@getmarrow/mcp 3.9.101 → 3.9.103
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +63 -29
- package/dist/cli.js +64 -1005
- package/dist/cli.js.map +1 -1
- package/dist/codex-plugin-pins.d.ts +19 -0
- package/dist/codex-plugin-pins.d.ts.map +1 -0
- package/dist/codex-plugin-pins.js +43 -0
- package/dist/codex-plugin-pins.js.map +1 -0
- package/dist/codex-plugins.d.ts +34 -0
- package/dist/codex-plugins.d.ts.map +1 -0
- package/dist/codex-plugins.js +240 -0
- package/dist/codex-plugins.js.map +1 -0
- package/dist/env.d.ts +2 -0
- package/dist/env.d.ts.map +1 -1
- package/dist/env.js +229 -39
- package/dist/env.js.map +1 -1
- package/dist/hook-contract.d.ts +41 -3
- package/dist/hook-contract.d.ts.map +1 -1
- package/dist/hook-contract.js +126 -18
- package/dist/hook-contract.js.map +1 -1
- package/dist/hook-pre-action.d.ts +48 -2
- package/dist/hook-pre-action.d.ts.map +1 -1
- package/dist/hook-pre-action.js +199 -23
- package/dist/hook-pre-action.js.map +1 -1
- package/dist/hook-tool-policy.d.ts +3 -3
- package/dist/hook-tool-policy.d.ts.map +1 -1
- package/dist/hook-tool-policy.js +6 -22
- package/dist/hook-tool-policy.js.map +1 -1
- package/dist/hook.d.ts +2 -2
- package/dist/hook.d.ts.map +1 -1
- package/dist/hook.js +13 -6
- package/dist/hook.js.map +1 -1
- package/dist/host-approval-state.d.ts +9 -0
- package/dist/host-approval-state.d.ts.map +1 -1
- package/dist/host-approval-state.js +4 -0
- package/dist/host-approval-state.js.map +1 -1
- package/dist/host-approval.d.ts +6 -0
- package/dist/host-approval.d.ts.map +1 -1
- package/dist/host-approval.js +3 -1
- package/dist/host-approval.js.map +1 -1
- package/dist/host-session.d.ts +11 -0
- package/dist/host-session.d.ts.map +1 -1
- package/dist/host-session.js +49 -0
- package/dist/host-session.js.map +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +27 -19
- package/dist/index.js.map +1 -1
- package/dist/normalized-action.d.ts +29 -6
- package/dist/normalized-action.d.ts.map +1 -1
- package/dist/normalized-action.js +497 -103
- package/dist/normalized-action.js.map +1 -1
- package/dist/own-server-identity.d.ts +123 -0
- package/dist/own-server-identity.d.ts.map +1 -0
- package/dist/own-server-identity.js +1052 -0
- package/dist/own-server-identity.js.map +1 -0
- package/dist/own-tool.d.ts +87 -0
- package/dist/own-tool.d.ts.map +1 -0
- package/dist/own-tool.js +169 -0
- package/dist/own-tool.js.map +1 -0
- package/dist/redact.d.ts +23 -0
- package/dist/redact.d.ts.map +1 -1
- package/dist/redact.js +181 -8
- package/dist/redact.js.map +1 -1
- package/dist/seatbelt/classifier-pin.d.ts +15 -0
- package/dist/seatbelt/classifier-pin.d.ts.map +1 -0
- package/dist/seatbelt/classifier-pin.js +26 -0
- package/dist/seatbelt/classifier-pin.js.map +1 -0
- package/dist/seatbelt/guards.d.ts +10 -0
- package/dist/seatbelt/guards.d.ts.map +1 -0
- package/dist/seatbelt/guards.js +509 -0
- package/dist/seatbelt/guards.js.map +1 -0
- package/dist/seatbelt/hook.d.ts +72 -0
- package/dist/seatbelt/hook.d.ts.map +1 -0
- package/dist/seatbelt/hook.js +362 -0
- package/dist/seatbelt/hook.js.map +1 -0
- package/dist/seatbelt/longopts.d.ts +68 -0
- package/dist/seatbelt/longopts.d.ts.map +1 -0
- package/dist/seatbelt/longopts.js +377 -0
- package/dist/seatbelt/longopts.js.map +1 -0
- package/dist/seatbelt/mapper.d.ts +83 -0
- package/dist/seatbelt/mapper.d.ts.map +1 -0
- package/dist/seatbelt/mapper.js +10248 -0
- package/dist/seatbelt/mapper.js.map +1 -0
- package/dist/seatbelt/record.d.ts +94 -0
- package/dist/seatbelt/record.d.ts.map +1 -0
- package/dist/seatbelt/record.js +776 -0
- package/dist/seatbelt/record.js.map +1 -0
- package/dist/seatbelt/tables.d.ts +82 -0
- package/dist/seatbelt/tables.d.ts.map +1 -0
- package/dist/seatbelt/tables.js +359 -0
- package/dist/seatbelt/tables.js.map +1 -0
- package/dist/seatbelt-deploy.d.ts +100 -0
- package/dist/seatbelt-deploy.d.ts.map +1 -0
- package/dist/seatbelt-deploy.js +393 -0
- package/dist/seatbelt-deploy.js.map +1 -0
- package/dist/seatbelt-fs.d.ts +30 -0
- package/dist/seatbelt-fs.d.ts.map +1 -0
- package/dist/seatbelt-fs.js +94 -0
- package/dist/seatbelt-fs.js.map +1 -0
- package/dist/seatbelt-git.d.ts +212 -0
- package/dist/seatbelt-git.d.ts.map +1 -0
- package/dist/seatbelt-git.js +844 -0
- package/dist/seatbelt-git.js.map +1 -0
- package/dist/seatbelt-mode.d.ts +77 -0
- package/dist/seatbelt-mode.d.ts.map +1 -0
- package/dist/seatbelt-mode.js +496 -0
- package/dist/seatbelt-mode.js.map +1 -0
- package/dist/seatbelt-path.d.ts +123 -0
- package/dist/seatbelt-path.d.ts.map +1 -0
- package/dist/seatbelt-path.js +482 -0
- package/dist/seatbelt-path.js.map +1 -0
- package/dist/seatbelt-scripts.d.ts +109 -0
- package/dist/seatbelt-scripts.d.ts.map +1 -0
- package/dist/seatbelt-scripts.js +1060 -0
- package/dist/seatbelt-scripts.js.map +1 -0
- package/dist/tool-catalog.d.ts +6852 -0
- package/dist/tool-catalog.d.ts.map +1 -0
- package/dist/tool-catalog.js +999 -0
- package/dist/tool-catalog.js.map +1 -0
- package/dist/types.d.ts +2 -1
- package/dist/types.d.ts.map +1 -1
- package/package.json +2 -1
- package/server.json +10 -3
- package/vendor/classifier/MANIFEST.json +25 -0
- package/vendor/classifier/classifier.js +1356 -0
- package/vendor/classifier/policy-baseline.js +187 -0
- package/vendor/classifier/redact.js +59 -0
- package/vendor/classifier/shell-parse.js +455 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"seatbelt-git.js","sourceRoot":"","sources":["../src/seatbelt-git.ts"],"names":[],"mappings":";;;AA8BA,0CAMC;AAwBD,gDA8BC;AAwDD,wCAaC;AAGD,4CAGC;AAuBD,0CA6BC;AAuID,sCAgDC;AAQD,oDAIC;AAGD,0CAGC;AAgBD,0CA2BC;AA4BD,gDAoDC;AAoBD,4CAkGC;AAmBD,0DAWC;AAID,kCAOC;AAGD,0DAOC;AAKD,8CAQC;AAcD,gDA4BC;AAsBD,kDA4CC;AA9zBD,mDAA2C;AAE3C,2EAA2E;AAC3E,yEAAyE;AACzE,2EAA2E;AAC3E,+EAA+E;AAC/E,oEAAoE;AAEvD,QAAA,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,QAAA,iBAAiB,GAAG,EAAE,CAAC;AACvB,QAAA,eAAe,GAAG,EAAE,CAAC;AAClC,iGAAiG;AACpF,QAAA,eAAe,GAAG,GAAG,CAAC;AACtB,QAAA,gBAAgB,GAAG,EAAE,CAAC;AAenC,6GAA6G;AAC7G,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;IAC7C,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AACnH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,GAAG,CAAC,MAAM,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,CAAC;YAAE,MAAM;QACjD,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9E,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,kEAAkE;AAClE,SAAgB,kBAAkB,CAAC,IAAY,EAAE,MAAc;IAC7D,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,gEAAgE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3F,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;iBAC/F,CAAC;gBACJ,qEAAqE;gBACrE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC9B,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACtH,CAAC;YACD,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;QACtE,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,IAAI,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AASD,SAAS,SAAS,CAAC,EAAc,EAAE,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,EAAE,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC7E,OAAO,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,4BAAoB,CAAC,CAAC;QACrD,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAW;IACxC,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtD,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACU,QAAA,kBAAkB,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,yBAAyB,EAAE,iCAAiC,EAAE,eAAe,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,kCAAkC,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAEnR;;;;GAIG;AACU,QAAA,YAAY,GAAG,CAAC,SAAS,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE,mBAAmB,EAAE,eAAe,CAAC,CAAC;AACnO,MAAM,eAAe,GAAG,sYAAsY,CAAC;AAE/Z;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,MAAiB,EAAE,GAAwC;IACxF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,oBAAY;QAAE,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/C,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7E,kFAAkF;QAClF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;;YAClD,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,2EAA2E;AAC3E,SAAgB,gBAAgB,CAAC,GAAmD;IAClF,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,0BAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;AACtE,CAAC;AAED,oGAAoG;AACpG,SAAS,cAAc,CAAC,EAAc,EAAE,GAAW;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACpC,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7E,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,EAAc,EAAE,GAAW,EAAE,GAAwC;IACnG,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;IACpB,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC;QACrD,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,EAAE,IAAI,KAAK,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QACzF,IAAI,KAAK,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC9C,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QACxD,CAAC;QACD,IAAI,KAAK;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACzC,IAAI,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAClE,IAAI,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC7B,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,EAAc,EAAE,MAAc;IACjD,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACzG,CAAC;AAmBD,MAAM,oBAAoB,GAAG,CAAC,gBAAgB,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,kEAAkE,CAAC,CAAC;AAE/K,mGAAmG;AACnG,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,EAAE,GAAG,sDAAsD,CAAC;IAClE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM;QAC1C,EAAE,CAAC,SAAS,GAAG,KAAK,CAAC;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACtD,CAAC;YACJ,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,EAAc,EAAE,IAAmB;IAC7D,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAE9C,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,IAAY,EAAiB,EAAE;QACtE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,IAAsB,EAAE,IAAmB,EAAE,KAAa,EAAE,EAAE;QAChF,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC3C,IAAI,KAAK,IAAI,yBAAiB,EAAE,CAAC;gBAC/B,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,8GAA8G;YAC9G,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI;gBAC1B,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9H,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE;QAC9C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;YACxB,OAAO;QACT,CAAC;QACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACjB,IAAI,KAAK,CAAC,KAAK,GAAG,wBAAgB,EAAE,CAAC;YACnC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;YACxB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QACrC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;YACxB,OAAO;QACT,CAAC;QACD,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACjD,CAAC;AAED,sGAAsG;AACtG,SAAS,kBAAkB,CAAC,GAAuC;IACjE,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,KAAK,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,GAAG,GAAG,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;gBAAE,UAAU,GAAG,IAAI,CAAC;;gBAC3D,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAChE,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;;YAC7B,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,EAAc,EAAE,OAAyB;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAEvD,0EAA0E;IAC1E,2EAA2E;IAC3E,8BAA8B;IAC9B,MAAM,UAAU,GAAG,CAAC,KAAyB,EAAE,EAAE;QAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO;QAChD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;;YAC/C,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC;IACF,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;IAC9D,2FAA2F;IAC3F,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,IAAI,oBAAoB;QAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjF,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAClC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,IAAI,qBAAqB,EAAE,CAAC,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;IAC1B,CAAC;IACD,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAChD,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YACzD,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,GAAG,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;QACpE,IAAI,GAAG,CAAC,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;;YACxG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;IAC/B,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAClC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,UAAU;QAAE,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9G,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB,CAAC,MAAiB,EAAE,UAAyB;IAC/E,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACpH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;AACpD,CAAC;AAED,iFAAiF;AACjF,SAAgB,eAAe,CAAC,MAAiB,EAAE,GAAW;IAC5D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACU,QAAA,iBAAiB,GAAG,IAAI,GAAG,CAAC,ouCAAouC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1xC;;;;GAIG;AACU,QAAA,kBAAkB,GAAG,IAAI,GAAG,CAAC,qfAAqf,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAE5iB,kIAAkI;AAClI,SAAgB,eAAe,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;iBAC1B,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;gBAAE,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;;gBAC7E,IAAI,IAAI,EAAE,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAClB,IAAI,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,GAAG,EAAE,CAAC;YACV,MAAM,GAAG,KAAK,CAAC;YACf,SAAS;QACX,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,GAAG,EAAE,CAAC;aACpC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;YAAE,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;;YAC5D,IAAI,IAAI,EAAE,CAAC;IAClB,CAAC;IACD,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAsBD,kHAAkH;AAClH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE9G,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE9O,yGAAyG;AACzG,SAAgB,kBAAkB,CAAC,IAAc;IAC/C,MAAM,GAAG,GAAkB,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzI,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE;QAChC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG;YAAE,MAAM;QAC/C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,CAAC,IAAI,CAAC,CAAC;YACP,MAAM;QACR,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,gBAAgB,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YACpN,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;;oBACxC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClC,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACxF,CAAC;iBAAM,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;gBAClC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC9B,IAAI,EAAE,GAAG,CAAC;oBAAE,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;oBACpC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACrE,CAAC;iBAAM,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa;gBAAE,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;gBAChG,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,mGAAmG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7H,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,aAAa;gBAAE,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;iBACzF,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,EAAE,GAAG,CAAC;oBAAE,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;oBACpC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,CAAC;;gBAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;aACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9D,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,SAAgB,gBAAgB,CAAC,IAAc,EAAE,OAA+G;IAC9J,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAiD,IAAI,CAAC;IAChE,MAAM,UAAU,GAAG,CAAC,MAA6G,EAAE,EAAE;QACnI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACnH,CAAC,CAAC;IACF,4HAA4H;IAC5H,MAAM,cAAc,GAAG,CAAC,KAA8B,EAA2D,EAAE;QACjH,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAC7C,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,SAAS;YAC3C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,UAAU,GAAG,IAAI,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,GAAG,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU;YAAE,UAAU,GAAG,IAAI,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACzC,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,UAAyB,EAAE,SAAkC,EAAE,IAAc,EAAE,KAAa,EAAE,EAAE;QAC5G,KAAK,IAAI,CAAC,CAAC;QACX,IAAI,KAAK,GAAG,uBAAe,EAAE,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAA4B,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACzB,CAAC;QACD,0GAA0G;QAC1G,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,QAAQ,CAAC,UAAU;YAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC;QAChC,MAAM,KAAK,GAA4B,CAAC,GAAG,SAAS,EAAE,GAAG,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAkB,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC;QACnC,2EAA2E;QAC3E,+EAA+E;QAC/E,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QAC9I,IAAI,IAAI,KAAK,IAAI,IAAI,yBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,IAAI,0BAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QACpF,IAAI,KAAK,IAAI,uBAAe,EAAE,CAAC;YAC7B,UAAU,CAAC,UAAU,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,UAAU,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,OAAO,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG;YAClB,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;YAC3F,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;SACpF,CAAC;QACF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,0BAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5I,OAAO;QACT,CAAC;QACD,yFAAyF;QACzF,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU;YAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAC/D,KAAK,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9C,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrF,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBACtD,SAAS;YACX,CAAC;YACD,yEAAyE;YACzE,IAAI,CAAC,kBAAkB,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC;IACF,6GAA6G;IAC7G,6FAA6F;IAC7F,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,UAAU;QAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,WAAW,CAAC,UAAU;QAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAC5D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAChF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACU,QAAA,sBAAsB,GAAG,CAAC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAEtH,4EAA4E;AAC/D,QAAA,qBAAqB,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC/W,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvS;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,GAAW,EAAE,UAAoB,6BAAqB,EAAE,YAAyB,kBAAkB;IACzI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,IAAI,OAAO,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,IAAI;QAAE,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;IAC1I,sDAAsD;IACtD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,MAAM,MAAM,IAAI,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;IAC5G,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAID,SAAgB,WAAW,CAAC,EAAc,EAAE,IAAa;IACvD,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC5E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAED,gHAAgH;AAChH,SAAgB,uBAAuB,CAAC,EAAc,EAAE,IAAa,EAAE,MAAc;IACnF,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACjF,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,iBAAiB,MAAM,OAAO,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,yBAAyB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACrH,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAEY,QAAA,2BAA2B,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAEnM,4FAA4F;AAC5F,SAAgB,iBAAiB,CAAC,MAAqB,EAAE,QAAkB,EAAE;IAC3E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,GAAG,mCAA2B,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACjE,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAChC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACL,CAAC;AAWD,MAAM,oBAAoB,GAAG,uCAAuC,CAAC;AAErE,oFAAoF;AACpF,SAAgB,kBAAkB,CAAC,OAAe,EAAE,IAAa;IAC/D,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAChF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;IACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACpF,sEAAsE;IACtE,+EAA+E;IAC/E,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAiB,EAAE;QAC1C,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,IAAI,uDAAuD,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnF,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,6CAA6C,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3G,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC/F,CAAC;AAiBD;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,MAAiB,EAAE,IAAa,EAAE,MAAqB;IACzF,MAAM,GAAG,GAAwB,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC9I,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,MAAM;QAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;SAChC,CAAC;QACJ,MAAM,UAAU,GAAG,OAAO;YACxB,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,UAAU,OAAO,aAAa,CAAC,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,UAAU,OAAO,SAAS,CAAC,CAAC;YACxK,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;QACjH,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACnD,IAAI,QAAQ,CAAC,KAAK;gBAAE,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC;YAC/C,IAAI,QAAQ,CAAC,GAAG;gBAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC;iBAC5B,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI;gBAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;;gBACtD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACrB,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;YACnB,SAAS;QACX,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC3D,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,MAAM,EAAE,UAAU,OAAO,QAAQ,CAAC,EAAE,CAAC;gBACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBACpG,IAAI,QAAQ;oBAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;oBACrC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;YAC1B,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IACjD,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC;AACb,CAAC"}
|
|
@@ -0,0 +1,77 @@
|
|
|
1
|
+
import { type SeatbeltFs } from './seatbelt-fs';
|
|
2
|
+
export type SeatbeltMode = 'seatbelt' | 'account' | 'claimed_no_key';
|
|
3
|
+
export declare const ACCOUNT_EVIDENCE: readonly ["env_file", "env_local_file", "device_binding", "claimed_marker", "host_approvals_state", "mcp_spool", "runner_holds_salt", "hook_claimed_marker", "marrow_dir", "evidence_dirs"];
|
|
4
|
+
export type AccountEvidence = typeof ACCOUNT_EVIDENCE[number];
|
|
5
|
+
export type EvidenceState = 'present' | 'absent' | 'unknown';
|
|
6
|
+
export type KeyState = 'none' | 'present' | 'rejected';
|
|
7
|
+
export interface SeatbeltModeInput {
|
|
8
|
+
fs: SeatbeltFs;
|
|
9
|
+
/** The home directory from passwd (getpwuid), never $HOME. */
|
|
10
|
+
passwdHome: string | null;
|
|
11
|
+
/** This hook process's argv: `--home <abs>` / `--home=<abs>` and the installer's `--claimed` marker. */
|
|
12
|
+
argv: string[];
|
|
13
|
+
/** Trusted key state: from the owner files or the hook's own environment; 'rejected' after a 401. */
|
|
14
|
+
key: KeyState;
|
|
15
|
+
uid?: number | null;
|
|
16
|
+
/** MARROW_SEATBELT_STRICT=1: never seatbelt. */
|
|
17
|
+
strict?: boolean;
|
|
18
|
+
/**
|
|
19
|
+
* Homes named only by the environment ($HOME, USERPROFILE): today's writers
|
|
20
|
+
* (src/env.ts, host-approval-state, lifecycle-spool, grok hooks) put keys
|
|
21
|
+
* and state there. Probed for evidence only; one that is not a trusted home
|
|
22
|
+
* gives `home_mismatch`. Never used for keys or later reads.
|
|
23
|
+
*/
|
|
24
|
+
envHomes?: string[];
|
|
25
|
+
/** Extra hook config files from env relocation (CODEX_HOME, CLAUDE_CONFIG_DIR ...). Additive; a relative path is unknown. */
|
|
26
|
+
extraHookConfigs?: string[];
|
|
27
|
+
/** Extra hook script directories (CLINE_DIR ...). Additive; a relative path is unknown. */
|
|
28
|
+
extraHookDirs?: string[];
|
|
29
|
+
/**
|
|
30
|
+
* The owner's private group id (privateGroupId), read only when a group-writable evidence dir is
|
|
31
|
+
* met. Absent or null: group write is refused (the U4 rule).
