@gaunt-sloth/core 2.0.0-alpha.2 → 2.0.0-alpha.4

package/dist/core/GthAgentRunner.js

@@ -1,4 +1,12 @@
+import { getEffectiveDevToolsConfig, getShellJudgeSettings, isShellAllowlistEnabled, isShellAllowlistPersisted, isShellJudgeEnabled, } from '#src/config.js';
 import { GthLangChainAgent } from '#src/core/GthLangChainAgent.js';
+import { AllowlistStore, PersistedAllowlist, matchesApproval, } from '#src/core/shell/allowlist.js';
+import { classifyCommand } from '#src/core/shell/arity.js';
+import { normalizeCommand } from '#src/core/shell/normalize.js';
+import { judgeShellCommand, mapVerdictToAction, } from '#src/core/shell/judge.js';
+import { env } from '#src/utils/systemUtils.js';
+import { getGslothConfigWritePath } from '#src/utils/fileUtils.js';
+import { SHELL_ALLOWLIST_FILE } from '#src/constants.js';
 import { enhanceVertexUnauthorizedMessage } from '#src/utils/vertexaiUtils.js';
 import { getNewRunnableConfig } from '#src/utils/llmUtils.js';
 import { initDebugLogging, debugLog, debugLogError, debugLogObject, } from '#src/utils/debugUtils.js';
@@ -13,6 +21,38 @@ export class GthAgentRunner {
     config = null;
     runConfig = null;
     agentFactory;
+    /**
+     * Consumer hook invoked when a run suspends on a tool-approval interrupt (e.g. the opt-in
+     * `run_shell_command` confirmation). Set via {@link setToolApprovalCallback}; when unset the
+     * runner REJECTS pending tool calls rather than hanging or auto-approving — the safe default
+     * for non-interactive entrypoints (a scripted `exec` run with no TTY to prompt on).
+     */
+    toolApprovalCallback = null;
+    /** The command the runner was initialized for; selects which `devTools` config applies. */
+    command = undefined;
+    /**
+     * EXT-12 — runtime, session-scoped yolo flag toggled by the `/yolo` slash command. Distinct
+     * from the static `devTools.shellYolo` config flag (which omits the tool from `interruptOn` at
+     * agent-build time and cannot be changed mid-session). Because the tool stays gated (in
+     * `interruptOn`), this flag is consulted at the TOP of {@link decideToolApproval}: when ON, a
+     * gated `run_shell_command` is auto-approved WITHOUT prompting (yolo behaviour) for the rest of
+     * this runner's life. Never persisted; defaults OFF. It does NOT disable the hardline floor —
+     * catastrophic commands are still refused at exec time in `GthDevToolkit.executeCommand`.
+     */
+    sessionYolo = false;
+    /**
+     * EXT-9 Tier-2 session allow-list — approved command prefixes that auto-approve for the
+     * life of THIS runner instance. Instance-scoped (not module-global) so concurrent
+     * sessions (ACP / AG-UI multi-session) cannot stomp each other's approvals.
+     */
+    sessionAllowlist = new AllowlistStore();
+    /**
+     * EXT-9 Tier-2 persisted (`always`) allow-list, loaded lazily on first use from
+     * `.gsloth/.gsloth-settings/shell-allowlist.json`. Null until the shell tool is gated
+     * and the allow-list is enabled; null also when persistence is disabled by config.
+     */
+    persistedAllowlist = null;
+    persistedAllowlistLoaded = false;
     /**
      * @param agentFactory Produces the {@link GthAgentInterface} the runner drives.
      *   Defaults to the lean {@link GthLangChainAgent} (core). `@gaunt-sloth/agent`
@@ -25,6 +65,28 @@ export class GthAgentRunner {
         this.agentFactory =
             agentFactory ?? ((status, agentResolvers) => new GthLangChainAgent(status, agentResolvers));
     }
+    /**
+     * Register the tool-approval handler the runner calls when a run suspends on a tool-approval
+     * interrupt (the interactive readline session wires a y/n prompt here). Pass `null` to clear.
+     * Without a handler the runner rejects pending tool calls (see {@link toolApprovalCallback}).
+     */
+    setToolApprovalCallback(callback) {
+        this.toolApprovalCallback = callback;
+    }
+    /**
+     * EXT-12 — flip the runtime, session-scoped yolo flag (the `/yolo` slash command). When ON,
+     * gated `run_shell_command` calls auto-approve without prompting for the rest of this session;
+     * the hardline floor still applies at exec time. Returns the NEW state so the caller can render
+     * a notice. Session-scoped only — nothing is written to config.
+     */
+    toggleSessionYolo() {
+        this.sessionYolo = !this.sessionYolo;
+        return this.sessionYolo;
+    }
+    /** EXT-12 — current state of the runtime session-scoped yolo flag (see {@link toggleSessionYolo}). */
+    isSessionYolo() {
+        return this.sessionYolo;
+    }
     /**
      * Init is split into a separate method. This may create a number of connections,
      * and we'd better have an instance by that moment, for the case things will go wrong,
@@ -32,6 +94,7 @@ export class GthAgentRunner {
      */
     async init(command, configIn, checkpointSaver) {
         this.config = configIn;
+        this.command = command;
         // Initialize debug logging
         initDebugLogging(configIn.debugLog ?? false);
         debugLog(`Initializing GthAgentRunner with command: ${command || 'default'}`);
@@ -60,10 +123,11 @@ export class GthAgentRunner {
                 const stream = await this.agent.stream(messages, this.runConfig);
                 let result = '';
                 try {
-                    for await (const chunk of stream) {
-                        debugLogObject('Stream chunk', chunk);
-                        result += chunk;
-                    }
+                    result = await this.drainTextStream(stream);
+                    // A run may suspend on one or more tool-approval interrupts (run_shell_command).
