@gaunt-sloth/core 2.0.0-beta.1 → 2.0.0-beta.3

package/dist/core/shell/hardline.js

@@ -21,8 +21,17 @@
  * **What it is:** a cheap, deterministic way to turn away a small set of commands we are
  * **absolutely sure** are catastrophic and that can be recognised **without numerous annoying false
  * positives** — wipe the root filesystem, format a disk, overwrite a raw block device, re-own the
- * filesystem out from under root, fork-bomb, take the host down — plus the deterministic subset of
- * the §4.1.1 `attack` outcome (a credential source and a network sink in one pipeline).
+ * filesystem out from under root, fork-bomb — plus the deterministic subset of the §4.1.1 `attack`
+ * outcome (a credential source and a network sink in one pipeline).
+ *
+ * **Taking the host down is NOT here.** `shutdown`, `reboot`, `halt`, `poweroff`, `init 0/6`,
+ * `systemctl poweroff` and `telinit 0/6` are `destructive`, not `catastrophic`: the machine comes
+ * back. §8 covers only the deterministic subset of `attack` and of `catastrophic`, so the family
+ * sits above this layer, with the rater and the confirmation dialog in front of it. Anchoring the
+ * family instead of removing it was the alternative and it is the wrong one — the floor is
+ * unappealable at every rung, so it refused `shutdown --help`, `shutdown --dry-run`, and the
+ * `shutdown -c` that CANCELS a pending shutdown, which is the command a user reaches for to PREVENT
+ * the harm.
  *
  * **What it is NOT: a security boundary, an ultimate defence, or complete.** It is a lexical test
  * over the normalized command; it does not parse the shell and never will. **Incompleteness here is
@@ -78,6 +87,13 @@
  * the two halves cannot come to disagree about what a separator is. Every destructive-verb pattern
  * is anchored at {@link CMD_POS}, so a verb in an ordinary argument is not a refusal.
  *
+ * **There are TWO pattern lists and the second is platform-gated.** {@link HARDLINE_PATTERNS} is
+ * catastrophic everywhere and is tried on every host; {@link WINDOWS_HARDLINE_PATTERNS} is tried in
+ * ADDITION when the platform is `win32`, never instead, because a Windows box also runs the POSIX
+ * shapes through Git Bash and WSL. The platform is an argument with a `process.platform` default
+ * ({@link HardlineOptions}) so both arms are reachable from any host's tests — read that docblock
+ * before adding a Windows arm, and the list's own for what it deliberately leaves out.
+ *
  * The floor is deliberately INDEPENDENT of the allow-list classifier above it: it must block a
  * catastrophic command even if every layer above wrongly decided that command was safe.
  */
@@ -144,7 +160,7 @@ const WRAPPER_ARMS = [
  * Matches a position where the shell would begin parsing a NEW command: start of string, after a
  * separator (`;` `&` `|` newline), after `$(` or a backtick, optionally consuming any run of the
  * leading wrappers in {@link WRAPPER_ARMS}. Used by every destructive-verb pattern so a verb in an
- * ordinary argument (`echo reboot`, `grep -c mkfs docs/*.md`) is not a refusal.
+ * ordinary argument (`echo mkfs.ext4 /dev/sda1`, `grep -c mkfs docs/*.md`) is not a refusal.
  *
  * **What this deliberately does NOT model. This is the worked example of the header's drop rule —
  * read it before proposing an addition.**
@@ -233,6 +249,44 @@ const CMD_POS = `(?:^|[${COMMAND_SEPARATOR_CLASS}\`]|\\$\\()` +
  * because a target is the last thing before the enclosing construct resumes.
  */
 const TARGET_TOKEN_END = `(?=$|[\\s)\`${COMMAND_SEPARATOR_CLASS}])`;
+/**
+ * A prefix asserting that what follows sits OUTSIDE any single-quoted region — an even number of
+ * single quotes between the start of the normalized command and the match. Used by the
+ * redirect-to-block-device arm, the one destructive arm that {@link CMD_POS} cannot anchor.
+ *
+ * **Why this arm needs an anchor of its own.** A redirection operator appears mid-command by
+ * definition, so there is no command position to bind it to. Unanchored, the arm fires on the
+ * STRING rather than on the operation, and the floor — unappealable at every rung including
+ * `bypass` — refuses `grep '> /dev/sda' install.log`, `echo 'wrote image > /dev/sdb'`, and
+ * `sed -i 's|> /dev/sda|> /dev/null|' script.sh`, which is the command someone runs to REMOVE a
+ * dangerous redirect from a script. The remediation being refused is what makes this a defect
+ * rather than noise.
+ *
+ * **SINGLE quotes only, and that is measured rather than aesthetic.** A scanner for this floor that
+ * tracked escapes and heredocs precisely leaked 6 of 12 attacks where a blunt single-quote one
+ * leaked 0: precision moved the decision onto a surface the attacker controls. Double quotes are
+ * deliberately NOT a region here either — treating them as one would newly hide
+ * `sh -c "cat img > /dev/sda"` and `bash -c "…"`, live shapes, to buy the refusal of
+ * `echo "wrote image > /dev/sdb"`, which nobody has hit. So a double-quoted mention stays refused.
+ *
+ * **What it gives up** is one rule and nothing else: every `> /dev/<blockdev>` preceded by an ODD
+ * number of single quotes in the normalized command, which is where the redirect reads as sitting
+ * inside a quoted region. That rule is the specification of the set; `shellHardline.spec.ts` pins a
+ * named SAMPLE of it rather than an enumeration, so a shape that satisfies the rule and is absent
+ * there is a declared miss all the same, and the rule is what to check a new one against. The
+ * commonest is `sh -c 'cat img > /dev/sda'` — already the interpreter-wrapper residual every other
+ * arm has. They execute, and they are misses this layer accepts: a miss keeps the rater and the
+ * confirmation dialog, an unappealable false positive keeps nothing. [[CFG-29]] span extraction is
+ * the discriminator that would close them.
