@gaunt-sloth/core 2.0.0-alpha.29 → 2.0.0-alpha.30

package/dist/config/shell-policy.js

@@ -14,6 +14,7 @@
  * keeps the toolkit/accessor surface stable while the single config surface is `builtInTools`.
  */
 import { StatusLevel } from '#src/core/types.js';
+import { isAccessClassGrantedAtRung } from '#src/config/tool-descriptions.js';
 /**
  * The fixed dev-command tools: each maps a `command` string (from its {@link BuiltInToolConfig})
  * to a run_* tool emitted by {@link GthDevToolkit}.
@@ -196,80 +197,369 @@ export function getEffectiveDevToolsConfig(config, command) {
  * -------------------------------------------------------------------------------------------- */
 /**
  * CFG-27 (spec §1, §2) — **the ladder**. There is ONE approvals setting and it is a single ordered
- * ladder of five rungs; each rung fully determines behaviour. There are no severity thresholds, no
- * strictness levels and no independent rater on/off switch.
+ * ladder; each rung fully determines behaviour. There are no severity thresholds, no strictness
+ * levels and no independent rater on/off switch.
  *
  * | # | Rung | Rater | LLM cost |
  * |---|---|---|---|
- * | 1 | `read-only` | no | none |
+ * | 1 | `manual` | no | none |
  * | 2 | `write` | no | none |
- * | 3 | `auto-safe` | yes | 1 call per gated call |
- * | 4 | `full-auto` | yes | 1–2 calls per gated call |
+ * | 3 | `assisted` | yes | 1 call per gated call |
+ * | 4 | `auto` | yes | 1–2 calls per gated call |
  * | 5 | `bypass` | no | none |
  *
  * Rungs 1, 2 and 5 are fully deterministic: no model is consulted, so behaviour is reproducible
  * and costs nothing.
  *
- * **`bypass` is NOT a higher-autonomy rung than `full-auto`** (§2.5). Both let the agent act
+ * **CFG-39 — four postures plus one modifier, not five peers.** `write` is not a rung on a trust
+ * ladder: it is the same posture as `manual` with a different auto-granted set. The four postures
+ * a user chooses between are {@link APPROVAL_POSTURES} (`manual` → `assisted` → `auto`, plus
+ * `bypass`), and that ordering is legible in the names themselves. `write` remains fully settable
+ * — via `/approvals write` and via config — and simply does not occupy a row in quick access.
+ * This constant keeps ALL FIVE members: it is the type's domain, the set
+ * {@link resolveInterruptToolNames} unions over, and what makes `write` settable at all.
+ *
+ * **`bypass` is NOT a higher-autonomy rung than `auto`** (§2.5). Both let the agent act
  * without asking; `bypass` is the same autonomy with the checks removed. The ordering below is the
- * order the rungs are *offered* in, and must never be presented as though `full-auto` were an
+ * order the rungs are *offered* in, and must never be presented as though `auto` were an
  * incomplete `bypass`.
  *
- * Identifiers are kebab-case (§9.1) because the same token must work as a config value, a
- * slash-command argument and a CLI flag — a space breaks the last two. Display names keep their
- * spaces; see {@link APPROVAL_RUNG_LABELS}.
+ * Identifiers are lower-case single words (§9.1) because the same token must work as a config
+ * value, a slash-command argument and a CLI flag — a space breaks the last two. Display names are
+ * capitalised; see {@link APPROVAL_RUNG_LABELS}.
  */
-export const APPROVAL_RUNGS = ['read-only', 'write', 'auto-safe', 'full-auto', 'bypass'];
+export const APPROVAL_RUNGS = ['manual', 'write', 'assisted', 'auto', 'bypass'];
 /**
  * §9.1 rule / §10 rule 4 — the display spelling of each rung, with spaces. An identifier and a
  * label do not have to match and only one of them has to survive a shell, so user-facing prose
  * uses these and never the kebab-case identifiers.
  */
 export const APPROVAL_RUNG_LABELS = {
-    'read-only': 'Read only',
+    manual: 'Manual',
     write: 'Write',
-    'auto-safe': 'Auto safe',
-    'full-auto': 'Full auto',
+    assisted: 'Assisted',
+    auto: 'Auto',
     bypass: 'Bypass',
 };
 /**
- * §10 — the one sentence shown wherever a rung is chosen or displayed. **Copied verbatim from the
- * specification**; the wording is constrained by four normative rules there (state what the rung
- * PERMITS, state the allow-list carve-out, never claim safety this system cannot deliver, use the
- * display spelling) plus §8.1 (the hardline floor is real but is NEVER advertised — descriptions
- * cite only protections the user can inspect and extend, i.e. the deny list). Do not "improve"
- * these: `auto-safe` in particular MUST keep the sentence saying files are still rewritten and
- * deleted without asking.
- *
- * The only departure from the source text is that §10's markdown emphasis markers (`**not**` in
- * *Full auto*) are dropped, since these strings are rendered as plain terminal copy.
