9B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,OAAO,CAAC,IAAgC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CACpB,OAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,OAA8B;IACpD,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAChC,MAAwB;IAExB,OAAO,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAgB;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAwB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC1D,OAAO,CACN,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CACzE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC7B,MAAwB,EACxB,OAA8B;IAE9B,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gEAAgE;SACxE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4DAA4D;SACpE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,8EAA8E;aAC/E,CAAC;QACH,CAAC;IACF,CAAC;IAED,IACC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9B,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EACrC,CAAC;QACF,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EACL,+EAA+E;SAChF,CAAC;IACH,CAAC;IAED,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;QAC7C,IAAI,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC3E,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EACL,yEAAyE;aAC1E,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA8B;IAI/D,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,mBAAmB;SAC/G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAwB,EACxB,OAA8B;IAK9B,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjE,IAAI,iBAAiB,EAAE,CAAC;QACvB,OAAO,iBAAiB,CAAC;IAC1B,CAAC;IAED,gCAAgC;IAChC,IACC,MAAM,CAAC,KAAK;QACZ,OAAO,CAAC,IAAI,EAAE,KAAK;QACnB,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,EAClC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC3C,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;SAC7B,CAAC,CAAC;QACH,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,qDAAqD,MAAM,CAAC,KAAK,8BAA8B,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG;SAC5H,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,sCAAsC;aACvE,CAAC;QACH,CAAC;QACD,IAAI,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,OAAO,CAAC,QAAQ,+CAA+C;aAChF,CAAC;QACH,CAAC;IACF,CAAC;IAED,iDAAiD;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACb,+CAA+C;YAC/C,MAAM,mBAAmB,GAAG;gBAC3B,sBAAsB,CAAC,YAAY;gBACnC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,UAAU;gBACjC,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,OAAO;gBAC9B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;gBAC/B,sBAAsB,CAAC,QAAQ;aAC/B,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,yIAAyI;qBAC1I,CAAC;gBACH,CAAC;YACF,CAAC;YAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBAE1C,iEAAiE;gBACjE,2EAA2E;gBAC3E,qDAAqD;gBACrD,MAAM,uBAAuB,GAC5B,mFAAmF,CAAC,IAAI,CACvF,OAAO,CACP,CAAC;gBACH,IACC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,uBAAuB,CAAC;oBAC5C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1B,CAAC;oBACF,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EACL,+GAA+G;qBAChH,CAAC;gBACH,CAAC;gBAED,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;gBAEjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACxB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvC,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,6CAA6C;yBACvE,CAAC;oBACH,CAAC;oBACD,IAAI,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5B,OAAO;4BACN,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,eAAe,GAAG,+CAA+C;yBACzE,CAAC;oBACH,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IAED,yBAAyB;IACzB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,YAAY,CAAC;QACrB,CAAC;IACF,CAAC;IAED,oBAAoB;IACpB,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACpD,IAAI,yBAAyB,IAAI,yBAAyB,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YAChE,IAAI,eAAe,GAAG,yBAAyB,EAAE,CAAC;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,yBAAyB,wCAAwC;iBAC5I,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACrC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC3B,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAI/C,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,UAAU,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,kBAAkB;SAC9G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAA4B,EAC5B,KAA4D;IAK5D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEtC,uBAAuB;QACvB,IACC,MAAM,CAAC,yBAAyB;YAChC,MAAM,CAAC,yBAAyB,GAAG,CAAC,EACnC,CAAC;YACF,MAAM,eAAe,GACpB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YACxD,IAAI,eAAe,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACxD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,yBAAyB,wCAAwC;iBACnJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,oBAAoB;QACpB,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,KAAK,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBACnD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,iCAAiC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,mBAAmB,uCAAuC;qBAC9H,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,sDAAsD;gBACtD,gGAAgG;gBAChG,qGAAqG;gBACrG,2EAA2E;gBAC3E,4DAA4D;gBAC5D,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,kCAAkC,MAAM,CAAC,mBAAmB,mEAAmE;iBACvI,CAAC;YACH,CAAC;QACF,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,KAAK,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBAC7C,IAAI,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;oBAC7D,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,sCAAsC,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,qBAAqB,8DAA8D;qBACpK,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,iDAAiD;gBACjD,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uCAAuC,MAAM,CAAC,qBAAqB,qEAAqE;iBAChJ,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yCAAyC,KAAK,EAAE;SACxD,CAAC;IACH,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC9B,wEAAwE;IACxE,wFAAwF;IACxF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC/B,IAAI,CAAC;QACJ,OAAO,UAAU,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC","sourcesContent":["/**\n * Enterprise Policy System - Access Control and Safety Enforcement\n *\n * This module implements enterprise-grade policy enforcement for the Maestro CLI,\n * enabling organizations to control what tools, models, paths, and network hosts\n * can be accessed during agent execution.\n *\n * ## Policy File Location\n *\n * Policies are loaded from `~/.maestro/policy.json` (or the legacy `.composer`\n * policy file as a fallback) and `.maestro/workspace.toml` in the current\n * workspace. The global JSON file is typically deployed by enterprise IT and\n * should be protected with appropriate permissions. Workspace TOML applies a\n * stricter project-specific layer.\n *\n * ## Policy Structure\n *\n * ```json\n * {\n *   \"orgId\": \"org-12345\",\n *   \"tools\": {\n *     \"allowed\": [\"Read\", \"Grep\", \"Glob\"],\n *     \"blocked\": [\"Bash\", \"Write\"]\n *   },\n *   \"models\": {\n *     \"allowed\": [\"anthropic/claude-*\"],\n *     \"blocked\": [\"openai/*\"]\n *   },\n *   \"paths\": {\n *     \"allowed\": [\"/home/user/projects/**\"],\n *     \"blocked\": [\"/etc/**\", \"/root/**\"]\n *   },\n *   \"network\": {\n *     \"allowedHosts\": [\"api.github.com\"],\n *     \"blockedHosts\": [\"*.internal.corp\"],\n *     \"blockLocalhost\": true,\n *     \"blockPrivateIPs\": true\n *   },\n *   \"limits\": {\n *     \"maxTokensPerSession\": 100000,\n *     \"maxSessionDurationMinutes\": 60,\n *     \"maxConcurrentSessions\": 3\n *   }\n * }\n * ```\n *\n * Workspace policies use TOML keys such as `allowed_models`, `blocked_tools`,\n * `file_boundaries`, and `max_tokens_per_session`.\n *\n * ## Rule Evaluation\n *\n * Policies use an allow/block list pattern with the following evaluation order:\n *\n * 1. If `blocked` list exists and matches → **DENY**\n * 2. If `allowed` list exists and doesn't match → **DENY**\n * 3. Otherwise → **ALLOW**\n *\n * This means:\n * - If only `allowed` is specified, everything else is blocked\n * - If only `blocked` is specified, everything else is allowed\n * - If both are specified, blocked takes precedence\n *\n * ## Pattern Matching\n *\n * Patterns support glob syntax via the `minimatch` library:\n *\n * | Pattern             | Matches                              |\n * |---------------------|--------------------------------------|\n * | `*`                 | Any single segment                   |\n * | `**`                | Any number of segments               |\n * | `*.md`              | Any file ending in .md               |\n * | `src/** (all .ts)`  | Any .ts file under src/              |\n *\n * ## Network Safety\n *\n * Network policies can block:\n * - Specific hosts by name or pattern\n * - Localhost (127.0.0.1, ::1)\n * - Private IP ranges (10.x, 172.16-31.x, 192.168.x)\n *\n * DNS resolution is performed to validate hosts before connection.\n *\n * ## Hot Reloading\n *\n * The policy file is watched for changes and automatically reloaded.\n * This enables policy updates without restarting active sessions.\n *\n * ## Error Handling\n *\n * Policy violations throw `PolicyError` which includes:\n * - The violated rule type (tool, model, path, network)\n * - A user-friendly error message\n * - Context about what was blocked\n *\n * @module safety/policy\n */\n\nimport {\n\ttype FSWatcher,\n\texistsSync,\n\tlstatSync,\n\treadFileSync,\n\twatch,\n} from \"node:fs\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { Type } from \"@sinclair/typebox\";\nimport { parse as parseTOML } from \"smol-toml\";\nimport type { ActionApprovalContext } from \"../agent/action-approval.js\";\nimport { PATHS } from \"../config/constants.js\";\nimport { extractDependencies } from \"../utils/dependency-extractor.js\";\nimport { isRecord, safeJsonParse } from \"../utils/json.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { getHomeDir, resolveEnvPath } from \"../utils/path-expansion.js\";\nimport { expandHomeDir, resolveRealPath } from \"../utils/path-matcher.js\";\nimport { uniquePaths } from \"../utils/path-utils.js\";\nimport { compileTypeboxSchema } from \"../utils/typebox-ajv.js\";\nimport { dangerousPatterns as shellDangerousPatterns } from \"./bash-safety-analyzer.js\";\nimport { checkModelAccess } from \"./validators/model-policy-validator.js\";\nimport { checkNetworkPolicy } from \"./validators/network-policy-validator.js\";\nimport {\n\tcheckPathPolicy,\n\textractPolicyFilePaths,\n} from \"./validators/path-policy-validator.js\";\n\nconst logger = createLogger(\"safety:policy\");\n\n/**\n * Enterprise policy configuration interface.\n *\n * Defines all available policy controls that organizations can configure\n * to restrict agent behavior according to their security requirements.