+ *
+ * **Linear, not backtracking.** `[^']*` cannot cross a `'`, so each iteration's partition is forced
+ * and the outer `*` is bounded by the quote count — no ambiguity for the engine to explore. The
+ * lesson {@link CMD_POS} records about Fibonacci-many parses does not reach this shape, and
+ * `shellHardline.spec.ts` measures that rather than arguing it, on quotes interleaved with other
+ * characters — a run of ADJACENT quotes is deleted by {@link normalizeCommand} as a token-splitting
+ * artefact and never reaches this scan at all.
+ */
+const OUTSIDE_SINGLE_QUOTES = "^(?:[^']*'[^']*')*[^']*";
 /**
  * A target path, in the three spellings a shell accepts for the same file: bare, double-quoted,
  * single-quoted. `rm -rf "/"` deletes exactly what `rm -rf /` deletes.
@@ -361,9 +415,12 @@ const CHOWN_HEAD = CMD_POS +
  * asked for no gate. A false positive in this layer has no recovery at any rung; a miss still has
  * the layers above it. The floor stays narrow and accepts the misses.
  *
- * Two patterns are deliberately NOT anchored, because neither is a command-position construct: the
- * `>`-redirect-to-device arm (a redirection operator appears mid-command by definition) and the
- * fork-bomb literal (the string *is* the fork bomb).
+ * Two patterns carry no {@link CMD_POS} anchor, because neither is a command-position construct.
+ * The `>`-redirect-to-device arm is anchored differently instead — see
+ * {@link OUTSIDE_SINGLE_QUOTES} — because a redirection operator appears mid-command by definition,
+ * so the discrimination available to it is whether the `>` is QUOTED, not where it sits. The
+ * fork-bomb literal is anchored by nothing at all: the string *is* the fork bomb, so prose quoting
+ * it is refused, and that false positive is accepted rather than fixed.
  */
 export const HARDLINE_PATTERNS = [
     // rm -rf targeting the root filesystem (`/`, `/*`). Built with `new RegExp` so both the tail and
@@ -392,8 +449,13 @@ export const HARDLINE_PATTERNS = [
         new RegExp(CMD_POS + 'dd\\b[^\\n]*\\bof=/dev/(?:sd|nvme|hd|mmcblk|vd|xvd)[a-z0-9]*'),
         'dd to raw block device',
     ],
-    // Shell redirection to a raw block device (`> /dev/sda`).
-    [/>\s*\/dev\/(?:sd|nvme|hd|mmcblk|vd|xvd)[a-z0-9]*\b/, 'redirect to raw block device'],
+    // Shell redirection to a raw block device (`> /dev/sda`). Anchored OUTSIDE single quotes rather
+    // than at a command position — a redirection operator has no command position — so a MENTION of a
+    // redirect is not read as performing one.
+    [
+        new RegExp(OUTSIDE_SINGLE_QUOTES + '>\\s*/dev/(?:sd|nvme|hd|mmcblk|vd|xvd)[a-z0-9]*\\b'),
+        'redirect to raw block device',
+    ],
     // Classic fork bomb `:(){ :|:& };:`.
     [/:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/, 'fork bomb'],
     // Recursive chmod of root, and the same on a named system directory.
@@ -440,15 +502,234 @@ export const HARDLINE_PATTERNS = [
     // unappealably. Requiring a preceding token keeps `kill -9 -1`, `kill -HUP -1` and `kill -- -1`,
     // and drops only `kill -1` with no PID, which is a usage error rather than a kill-all.
     [new RegExp(CMD_POS + 'kill\\s+(?:-[^\\s]+\\s+)+-1\\b'), 'kill all processes'],
-    // System shutdown / reboot — anchored to a command position so `echo reboot`
-    // and `grep shutdown log` don't trip it.
-    [new RegExp(CMD_POS + '(?:shutdown|reboot|halt|poweroff)\\b'), 'system shutdown/reboot'],
-    [new RegExp(CMD_POS + 'init\\s+[06]\\b'), 'init 0/6 (shutdown/reboot)'],
+    // The shutdown family is NOT here — see "Taking the host down is NOT here" in the module header.
+];
+/* -------------------------------------------------------------------------------------------- *
+ * §8 — the WINDOWS arm. Tried only when the host platform is `win32`.
+ *
+ * **Why a separate list rather than more entries above.** The patterns above are catastrophic on
+ * every host; these are catastrophic only where they name real objects. `format` is a word a Linux
+ * agent writes into a deployment script, `del` and `rd` are ordinary words, and `diskpart` is a
+ * string someone greps for. Refusing them off-platform would be an unappealable refusal of prose,
+ * which is the defect class {@link CMD_POS} exists to record. Gating costs one comparison and
+ * removes the whole class, so the two lists never merge.
+ *
+ * **The POSIX list stays active on win32.** Nothing here replaces it: Git Bash, MSYS and WSL all
+ * run `rm -rf /` on a Windows box, and removing an arm from a platform would be a NARROWING of the
+ * kind the module header forbids without a pinned removal set. The win32 arm is purely additive.
+ *
+ * **WHICH SHELL THE REUSED HELPERS MODEL — read this before adding an arm.** {@link CMD_POS} and
+ * {@link TARGET_TOKEN_END} model **bash**, and they are reused here on a stated claim rather than
+ * by assumption. What carries over is exact: the separators they recognise (`;`, `&`, `|`, a line
+ * break) are also cmd.exe's and PowerShell's, and a token still ends at whitespace or end of input
+ * in all three. What does NOT carry over is the escape character. A backtick is PowerShell's
+ * ESCAPE, not a command substitution, and `^` is cmd.exe's, and {@link normalizeCommand} collapses
+ * neither. So `` r`emove-item -recurse c:\ `` and `de^l /s /q c:\` walk past this arm. **Those are
+ * MISSES, and misses are the direction this floor errs in** — the rater and the confirmation
+ * dialog stand behind them at every rung but `bypass`. The one place the bash reading is instead
+ * over-broad is a literal backtick immediately preceding a floored Windows verb, where bash would
+ * open a command and PowerShell would escape a character; that is a false positive nobody has hit
+ * and it is written down here rather than patched speculatively.