+ * CFG-39 — **the four postures**, in the order they are offered: the rows `/approvals` presents
+ * when it asks the user to choose one.
+ *
+ * `write` is deliberately absent, and its absence is the whole point of the reframe. It is not a
+ * rung on a trust ladder — it is `manual`'s posture with a different auto-granted set, so listing
+ * it as a fifth peer is what made a four-point ladder read as five indistinguishable ones. It stays
+ * fully settable via `/approvals write` and via config; it simply leaves quick access.
+ *
+ * **This is a presentation list, never a policy one.** Every predicate, every `Record<ApprovalRung,
+ * …>` and the interrupt set are built from {@link APPROVAL_RUNGS}, which keeps all five. Using this
+ * constant to decide behaviour would silently un-settle `write`.
+ */
+export const APPROVAL_POSTURES = [
+    'manual',
+    'assisted',
+    'auto',
+    'bypass',
+];
+/**
+ * CFG-39 — the one-line note that `write` exists, shown as picker CHROME beside the `manual` row.
+ *
+ * It lives here rather than appended to {@link APPROVAL_RUNG_DESCRIPTIONS}`.manual` on purpose: the
+ * descriptions are one surface's copy shared by six, so a sentence about quick-access mechanics
+ * would follow the mode into the status display and the tool-description layer, where it means
+ * nothing.
+ */
+export const APPROVAL_WRITE_MODIFIER_HINT = 'Manual also has a Write variant that may edit files in your working folder without asking: ' +
+    'set it with /approvals write.';
+/**
+ * §10 — what each mode is **for**, in at most two sentences, shown wherever a mode is chosen or
+ * displayed.
+ *
+ * **The first sentence is load-bearing and must stand alone.** The `/approvals` picker, the text
+ * fallback and the usage hint all render one line per mode through `firstSentence`, so sentence
+ * one has to answer "what is this mode for" on its own and sentence two carries the qualification.
+ * Keep it short enough to read as a menu row.
+ *
+ * **Say what the mode is for, not only what it permits.** A description that lists permissions
+ * invites the category error these modes actually suffer: Manual reads as "the safe one", so it
+ * gets picked for a long unattended run — where the deciding is done by a human, and a human is the
+ * fastest-degrading decider in the system. Manual and Write are bounded-volume tools and their copy
+ * says so.
+ *
+ * The wording is constrained by four normative rules (state what the mode PERMITS, state the
+ * allow-list carve-out, never claim safety this system cannot deliver, use the display spelling)
+ * plus §8.1 — the hardline floor is real but is NEVER advertised, so descriptions cite only
+ * protections the user can inspect and extend, i.e. the deny list. Five further constraints bind
+ * every edit here:
+ *
+ * 1. **No description may imply containment.** The gate protects against accidents, not intent, and
+ *    a working-folder claim collapses the moment the agent has a shell — `write_file` refuses a
+ *    path that `touch` then writes. The narrow true form (the built-in file *tools* are confined)
+ *    is stated once, on `write`, alongside the fact that the shell is not confined that way.
+ * 2. **Claims are scoped to the session the user is in.** These strings render on terminal surfaces
+ *    only; a sentence whose subject is "Gaunt Sloth" and whose claim is that it always asks would
+ *    be false over the AG-UI and ACP servers, which never drain an approval interrupt ([[EXT-94]]).
+ * 3. **`assisted` MUST keep the sentence saying files are still rewritten and deleted without
+ *    asking** — it sounds safer than it is, and that clause is the correction.
+ * 4. **A qualification may not live in the second sentence alone.** The picker, the text fallback
+ *    and the usage hint all render `firstSentence` and nothing else, so the opener is the whole
+ *    message on the three surfaces a user reads while *choosing* a mode. An opener that sells a
+ *    behavioural difference the product does not have is not rescued by a sentence two those
+ *    surfaces never print — check a wording by rendering it, not by reading the constant.
+ * 5. **`auto` is the mode a reader most wants to hear is quiet, and it is not.** It settles some
+ *    risky commands with the rater instead of interrupting — that difference is real and may be
+ *    stated — but the copy MUST also say that a bounded exchange ends at the user, and MUST NOT
+ *    promise the user watches it happen. The rounds reach a person at the escalation, all of them
+ *    at once, and nothing renders them before that ([[TUI-C26]]), so a sentence implying a live
+ *    commentary would be describing a screen that does not exist.
+ *
+ * Everything these two sentences cannot hold lives at {@link APPROVAL_PROTECTION_DOCS_URL}, which
+ * the surfaces print beside the copy rather than each description repeating it.
