@greppleai/grip 0.0.0-stage → 0.0.1

package/dist/core/hooks/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../src/core/hooks/executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuC,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAgB/D,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,wCAAwC,GAAG,EAAE,CAAC;AAC3D,MAAM,CAAC,MAAM,wCAAwC,GAAG,GAAG,CAAC;AAC5D,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,CAAC;AACvD,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,GAAG,IAAI,CAAC;AAmBzD,SAAS,0BAA0B,CAClC,KAAqC,EACrC,QAAyB,EACzB,oBAAkD,EAC3C;IACP,IAAI,KAAK,CAAC,GAAG,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvC,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;SAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACR,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjF,CAAC;IACF,CAAC;SAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;AAAA,CACD;AAED,SAAS,QAAQ,CAAC,KAAc,EAAoC;IACnE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAAA,CAC5E;AACD,SAAS,kBAAkB,CAAC,KAAc,EAAiC;IAC1E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,CACN,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC;QACrE,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC;QACxE,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC;QAC9E,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACpE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;QAChE,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAC9E,CAAC;AAAA,CACF;AACD,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAA4B;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IACrG,IAAI,CAAC;QACJ,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;AAAA,CACD;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAgB,EAAU;IACnE,IAAI,KAAK,CAAC,eAAe,KAAK,YAAY;QAAE,OAAO,wCAAwC,CAAC;IAC5F,IAAI,KAAK,CAAC,eAAe,KAAK,kBAAkB;QAAE,OAAO,wCAAwC,CAAC;IAClG,OAAO,4BAA4B,CAAC;AAAA,CACpC;AAED,SAAS,kBAAkB,CAAC,OAA0B,EAAE,KAAgB,EAAE,OAAwB,EAAU;IAC3G,IAAI,OAAO,EAAE,cAAc,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,cAAc,CAAC;IACzE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,eAAe,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAAA,CAClH;AACD,MAAM,UAAU,wBAAwB,CAAC,MAAM,GAAsB,OAAO,CAAC,GAAG,EAAqB;IACpG,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,8DAA8D,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACvF,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AACD,SAAS,aAAa,CAAC,OAAe,EAAE,KAAa,EAAE,OAAe,EAA6B;IAClG,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;AAAA,CAC9G;AACD,SAAS,aAAa,CAAC,KAAgB,EAAW;IACjD,OAAO,CACN,KAAK,CAAC,eAAe,KAAK,YAAY;QACtC,KAAK,CAAC,eAAe,KAAK,kBAAkB;QAC5C,KAAK,CAAC,eAAe,KAAK,MAAM;QAChC,KAAK,CAAC,eAAe,KAAK,YAAY,CACtC,CAAC;AAAA,CACF;AACD,SAAS,wBAAwB,CAAC,MAAgC,EAAE,KAAgB,EAAsB;IACzG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;IACnH,IAAI,KAAK,CAAC,eAAe,KAAK,YAAY,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACjD,IACC,QAAQ,EAAE,aAAa,KAAK,KAAK,CAAC,eAAe;YACjD,QAAQ,CAAC,kBAAkB,KAAK,MAAM;YACtC,OAAO,QAAQ,CAAC,wBAAwB,KAAK,QAAQ,EACpD,CAAC;YACF,OAAO,QAAQ,CAAC,wBAAwB,CAAC;QAC1C,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;IAC7G,OAAO,SAAS,CAAC;AAAA,CACjB;AACD,SAAS,UAAU,CAAC,IAAuB,EAAE,IAAwB,EAAE,OAAe,EAAkB;IACvG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AAAA,CACnF;AACD,SAAS,UAAU,CAClB,IAAuB,EACvB,OAAe,EACf,OAAqC,EACf;IACtB,OAAO;QACN,IAAI;QACJ,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,EAAE;QACV,eAAe,EAAE,KAAK;QACtB,eAAe,EAAE,KAAK;QACtB,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QACzB,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO;QACvC,GAAG,OAAO;KACV,CAAC;AAAA,CACF;AAED,SAAS,sBAAsB,CAAC,KAA4B,EAAuB;IAClF,IAAI,KAAK,CAAC,mBAAmB;QAAE,OAAO,OAAO,CAAC;IAC9C,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,WAAW,CAAC;IACxC,OAAO,WAAW,CAAC;AAAA,CACnB;AAED,SAAS,0BAA0B,CAClC,IAAuB,EACvB,KAA4B,EAC5B,MAAgC,EACH;IAC7B,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,0CAA0C,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACtE,OAAO,UAAU,CAAC,IAAI,EAAE,kBAAkB,EAAE,oEAAoE,CAAC,CAAC;AAAA,CAClH;AAED,SAAS,sBAAsB,CAC9B,IAAuB,EACvB,OAAe,EACf,KAAgB,EAChB,QAAuB,EACvB,KAA4B,EACN;IACtB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACnG,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,QAAQ,GACb,