+                    // Resolve them in a loop: each resume can itself suspend again on the next gated
+                    // tool call, so keep going until the graph completes with no pending interrupts.
+                    result += await this.resolveToolInterrupts();
                 }
                 catch (streamError) {
                     // Handle streaming-specific errors
@@ -101,6 +165,189 @@ export class GthAgentRunner {
             throw new Error(`Agent processing failed: ${enhancedMessage}`, error instanceof Error ? { cause: error } : undefined);
         }
     }
+    /**
+     * Accumulate a text stream into a single string. Extracted so {@link processMessages} and
+     * the interrupt-resume loop ({@link resolveToolInterrupts}) drain streams identically.
+     */
+    async drainTextStream(stream) {
+        let result = '';
+        for await (const chunk of stream) {
+            debugLogObject('Stream chunk', chunk);
+            result += chunk;
+        }
+        return result;
+    }
+    /**
+     * After a streamed run ends, resolve any tool-approval interrupts it suspended on. For each
+     * pending tool call the {@link toolApprovalCallback} is consulted (defaulting to REJECT when
+     * no handler is wired, so a non-interactive run never hangs or auto-approves); the collected
+     * decisions are then sent back via the agent's `streamResume` as a LangChain HITL resume
+     * (`{ decisions }`). Because a resumed run can suspend again on the next gated tool call, this
+     * loops until the graph completes with no pending interrupts. Returns the concatenated text
+     * streamed across all resume turns (empty when nothing was resumed).
+     *
+     * No-ops (returns '') when the agent does not support interrupts (`getPendingToolInterrupts`/
+     * `streamResume` absent), so the lean agent and non-HITL configs are unaffected.
+     */
+    async resolveToolInterrupts() {
+        const agent = this.agent;
+        const runConfig = this.runConfig;
+        if (!agent || !runConfig)
+            return '';
+        if (!agent.getPendingToolInterrupts || !agent.streamResume)
+            return '';
+        let resumedText = '';
+        // Bound the loop defensively so a misbehaving graph that re-suspends forever cannot spin.
+        for (let guard = 0; guard < 100; guard++) {
+            const pending = await agent.getPendingToolInterrupts(runConfig);
+            if (pending.length === 0)
+                break;
+            const decisions = [];
+            for (const tool of pending) {
+                decisions.push(await this.decideToolApproval(tool));
+            }
+            const stream = await agent.streamResume({ decisions }, runConfig);
+            resumedText += await this.drainTextStream(stream);
+        }
+        return resumedText;
+    }
+    /**
+     * Decide a single pending tool call (EXT-9 Tier-2). For the opt-in `run_shell_command`,
+     * consult the scoped allow-list FIRST: if the command's classified prefix is already
+     * approved (session or persisted `always`) and survives the safe-bin anti-widening
+     * re-validation, auto-approve SILENTLY (no human prompt). Otherwise fall through to the
+     * human callback; when the human grants `session`/`always` scope, record the command's
+     * classified prefix into the matching store so future flag-variants stop re-prompting.
+     *
+     * When no human callback is wired (non-TTY exec run) and nothing is allow-listed, reject —
+     * never auto-approve. Non-shell tools (or any tool when the allow-list is disabled) skip the
+     * allow-list and go straight to the human callback / default-reject, preserving prior behaviour.
+     *
+     * Hardline catastrophic commands remain refused at exec time regardless of any approval here
+     * (defense in depth in `GthDevToolkit.executeCommand`), so an allow-listed `rm -rf /` still
+     * cannot run.
+     */
+    async decideToolApproval(tool) {
+        const command = typeof tool.args?.command === 'string' ? tool.args.command : null;
+        const isShellCommand = tool.name === 'run_shell_command' && command !== null;
+        const allowlistApplies = isShellCommand && this.isShellAllowlistOn();
+        // EXT-12 — runtime session yolo (`/yolo`): when ON, auto-approve a gated shell command WITHOUT
+        // prompting, judging, or persisting. Scope `once` so nothing is written to the allow-list (the
+        // bypass is intentionally ephemeral and reversible). The hardline floor is NOT bypassed here —
+        // it is enforced at exec time in GthDevToolkit.executeCommand regardless of this decision, so a
+        // catastrophic command is still refused even under yolo.
+        if (isShellCommand && this.sessionYolo) {
+            return { type: 'approve', scope: 'once' };
+        }
+        // Auto-approve from the allow-list without prompting. The allow-list ALWAYS wins over the
+        // judge: a human-trusted prefix shouldn't pay for an LLM call on every variant.
+        if (allowlistApplies && this.isApprovedByAllowlist(command)) {
+            return { type: 'approve', scope: 'session' };
+        }
+        // EXT-10 — LLM-as-judge safety gate (default OFF). Runs BEFORE the human callback for a
+        // `run_shell_command` not already allow-listed: auto-approve clearly-safe (fatigue reducer),
+        // reject clearly-catastrophic (only when blockHigh), otherwise fall through to the human with
+        // the verdict attached. When disabled this is a no-op and behaviour is exactly EXT-9.
