@goodandready/dsh-approval-gate 0.1.24 → 0.1.26

package/lib/diff-viewer.js

@@ -0,0 +1,371 @@
+// lib/diff-viewer.js
+// Unified Diff Generator and Hunk Folding Engine for DSH Approval Gate (#74, #75).
+// Zero-dependency pure JavaScript Myers-style line diffing with folding support.
+
+/**
+ * @typedef {Object} DiffLine
+ * @property {'eq' | 'add' | 'del'} type
+ * @property {string} text
+ * @property {number | null} oldLine
+ * @property {number | null} newLine
+ */
+
+/**
+ * @typedef {Object} FoldItem
+ * @property {'fold'} type
+ * @property {number} count
+ * @property {number} startOldLine
+ * @property {number} startNewLine
+ * @property {DiffLine[]} foldedLines
+ * @property {boolean} expanded
+ */
+
+/**
+ * @typedef {Object} Hunk
+ * @property {number} oldStart
+ * @property {number} oldCount
+ * @property {number} newStart
+ * @property {number} newCount
+ * @property {string} header
+ * @property {(DiffLine | FoldItem)[]} items
+ */
+
+/**
+ * Splits text into lines preserving empty lines.
+ *
+ * @param {string} text
+ * @returns {string[]}
+ */
+export function splitLines(text) {
+  if (typeof text !== "string") return [];
+  const lines = text.split(/\r?\n/);
+  if (lines.length > 0 && lines[lines.length - 1] === "") {
+    lines.pop();
+  }
+  return lines;
+}
+
+/**
+ * Computes Longest Common Subsequence matrix for two arrays of lines.
+ *
+ * @param {string[]} a
+ * @param {string[]} b
+ * @returns {number[][]}
+ */
+function lcsMatrix(a, b) {
+  const m = a.length;
+  const n = b.length;
+  const dp = Array.from({ length: m + 1 }, () => new Uint32Array(n + 1));
+  for (let i = 0; i < m; i++) {
+    for (let j = 0; j < n; j++) {
+      if (a[i] === b[j]) {
+        dp[i + 1][j + 1] = dp[i][j] + 1;
+      } else {
+        dp[i + 1][j + 1] = Math.max(dp[i + 1][j], dp[i][j + 1]);
+      }
+    }
+  }
+  return dp;
+}
+
+/**
+ * Generates raw diff lines between old and new text.
+ *
+ * @param {string} oldText
+ * @param {string} newText
+ * @returns {DiffLine[]}
+ */
+export function generateDiffLines(oldText, newText) {
+  const a = splitLines(oldText);
+  const b = splitLines(newText);
+  const dp = lcsMatrix(a, b);
+
+  let i = a.length;
+  let j = b.length;
+  /** @type {DiffLine[]} */
+  const reversed = [];
+
+  while (i > 0 || j > 0) {
+    if (i > 0 && j > 0 && a[i - 1] === b[j - 1]) {
+      reversed.push({ type: "eq", text: a[i - 1], oldLine: i, newLine: j });
+      i--;
+      j--;
+    } else if (j > 0 && (i === 0 || dp[i][j - 1] >= dp[i - 1][j])) {
+      reversed.push({ type: "add", text: b[j - 1], oldLine: null, newLine: j });
+      j--;
+    } else if (i > 0 && (j === 0 || dp[i][j - 1] < dp[i - 1][j])) {
+      reversed.push({ type: "del", text: a[i - 1], oldLine: i, newLine: null });
+      i--;
+    }
+  }
+
+  return reversed.reverse();
+}
+
+/**
+ * Groups diff lines into hunks with context and hunk folding (#75).
+ *
+ * @param {DiffLine[]} lines
+ * @param {Object} [options]
+ * @param {number} [options.contextLines=3]
+ * @param {number} [options.minFoldLines=4]
+ * @returns {Hunk[]}
+ */
+export function groupHunks(lines, options = {}) {
+  const ctx = typeof options.contextLines === "number" ? options.contextLines : 3;
+  const minFold = typeof options.minFoldLines === "number" ? options.minFoldLines : 4;
+  if (!lines || lines.length === 0) return [];
+
+  // Find all modified indices
+  const isChanged = lines.map((l) => l.type !== "eq");
+  const anyChange = isChanged.some(Boolean);
+  if (!anyChange) {
+    return [];