\n */\nexport interface EnterprisePolicy {\n\t/** Organization identifier for audit logging and policy association */\n\torgId?: string;\n\n\t/** Tool execution restrictions (e.g., block Bash, allow only Read) */\n\ttools?: {\n\t\t/** Whitelist of allowed tool names (glob patterns supported) */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked tool names (takes precedence over allowed) */\n\t\tblocked?: string[];\n\t};\n\n\t/** Package/dependency installation restrictions */\n\tdependencies?: {\n\t\t/** Whitelist of allowed package patterns */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked package patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Model access restrictions (format: \"provider/model-id\") */\n\tmodels?: {\n\t\t/** Whitelist of allowed model patterns (e.g., \"anthropic/*\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked model patterns */\n\t\tblocked?: string[];\n\t};\n\n\t/** Required skill names for workspace-controlled workflows */\n\tskills?: {\n\t\t/** Skills that must be available for this workspace */\n\t\trequired?: string[];\n\t};\n\n\t/** File system path restrictions */\n\tpaths?: {\n\t\t/** Whitelist of allowed path patterns (e.g., \"/home/user/projects/**\") */\n\t\tallowed?: string[];\n\t\t/** Blacklist of blocked path patterns (e.g., \"/etc/**\") */\n\t\tblocked?: string[];\n\t};\n\n\t/** Network access restrictions */\n\tnetwork?: {\n\t\t/** Whitelist of allowed hostnames (e.g., \"api.github.com\") */\n\t\tallowedHosts?: string[];\n\t\t/** Blacklist of blocked hostnames (e.g., \"*.internal.corp\") */\n\t\tblockedHosts?: string[];\n\t\t/** Block access to localhost (127.0.0.1, ::1) */\n\t\tblockLocalhost?: boolean;\n\t\t/** Block access to private IP ranges (10.x, 172.16-31.x, 192.168.x) */\n\t\tblockPrivateIPs?: boolean;\n\t};\n\n\t/**\n\t * Session limits for resource control.\n\t *\n\t * NOTE: These are schema definitions for policy configuration.\n\t * Actual enforcement requires integration with the billing/token-tracker system.\n\t * Currently exposed via getPolicyLimits() for consumers that want to implement limits.\n\t */\n\tlimits?: {\n\t\t/** Maximum tokens per session before termination */\n\t\tmaxTokensPerSession?: number;\n\t\t/** Maximum session duration in minutes */\n\t\tmaxSessionDurationMinutes?: number;\n\t\t/** Maximum concurrent active sessions */\n\t\tmaxConcurrentSessions?: number;\n\t};\n}\n\nconst PolicySchema = Type.Object({\n\torgId: Type.Optional(Type.String()),\n\ttools: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tdependencies: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tmodels: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tskills: Type.Optional(\n\t\tType.Object({\n\t\t\trequired: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tpaths: Type.Optional(\n\t\tType.Object({\n\t\t\tallowed: Type.Optional(Type.Array(Type.String())),\n\t\t\tblocked: Type.Optional(Type.Array(Type.String())),\n\t\t}),\n\t),\n\tnetwork: Type.Optional(\n\t\tType.Object({\n\t\t\tallowedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockedHosts: Type.Optional(Type.Array(Type.String())),\n\t\t\tblockLocalhost: Type.Optional(Type.Boolean()),\n\t\t\tblockPrivateIPs: Type.Optional(Type.Boolean()),\n\t\t}),\n\t),\n\tlimits: Type.Optional(\n\t\tType.Object({\n\t\t\tmaxTokensPerSession: Type.Optional(Type.Number()),\n\t\t\tmaxSessionDurationMinutes: Type.Optional(Type.Number()),\n\t\t\tmaxConcurrentSessions: Type.Optional(Type.Number()),\n\t\t}),\n\t),\n});\n\nconst validatePolicy = compileTypeboxSchema(PolicySchema);\n\ntype PolicyFormat = \"json\" | \"toml\";\ntype PolicyScope = \"user\" | \"workspace\";\ntype UnknownRecord = Record<string, unknown>;\n\ninterface PolicySource {\n\tpath: string;\n\tformat: PolicyFormat;\n\tscope: PolicyScope;\n}\n\nconst getUserPolicyPath = (): string => join(PATHS.MAESTRO_HOME, \"policy.json\");\nconst getLegacyUserPolicyPath = (): string =>\n\tjoin(getHomeDir(), \".composer\", \"policy.json\");\n\nfunction getUserPolicyPathCandidates(): string[] {\n\treturn uniquePaths([\n\t\tresolveEnvPath(process.env.MAESTRO_ENTERPRISE_POLICY_PATH),\n\t\tresolveEnvPath(process.env.MAESTRO_POLICY_PATH),\n\t\tgetUserPolicyPath(),\n\t\tgetLegacyUserPolicyPath(),\n\t]);\n}\n\nfunction getEffectiveUserPolicyPath(): string | null {\n\tconst candidates = getUserPolicyPathCandidates();\n\treturn candidates.find(isPolicyFile) ?? null;\n}\n\nconst isPolicyFile = (path: string): boolean => {\n\tif (!existsSync(path)) return false;\n\ttry {\n\t\treturn lstatSync(path).isFile();\n\t} catch {\n\t\treturn false;\n\t}\n};\n\nconst getWorkspacePolicyPath = (): string | null => {\n\tlet current = resolve(process.cwd());\n\twhile (true) {\n\t\tconst candidate = join(current, \".maestro\", \"workspace.toml\");\n\t\tif (isPolicyFile(candidate)) {\n\t\t\treturn candidate;\n\t\t}\n\t\tconst parent = dirname(current);\n\t\tif (parent === current) {\n\t\t\treturn null;\n\t\t}\n\t\tcurrent = parent;\n\t}\n};\n\nlet cachedPolicy: EnterprisePolicy | null = null;\nlet cachedPolicyKey: string | null = null;\nlet cachedPolicyLayers: EnterprisePolicy[] = [];\nlet policyWatchers: FSWatcher[] = [];\n\nfunction getPolicySources(): PolicySource[] {\n\tconst sources: PolicySource[] = [];\n\tconst userPolicyPath = getEffectiveUserPolicyPath();\n\tif (userPolicyPath) {\n\t\tsources.push({ path: userPolicyPath, format: \"json\", scope: \"user\" });\n\t}\n\n\tconst workspacePolicyPath = getWorkspacePolicyPath();\n\tif (workspacePolicyPath) {\n\t\tsources.push({\n\t\t\tpath: workspacePolicyPath,\n\t\t\tformat: \"toml\",\n\t\t\tscope: \"workspace\",\n\t\t});\n\t}\n\treturn sources;\n}\n\nfunction getPolicyCacheKey(sources: PolicySource[]): string {\n\treturn sources\n\t\t.map((source) => `${source.scope}:${source.format}:${source.path}`)\n\t\t.join(\"|\");\n}\n\nfunction closePolicyWatchers() {\n\tfor (const watcher of policyWatchers) {\n\t\twatcher.close();\n\t}\n\tpolicyWatchers = [];\n}\n\nfunction startPolicyWatchers(sources: PolicySource[]) {\n\tif (policyWatchers.length > 0) return;\n\n\tfor (const source of sources) {\n\t\ttry {\n\t\t\t// Only watch if the file exists\n\t\t\tif (!isPolicyFile(source.path)) continue;\n\n\t\t\tconst watcher = watch(source.path, (eventType) => {\n\t\t\t\tif (eventType === \"rename\") {\n\t\t\t\t\t// File deleted or renamed\n\t\t\t\t\tcachedPolicy = null;\n\t\t\t\t\tcachedPolicyKey = null;\n\t\t\t\t\tif (!isPolicyFile(source.path)) {\n\t\t\t\t\t\tclosePolicyWatchers();\n\t\t\t\t\t}\n\t\t\t\t} else if (eventType === \"change\") {\n\t\t\t\t\t// File modified - invalidate cache so next loadPolicy() reloads\n\t\t\t\t\t// We don't proactively reload here to avoid race conditions with partial writes\n\t\t\t\t\tcachedPolicy = null;\n\t\t\t\t\tcachedPolicyKey = null;\n\t\t\t\t}\n\t\t\t});\n\t\t\t// Prevent the watcher from keeping the process alive\n\t\t\twatcher.unref();\n\t\t\tpolicyWatchers.push(watcher);\n\t\t} catch (error) {\n\t\t\t// Ignore watcher errors (e.g. system limit reached)\n\t\t\t// We fall back to standard caching behavior\n\t\t}\n\t}\n}\n\nfunction readStringArray(\n\tsource: UnknownRecord,\n\tkey: string,\n): string[] | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (\n\t\t!Array.isArray(value) ||\n\t\t!value.every((entry) => typeof entry === \"string\")\n\t) {\n\t\tthrow new Error(\n\t\t\t`Workspace policy key \"${key}\" must be an array of strings`,\n\t\t);\n\t}\n\treturn value;\n}\n\nfunction readOptionalString(\n\tsource: UnknownRecord,\n\tkey: string,\n): string | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"string\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a string`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalNumber(\n\tsource: UnknownRecord,\n\tkey: string,\n): number | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"number\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a number`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalBoolean(\n\tsource: UnknownRecord,\n\tkey: string,\n): boolean | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (typeof value !== \"boolean\") {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a boolean`);\n\t}\n\treturn value;\n}\n\nfunction readOptionalRecord(\n\tsource: UnknownRecord,\n\tkey: string,\n): UnknownRecord | undefined {\n\tif (!(key in source)) return undefined;\n\n\tconst value = source[key];\n\tif (!isRecord(value)) {\n\t\tthrow new Error(`Workspace policy key \"${key}\" must be a table`);\n\t}\n\treturn value;\n}\n\nfunction selectWorkspacePolicyRoot(parsed: unknown): UnknownRecord {\n\tif (!isRecord(parsed)) {\n\t\tthrow new Error(\"Workspace policy must be a TOML table\");\n\t}\n\n\tconst nestedPolicy = parsed.policy;\n\tif (nestedPolicy === undefined) {\n\t\treturn parsed;\n\t}\n\tif (!isRecord(nestedPolicy)) {\n\t\tthrow new Error('Workspace policy key \"policy\" must be a table');\n\t}\n\treturn nestedPolicy;\n}\n\nfunction getWorkspaceStringArray(\n\tsource: UnknownRecord,\n\ttableName: string,\n\ttableKey: string,\n\tflatKey: string,\n): string[] | undefined {\n\tconst flatValue = readStringArray(source, flatKey);\n\tif (flatValue !== undefined) return flatValue;\n\n\tconst table = readOptionalRecord(source, tableName);\n\treturn table ? readStringArray(table, tableKey) : undefined;\n}\n\nfunction mapWorkspacePolicy(parsed: unknown): EnterprisePolicy {\n\tconst source = selectWorkspacePolicyRoot(parsed);\n\tconst policy: EnterprisePolicy = {};\n\n\tconst orgId = readOptionalString(source, \"org_id\");\n\tif (orgId !== undefined) {\n\t\tpolicy.orgId = orgId;\n\t}\n\n\tconst allowedTools = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"tools\",\n\t\t\"allowed\",\n\t\t\"allowed_tools\",\n\t);\n\tconst blockedTools = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"tools\",\n\t\t\"blocked\",\n\t\t\"blocked_tools\",\n\t);\n\tif (allowedTools !== undefined || blockedTools !== undefined) {\n\t\tpolicy.tools = {\n\t\t\t...(allowedTools !== undefined ? { allowed: allowedTools } : {}),\n\t\t\t...(blockedTools !== undefined ? { blocked: blockedTools } : {}),\n\t\t};\n\t}\n\n\tconst allowedModels = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"models\",\n\t\t\"allowed\",\n\t\t\"allowed_models\",\n\t);\n\tconst blockedModels = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"models\",\n\t\t\"blocked\",\n\t\t\"blocked_models\",\n\t);\n\tif (allowedModels !== undefined || blockedModels !== undefined) {\n\t\tpolicy.models = {\n\t\t\t...(allowedModels !== undefined ? { allowed: allowedModels } : {}),\n\t\t\t...(blockedModels !== undefined ? { blocked: blockedModels } : {}),\n\t\t};\n\t}\n\n\tconst fileBoundaries = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"paths\",\n\t\t\"allowed\",\n\t\t\"file_boundaries\",\n\t);\n\tconst blockedPaths = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"paths\",\n\t\t\"blocked\",\n\t\t\"blocked_paths\",\n\t);\n\tif (fileBoundaries !== undefined || blockedPaths !== undefined) {\n\t\tpolicy.paths = {\n\t\t\t...(fileBoundaries !== undefined ? { allowed: fileBoundaries } : {}),\n\t\t\t...(blockedPaths !== undefined ? { blocked: blockedPaths } : {}),\n\t\t};\n\t}\n\n\tconst allowedDependencies = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"dependencies\",\n\t\t\"allowed\",\n\t\t\"allowed_dependencies\",\n\t);\n\tconst blockedDependencies = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"dependencies\",\n\t\t\"blocked\",\n\t\t\"blocked_dependencies\",\n\t);\n\tif (allowedDependencies !== undefined || blockedDependencies !== undefined) {\n\t\tpolicy.dependencies = {\n\t\t\t...(allowedDependencies !== undefined\n\t\t\t\t? { allowed: allowedDependencies }\n\t\t\t\t: {}),\n\t\t\t...(blockedDependencies !== undefined\n\t\t\t\t? { blocked: blockedDependencies }\n\t\t\t\t: {}),\n\t\t};\n\t}\n\n\tconst requiredSkills = getWorkspaceStringArray(\n\t\tsource,\n\t\t\"skills\",\n\t\t\"required\",\n\t\t\"required_skills\",\n\t);\n\tif (requiredSkills !