@gaunt-sloth/core 2.0.0-alpha.35 → 2.0.0-alpha.37

package/dist/core/shell/approvalStop.d.ts

@@ -1,49 +1,88 @@
 /**
- * @module core/shell/approvalStop
+ * One piece of a stop message, tagged with who wrote it.
  *
- * CFG-27 — the two ways the approvals gate **ends a run** rather than answering a tool call.
- * Both are thrown from `GthAgentRunner.decideToolApproval`, both carry the command and the reason
- * a person needs to see, and both are re-thrown UNCHANGED by `processMessages` (which otherwise
- * wraps failures as `Agent processing failed: …`) so the explanation reaches the user intact.
+ * - `own` — this module's own sentence. Nothing outside it can influence the text, so a surface
+ *   may paint it as it is and let the terminal wrap it.
+ * - `command` — the command the agent proposed. Framed with the site extraction, because its
+ *   composition boundaries and substitutions are the decision-relevant positions in it.
+ * - `value` — one untrusted single value (the rater's outcome or reason, the matched
+ *   `approvals.escalate` entry). Framed as prose; there are no sites to point at.
+ * - `block` — an untrusted block whose LINE STRUCTURE is a renderer's, not the model's: the §5
+ *   negotiation transcript, whose rows `core/shell/negotiation` builds and whose leaves it has
+ *   already collapsed to one line each. Its breaks survive into the message where a `value`'s
+ *   would be escaped, because they are the thing that makes it readable at all.
  *
- * They are errors rather than {@link ../types.js ToolApprovalDecision}s on purpose. A decision is
- * something the model observes as a `ToolMessage` and can respond to; these two are precisely the
- * cases where the spec says the model gets no move at all:
+ * **A `block` is still neutralised line by line here, and that is deliberate defence in depth.**
+ * Its one production producer (`renderNegotiationTranscript`) has already cleaned every leaf, so
+ * on today's paths this arm changes nothing — but these constructors are public, and a caller
+ * handing one a raw multi-line string must not be the thing that decides whether a cursor can
+ * move. `approvalStop.spec.ts` builds exactly that string so the arm is falsifiable rather than
+ * merely reassuring.
  *
- * - **{@link AttackHaltError}** (§4.2) — an `attack` outcome *halts the run*. "A halt ends the
- *   agent loop. It is not a rejection the model can respond to, and no rung except `bypass` can
- *   turn it into anything else."
- * - **{@link NonInteractiveEscalationError}** (§6.2) — where no human can answer, *every*
- *   escalation is an immediate non-zero exit carrying the command, the rating and its reason.
- *   There is no prompt, no waiting, and never a timeout into approval. Teams that need specific
- *   commands to run unattended declare them in `approvals.allow` (§3), which is consulted before
- *   the rater and therefore never escalates.
+ * **The §5.4 VOICE distinction is deliberately not carried here**, and the trade is worth stating
+ * because `negotiation.ts` documents voice preservation as a rule: `renderNegotiationRows` tags
+ * each row `chrome`/`agent`/`rater` so a surface can colour the rater's turns apart from the
+ * agent's. A stop renders the transcript as one undifferentiated untrusted block instead. Framing
+ * a mixed-trust block wholly as untrusted is the safe direction (nothing in it is promoted to the
+ * gate's own voice), the row prefixes still name the speaker in text, and an `Error` carries no
+ * colour to any of the non-terminal consumers anyway. Colouring by voice here would mean
+ * re-deriving the tags from a string that no longer has them.
+ */
+export type ApprovalStopPart = {
+    kind: 'own';
+    text: string;
+} | {
+    kind: 'command';
+    label: string;
+    text: string;
+} | {
+    kind: 'value';
+    label: string;
+    text: string;
+} | {
+    kind: 'block';
+    text: string;
+};
+/**
+ * The stop as terminal rows, for a surface that paints lines rather than components.
  *
- * Exit code: neither class sets one. The single-shot runtime (`runSingleShot`) already reports a
- * thrown run as `ok: false`, and each command entry point turns that into `setExitCode(1)` — so
- * "immediate non-zero exit carrying the explanation" is what a caller already gets, without a new
- * exit path that could diverge from the existing one.
+ * Every row is painted **verbatim, one row per line, and never re-wrapped** — that is the
+ * condition `core/shell/framing` states its column-0 guarantee over, and a caller that joins these
+ * and hands them to something that wraps has undone the whole point.
+ *
+ * `columns` is what the surface reports (`stdout.columns`), not a frame width: it is resolved
+ * through {@link frameWidthFor} here so the plain surfaces, the Ink TUI and the approval dialog
+ * cannot come to disagree about how much of a command a human was shown. When it is below core's
+ * floor the frame is wider than the terminal and the guarantee lapses — {@link narrowTerminalNotice}
+ * leads the block in that case, so it lapses out loud.
  */
+export declare function approvalStopRows(parts: readonly ApprovalStopPart[], options?: {
+    columns?: number;
+}): string[];
 /**
  * Base class for the two run-ending approvals outcomes, so a caller that wants to present them as
- * an ending rather than a crash can catch both with one `instanceof`. Every surface shows the
- * message as-is, which is already the whole explanation.
+ * an ending rather than a crash can catch both with one `instanceof`.
+ *
+ * A surface that can frame should render {@link parts} (see {@link approvalStopRows}); one that
+ * cannot shows {@link message}, which is already neutralised and is already the whole explanation.
  */
 export declare abstract class ApprovalStopError extends Error {
-    /** The command that ended the run. */
+    /** The command that ended the run, exactly as the agent proposed it. */
     readonly command: string;
-    protected constructor(message: string, command: string);
+    /** The message's pieces, tagged with who wrote each — see {@link ApprovalStopPart}. */
+    readonly parts: readonly ApprovalStopPart[];
+    protected constructor(parts: readonly ApprovalStopPart[], command: string);
 }
 /**
  * §4.2 — an `attack` outcome: the command's own **structure** evidenced compromise (§4.1.1 —
  * credential targeting, privilege escalation, persistence, deception, obfuscation). Ends the agent
  * loop; the model is told nothing and offered nothing.