  */
 export const APPROVAL_RUNG_DESCRIPTIONS = {
-    'read-only': 'Gaunt Sloth may automatically read and list files in the current working folder. It asks ' +
-        'for approval for anything else, until you tell it to always allow a command.',
-    write: 'Gaunt Sloth may automatically read, edit, create and delete files in the current working ' +
-        'folder. It asks for approval for anything else, until you tell it to always allow a command.',
-    'auto-safe': 'Same as write, plus the auto-rater rates everything else and automatically approves what it ' +
-        'rates as safe; anything questionable comes to you. Gaunt Sloth can still rewrite and delete ' +
-        'files in your working folder without asking — "safe" means each action is checked for ' +
-        'reaching outside that folder or harming your system, not that nothing changes.',
-    'full-auto': 'The auto-rater steers Gaunt Sloth: it decides for itself and does not stop to ask you. This ' +
-        'is safer than bypass — the auto-rater still stops the run on a command that reads your keys ' +
-        'or passwords, weakens permissions, installs itself to run again later, or hides what it ' +
-        'does; it brings anything it cannot undo to you rather than deciding alone; and your deny ' +
-        'list still applies — but it is not safe. Gaunt Sloth will change and delete things. Use it ' +
-        'where the consequences are recoverable, and put real gates (deployment approvals, ' +
-        'two-factor, branch protection) on anything that is not.',
-    bypass: 'No gate. Gaunt Sloth runs whatever it decides to run, without asking and without rating. ' +
-        'Only the refusals configured in the deny list in your config still apply.',
+    manual: 'For a handful of commands you want to read yourself — not a mode to leave running. In this ' +
+        'session Gaunt Sloth reads and lists files in your working folder on its own; everything ' +
+        'else — shell, file changes, MCP and custom tools — comes to you, until you tell it to always ' +
+        'allow a command.',
+    write: 'Manual, for work that is mostly editing, and like Manual a bounded stretch: the built-in ' +
+        'file tools run free inside your working folder. The shell is not confined that way, so shell ' +
+        'commands, MCP calls and custom tools still come to you, until you tell it to always allow a ' +
+        'command.',
+    assisted: 'For everyday work: safe commands run, anything riskier comes to you — usually with a line ' +
+        'explaining what it does. Gaunt Sloth can still rewrite and delete files in your working ' +
+        'folder without asking — "safe" means each action is checked for reaching outside that folder ' +
+        'or harming your system, not that nothing changes.',
+    auto: 'For work you want to keep moving: Auto sends a risky command back to the agent to fix or ' +
+        'justify a few times, then stops and asks you. It is not safe — Gaunt Sloth will change and ' +
+        'delete things, your deny list still applies, and when it does ask, you are shown the whole ' +
+        'argument that led there.',
+    bypass: 'No gate, for a throwaway environment you would not mind losing. Whatever Gaunt Sloth decides ' +
+        'to run, runs — nothing is rated and nothing is asked; only the refusals in your config’s ' +
+        'deny list still apply.',
 };
+/**
+ * The page that carries what these modes do and do NOT protect you from — the reasoning the
+ * two-sentence descriptions deliberately do not hold.
+ *
+ * **A GitHub blob URL, matching the one other user-facing runtime doc link in this package** (the
+ * 2.0 migration pointer in `config/schema.ts`). The docs site publishes the same page at
+ * `https://gauntsloth.app/docs/guides/what-approvals-protect-you-from/`; move this constant there
+ * once that path serves the page, and nothing else changes.
+ */
+export const APPROVAL_PROTECTION_DOCS_URL = 'https://github.com/pukeko-robotics/gaunt-sloth/blob/main/docs/guides/what-approvals-protect-you-from.md';
+/**
+ * The docs pointer as the surfaces print it: **label and URL as two separate lines**, never one
+ * joined string. Every notice surface takes `lines: string[]` and renders one line each, so a bare
+ * URL on its own line is the only form that survives a narrow pane without the break landing
+ * mid-path — and it is what lets a terminal that linkifies URLs pick the whole thing up.
+ *
+ * It lives beside the descriptions rather than inside them for {@link APPROVAL_WRITE_MODIFIER_HINT}'s
+ * reason: one line about where to read more, repeated into all five descriptions, would follow each
+ * mode into the tool-description layer and the status display, where it is noise.
+ */
+export const APPROVAL_PROTECTION_DOCS_LINES = [
+    'What these modes do and do not protect you from:',
+    APPROVAL_PROTECTION_DOCS_URL,
+];
 /** Narrowing type guard for a raw string that may name a rung. */
 export function isApprovalRung(value) {
     return typeof value === 'string' && APPROVAL_RUNGS.includes(value);
 }
 /** The rungs at which every gated call is rated by the model (§2.3, §2.4). */
 export function isRatedRung(rung) {
-    return rung === 'auto-safe' || rung === 'full-auto';
+    return rung === 'assisted' || rung === 'auto';
+}
+/**
+ * [[EXT-29]] (§5) — the rung at which a `destructive` rating opens a **negotiation** with the rater
+ * instead of going to the human: the agent may revise the command or justify it, the rater re-rates
+ * with the exchange in view, and only a spent bound reaches a person.
+ *
+ * **This is the one predicate that separates `auto` from `assisted`, and it is deliberately ONE.**
+ * Three places have to agree about it — the decision mapping
+ * ({@link import('../core/shell/rater.js').mapVerdictToAction}, which returns `reject` here and
+ * `escalate` at `assisted`), the rating prompt (§5.2's wording rules are addressed to the agent, so
+ * they are turned on by this and not by whether a transcript happens to exist yet), and the runner
+ * that counts the rounds. Two of them agreeing and the third not is exactly how the two rated rungs
+ * would drift back into being the same posture with different names.
+ *
+ * Written as a `=== 'auto'` test rather than as "rated but not assisted" so that a sixth rung has to
+ * be classified deliberately rather than inheriting a negotiation by omission.
+ */
+export function isNegotiatingRung(rung) {
+    return rung === 'auto';
+}
+/**
+ * The rungs that decide a gated call **without a model** — `manual` and `write` (§2.1, §2.2).
+ * Everything they do not auto-grant goes to the human, so these are the two rungs a user picks in
+ * order to read and approve every tool call themselves.
+ *
+ * The complement of {@link isRatedRung} plus `bypass`; written out rather than negated so that a
+ * sixth rung would have to be classified deliberately instead of defaulting into this set.
+ */
+export function isDeterministicRung(rung) {
+    return rung === 'manual' || rung === 'write';
+}
+/**
+ * **The one rule: does `rung` gate this tool — i.e. must this call be decided rather than simply
+ * run?** Everything else in this area is a projection of this predicate over a set of names.
+ *
+ * - The shell is gated whenever the shell gate is on, at EVERY rung (`bypass` included, so §2.5's
+ *   deny list can still fire — see the `bypass` arm of `GthAgentRunner.decideToolApproval`).
+ * - At the two **deterministic** rungs, a tool is gated when the rung's own grant does not cover its
+ *   access class ({@link isAccessClassGrantedAtRung}). At `manual` that leaves only the built-in
+ *   READ tools free; at `write`, the built-in read and write tools. The write built-ins, the shell,
+ *   deepagents' `execute`, MCP tools and custom/agent-authored tools all escalate to the human.
+ * - At `assisted`, `auto` and `bypass` nothing but the shell is gated. **That split is
+ *   deliberate and load-bearing, not tidiness.** At a rated rung a gated non-shell call reaches the
+ *   `subject.kind !== 'shell'` arm of `GthAgentRunner.decideToolApproval`, which floors it at
+ *   `destructive` and sends it to the human *with no rating call*, because §4.3 keeps the rater on
+ *   the shell until [[EXT-30]]. Gating there would silently turn every MCP call at `assisted` into
+ *   a human prompt — a UX change belonging to EXT-30, not to the two rungs whose published
+ *   descriptions this predicate makes true.
+ *
+ * `gateShell` only ever WIDENS the result. At a deterministic rung the shell is gated by its own
+ * (absent) access class if it is bound at all, so `gateShell: false` does not exempt it — an
+ * exemption keyed to one tool NAME is the defect class this predicate exists to remove. In practice
+ * a disabled shell tool is never bound, so the two agree.
+ *
+ * **This takes no bound toolset**, which is what lets `GthAgentRunner` ask it about a single
+ * arriving call: the runner sees the names the graph registered, and on the deep backend that list
+ * omits tools deepagents registers itself. A decision that consulted a bound list would grant
+ * `execute` at `manual` purely because the runner could not see it.
+ */
+export function isToolGatedAtRung(options) {
+    const { toolName, rung, gateShell } = options;
+    if (gateShell && toolName === SHELL_TOOL_NAME)
+        return true;
+    if (!isDeterministicRung(rung))
+        return false;
+    return !isAccessClassGrantedAtRung(toolName, rung);
+}
+/**
+ * **The LIVE gated set: which bound tools the rung in force actually gates.** What a decision is
+ * measured against — the tool descriptions the model reads (§4.5) and the rater's granted-tools
+ * summary (§4.4) are both built from this, so neither can tell the model a tool is free while the
+ * gate escalates it.
+ *
+ * **It is NOT what the backends wire into the interrupt.** That is
+ * {@link resolveInterruptToolNames}, and the two are different sets on purpose: the interrupt is
+ * installed once, at agent init, while `/approvals <rung>` moves the rung underneath it for the rest
+ * of the session. A set that carried the rung would be frozen at the rung the session started on —
+ * and since the default is `assisted`, typing `/approvals manual` would leave exactly the write
+ * tools this design escalates ungated. So the interrupt is wired rung-independently and
+ * `GthAgentRunner.decideToolApproval` consults {@link isToolGatedAtRung} against the LIVE rung.
+ *
+ * **Derived from the bound toolset, never a hand-written list.** A static list of built-ins would
+ * leave MCP, custom and agent-authored tools out — the exact tools with no access class and so the
+ * exact tools the deterministic rungs must escalate. `boundToolNames` must therefore be the FINAL
+ * toolset the graph is handed, including tools the graph builder registers itself (deepagents'
+ * filesystem tools, `execute`, `task` and `write_todos` never appear in the array gsloth passes it).