|
|
32
|
+
*/
|
|
33
|
+
privateGid?: (() => number | null) | number | null;
|
|
34
|
+
}
|
|
35
|
+
export interface SeatbeltModeResolution {
|
|
36
|
+
mode: SeatbeltMode;
|
|
37
|
+
homes: string[];
|
|
38
|
+
evidence: Record<AccountEvidence, EvidenceState>;
|
|
39
|
+
/** Fixed reason codes, no paths or values. */
|
|
40
|
+
reasons: string[];
|
|
41
|
+
}
|
|
42
|
+
/** Harness hook configs (user level) that carry the installer's `--claimed` marker after a claim. */
|
|
43
|
+
export declare const HOOK_CONFIG_FILES: string[];
|
|
44
|
+
/**
|
|
45
|
+
* Hook script directories (Cline runs the executable scripts in its hooks
|
|
46
|
+
* directory). Every regular file in them is scanned for the marker. U8 must
|
|
47
|
+
* publish the exact paths it writes; any path it adds must be added here.
|
|
48
|
+
*/
|
|
49
|
+
export declare const HOOK_CONFIG_DIRS: string[];
|
|
50
|
+
/** Every `--home` value in the hook's argv (repeated flags are all kept: a mismatch is contradictory). */
|
|
51
|
+
export declare function homeFlags(argv: string[]): string[];
|
|
52
|
+
/**
|
|
53
|
+
* The owner's private group (Debian OpenSSH "user-group-modes"), read from the local files only:
|
|
54
|
+
* uid has exactly one local passwd entry, no other passwd entry has its primary gid, and that gid
|
|
55
|
+
* has exactly one local group entry whose member list names nobody but the owner. Anything else,
|
|
56
|
+
* including an unreadable file, a network name service (users there cannot be listed) or root,
|
|
57
|
+
* gives null: group write then stays refused, as before.
|
|
58
|
+
*/
|
|
59
|
+
export declare function privateGroupId(fs: SeatbeltFs, uid: number | null): number | null;
|
|
60
|
+
export declare function resolveSeatbeltMode(input: SeatbeltModeInput): SeatbeltModeResolution;
|
|
61
|
+
export declare const MODE_ENV_NAMES: string[];
|
|
62
|
+
/**
|
|
63
|
+
* Host wiring for the hook (U5 calls this). The key comes only from the hook's
|
|
64
|
+
* environment or the owner files in a trusted home (never repo .env files);
|
|
65
|
+
* keyRejected is set after the server answers 401.
|
|
66
|
+
*/
|
|
67
|
+
export declare function resolveSeatbeltModeOnHost(options?: {
|
|
68
|
+
argv?: string[];
|
|
69
|
+
env?: NodeJS.ProcessEnv;
|
|
70
|
+
fs?: SeatbeltFs;
|
|
71
|
+
passwdHome?: string | null;
|
|
72
|
+
uid?: number | null;
|
|
73
|
+
keyRejected?: boolean;
|
|
74
|
+
/** Tests: the private group answer; default reads the local account files (Linux only). */
|
|
75
|
+
privateGid?: (() => number | null) | number | null;
|
|
76
|
+
}): SeatbeltModeResolution;
|
|
77
|
+
//# sourceMappingURL=seatbelt-mode.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"seatbelt-mode.d.ts","sourceRoot":"","sources":["../src/seatbelt-mode.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAmBhE,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAErE,eAAO,MAAM,gBAAgB,6LAYnB,CAAC;AACX,MAAM,MAAM,eAAe,GAAG,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;AAEvD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,UAAU,CAAC;IACf,8DAA8D;IAC9D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,wGAAwG;IACxG,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qGAAqG;IACrG,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,gDAAgD;IAChD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,6HAA6H;IAC7H,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,2FAA2F;IAC3F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IACjD,8CAA8C;IAC9C,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,qGAAqG;AACrG,eAAO,MAAM,iBAAiB,UAS7B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,UAA4C,CAAC;AAS1E,0GAA0G;AAC1G,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAUlD;AA0ID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAoBhF;AAuDD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,sBAAsB,CAsFpF;AAaD,eAAO,MAAM,cAAc,UAAiI,CAAC;AAW7J;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAE;IACjD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,EAAE,CAAC,EAAE,UAAU,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2FAA2F;IAC3F,UAAU,CAAC,EAAE,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;CAC/C,GAAG,sBAAsB,CA6C9B"}
|
|
@@ -0,0 +1,496 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.MODE_ENV_NAMES = exports.HOOK_CONFIG_DIRS = exports.HOOK_CONFIG_FILES = exports.ACCOUNT_EVIDENCE = void 0;
|
|
4
|
+
exports.homeFlags = homeFlags;
|
|
5
|
+
exports.privateGroupId = privateGroupId;
|
|
6
|
+
exports.resolveSeatbeltMode = resolveSeatbeltMode;
|
|
7
|
+
exports.resolveSeatbeltModeOnHost = resolveSeatbeltModeOnHost;
|
|
8
|
+
const node_os_1 = require("node:os");
|
|
9
|
+
const env_1 = require("./env");
|
|
10
|
+
const seatbelt_fs_1 = require("./seatbelt-fs");
|
|
11
|
+
const seatbelt_path_1 = require("./seatbelt-path");
|
|
12
|
+
exports.ACCOUNT_EVIDENCE = [
|
|
13
|
+
'env_file',
|
|
14
|
+
'env_local_file',
|
|
15
|
+
'device_binding',
|
|
16
|
+
'claimed_marker',
|
|
17
|
+
'host_approvals_state',
|
|
18
|
+
'mcp_spool',
|
|
19
|
+
'runner_holds_salt',
|
|
20
|
+
'hook_claimed_marker',
|
|
21
|
+
'marrow_dir',
|
|
22
|
+
/** The home and every directory holding evidence: owned by this user and not group/world-writable. Never 'present'. */
|
|
23
|
+
'evidence_dirs',
|
|
24
|
+
];
|
|
25
|
+
/** Harness hook configs (user level) that carry the installer's `--claimed` marker after a claim. */
|
|
26
|
+
exports.HOOK_CONFIG_FILES = [
|
|
27
|
+
'.claude/settings.json',
|
|
28
|
+
'.codex/hooks.json',
|
|
29
|
+
'.cursor/hooks.json',
|
|
30
|
+
'.gemini/settings.json',
|
|
31
|
+
'.codeium/windsurf/hooks.json',
|
|
32
|
+
'.grok/hooks/marrow.json',
|
|
33
|
+
'.claude/settings.local.json',
|
|
34
|
+
'.codex/config.toml',
|
|
35
|
+
];
|
|
36
|
+
/**
|
|
37
|
+
* Hook script directories (Cline runs the executable scripts in its hooks
|
|
38
|
+
* directory). Every regular file in them is scanned for the marker. U8 must
|
|
39
|
+
* publish the exact paths it writes; any path it adds must be added here.