  *
- * **This is what reaches a surface that cannot ask.** An interactive surface is offered §6.1's red
- * banner first — `GthAgentRunner.setAttackHaltCallback`, where typing `run anyway` runs this one
- * command and everything else stops the run — and this error is thrown when no banner is wired, or
- * when the banner is answered with anything but that phrase. A non-interactive session wires
- * nothing and so gets this message directly (§6.2).
+ * **This is what reaches a surface that cannot ask.** An interactive surface is offered [[TUI-C68]]
+ * §6.1's red banner first — `GthAgentRunner.setAttackHaltCallback`, where typing `run anyway` runs
+ * this one command and everything else stops the run — and this error is thrown when no banner is
+ * wired, or when the banner is answered with anything but that phrase. A non-interactive session
+ * wires nothing and so gets this message directly (§6.2).
  *
  * The recovery this message names is deliberately the **allow-list**, not `bypass`. §4.2 makes
  * `approvals.allow` the supported way to run such a command unattended (it is consulted before the

package/dist/core/shell/approvalStop.js

@@ -23,18 +23,145 @@
  * thrown run as `ok: false`, and each command entry point turns that into `setExitCode(1)` — so
  * "immediate non-zero exit carrying the explanation" is what a caller already gets, without a new
  * exit path that could diverge from the existing one.
+ *
+ * ## [[TUI-C71]] — a stop message is UNTRUSTED TEXT, and it is made safe in two places
+ *
+ * Every string a stop carries except this module's own sentences is written by something other
+ * than the user: the command the agent proposed, the rater's outcome and reason, the
+ * `approvals.escalate` entry that matched, and the whole §5 negotiation. On an `attack` verdict
+ * that is the *worst* text in the system by construction — the rater judged the command's own
+ * structure to evidence deception or obfuscation — so a stop is the one message most likely to
+ * carry a payload crafted to forge terminal output, and the last one that may be printed raw.
+ *
+ * The defence [[TUI-C26]] built has two halves, and they belong at different times:
+ *
+ * 1. **Neutralisation is done HERE, at construction, unconditionally.** It needs no width and no
+ *    screen, it is idempotent, and it is the half every consumer needs — a thrown stop reaches the
+ *    Ink transcript, `--no-tui` stderr, a session log, the approvals archive (`record.error`), an
+ *    eval turn record, AG-UI and a CI job's output, and only some of those are terminals. Doing it
+ *    at each render site would mean every present and future consumer had to remember; doing it
+ *    once here means none of them can forget. After it, `{@link message}` contains no control or
+ *    format character at all: a carriage return is the five printable characters `\x0d`, and —
+ *    because LF is a control character too — untrusted text cannot even open a new line, let alone
+ *    reach column 0 on one.
+ * 2. **The gutter and the width bound are done at RENDER, by the surface** ({@link
+ *    approvalStopRows} for the plain surfaces, `<ApprovalStopMessage>` for the Ink TUI). They
+ *    cannot be done here: framing is arithmetic against a terminal width, an `Error.message` has
+ *    no width, and a block wrapped for an 80-column terminal is wrong for every other one. What
+ *    they buy over neutralisation alone is the last case it cannot close — one very long
+ *    neutralised line that the *terminal* wraps, whose continuation starts at column 0 carrying
+ *    whatever the attacker chose to put at that offset. That route is measured, not theorised: on
+ *    a 120-column terminal the neutralised `Command:` line of a hostile command is ~164 columns.
+ *
+ * **Because half of it is the surface's job, the surfaces are enumerated rather than assumed.**
+ * Every place that catches an `ApprovalStopError` and prints it calls {@link approvalStopRows} (or
+ * the Ink component): `runtime/singleShot.ts`, `runtime/conversation.ts`,
+ * `agent/modules/interactiveSessionModule.ts` (both its per-turn catch and its outermost one, which
+ * is where the `-m` path lands), `review/modules/reviewModule.ts`, `app/commands/prCommand.ts`
+ * (which catches what the PR-discovery agent throws) and `app/tui/components/App.tsx`.
+ * **Adding a surface that catches a stop means adding it to that list.**
+ *
+ * **That list is over the ERROR, and the error is not the only way a stop reaches a screen.** Some
+ * consumers take {@link message} and hand the *string* onward, at which point no `instanceof` can
+ * find it again: `runConversation` records it as a turn's `error`, and `evalRunner` folds that into
+ * an eval case's `reasons`, which `batch/reporters/textReporter.ts` prints — a terminal, reached
+ * without any of its code ever seeing this class. That one frames the text itself. So the honest
+ * statement is not "every other consumer is a non-terminal" but: **a consumer that prints to a
+ * terminal frames what it prints, whether it holds the error or only its text**, and the ones that
+ * legitimately do neither are the file and protocol sinks (the approvals archive, the JUnit/JSON
+ * reports, the AG-UI event) plus `reviewModule`'s `displayDebug` of the raw error, which is a debug
+ * channel. All of them still inherit the neutralisation, which is what keeps the worst case a
+ * wrapped line rather than a repainted screen.
+ *
+ * **The structured fields stay RAW; only the message is neutralised.** That is what answers the
+ * obvious objection to construction-time work — that it stops the error being a faithful record of
+ * what was proposed. `{@link ApprovalStopError.command}`, `reason`, `outcome`, `escalatedBy` and
+ * `negotiation` are the command as the agent wrote it, byte for byte, for any consumer that needs
+ * the truth rather than a screen; the message is the *presentation*, and a presentation that can
+ * repaint the terminal is not one. The render path frames from those raw fields, so its gutter
+ * numbers the command's real lines rather than one escaped line.