== undefined) {\n\t\tpolicy.skills = { required: requiredSkills };\n\t}\n\n\tconst network = readOptionalRecord(source, \"network\");\n\tif (network) {\n\t\tconst allowedHosts = readStringArray(network, \"allowed_hosts\");\n\t\tconst blockedHosts = readStringArray(network, \"blocked_hosts\");\n\t\tconst blockLocalhost = readOptionalBoolean(network, \"block_localhost\");\n\t\tconst blockPrivateIPs = readOptionalBoolean(network, \"block_private_ips\");\n\t\tif (\n\t\t\tallowedHosts !== undefined ||\n\t\t\tblockedHosts !== undefined ||\n\t\t\tblockLocalhost !== undefined ||\n\t\t\tblockPrivateIPs !== undefined\n\t\t) {\n\t\t\tpolicy.network = {\n\t\t\t\t...(allowedHosts !== undefined ? { allowedHosts } : {}),\n\t\t\t\t...(blockedHosts !== undefined ? { blockedHosts } : {}),\n\t\t\t\t...(blockLocalhost !== undefined ? { blockLocalhost } : {}),\n\t\t\t\t...(blockPrivateIPs !== undefined ? { blockPrivateIPs } : {}),\n\t\t\t};\n\t\t}\n\t}\n\n\tconst maxTokensPerSession = readOptionalNumber(\n\t\tsource,\n\t\t\"max_tokens_per_session\",\n\t);\n\tconst maxSessionDurationMinutes = readOptionalNumber(\n\t\tsource,\n\t\t\"max_session_duration_minutes\",\n\t);\n\tconst maxConcurrentSessions = readOptionalNumber(\n\t\tsource,\n\t\t\"max_concurrent_sessions\",\n\t);\n\tif (\n\t\tmaxTokensPerSession !== undefined ||\n\t\tmaxSessionDurationMinutes !== undefined ||\n\t\tmaxConcurrentSessions !== undefined\n\t) {\n\t\tpolicy.limits = {\n\t\t\t...(maxTokensPerSession !== undefined ? { maxTokensPerSession } : {}),\n\t\t\t...(maxSessionDurationMinutes !== undefined\n\t\t\t\t? { maxSessionDurationMinutes }\n\t\t\t\t: {}),\n\t\t\t...(maxConcurrentSessions !== undefined ? { maxConcurrentSessions } : {}),\n\t\t};\n\t}\n\n\treturn policy;\n}\n\nfunction uniqueUnion(\n\tleft: string[] | undefined,\n\tright: string[] | undefined,\n): string[] | undefined {\n\tconst values = [...(left ?? []), ...(right ?? [])];\n\treturn values.length > 0 ? [...new Set(values)] : undefined;\n}\n\nfunction minPositiveNumber(\n\tleft: number | undefined,\n\tright: number | undefined,\n): number | undefined {\n\tconst values = [left, right].filter(\n\t\t(value): value is number => value !== undefined && value > 0,\n\t);\n\tif (values.length === 0) {\n\t\treturn left ?? right;\n\t}\n\treturn Math.min(...values);\n}\n\nfunction mergeAllowedBlockedPolicy(\n\tuserPolicy: { allowed?: string[]; blocked?: string[] } | undefined,\n\tworkspacePolicy: { allowed?: string[]; blocked?: string[] } | undefined,\n): { allowed?: string[]; blocked?: string[] } | undefined {\n\tconst allowed = workspacePolicy?.allowed ?? userPolicy?.allowed;\n\tconst blocked = uniqueUnion(userPolicy?.blocked, workspacePolicy?.blocked);\n\tif (allowed === undefined && blocked === undefined) return undefined;\n\treturn {\n\t\t...(allowed !== undefined ? { allowed } : {}),\n\t\t...(blocked !== undefined ? { blocked } : {}),\n\t};\n}\n\nfunction mergeNetworkPolicy(\n\tuserPolicy: EnterprisePolicy[\"network\"],\n\tworkspacePolicy: EnterprisePolicy[\"network\"],\n): EnterprisePolicy[\"network\"] {\n\tconst allowedHosts =\n\t\tworkspacePolicy?.allowedHosts ?? userPolicy?.allowedHosts;\n\tconst blockedHosts = uniqueUnion(\n\t\tuserPolicy?.blockedHosts,\n\t\tworkspacePolicy?.blockedHosts,\n\t);\n\tconst blockLocalhost =\n\t\tuserPolicy?.blockLocalhost === true ||\n\t\tworkspacePolicy?.blockLocalhost === true;\n\tconst blockPrivateIPs =\n\t\tuserPolicy?.blockPrivateIPs === true ||\n\t\tworkspacePolicy?.blockPrivateIPs === true;\n\n\tif (\n\t\tallowedHosts === undefined &&\n\t\tblockedHosts === undefined &&\n\t\t!blockLocalhost &&\n\t\t!blockPrivateIPs\n\t) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\t...(allowedHosts !== undefined ? { allowedHosts } : {}),\n\t\t...(blockedHosts !== undefined ? { blockedHosts } : {}),\n\t\t...(blockLocalhost ? { blockLocalhost } : {}),\n\t\t...(blockPrivateIPs ? { blockPrivateIPs } : {}),\n\t};\n}\n\nfunction mergePolicyLimits(\n\tuserPolicy: EnterprisePolicy[\"limits\"],\n\tworkspacePolicy: EnterprisePolicy[\"limits\"],\n): EnterprisePolicy[\"limits\"] {\n\tconst maxTokensPerSession = minPositiveNumber(\n\t\tuserPolicy?.maxTokensPerSession,\n\t\tworkspacePolicy?.maxTokensPerSession,\n\t);\n\tconst maxSessionDurationMinutes = minPositiveNumber(\n\t\tuserPolicy?.maxSessionDurationMinutes,\n\t\tworkspacePolicy?.maxSessionDurationMinutes,\n\t);\n\tconst maxConcurrentSessions = minPositiveNumber(\n\t\tuserPolicy?.maxConcurrentSessions,\n\t\tworkspacePolicy?.maxConcurrentSessions,\n\t);\n\n\tif (\n\t\tmaxTokensPerSession === undefined &&\n\t\tmaxSessionDurationMinutes === undefined &&\n\t\tmaxConcurrentSessions === undefined\n\t) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\t...(maxTokensPerSession !== undefined ? { maxTokensPerSession } : {}),\n\t\t...(maxSessionDurationMinutes !== undefined\n\t\t\t? { maxSessionDurationMinutes }\n\t\t\t: {}),\n\t\t...(maxConcurrentSessions !== undefined ? { maxConcurrentSessions } : {}),\n\t};\n}\n\nfunction mergePolicies(\n\tuserPolicy: EnterprisePolicy | null,\n\tworkspacePolicy: EnterprisePolicy | null,\n): EnterprisePolicy | null {\n\tif (!userPolicy) return workspacePolicy;\n\tif (!workspacePolicy) return userPolicy;\n\n\tconst policy: EnterprisePolicy = {\n\t\t...(userPolicy.orgId || workspacePolicy.orgId\n\t\t\t? { orgId: workspacePolicy.orgId ?? userPolicy.orgId }\n\t\t\t: {}),\n\t};\n\n\tconst tools = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.tools,\n\t\tworkspacePolicy.tools,\n\t);\n\tif (tools) policy.tools = tools;\n\n\tconst dependencies = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.dependencies,\n\t\tworkspacePolicy.dependencies,\n\t);\n\tif (dependencies) policy.dependencies = dependencies;\n\n\tconst models = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.models,\n\t\tworkspacePolicy.models,\n\t);\n\tif (models) policy.models = models;\n\n\tconst paths = mergeAllowedBlockedPolicy(\n\t\tuserPolicy.paths,\n\t\tworkspacePolicy.paths,\n\t);\n\tif (paths) policy.paths = paths;\n\n\tconst requiredSkills = uniqueUnion(\n\t\tuserPolicy.skills?.required,\n\t\tworkspacePolicy.skills?.required,\n\t);\n\tif (requiredSkills) {\n\t\tpolicy.skills = { required: requiredSkills };\n\t}\n\n\tconst network = mergeNetworkPolicy(\n\t\tuserPolicy.network,\n\t\tworkspacePolicy.network,\n\t);\n\tif (network) policy.network = network;\n\n\tconst limits = mergePolicyLimits(userPolicy.limits, workspacePolicy.limits);\n\tif (limits) policy.limits = limits;\n\n\treturn policy;\n}\n\nfunction validateLoadedPolicy(policy: EnterprisePolicy, sourcePath: string) {\n\tif (!validatePolicy(policy)) {\n\t\tthrow new Error(\n\t\t\t`Invalid schema in ${sourcePath}: ${validatePolicy.errors?.map((e) => e.message).join(\", \")}`,\n\t\t);\n\t}\n}\n\nfunction loadPolicySource(source: PolicySource): EnterprisePolicy {\n\tconst raw = readFileSync(source.path, \"utf8\");\n\tif (source.format === \"json\") {\n\t\tconst result = safeJsonParse<EnterprisePolicy>(raw);\n\t\tif (!result.success) {\n\t\t\tthrow new Error(\n\t\t\t\t`JSON parse error in ${source.path}: ${result.error.message}`,\n\t\t\t);\n\t\t}\n\t\tvalidateLoadedPolicy(result.data, source.path);\n\t\treturn result.data;\n\t}\n\n\tconst workspacePolicy = mapWorkspacePolicy(parseTOML(raw));\n\tvalidateLoadedPolicy(workspacePolicy, source.path);\n\treturn workspacePolicy;\n}\n\nexport function loadPolicy(force = false): EnterprisePolicy | null {\n\tconst sources = getPolicySources();\n\t// Check if file exists first - if not, clear cache and return null\n\tif (sources.length === 0) {\n\t\tcachedPolicy = null;\n\t\tcachedPolicyKey = null;\n\t\tcachedPolicyLayers = [];\n\t\tclosePolicyWatchers();\n\t\treturn null;\n\t}\n\n\tconst policyKey = getPolicyCacheKey(sources);\n\tif (cachedPolicy && cachedPolicyKey === policyKey && !force) {\n\t\treturn cachedPolicy;\n\t}\n\n\ttry {\n\t\tif (cachedPolicyKey !== policyKey) {\n\t\t\tclosePolicyWatchers();\n\t\t}\n\n\t\tlet userPolicy: EnterprisePolicy | null = null;\n\t\tlet workspacePolicy: EnterprisePolicy | null = null;\n\n\t\tfor (const source of sources) {\n\t\t\tconst loadedPolicy = loadPolicySource(source);\n\t\t\tif (source.scope === \"user\") {\n\t\t\t\tuserPolicy = loadedPolicy;\n\t\t\t} else {\n\t\t\t\tworkspacePolicy = loadedPolicy;\n\t\t\t}\n\t\t}\n\n\t\tcachedPolicy = mergePolicies(userPolicy, workspacePolicy);\n\t\tcachedPolicyLayers = [userPolicy, workspacePolicy].filter(\n\t\t\t(policy): policy is EnterprisePolicy => policy !== null,\n\t\t);\n\t\tcachedPolicyKey = policyKey;\n\t\tstartPolicyWatchers(sources);\n\t\treturn cachedPolicy;\n\t} catch (error) {\n\t\tlogger.error(\n\t\t\t\"Critical: Failed to load enterprise policy\",\n\t\t\terror instanceof Error ? error : new Error(String(error)),\n\t\t);\n\t\t// Throw to ensure we fail closed (block access) rather than treating as no policy\n\t\tthrow error;\n\t}\n}\n\nfunction getArgsObject(\n\tcontext: ActionApprovalContext,\n): Record<string, unknown> | null {\n\treturn context.args && typeof context.args === \"object\"\n\t\t? (context.args as Record<string, unknown>)\n\t\t: null;\n}\n\nfunction getStringArg(\n\tcontext: ActionApprovalContext,\n\tkey: string,\n): string | null {\n\tconst args = getArgsObject(context);\n\tif (!args) {\n\t\treturn null;\n\t}\n\tconst value = args[key];\n\treturn typeof value === \"string\" ? value : null;\n}\n\nfunction getCommandArg(context: ActionApprovalContext): string | null {\n\treturn getStringArg(context, \"command\");\n}\n\nfunction getEffectivePolicyLayers(\n\tpolicy: EnterprisePolicy,\n): EnterprisePolicy[] {\n\treturn cachedPolicyLayers.length > 0 ? cachedPolicyLayers : [policy];\n}\n\nfunction hasOwnKey(value: object, key: PropertyKey): boolean {\n\treturn Object.prototype.hasOwnProperty.call(value, key);\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n\treturn typeof value === \"string\" && value.trim().length > 0;\n}\n\nfunction hasActiveDurationLimit(policy: EnterprisePolicy): boolean {\n\tconst duration = policy.limits?.maxSessionDurationMinutes;\n\treturn (\n\t\ttypeof duration === \"number\" && Number.isFinite(duration) && duration > 0\n\t);\n}\n\nfunction validatePolicyContext(\n\tpolicy: EnterprisePolicy,\n\tcontext: ActionApprovalContext,\n): { allowed: false; reason: string } | null {\n\tif (!isNonEmptyString(context.toolName)) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Policy evaluation context is missing required field: toolName.\",\n\t\t};\n\t}\n\n\tif (!hasOwnKey(context, \"args\")) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: \"Policy evaluation context is missing required field: args.\",\n\t\t};\n\t}\n\n\tif (context.user) {\n\t\tif (!isNonEmptyString(context.user.orgId)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Policy evaluation context has invalid user context: missing organization id.\",\n\t\t\t};\n\t\t}\n\t}\n\n\tif (\n\t\tisNonEmptyString(policy.orgId) &&\n\t\t!isNonEmptyString(context.user?.orgId)\n\t) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason:\n\t\t\t\t\"Organization-bound policy requires user organization context. Access blocked.\",\n\t\t};\n\t}\n\n\tif (hasActiveDurationLimit(policy)) {\n\t\tconst startedAt = context.session?.startedAt;\n\t\tif (!