+ *
+ * Order is stable: the shell first, then bound order. Duplicates are collapsed, so a caller may pass
+ * overlapping name sources without deduplicating first.
+ */
+export function resolveGatedToolNames(options) {
+    const { rung, gateShell, boundToolNames } = options;
+    return collectToolNames(gateShell, boundToolNames, (name) => isToolGatedAtRung({ toolName: name, rung, gateShell }));
+}
+/**
+ * **Which commands have something that ANSWERS an approval interrupt.**
+ *
+ * `GthAgentRunner` is the one component that drains a suspended graph
+ * (`resolveToolInterrupts` → `decideToolApproval`) and the one that holds the session rung, so every
+ * command it drives answers approvals and can move the rung under a running session.
+ *
+ * **The AG-UI server (`api`) does not.** It drives the agent directly — `agent.init` +
+ * `streamWithEvents` — and its resume path serves its own frontend-tool `interrupt()` stubs, not
+ * approvals. An approval interrupt raised there suspends the graph with nobody to resume it: the
+ * tool never runs, the client is never asked, and the turn simply ends with that tool call
+ * unanswered. Measured, not inferred.
+ *
+ * So a command that answers nothing must be handed **no approval interrupt beyond what the shell
+ * gate itself requires** — see the `interruptTools` wiring in both backends. In particular it must
+ * NOT be handed the LIVE set for its configured rung: that set is non-empty at `manual` and
+ * `write`, so it carries exactly the same trap, and `commands.api.approvals` (plus a root-level
+ * `approvals`, which applies to every command) puts an ordinary config on those rungs.
+ *
+ * **Total over {@link GthCommand} on purpose.** An eighth command has to be classified here before
+ * it compiles, rather than defaulting silently into "answers approvals". The property is really
+ * about the DRIVER and not about the command — a second server built under an existing command that
+ * drives the agent without `GthAgentRunner` would inherit the trap with this record fully populated
+ * — so the shape that cannot rot at all is for the constructing surface to declare it at its own
+ * call site.
+ *
+ * Approvals for the AG-UI surface are [[EXT-30]]'s to build; until then this keeps a rung the server
+ * cannot serve from silently swallowing the tool calls it was asked to make.
+ */
+const COMMAND_ANSWERS_APPROVALS = {
+    ask: true,
+    chat: true,
+    code: true,
+    exec: true,
+    pr: true,
+    review: true,
+    /** The AG-UI server: it drives the agent itself and drains nothing. */
+    api: false,
+};
+/**
+ * {@link COMMAND_ANSWERS_APPROVALS} as a predicate. An unset command is a session driven by
+ * `GthAgentRunner` (nothing else leaves it unset), so it answers approvals.
+ *
+ * **`?? true` is the fail-safe default, not defensive noise.** The lookup yields `undefined` for a
+ * value outside {@link GthCommand}, and `undefined` is falsy — which would tell the caller to
+ * install NO approval interrupt, the one direction this predicate must never fail in. TypeScript
+ * makes that unreachable from inside this repo, but the function is re-exported from the public
+ * `@gaunt-sloth/core/config.js` barrel, so an untyped consumer can reach it. The coalesce restores
+ * runtime totality without weakening the compile-time totality the record already gives.
+ */
+export function commandAnswersApprovals(command) {
+    return command === undefined ? true : (COMMAND_ANSWERS_APPROVALS[command] ?? true);
+}
+/**
+ * **The interrupt set: which tool names the backends wire into the approval interrupt.** Every bound
+ * tool that ANY rung could gate — the union of {@link resolveGatedToolNames} over
+ * {@link APPROVAL_RUNGS}, which in practice is the shell plus every bound tool that is not a
+ * built-in READ tool.
+ *
+ * One derivation for both backends, for the same reason {@link resolveShellApprovalGate} is one: the
+ * lean backend installs `humanInTheLoopMiddleware` directly and the deep backend installs the very
+ * same middleware through deepagents' `interruptOn`, and a set computed twice is a set that drifts.
+ *
+ * **Deliberately rung-independent.** The interrupt is installed once, when the agent is built, and
+ * `/approvals <rung>` then moves the rung for the rest of the session without rebuilding it. Only a
+ * set that covers every rung can survive that: the interrupt fires and
+ * `GthAgentRunner.decideToolApproval` decides on the rung in force, which is where the rung has
+ * always been read. **Wiring wider does not gate wider** — a call the live rung does not gate is
+ * approved there with no rating call and no prompt, so `assisted`, `auto` and `bypass` behave
+ * exactly as they do when the interrupt holds the shell alone.
+ *
+ * **Only for a command that answers approvals** ({@link commandAnswersApprovals}). A surface that
+ * drains nothing gets the shell-gate set instead, because a rung-independent set there parks tool
+ * calls nobody can reach.