+ *
+ * **THE NORMALIZER COLLAPSES BACKSLASHES, AND EVERY TARGET BELOW IS WRITTEN FOR WHAT SURVIVES.**
+ * {@link normalizeCommand} folds `\x` to `x` (it is what stops `r\m -rf /`), so a Windows path
+ * arrives here with most of its separators gone: `C:\Windows\System32` is `c:windowssystem32`,
+ * `HKLM\SOFTWARE` is `hklmsoftware`, `.\dist` is `.dist`, and `\\?\C:\` is `\?c:\`. A trailing
+ * backslash survives only at end of input, and `C:\` followed by a space is just `c:`. Reading a
+ * pattern below as though it matched the command a user typed will therefore mislead in both
+ * directions — match them against the normalized form, which is what the specs assert on.
+ *
+ * The consequence that shapes the design: after the collapse a Windows path has **no separator
+ * left to bind a tail against**, so the discrimination POSIX gets for free from the `/` in
+ * `/etc/foo` has to come from the drive-letter colon and an enumerated directory name instead.
+ * That is why the drive-root arms are broad and the named-directory arm is a short enumeration.
+ * -------------------------------------------------------------------------------------------- */
+/**
+ * A run of Windows flag tokens. Identical in shape to the POSIX flag runs above — bounded per
+ * token by the required trailing whitespace — but a Windows flag may start with `/` as well as
+ * `-`, because cmd.exe and PowerShell disagree about which one they use and both spellings reach
+ * the same verbs.
+ */
+const WIN_FLAG_RUN = '(?:[-/][^\\s]*\\s+)*';
+/**
+ * The span of ONE command, for the lookaheads below: anything that is not a separator. It is what
+ * keeps a flag belonging to a LATER command out of an earlier one's reading, so `icacls c:\ /grant
+ * everyone:f; ls /t` cannot borrow the `/t` from the `ls`.
+ */
+const WIN_SAME_COMMAND = `[^${COMMAND_SEPARATOR_CLASS}]*`;
+/**
+ * How a Windows system drive is NAMED, before any trailing separator: a drive letter and its
+ * colon, optionally behind the `\\?\` long-path prefix (which normalisation leaves as `\?`), or
+ * the two environment spellings of the same thing — cmd's `%SystemDrive%` and PowerShell's
+ * `$env:SystemDrive`.
+ *
+ * The colon is what makes this bindable at all. Every other character of a collapsed Windows path
+ * is an ordinary letter, so without the colon there would be nothing to distinguish `c:` from the
+ * first letter of a relative path.
+ */
+const WIN_DRIVE_PREFIX = '(?:(?:\\\\\\?)?[a-z]:|%systemdrive%|\\$env:systemdrive)';
+/**
+ * What may follow a Windows target before its token ends: a separator (`\` or `/`), a wildcard, or
+ * both. `C:\` reaches here as `c:\` at end of input, as `c:` before a space, and `C:\*` as `c:*`,
+ * so all three have to be one optional group.
+ */
+const WIN_ROOT_TAIL = '(?:[\\\\/]?\\*|[\\\\/])?';
+/**
+ * A Windows drive ROOT as a target. The {@link TARGET_TOKEN_END} tail that {@link quotedOrBare}
+ * appends is what does the work: without it `c:` matches the first two characters of every
+ * absolute Windows path, and `rd /s /q c:\build` — ordinary work — would be refused unappealably.
+ * With it, the token has to END at the drive, so `c:build` and `c:/users/me/app` are out of range
+ * for the same reason `/var/www/html` is out of range on the POSIX side.
+ */
+const WIN_DRIVE_ROOT = quotedOrBare(WIN_DRIVE_PREFIX + WIN_ROOT_TAIL);
+/**
+ * The Windows system directory as a target — `C:\Windows` and `C:\Windows\System32`, plus the
+ * `%SystemRoot%` / `$env:windir` spellings of the first.
+ *
+ * **The two depths are ENUMERATED, and the hole that leaves is declared rather than argued away.**
+ * Because the backslash collapse leaves `c:windowssystem32` with no separator, a tail cannot bind
+ * part-way through the way it can after `/etc`; each depth is its own alternative. So a deeper
+ * system path (`C:\Windows\System32\drivers`) is NOT matched. That is the same shape of residual
+ * the POSIX arms carry — `/etc/foo` is equally out of range — and it errs toward a miss, which is
+ * this floor's safe direction.
+ *
+ * The tail still has to bind, which is what keeps `C:\Windows.old` (a leftover upgrade directory
+ * people delete on purpose) and `C:\WindowsApps\…` out of range.
+ */
+const WIN_SYSTEM_DIR_TARGET = quotedOrBare(`(?:${WIN_DRIVE_PREFIX}[\\\\/]?windows(?:[\\\\/]?system32)?|%systemroot%|\\$env:windir)` +
+    WIN_ROOT_TAIL);
+/**
+ * The delete verbs, in one alternation because cmd.exe and PowerShell share most of them.
+ * `remove-item` is the PowerShell cmdlet and `ri`/`rm`/`rd`/`rmdir`/`del`/`erase` are all aliases
+ * of it, while `rd`/`rmdir`/`del`/`erase` are simultaneously cmd.exe's own builtins. One list
+ * covers both shells, and the target is what carries the discrimination.
+ *
+ * **No flag is required, deliberately, and that mirrors the POSIX `rm` arm** — which also requires
+ * none, because a verb pointed at the root of a filesystem is the catastrophe whether or not the
+ * recursion flag is spelled. The `chown`/`chmod` analogues below DO require recursion, for the
+ * same reason their POSIX siblings do: without it they touch one directory entry rather than every
+ * file on the disk.
+ */
+const WIN_DELETE_VERB = '(?:remove-item|rmdir|erase|del|rd|ri|rm)';
+/**
+ * The Windows system drive as **Git Bash and Cygwin spell it**. Git for Windows mounts `C:` at
+ * `/c`, Cygwin at `/cygdrive/c`, and both spellings reach the real system drive while `rm -rf /`
+ * on the same box reaches only the MSYS root — the least harmful of the three.