+  }
+
+  // Group changed clusters with context
+  const ranges = [];
+  let curStart = null;
+  let curEnd = null;
+
+  for (let k = 0; k < lines.length; k++) {
+    if (isChanged[k]) {
+      const start = Math.max(0, k - ctx);
+      const end = Math.min(lines.length - 1, k + ctx);
+      if (curStart === null) {
+        curStart = start;
+        curEnd = end;
+      } else if (start <= curEnd + 1) {
+        curEnd = Math.max(curEnd, end);
+      } else {
+        ranges.push({ start: curStart, end: curEnd });
+        curStart = start;
+        curEnd = end;
+      }
+    }
+  }
+  if (curStart !== null) {
+    ranges.push({ start: curStart, end: curEnd });
+  }
+
+  /** @type {Hunk[]} */
+  const hunks = [];
+  let lastRangeEnd = -1;
+
+  for (let idx = 0; idx < ranges.length; idx++) {
+    const r = ranges[idx];
+    const prevEnd = lastRangeEnd;
+    const hunkLines = lines.slice(r.start, r.end + 1);
+
+    let oldStart = 0;
+    let oldCount = 0;
+    let newStart = 0;
+    let newCount = 0;
+
+    for (const l of hunkLines) {
+      if (l.type === "eq" || l.type === "del") {
+        oldCount++;
+        if (!oldStart && l.oldLine) oldStart = l.oldLine;
+      }
+      if (l.type === "eq" || l.type === "add") {
+        newCount++;
+        if (!newStart && l.newLine) newStart = l.newLine;
+      }
+    }
+
+    /** @type {(DiffLine | FoldItem)[]} */
+    const items = [];
+
+    // Leading fold if there are unchanged lines before this range (#75)
+    if (r.start > prevEnd + 1) {
+      const leadingLines = lines.slice(prevEnd + 1, r.start);
+      if (leadingLines.length >= minFold) {
+        items.push({
+          type: "fold",
+          count: leadingLines.length,
+          startOldLine: leadingLines[0].oldLine,
+          startNewLine: leadingLines[0].newLine,
+          foldedLines: leadingLines,
+          expanded: false,
+        });
+      } else {
+        items.push(...leadingLines);
+      }
+    }
+
+    // Inside range: check for fold streaks
+    let eqStreak = [];
+    const flushStreak = () => {
+      if (eqStreak.length >= minFold) {
+        items.push({
+          type: "fold",
+          count: eqStreak.length,
+          startOldLine: eqStreak[0].oldLine,
+          startNewLine: eqStreak[0].newLine,
+          foldedLines: eqStreak.slice(),
+          expanded: false,
+        });
+      } else {
+        items.push(...eqStreak);
+      }
+      eqStreak = [];
+    };
+
+    for (const l of hunkLines) {
+      if (l.type === "eq") {
+        eqStreak.push(l);
+      } else {
+        if (eqStreak.length > 0) flushStreak();
+        items.push(l);
+      }
+    }
+    if (eqStreak.length > 0) flushStreak();
+
+    // Trailing fold if this is the last range and there are remaining lines
+    if (idx === ranges.length - 1 && r.end < lines.length - 1) {
+      const trailingLines = lines.slice(r.end + 1);
+      if (trailingLines.length >= minFold) {
+        items.push({
+          type: "fold",
+          count: trailingLines.length,
+          startOldLine: trailingLines[0].oldLine,
+          startNewLine: trailingLines[0].newLine,
+          foldedLines: trailingLines,
+          expanded: false,
+        });
+      } else {
+        items.push(...trailingLines);
+      }
+    }
+
+    const header = `@@ -${oldStart || 1},${oldCount} +${newStart || 1},${newCount} @@`;
+    hunks.push({
+      oldStart: oldStart || 1,
+      oldCount,
+      newStart: newStart || 1,
+      newCount,
+      header,
+      items,
+    });