+ *
+ * **One parts list, two renderings** ({@link ApprovalStopPart}). The message string and the framed
+ * block are both derived from {@link ApprovalStopError.parts}, so they cannot come to describe one
+ * stop two ways — the same argument `renderNegotiationTranscript` makes for its own two surfaces.
+ * A part is tagged with *who wrote it*, which is the only distinction any of this rests on: the
+ * gate's own prose can be painted as it is because nothing can forge it, and everything else goes
+ * through the shared renderer.
  */
+import { frameUntrustedCommand, frameUntrustedText, frameWidthFor, narrowTerminalNotice, neutralizeUntrustedText, } from '#src/core/shell/framing.js';
+/**
+ * The parts as the one string an `Error.message` has to be, with every untrusted part neutralised.
+ *
+ * A `block` is neutralised **line by line**, so the renderer-owned breaks that carry its meaning
+ * survive while its content still cannot introduce one. Everything else is neutralised whole,
+ * which — LF being a control character — is what collapses an untrusted value onto the single line
+ * its label put it on.
+ */
+function composeMessage(parts) {
+    return parts.map(messageLineFor).join('\n');
+}
+function messageLineFor(part) {
+    switch (part.kind) {
+        case 'own':
+            return part.text;
+        case 'block':
+            return part.text.split('\n').map(neutralizeUntrustedText).join('\n');
+        default:
+            return `  ${part.label}: ${neutralizeUntrustedText(part.text)}`;
+    }
+}
+/**
+ * The stop as terminal rows, for a surface that paints lines rather than components.
+ *
+ * Every row is painted **verbatim, one row per line, and never re-wrapped** — that is the
+ * condition `core/shell/framing` states its column-0 guarantee over, and a caller that joins these
+ * and hands them to something that wraps has undone the whole point.
+ *
+ * `columns` is what the surface reports (`stdout.columns`), not a frame width: it is resolved
+ * through {@link frameWidthFor} here so the plain surfaces, the Ink TUI and the approval dialog
+ * cannot come to disagree about how much of a command a human was shown. When it is below core's
+ * floor the frame is wider than the terminal and the guarantee lapses — {@link narrowTerminalNotice}
+ * leads the block in that case, so it lapses out loud.
+ */
+export function approvalStopRows(parts, options) {
+    const width = frameWidthFor(options?.columns);
+    const rows = [];
+    const tooNarrow = narrowTerminalNotice(options?.columns);
+    if (tooNarrow)
+        rows.push(tooNarrow);
+    for (const part of parts) {
+        if (part.kind === 'own') {
+            rows.push(part.text);
+            continue;
+        }
+        // The label is the gate's OWN word for what follows, and it stays on the gate's own row rather
+        // than being prefixed to the first framed row — a label sharing a row with untrusted text is a
+        // row a reader cannot tell apart from one the model wrote all of.
+        if (part.kind !== 'block')
+            rows.push(`  ${part.label}:`);
+        const framed = part.kind === 'command'
+            ? frameUntrustedCommand(part.text, { width })
+            : frameUntrustedText(part.text, { width });
+        rows.push(...framed.notices, ...framed.lines);
+    }
+    return rows;
+}
 /**
  * Base class for the two run-ending approvals outcomes, so a caller that wants to present them as
- * an ending rather than a crash can catch both with one `instanceof`. Every surface shows the
- * message as-is, which is already the whole explanation.
+ * an ending rather than a crash can catch both with one `instanceof`.
+ *
+ * A surface that can frame should render {@link parts} (see {@link approvalStopRows}); one that
+ * cannot shows {@link message}, which is already neutralised and is already the whole explanation.
  */
 export class ApprovalStopError extends Error {
-    /** The command that ended the run. */
+    /** The command that ended the run, exactly as the agent proposed it. */
     command;
-    constructor(message, command) {
-        super(message);
+    /** The message's pieces, tagged with who wrote each — see {@link ApprovalStopPart}. */
+    parts;
+    constructor(parts, command) {
+        super(composeMessage(parts));
         this.command = command;
+        this.parts = parts;
         // Restore the prototype chain across the ES5 `extends Error` downlevel, so `instanceof` works.
         Object.setPrototypeOf(this, new.target.prototype);
         this.name = new.target.name;
@@ -45,11 +172,11 @@ export class ApprovalStopError extends Error {
  * credential targeting, privilege escalation, persistence, deception, obfuscation). Ends the agent
  * loop; the model is told nothing and offered nothing.
  *
- * **This is what reaches a surface that cannot ask.** An interactive surface is offered §6.1's red
- * banner first — `GthAgentRunner.setAttackHaltCallback`, where typing `run anyway` runs this one
- * command and everything else stops the run — and this error is thrown when no banner is wired, or
- * when the banner is answered with anything but that phrase. A non-interactive session wires
- * nothing and so gets this message directly (§6.2).
+ * **This is what reaches a surface that cannot ask.** An interactive surface is offered [[TUI-C68]]
+ * §6.1's red banner first — `GthAgentRunner.setAttackHaltCallback`, where typing `run anyway` runs
+ * this one command and everything else stops the run — and this error is thrown when no banner is
+ * wired, or when the banner is answered with anything but that phrase. A non-interactive session
+ * wires nothing and so gets this message directly (§6.2).