+        let safetyVerdict;
+        if (isShellCommand && command !== null && this.isShellJudgeOn()) {
+            const settings = getShellJudgeSettings(getEffectiveDevToolsConfig(this.config ?? undefined, this.command));
+            const verdict = await judgeShellCommand(command, this.config, {
+                home: env?.HOME,
+            });
+            const action = mapVerdictToAction(command, verdict, {
+                autoApproveLow: settings.autoApproveLow,
+                blockHigh: settings.blockHigh,
+            });
+            if (action === 'auto-approve') {
+                // Scope `once`: judge approvals are NEVER persisted to the allow-list.
+                return { type: 'approve', scope: 'once' };
+            }
+            if (action === 'reject') {
+                return {
+                    type: 'reject',
+                    message: `Safety judge blocked the command: ${verdict.reason}`,
+                };
+            }
+            // Escalate: carry the verdict to the human approval surface.
+            safetyVerdict = verdict;
+        }
+        if (!this.toolApprovalCallback) {
+            // No interactive handler (e.g. non-TTY exec run): reject rather than auto-approve.
+            return {
+                type: 'reject',
+                message: 'Tool call rejected: no interactive approval handler available.',
+            };
+        }
+        // Surface the judge's verdict to the human prompt (if the judge escalated) without mutating
+        // the original interrupt object the caller holds.
+        const pending = safetyVerdict ? { ...tool, safetyVerdict } : tool;
+        const decision = await this.toolApprovalCallback(pending);
+        // Persist the human's scoped grant so future variants of the same operation skip the prompt.
+        if (decision.type === 'approve' && allowlistApplies && command) {
+            this.recordApproval(command, decision.scope ?? 'once');
+        }
+        return decision;
+    }
+    /** Whether the EXT-10 LLM-as-judge safety gate is enabled for the active command's config. */
+    isShellJudgeOn() {
+        if (!this.config)
+            return false;
+        const devTools = getEffectiveDevToolsConfig(this.config, this.command);
+        return isShellJudgeEnabled(devTools);
+    }
+    /** Whether the EXT-9 Tier-2 allow-list is enabled for the active command's devTools config. */
+    isShellAllowlistOn() {
+        const devTools = getEffectiveDevToolsConfig(this.config ?? undefined, this.command);
+        return isShellAllowlistEnabled(devTools);
+    }
+    /**
+     * Lazily load (once per instance) the persisted `always` allow-list, unless persistence is
+     * disabled by config. Returns null when persistence is off so `always` grants behave as
+     * `session` (in-memory only).
+     */
+    getPersistedAllowlist() {
+        if (this.persistedAllowlistLoaded)
+            return this.persistedAllowlist;
+        this.persistedAllowlistLoaded = true;
+        const devTools = getEffectiveDevToolsConfig(this.config ?? undefined, this.command);
+        if (!isShellAllowlistPersisted(devTools)) {
+            this.persistedAllowlist = null;
+            return null;
+        }
+        try {
+            const filePath = getGslothConfigWritePath(SHELL_ALLOWLIST_FILE);
+            this.persistedAllowlist = new PersistedAllowlist(filePath);
+        }
+        catch (e) {
+            // Path/IO failure → behave as no persisted store (still safe: just prompts more).
+            debugLogError('Loading persisted shell allow-list', e);
+            this.persistedAllowlist = null;
+        }
+        return this.persistedAllowlist;
+    }
+    /** Check the command against the session + persisted stores (with anti-widening re-validation). */
+    isApprovedByAllowlist(command) {
+        return matchesApproval(command, {
+            session: this.sessionAllowlist,
+            always: this.getPersistedAllowlist() ?? undefined,
+        });
+    }
+    /**
+     * Record a human-granted approval at the given scope. `once` persists nothing. `session`
+     * adds the classified prefix to the in-memory store. `always` additionally persists it (or
+     * falls back to session-only when persistence is disabled).
+     */
+    recordApproval(command, scope) {
+        if (scope === 'once')
+            return;
+        const classification = classifyCommand(command, normalizeCommand);
+        if (!classification)
+            return; // unclassifiable (composition/redirection) → never remember.
+        this.sessionAllowlist.add(classification.prefix);
+        if (scope === 'always') {
+            this.getPersistedAllowlist()?.add(classification.prefix);
+        }
+    }
     /**
      * Event-stream counterpart to {@link processMessages}: drives the agent's typed
      * {@link AgentStreamEvent} path using the runner's own thread-bound `runConfig`, so a
@@ -111,6 +358,16 @@ export class GthAgentRunner {
      * underlying `streamWithEvents` ends cleanly on abort or `interrupt()`. The string
      * path's empty-stream retry/`invoke` fallback is intentionally NOT duplicated here — the
      * TUI renders the live event stream directly; revisit if empty-stream retries are needed.
+     *
+     * Tool-approval round-trip (EXT-11): after the stream ends, a gated `run_shell_command`
+     * leaves the graph suspended on a `humanInTheLoopMiddleware` interrupt rather than
+     * completing. This is the event-stream counterpart to the readline path's
+     * {@link resolveToolInterrupts}: it drains any pending interrupts through
+     * {@link decideToolApproval} (allow-list → judge → bridged human prompt), resumes via
+     * `streamWithEventsResume({ decisions })`, and loops until the graph completes with no
+     * pending interrupts — so the executed command's output renders into the TUI. Without
+     * this the TUI silently finalized an empty turn (approval gate was dead code on the
+     * event-stream path).