+    lastRangeEnd = r.end;
+  }
+
+  return hunks;
+}
+
+/**
+ * Formats hunks as standard Unified Diff string (#74).
+ *
+ * @param {Hunk[]} hunks
+ * @param {Object} [options]
+ * @param {string} [options.oldFile='a/file']
+ * @param {string} [options.newFile='b/file']
+ * @returns {string}
+ */
+export function formatUnifiedDiff(hunks, options = {}) {
+  const oldFile = options.oldFile || "a/file";
+  const newFile = options.newFile || "b/file";
+  if (!hunks || hunks.length === 0) return "";
+
+  const out = [`--- ${oldFile}`, `+++ ${newFile}`];
+
+  for (const h of hunks) {
+    out.push(h.header);
+    for (const item of h.items) {
+      if (item.type === "fold") {
+        out.push(`@@ ... [${item.count} unchanged lines folded] ... @@`);
+        if (item.expanded) {
+          for (const fl of item.foldedLines) {
+            out.push(` ${fl.text}`);
+          }
+        }
+      } else if (item.type === "eq") {
+        out.push(` ${item.text}`);
+      } else if (item.type === "add") {
+        out.push(`+${item.text}`);
+      } else if (item.type === "del") {
+        out.push(`-${item.text}`);
+      }
+    }
+  }
+
+  return out.join("\n");
+}
+
+/**
+ * Parses a unified diff string into hunks and lines.
+ *
+ * @param {string} diffText
+ * @returns {Hunk[]}
+ */
+export function parseUnifiedDiff(diffText) {
+  if (typeof diffText !== "string" || !diffText.trim()) return [];
+  const lines = splitLines(diffText);
+  /** @type {Hunk[]} */
+  const hunks = [];
+  let curHunk = null;
+  let curOldLine = 1;
+  let curNewLine = 1;
+
+  for (const l of lines) {
+    if (l.startsWith("---") || l.startsWith("+++")) {
+      continue;
+    }
+    const hMatch = l.match(/^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/);
+    if (hMatch) {
+      if (curHunk) hunks.push(curHunk);
+      curOldLine = parseInt(hMatch[1], 10);
+      curNewLine = parseInt(hMatch[3], 10);
+      curHunk = {
+        oldStart: curOldLine,
+        oldCount: hMatch[2] !== undefined ? parseInt(hMatch[2], 10) : 1,
+        newStart: curNewLine,
+        newCount: hMatch[4] !== undefined ? parseInt(hMatch[4], 10) : 1,
+        header: l,
+        items: [],
+      };
+      continue;
+    }
+    if (!curHunk) continue;
+
+    if (l.startsWith("+")) {
+      curHunk.items.push({ type: "add", text: l.slice(1), oldLine: null, newLine: curNewLine++ });
+    } else if (l.startsWith("-")) {
+      curHunk.items.push({ type: "del", text: l.slice(1), oldLine: curOldLine++, newLine: null });
+    } else if (l.startsWith(" ")) {
+      curHunk.items.push({ type: "eq", text: l.slice(1), oldLine: curOldLine++, newLine: curNewLine++ });
+    } else if (l.startsWith("@@ ...")) {
+      const fMatch = l.match(/\[(\d+) unchanged lines folded\]/);
+      const count = fMatch ? parseInt(fMatch[1], 10) : 0;
+      curHunk.items.push({
+        type: "fold",
+        count,
+        startOldLine: curOldLine,
+        startNewLine: curNewLine,
+        foldedLines: [],
+        expanded: false,
+      });
+      curOldLine += count;
+      curNewLine += count;
+    }
+  }
+  if (curHunk) hunks.push(curHunk);
+  return hunks;
+}
+
+/**
+ * Toggles fold expansion in a hunk item (#75).
+ *
+ * @param {Hunk} hunk
+ * @param {number} itemIndex
+ * @returns {boolean}
+ */
+export function toggleFold(hunk, itemIndex) {
+  if (!hunk || !Array.isArray(hunk.items)) return false;
+  const it = hunk.items[itemIndex];
+  if (it && it.type === "fold") {
+    it.expanded = !it.expanded;
+    return true;
+  }
+  return false;
+}