  *
  * The recovery this message names is deliberately the **allow-list**, not `bypass`. §4.2 makes
  * `approvals.allow` the supported way to run such a command unattended (it is consulted before the
@@ -61,13 +188,21 @@ export class AttackHaltError extends ApprovalStopError {
     /** The rater's explanation of what the command's structure showed. */
     reason;
     constructor(command, reason) {
-        super(`Run halted: the auto-rater rated this command as an attack, which ends the run.\n` +
-            `  Command: ${command}\n` +
-            `  Reason: ${reason}\n` +
-            `This is not negotiable. If this command is legitimate and you need it to run, declare ` +
-            `it in approvals.allow — that list is consulted before the auto-rater, so it never ` +
-            `reaches a halt. Dropping to approvals "bypass" also works, but it turns off the rater, ` +
-            `the prompts and the halt for every command in the run.`, command);
+        super([
+            {
+                kind: 'own',
+                text: 'Run halted: the auto-rater rated this command as an attack, which ends the run.',
+            },
+            { kind: 'command', label: 'Command', text: command },
+            { kind: 'value', label: 'Reason', text: reason },
+            {
+                kind: 'own',
+                text: `This is not negotiable. If this command is legitimate and you need it to run, declare ` +
+                    `it in approvals.allow — that list is consulted before the auto-rater, so it never ` +
+                    `reaches a halt. Dropping to approvals "bypass" also works, but it turns off the rater, ` +
+                    `the prompts and the halt for every command in the run.`,
+            },
+        ], command);
         this.reason = reason;
     }
 }
@@ -96,20 +231,35 @@ export class NonInteractiveEscalationError extends ApprovalStopError {
      */
     negotiation;
     constructor(command, outcome, reason, escalatedBy, negotiation) {
-        super(`Approval required, but this session has no one to ask.\n` +
-            `  Command: ${command}\n` +
-            (outcome ? `  Rating: ${outcome}\n` : '') +
-            (reason ? `  Reason: ${reason}\n` : '') +
-            (negotiation ? `${negotiation}\n` : '') +
-            (escalatedBy
-                ? `  Matched approvals.escalate: ${escalatedBy}\n` +
-                    `An escalate entry always asks a human, whatever the rung would have done, so no ` +
+        const parts = [
+            { kind: 'own', text: 'Approval required, but this session has no one to ask.' },
+            { kind: 'command', label: 'Command', text: command },
+        ];
+        if (outcome)
+            parts.push({ kind: 'value', label: 'Rating', text: outcome });
+        if (reason)
+            parts.push({ kind: 'value', label: 'Reason', text: reason });
+        if (negotiation)
+            parts.push({ kind: 'block', text: negotiation });
+        if (escalatedBy) {
+            parts.push({ kind: 'value', label: 'Matched approvals.escalate', text: escalatedBy });
+            parts.push({
+                kind: 'own',
+                text: `An escalate entry always asks a human, whatever the rung would have done, so no ` +
                     `entry in approvals.allow can answer it. Remove the escalate entry if this command ` +
-                    `should run unattended.`
-                : `Declare the commands this run is allowed to execute in approvals.allow — write each ` +
+                    `should run unattended.`,
+            });
+        }
+        else {
+            parts.push({
+                kind: 'own',
+                text: `Declare the commands this run is allowed to execute in approvals.allow — write each ` +
                     `one as an explicit entry, for example { "type": "shell", "matcher": "exact", ` +
                     `"pattern": "npm test" }. That list is consulted before the auto-rater and never ` +
-                    `escalates.`), command);
+                    `escalates.`,
+            });
+        }
+        super(parts, command);
         this.outcome = outcome;
         this.reason = reason;
         this.escalatedBy = escalatedBy;

package/dist/core/shell/approvalStop.js.map

@@ -1 +1 @@
-{"version":3,"file":"approvalStop.js","sourceRoot":"","sources":["../../../src/core/shell/approvalStop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,MAAM,OAAgB,iBAAkB,SAAQ,KAAK;IACnD,sCAAsC;IAC7B,OAAO,CAAS;IAEzB,YAAsB,OAAe,EAAE,OAAe;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,+FAA+F;QAC/F,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,eAAgB,SAAQ,iBAAiB;IACpD,sEAAsE;IAC7D,MAAM,CAAS;IAExB,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CACH,mFAAmF;YACjF,cAAc,OAAO,IAAI;YACzB,aAAa,MAAM,IAAI;YACvB,wFAAwF;YACxF,oFAAoF;YACpF,yFAAyF;YACzF,wDAAwD,EAC1D,OAAO,CACR,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,6BAA8B,SAAQ,iBAAiB;IAClE,gFAAgF;IACvE,OAAO,CAAqB;IACrC,sDAAsD;IAC7C,MAAM,CAAqB;IACpC;;;;;OAKG;IACM,WAAW,CAAqB;IAEzC;;;;;;OAMG;IACM,WAAW,CAAqB;IAEzC,YACE,OAAe,EACf,OAAgB,EAChB,MAAe,EACf,WAAoB,EACpB,WAAoB;QAEpB,KAAK,CACH,0DAA0D;YACxD,cAAc,OAAO,IAAI;YACzB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,CAAC,WAAW;gBACV,CAAC,CAAC,iCAAiC,WAAW,IAAI;oBAChD,kFAAkF;oBAClF,oFAAoF;oBACpF,wBAAwB;gBAC1B,CAAC,CAAC,sFAAsF;oBACtF,+EAA+E;oBAC/E,kFAAkF;oBAClF,YAAY,CAAC,EACnB,OAAO,CACR,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"approvalStop.js","sourceRoot":"","sources":["../../../src/core/shell/approvalStop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAsCpC;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAAkC;IACxD,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,IAAsB;IAC5C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE;YACE,OAAO,KAAK,IAAI,CAAC,KAAK,KAAK,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAkC,EAClC,OAA8B;IAE9B,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,+FAA+F;QAC/F,+FAA+F;QAC/F,kEAAkE;QAClE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACzD,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,SAAS;YACrB,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC;YAC7C,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAgB,iBAAkB,SAAQ,KAAK;IACnD,wEAAwE;IAC/D,OAAO,CAAS;IAEzB,uFAAuF;IAC9E,KAAK,CAA8B;IAE5C,YAAsB,KAAkC,EAAE,OAAe;QACvE,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,+FAA+F;QAC/F,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,eAAgB,SAAQ,iBAAiB;IACpD,sEAAsE;IAC7D,MAAM,CAAS;IAExB,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CACH;YACE;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,iFAAiF;aACxF;YACD,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE;YACpD,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;YAChD;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EACF,wFAAwF;oBACxF,oFAAoF;oBACpF,yFAAyF;oBACzF,wDAAwD;aAC3D;SACF,EACD,OAAO,CACR,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,6BAA8B,SAAQ,iBAAiB;IAClE,gFAAgF;IACvE,OAAO,CAAqB;IACrC,sDAAsD;IAC7C,MAAM,CAAqB;IACpC;;;;;OAKG;IACM,WAAW,CAAqB;IAEzC;;;;;;OAMG;IACM,WAAW,CAAqB;IAEzC,YACE,OAAe,EACf,OAAgB,EAChB,MAAe,EACf,WAAoB,EACpB,WAAoB;QAEpB,MAAM,KAAK,GAAuB;YAChC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,wDAAwD,EAAE;YAC/E,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE;SACrD,CAAC;QACF,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,IAAI,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAClE,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,KAAK;gBACX,IAAI,EACF,kFAAkF;oBAClF,oFAAoF;oBACpF,wBAAwB;aAC3B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,KAAK;gBACX,IAAI,EACF,sFAAsF;oBACtF,+EAA+E;oBAC/E,kFAAkF;oBAClF,YAAY;aACf,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF"}

package/dist/core/shell/hardline.d.ts

@@ -24,6 +24,28 @@
  * fork-bomb literal (the string *is* the fork bomb).