      */
     async *processMessagesWithEvents(messages, signal) {
         if (!this.agent || !this.config || !this.runConfig) {
@@ -119,6 +376,43 @@ export class GthAgentRunner {
         debugLog('Processing messages (event stream)...');
         debugLogObject('Input Messages', messages);
         yield* this.agent.streamWithEvents(messages, this.runConfig, signal);
+        yield* this.resolveToolInterruptsWithEvents(signal);
+    }
+    /**
+     * Event-stream counterpart to {@link resolveToolInterrupts}: after a streamed run ends,
+     * resolve any tool-approval interrupts it suspended on, yielding the resumed run's typed
+     * {@link AgentStreamEvent}s so the renderer (the Ink TUI) shows the executed command's
+     * output. Each pending tool call is consulted via {@link decideToolApproval} — the SAME
+     * three-layer gate the readline path uses (allow-list auto-approve → EXT-10 judge →
+     * bridged human callback, defaulting to REJECT when no handler is wired) — and the
+     * collected decisions are sent back via `streamWithEventsResume` as a LangChain HITL
+     * resume (`{ decisions }`). Because a resumed run can suspend again on the next gated
+     * tool call, this loops until the graph completes with no pending interrupts.
+     *
+     * No-ops (yields nothing) when the agent does not support interrupts
+     * (`getPendingToolInterrupts`/`streamWithEventsResume` absent), so the lean agent and
+     * non-HITL configs are unaffected. Aborts (`signal`) propagate through the resumed stream.
+     */
+    async *resolveToolInterruptsWithEvents(signal) {
+        const agent = this.agent;
+        const runConfig = this.runConfig;
+        if (!agent || !runConfig)
+            return;
+        if (!agent.getPendingToolInterrupts || !agent.streamWithEventsResume)
+            return;
+        // Bound the loop defensively so a misbehaving graph that re-suspends forever cannot spin.
+        for (let guard = 0; guard < 100; guard++) {
+            if (signal?.aborted)
+                return;
+            const pending = await agent.getPendingToolInterrupts(runConfig);
+            if (pending.length === 0)
+                break;
+            const decisions = [];
+            for (const tool of pending) {
+                decisions.push(await this.decideToolApproval(tool));
+            }
+            yield* agent.streamWithEventsResume({ decisions }, runConfig, [], signal);
+        }
     }
     // noinspection JSUnusedGlobalSymbols
     getAgent() {

package/dist/core/GthAgentRunner.js.map

@@ -1 +1 @@
-{"version":3,"file":"GthAgentRunner.js","sourceRoot":"","sources":["../../src/core/GthAgentRunner.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EACL,gBAAgB,EAChB,QAAQ,EACR,aAAa,EACb,cAAc,GACf,MAAM,0BAA0B,CAAC;AAElC;;;GAGG;AACH,MAAM,OAAO,cAAc;IACjB,YAAY,CAAuB;IACnC,SAAS,CAA6B;IACtC,KAAK,GAA6B,IAAI,CAAC;IACvC,MAAM,GAAqB,IAAI,CAAC;IAChC,SAAS,GAA0B,IAAI,CAAC;IACxC,YAAY,CAAkB;IAEtC;;;;;OAKG;IACH,YACE,YAAkC,EAClC,SAA0B,EAC1B,YAA8B;QAE9B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,YAAY;YACf,YAAY,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,IAAI,iBAAiB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAChG,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CACR,OAA+B,EAC/B,QAAmB,EACnB,eAAiD;QAEjD,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QAEvB,2BAA2B;QAC3B,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC;QAC7C,QAAQ,CAAC,6CAA6C,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QAE9E,IAAI,CAAC,SAAS,GAAG,oBAAoB,EAAE,CAAC;QAExC,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAElD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAElE,uBAAuB;QACvB,QAAQ,CAAC,uBAAuB,CAAC,CAAC;QAClC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QAE1D,QAAQ,CAAC,+BAA+B,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,QAAmB;QACvC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QACnC,cAAc,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAE3C,IAAI,CAAC;YACH,2DAA2D;YAC3D,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBAC7B,gBAAgB;gBAChB,QAAQ,CAAC,sBAAsB,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBACjE,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;wBACjC,cAAc,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;wBACtC,MAAM,IAAI,KAAK,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,mCAAmC;oBACnC,aAAa,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;oBAChD,MAAM,IAAI,KAAK,CACb,6BAA6B,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CACxG,CAAC;gBACJ,CAAC;gBACD,QAAQ,CAAC,4CAA4C,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC/B,QAAQ,CAAC,0EAA0E,CAAC,CAAC;oBACrF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;oBACnE,QAAQ,CAAC,wCAAwC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;oBACpE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;oBACJ,CAAC;oBACD,OAAO,QAAQ,CAAC;gBAClB,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,oBAAoB;gBACpB,QAAQ,CAAC,0BAA0B,CAAC,CAAC;gBACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBACjE,QAAQ,CAAC,+BAA+B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACzD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iCAAiC;YACjC,aAAa,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,eAAe,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/E,MAAM,eAAe,GAAG,gCAAgC,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC5F,MAAM,IAAI,KAAK,CACb,4BAA4B,eAAe,EAAE,EAC7C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,yBAAyB,CAC9B,QAAmB,EACnB,MAAoB;QAEpB,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,QAAQ,CAAC,uCAAuC,CAAC,CAAC;QAClD,cAAc,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAC3C,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,qCAAqC;IAC9B,QAAQ;QACb,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IACI,WAAW;QAChB,IAAI,CAAC,SAAS,GAAG,oBAAoB,EAAE,CAAC;QACxC,cAAc,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,OAAO;QACX,QAAQ,CAAC,+BAA+B,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,KAAK,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACtF,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,QAAQ,CAAC,iCAAiC,CAAC,CAAC;IAC9C,CAAC;CACF"}