package/lib/engine.js

@@ -31,6 +31,9 @@ import { TrajectoryTracker } from "./drift.js";
 import { ConfirmationLearner } from "./learning.js";
 import { findSemanticallyEquivalentRule } from "./similarity.js";
 import { IndependentReviewer } from "./reviewer.js";
+import { raceHumanDecision, RaceHumanHandle } from "./race-decision.js";
+import { RulesHmrWatcher } from "./rules-hmr.js";
+import { checkNetworkAccess, resolveNetworkPolicy } from "./network-sandbox.js";
 
 /**
  * Determine whether an operation belongs to a critical risk category requiring lockedAsk (#52).
@@ -98,6 +101,8 @@ export class SecurityEngine {
     this.trajectoryTracker = options.trajectoryTracker !== undefined ? options.trajectoryTracker : new TrajectoryTracker();
     this.learner = options.learner !== undefined ? options.learner : new ConfirmationLearner(options);
     this.reviewer = options.reviewer || new IndependentReviewer(options);
+    this.hmrWatcher = options.hmrWatcher || new RulesHmrWatcher(options);
+    this.egressProxy = options.egressProxy || null;
   }
 
   /**
@@ -522,9 +527,7 @@ export class SecurityEngine {
     if (decision && decision.verdict === "ask" && isCriticalOperation(toolName, command, execution)) {
       decision.lockedAsk = true;
       decision.lockedReason = "critical-operation";
-      if (decision.hit) {
-        decision.hit.lockedAsk = true;
-      }
+      if (decision.hit) decision.hit.lockedAsk = true;
     }
   }
 
@@ -582,5 +585,9 @@ export class SecurityEngine {
   recordConfirmation(sessionId, execution) { return this.learner ? this.learner.recordConfirmation(sessionId, execution) : null; }
   getLearnedRules(sessionId) { return this.learner ? this.learner.getLearnedRules(sessionId) : []; }
   reviewWithIndependentModel(execution, context) { return this.reviewer ? this.reviewer.review(execution, context) : null; }
+  raceDecision(humanPromise, opts) { return raceHumanDecision(humanPromise, opts); }
+  createRaceHandle(opts) { return new RaceHumanHandle(opts); }
+  checkNetwork(dest, sandboxMode, opts) { return checkNetworkAccess(dest, sandboxMode, opts); }
+  resolveNetworkPolicy(mode, opts) { return resolveNetworkPolicy(mode, opts); }
 }
 