+ */
+export function resolveInterruptToolNames(options) {
+    const { gateShell, boundToolNames } = options;
+    return collectToolNames(gateShell, boundToolNames, (name) => APPROVAL_RUNGS.some((rung) => isToolGatedAtRung({ toolName: name, rung, gateShell })));
+}
+/**
+ * Shared body of the two resolvers above: the shell first (when gated), then the bound names the
+ * caller's predicate selects, in bound order, deduplicated, with nameless entries dropped.
+ */
+function collectToolNames(gateShell, boundToolNames, include) {
+    const names = [];
+    const seen = new Set();
+    const add = (name) => {
+        if (typeof name !== 'string' || name.length === 0 || seen.has(name))
+            return;
+        seen.add(name);
+        names.push(name);
+    };
+    if (gateShell)
+        add(SHELL_TOOL_NAME);
+    for (const name of boundToolNames) {
+        if (typeof name === 'string' && name.length > 0 && include(name))
+            add(name);
+    }
+    return names;
 }
 /**
  * §4.7 — the four MCP `ToolAnnotations` hint names, and the whole vocabulary. It is the same list
@@ -296,13 +586,13 @@ export const TOOL_ANNOTATION_HINTS = [
     'openWorldHint',
 ];
 /**
- * §1.1 — **the default rung is `auto-safe`, everywhere.** It is the default in every interactive
+ * §1.1 — **the default rung is `assisted`, everywhere.** It is the default in every interactive
  * context, it does NOT vary with the configured model, and there is no separate non-interactive
  * default. What changes without a human is what an escalation *does* (§6.2: an immediate non-zero
  * exit, never an approval), not which rung the session starts on. A context-dependent default
  * would reintroduce exactly the hidden branching this ladder exists to remove.
  */
-export const DEFAULT_APPROVAL_RUNG = 'auto-safe';
+export const DEFAULT_APPROVAL_RUNG = 'assisted';
 /** Normalize the scalar/object union to the object form. The scalar is sugar for `{ mode }`. */
 function toApprovalsObject(raw) {
     if (raw === undefined)
@@ -314,7 +604,7 @@ function toApprovalsObject(raw) {
 /**
  * CFG-27 — resolve the effective {@link ResolvedApprovals} for the active command.
  *
- * There is no defaults *matrix*: §1.1 makes `auto-safe` the default in every context, so this
+ * There is no defaults *matrix*: §1.1 makes `assisted` the default in every context, so this
  * resolver neither detects nor accepts a "context". Precedence is the only thing it decides, and
  * §9.1 splits it in two:
  *
@@ -400,10 +690,15 @@ export function resolveApprovals(config, command) {
  *
  * What each rung then does is decided in `decideToolApproval`, not here:
  *   • `bypass` — deny list, then approve without prompting or rating.
- *   • `read-only`/`write` — deny list, allow-list, else escalate to the human.
- *   • `auto-safe`/`full-auto` — deny list, allow-list, then the rater.
- *   • With the shell tool disabled — or on a non-dev-tools command (chat/api/…) — nothing is gated
- *     and nothing is announced.
+ *   • `manual`/`write` — deny list, allow-list, else escalate to the human.
+ *   • `assisted`/`auto` — deny list, allow-list, then the rater.
+ *
+ * **This decides the SHELL's gating only, and it is not the whole gated set.** With the shell tool
+ * disabled — or on a non-dev-tools command (chat/api/…) — nothing about the shell is gated and
+ * nothing is announced, but at `manual` and `write` {@link resolveGatedToolNames} still gates
+ * every bound tool the rung does not auto-grant, so an MCP call in a plain `chat` session is
+ * escalated there. Read `gateShell` as "does the shell need the interrupt", never as "is the
+ * interrupt needed at all".
  *
  * Shell enablement itself is resolved through {@link getEffectiveDevToolsConfig} +
  * {@link isShellToolEnabled}, so the gate stays in lockstep with where `GthDevToolkit` actually
@@ -422,19 +717,25 @@ export function resolveShellApprovalGate(config, command) {
             notice: {
                 level: StatusLevel.WARNING,
                 message: 'Shell tool (run_shell_command): commands run without asking and without rating ' +
-                    '(approvals: bypass). Only your deny list still applies — type /approvals auto-safe to ' +
+                    '(approvals: bypass). Only your deny list still applies — type /approvals assisted to ' +
                     'rate commands again.',
             },
         };
     }
     if (isRatedRung(rung)) {
+        // **Both rated modes get the SAME tail, because it is true of both and it is all this line
+        // promises**: nothing the rater does not clear simply runs. They reach it differently — at
+        // `assisted` an unsafe-looking command goes to the human, at `auto` ([[EXT-29]] §5) it is
+        // refused back to the agent first and reaches the human when a bound is spent — and at `auto`
+        // both halves happen within one session, so a per-mode tail could only pick one of them. This
+        // is the startup notice a user meets while working out what their config does; the mode's own
+        // description ({@link APPROVAL_RUNG_DESCRIPTIONS}) is where the difference is stated.