  */
 export declare const HARDLINE_PATTERNS: ReadonlyArray<readonly [RegExp, string]>;
+/**
+ * **Every string a §8 decision is made of, in one record — exported ONLY for the snapshot gate**
+ * (`shellHardlinePatternSurface.spec.ts`), which freezes it as a literal in its own source. Nothing
+ * in production reads it, and nothing should: it is the module's pattern surface made addressable so
+ * that a narrowing cannot land silently. **Any new pattern constant joins it**, and the gate's
+ * key-set check fails if one does not.
+ *
+ * **Membership is decided by what the patterns are BUILT FROM, not by what this file declares** —
+ * which is why {@link COMMAND_SEPARATOR_CLASS}, imported from `core/shell/normalize`, is a member.
+ * Floor behaviour depends on it and it is edited in another module, so a change there is exactly the
+ * silent narrowing this exists to make loud.
+ *
+ * A value composed at module load carries its parts with it: {@link CMD_POS} expands
+ * {@link WRAPPER_ARMS}, and {@link ROOT_TARGET} expands `quotedOrBare`, so those parts are frozen
+ * whether or not they are also members. The parts are listed anyway, because a diff that names
+ * `H_TOKEN_EXCLUSIONS` is actionable where one that names only `CHOWN_HEAD` is a wall of regex.
+ *
+ * Regexes are recorded as `String(re)` rather than `re.source` **because the flags are part of the
+ * behaviour**: a `g` flag makes `.test()` stateful across calls, a change no source-only record
+ * would show.
+ */
+export declare const HARDLINE_PATTERN_SURFACE: Readonly<Record<string, string | readonly string[]>>;
 /**
  * Whether one pipeline both reads credential material and transmits data off the machine.
  * Exported for tests, which pin BOTH directions: the credential-upload shapes must match, and

package/dist/core/shell/hardline.js

@@ -39,6 +39,34 @@
  * escalation behind it at every rung but `bypass`.** {@link CMD_POS} carries the worked example of
  * a case measured and dropped.
  *
+ * **How it may SHRINK — a narrowing ships with its removal set pinned.** Any edit that makes the
+ * floor refuse strictly fewer commands is a narrowing: a new exclusion, a loosened bound, a
+ * tightened anchor, a narrower character class. **The suite cannot review one.** If the edit had
+ * removed a refusal that any spec asserts, that spec would be red — so a green run proves only that
+ * everything the edit removed was unasserted, which is the same set as "uncovered". Green is
+ * structurally silent about a narrowing, and an AI review of the diff is no better: both read what
+ * the change still does, and the whole risk is in what it quietly stopped doing.
+ *
+ * So the change states its **removal set** — the commands that matched before and do not match
+ * after — characterised from the shape of the edit, never sampled from the corpus
+ * (`shellHardlineCorpus.spec.ts` sees only its own cases *by construction*; its docblock says so). A
+ * regex's removal set cannot be enumerated exactly, so the requirement is a characterisation plus
+ * probes pinned at its dangerous end. **Derived by the reviewer independently, not by the author** —
+ * an author who missed the removal while writing the edit will miss it again while describing it.
+ * {@link HARDLINE_PATTERN_SURFACE} is what makes a narrowing ASK for that declaration: every pattern
+ * constant this module binds at module scope is frozen in `shellHardlinePatternSurface.spec.ts`, so
+ * moving one turns a cell red and only a deliberate edit to that spec's literal turns it green
+ * again. A pattern built inside a function body, and any narrowing that lives in control flow rather
+ * than in a string, are outside it — that spec's docblock names them.
+ *
+ * **The asymmetry above flips at the exfiltration boundary — check which half you are editing.**
+ * For the destructive-verb arms a miss still has the confirmation dialog and the rater behind it,
+ * which is what makes "prefer fewer false positives" safe there. For the exfiltration arms,
+ * removing a refusal **is** the harm, and "a miss still has the rater behind it" is the precise
+ * reliance §3 forbids: the deterministic subset exists *because* the `attack` outcome must not
+ * depend on the rater alone. "Strictly subtractive — it can only remove refusals, never add one" is
+ * a safety property in the first half and a description of the vulnerability in the second.
+ *
  * §8.1 — **the floor is never advertised.** It is documented for people reading the code and the
  * spec, never offered to a user as a reason to feel safe; user-facing copy cites only protections
  * the user can inspect and extend (the deny list).