+{"version":3,"file":"GthAgentRunner.js","sourceRoot":"","sources":["../../src/core/GthAgentRunner.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAcxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,eAAe,GAEhB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EACL,gBAAgB,EAChB,QAAQ,EACR,aAAa,EACb,cAAc,GACf,MAAM,0BAA0B,CAAC;AAElC;;;GAGG;AACH,MAAM,OAAO,cAAc;IACjB,YAAY,CAAuB;IACnC,SAAS,CAA6B;IACtC,KAAK,GAA6B,IAAI,CAAC;IACvC,MAAM,GAAqB,IAAI,CAAC;IAChC,SAAS,GAA0B,IAAI,CAAC;IACxC,YAAY,CAAkB;IACtC;;;;;OAKG;IACK,oBAAoB,GAAgC,IAAI,CAAC;IAEjE,2FAA2F;IACnF,OAAO,GAA2B,SAAS,CAAC;IAEpD;;;;;;;;OAQG;IACK,WAAW,GAAG,KAAK,CAAC;IAE5B;;;;OAIG;IACc,gBAAgB,GAAG,IAAI,cAAc,EAAE,CAAC;IAEzD;;;;OAIG;IACK,kBAAkB,GAA8B,IAAI,CAAC;IACrD,wBAAwB,GAAG,KAAK,CAAC;IAEzC;;;;;OAKG;IACH,YACE,YAAkC,EAClC,SAA0B,EAC1B,YAA8B;QAE9B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,YAAY;YACf,YAAY,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,IAAI,iBAAiB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAChG,CAAC;IAED;;;;OAIG;IACI,uBAAuB,CAAC,QAAqC;QAClE,IAAI,CAAC,oBAAoB,GAAG,QAAQ,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACI,iBAAiB;QACtB,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;QACrC,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,sGAAsG;IAC/F,aAAa;QAClB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CACR,OAA+B,EAC/B,QAAmB,EACnB,eAAiD;QAEjD,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAEvB,2BAA2B;QAC3B,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC;QAC7C,QAAQ,CAAC,6CAA6C,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QAE9E,IAAI,CAAC,SAAS,GAAG,oBAAoB,EAAE,CAAC;QAExC,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAElD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAElE,uBAAuB;QACvB,QAAQ,CAAC,uBAAuB,CAAC,CAAC;QAClC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QAE1D,QAAQ,CAAC,+BAA+B,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,QAAmB;QACvC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QACnC,cAAc,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAE3C,IAAI,CAAC;YACH,2DAA2D;YAC3D,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBAC7B,gBAAgB;gBAChB,QAAQ,CAAC,sBAAsB,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBACjE,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;oBAC5C,iFAAiF;oBACjF,iFAAiF;oBACjF,iFAAiF;oBACjF,MAAM,IAAI,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC/C,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,mCAAmC;oBACnC,aAAa,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;oBAChD,MAAM,IAAI,KAAK,CACb,6BAA6B,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CACxG,CAAC;gBACJ,CAAC;gBACD,QAAQ,CAAC,4CAA4C,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC/B,QAAQ,CAAC,0EAA0E,CAAC,CAAC;oBACrF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;oBACnE,QAAQ,CAAC,wCAAwC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;oBACpE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;oBACJ,CAAC;oBACD,OAAO,QAAQ,CAAC;gBAClB,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,oBAAoB;gBACpB,QAAQ,CAAC,0BAA0B,CAAC,CAAC;gBACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBACjE,QAAQ,CAAC,+BAA+B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACzD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iCAAiC;YACjC,aAAa,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,eAAe,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/E,MAAM,eAAe,GAAG,gCAAgC,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC5F,MAAM,IAAI,KAAK,CACb,4BAA4B,eAAe,EAAE,EAC7C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAAC,MAA6B;QACzD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YACjC,cAAc,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,qBAAqB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,OAAO,EAAE,CAAC;QAEtE,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,0FAA0F;QAC1F,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM;YAEhC,MAAM,SAAS,GAA2B,EAAE,CAAC;YAC7C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC;YAClE,WAAW,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,kBAAkB,CAAC,IAA0B;QACzD,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,IAAI,CAAC,OAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9F,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,KAAK,mBAAmB,IAAI,OAAO,KAAK,IAAI,CAAC;QAC7E,MAAM,gBAAgB,GAAG,cAAc,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAErE,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,gGAAgG;QAChG,yDAAyD;QACzD,IAAI,cAAc,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC5C,CAAC;QAED,0FAA0F;QAC1F,gFAAgF;QAChF,IAAI,gBAAgB,IAAI,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC/C,CAAC;QAED,wFAAwF;QACxF,6FAA6F;QAC7F,8FAA8F;QAC9F,sFAAsF;QACtF,IAAI,aAA6C,CAAC;QAClD,IAAI,cAAc,IAAI,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAChE,MAAM,QAAQ,GAAG,qBAAqB,CACpC,0BAA0B,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CACnE,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAmB,EAAE;gBACzE,IAAI,EAAE,GAAG,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE;gBAClD,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B,CAAC,CAAC;YACH,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;gBAC9B,uEAAuE;gBACvE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC5C,CAAC;YACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,qCAAqC,OAAO,CAAC,MAAM,EAAE;iBAC/D,CAAC;YACJ,CAAC;YACD,6DAA6D;YAC7D,aAAa,GAAG,OAAO,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/B,mFAAmF;YACnF,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,gEAAgE;aAC1E,CAAC;QACJ,CAAC;QAED,4FAA4F;QAC5F,kDAAkD;QAClD,MAAM,OAAO,GAAyB,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACxF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAE1D,6FAA6F;QAC7F,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,gBAAgB,IAAI,OAAO,EAAE,CAAC;YAC/D,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,8FAA8F;IACtF,cAAc;QACpB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,+FAA+F;IACvF,kBAAkB;QACxB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACpF,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACK,qBAAqB;QAC3B,IAAI,IAAI,CAAC,wBAAwB;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;QAClE,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC;QACrC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;YAChE,IAAI,CAAC,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,kFAAkF;YAClF,aAAa,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,mGAAmG;IAC3F,qBAAqB,CAAC,OAAe;QAC3C,OAAO,eAAe,CAAC,OAAO,EAAE;YAC9B,OAAO,EAAE,IAAI,CAAC,gBAAgB;YAC9B,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,IAAI,SAAS;SAClD,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,OAAe,EAAE,KAAoB;QAC1D,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO;QAC7B,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAClE,IAAI,CAAC,cAAc;YAAE,OAAO,CAAC,6DAA6D;QAC1F,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,CAAC,qBAAqB,EAAE,EAAE,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,CAAC,yBAAyB,CAC9B,QAAmB,EACnB,MAAoB;QAEpB,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,QAAQ,CAAC,uCAAuC,CAAC,CAAC;QAClD,cAAc,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAC3C,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACrE,KAAK,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,CAAC,+BAA+B,CAC5C,MAAoB;QAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;YAAE,OAAO;QACjC,IAAI,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,KAAK,CAAC,sBAAsB;YAAE,OAAO;QAE7E,0FAA0F;QAC1F,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;YACzC,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO;YAC5B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM;YAEhC,MAAM,SAAS,GAA2B,EAAE,CAAC;YAC7C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YACtD,CAAC;YAED,KAAK,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,qCAAqC;IAC9B,QAAQ;QACb,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IACI,WAAW;QAChB,IAAI,CAAC,SAAS,GAAG,oBAAoB,EAAE,CAAC;QACxC,cAAc,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,OAAO;QACX,QAAQ,CAAC,+BAA+B,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,KAAK,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACtF,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,QAAQ,CAAC,iCAAiC,CAAC,CAAC;IAC9C,CAAC;CACF"}

package/dist/core/shell/allowlist.d.ts

@@ -0,0 +1,75 @@
+import type { ToolApprovalScope } from '#src/core/types.js';
+/**
+ * Approval persistence scopes, widest-lived last. Alias of the canonical
+ * {@link ToolApprovalScope} so the allow-list engine and the decision vocabulary stay in sync.
+ */
+export type ApprovalScope = ToolApprovalScope;
+/**
+ * Decide whether a candidate argv contains a flag that *widens* the approved operation.
+ *
+ * Rule implemented (documented for the coordinator):
+ *  - Re-derive the meaningful prefix from the candidate's actual argv.
+ *  - Inspect every token of the candidate that is a flag (starts with `-`).
+ *  - If any flag token — normalized by stripping a trailing `=value` and lowercasing —
+ *    is in {@link WIDENING_FLAGS}, the command is considered a widening of the approved
+ *    operation and the match is REFUSED (returns true).
+ *
+ * This is purposely a deny-list of operation-changing flags rather than an allow-list of
+ * benign flags: benign flag variants (`-b`, `--oneline`, `-la`) are exactly what we WANT
+ * to keep auto-approving, while the handful of "run-an-arbitrary-program / redirect-the-
+ * transport" flags are what an injected approval must never silently enable.
+ */
+export declare function hasWideningFlag(argv: string[]): boolean;
+/**
+ * A holder of approved prefixes with set semantics. Used for both the in-memory session
+ * store and the loaded persisted store. Pure data + membership; persistence is layered on
+ * top by {@link PersistedAllowlist}.
+ */
+export declare class AllowlistStore {
+    private readonly prefixes;
+    constructor(initial?: Iterable<string>);
+    has(prefix: string): boolean;
+    add(prefix: string): void;
+    list(): string[];
+}
+/**
+ * The persisted (`always`) allow-list, backed by a JSON file. The path is injected (the
+ * runner resolves it via fileUtils → `.gsloth/.gsloth-settings/shell-allowlist.json`) so
+ * tests can point it at a temp dir. Loads lazily/defensively: a missing or malformed file
+ * yields an empty store rather than throwing (fail-open on READ is safe — an empty
+ * allow-list just means "prompt"; it never auto-approves anything).
+ */
+export declare class PersistedAllowlist {
+    private readonly store;
+    private readonly filePath;
+    constructor(filePath: string);
+    private static load;
+    has(prefix: string): boolean;
+    list(): string[];
+    /** Add a prefix and persist the whole set to disk. */
+    add(prefix: string): void;
+    private persist;
+}
+/**
+ * Read-only view over the stores consulted for an auto-approval check. The runner passes
+ * its per-instance session store and (optionally) the persisted store.