|
|
40
|
+
*/
|
|
41
|
+
exports.HOOK_CONFIG_DIRS = ['Documents/Cline/Hooks', '.cline/hooks'];
|
|
42
|
+
const MAX_HOOK_DIR_ENTRIES = 64;
|
|
43
|
+
/** Directories under a home whose owner and mode are checked (others could delete evidence in them). */
|
|
44
|
+
const EVIDENCE_DIRS = ['.marrow/device', '.marrow/host-approvals', '.marrow/spool', '.marrow/runner-holds', '.claude', '.codex', '.cursor', '.gemini', '.codeium', '.codeium/windsurf', '.grok', '.grok/hooks', 'Documents', 'Documents/Cline', ...exports.HOOK_CONFIG_DIRS, '.cline'];
|
|
45
|
+
const MAX_HOOK_CONFIG_BYTES = 1024 * 1024;
|
|
46
|
+
const CLAIMED_TOKEN = /(?:^|[\s"'\\])--claimed(?:$|[\s"'=\\])/;
|
|
47
|
+
/** Every `--home` value in the hook's argv (repeated flags are all kept: a mismatch is contradictory). */
|
|
48
|
+
function homeFlags(argv) {
|
|
49
|
+
const out = [];
|
|
50
|
+
for (let i = 0; i < argv.length; i += 1) {
|
|
51
|
+
const arg = argv[i];
|
|
52
|
+
if (arg === '--home') {
|
|
53
|
+
out.push(argv[i + 1] ?? '');
|
|
54
|
+
i += 1;
|
|
55
|
+
}
|
|
56
|
+
else if (arg.startsWith('--home='))
|
|
57
|
+
out.push(arg.slice('--home='.length));
|
|
58
|
+
}
|
|
59
|
+
return out;
|
|
60
|
+
}
|
|
61
|
+
function argvClaimed(argv) {
|
|
62
|
+
return argv.some((arg) => arg === '--claimed' || arg.startsWith('--claimed='));
|
|
63
|
+
}
|
|
64
|
+
function exists(fs, path) {
|
|
65
|
+
try {
|
|
66
|
+
return fs.lstat(path) ? 'present' : 'absent';
|
|
67
|
+
}
|
|
68
|
+
catch {
|
|
69
|
+
return 'unknown';
|
|
70
|
+
}
|
|
71
|
+
}
|
|
72
|
+
function worst(a, b) {
|
|
73
|
+
if (a === 'present' || b === 'present')
|
|
74
|
+
return 'present';
|
|
75
|
+
if (a === 'unknown' || b === 'unknown')
|
|
76
|
+
return 'unknown';
|
|
77
|
+
return 'absent';
|
|
78
|
+
}
|
|
79
|
+
function probeSpool(fs, dir) {
|
|
80
|
+
try {
|
|
81
|
+
const entry = fs.lstat(dir);
|
|
82
|
+
if (!entry)
|
|
83
|
+
return 'absent';
|
|
84
|
+
if (entry.type !== 'dir')
|
|
85
|
+
return 'unknown';
|
|
86
|
+
return fs.readdir(dir).some((name) => /^mcp-.*\.json$/i.test(name)) ? 'present' : 'absent';
|
|
87
|
+
}
|
|
88
|
+
catch {
|
|
89
|
+
return 'unknown';
|
|
90
|
+
}
|
|
91
|
+
}
|
|
92
|
+
function probeHookConfig(fs, path, skipNonFiles = false) {
|
|
93
|
+
try {
|
|
94
|
+
const entry = fs.lstat(path);
|
|
95
|
+
if (!entry)
|
|
96
|
+
return 'absent';
|
|
97
|
+
if (skipNonFiles && entry.type === 'dir')
|
|
98
|
+
return 'absent';
|
|
99
|
+
let target = path;
|
|
100
|
+
if (entry.type === 'symlink') {
|
|
101
|
+
const real = (0, seatbelt_path_1.realPath)(fs, path, { followFinal: true });
|
|
102
|
+
if (real.status !== 'resolved' || !real.exists)
|
|
103
|
+
return 'unknown';
|
|
104
|
+
target = real.path;
|
|
105
|
+
}
|
|
106
|
+
const text = fs.readFile(target, MAX_HOOK_CONFIG_BYTES);
|
|
107
|
+
if (text === null)
|
|
108
|
+
return 'unknown';
|
|
109
|
+
return CLAIMED_TOKEN.test(text) ? 'present' : 'absent';
|
|
110
|
+
}
|
|
111
|
+
catch {
|
|
112
|
+
return 'unknown';
|
|
113
|
+
}
|
|
114
|
+
}
|
|
115
|
+
function probeHookDir(fs, dir) {
|
|
116
|
+
try {
|
|
117
|
+
const real = (0, seatbelt_path_1.realPath)(fs, dir, { followFinal: true });
|
|
118
|
+
if (real.status !== 'resolved')
|
|
119
|
+
return 'unknown';
|
|
120
|
+
if (!real.exists)
|
|
121
|
+
return 'absent';
|
|
122
|
+
const entry = fs.lstat(real.path);
|
|
123
|
+
if (!entry)
|
|
124
|
+
return 'absent';
|
|
125
|
+
if (entry.type !== 'dir')
|
|
126
|
+
return 'unknown';
|
|
127
|
+
const names = fs.readdir(real.path);
|
|
128
|
+
if (names.length > MAX_HOOK_DIR_ENTRIES)
|
|
129
|
+
return 'unknown';
|
|
130
|
+
let state = 'absent';
|
|
131
|
+
for (const name of names)
|
|
132
|
+
state = worst(state, probeHookConfig(fs, `${real.path}/${name}`, true));
|
|
133
|
+
return state;
|
|
134
|
+
}
|
|
135
|
+
catch {
|
|
136
|
+
return 'unknown';
|
|
137
|
+
}
|
|
138
|
+
}
|
|
139
|
+
/**
|
|
140
|
+
* A directory that holds evidence: absent is fine; otherwise its real target must be a dir owned by
|
|
141
|
+
* uid and not world-writable. Group write is refused too, except (Debian OpenSSH "user-group-modes",
|
|
142
|
+
* the umask 002 default of user-private-group systems) when the directory was reached without any
|
|
143
|
+
* symlink and its group is the owner's private group (privateGroupId below): then nobody but the
|
|
144
|
+
* owner can write it, exactly as with 0755. uid, gid and mode come from one lstat of that inode.