+ *
+ * **It is on the win32 arm rather than folded into {@link SYSTEM_DIR_TARGET}, and that is the
+ * deliberate half.** Folding it in would widen a shared pattern, which is the one edit that could
+ * regress the POSIX behaviour this node must leave untouched — and on Linux `/c/users` is an
+ * ordinary directory nobody may be refused for deleting. `process.platform` is `win32` under Git
+ * Bash and Cygwin alike, so gating loses no coverage. **WSL is NOT covered**: it reports `linux`
+ * and mounts the drive at `/mnt/c`, so that spelling is a declared miss.
+ *
+ * The user-profile and system directories are enumerated one level down for the same reason the
+ * POSIX arm names `/home` — `/c/users` is every account on the machine.
+ */
+const GIT_BASH_DRIVE_TARGET = quotedOrBare('(?:/cygdrive)?/[a-z](?:/(?:users|windows|programdata))?(?:/\\*?)?');
+/**
+ * A MACHINE registry hive as a target: the whole of `HKLM` or `HKCR`, or the two subtrees whose
+ * loss is not survivable — `HKLM\SOFTWARE` unregisters every installed application and
+ * `HKLM\SYSTEM` stops the machine booting.
+ *
+ * The {@link TARGET_TOKEN_END} tail is doing the same job it does for the filesystem targets, and
+ * here it is what separates the catastrophe from the everyday: after the backslash collapse
+ * `HKLM\SOFTWARE\MyApp` is `hklmsoftwaremyapp`, so requiring the token to END at the hive is what
+ * leaves an application deleting its OWN key alone. `HKCU` is deliberately absent — a user hive is
+ * recoverable by logging in again.
+ */
+const WIN_MACHINE_HIVE = quotedOrBare('(?:(?:hklm|hkey_local_machine)(?:[\\\\/]?(?:software|system))?|hkcr|hkey_classes_root)');
+/**
+ * The win32-only patterns, in the same `[regex, description]` shape as {@link HARDLINE_PATTERNS}
+ * and subject to every rule in the module header — including that a miss here is cheap and a false
+ * positive is unappealable.
+ *
+ * **What is deliberately NOT here, so the residual is a decision rather than an oversight:**
+ *
+ *  - **The host-down family** — `shutdown /s`, `shutdown /r`, `Stop-Computer`, `Restart-Computer`.
+ *    They are `destructive`, not `catastrophic`, under the same ruling that removed their POSIX
+ *    siblings; the machine comes back. `shellHardline.spec.ts` pins them as non-additions so this
+ *    arm cannot quietly re-open a settled classification on one platform.
+ *  - **`cipher /w:`** — it overwrites FREE space. Nothing in use is lost and the machine is
+ *    unaffected, so it fails the catastrophic test even though it destroys recoverability.
+ *  - **`bcdedit /set … recoveryenabled No`** — a setting flip, undone by the opposite flip. It is a
+ *    ransomware precursor, not a loss.
+ *  - **`taskkill /f /im *`** — the wildcard image name is documented as accepted only alongside a
+ *    filter, so the bare form may be a usage error. Flooring a command that does nothing buys
+ *    nothing and puts a pattern next to the ordinary `taskkill /f /im node.exe`; the POSIX
+ *    `kill -9 -1` arm covers the shape where it is known to bite.
+ *  - **The interpreter-wrapper forms** — `powershell -Command "…"` and `cmd /c "…"` put the verb
+ *    inside a quoted ARGUMENT, exactly as `sh -c "…"` does above, and are uncovered on the same
+ *    basis. This matters more here than it looks: `run_shell_command` spawns **cmd.exe** on win32,
+ *    so the cmd verbs are the ones actually reachable and the PowerShell cmdlets are reachable only
+ *    where the model writes PowerShell idioms anyway, or a future config points the tool at `pwsh`.
+ */
+const WINDOWS_HARDLINE_PATTERNS = [
+    // Delete of a drive root, in both shells' spellings.
+    [
+        new RegExp(CMD_POS + WIN_DELETE_VERB + '\\s+' + WIN_FLAG_RUN + WIN_DRIVE_ROOT),
+        'recursive delete of a Windows drive root',
+    ],
+    // The same verbs pointed at the system directory.
+    [
+        new RegExp(CMD_POS + WIN_DELETE_VERB + '\\s+' + WIN_FLAG_RUN + WIN_SYSTEM_DIR_TARGET),
+        'recursive delete of the Windows system directory',
+    ],
+    // The Git Bash / Cygwin spelling of the system drive, on the POSIX verb that reaches it.
+    [
+        new RegExp(CMD_POS + 'rm\\s+(?:-[^\\s]*\\s+)*' + GIT_BASH_DRIVE_TARGET),
+        'recursive delete of the Windows system drive',
+    ],
+    // `format C: /y`. The drive-letter OPERAND is required, which is what keeps `Format-Table`,
+    // `Format-List` and `git format-patch` out of range — each has a `-` where this needs whitespace.
+    [new RegExp(CMD_POS + 'format\\s+' + WIN_FLAG_RUN + WIN_DRIVE_ROOT), 'format a Windows drive'],
+    // The storage cmdlets, bare: every invocation of them destroys a volume or a disk. Anchored, so
+    // `get-help format-volume` is a lookup rather than a refusal. Same accepted cost as `mkfs`.
+    [new RegExp(CMD_POS + 'format-volume\\b'), 'format a Windows volume'],
+    [new RegExp(CMD_POS + 'clear-disk\\b'), 'wipe a Windows disk'],
+    [new RegExp(CMD_POS + 'diskpart\\b'), 'Windows disk partitioning (diskpart)'],
+    // Destroying the shadow copies is what makes an encryption pass unrecoverable, and it is the
+    // single most reliable ransomware precursor there is. `vssadmin list shadows` is read-only and
+    // stays allowed, which is why the arm requires the verb and not merely the tool.