+ */
+export interface ApprovalStores {
+    session: Pick<AllowlistStore, 'has'>;
+    always?: Pick<PersistedAllowlist, 'has'>;
+}
+/**
+ * Decide whether `command` is already approved by the given stores — the gate the runner
+ * consults BEFORE prompting the human.
+ *
+ * Returns true ONLY when ALL of the following hold:
+ *  1. {@link classifyCommand} returns a non-null classification (so composition /
+ *     substitution / redirection commands can never match — anti-injection layer 1);
+ *  2. the classified prefix is present in the session OR persisted (`always`) store; AND
+ *  3. the safe-bin re-validation passes: the candidate's actual argv contains no
+ *     operation-widening flag (anti-injection layer 2 — see {@link hasWideningFlag}).
+ *
+ * Anything else (unclassifiable, unknown prefix, or a widening flag) → false → the human
+ * is prompted. Fail-closed by construction.
+ */
+export declare function matchesApproval(command: string, stores: ApprovalStores): boolean;

package/dist/core/shell/allowlist.js

@@ -0,0 +1,187 @@
+/**
+ * @module core/shell/allowlist
+ *
+ * EXT-9 Tier-2: the persisted + session-scoped allow-list engine for the opt-in
+ * `run_shell_command` tool. Once a human approves a command at `session` or `always`
+ * scope, future commands with the same classified prefix ({@link classifyCommand}) are
+ * auto-approved without re-prompting — the ergonomics improvement mature agents
+ * (opencode/openclaw/hermes) ship.
+ *
+ * SECURITY — a naive "remember the prefix" allow-list is an injection vector. Two layers
+ * guard it:
+ *  1. **Classification fail-closed** (arity.ts): any command with shell composition,
+ *     substitution, or redirection returns `null` and can NEVER match, so
+ *     `git checkout x; rm -rf /` does not ride an approved `git checkout *`.
+ *  2. **Safe-bin anti-widening re-validation** (here, after opencode/openclaw): a stored
+ *     approval is matched ONLY if the candidate command's first non-flag operand region
+ *     does not introduce a flag that *widens or redirects* the approved operation. The
+ *     exact rule is documented on {@link matchesApproval} / {@link hasWideningFlag}.
+ *
+ * No module-global mutable state: the session store is a per-instance class so concurrent
+ * sessions (ACP / AG-UI multi-session) cannot stomp each other. The persisted (`always`)
+ * store is a small JSON file the runner loads once per instance.
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { classifyCommand, tokenize } from '#src/core/shell/arity.js';
+import { normalizeCommand } from '#src/core/shell/normalize.js';
+const PERSISTED_VERSION = 1;
+/**
+ * Flags that, if present in a candidate command but not implied by the approved prefix,
+ * could change the *operation* the human approved (point it at a different transport,
+ * exec a hook, follow an attacker-controlled URL). Approving `git clone` must not
+ * green-light `git clone --upload-pack=evil`. This list is intentionally conservative:
+ * it is the openclaw "safe-bin" idea reduced to a deny-set of operation-changing flags
+ * that commonly appear in shell-injection / supply-chain abuse.
+ *
+ * Matched against the flag token with any `=value` stripped, case-insensitively.
+ */
+const WIDENING_FLAGS = new Set([
+    // git: remote command / hook overrides.
+    '--upload-pack',
+    '--receive-pack',
+    '--exec',
+    '-u', // git clone -u <upload-pack>
+    '--config', // git -c is the short form; --config can inject core.sshCommand etc.
+    '-c', // git -c core.sshCommand='...' — arbitrary command execution
+    // generic "run this program" escape hatches across tools.
+    '--exec-path',
+    '-exec', // find -exec <cmd>
+    '--use-askpass',
+    '--ssh-command',
+    // package managers: lifecycle-script / arbitrary-script toggles.
+    '--unsafe-perm',
+    '--ignore-scripts=false',
+    '--allow-scripts',
+    // curl/wget style follow/exec (in case a bare binary is approved).
+    '-o', // write to arbitrary path
+    '--output',
+    '-T', // upload
+    '--upload-file',
+]);
+/**
+ * Decide whether a candidate argv contains a flag that *widens* the approved operation.
+ *
+ * Rule implemented (documented for the coordinator):
+ *  - Re-derive the meaningful prefix from the candidate's actual argv.
+ *  - Inspect every token of the candidate that is a flag (starts with `-`).
+ *  - If any flag token — normalized by stripping a trailing `=value` and lowercasing —
+ *    is in {@link WIDENING_FLAGS}, the command is considered a widening of the approved
+ *    operation and the match is REFUSED (returns true).
+ *
+ * This is purposely a deny-list of operation-changing flags rather than an allow-list of
+ * benign flags: benign flag variants (`-b`, `--oneline`, `-la`) are exactly what we WANT
+ * to keep auto-approving, while the handful of "run-an-arbitrary-program / redirect-the-
+ * transport" flags are what an injected approval must never silently enable.
+ */
+export function hasWideningFlag(argv) {
+    for (const tok of argv) {
+        if (!tok.startsWith('-'))
+            continue;
+        const bare = tok.split('=', 1)[0].toLowerCase();
+        if (WIDENING_FLAGS.has(bare))
+            return true;
+    }
+    return false;
+}
+/**
+ * A holder of approved prefixes with set semantics. Used for both the in-memory session
+ * store and the loaded persisted store. Pure data + membership; persistence is layered on
+ * top by {@link PersistedAllowlist}.