package/lib/forward-proxy.js

@@ -0,0 +1,218 @@
+// lib/forward-proxy.js
+// Local HTTP/CONNECT Forward Proxy for Bash Network Egress Interception (#39).
+// Binds to 127.0.0.1 and intercepts egress traffic from child processes (curl, python, node).
+// Enforces sandbox network policies and blocks unauthorized hosts via HTTP and CONNECT tunnels.
+
+import http from "node:http";
+import net from "node:net";
+import { checkNetworkAccess, parseDestination } from "./network-sandbox.js";
+
+/**
+ * Embedded forward proxy for intercepting subprocess egress (#39).
+ */
+export class LocalEgressProxy {
+  /**
+   * @param {{
+   *   port?: number,
+   *   sandboxMode?: string,
+   *   whitelist?: string[],
+   *   auditLogger?: any,
+   *   logger?: any,
+   * }} [options]
+   */
+  constructor(options = {}) {
+    this.port = typeof options.port === "number" ? options.port : 0;
+    this.sandboxMode = options.sandboxMode || "workspace-write";
+    this.whitelist = Array.isArray(options.whitelist) ? [...options.whitelist] : [];
+    this.auditLogger = options.auditLogger || null;
+    this.logger = options.logger || null;
+
+    this.server = null;
+    this.listeningPort = 0;
+    this.activeSockets = new Set();
+  }
+
+  /**
+   * Starts the forward proxy server.
+   * @returns {Promise<{ host: string, port: number }>}
+   */
+  async start() {
+    if (this.server) {
+      return { host: "127.0.0.1", port: this.listeningPort };
+    }
+
+    return new Promise((resolve, reject) => {
+      this.server = http.createServer((req, res) => {
+        this._handleHttpRequest(req, res);
+      });
+
+      this.server.on("connect", (req, clientSocket, head) => {
+        this._handleConnectTunnel(req, clientSocket, head);
+      });
+
+      this.server.on("connection", (socket) => {
+        this.activeSockets.add(socket);
+        socket.once("close", () => this.activeSockets.delete(socket));
+      });
+
+      this.server.on("error", (err) => {
+        if (this.logger) this.logger.error?.("LocalEgressProxy server error:", err);
+        reject(err);
+      });
+
+      this.server.listen(this.port, "127.0.0.1", () => {
+        const addr = this.server.address();
+        this.listeningPort = typeof addr === "object" && addr ? addr.port : this.port;
+        resolve({ host: "127.0.0.1", port: this.listeningPort });
+      });
+    });
+  }
+
+  /**
+   * Stops the forward proxy and closes all active sockets.
+   * @returns {Promise<void>}
+   */
+  async stop() {
+    if (!this.server) return;
+
+    return new Promise((resolve) => {
+      for (const socket of this.activeSockets) {
+        try {
+          socket.destroy();
+        } catch (_e) {}
+      }
+      this.activeSockets.clear();
+
+      this.server.close(() => {
+        this.server = null;
+        this.listeningPort = 0;
+        resolve();
+      });
+    });
+  }
+
+  /**
+   * Returns proxy environment variables to inject into child processes.
+   * @returns {{ HTTP_PROXY: string, HTTPS_PROXY: string, ALL_PROXY: string, NO_PROXY: string }}
+   */
+  getEnv() {
+    if (!this.listeningPort) return {};
+    const proxyUrl = `http://127.0.0.1:${this.listeningPort}`;
+    return {
+      HTTP_PROXY: proxyUrl,
+      HTTPS_PROXY: proxyUrl,
+      ALL_PROXY: proxyUrl,
+      NO_PROXY: "127.0.0.1,localhost",
+    };
+  }
+
+  /**
+   * Checks whether access to destination is allowed under proxy rules.
+   * @param {string} destination
+   * @returns {ReturnType<typeof checkNetworkAccess>}
+   */
+  checkAccess(destination) {
+    return checkNetworkAccess(destination, this.sandboxMode, {
+      whitelist: this.whitelist,
+    });
+  }
+
+  /**
+   * @private
+   */
+  _handleHttpRequest(req, res) {
+    const dest = req.url || req.headers.host || "";
+    const access = this.checkAccess(dest);
+
+    if (!access.allowed) {
+      this._recordBlockedEgress(access.hostname, "HTTP", access.reason);
+      res.writeHead(403, { "Content-Type": "text/plain", "X-Proxy-Blocked": "unauthorized-egress" });
+      res.end(`403 Forbidden: Egress to ${access.hostname} blocked by security sandbox (${access.reason})\n`);
+      return;
+    }
+
+    // Forward HTTP request
+    try {
+      const u = new URL(req.url);
+      const options = {
+        hostname: u.hostname,
+        port: Number(u.port) || 80,
+        path: `${u.pathname}${u.search}`,
+        method: req.method,
+        headers: req.headers,
+      };
+
+      const proxyReq = http.request(options, (proxyRes) => {
+        res.writeHead(proxyRes.statusCode || 200, proxyRes.headers);
+        proxyRes.pipe(res);
+      });
+
+      proxyReq.on("error", (err) => {
+        res.writeHead(502, { "Content-Type": "text/plain" });
+        res.end(`502 Bad Gateway: ${err.message}\n`);
+      });
+
+      req.pipe(proxyReq);
+    } catch (err) {
+      res.writeHead(400, { "Content-Type": "text/plain" });
+      res.end(`400 Bad Request: ${err.message}\n`);
+    }
+  }
+
+  /**
+   * @private
+   */
+  _handleConnectTunnel(req, clientSocket, head) {
+    const dest = req.url || "";
+    const access = this.checkAccess(dest);
+
+    if (!access.allowed) {
+      this._recordBlockedEgress(access.hostname, "CONNECT", access.reason);
+      clientSocket.write("HTTP/1.1 403 Forbidden\r\nContent-Type: text/plain\r\n\r\nBlocked by security sandbox\n");
+      clientSocket.destroy();
+      return;
+    }
+
+    const { hostname, port } = parseDestination(dest);
+    const targetPort = port || 443;
+
+    const serverSocket = net.connect(targetPort, hostname, () => {
+      clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+      if (head && head.length > 0) {
+        serverSocket.write(head);
+      }
+      serverSocket.pipe(clientSocket);
+      clientSocket.pipe(serverSocket);
+    });
+
+    serverSocket.on("error", (_err) => {
+      try {
+        clientSocket.write("HTTP/1.1 502 Bad Gateway\r\n\r\n");
+        clientSocket.destroy();
+      } catch (_e) {}
+    });
+
+    clientSocket.on("error", (_err) => {
+      try {
+        serverSocket.destroy();
+      } catch (_e) {}
+    });
+  }
+
+  /**
+   * @private
+   */
+  _recordBlockedEgress(host, protocol, reason) {
+    if (this.auditLogger && typeof this.auditLogger.appendAuditLine === "function") {
+      this.auditLogger.appendAuditLine({
+        sessionId: "egress-proxy",
+        decision: {
+          verdict: "deny",
+          stage: "P0",
+          reason: `egress-proxy-blocked: ${reason}`,
+          detail: `${protocol} to ${host}`,
+        },
+      });
+    }
+  }
+}