|
|
145
|
+
*/
|
|
146
|
+
function probeTrustedDir(fs, dir, uid, privateGid) {
|
|
147
|
+
try {
|
|
148
|
+
const real = (0, seatbelt_path_1.realPath)(fs, dir, { followFinal: true });
|
|
149
|
+
if (real.status !== 'resolved')
|
|
150
|
+
return 'unknown';
|
|
151
|
+
if (!real.exists)
|
|
152
|
+
return 'absent';
|
|
153
|
+
const entry = fs.lstat(real.path);
|
|
154
|
+
if (!entry)
|
|
155
|
+
return 'absent';
|
|
156
|
+
if (entry.type !== 'dir')
|
|
157
|
+
return 'unknown';
|
|
158
|
+
if (uid !== null && entry.uid !== uid)
|
|
159
|
+
return 'unknown';
|
|
160
|
+
if ((entry.mode & 0o002) !== 0)
|
|
161
|
+
return 'unknown';
|
|
162
|
+
if ((entry.mode & 0o020) !== 0) {
|
|
163
|
+
if (uid === null || real.path !== dir || typeof entry.gid !== 'number')
|
|
164
|
+
return 'unknown';
|
|
165
|
+
const gid = privateGid();
|
|
166
|
+
if (gid === null || entry.gid !== gid)
|
|
167
|
+
return 'unknown';
|
|
168
|
+
}
|
|
169
|
+
return 'absent';
|
|
170
|
+
}
|
|
171
|
+
catch {
|
|
172
|
+
return 'unknown';
|
|
173
|
+
}
|
|
174
|
+
}
|
|
175
|
+
const ACCOUNT_DB_MAX_BYTES = 4 * 1024 * 1024;
|
|
176
|
+
/** Name-service sources whose users and groups are all in the local files read below. */
|
|
177
|
+
const LOCAL_NSS_SOURCES = new Set(['files', 'compat', 'systemd']);
|
|
178
|
+
/** A root-owned, not group/world-writable regular file (no final symlink), or null. */
|
|
179
|
+
function readSystemFile(fs, path) {
|
|
180
|
+
try {
|
|
181
|
+
const entry = fs.lstat(path);
|
|
182
|
+
if (!entry || entry.type !== 'file' || entry.uid !== 0 || (entry.mode & 0o022) !== 0)
|
|
183
|
+
return null;
|
|
184
|
+
return fs.readFile(path, ACCOUNT_DB_MAX_BYTES);
|
|
185
|
+
}
|
|
186
|
+
catch {
|
|
187
|
+
return null;
|
|
188
|
+
}
|
|
189
|
+
}
|
|
190
|
+
/** Every passwd and group source in nsswitch.conf is local (no ldap, sss, nis, winbind ...); both lines must be present. */
|
|
191
|
+
function localNameServiceOnly(text) {
|
|
192
|
+
const seen = new Set();
|
|
193
|
+
for (const raw of text.split('\n')) {
|
|
194
|
+
const line = raw.replace(/#.*/, '').trim();
|
|
195
|
+
const match = /^(passwd|group)\s*:(.*)$/i.exec(line);
|
|
196
|
+
if (!match)
|
|
197
|
+
continue;
|
|
198
|
+
seen.add(match[1].toLowerCase());
|
|
199
|
+
const sources = match[2].replace(/\[[^\]]*\]/g, ' ').trim().split(/\s+/).filter(Boolean);
|
|
200
|
+
if (sources.length === 0 || sources.some((source) => !LOCAL_NSS_SOURCES.has(source.toLowerCase())))
|
|
201
|
+
return false;
|
|
202
|
+
}
|
|
203
|
+
return seen.has('passwd') && seen.has('group');
|
|
204
|
+
}
|
|
205
|
+
/** Colon records of a local account file; null when any line is not a plain record of exactly `fields` fields (NIS +/- lines, comments). */
|
|
206
|
+
function records(text, fields) {
|
|
207
|
+
const out = [];
|
|
208
|
+
for (const raw of text.split('\n')) {
|
|
209
|
+
const line = raw.replace(/\r$/, '');
|
|
210
|
+
if (line.trim() === '')
|
|
211
|
+
continue;
|
|
212
|
+
const parts = line.split(':');
|
|
213
|
+
if (parts.length !== fields || /^[+\-#]/.test(line) || !/^\d+$/.test(parts[2]) || (fields === 7 && !/^\d+$/.test(parts[3])))
|
|
214
|
+
return null;
|
|
215
|
+
out.push(parts);
|
|
216
|
+
}
|
|
217
|
+
return out;
|
|
218
|
+
}
|
|
219
|
+
/**
|
|
220
|
+
* The owner's private group (Debian OpenSSH "user-group-modes"), read from the local files only:
|
|
221
|
+
* uid has exactly one local passwd entry, no other passwd entry has its primary gid, and that gid
|
|
222
|
+
* has exactly one local group entry whose member list names nobody but the owner. Anything else,
|
|
223
|
+
* including an unreadable file, a network name service (users there cannot be listed) or root,
|
|
224
|
+
* gives null: group write then stays refused, as before.
|
|
225
|
+
*/
|
|
226
|
+
function privateGroupId(fs, uid) {
|
|
227
|
+
if (uid === null || !Number.isInteger(uid) || uid <= 0)
|
|
228
|
+
return null;
|
|
229
|
+
const nss = readSystemFile(fs, '/etc/nsswitch.conf');
|
|
230
|
+
if (nss === null || !localNameServiceOnly(nss))
|
|
231
|
+
return null;
|
|
232
|
+
const passwdText = readSystemFile(fs, '/etc/passwd');
|
|
233
|
+
const groupText = readSystemFile(fs, '/etc/group');
|
|
234
|
+
if (passwdText === null || groupText === null)
|
|
235
|
+
return null;
|
|
236
|
+
const passwd = records(passwdText, 7);
|
|
237
|
+
const group = records(groupText, 4);
|
|
238
|
+
if (passwd === null || group === null)
|
|
239
|
+
return null;
|
|
240
|
+
const own = passwd.filter((entry) => Number(entry[2]) === uid);
|
|
241
|
+
if (own.length !== 1)
|
|
242
|
+
return null;
|
|
243
|
+
const name = own[0][0];
|
|
244
|
+
const gid = Number(own[0][3]);
|
|
245
|
+
if (!name || gid <= 0)
|
|
246
|
+
return null;
|
|
247
|
+
if (passwd.some((entry) => entry !== own[0] && Number(entry[3]) === gid))
|
|
248
|
+
return null;
|
|
249
|
+
const entries = group.filter((entry) => Number(entry[2]) === gid);
|
|
250
|
+
if (entries.length !== 1)
|
|
251
|
+
return null;
|
|
252
|
+
const members = entries[0][3].split(',').map((member) => member.trim()).filter(Boolean);
|
|
253
|
+
return members.every((member) => member === name) ? gid : null;
|
|
254
|
+
}
|
|
255
|
+
// ~/.marrow itself: absent and a plain directory owned by this user are both
|
|
256
|
+
// fine (keyless installs keep control.json there). A symlink, a file, another
|
|
257
|
+
// owner, group/world write or an unreadable entry cannot be reasoned about, so it is unknown.
|
|
258
|
+
function probeMarrowDir(fs, dir, uid) {
|
|
259
|
+
try {
|
|
260
|
+
const entry = fs.lstat(dir);
|
|
261
|
+
if (!entry)
|
|
262
|
+
return 'absent';
|
|
263
|
+
if (entry.type !== 'dir')
|
|
264
|
+
return 'unknown';
|
|
265
|
+
if (uid !== null && entry.uid !== uid)
|
|
266
|
+
return 'unknown';
|
|
267
|
+
// Others could delete evidence from a group/world-writable directory.
|
|
268
|
+
if ((entry.mode & 0o022) !== 0)
|
|
269
|
+
return 'unknown';
|
|
270
|
+
return 'absent';
|
|
271
|
+
}
|
|
272
|
+
catch {
|
|
273
|
+
return 'unknown';
|
|
274
|
+
}
|
|
275
|
+
}
|
|
276
|
+
function probeHome(fs, home, uid, privateGid) {
|
|
277
|
+
const marrow = `${home}/.marrow`;
|
|
278
|
+
let hooks = 'absent';
|
|
279
|
+
for (const file of exports.HOOK_CONFIG_FILES)
|
|
280
|
+
hooks = worst(hooks, probeHookConfig(fs, `${home}/${file}`));
|
|
281
|
+
for (const dir of exports.HOOK_CONFIG_DIRS)
|
|
282
|
+
hooks = worst(hooks, probeHookDir(fs, `${home}/${dir}`));
|
|
283
|
+
let dirs = probeTrustedDir(fs, home, uid, privateGid);
|
|
284
|
+
for (const dir of EVIDENCE_DIRS)
|
|
285
|
+
dirs = worst(dirs, probeTrustedDir(fs, `${home}/${dir}`, uid, privateGid));
|
|
286
|
+
return {
|
|
287
|
+
env_file: exists(fs, `${marrow}/env`),
|
|
288
|
+
env_local_file: exists(fs, `${marrow}/env.local`),
|
|
289
|
+
device_binding: exists(fs, `${marrow}/device/binding.json`),
|
|
290
|
+
claimed_marker: exists(fs, `${marrow}/claimed`),
|
|
291
|
+
// Spec: "has a protected_categories cache". Any state file counts: it is only
|
|
292
|
+
// ever written after talking to a server, and counting more is stricter.