(startedAt instanceof Date) || !Number.isFinite(startedAt.getTime())) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason:\n\t\t\t\t\t\"Session duration policy requires session start context. Access blocked.\",\n\t\t\t};\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport async function checkPolicy(context: ActionApprovalContext): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Access blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\tfor (const policyLayer of getEffectivePolicyLayers(policy)) {\n\t\tconst result = await checkPolicyLayer(policyLayer, context);\n\t\tif (!result.allowed) {\n\t\t\treturn result;\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nasync function checkPolicyLayer(\n\tpolicy: EnterprisePolicy,\n\tcontext: ActionApprovalContext,\n): Promise<{\n\tallowed: boolean;\n\treason?: string;\n}> {\n\tconst contextValidation = validatePolicyContext(policy, context);\n\tif (contextValidation) {\n\t\treturn contextValidation;\n\t}\n\n\t// 0. Organization Context Check\n\tif (\n\t\tpolicy.orgId &&\n\t\tcontext.user?.orgId &&\n\t\tpolicy.orgId !== context.user.orgId\n\t) {\n\t\tlogger.warn(\"Org mismatch, action blocked\", {\n\t\t\tpolicyOrgId: policy.orgId,\n\t\t\tuserOrgId: context.user.orgId,\n\t\t});\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Organization mismatch: This machine is managed by ${policy.orgId}, but you are signed in to ${context.user.orgId}.`,\n\t\t};\n\t}\n\n\t// 1. Tool Constraints\n\tif (policy.tools) {\n\t\tconst { allowed, blocked } = policy.tools;\n\t\tif (allowed && !allowed.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is not in the approved tools list.`,\n\t\t\t};\n\t\t}\n\t\tif (blocked?.includes(context.toolName)) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\treason: `Tool \"${context.toolName}\" is explicitly blocked by enterprise policy.`,\n\t\t\t};\n\t\t}\n\t}\n\n\t// 2. Dangerous Patterns & Dependency Constraints\n\tif (context.toolName === \"bash\" || context.toolName === \"background_tasks\") {\n\t\tconst command = getCommandArg(context);\n\t\tif (command) {\n\t\t\t// Check for obfuscation and dangerous patterns\n\t\t\tconst obfuscationPatterns = [\n\t\t\t\tshellDangerousPatterns.base64Decode,\n\t\t\t\tshellDangerousPatterns.opensslEnc,\n\t\t\t\tshellDangerousPatterns.pythonEval,\n\t\t\t\tshellDangerousPatterns.perlEval,\n\t\t\t\tshellDangerousPatterns.nodeEval,\n\t\t\t\tshellDangerousPatterns.phpEval,\n\t\t\t\tshellDangerousPatterns.rubyEval,\n\t\t\t\tshellDangerousPatterns.evalCall,\n\t\t\t\tshellDangerousPatterns.execCall,\n\t\t\t];\n\t\t\tfor (const pattern of obfuscationPatterns) {\n\t\t\t\tif (pattern.test(command)) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains obfuscated or dangerous patterns (e.g. base64 decoding, inline code execution) which are blocked by enterprise policy.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (policy.dependencies) {\n\t\t\t\tconst deps = extractDependencies(command);\n\n\t\t\t\t// Check for shell metacharacters in any package install command,\n\t\t\t\t// even when no explicit package names are extracted (e.g., \"npm install\").\n\t\t\t\t// This prevents bypass via \"npm install && rm -rf /\"\n\t\t\t\tconst isPackageInstallCommand =\n\t\t\t\t\t/(?:npm|yarn|pnpm|bun|pip|pip3|gem|cargo|go\\s+get|composer)\\s+(?:install|add|i\\b)/i.test(\n\t\t\t\t\t\tcommand,\n\t\t\t\t\t);\n\t\t\t\tif (\n\t\t\t\t\t(deps.length > 0 || isPackageInstallCommand) &&\n\t\t\t\t\t/[;&|`$()<>]/.test(command)\n\t\t\t\t) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\"Command contains shell metacharacters which are not allowed by enterprise policy during package installation.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\tconst { allowed, blocked } = policy.dependencies;\n\n\t\t\t\tfor (const dep of deps) {\n\t\t\t\t\tif (allowed && !allowed.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is not in the approved dependencies list.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t\tif (blocked?.includes(dep)) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\t\treason: `Dependency \"${dep}\" is explicitly blocked by enterprise policy.`,\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\t// 3. Path Constraints\n\tif (policy.paths) {\n\t\tconst filePaths = extractPolicyFilePaths(context);\n\t\tconst pathCheck = checkPathPolicy(filePaths, policy.paths);\n\t\tif (!pathCheck.allowed) {\n\t\t\treturn pathCheck;\n\t\t}\n\t}\n\n\t// 4. Network Constraints\n\tif (policy.network) {\n\t\tconst networkCheck = await checkNetworkPolicy(context, policy.network);\n\t\tif (!networkCheck.allowed) {\n\t\t\treturn networkCheck;\n\t\t}\n\t}\n\n\t// 5. Session Limits\n\tif (policy.limits && context.session) {\n\t\tconst { maxSessionDurationMinutes } = policy.limits;\n\t\tif (maxSessionDurationMinutes && maxSessionDurationMinutes > 0) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - context.session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\nexport class PolicyError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"PolicyError\";\n\t}\n}\n\n/**\n * Check if a model is allowed by policy\n * Called separately from tool checks since model selection happens at a different time\n */\nexport function checkModelPolicy(modelId: string): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\tlet policy: EnterprisePolicy | null;\n\ttry {\n\t\tpolicy = loadPolicy();\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Enterprise policy error: ${error instanceof Error ? error.message : \"Unknown error\"}. Model blocked.`,\n\t\t};\n\t}\n\n\tif (!policy) {\n\t\treturn { allowed: true };\n\t}\n\n\tfor (const policyLayer of getEffectivePolicyLayers(policy)) {\n\t\tif (!policyLayer.models) {\n\t\t\tcontinue;\n\t\t}\n\t\tconst result = checkModelAccess(modelId, policyLayer.models);\n\t\tif (!result.allowed) {\n\t\t\treturn result;\n\t\t}\n\t}\n\n\treturn { allowed: true };\n}\n\n/**\n * Check if the current session has exceeded policy limits\n */\nexport function checkSessionLimits(\n\tsession: { startedAt: Date },\n\tusage?: { tokenCount?: number; activeSessionCount?: number },\n): {\n\tallowed: boolean;\n\treason?: string;\n} {\n\ttry {\n\t\tconst limits = getPolicyLimits();\n\t\tif (!limits) return { allowed: true };\n\n\t\t// Check duration limit\n\t\tif (\n\t\t\tlimits.maxSessionDurationMinutes &&\n\t\t\tlimits.maxSessionDurationMinutes > 0\n\t\t) {\n\t\t\tconst durationMinutes =\n\t\t\t\t(Date.now() - session.startedAt.getTime()) / 1000 / 60;\n\t\t\tif (durationMinutes > limits.maxSessionDurationMinutes) {\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session duration limit exceeded (${Math.floor(durationMinutes)}/${limits.maxSessionDurationMinutes} minutes). Please start a new session.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check token limit\n\t\tif (limits.maxTokensPerSession && limits.maxTokensPerSession > 0) {\n\t\t\tif (usage?.tokenCount !== undefined) {\n\t\t\t\tif (usage.tokenCount > limits.maxTokensPerSession) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Session token limit exceeded (${usage.tokenCount}/${limits.maxTokensPerSession} tokens). Please start a new session.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Usage undefined but limit is set - should we block?\n\t\t\t\t// To be safe (fail-closed) for strict limits, we probably should if we can't verify compliance.\n\t\t\t\t// However, if usage is undefined because metrics are disabled/failing, this might be too aggressive.\n\t\t\t\t// Given user feedback \"Fail-Open Error Handling\", we should warn or block.\n\t\t\t\t// Let's block if we can't verify usage against a set limit.\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Session token limit is active (${limits.maxTokensPerSession}) but token usage data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check concurrent sessions limit\n\t\tif (limits.maxConcurrentSessions && limits.maxConcurrentSessions > 0) {\n\t\t\tif (usage?.activeSessionCount !== undefined) {\n\t\t\t\tif (usage.activeSessionCount > limits.maxConcurrentSessions) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Concurrent session limit exceeded (${usage.activeSessionCount}/${limits.maxConcurrentSessions}). Please close existing sessions before starting a new one.`,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Same fail-closed logic for concurrent sessions\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason: `Concurrent session limit is active (${limits.maxConcurrentSessions}) but session count data is unavailable. Access blocked for safety.`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn { allowed: true };\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Policy error checking session limits: ${error}`,\n\t\t};\n\t}\n}\n\n/**\n * Get the current policy limits\n */\nexport function getPolicyLimits(): EnterprisePolicy[\"limits\"] | null {\n\t// Catch errors and return null (no limits) to prevent crashing callers.\n\t// Strict enforcement should rely on checkSessionLimits() which handles its own loading.\n\ttry {\n\t\tconst policy = loadPolicy();\n\t\treturn policy?.limits ?? null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Get the full loaded policy (for admin UI display)\n */\nexport function getCurrentPolicy(): EnterprisePolicy | null {\n\ttry {\n\t\treturn loadPolicy();\n\t} catch {\n\t\treturn null;\n\t}\n}\n"]}

package/dist/sandbox/docker-sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker-sandbox.d.ts","sourceRoot":"","sources":["../../src/sandbox/docker-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAWH,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAyB3E,MAAM,WAAW,mBAAmB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,aAAc,YAAW,OAAO;IAC5C,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,cAAc,CAAS;gBAEnB,MAAM,GAAE,mBAAwB;IAKtC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;YAenB,eAAe;IAUvB,IAAI,CACT,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,UAAU,CAAC;IA8DhB,YAAY,CACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,mBAAwB,GAC/B,OAAO,CAAC,UAAU,CAAC;IAkFhB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYvC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwCvD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAa9B"}
+{"version":3,"file":"docker-sandbox.d.ts","sourceRoot":"","sources":["../../src/sandbox/docker-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAWH,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAyB3E,MAAM,WAAW,mBAAmB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,aAAc,YAAW,OAAO;IAC5C,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,cAAc,CAAS;gBAEnB,MAAM,GAAE,mBAAwB;IAKtC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;YAenB,eAAe;IAUvB,IAAI,CACT,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,UAAU,CAAC;IA8DhB,YAAY,CACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,mBAAwB,GAC/B,OAAO,CAAC,UAAU,CAAC;IAkFhB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBvC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwCvD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAa9B"}

package/dist/sandbox/docker-sandbox.js

@@ -235,10 +235,15 @@ export class DockerSandbox {
         // shell interpolation of the path on host OR in container.