+    [
+        new RegExp(CMD_POS + 'vssadmin\\s+' + WIN_FLAG_RUN + 'delete\\s+shadows\\b'),
+        'delete the Windows shadow copies',
+    ],
     [
-        new RegExp(CMD_POS + 'systemctl\\s+(?:poweroff|reboot|halt|kexec)\\b'),
-        'systemctl poweroff/reboot',
+        new RegExp(CMD_POS + 'wmic\\b' + WIN_SAME_COMMAND + 'shadowcopy\\b' + WIN_SAME_COMMAND + 'delete\\b'),
+        'delete the Windows shadow copies',
+    ],
+    // `reg delete` of a machine hive. `reg query` and `reg export` are read-only and cannot reach it.
+    [
+        new RegExp(CMD_POS + 'reg\\s+delete\\s+' + WIN_MACHINE_HIVE),
+        'delete a Windows machine registry hive',
+    ],
+    // `takeown /f C:\ /r` — the `chown -R /` analogue, and the worse of the pair for the same reason
+    // `chown` is worse than `chmod`: it takes ownership AWAY, so the box can no longer repair itself.
+    // `/r` is required (a non-recursive takeown re-owns one directory entry). It is asserted by a
+    // lookahead taken FROM THE VERB rather than from the target, because `takeown /r /f C:\` and
+    // `takeown /f C:\ /r` are both real invocations and a lookahead placed after the target can only
+    // see the second — measured, that spelling was allowed.
+    [
+        new RegExp(CMD_POS +
+            'takeown\\b' +
+            `(?=${WIN_SAME_COMMAND}\\s/r\\b)` +
+            WIN_SAME_COMMAND +
+            '\\s/f\\s+' +
+            WIN_DRIVE_ROOT),
+        'recursive takeown of a Windows drive root',
+    ],
+    // `icacls C:\ /grant Everyone:F /t` — the `chmod -R /` analogue. BOTH lookaheads are required and
+    // the second is not decoration: `/t` alone would refuse `icacls C:\ /save acl.txt /t`, which is a
+    // recursive BACKUP of the ACLs and the command an administrator runs before changing them.
+    [
+        new RegExp(CMD_POS +
+            'icacls\\s+' +
+            WIN_DRIVE_ROOT +
+            `(?=${WIN_SAME_COMMAND}\\s/t\\b)` +
+            `(?=${WIN_SAME_COMMAND}\\s/(?:grant|deny|remove|reset|setowner)\\b)`),
+        'recursive ACL rewrite of a Windows drive root',
     ],
-    [new RegExp(CMD_POS + 'telinit\\s+[06]\\b'), 'telinit 0/6 (shutdown/reboot)'],
 ];
 /* -------------------------------------------------------------------------------------------- *
  * §8 — the DETERMINISTIC SUBSET OF THE `attack` OUTCOME.
@@ -690,6 +971,7 @@ export const HARDLINE_PATTERN_SURFACE = Object.freeze({
     WRAPPER_ARMS: Object.freeze([...WRAPPER_ARMS]),
     CMD_POS,
     TARGET_TOKEN_END,
+    OUTSIDE_SINGLE_QUOTES,
     H_SPACE,
     H_TOKEN_EXCLUSIONS,
     H_TOKEN_CHAR,
@@ -704,6 +986,19 @@ export const HARDLINE_PATTERN_SURFACE = Object.freeze({
     // reworded one is not a narrowing, so they stay out rather than train a reader to update the
     // frozen literal without reading why the cell went red.
     HARDLINE_PATTERNS: Object.freeze(HARDLINE_PATTERNS.map(([pattern]) => String(pattern))),
+    // The win32-only arm and the fragments it is built from. Enrolled on exactly the same terms as
+    // the shared arm: a narrowing here is invisible on four of five matrix cells, so it needs the
+    // declaration more than the POSIX half does, not less.
+    WIN_FLAG_RUN,
+    WIN_SAME_COMMAND,
+    WIN_DRIVE_PREFIX,
+    WIN_ROOT_TAIL,
+    WIN_DRIVE_ROOT,
+    WIN_SYSTEM_DIR_TARGET,
+    WIN_DELETE_VERB,
+    GIT_BASH_DRIVE_TARGET,
+    WIN_MACHINE_HIVE,
+    WINDOWS_HARDLINE_PATTERNS: Object.freeze(WINDOWS_HARDLINE_PATTERNS.map(([pattern]) => String(pattern))),
     // The exfiltration arms.
     PIPELINE_SPLIT_RE: String(PIPELINE_SPLIT_RE),
     NETWORK_SINK_RE: String(NETWORK_SINK_RE),
@@ -745,14 +1040,24 @@ export const EXFILTRATION_ARM = 'deterministic-exfiltration';
  * Check a raw command against the hardline blocklist. Normalizes first so
  * obfuscated variants are caught. Returns the match (with a description) when the
  * command is catastrophic, or `null` when it is allowed to proceed.
+ *
+ * The shared patterns are tried on every host. The win32 arm is tried in addition on Windows —
+ * never instead of, because Git Bash, MSYS and WSL run the POSIX shapes on a Windows box too.
  */
-export function checkHardline(command) {
+export function checkHardline(command, options) {
     const normalized = normalizeCommand(command).toLowerCase();
     for (const [pattern, description] of HARDLINE_PATTERNS) {
         if (pattern.test(normalized)) {
             return { description, pattern: pattern.source };
         }
     }
+    if ((options?.platform ?? process.platform) === 'win32') {
+        for (const [pattern, description] of WINDOWS_HARDLINE_PATTERNS) {
+            if (pattern.test(normalized)) {
+                return { description, pattern: pattern.source };
+            }
+        }
+    }
     // §3/§8 — the deterministic subset of the `attack` outcome, so refusing a credential upload does
     // not depend on a model being right, and cannot be ridden through on an allow-list entry
     // (consulted before the rater).