|
|
293
|
+
host_approvals_state: exists(fs, `${marrow}/host-approvals/state.json`),
|
|
294
|
+
mcp_spool: probeSpool(fs, `${marrow}/spool`),
|
|
295
|
+
runner_holds_salt: exists(fs, `${marrow}/runner-holds/.salt`),
|
|
296
|
+
hook_claimed_marker: hooks,
|
|
297
|
+
marrow_dir: probeMarrowDir(fs, marrow, uid),
|
|
298
|
+
evidence_dirs: dirs === 'present' ? 'unknown' : dirs,
|
|
299
|
+
};
|
|
300
|
+
}
|
|
301
|
+
/** A usable home: absolute, no `.`/`..` parts, and an existing directory other than `/` after realpath. */
|
|
302
|
+
function trustedHome(fs, value) {
|
|
303
|
+
if (typeof value !== 'string' || !value.startsWith('/') || value.split('/').some((part) => part === '..' || part === '.'))
|
|
304
|
+
return null;
|
|
305
|
+
const real = (0, seatbelt_path_1.realPath)(fs, value, { followFinal: true });
|
|
306
|
+
// A service user's `/` home is shared with everything on the machine.
|
|
307
|
+
if (real.status !== 'resolved' || !real.exists || real.path === '/')
|
|
308
|
+
return null;
|
|
309
|
+
try {
|
|
310
|
+
return fs.lstat(real.path)?.type === 'dir' ? real.path : null;
|
|
311
|
+
}
|
|
312
|
+
catch {
|
|
313
|
+
return null;
|
|
314
|
+
}
|
|
315
|
+
}
|
|
316
|
+
function resolveSeatbeltMode(input) {
|
|
317
|
+
const reasons = [];
|
|
318
|
+
const uid = input.uid === undefined ? null : input.uid;
|
|
319
|
+
const evidence = Object.fromEntries(exports.ACCOUNT_EVIDENCE.map((id) => [id, 'absent']));
|
|
320
|
+
if (argvClaimed(input.argv))
|
|
321
|
+
evidence.hook_claimed_marker = 'present';
|
|
322
|
+
const flags = homeFlags(input.argv);
|
|
323
|
+
const candidates = [...flags, ...(input.passwdHome === null ? [] : [input.passwdHome])];
|
|
324
|
+
const homes = [];
|
|
325
|
+
let homeProblem = false;
|
|
326
|
+
if (input.passwdHome === null && flags.length === 0) {
|
|
327
|
+
homeProblem = true;
|
|
328
|
+
reasons.push('home_unknown');
|
|
329
|
+
}
|
|
330
|
+
for (const candidate of candidates) {
|
|
331
|
+
const home = trustedHome(input.fs, candidate);
|
|
332
|
+
if (home === null) {
|
|
333
|
+
homeProblem = true;
|
|
334
|
+
reasons.push('home_unusable');
|
|
335
|
+
continue;
|
|
336
|
+
}
|
|
337
|
+
if (!homes.includes(home))
|
|
338
|
+
homes.push(home);
|
|
339
|
+
}
|
|
340
|
+
if (homes.length > 1) {
|
|
341
|
+
homeProblem = true;
|
|
342
|
+
reasons.push('home_mismatch');
|
|
343
|
+
}
|
|
344
|
+
// Env homes ($HOME ...) only tighten: probed for evidence, and one that is
|
|
345
|
+
// not a trusted home is a contradiction. They never join `homes`.
|
|
346
|
+
const probeHomes = [...homes];
|
|
347
|
+
for (const value of input.envHomes || []) {
|
|
348
|
+
const home = trustedHome(input.fs, value);
|
|
349
|
+
if (home === null) {
|
|
350
|
+
homeProblem = true;
|
|
351
|
+
if (!reasons.includes('env_home_unusable'))
|
|
352
|
+
reasons.push('env_home_unusable');
|
|
353
|
+
continue;
|
|
354
|
+
}
|
|
355
|
+
if (!homes.includes(home)) {
|
|
356
|
+
homeProblem = true;
|
|
357
|
+
if (!reasons.includes('home_mismatch'))
|
|
358
|
+
reasons.push('home_mismatch');
|
|
359
|
+
}
|
|
360
|
+
if (!probeHomes.includes(home))
|
|
361
|
+
probeHomes.push(home);
|
|
362
|
+
}
|
|
363
|
+
// Read at most once per resolution, and only when a group-writable evidence dir needs it.
|
|
364
|
+
let privateGidValue;
|
|
365
|
+
const privateGid = () => {
|
|
366
|
+
if (privateGidValue === undefined) {
|
|
367
|
+
const source = input.privateGid;
|
|
368
|
+
let value = null;
|
|
369
|
+
try {
|
|
370
|
+
value = typeof source === 'function' ? source() : source;
|
|
371
|
+
}
|
|
372
|
+
catch {
|
|
373
|
+
value = null;
|
|
374
|
+
}
|
|
375
|
+
privateGidValue = typeof value === 'number' && Number.isInteger(value) && value > 0 ? value : null;
|
|
376
|
+
}
|
|
377
|
+
return privateGidValue;
|
|
378
|
+
};
|
|
379
|
+
// Every home named anywhere is probed: evidence in any of them counts.