         return {
             gateShell,
             notice: {
                 level: StatusLevel.INFO,
                 message: `Shell tool (run_shell_command) rated by the auto-rater (approvals: ${rung}); ` +
-                    'anything it does not rate safe is still ' +
-                    (rung === 'auto-safe' ? 'escalated to you.' : 'refused or escalated.'),
+                    'anything it does not rate safe is still refused or escalated to you.',
             },
         };
     }

package/dist/config/shell-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell-policy.js","sourceRoot":"","sources":["../../src/config/shell-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAmB,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAwElE;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW;IACX,UAAU;IACV,WAAW;IACX,iBAAiB;CACT,CAAC;AAEX,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB,CAAC,GAAG,sBAAsB,EAAE,eAAe,CAAC,CAAC;AAE9F;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAA6C;IAE7C,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAgD,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,YAAY;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAClD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAA8C;IACtF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC;AACjC,CAAC;AAgFD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAC;AAEtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAuC,EACvC,OAAgC;IAEhC,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,+FAA+F;IAC/F,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM,CAAC;IACnF,gFAAgF;IAChF,OAAO,OAAO,KAAK,MAAM,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAuC;IACvE,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5E,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IAChF,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAuC;IAC5E,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACnF,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC,cAAc,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,0BAA0B,CACjC,QAAqD;IAErD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;YACrB,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;QACzB,CAAC;aAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,QAAQ,CAAC,KAAK,GAAG;gBACf,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAiF,EACjF,OAA+B;IAE/B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC;IACnE,MAAM,SAAS,GACb,OAAO,KAAK,MAAM;QAChB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI;QACvB,CAAC,CAAC,QAAQ;YACR,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG;YACtB,CAAC,CAAC,OAAO,KAAK,MAAM;gBAClB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI;gBACvB,CAAC,CAAC,SAAS,CAAC;IACpB,8EAA8E;IAC9E,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,SAAS,GAAG,SAAS,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;IACjE,OAAO,0BAA0B,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;kGAEkG;AAElG;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAKlG;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE,WAAW,EAAE,WAAW;IACxB,KAAK,EAAE,OAAO;IACd,WAAW,EAAE,WAAW;IACxB,WAAW,EAAE,WAAW;IACxB,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAiC;IACtE,WAAW,EACT,2FAA2F;QAC3F,8EAA8E;IAChF,KAAK,EACH,2FAA2F;QAC3F,8FAA8F;IAChG,WAAW,EACT,8FAA8F;QAC9F,8FAA8F;QAC9F,wFAAwF;QACxF,gFAAgF;IAClF,WAAW,EACT,8FAA8F;QAC9F,8FAA8F;QAC9F,0FAA0F;QAC1F,2FAA2F;QAC3F,6FAA6F;QAC7F,oFAAoF;QACpF,yDAAyD;IAC3D,MAAM,EACJ,2FAA2F;QAC3F,2EAA2E;CAC9E,CAAC;AAEF,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,CAAC;AACtD,CAAC;AAcD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;CACP,CAAC;AA+QX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAiB,WAAW,CAAC;AAE/D,gGAAgG;AAChG,SAAS,iBAAiB,CAAC,GAAgC;IACzD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA6D,EAC7D,OAA+B;IAE/B,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,iBAAiB,CAClC,OAAO;QACL,CAAC,CAAE,MAAM,EAAE,QAAwE,EAAE,CAAC,OAAO,CAAC;YAC1F,EAAE,SAAS;QACf,CAAC,CAAC,SAAS,CACd,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,qBAAqB;QAC7D,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK;QACvC,2FAA2F;QAC3F,6EAA6E;QAC7E,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE;QAC7C,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1D,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QACtE,cAAc,EAAE,UAAU,EAAE,cAAc,IAAI,IAAI,EAAE,cAAc;QAClE,2FAA2F;QAC3F,gGAAgG;QAChG,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG;KAClC,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAA+F,EAC/F,OAA+B;IAE/B,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAErC,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,SAAS;YACT,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW,CAAC,OAAO;gBAC1B,OAAO,EACL,iFAAiF;oBACjF,wFAAwF;oBACxF,sBAAsB;aACzB;SACF,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,SAAS;YACT,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW,CAAC,IAAI;gBACvB,OAAO,EACL,sEAAsE,IAAI,KAAK;oBAC/E,0CAA0C;oBAC1C,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,uBAAuB,CAAC;aACzE;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,MAAM,EAAE;YACN,KAAK,EAAE,WAAW,CAAC,IAAI;YACvB,OAAO,EAAE,gFAAgF,IAAI,IAAI;SAClG;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"shell-policy.js","sourceRoot":"","sources":["../../src/config/shell-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAmB,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAuE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW;IACX,UAAU;IACV,WAAW;IACX,iBAAiB;CACT,CAAC;AAEX,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB,CAAC,GAAG,sBAAsB,EAAE,eAAe,CAAC,CAAC;AAE9F;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAA6C;IAE7C,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAgD,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