package/lib/index.js

@@ -11,6 +11,8 @@ import { MEASURE_KINDS, classifyMeasureKind } from "./measure-kinds.js";
 import { LineageManager } from "./lineage.js";
 import { generateAgentGuidance, injectAgentGuidance, extractGuidance, GUIDANCE_MARKER } from "./guidance.js";
 import { isRedundantSandboxRequest, buildRedundantSandboxRemediation, checkEscalationJustification } from "./escalation.js";
+import { TimelineService } from "./timeline-service.js";
+import { TurnCardTracker } from "./turn-card.js";
 import Schema from "@deepseek-ai/schemastery";
 
 if (typeof Schema.prototype?.volatile !== "function") {
@@ -405,6 +407,11 @@ export function apply(ctx, config) {
     }),
   };
   provideServicePolyfill(ctx, "approvalGate", gateService);
+  const turnCard = new TurnCardTracker();
+  const timeline = new TimelineService({ turnCardTracker: turnCard });
+  timeline.registerRoutes(ctx);
+  gateService.timeline = timeline;
+  gateService.turnCard = turnCard;
 
   const hasPreExecute = ctx && typeof ctx.on === "function";
   if (hasPreExecute) {
@@ -428,6 +435,7 @@ export function apply(ctx, config) {
         return { kind: "ask", reason: askMessage(hit, who, translate, ctx && ctx.logger) };
       }
 
+      timeline.recordEvent({ sessionId, turnId: execution?.turnId, tool: execution?.name, command: execution?.arguments?.command, snippet: decision.snippet, verdict: decision.verdict, stage: decision.stage, reason: decision.reason, timeoutMs: decision.timeoutMs });
       if (decision.dryRun) {
         if (ctx && ctx.logger && typeof ctx.logger.info === "function") {
           ctx.logger.info(`[dsh-approval-gate:DRY-RUN] would block rule=${decision.reason} (${decision.originalVerdict})${who}`);
@@ -497,6 +505,7 @@ export function apply(ctx, config) {
       return denyMessage(hit, who, translate, ctx && ctx.logger);
     }
 
+    timeline.recordEvent({ sessionId, turnId: execution?.turnId, tool: execution?.name, command: execution?.arguments?.command, snippet: decision.snippet, verdict: decision.verdict, stage: decision.stage, reason: decision.reason });
     if (decision.dryRun) {
       if (ctx && ctx.logger && typeof ctx.logger.info === "function") {
         ctx.logger.info(`[dsh-approval-gate:DRY-RUN] would block rule=${decision.reason} (${decision.originalVerdict})${who}`);
@@ -578,3 +587,10 @@ export { DEFAULT_MIN_CONFIRMATIONS, DEFAULT_MAX_LEARNED_RULES, EXCLUSION_REASONS
 export { canonicalizeCommand, isSemanticallyEquivalent, findSemanticallyEquivalentRule, validateSemanticSimilarity } from "./similarity.js";
 export { SAFETY_REVIEWER_SYSTEM_PROMPT, DEFAULT_REVIEWER_AGENT_ID, assertSeparationOfDuties, IndependentReviewer } from "./reviewer.js";
 export { DEFAULT_EVAL_CORPUS, runEvaluation, formatEvaluationReport } from "./eval-runner.js";
+export { DEFAULT_HUMAN_TIMEOUT_MS, RACE_WINNERS, RaceHumanHandle, raceHumanDecision } from "./race-decision.js";
+export { DEFAULT_HMR_DEBOUNCE_MS, RulesHmrWatcher } from "./rules-hmr.js";
+export { NETWORK_POLICIES, SANDBOX_NETWORK_MAP, resolveNetworkPolicy, parseDestination, checkNetworkAccess } from "./network-sandbox.js";
+export { LocalEgressProxy } from "./forward-proxy.js";
+export { splitLines, generateDiffLines, groupHunks, formatUnifiedDiff, parseUnifiedDiff, toggleFold } from "./diff-viewer.js";
+export { TurnCardTracker, formatTurnCardSummary } from "./turn-card.js";
+export { TimelineService } from "./timeline-service.js";