|
|
380
|
+
for (const home of probeHomes) {
|
|
381
|
+
const probed = probeHome(input.fs, home, uid, privateGid);
|
|
382
|
+
for (const id of exports.ACCOUNT_EVIDENCE)
|
|
383
|
+
evidence[id] = worst(evidence[id], probed[id]);
|
|
384
|
+
}
|
|
385
|
+
for (const file of input.extraHookConfigs || []) {
|
|
386
|
+
evidence.hook_claimed_marker = worst(evidence.hook_claimed_marker, file.startsWith('/') ? probeHookConfig(input.fs, file) : 'unknown');
|
|
387
|
+
}
|
|
388
|
+
for (const dir of input.extraHookDirs || []) {
|
|
389
|
+
evidence.hook_claimed_marker = worst(evidence.hook_claimed_marker, dir.startsWith('/') ? probeHookDir(input.fs, dir) : 'unknown');
|
|
390
|
+
}
|
|
391
|
+
const present = exports.ACCOUNT_EVIDENCE.filter((id) => evidence[id] === 'present');
|
|
392
|
+
const unknown = exports.ACCOUNT_EVIDENCE.filter((id) => evidence[id] === 'unknown');
|
|
393
|
+
if (present.length > 0)
|
|
394
|
+
reasons.push('account_evidence');
|
|
395
|
+
if (unknown.length > 0)
|
|
396
|
+
reasons.push('evidence_unknown');
|
|
397
|
+
let mode;
|
|
398
|
+
if (input.key === 'present')
|
|
399
|
+
mode = 'account';
|
|
400
|
+
else if (input.key === 'rejected') {
|
|
401
|
+
mode = 'claimed_no_key';
|
|
402
|
+
reasons.push('key_rejected');
|
|
403
|
+
}
|
|
404
|
+
else if (homeProblem || present.length > 0 || unknown.length > 0)
|
|
405
|
+
mode = 'claimed_no_key';
|
|
406
|
+
else if (input.strict) {
|
|
407
|
+
mode = 'claimed_no_key';
|
|
408
|
+
reasons.push('strict');
|
|
409
|
+
}
|
|
410
|
+
else
|
|
411
|
+
mode = 'seatbelt';
|
|
412
|
+
return { mode, homes, evidence, reasons };
|
|
413
|
+
}
|
|
414
|
+
/** The only environment names mode resolution reads: the key lookup's names, the strict switch and the tighten-only evidence relocations. */
|
|
415
|
+
const KEY_ENV_NAMES = ['MARROW_API_KEY', 'MARROW_KEY', 'MARROW_BASE_URL', 'MARROW_SESSION_ID'];
|
|
416
|
+
/** Env homes 3.9.102 writes under (src/env.ts: HOME, then USERPROFILE). */
|
|
417
|
+
const ENV_HOME_NAMES = ['HOME', 'USERPROFILE'];
|
|
418
|
+
/** Env-relocated harness config: name -> files (or, for dirs, '' meaning the dir itself is scanned). */
|
|
419
|
+
const ENV_HOOK_FILES = {
|
|
420
|
+
CODEX_HOME: ['hooks.json', 'config.toml'],
|
|
421
|
+
CLAUDE_CONFIG_DIR: ['settings.json', 'settings.local.json'],
|
|
422
|
+
GEMINI_CLI_SYSTEM_SETTINGS_PATH: [''],
|
|
423
|
+
};
|
|
424
|
+
const ENV_HOOK_DIRS = { CLINE_DIR: 'hooks' };
|
|
425
|
+
exports.MODE_ENV_NAMES = [...KEY_ENV_NAMES, 'MARROW_SEATBELT_STRICT', ...ENV_HOME_NAMES, ...Object.keys(ENV_HOOK_FILES), ...Object.keys(ENV_HOOK_DIRS)];
|
|
426
|
+
function passwdHomeDirectory() {
|
|
427
|
+
try {
|
|
428
|
+
const home = (0, node_os_1.userInfo)().homedir;
|
|
429
|
+
return typeof home === 'string' && home ? home : null;
|
|
430
|
+
}
|
|
431
|
+
catch {
|
|
432
|
+
return null;
|
|
433
|
+
}
|
|
434
|
+
}
|
|
435
|
+
/**
|
|
436
|
+
* Host wiring for the hook (U5 calls this). The key comes only from the hook's
|
|
437
|
+
* environment or the owner files in a trusted home (never repo .env files);
|
|
438
|
+
* keyRejected is set after the server answers 401.
|
|
439
|
+
*/
|
|
440
|
+
function resolveSeatbeltModeOnHost(options = {}) {
|
|
441
|
+
const env = options.env || process.env;
|
|
442
|
+
const fs = options.fs || (0, seatbelt_fs_1.nodeSeatbeltFs)();
|
|
443
|
+
const argv = options.argv || process.argv.slice(2);
|
|
444
|
+
const passwdHome = options.passwdHome === undefined ? passwdHomeDirectory() : options.passwdHome;
|
|
445
|
+
const uid = options.uid === undefined ? (typeof process.getuid === 'function' ? process.getuid() : null) : options.uid;
|
|
446
|
+
// Only MODE_ENV_NAMES are read. None of them can select seatbelt or the
|
|
447
|
+
// trusted home: the env homes and relocated configs only add evidence.
|
|
448
|
+
const keyEnv = {};
|
|
449
|
+
for (const name of KEY_ENV_NAMES) {
|
|
450
|
+
const value = env[name];
|
|
451
|
+
if (typeof value === 'string')
|
|
452
|
+
keyEnv[name] = value;
|
|
453
|
+
}
|
|
454
|
+
const strict = env.MARROW_SEATBELT_STRICT === '1';
|
|
455
|
+
const homes = [...homeFlags(argv), ...(passwdHome ? [passwdHome] : [])];
|
|
456
|
+
let key = 'none';
|
|
457
|
+
if (keyEnv.MARROW_API_KEY || keyEnv.MARROW_KEY)
|
|
458
|
+
key = 'present';
|
|
459
|
+
for (const home of homes) {
|
|
460
|
+
if (key === 'present')
|
|
461
|
+
break;
|
|
462
|
+
const real = trustedHome(fs, home);
|
|
463
|
+
if (!real)
|
|
464
|
+
continue;
|
|
465
|
+
if ((0, env_1.resolveMarrowEnv)({ env: keyEnv, home: real, trustedOnly: true }).apiKey)
|
|
466
|
+
key = 'present';
|
|
467
|
+
}
|
|
468
|
+
if (key === 'present' && options.keyRejected)
|
|
469
|
+
key = 'rejected';
|
|
470
|
+
const envHomes = [];
|
|
471
|
+
for (const name of ENV_HOME_NAMES) {
|
|
472
|
+
const value = env[name];
|
|
473
|
+
// 3.9.102 uses `env.HOME || ...`: an empty value falls through to the next.
|
|
474
|
+
if (typeof value === 'string' && value !== '')
|
|
475
|
+
envHomes.push(value);
|
|
476
|
+
}
|
|
477
|
+
const extraHookConfigs = [];
|
|
478
|
+
for (const [name, files] of Object.entries(ENV_HOOK_FILES)) {
|
|
479
|
+
const value = env[name];
|
|
480
|
+
if (typeof value !== 'string' || value.trim() === '')
|
|
481
|
+
continue;
|
|
482
|
+
for (const file of files)
|
|
483
|
+
extraHookConfigs.push(file ? `${value.replace(/\/+$/, '')}/${file}` : value);
|
|
484
|
+
}
|
|
485
|
+
const extraHookDirs = [];
|
|
486
|
+
for (const [name, sub] of Object.entries(ENV_HOOK_DIRS)) {
|
|
487
|
+
const value = env[name];
|
|
488
|
+
if (typeof value === 'string' && value.trim() !== '')
|
|
489
|
+
extraHookDirs.push(`${value.replace(/\/+$/, '')}/${sub}`);
|
|
490
|
+
}
|
|
491
|
+
// Only Linux has the user-private-group convention this allowance is for; elsewhere group write stays refused.
|
|
492
|
+
const privateGid = options.privateGid !== undefined ? options.privateGid
|
|
493
|
+
: process.platform === 'linux' ? () => privateGroupId(fs, uid) : null;
|
|
494
|
+
return resolveSeatbeltMode({ fs, passwdHome, argv, key, uid, strict, envHomes, extraHookConfigs, extraHookDirs, privateGid });
|
|
495
|
+
}
|
|
496
|
+
//# sourceMappingURL=seatbelt-mode.js.map
|