         // Previously: `cat "${path}"` was sent through a shell, so
         // `path` containing `"` or `$` could break or inject (#2473).
-        const result = await this.execWithArgs("cat", [path]);
+        const result = await this.execWithArgs("cat", [path], {
+            maxBuffer: EXEC_WITH_ARGS_MAX_BUFFER + 1,
+        });
         if (result.exitCode !== 0) {
             throw new Error(`Failed to read file: ${result.stderr}`);
         }
+        if (Buffer.byteLength(result.stdout, "utf8") > EXEC_WITH_ARGS_MAX_BUFFER) {
+            throw new Error(`Failed to read file: ${path} exceeds the ${EXEC_WITH_ARGS_MAX_BUFFER} byte Docker read limit`);
+        }
         return result.stdout;
     }
     async writeFile(path, content) {

package/dist/sandbox/docker-sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"docker-sandbox.js","sourceRoot":"","sources":["../../src/sandbox/docker-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,GACtB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE9C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAClC,MAAM,yBAAyB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9C,MAAM,6BAA6B,GAAG;;;;;;;;;;;;;;;;;CAiBrC,CAAC,IAAI,EAAE,CAAC;AAOT,MAAM,OAAO,aAAa;IAKzB,YAAY,SAA8B,EAAE;QAJpC,gBAAW,GAAkB,IAAI,CAAC;QAKzC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,cAAc,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,YAAY,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,UAAU;QACf,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,8CAA8C;QAC9C,MAAM,IAAI,GAAG,oBAAoB,UAAU,EAAE,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,6BAA6B,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,cAAc,QAAQ,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,oBAAoB,CAAC;QAEvJ,IAAI,CAAC;YACJ,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,eAAe;QAC5B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,IAAI,CACT,OAAe,EACf,GAAY,EACZ,GAA4B,EAC5B,MAAoB;QAEpB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAExC,6DAA6D;QAC7D,aAAa;QACb,EAAE;QACF,uDAAuD;QACvD,yDAAyD;QACzD,0DAA0D;QAC1D,qDAAqD;QACrD,6DAA6D;QAC7D,4DAA4D;QAC5D,yDAAyD;QACzD,4DAA4D;QAC5D,4DAA4D;QAC5D,kCAAkC;QAClC,MAAM,UAAU,GAAa,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,QAAQ,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACvD,IAAI,GAAG,EAAE,CAAC;YACT,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACzB,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;QACF,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAEzC,OAAO,MAAM,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE;gBACzC,MAAM;gBACN,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,GAAG,EAAE,QAAQ;aACb,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;YAC5C,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;YAC5C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,oBAAoB,CAAC,aAAa,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,oBAAoB,CAAC,aAAa,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC1B,OAAO,CAAC;oBACP,MAAM,EAAE,sBAAsB,CAAC,aAAa,CAAC;oBAC7C,MAAM,EAAE,sBAAsB,CAAC,aAAa,CAAC;oBAC7C,QAAQ,EAAE,IAAI,IAAI,CAAC;iBACnB,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC3B,OAAO,CAAC;oBACP,MAAM,EAAE,sBAAsB,CAAC,aAAa,CAAC;oBAC7C,MAAM,EACL,sBAAsB,CAAC,aAAa,CAAC;wBACrC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACzD,QAAQ,EAAE,CAAC;iBACX,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CACjB,OAAe,EACf,OAAiB,EAAE,EACnB,UAA+B,EAAE;QAEjC,IAAI,CAAC;YACJ,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBACjB,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YACD,4DAA4D;YAC5D,4DAA4D;YAC5D,wDAAwD;YACxD,wDAAwD;YACxD,0CAA0C;YAC1C,IAAI,QAAuC,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBACjB,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5C,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC3B,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClC,CAAC;YACF,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,UAAU,CAAC,IAAI,CACd,EAAE,EACF,IAAI,EACJ,KAAK,EACL,6BAA6B,EAC7B,IAAI,EACJ,OAAO,EACP,GAAG,IAAI,CACP,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;YACvC,CAAC;YAED,OAAO,MAAM,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACxD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE;oBACzC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;oBACjC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtC,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,yBAAyB,CAAC;gBACjE,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;gBAC5C,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;gBAE5C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;oBACzC,oBAAoB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACtD,CAAC,CAAC,CAAC;gBACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;oBACzC,oBAAoB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACtD,CAAC,CAAC,CAAC;gBACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;oBAC1B,OAAO,CAAC;wBACP,MAAM,EAAE,sBAAsB,CAAC,aAAa,CAAC;wBAC7C,MAAM,EAAE,sBAAsB,CAAC,aAAa,CAAC;wBAC7C,QAAQ,EAAE,IAAI,IAAI,CAAC;qBACnB,CAAC,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBAC3B,MAAM,SAAS,GAAG,KAGjB,CAAC;oBACF,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;oBACzD,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;oBACzD,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnB,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,KAKjB,CAAC;YACF,OAAO;gBACN,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE;gBAC9B,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,OAAO,IAAI,EAAE;gBACnD,QAAQ,EAAE,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACjE,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QAC1B,2DAA2D;QAC3D,2DAA2D;QAC3D,2DAA2D;QAC3D,8DAA8D;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC5C,kDAAkD;QAClD,4DAA4D;QAC5D,+DAA+D;QAC/D,2DAA2D;QAC3D,0DAA0D;QAC1D,EAAE;QACF,wDAAwD;QACxD,4DAA4D;QAC5D,4DAA4D;QAC5D,4CAA4C;QAC5C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAE5E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE;gBACzC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAC/B,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;YAC5C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,oBAAoB,CAAC,aAAa,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC1B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBAChB,OAAO,EAAE,CAAC;gBACX,CAAC;qBAAM,CAAC;oBACP,MAAM,CACL,IAAI,KAAK,CACR,yBAAyB,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAChE,CACD,CAAC;gBACH,CAAC;YACF,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC3B,MAAM,CAAC,KAAK,CAAC,CAAC;YACf,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACxB,mEAAmE;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC;gBACJ,MAAM,SAAS,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,uBAAuB;YAC5E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;oBAC9D,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACvD,CAAC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACzB,CAAC;IACF,CAAC;CACD","sourcesContent":["/**\n * Docker Sandbox - Isolated Container Execution Environment\n *\n * This module provides a Docker-based sandbox for running commands and\n * file operations in an isolated container. It mounts the current workspace\n * and executes operations within the container.\n *\n * ## Features\n *\n * - **Isolation**: Commands run in a Docker container\n * - **Workspace mount**: Current directory mounted at /workspace\n * - **Persistent container**: Reuses container across operations\n * - **Cleanup**: Container automatically removed on dispose\n *\n * ## Default Configuration\n *\n * | Setting        | Default        | Description                  |\n * |----------------|----------------|------------------------------|\n * | image          | node:20-slim   | Docker image to use          |\n * | workspaceMount | /workspace     | Mount point in container     |\n *\n * ## Container Lifecycle\n *\n * ```\n * ┌─────────────────────────────────────────────────────────────┐\n * │                    Container Lifecycle                      │\n * ├─────────────────────────────────────────────────────────────┤\n * │  initialize()                                               │\n * │       │                                                     │\n * │       ▼                                                     │\n * │  docker run -d --rm ...  (starts detached container)        │\n * │       │                                                     │\n * │       ▼                                                     │\n * │  exec() / readFile() / writeFile() (reuse container)        │\n * │       │                                                     │\n * │       ▼                                                     │\n * │  dispose() → docker stop (container auto-removed)           │\n * └─────────────────────────────────────────────────────────────┘\n * ```\n *\n * ## Example\n *\n * ```typescript\n * const sandbox = new DockerSandbox({ image: 'python:3.12-slim' });\n * await sandbox.initialize();\n *\n * const result = await sandbox.exec('python --version');\n * console.log(result.stdout); // Python 3.12.x\n *\n * await sandbox.dispose();\n * ```\n *\n * @module sandbox/docker-sandbox\n */\n\nimport { exec, spawn } from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport { promisify } from \"node:util\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\tappendCapturedOutput,\n\tcreateOutputCapture,\n\tfinalizeCapturedOutput,\n} from \"./output-capture.js\";\nimport type { ExecResult, ExecWithArgsOptions, Sandbox } from \"./types.js\";\n\nconst logger = createLogger(\"sandbox:docker\");\n\nconst execAsync = promisify(exec);\nconst EXEC_WITH_ARGS_MAX_BUFFER = 1024 * 1024;\nconst DOCKER_ABORTABLE_EXEC_WRAPPER = `\nchild_pid=\"\"\non_signal() {\n\tif [ -n \"$child_pid\" ]; then\n\t\tkill -TERM -- \"-$child_pid\" 2>/dev/null || kill -TERM \"$child_pid\" 2>/dev/null || true\n\t\twait \"$child_pid\" 2>/dev/null || true\n\tfi\n\texit 143\n}\ntrap on_signal TERM INT HUP\nif command -v setsid >/dev/null 2>&1; then\n\tsetsid \"$@\" &\nelse\n\t\"$@\" &\nfi\nchild_pid=$!