,YAAY;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAClD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAA8C;IACtF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC;AACjC,CAAC;AAgFD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAC;AAEtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAuC,EACvC,OAAgC;IAEhC,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,+FAA+F;IAC/F,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM,CAAC;IACnF,gFAAgF;IAChF,OAAO,OAAO,KAAK,MAAM,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAuC;IACvE,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5E,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IAChF,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAuC;IAC5E,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC9B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACnF,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC,cAAc,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,0BAA0B,CACjC,QAAqD;IAErD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;YACrB,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;QACzB,CAAC;aAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,QAAQ,CAAC,KAAK,GAAG;gBACf,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAiF,EACjF,OAA+B;IAE/B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC;IACnE,MAAM,SAAS,GACb,OAAO,KAAK,MAAM;QAChB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI;QACvB,CAAC,CAAC,QAAQ;YACR,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG;YACtB,CAAC,CAAC,OAAO,KAAK,MAAM;gBAClB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI;gBACvB,CAAC,CAAC,SAAS,CAAC;IACpB,8EAA8E;IAC9E,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,SAAS,GAAG,SAAS,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;IACjE,OAAO,0BAA0B,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;kGAEkG;AAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAKzF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,QAAQ;IACR,UAAU;IACV,MAAM;IACN,QAAQ;CACkC,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,6FAA6F;IAC7F,+BAA+B,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAiC;IACtE,MAAM,EACJ,6FAA6F;QAC7F,0FAA0F;QAC1F,+FAA+F;QAC/F,kBAAkB;IACpB,KAAK,EACH,2FAA2F;QAC3F,+FAA+F;QAC/F,8FAA8F;QAC9F,UAAU;IACZ,QAAQ,EACN,4FAA4F;QAC5F,0FAA0F;QAC1F,+FAA+F;QAC/F,mDAAmD;IACrD,IAAI,EACF,2FAA2F;QAC3F,6FAA6F;QAC7F,6FAA6F;QAC7F,0BAA0B;IAC5B,MAAM,EACJ,+FAA+F;QAC/F,2FAA2F;QAC3F,wBAAwB;CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,yGAAyG,CAAC;AAE5G;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB;IAC/D,kDAAkD;IAClD,4BAA4B;CAC7B,CAAC;AAEF,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,OAAO,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,MAAM,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,OAAO,IAAI,KAAK,MAAM,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAkB;IACpD,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAIjC;IACC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC9C,IAAI,SAAS,IAAI,QAAQ,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,CAAC,0BAA0B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAIrC;IACC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IACpD,OAAO,gBAAgB,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAC1D,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,yBAAyB,GAAgC;IAC7D,GAAG,EAAE,IAAI;IACT,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,EAAE,EAAE,IAAI;IACR,MAAM,EAAE,IAAI;IACZ,uEAAuE;IACvE,GAAG,EAAE,KAAK;CACX,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA+B;IACrE,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAGzC;IACC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAC9C,OAAO,gBAAgB,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAC1D,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CACtF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,SAAkB,EAClB,cAAiC,EACjC,OAAkC;IAElC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAQ,EAAE;QACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC5E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,SAAS;QAAE,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAcD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;CACP,CAAC;AA+QX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAiB,UAAU,CAAC;AAE9D,gGAAgG;AAChG,SAAS,iBAAiB,CAAC,GAAgC;IACzD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA6D,EAC7D,OAA+B;IAE/B,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,iBAAiB,CAClC,OAAO;QACL,CAAC,CAAE,MAAM,EAAE,QAAwE,EAAE,CAAC,OAAO,CAAC;YAC1F,EAAE,SAAS;QACf,CAAC,CAAC,SAAS,CACd,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,qBAAqB;QAC7D,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK;QACvC,2FAA2F;QAC3F,6EAA6E;QAC7E,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE;QAC7C,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1D,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QACtE,cAAc,EAAE,UAAU,EAAE,cAAc,IAAI,IAAI,EAAE,cAAc;QAClE,2FAA2F;QAC3F,gGAAgG;QAChG,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG;KAClC,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAA+F,EAC/F,OAA+B;IAE/B,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAErC,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,SAAS;YACT,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW,CAAC,OAAO;gBAC1B,OAAO,EACL,iFAAiF;oBACjF,uFAAuF;oBACvF,sBAAsB;aACzB;SACF,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,2FAA2F;QAC3F,2FAA2F;QAC3F,0FAA0F;QAC1F,8FAA8F;QAC9F,8FAA8F;QAC9F,8FAA8F;QAC9F,sFAAsF;QACtF,OAAO;YACL,SAAS;YACT,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW,CAAC,IAAI;gBACvB,OAAO,EACL,sEAAsE,IAAI,KAAK;oBAC/E,sEAAsE;aACzE;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,MAAM,EAAE;YACN,KAAK,EAAE,WAAW,CAAC,IAAI;YACvB,OAAO,EAAE,gFAAgF,IAAI,IAAI;SAClG;KACF,CAAC;AACJ,CAAC"}