@@ -634,6 +662,59 @@ const CREDENTIAL_SOURCE_PATTERNS = [
     // The whole environment, piped somewhere.
     new RegExp(CMD_POS + '(?:printenv|env)\\s*(?=\\||$)'),
 ];
+/**
+ * **Every string a §8 decision is made of, in one record — exported ONLY for the snapshot gate**
+ * (`shellHardlinePatternSurface.spec.ts`), which freezes it as a literal in its own source. Nothing
+ * in production reads it, and nothing should: it is the module's pattern surface made addressable so
+ * that a narrowing cannot land silently. **Any new pattern constant joins it**, and the gate's
+ * key-set check fails if one does not.
+ *
+ * **Membership is decided by what the patterns are BUILT FROM, not by what this file declares** —
+ * which is why {@link COMMAND_SEPARATOR_CLASS}, imported from `core/shell/normalize`, is a member.
+ * Floor behaviour depends on it and it is edited in another module, so a change there is exactly the
+ * silent narrowing this exists to make loud.
+ *
+ * A value composed at module load carries its parts with it: {@link CMD_POS} expands
+ * {@link WRAPPER_ARMS}, and {@link ROOT_TARGET} expands `quotedOrBare`, so those parts are frozen
+ * whether or not they are also members. The parts are listed anyway, because a diff that names
+ * `H_TOKEN_EXCLUSIONS` is actionable where one that names only `CHOWN_HEAD` is a wall of regex.
+ *
+ * Regexes are recorded as `String(re)` rather than `re.source` **because the flags are part of the
+ * behaviour**: a `g` flag makes `.test()` stateful across calls, a change no source-only record
+ * would show.
+ */
+export const HARDLINE_PATTERN_SURFACE = Object.freeze({
+    // Structural / shared.
+    COMMAND_SEPARATOR_CLASS,
+    WRAPPER_FLAGS,
+    WRAPPER_ARMS: Object.freeze([...WRAPPER_ARMS]),
+    CMD_POS,
+    TARGET_TOKEN_END,
+    H_SPACE,
+    H_TOKEN_EXCLUSIONS,
+    H_TOKEN_CHAR,
+    H_OPERAND_CHAR,
+    // The destructive-verb arms and the fragments they share.
+    ROOT_TARGET,
+    SYSTEM_DIR_TARGET,
+    RECURSIVE_FLAG,
+    CHOWN_SKIPPABLE_ARG,
+    CHOWN_HEAD,
+    // The pattern list itself, sources only: the human descriptions beside them are prose, and a
+    // reworded one is not a narrowing, so they stay out rather than train a reader to update the
+    // frozen literal without reading why the cell went red.
+    HARDLINE_PATTERNS: Object.freeze(HARDLINE_PATTERNS.map(([pattern]) => String(pattern))),
+    // The exfiltration arms.
+    PIPELINE_SPLIT_RE: String(PIPELINE_SPLIT_RE),
+    NETWORK_SINK_RE: String(NETWORK_SINK_RE),
+    RSYNC_REMOTE_TARGET,
+    RSYNC_REMOTE_SINK_RE: String(RSYNC_REMOTE_SINK_RE),
+    TOKEN_END,
+    NOT_PUBLIC_KEY,
+    DOTENV_RE: String(DOTENV_RE),
+    DOTENV_AS_OUTPUT_TARGET: String(DOTENV_AS_OUTPUT_TARGET),
+    CREDENTIAL_SOURCE_PATTERNS: Object.freeze(CREDENTIAL_SOURCE_PATTERNS.map((pattern) => String(pattern))),
+});
 /**
  * Whether one pipeline both reads credential material and transmits data off the machine.
  * Exported for tests, which pin BOTH directions: the credential-upload shapes must match, and

package/dist/core/shell/hardline.js.map

@@ -1 +1 @@
-{"version":3,"file":"hardline.js","sourceRoot":"","sources":["../../../src/core/shell/hardline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEzF;;;GAGG;AACH,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,YAAY,GAAsB;IACtC,6FAA6F;IAC7F,sEAAsE;IACtE,iGAAiG;IACjG,yBAAyB;IACzB,mEAAmE;IACnE,6FAA6F;IAC7F,6FAA6F;IAC7F,oBAAoB;IACpB,0FAA0F;IAC1F,gGAAgG;IAChG,kDAAkD;IAClD,4DAA4D;IAC5D,aAAa,aAAa,EAAE;IAC5B,gGAAgG;IAChG,iGAAiG;IACjG,2FAA2F;IAC3F,4DAA4D,aAAa,EAAE;CAC5E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,MAAM,OAAO,GACX,SAAS,uBAAuB,aAAa;IAC7C,MAAM;IACN,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;IAChC,MAAM,CAAC;AAET;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,gBAAgB,GAAG,eAAe,uBAAuB,IAAI,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,OAAO,IAAI,MAAM,IAAI,KAAK,IAAI,IAAI,gBAAgB,EAAE,CAAC;AAEpG;;;;;;;;kGAQkG;AAElG;;;;GAIG;AACH,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,YAAY,CACpC,+EAA+E,CAChF,CAAC;AAEF;;;;;;;kGAOkG;AAElG;;;;;;GAMG;AACH,MAAM,OAAO,GAAG,eAAe,CAAC;AAEhC;;;;;;;;;;;;;GAaG;AACH,MAAM,kBAAkB,GAAG,SAAS,uBAAuB,EAAE,CAAC;AAE9D,wDAAwD;AACxD,MAAM,YAAY,GAAG,KAAK,kBAAkB,GAAG,CAAC;AAEhD,oEAAoE;AACpE,MAAM,cAAc,GAAG,KAAK,kBAAkB,IAAI,CAAC;AAEnD;;;;GAIG;AACH,MAAM,cAAc,GAAG,wBAAwB,YAAY,KAAK,YAAY,IAAI,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,OAAO,YAAY,KAAK,cAAc,IAAI,CAAC;AAEvE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GACd,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM,mBAAmB,GAAG,OAAO,IAAI;IACvC,cAAc;IACd,OAAO;IACP,MAAM,mBAAmB,GAAG,OAAO,IAAI,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA6C;IACzE,iGAAiG;IACjG,yFAAyF;IACzF;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,yBAAyB,GAAG,WAAW,CAAC;QAC7D,qCAAqC;KACtC;IACD,2EAA2E;IAC3E;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,yBAAyB,GAAG,iBAAiB,CAAC;QACnE,sCAAsC;KACvC;IACD,oDAAoD;IACpD,4EAA4E;IAC5E;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,+CAA+C,GAAG,gBAAgB,CAAC;QACxF,oCAAoC;KACrC;IACD,6FAA6F;IAC7F,6FAA6F;IAC7F,4BAA4B;IAC5B,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IAC9E,mGAAmG;IACnG;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,8DAA8D,CAAC;QACpF,wBAAwB;KACzB;IACD,0DAA0D;IAC1D,CAAC,oDAAoD,EAAE,8BAA8B,CAAC;IACtF,qCAAqC;IACrC,CAAC,gDAAgD,EAAE,WAAW,CAAC;IAC/D,qEAAqE;IACrE,EAAE;IACF,6FAA6F;IAC7F,6FAA6F;IAC7F,yFAAyF;IACzF,uCAAuC;IACvC,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,EAAE;IACF,wFAAwF;IACxF,gGAAgG;IAChG,6CAA6C;IAC7C;QACE,IAAI,MAAM,CACR,OAAO;YACL,4BAA4B;YAC5B,cAAc;YACd,qCAAqC;YACrC,WAAW,CACd;QACD,oCAAoC;KACrC;IACD;QACE,IAAI,MAAM,CACR,OAAO;YACL,4BAA4B;YAC5B,cAAc;YACd,qCAAqC;YACrC,iBAAiB,CACpB;QACD,qCAAqC;KACtC;IACD,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,uBAAuB;IACvB,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,oCAAoC,CAAC;IAC5E,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,iBAAiB,CAAC,EAAE,qCAAqC,CAAC;IACnF,iEAAiE;IACjE,EAAE;IACF,iGAAiG;IACjG,4FAA4F;IAC5F,qFAAqF;IACrF,iGAAiG;IACjG,uFAAuF;IACvF,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,gCAAgC,CAAC,EAAE,oBAAoB,CAAC;IAC9E,6EAA6E;IAC7E,yCAAyC;IACzC,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,sCAAsC,CAAC,EAAE,wBAAwB,CAAC;IACxF,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACvE;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,gDAAgD,CAAC;QACtE,2BAA2B;KAC5B;IACD,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,EAAE,+BAA+B,CAAC;CAC9E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kGA6DkG;AAElG;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,OAAO;IACL,+FAA+F,CAClG,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,OAAO,GAAG,kBAAkB,GAAG,mBAAmB,CAAC,CAAC;AAE5F;;;;GAIG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC;;;;GAIG;AACH,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C,iGAAiG;AACjG,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,uBAAuB,GAC3B,4EAA4E,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAsB;IACpD,4DAA4D;IAC5D,IAAI,MAAM,CAAC,YAAY,GAAG,cAAc,CAAC;IACzC,IAAI,MAAM,CAAC,oCAAoC,GAAG,cAAc,CAAC;IACjE,gFAAgF;IAChF,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IAChC,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IAChC,IAAI,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IAClC,IAAI,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IACjC,IAAI,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;IACnC,IAAI,MAAM,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAC1C,gCAAgC;IAChC,sBAAsB;IACtB,WAAW;IACX,WAAW;IACX,0BAA0B;IAC1B,kBAAkB;IAClB,WAAW;IACX,oBAAoB;IACpB,0CAA0C;IAC1C,IAAI,MAAM,CAAC,OAAO,GAAG,+BAA+B,CAAC;CACtD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,sBAA8B;IACxE,KAAK,MAAM,QAAQ,IAAI,sBAAsB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACtF,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,0EAA0E;QAC1E,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAwBD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IACD,iGAAiG;IACjG,yFAAyF;IACzF,gCAAgC;IAChC,IAAI,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,WAAW,EAAE,qCAAqC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,KAAoB;IACxE,OAAO,CACL,wBAAwB,OAAO,uCAAuC;QACtE,IAAI,KAAK,CAAC,WAAW,gEAAgE,CACtF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hardline.js","sourceRoot":"","sources":["../../../src/core/shell/hardline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEzF;;;GAGG;AACH,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,YAAY,GAAsB;IACtC,6FAA6F;IAC7F,sEAAsE;IACtE,iGAAiG;IACjG,yBAAyB;IACzB,mEAAmE;IACnE,6FAA6F;IAC7F,6FAA6F;IAC7F,oBAAoB;IACpB,0FAA0F;IAC1F,gGAAgG;IAChG,kDAAkD;IAClD,4DAA4D;IAC5D,aAAa,aAAa,EAAE;IAC5B,gGAAgG;IAChG,iGAAiG;IACjG,2FAA2F;IAC3F,4DAA4D,aAAa,EAAE;CAC5E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,MAAM,OAAO,GACX,SAAS,uBAAuB,aAAa;IAC7C,MAAM;IACN,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;IAChC,MAAM,CAAC;AAET;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,gBAAgB,GAAG,eAAe,uBAAuB,IAAI,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,OAAO,IAAI,MAAM,IAAI,KAAK,IAAI,IAAI,gBAAgB,EAAE,CAAC;AAEpG;;;;;;;;kGAQkG;AAElG;;;;GAIG;AACH,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,YAAY,CACpC,+EAA+E,CAChF,CAAC;AAEF;;;;;;;kGAOkG;AAElG;;;;;;GAMG;AACH,MAAM,OAAO,GAAG,eAAe,CAAC;AAEhC;;;;;;;;;;;;;GAaG;AACH,MAAM,kBAAkB,GAAG,SAAS,uBAAuB,EAAE,CAAC;AAE9D,wDAAwD;AACxD,MAAM,YAAY,GAAG,KAAK,kBAAkB,GAAG,CAAC;AAEhD,oEAAoE