\nwait \"$child_pid\"\n`.trim();\n\nexport interface DockerSandboxConfig {\n\timage?: string;\n\tworkspaceMount?: string;\n}\n\nexport class DockerSandbox implements Sandbox {\n\tprivate containerId: string | null = null;\n\tprivate image: string;\n\tprivate workspaceMount: string;\n\n\tconstructor(config: DockerSandboxConfig = {}) {\n\t\tthis.image = config.image || \"node:20-slim\";\n\t\tthis.workspaceMount = config.workspaceMount || \"/workspace\";\n\t}\n\n\tasync initialize(): Promise<void> {\n\t\tif (this.containerId) return;\n\n\t\t// Start a detached container that stays alive\n\t\tconst name = `composer-sandbox-${randomUUID()}`;\n\t\tconst cmd = `docker run -d --rm --name ${name} -v \"${process.cwd()}:${this.workspaceMount}\" -w ${this.workspaceMount} ${this.image} tail -f /dev/null`;\n\n\t\ttry {\n\t\t\tconst { stdout } = await execAsync(cmd);\n\t\t\tthis.containerId = stdout.trim();\n\t\t} catch (error) {\n\t\t\tthrow new Error(`Failed to start docker sandbox: ${error}`);\n\t\t}\n\t}\n\n\tprivate async ensureContainer(): Promise<string> {\n\t\tif (!this.containerId) {\n\t\t\tawait this.initialize();\n\t\t}\n\t\tif (!this.containerId) {\n\t\t\tthrow new Error(\"Sandbox not initialized\");\n\t\t}\n\t\treturn this.containerId;\n\t}\n\n\tasync exec(\n\t\tcommand: string,\n\t\tcwd?: string,\n\t\tenv?: Record<string, string>,\n\t\tsignal?: AbortSignal,\n\t): Promise<ExecResult> {\n\t\tconst id = await this.ensureContainer();\n\n\t\t// Build argv for `spawn` — never a shell string. This is the\n\t\t// #2473 fix:\n\t\t//\n\t\t//   1. Env values are NOT placed on argv (the previous\n\t\t//      `-e KEY=\"value\"` made secrets visible via `ps` to\n\t\t//      other users on the host). Instead we pass `-e KEY`\n\t\t//      (no value) and supply the value via the child\n\t\t//      process's environment, which Docker reads from there.\n\t\t//   2. Nothing is shelled on the host. The `command` string\n\t\t//      is still shelled inside the container via `sh -c`\n\t\t//      (that's the existing API contract), but no host-side\n\t\t//      escaping is needed and no values from `env` or `cwd`\n\t\t//      touch a shell on the host.\n\t\tconst dockerArgs: string[] = [\"exec\"];\n\t\tif (cwd) {\n\t\t\tdockerArgs.push(\"-w\", cwd);\n\t\t}\n\t\tconst childEnv: NodeJS.ProcessEnv = { ...process.env };\n\t\tif (env) {\n\t\t\tfor (const [k, v] of Object.entries(env)) {\n\t\t\t\tdockerArgs.push(\"-e\", k);\n\t\t\t\tchildEnv[k] = v;\n\t\t\t}\n\t\t}\n\t\tdockerArgs.push(id, \"sh\", \"-c\", command);\n\n\t\treturn await new Promise<ExecResult>((resolve) => {\n\t\t\tconst child = spawn(\"docker\", dockerArgs, {\n\t\t\t\tsignal,\n\t\t\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t\t\t\tenv: childEnv,\n\t\t\t});\n\t\t\tconst stdoutCapture = createOutputCapture();\n\t\t\tconst stderrCapture = createOutputCapture();\n\t\t\tchild.stdout?.on(\"data\", (data: Buffer) => {\n\t\t\t\tappendCapturedOutput(stdoutCapture, data, EXEC_WITH_ARGS_MAX_BUFFER);\n\t\t\t});\n\t\t\tchild.stderr?.on(\"data\", (data: Buffer) => {\n\t\t\t\tappendCapturedOutput(stderrCapture, data, EXEC_WITH_ARGS_MAX_BUFFER);\n\t\t\t});\n\t\t\tchild.on(\"close\", (code) => {\n\t\t\t\tresolve({\n\t\t\t\t\tstdout: finalizeCapturedOutput(stdoutCapture),\n\t\t\t\t\tstderr: finalizeCapturedOutput(stderrCapture),\n\t\t\t\t\texitCode: code ?? 1,\n\t\t\t\t});\n\t\t\t});\n\t\t\tchild.on(\"error\", (error) => {\n\t\t\t\tresolve({\n\t\t\t\t\tstdout: finalizeCapturedOutput(stdoutCapture),\n\t\t\t\t\tstderr:\n\t\t\t\t\t\tfinalizeCapturedOutput(stderrCapture) ||\n\t\t\t\t\t\t(error instanceof Error ? error.message : String(error)),\n\t\t\t\t\texitCode: 1,\n\t\t\t\t});\n\t\t\t});\n\t\t});\n\t}\n\n\tasync execWithArgs(\n\t\tcommand: string,\n\t\targs: string[] = [],\n\t\toptions: ExecWithArgsOptions = {},\n\t): Promise<ExecResult> {\n\t\ttry {\n\t\t\tconst id = await this.ensureContainer();\n\t\t\tconst dockerArgs = [\"exec\"];\n\t\t\tif (options.cwd) {\n\t\t\t\tdockerArgs.push(\"-w\", options.cwd);\n\t\t\t}\n\t\t\t// Env values are passed via the child process's env, not on\n\t\t\t// argv. See #2473 — the previous `-e KEY=VALUE` form leaked\n\t\t\t// secrets to host `ps`. When `options.env` is absent we\n\t\t\t// leave the spawn options' `env` field undefined so the\n\t\t\t// child simply inherits the parent's env.\n\t\t\tlet childEnv: NodeJS.ProcessEnv | undefined;\n\t\t\tif (options.env) {\n\t\t\t\tchildEnv = { ...process.env };\n\t\t\t\tfor (const key of Object.keys(options.env)) {\n\t\t\t\t\tdockerArgs.push(\"-e\", key);\n\t\t\t\t\tchildEnv[key] = options.env[key];\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (options.signal) {\n\t\t\t\tdockerArgs.push(\n\t\t\t\t\tid,\n\t\t\t\t\t\"sh\",\n\t\t\t\t\t\"-lc\",\n\t\t\t\t\tDOCKER_ABORTABLE_EXEC_WRAPPER,\n\t\t\t\t\t\"sh\",\n\t\t\t\t\tcommand,\n\t\t\t\t\t...args,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tdockerArgs.push(id, command, ...args);\n\t\t\t}\n\n\t\t\treturn await new Promise<ExecResult>((resolve, reject) => {\n\t\t\t\tconst child = spawn(\"docker\", dockerArgs, {\n\t\t\t\t\tsignal: options.signal,\n\t\t\t\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t\t\t\t\t...(childEnv ? { env: childEnv } : {}),\n\t\t\t\t});\n\t\t\t\tconst maxBuffer = options.maxBuffer ?? EXEC_WITH_ARGS_MAX_BUFFER;\n\t\t\t\tconst stdoutCapture = createOutputCapture();\n\t\t\t\tconst stderrCapture = createOutputCapture();\n\n\t\t\t\tchild.stdout?.on(\"data\", (data: Buffer) => {\n\t\t\t\t\tappendCapturedOutput(stdoutCapture, data, maxBuffer);\n\t\t\t\t});\n\t\t\t\tchild.stderr?.on(\"data\", (data: Buffer) => {\n\t\t\t\t\tappendCapturedOutput(stderrCapture, data, maxBuffer);\n\t\t\t\t});\n\t\t\t\tchild.on(\"close\", (code) => {\n\t\t\t\t\tresolve({\n\t\t\t\t\t\tstdout: finalizeCapturedOutput(stdoutCapture),\n\t\t\t\t\t\tstderr: finalizeCapturedOutput(stderrCapture),\n\t\t\t\t\t\texitCode: code ?? 1,\n\t\t\t\t\t});\n\t\t\t\t});\n\t\t\t\tchild.on(\"error\", (error) => {\n\t\t\t\t\tconst execError = error as Error & {\n\t\t\t\t\t\tstdout?: string;\n\t\t\t\t\t\tstderr?: string;\n\t\t\t\t\t};\n\t\t\t\t\texecError.stdout = finalizeCapturedOutput(stdoutCapture);\n\t\t\t\t\texecError.stderr = finalizeCapturedOutput(stderrCapture);\n\t\t\t\t\treject(execError);\n\t\t\t\t});\n\t\t\t});\n\t\t} catch (error: unknown) {\n\t\t\tconst execError = error as {\n\t\t\t\tstdout?: string;\n\t\t\t\tstderr?: string;\n\t\t\t\tcode?: number | string;\n\t\t\t\tmessage?: string;\n\t\t\t};\n\t\t\treturn {\n\t\t\t\tstdout: execError.stdout || \"\",\n\t\t\t\tstderr: execError.stderr || execError.message || \"\",\n\t\t\t\texitCode: typeof execError.code === \"number\" ? execError.code : 1,\n\t\t\t};\n\t\t}\n\t}\n\n\tasync readFile(path: string): Promise<string> {\n\t\t// Use execWithArgs so `path` is a separate argv entry — no\n\t\t// shell interpolation of the path on host OR in container.\n\t\t// Previously: `cat \"${path}\"` was sent through a shell, so\n\t\t// `path` containing `\"` or `$` could break or inject (#2473).\n\t\tconst result = await this.execWithArgs(\"cat\", [path]);\n\t\tif (result.exitCode !== 0) {\n\t\t\tthrow new Error(`Failed to read file: ${result.stderr}`);\n\t\t}\n\t\treturn result.stdout;\n\t}\n\n\tasync writeFile(path: string, content: string): Promise<void> {\n\t\t// Stream content over stdin (#2473). The previous\n\t\t// implementation built `echo \"${content}\" > \"${path}\"` with\n\t\t// naive quote-escaping, which corrupted any content containing\n\t\t// quotes, backslashes, `$`, backticks, newlines, or binary\n\t\t// bytes — and was shell-injectable via the path argument.\n\t\t//\n\t\t// Now: argv is fully spawn-quoted; the inner shell line\n\t\t// reads `path` as `$1` (literal param expansion, no further\n\t\t// shell interpretation), then `cat`s stdin into it. Content\n\t\t// round-trips byte-for-byte for any string.\n\t\tconst id = await this.ensureContainer();\n\t\tconst dockerArgs = [\"exec\", \"-i\", id, \"sh\", \"-c\", 'cat > \"$1\"', \"sh\", path];\n\n\t\tawait new Promise<void>((resolve, reject) => {\n\t\t\tconst child = spawn(\"docker\", dockerArgs, {\n\t\t\t\tstdio: [\"pipe\", \"pipe\", \"pipe\"],\n\t\t\t});\n\t\t\tconst stderrCapture = createOutputCapture();\n\t\t\tchild.stderr?.on(\"data\", (data: Buffer) => {\n\t\t\t\tappendCapturedOutput(stderrCapture, data, EXEC_WITH_ARGS_MAX_BUFFER);\n\t\t\t});\n\t\t\tchild.on(\"close\", (code) => {\n\t\t\t\tif (code === 0) {\n\t\t\t\t\tresolve();\n\t\t\t\t} else {\n\t\t\t\t\treject(\n\t\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\t`Failed to write file: ${finalizeCapturedOutput(stderrCapture)}`,\n\t\t\t\t\t\t),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t});\n\t\t\tchild.on(\"error\", (error) => {\n\t\t\t\treject(error);\n\t\t\t});\n\t\t\tchild.stdin?.end(content);\n\t\t});\n\t}\n\n\tasync exists(path: string): Promise<boolean> {\n\t\t// `test` directly invoked, no shell interpolation of path (#2473).\n\t\tconst result = await this.execWithArgs(\"test\", [\"-e\", path]);\n\t\treturn result.exitCode === 0;\n\t}\n\n\tasync dispose(): Promise<void> {\n\t\tif (this.containerId) {\n\t\t\ttry {\n\t\t\t\tawait execAsync(`docker stop ${this.containerId}`); // --rm handles removal\n\t\t\t} catch (err) {\n\t\t\t\tlogger.debug(\"Failed to stop docker container during dispose\", {\n\t\t\t\t\tcontainerId: this.containerId,\n\t\t\t\t\terror: err instanceof Error ? err.message : String(err),\n\t\t\t\t});\n\t\t\t}\n\t\t\tthis.containerId = null;\n\t\t}\n\t}\n}\n"]}