+ */
+export class AllowlistStore {
+    prefixes;
+    constructor(initial = []) {
+        this.prefixes = new Set(initial);
+    }
+    has(prefix) {
+        return this.prefixes.has(prefix);
+    }
+    add(prefix) {
+        this.prefixes.add(prefix);
+    }
+    list() {
+        return [...this.prefixes];
+    }
+}
+/**
+ * The persisted (`always`) allow-list, backed by a JSON file. The path is injected (the
+ * runner resolves it via fileUtils → `.gsloth/.gsloth-settings/shell-allowlist.json`) so
+ * tests can point it at a temp dir. Loads lazily/defensively: a missing or malformed file
+ * yields an empty store rather than throwing (fail-open on READ is safe — an empty
+ * allow-list just means "prompt"; it never auto-approves anything).
+ */
+export class PersistedAllowlist {
+    store;
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+        this.store = new AllowlistStore(PersistedAllowlist.load(filePath));
+    }
+    static load(filePath) {
+        try {
+            if (!existsSync(filePath))
+                return [];
+            const raw = readFileSync(filePath, 'utf8');
+            const parsed = JSON.parse(raw);
+            if (!parsed || !Array.isArray(parsed.prefixes))
+                return [];
+            return parsed.prefixes.filter((p) => typeof p === 'string');
+        }
+        catch {
+            // Corrupt/unreadable file → behave as empty (fail-closed on auto-approval).
+            return [];
+        }
+    }
+    has(prefix) {
+        return this.store.has(prefix);
+    }
+    list() {
+        return this.store.list();
+    }
+    /** Add a prefix and persist the whole set to disk. */
+    add(prefix) {
+        if (this.store.has(prefix))
+            return;
+        this.store.add(prefix);
+        this.persist();
+    }
+    persist() {
+        const file = {
+            version: PERSISTED_VERSION,
+            prefixes: this.store.list().sort(),
+        };
+        writeFileSync(this.filePath, JSON.stringify(file, null, 2) + '\n', 'utf8');
+    }
+}
+/**
+ * Decide whether `command` is already approved by the given stores — the gate the runner
+ * consults BEFORE prompting the human.
+ *
+ * Returns true ONLY when ALL of the following hold:
+ *  1. {@link classifyCommand} returns a non-null classification (so composition /
+ *     substitution / redirection commands can never match — anti-injection layer 1);
+ *  2. the classified prefix is present in the session OR persisted (`always`) store; AND
+ *  3. the safe-bin re-validation passes: the candidate's actual argv contains no
+ *     operation-widening flag (anti-injection layer 2 — see {@link hasWideningFlag}).
+ *
+ * Anything else (unclassifiable, unknown prefix, or a widening flag) → false → the human
+ * is prompted. Fail-closed by construction.
+ */
+export function matchesApproval(command, stores) {
+    const classification = classifyCommand(command, normalizeCommand);
+    if (!classification)
+        return false; // layer 1: composition/redirection/substitution.
+    const approved = stores.session.has(classification.prefix) ||
+        (stores.always?.has(classification.prefix) ?? false);
+    if (!approved)
+        return false;
+    // Layer 2: re-derive argv from the normalized command and refuse if an operation-
+    // widening flag is present that the human's prefix-level approval never implied.
+    const argv = tokenize(normalizeCommand(command));
+    if (!argv)
+        return false; // unbalanced quoting → fail-closed.
+    if (hasWideningFlag(argv))
+        return false;
+    return true;
+}
+//# sourceMappingURL=allowlist.js.map

package/dist/core/shell/allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../../../src/core/shell/allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAgBhE,MAAM,iBAAiB,GAAG,CAAU,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,wCAAwC;IACxC,eAAe;IACf,gBAAgB;IAChB,QAAQ;IACR,IAAI,EAAE,6BAA6B;IACnC,UAAU,EAAE,qEAAqE;IACjF,IAAI,EAAE,6DAA6D;IACnE,0DAA0D;IAC1D,aAAa;IACb,OAAO,EAAE,mBAAmB;IAC5B,eAAe;IACf,eAAe;IACf,iEAAiE;IACjE,eAAe;IACf,wBAAwB;IACxB,iBAAiB;IACjB,mEAAmE;IACnE,IAAI,EAAE,0BAA0B;IAChC,UAAU;IACV,IAAI,EAAE,SAAS;IACf,eAAe;CAChB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAc;IACR,QAAQ,CAAc;IAEvC,YAAY,UAA4B,EAAE;QACxC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACZ,KAAK,CAAiB;IACtB,QAAQ,CAAS;IAElC,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,IAAI,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,MAAM,CAAC,IAAI,CAAC,QAAgB;QAClC,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoC,CAAC;YAClE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC1D,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,sDAAsD;IACtD,GAAG,CAAC,MAAc;QAChB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEO,OAAO;QACb,MAAM,IAAI,GAA2B;YACnC,OAAO,EAAE,iBAAiB;YAC1B,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE;SACnC,CAAC;QACF,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;CACF;AAWD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,MAAsB;IACrE,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAClE,IAAI,CAAC,cAAc;QAAE,OAAO,KAAK,CAAC,CAAC,iDAAiD;IAEpF,MAAM,QAAQ,GACZ,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC;QACzC,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,kFAAkF;IAClF,iFAAiF;IACjF,MAAM,IAAI,GAAG,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,oCAAoC;IAC7D,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAExC,OAAO,IAAI,CAAC;AACd,CAAC"}