;AACpE,MAAM,cAAc,GAAG,KAAK,kBAAkB,IAAI,CAAC;AAEnD;;;;GAIG;AACH,MAAM,cAAc,GAAG,wBAAwB,YAAY,KAAK,YAAY,IAAI,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,OAAO,YAAY,KAAK,cAAc,IAAI,CAAC;AAEvE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GACd,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM,mBAAmB,GAAG,OAAO,IAAI;IACvC,cAAc;IACd,OAAO;IACP,MAAM,mBAAmB,GAAG,OAAO,IAAI,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA6C;IACzE,iGAAiG;IACjG,yFAAyF;IACzF;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,yBAAyB,GAAG,WAAW,CAAC;QAC7D,qCAAqC;KACtC;IACD,2EAA2E;IAC3E;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,yBAAyB,GAAG,iBAAiB,CAAC;QACnE,sCAAsC;KACvC;IACD,oDAAoD;IACpD,4EAA4E;IAC5E;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,+CAA+C,GAAG,gBAAgB,CAAC;QACxF,oCAAoC;KACrC;IACD,6FAA6F;IAC7F,6FAA6F;IAC7F,4BAA4B;IAC5B,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IAC9E,mGAAmG;IACnG;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,8DAA8D,CAAC;QACpF,wBAAwB;KACzB;IACD,0DAA0D;IAC1D,CAAC,oDAAoD,EAAE,8BAA8B,CAAC;IACtF,qCAAqC;IACrC,CAAC,gDAAgD,EAAE,WAAW,CAAC;IAC/D,qEAAqE;IACrE,EAAE;IACF,6FAA6F;IAC7F,6FAA6F;IAC7F,yFAAyF;IACzF,uCAAuC;IACvC,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,EAAE;IACF,wFAAwF;IACxF,gGAAgG;IAChG,6CAA6C;IAC7C;QACE,IAAI,MAAM,CACR,OAAO;YACL,4BAA4B;YAC5B,cAAc;YACd,qCAAqC;YACrC,WAAW,CACd;QACD,oCAAoC;KACrC;IACD;QACE,IAAI,MAAM,CACR,OAAO;YACL,4BAA4B;YAC5B,cAAc;YACd,qCAAqC;YACrC,iBAAiB,CACpB;QACD,qCAAqC;KACtC;IACD,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,uBAAuB;IACvB,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,oCAAoC,CAAC;IAC5E,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,iBAAiB,CAAC,EAAE,qCAAqC,CAAC;IACnF,iEAAiE;IACjE,EAAE;IACF,iGAAiG;IACjG,4FAA4F;IAC5F,qFAAqF;IACrF,iGAAiG;IACjG,uFAAuF;IACvF,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,gCAAgC,CAAC,EAAE,oBAAoB,CAAC;IAC9E,6EAA6E;IAC7E,yCAAyC;IACzC,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,sCAAsC,CAAC,EAAE,wBAAwB,CAAC;IACxF,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACvE;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,gDAAgD,CAAC;QACtE,2BAA2B;KAC5B;IACD,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,EAAE,+BAA+B,CAAC;CAC9E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kGA6DkG;AAElG;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,OAAO;IACL,+FAA+F,CAClG,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,OAAO,GAAG,kBAAkB,GAAG,mBAAmB,CAAC,CAAC;AAE5F;;;;GAIG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC;;;;GAIG;AACH,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C,iGAAiG;AACjG,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,uBAAuB,GAC3B,4EAA4E,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAsB;IACpD,4DAA4D;IAC5D,IAAI,MAAM,CAAC,YAAY,GAAG,cAAc,CAAC;IACzC,IAAI,MAAM,CAAC,oCAAoC,GAAG,cAAc,CAAC;IACjE,gFAAgF;IAChF,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IAChC,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IAChC,IAAI,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IAClC,IAAI,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IACjC,IAAI,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;IACnC,IAAI,MAAM,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAC1C,gCAAgC;IAChC,sBAAsB;IACtB,WAAW;IACX,WAAW;IACX,0BAA0B;IAC1B,kBAAkB;IAClB,WAAW;IACX,oBAAoB;IACpB,0CAA0C;IAC1C,IAAI,MAAM,CAAC,OAAO,GAAG,+BAA+B,CAAC;CACtD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,MAAM,CAAC,MAAM,CAAC;IACZ,uBAAuB;IACvB,uBAAuB;IACvB,aAAa;IACb,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC;IAC9C,OAAO;IACP,gBAAgB;IAChB,OAAO;IACP,kBAAkB;IAClB,YAAY;IACZ,cAAc;IACd,0DAA0D;IAC1D,WAAW;IACX,iBAAiB;IACjB,cAAc;IACd,mBAAmB;IACnB,UAAU;IACV,6FAA6F;IAC7F,6FAA6F;IAC7F,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,yBAAyB;IACzB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC;IACxC,mBAAmB;IACnB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAClD,SAAS;IACT,cAAc;IACd,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IACxD,0BAA0B,EAAE,MAAM,CAAC,MAAM,CACvC,0BAA0B,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAC7D;CACF,CAAC,CAAC;AAEL;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,sBAA8B;IACxE,KAAK,MAAM,QAAQ,IAAI,sBAAsB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACtF,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,0EAA0E;QAC1E,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAwBD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IACD,iGAAiG;IACjG,yFAAyF;IACzF,gCAAgC;IAChC,IAAI,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,WAAW,EAAE,qCAAqC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,KAAoB;IACxE,OAAO,CACL,wBAAwB,OAAO,uCAAuC;QACtE,IAAI,KAAK,CAAC,WAAW,gEAAgE,CACtF,CAAC;AACJ,CAAC"}