+{"version":3,"file":"docker-sandbox.js","sourceRoot":"","sources":["../../src/sandbox/docker-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,GACtB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE9C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAClC,MAAM,yBAAyB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9C,MAAM,6BAA6B,GAAG;;;;;;;;;;;;;;;;;CAiBrC,CAAC,IAAI,EAAE,CAAC;AAOT,MAAM,OAAO,aAAa;IAKzB,YAAY,SAA8B,EAAE;QAJpC,gBAAW,GAAkB,IAAI,CAAC;QAKzC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,cAAc,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,YAAY,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,UAAU;QACf,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,8CAA8C;QAC9C,MAAM,IAAI,GAAG,oBAAoB,UAAU,EAAE,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,6BAA6B,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,cAAc,QAAQ,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,oBAAoB,CAAC;QAEvJ,IAAI,CAAC;YACJ,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,eAAe;QAC5B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,IAAI,CACT,OAAe,EACf,GAAY,EACZ,GAA4B,EAC5B,MAAoB;QAEpB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAExC,6DAA6D;QAC7D,aAAa;QACb,EAAE;QACF,uDAAuD;QACvD,yDAAyD;QACzD,0DAA0D;QAC1D,qDAAqD;QACrD,6DAA6D;QAC7D,4DAA4D;QAC5D,yDAAyD;QACzD,4DAA4D;QAC5D,4DAA4D;QAC5D,kCAAkC;QAClC,MAAM,UAAU,GAAa,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,QAAQ,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACvD,IAAI,GAAG,EAAE,CAAC;YACT,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACzB,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;QACF,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAEzC,OAAO,MAAM,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE;gBACzC,MAAM;gBACN,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,GAAG,EAAE,QAAQ;aACb,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;YAC5C,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;YAC5C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,oBAAoB,CAAC,aAAa,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,oBAAoB,CAAC,aAAa,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC1B,OAAO,CAAC;oBACP,MAAM,EAAE,sBAAsB,CAAC,aAAa,CAAC;oBAC7C,MAAM,EAAE,sBAAsB,CAAC,aAAa,CAAC;oBAC7C,QAAQ,EAAE,IAAI,IAAI,CAAC;iBACnB,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC3B,OAAO,CAAC;oBACP,MAAM,EAAE,sBAAsB,CAAC,aAAa,CAAC;oBAC7C,MAAM,EACL,sBAAsB,CAAC,aAAa,CAAC;wBACrC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACzD,QAAQ,EAAE,CAAC;iBACX,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CACjB,OAAe,EACf,OAAiB,EAAE,EACnB,UAA+B,EAAE;QAEjC,IAAI,CAAC;YACJ,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBACjB,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YACD,4DAA4D;YAC5D,4DAA4D;YAC5D,wDAAwD;YACxD,wDAAwD;YACxD,0CAA0C;YAC1C,IAAI,QAAuC,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBACjB,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5C,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC3B,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClC,CAAC;YACF,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,UAAU,CAAC,IAAI,CACd,EAAE,EACF,IAAI,EACJ,KAAK,EACL,6BAA6B,EAC7B,IAAI,EACJ,OAAO,EACP,GAAG,IAAI,CACP,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;YACvC,CAAC;YAED,OAAO,MAAM,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACxD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE;oBACzC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;oBACjC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtC,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,yBAAyB,CAAC;gBACjE,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;gBAC5C,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;gBAE5C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;oBACzC,oBAAoB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACtD,CAAC,CAAC,CAAC;gBACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;oBACzC,oBAAoB,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACtD,CAAC,CAAC,CAAC;gBACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;oBAC1B,OAAO,CAAC;wBACP,MAAM,EAAE,sBAAsB,CAAC,aAAa,CAAC;wBAC7C,MAAM,EAAE,sBAAsB,CAAC,aAAa,CAAC;wBAC7C,QAAQ,EAAE,IAAI,IAAI,CAAC;qBACnB,CAAC,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBAC3B,MAAM,SAAS,GAAG,KAGjB,CAAC;oBACF,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;oBACzD,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;oBACzD,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnB,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,KAKjB,CAAC;YACF,OAAO;gBACN,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE;gBAC9B,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,OAAO,IAAI,EAAE;gBACnD,QAAQ,EAAE,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACjE,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QAC1B,2DAA2D;QAC3D,2DAA2D;QAC3D,2DAA2D;QAC3D,8DAA8D;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE;YACrD,SAAS,EAAE,yBAAyB,GAAG,CAAC;SACxC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CACd,wBAAwB,IAAI,gBAAgB,yBAAyB,yBAAyB,CAC9F,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;QAC5C,kDAAkD;QAClD,4DAA4D;QAC5D,+DAA+D;QAC/D,2DAA2D;QAC3D,0DAA0D;QAC1D,EAAE;QACF,wDAAwD;QACxD,4DAA4D;QAC5D,4DAA4D;QAC5D,4CAA4C;QAC5C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAE5E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE;gBACzC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAC/B,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,mBAAmB,EAAE,CAAC;YAC5C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACzC,oBAAoB,CAAC,aAAa,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC1B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBAChB,OAAO,EAAE,CAAC;gBACX,CAAC;qBAAM,CAAC;oBACP,MAAM,CACL,IAAI,KAAK,CACR,yBAAyB,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAChE,CACD,CAAC;gBACH,CAAC;YACF,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC3B,MAAM,CAAC,KAAK,CAAC,CAAC;YACf,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACxB,mEAAmE;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC;gBACJ,MAAM,SAAS,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,uBAAuB;YAC5E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;oBAC9D,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACvD,CAAC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACzB,CAAC;IACF,CAAC;CACD","sourcesContent":["/**\n * Docker Sandbox - Isolated Container Execution Environment\n *\n * This module provides a Docker-based sandbox for running commands and\n * file operations in an isolated container. It mounts the current workspace\n * and executes operations within the container.\n *\n * ## Features\n *\n * - **Isolation**: Commands run in a Docker container\n * - **Workspace mount**: Current directory mounted at /workspace\n * - **Persistent container**: Reuses container across operations\n * - **Cleanup**: Container automatically removed on dispose\n *\n * ## Default Configuration\n *\n * | Setting        | Default        | Description                  |\n * |----------------|----------------|------------------------------|\n * | image          | node:20-slim   | Docker image to use          |\n * | workspaceMount | /workspace     | Mount point in container     |\n *\n * ## Container Lifecycle\n *\n * ```\n * ┌─────────────────────────────────────────────────────────────┐\n * │                    Container Lifecycle                      │\n * ├─────────────────────────────────────────────────────────────┤\n * │  initialize()                                               │\n * │       │                                                     │\n * │       ▼                                                     │\n * │  docker run -d --rm ...  (starts detached container)        │\n * │       │                                                     │\n * │       ▼                                                     │\n * │  exec() / readFile() / writeFile() (reuse container)        │\n * │       │                                                     │\n * │       ▼                                                     │\n * │  dispose() → docker stop (container auto-removed)           │\n * └─────────────────────────────────────────────────────────────┘\n * ```\n *\n * ## Example\n *\n * ```typescript\n * const sandbox = new DockerSandbox({ image: 'python:3.12-slim' });\n * await sandbox.initialize();\n *\n * const result = await sandbox.exec('python --version');\n * console.log(result.stdout); // Python 3.12.x\n *\n * await sandbox.dispose();\n * ```\n *\n * @module sandbox/docker-sandbox\n */\n\nimport { exec, spawn } from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport { promisify } from \"node:util\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\tappendCapturedOutput,\n\tcreateOutputCapture,\n\tfinalizeCapturedOutput,\n} from \"./output-capture.js\";\nimport type { ExecResult, ExecWithArgsOptions, Sandbox } from \"./types.js\";\n\nconst logger = createLogger(\"sandbox:docker\");\n\nconst execAsync = promisify(exec);\nconst EXEC_WITH_ARGS_MAX_BUFFER = 1024 * 1024;\nconst DOCKER_ABORTABLE_EXEC_WRAPPER = `\nchild_pid=\"\"\non_signal() {\n\tif [ -n \"$child_pid\" ]; then\n\t\tkill -TERM -- \"-$child_pid\" 2>/dev/null || kill -TERM \"$child_pid\" 2>/dev/null || true\n\t\twait \"$child_pid\" 2>/dev/null || true\n\tfi\n\texit 143\n}\ntrap on_signal TERM INT HUP\nif command -v setsid >/dev/null 2>&1; then\n\tsetsid \"$@\" &\nelse\n\t\"$@\" &\nfi\nchild_pid=$!\nwait \"$child_pid\"\n`.trim();\n\nexport interface DockerSandboxConfig {\n\timage?: string;\n\tworkspaceMount?: string;\n}\n\nexport class DockerSandbox implements Sandbox {\n\tprivate containerId: string | null = null;\n\tprivate image: string;\n\tprivate workspaceMount: string;\n\n\tconstructor(config: DockerSandboxConfig = {}) {\n\t\tthis.image = config.image || \"node:20-slim\";\n\t\tthis.workspaceMount = config.workspaceMount || \"/workspace\";\n\t}\n\n\tasync initialize(): Promise<void> {\n\t\tif (this.containerId) return;\n\n\t\t// Start a detached container that stays alive\n\t\tconst name = `composer-sandbox-${randomUUID()}`;\n\t\tconst cmd = `docker run -d --rm --name ${name} -v \"${process.cwd()}:${this.workspaceMount}\" -w ${this.workspaceMount} ${this.image} tail -f /dev/null`;\n\n\t\ttry {\n\t\t\tconst { stdout } = await execAsync(cmd);\n\t\t\tthis.containerId = stdout.trim();\n\t\t} catch (error) {\n\t\t\tthrow new Error(`Failed to start docker sandbox: ${error}`);\n\t\t}\n\t}\n\n\tprivate async ensureContainer(): Promise<string> {\n\t\tif (!this.containerId) {\n\t\t\tawait this.initialize();\n\t\t}\n\t\tif (!this.containerId) {\n\t\t\tthrow new Error(\"Sandbox not initialized\");\n\t\t}\n\t\treturn this.containerId;\n\t}\n\n\tasync exec(\n\t\tcommand: string,\n\t\tcwd?: string,\n\t\tenv?: Record<string, string>,\n\t\tsignal?: AbortSignal,\n\t): Promise<ExecResult> {\n\t\tconst id = await this.ensureContainer();\n\n\t\t// Build argv for `spawn` — never a shell string. This is the\n\t\t// #2473 fix:\n\t\t//\n\t\t//   1. Env values are NOT placed on argv (the previous\n\t\t//      `-e KEY=\"value\"` made secrets visible via `ps` to\n\t\t//      other users on the host). Instead we pass `-e KEY`\n\t\t//      (no value) and supply the value via the child\n\t\t//      process's environment, which Docker reads from there.