package/dist/core/shell/hardline.js.map

@@ -1 +1 @@
-{"version":3,"file":"hardline.js","sourceRoot":"","sources":["../../../src/core/shell/hardline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEzF;;;GAGG;AACH,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,YAAY,GAAsB;IACtC,6FAA6F;IAC7F,sEAAsE;IACtE,iGAAiG;IACjG,yBAAyB;IACzB,mEAAmE;IACnE,6FAA6F;IAC7F,6FAA6F;IAC7F,oBAAoB;IACpB,0FAA0F;IAC1F,gGAAgG;IAChG,kDAAkD;IAClD,4DAA4D;IAC5D,aAAa,aAAa,EAAE;IAC5B,gGAAgG;IAChG,iGAAiG;IACjG,2FAA2F;IAC3F,4DAA4D,aAAa,EAAE;CAC5E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,MAAM,OAAO,GACX,SAAS,uBAAuB,aAAa;IAC7C,MAAM;IACN,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;IAChC,MAAM,CAAC;AAET;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,gBAAgB,GAAG,eAAe,uBAAuB,IAAI,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,OAAO,IAAI,MAAM,IAAI,KAAK,IAAI,IAAI,gBAAgB,EAAE,CAAC;AAEpG;;;;;;;;kGAQkG;AAElG;;;;GAIG;AACH,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,YAAY,CACpC,+EAA+E,CAChF,CAAC;AAEF;;;;;;;kGAOkG;AAElG;;;;;;GAMG;AACH,MAAM,OAAO,GAAG,eAAe,CAAC;AAEhC;;;;;;;;;;;;;GAaG;AACH,MAAM,kBAAkB,GAAG,SAAS,uBAAuB,EAAE,CAAC;AAE9D,wDAAwD;AACxD,MAAM,YAAY,GAAG,KAAK,kBAAkB,GAAG,CAAC;AAEhD,oEAAoE;AACpE,MAAM,cAAc,GAAG,KAAK,kBAAkB,IAAI,CAAC;AAEnD;;;;GAIG;AACH,MAAM,cAAc,GAAG,wBAAwB,YAAY,KAAK,YAAY,IAAI,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,OAAO,YAAY,KAAK,cAAc,IAAI,CAAC;AAEvE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GACd,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM,mBAAmB,GAAG,OAAO,IAAI;IACvC,cAAc;IACd,OAAO;IACP,MAAM,mBAAmB,GAAG,OAAO,IAAI,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA6C;IACzE,iGAAiG;IACjG,yFAAyF;IACzF;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,yBAAyB,GAAG,WAAW,CAAC;QAC7D,qCAAqC;KACtC;IACD,2EAA2E;IAC3E;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,yBAAyB,GAAG,iBAAiB,CAAC;QACnE,sCAAsC;KACvC;IACD,oDAAoD;IACpD,4EAA4E;IAC5E;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,+CAA+C,GAAG,gBAAgB,CAAC;QACxF,oCAAoC;KACrC;IACD,6FAA6F;IAC7F,6FAA6F;IAC7F,4BAA4B;IAC5B,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IAC9E,mGAAmG;IACnG;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,8DAA8D,CAAC;QACpF,wBAAwB;KACzB;IACD,0DAA0D;IAC1D,CAAC,oDAAoD,EAAE,8BAA8B,CAAC;IACtF,qCAAqC;IACrC,CAAC,gDAAgD,EAAE,WAAW,CAAC;IAC/D,qEAAqE;IACrE,EAAE;IACF,6FAA6F;IAC7F,6FAA6F;IAC7F,yFAAyF;IACzF,uCAAuC;IACvC,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,EAAE;IACF,wFAAwF;IACxF,gGAAgG;IAChG,6CAA6C;IAC7C;QACE,IAAI,MAAM,CACR,OAAO;YACL,4BAA4B;YAC5B,cAAc;YACd,qCAAqC;YACrC,WAAW,CACd;QACD,oCAAoC;KACrC;IACD;QACE,IAAI,MAAM,CACR,OAAO;YACL,4BAA4B;YAC5B,cAAc;YACd,qCAAqC;YACrC,iBAAiB,CACpB;QACD,qCAAqC;KACtC;IACD,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,uBAAuB;IACvB,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,oCAAoC,CAAC;IAC5E,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,iBAAiB,CAAC,EAAE,qCAAqC,CAAC;IACnF,iEAAiE;IACjE,EAAE;IACF,iGAAiG;IACjG,4FAA4F;IAC5F,qFAAqF;IACrF,iGAAiG;IACjG,uFAAuF;IACvF,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,gCAAgC,CAAC,EAAE,oBAAoB,CAAC;IAC9E,6EAA6E;IAC7E,yCAAyC;IACzC,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,sCAAsC,CAAC,EAAE,wBAAwB,CAAC;IACxF,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACvE;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,gDAAgD,CAAC;QACtE,2BAA2B;KAC5B;IACD,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,EAAE,+BAA+B,CAAC;CAC9E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kGA6DkG;AAElG;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,OAAO;IACL,+FAA+F,CAClG,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,OAAO,GAAG,kBAAkB,GAAG,mBAAmB,CAAC,CAAC;AAE5F;;;;GAIG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC;;;;GAIG;AACH,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C,iGAAiG;AACjG,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,uBAAuB,GAC3B,4EAA4E,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAsB;IACpD,4DAA4D;IAC5D,IAAI,MAAM,CAAC,YAAY,GAAG,cAAc,CAAC;IACzC,IAAI,MAAM,CAAC,oCAAoC,GAAG,cAAc,CAAC;IACjE,gFAAgF;IAChF,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IAChC,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IAChC,IAAI,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IAClC,IAAI,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IACjC,IAAI,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;IACnC,IAAI,MAAM,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAC1C,gCAAgC;IAChC,sBAAsB;IACtB,WAAW;IACX,WAAW;IACX,0BAA0B;IAC1B,kBAAkB;IAClB,WAAW;IACX,oBAAoB;IACpB,0CAA0C;IAC1C,IAAI,MAAM,CAAC,OAAO,GAAG,+BAA+B,CAAC;CACtD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,MAAM,CAAC,MAAM,CAAC;IACZ,uBAAuB;IACvB,uBAAuB;IACvB,aAAa;IACb,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC;IAC9C,OAAO;IACP,gBAAgB;IAChB,OAAO;IACP,kBAAkB;IAClB,YAAY;IACZ,cAAc;IACd,0DAA0D;IAC1D,WAAW;IACX,iBAAiB;IACjB,cAAc;IACd,mBAAmB;IACnB,UAAU;IACV,6FAA6F;IAC7F,6FAA6F;IAC7F,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,yBAAyB;IACzB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC;IACxC,mBAAmB;IACnB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAClD,SAAS;IACT,cAAc;IACd,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IACxD,0BAA0B,EAAE,MAAM,CAAC,MAAM,CACvC,0BAA0B,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAC7D;CACF,CAAC,CAAC;AAEL;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,sBAA8B;IACxE,KAAK,MAAM,QAAQ,IAAI,sBAAsB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACtF,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,0EAA0E;QAC1E,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAwBD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IACD,iGAAiG;IACjG,yFAAyF;IACzF,gCAAgC;IAChC,IAAI,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,WAAW,EAAE,qCAAqC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,KAAoB;IACxE,OAAO,CACL,wBAAwB,OAAO,uCAAuC;QACtE,IAAI,KAAK,CAAC,WAAW,gEAAgE,CACtF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hardline.js","sourceRoot":"","sources":["../../../src/core/shell/hardline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AACH,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEzF;;;GAGG;AACH,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,YAAY,GAAsB;IACtC,6FAA6F;IAC7F,sEAAsE;IACtE,iGAAiG;IACjG,yBAAyB;IACzB,mEAAmE;IACnE,6FAA6F;IAC7F,6FAA6F;IAC7F,oBAAoB;IACpB,0FAA0F;IAC1F,gGAAgG;IAChG,kDAAkD;IAClD,4DAA4D;IAC5D,aAAa,aAAa,EAAE;IAC5B,gGAAgG;IAChG,iGAAiG;IACjG,2FAA2F;IAC3F,4DAA4D,aAAa,EAAE;CAC5E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,MAAM,OAAO,GACX,SAAS,uBAAuB,aAAa;IAC7C,MAAM;IACN,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;IAChC,MAAM,CAAC;AAET;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,gBAAgB,GAAG,eAAe,uBAAuB,IAAI,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAExD;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,OAAO,IAAI,MAAM,IAAI,KAAK,IAAI,IAAI,gBAAgB,EAAE,CAAC;AAEpG;;;;;;;;kGAQkG;AAElG;;;;GAIG;AACH,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,YAAY,CACpC,+EAA+E,CAChF,CAAC;AAEF;;;;;;;kGAOkG;AAElG;;;;;;GAMG;AACH,MAAM,OAAO,GAAG,eAAe,CAAC;AAEhC;;;;;;;;;;;;;GAaG;AACH,MAAM,kBAAkB,GAAG,SAAS,uBAAuB,EAAE,CAAC;AAE9D,wDAAwD;AACxD,MAAM,YAAY,GAAG,KAAK,kBAAkB,GAAG,CAAC;AAEhD,oEAAoE;AACpE,MAAM,cAAc,GAAG,KAAK,kBAAkB,IAAI,CAAC;AAEnD;;;;GAIG;AACH,MAAM,cAAc,GAAG,wBAAwB,YAAY,KAAK,YAAY,IAAI,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,OAAO,YAAY,KAAK,cAAc,IAAI,CAAC;AAEvE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,GACd,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM,mBAAmB,GAAG,OAAO,IAAI;IACvC,cAAc;IACd,OAAO;IACP,MAAM,mBAAmB,GAAG,OAAO,IAAI,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA6C;IACzE,iGAAiG;IACjG,yFAAyF;IACzF;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,yBAAyB,GAAG,WAAW,CAAC;QAC7D,qCAAqC;KACtC;IACD,2EAA2E;IAC3E;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,yBAAyB,GAAG,iBAAiB,CAAC;QACnE,sCAAsC;KACvC;IACD,oDAAoD;IACpD,4EAA4E;IAC5E;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,+CAA+C,GAAG,gBAAgB,CAAC;QACxF,oCAAoC;KACrC;IACD,6FAA6F;IAC7F,6FAA6F;IAC7F,4BAA4B;IAC5B,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IAC9E,mGAAmG;IACnG;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,8DAA8D,CAAC;QACpF,wBAAwB;KACzB;IACD,gGAAgG;IAChG,kGAAkG;IAClG,0CAA0C;IAC1C;QACE,IAAI,MAAM,CAAC,qBAAqB,GAAG,oDAAoD,CAAC;QACxF,8BAA8B;KAC/B;IACD,qCAAqC;IACrC,CAAC,gDAAgD,EAAE,WAAW,CAAC;IAC/D,qEAAqE;IACrE,EAAE;IACF,6FAA6F;IAC7F,6FAA6F;IAC7F,yFAAyF;IACzF,uCAAuC;IACvC,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,EAAE;IACF,wFAAwF;IACxF,gGAAgG;IAChG,6CAA6C;IAC7C;QACE,IAAI,MAAM,CACR,OAAO;YACL,4BAA4B;YAC5B,cAAc;YACd,qCAAqC;YACrC,WAAW,CACd;QACD,oCAAoC;KACrC;IACD;QACE,IAAI,MAAM,CACR,OAAO;YACL,4BAA4B;YAC5B,cAAc;YACd,qCAAqC;YACrC,iBAAiB,CACpB;QACD,qCAAqC;KACtC;IACD,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,uBAAuB;IACvB,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,oCAAoC,CAAC;IAC5E,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,iBAAiB,CAAC,EAAE,qCAAqC,CAAC;IACnF,iEAAiE;IACjE,EAAE;IACF,iGAAiG;IACjG,4FAA4F;IAC5F,qFAAqF;IACrF,iGAAiG;IACjG,uFAAuF;IACvF,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,gCAAgC,CAAC,EAAE,oBAAoB,CAAC;IAC9E,iGAAiG;CAClG,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kGAuCkG;AAElG;;;;;GAKG;AACH,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,KAAK,uBAAuB,IAAI,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,yDAAyD,CAAC;AAEnF;;;;GAIG;AACH,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,YAAY,CAAC,gBAAgB,GAAG,aAAa,CAAC,CAAC;AAEtE;;;;;;;;;;;;;GAaG;AACH,MAAM,qBAAqB,GAAG,YAAY,CACxC,MAAM,gBAAgB,kEAAkE;IACtF,aAAa,CAChB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,eAAe,GAAG,0CAA0C,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,qBAAqB,GAAG,YAAY,CACxC,mEAAmE,CACpE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG,YAAY,CACnC,wFAAwF,CACzF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,yBAAyB,GAA6C;IAC1E,qDAAqD;IACrD;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,eAAe,GAAG,MAAM,GAAG,YAAY,GAAG,cAAc,CAAC;QAC9E,0CAA0C;KAC3C;IACD,kDAAkD;IAClD;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,eAAe,GAAG,MAAM,GAAG,YAAY,GAAG,qBAAqB,CAAC;QACrF,kDAAkD;KACnD;IACD,yFAAyF;IACzF;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,yBAAyB,GAAG,qBAAqB,CAAC;QACvE,8CAA8C;KAC/C;IACD,4FAA4F;IAC5F,kGAAkG;IAClG,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC9F,gGAAgG;IAChG,4FAA4F;IAC5F,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;IACrE,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,eAAe,CAAC,EAAE,qBAAqB,CAAC;IAC9D,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,aAAa,CAAC,EAAE,sCAAsC,CAAC;IAC7E,6FAA6F;IAC7F,+FAA+F;IAC/F,iFAAiF;IACjF;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,cAAc,GAAG,YAAY,GAAG,sBAAsB,CAAC;QAC5E,kCAAkC;KACnC;IACD;QACE,IAAI,MAAM,CACR,OAAO,GAAG,SAAS,GAAG,gBAAgB,GAAG,eAAe,GAAG,gBAAgB,GAAG,WAAW,CAC1F;QACD,kCAAkC;KACnC;IACD,kGAAkG;IAClG;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,mBAAmB,GAAG,gBAAgB,CAAC;QAC5D,wCAAwC;KACzC;IACD,iGAAiG;IACjG,kGAAkG;IAClG,8FAA8F;IAC9F,6FAA6F;IAC7F,iGAAiG;IACjG,wDAAwD;IACxD;QACE,IAAI,MAAM,CACR,OAAO;YACL,YAAY;YACZ,MAAM,gBAAgB,WAAW;YACjC,gBAAgB;YAChB,WAAW;YACX,cAAc,CACjB;QACD,2CAA2C;KAC5C;IACD,kGAAkG;IAClG,kGAAkG;IAClG,2FAA2F;IAC3F;QACE,IAAI,MAAM,CACR,OAAO;YACL,YAAY;YACZ,cAAc;YACd,MAAM,gBAAgB,WAAW;YACjC,MAAM,gBAAgB,8CAA8C,CACvE;QACD,+CAA+C;KAChD;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kGA6DkG;AAElG;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,OAAO;IACL,+FAA+F,CAClG,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,OAAO,GAAG,kBAAkB,GAAG,mBAAmB,CAAC,CAAC;AAE5F;;;;GAIG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC;;;;GAIG;AACH,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C,iGAAiG;AACjG,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,uBAAuB,GAC3B,4EAA4E,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAsB;IACpD,4DAA4D;IAC5D,IAAI,MAAM,CAAC,YAAY,GAAG,cAAc,CAAC;IACzC,IAAI,MAAM,CAAC,oCAAoC,GAAG,cAAc,CAAC;IACjE,gFAAgF;IAChF,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IAChC,IAAI,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IAChC,IAAI,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IAClC,IAAI,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IACjC,IAAI,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;IACnC,IAAI,MAAM,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAC1C,gCAAgC;IAChC,sBAAsB;IACtB,WAAW;IACX,WAAW;IACX,0BAA0B;IAC1B,kBAAkB;IAClB,WAAW;IACX,oBAAoB;IACpB,0CAA0C;IAC1C,IAAI,MAAM,CAAC,OAAO,GAAG,+BAA+B,CAAC;CACtD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,MAAM,CAAC,MAAM,CAAC;IACZ,uBAAuB;IACvB,uBAAuB;IACvB,aAAa;IACb,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC;IAC9C,OAAO;IACP,gBAAgB;IAChB,qBAAqB;IACrB,OAAO;IACP,kBAAkB;IAClB,YAAY;IACZ,cAAc;IACd,0DAA0D;IAC1D,WAAW;IACX,iBAAiB;IACjB,cAAc;IACd,mBAAmB;IACnB,UAAU;IACV,6FAA6F;IAC7F,6FAA6F;IAC7F,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,+FAA+F;IAC/F,8FAA8F;IAC9F,uDAAuD;IACvD,YAAY;IACZ,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,qBAAqB;IACrB,gBAAgB;IAChB,yBAAyB,EAAE,MAAM,CAAC,MAAM,CACtC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAC9D;IACD,yBAAyB;IACzB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC;IACxC,mBAAmB;IACnB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,CAAC;IAClD,SAAS;IACT,cAAc;IACd,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,CAAC;IACxD,0BAA0B,EAAE,MAAM,CAAC,MAAM,CACvC,0BAA0B,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAC7D;CACF,CAAC,CAAC;AAEL;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,sBAA8B;IACxE,KAAK,MAAM,QAAQ,IAAI,sBAAsB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACtF,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,0EAA0E;QAC1E,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAwBD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAmB7D;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAyB;IACtE,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;QACxD,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,yBAAyB,EAAE,CAAC;YAC/D,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IACD,iGAAiG;IACjG,yFAAyF;IACzF,gCAAgC;IAChC,IAAI,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,WAAW,EAAE,qCAAqC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,KAAoB;IACxE,OAAO,CACL,wBAAwB,OAAO,uCAAuC;QACtE,IAAI,KAAK,CAAC,WAAW,gEAAgE,CACtF,CAAC;AACJ,CAAC"}