\n\t\t//   2. Nothing is shelled on the host. The `command` string\n\t\t//      is still shelled inside the container via `sh -c`\n\t\t//      (that's the existing API contract), but no host-side\n\t\t//      escaping is needed and no values from `env` or `cwd`\n\t\t//      touch a shell on the host.\n\t\tconst dockerArgs: string[] = [\"exec\"];\n\t\tif (cwd) {\n\t\t\tdockerArgs.push(\"-w\", cwd);\n\t\t}\n\t\tconst childEnv: NodeJS.ProcessEnv = { ...process.env };\n\t\tif (env) {\n\t\t\tfor (const [k, v] of Object.entries(env)) {\n\t\t\t\tdockerArgs.push(\"-e\", k);\n\t\t\t\tchildEnv[k] = v;\n\t\t\t}\n\t\t}\n\t\tdockerArgs.push(id, \"sh\", \"-c\", command);\n\n\t\treturn await new Promise<ExecResult>((resolve) => {\n\t\t\tconst child = spawn(\"docker\", dockerArgs, {\n\t\t\t\tsignal,\n\t\t\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t\t\t\tenv: childEnv,\n\t\t\t});\n\t\t\tconst stdoutCapture = createOutputCapture();\n\t\t\tconst stderrCapture = createOutputCapture();\n\t\t\tchild.stdout?.on(\"data\", (data: Buffer) => {\n\t\t\t\tappendCapturedOutput(stdoutCapture, data, EXEC_WITH_ARGS_MAX_BUFFER);\n\t\t\t});\n\t\t\tchild.stderr?.on(\"data\", (data: Buffer) => {\n\t\t\t\tappendCapturedOutput(stderrCapture, data, EXEC_WITH_ARGS_MAX_BUFFER);\n\t\t\t});\n\t\t\tchild.on(\"close\", (code) => {\n\t\t\t\tresolve({\n\t\t\t\t\tstdout: finalizeCapturedOutput(stdoutCapture),\n\t\t\t\t\tstderr: finalizeCapturedOutput(stderrCapture),\n\t\t\t\t\texitCode: code ?? 1,\n\t\t\t\t});\n\t\t\t});\n\t\t\tchild.on(\"error\", (error) => {\n\t\t\t\tresolve({\n\t\t\t\t\tstdout: finalizeCapturedOutput(stdoutCapture),\n\t\t\t\t\tstderr:\n\t\t\t\t\t\tfinalizeCapturedOutput(stderrCapture) ||\n\t\t\t\t\t\t(error instanceof Error ? error.message : String(error)),\n\t\t\t\t\texitCode: 1,\n\t\t\t\t});\n\t\t\t});\n\t\t});\n\t}\n\n\tasync execWithArgs(\n\t\tcommand: string,\n\t\targs: string[] = [],\n\t\toptions: ExecWithArgsOptions = {},\n\t): Promise<ExecResult> {\n\t\ttry {\n\t\t\tconst id = await this.ensureContainer();\n\t\t\tconst dockerArgs = [\"exec\"];\n\t\t\tif (options.cwd) {\n\t\t\t\tdockerArgs.push(\"-w\", options.cwd);\n\t\t\t}\n\t\t\t// Env values are passed via the child process's env, not on\n\t\t\t// argv. See #2473 — the previous `-e KEY=VALUE` form leaked\n\t\t\t// secrets to host `ps`. When `options.env` is absent we\n\t\t\t// leave the spawn options' `env` field undefined so the\n\t\t\t// child simply inherits the parent's env.\n\t\t\tlet childEnv: NodeJS.ProcessEnv | undefined;\n\t\t\tif (options.env) {\n\t\t\t\tchildEnv = { ...process.env };\n\t\t\t\tfor (const key of Object.keys(options.env)) {\n\t\t\t\t\tdockerArgs.push(\"-e\", key);\n\t\t\t\t\tchildEnv[key] = options.env[key];\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (options.signal) {\n\t\t\t\tdockerArgs.push(\n\t\t\t\t\tid,\n\t\t\t\t\t\"sh\",\n\t\t\t\t\t\"-lc\",\n\t\t\t\t\tDOCKER_ABORTABLE_EXEC_WRAPPER,\n\t\t\t\t\t\"sh\",\n\t\t\t\t\tcommand,\n\t\t\t\t\t...args,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tdockerArgs.push(id, command, ...args);\n\t\t\t}\n\n\t\t\treturn await new Promise<ExecResult>((resolve, reject) => {\n\t\t\t\tconst child = spawn(\"docker\", dockerArgs, {\n\t\t\t\t\tsignal: options.signal,\n\t\t\t\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t\t\t\t\t...(childEnv ? { env: childEnv } : {}),\n\t\t\t\t});\n\t\t\t\tconst maxBuffer = options.maxBuffer ?? EXEC_WITH_ARGS_MAX_BUFFER;\n\t\t\t\tconst stdoutCapture = createOutputCapture();\n\t\t\t\tconst stderrCapture = createOutputCapture();\n\n\t\t\t\tchild.stdout?.on(\"data\", (data: Buffer) => {\n\t\t\t\t\tappendCapturedOutput(stdoutCapture, data, maxBuffer);\n\t\t\t\t});\n\t\t\t\tchild.stderr?.on(\"data\", (data: Buffer) => {\n\t\t\t\t\tappendCapturedOutput(stderrCapture, data, maxBuffer);\n\t\t\t\t});\n\t\t\t\tchild.on(\"close\", (code) => {\n\t\t\t\t\tresolve({\n\t\t\t\t\t\tstdout: finalizeCapturedOutput(stdoutCapture),\n\t\t\t\t\t\tstderr: finalizeCapturedOutput(stderrCapture),\n\t\t\t\t\t\texitCode: code ?? 1,\n\t\t\t\t\t});\n\t\t\t\t});\n\t\t\t\tchild.on(\"error\", (error) => {\n\t\t\t\t\tconst execError = error as Error & {\n\t\t\t\t\t\tstdout?: string;\n\t\t\t\t\t\tstderr?: string;\n\t\t\t\t\t};\n\t\t\t\t\texecError.stdout = finalizeCapturedOutput(stdoutCapture);\n\t\t\t\t\texecError.stderr = finalizeCapturedOutput(stderrCapture);\n\t\t\t\t\treject(execError);\n\t\t\t\t});\n\t\t\t});\n\t\t} catch (error: unknown) {\n\t\t\tconst execError = error as {\n\t\t\t\tstdout?: string;\n\t\t\t\tstderr?: string;\n\t\t\t\tcode?: number | string;\n\t\t\t\tmessage?: string;\n\t\t\t};\n\t\t\treturn {\n\t\t\t\tstdout: execError.stdout || \"\",\n\t\t\t\tstderr: execError.stderr || execError.message || \"\",\n\t\t\t\texitCode: typeof execError.code === \"number\" ? execError.code : 1,\n\t\t\t};\n\t\t}\n\t}\n\n\tasync readFile(path: string): Promise<string> {\n\t\t// Use execWithArgs so `path` is a separate argv entry — no\n\t\t// shell interpolation of the path on host OR in container.\n\t\t// Previously: `cat \"${path}\"` was sent through a shell, so\n\t\t// `path` containing `\"` or `$` could break or inject (#2473).\n\t\tconst result = await this.execWithArgs(\"cat\", [path], {\n\t\t\tmaxBuffer: EXEC_WITH_ARGS_MAX_BUFFER + 1,\n\t\t});\n\t\tif (result.exitCode !== 0) {\n\t\t\tthrow new Error(`Failed to read file: ${result.stderr}`);\n\t\t}\n\t\tif (Buffer.byteLength(result.stdout, \"utf8\") > EXEC_WITH_ARGS_MAX_BUFFER) {\n\t\t\tthrow new Error(\n\t\t\t\t`Failed to read file: ${path} exceeds the ${EXEC_WITH_ARGS_MAX_BUFFER} byte Docker read limit`,\n\t\t\t);\n\t\t}\n\t\treturn result.stdout;\n\t}\n\n\tasync writeFile(path: string, content: string): Promise<void> {\n\t\t// Stream content over stdin (#2473). The previous\n\t\t// implementation built `echo \"${content}\" > \"${path}\"` with\n\t\t// naive quote-escaping, which corrupted any content containing\n\t\t// quotes, backslashes, `$`, backticks, newlines, or binary\n\t\t// bytes — and was shell-injectable via the path argument.\n\t\t//\n\t\t// Now: argv is fully spawn-quoted; the inner shell line\n\t\t// reads `path` as `$1` (literal param expansion, no further\n\t\t// shell interpretation), then `cat`s stdin into it. Content\n\t\t// round-trips byte-for-byte for any string.\n\t\tconst id = await this.ensureContainer();\n\t\tconst dockerArgs = [\"exec\", \"-i\", id, \"sh\", \"-c\", 'cat > \"$1\"', \"sh\", path];\n\n\t\tawait new Promise<void>((resolve, reject) => {\n\t\t\tconst child = spawn(\"docker\", dockerArgs, {\n\t\t\t\tstdio: [\"pipe\", \"pipe\", \"pipe\"],\n\t\t\t});\n\t\t\tconst stderrCapture = createOutputCapture();\n\t\t\tchild.stderr?.on(\"data\", (data: Buffer) => {\n\t\t\t\tappendCapturedOutput(stderrCapture, data, EXEC_WITH_ARGS_MAX_BUFFER);\n\t\t\t});\n\t\t\tchild.on(\"close\", (code) => {\n\t\t\t\tif (code === 0) {\n\t\t\t\t\tresolve();\n\t\t\t\t} else {\n\t\t\t\t\treject(\n\t\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\t`Failed to write file: ${finalizeCapturedOutput(stderrCapture)}`,\n\t\t\t\t\t\t),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t});\n\t\t\tchild.on(\"error\", (error) => {\n\t\t\t\treject(error);\n\t\t\t});\n\t\t\tchild.stdin?.end(content);\n\t\t});\n\t}\n\n\tasync exists(path: string): Promise<boolean> {\n\t\t// `test` directly invoked, no shell interpolation of path (#2473).\n\t\tconst result = await this.execWithArgs(\"test\", [\"-e\", path]);\n\t\treturn result.exitCode === 0;\n\t}\n\n\tasync dispose(): Promise<void> {\n\t\tif (this.containerId) {\n\t\t\ttry {\n\t\t\t\tawait execAsync(`docker stop ${this.containerId}`); // --rm handles removal\n\t\t\t} catch (err) {\n\t\t\t\tlogger.debug(\"Failed to stop docker container during dispose\", {\n\t\t\t\t\tcontainerId: this.containerId,\n\t\t\t\t\terror: err instanceof Error ? err.message : String(err),\n\t\t\t\t});\n\t\t\t}\n\t\t\tthis.containerId = null;\n\t\t}\n\t}\n}\n"]}

package/dist/server/handlers/chat-ws.d.ts

@@ -5,6 +5,7 @@
  */
 import type { IncomingMessage } from "node:http";
 import type { WebSocket } from "ws";
+import type { WorkspaceConfigRequestContext } from "../../services/workspace-config/types.js";
 import type { WebServerContext } from "../app-context.js";
-export declare function handleChatWebSocket(ws: WebSocket, req: IncomingMessage, context: WebServerContext): void;
+export declare function handleChatWebSocket(ws: WebSocket, req: IncomingMessage, context: WebServerContext, workspaceConfig?: WorkspaceConfigRequestContext): void;
 //# sourceMappingURL=chat-ws.d.ts.map

package/dist/server/handlers/chat-ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat-ws.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/chat-ws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,KAAK,EAAW,SAAS,EAAE,MAAM,IAAI,CAAC;AAoB7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA6L1D,wBAAgB,mBAAmB,CAClC,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,gBAAgB,QAyuBzB"}
+{"version":3,"file":"chat-ws.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/chat-ws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAMjD,OAAO,KAAK,EAAW,SAAS,EAAE,MAAM,IAAI,CAAC;AA6B7C,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AAK9F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAwM1D,wBAAgB,mBAAmB,CAClC,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,gBAAgB,EACzB,eAAe,CAAC,EAAE,6BAA6B,QAm4B/C"}