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,mBAAmB,IAAI,QAAQ,KAAK,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC;IAC7G,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE;QAChC,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC;QACrC,QAAQ;QACR,MAAM;QACN,MAAM;QACN,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,MAAM;QACN,UAAU,EAAE,gBAAgB;QAC5B,QAAQ;QACR,GAAG,CAAC,QAAQ;YACX,CAAC,CAAC,EAAE,cAAc,EAAE,wBAAwB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,yBAAyB,CAAC,EAAE;YAC7G,CAAC,CAAC,EAAE,CAAC;KACN,CAAC,CAAC;AAAA,CACH;AAED,SAAS,UAAU,CAAC,KAAa,EAAU;IAC1C,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAAA,CAC3C;AAED,SAAS,+BAA+B,CAAC,IAAuB,EAAE,OAAuB,EAAW;IACnG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACjF,OAAO,OAAO,CAAC,cAAc,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC;AAAA,CACpE;AAED,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;CAgBvC,CAAC;AAmBF,SAAS,oBAAoB,CAC5B,OAA2B,EAC3B,KAAgB,EAChB,GAAW,EACX,UAA8B,EACH;IAC3B,MAAM,cAAc,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,GAAG,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAC/E,IAAI,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAC3B,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,CAAC,EAAE,CAAC;YACjG,IAAI,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC;YAC5D,IAAI,GAAG,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACP,IAAI,GAAG,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACrD,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAC5G,QAAQ,CACR,CAAC;IACF,OAAO;QACN,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,WAAW,UAAU,CAAC,qBAAqB,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE;QAC3E,KAAK,EAAE,cAAc;KACrB,CAAC;AAAA,CACF;AAED,SAAS,8BAA8B,CAAC,OAAe,EAA4B;IAClF,OAAO;QACN,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACvB,eAAe,EAAE,KAAK;QACtB,eAAe,EAAE,KAAK;QACtB,OAAO,EAAE,EAAE;QACX,mBAAmB,EAAE,KAAK;QAC1B,gBAAgB,EAAE,IAAI,eAAe,EAAE;KACvC,CAAC;AAAA,CACF;AAED,SAAS,8BAA8B,CAAC,KAA+B,EAAQ;IAC9E,IAAI,KAAK,CAAC,mBAAmB;QAAE,OAAO;IACtC,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACjC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;AAAA,CAC/B;AAED,SAAS,wBAAwB,CAAC,KAA+B,EAAE,IAAY,EAAQ;IACtF,MAAM,KAAK,GAAG,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAClF,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QAC1B,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,SAAS,CAAC;QACzC,IAAI,IAAI,CAAC,SAAS;YAAE,8BAA8B,CAAC,KAAK,CAAC,CAAC;QAC1D,OAAO;IACR,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QAC1B,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,SAAS,CAAC;IAC1C,CAAC;SAAM,CAAC;QACP,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QAC1B,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,SAAS,CAAC;IAC1C,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,eAAe;QAAE,8BAA8B,CAAC,KAAK,CAAC,CAAC;AAAA,CAC1F;AAED,SAAS,wBAAwB,CAAC,KAA+B,EAAE,IAAY,EAAQ;IACtF,IAAI,KAAK,CAAC,mBAAmB;QAAE,OAAO;IACtC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAC9C,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC1D,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC;QAC7B,8BAA8B,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO;IACR,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AAAA,CACnF;AAED,SAAS,2BAA2B,CAAC,KAA+B,EAAQ;IAC3E,IAAI,KAAK,CAAC,OAAO;QAAE,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AAAA,CAClE;AAED,SAAS,4BAA4B,CACpC,IAAuB,EACvB,OAAe,EACf,KAAgB,EAChB,KAA+B,EAC/B,QAAuB,EACD;IACtB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACnG,IAAI,gBAA4C,CAAC;IACjD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACpD,gBAAgB,GAAG,UAAU,CAC5B,IAAI,EACJ,kBAAkB,EAClB,oEAAoE,CACpE,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACtC,gBAAgB,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,4DAA4D,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI,QAAQ,KAAK,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC;IACtF,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE;QAChC,MAAM,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;QACzD,QAAQ;QACR,MAAM;QACN,MAAM;QACN,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,MAAM;QACN,UAAU,EAAE,gBAAgB;QAC5B,QAAQ;QACR,GAAG,CAAC,QAAQ;YACX,CAAC,CAAC,EAAE,cAAc,EAAE,wBAAwB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,yBAAyB,CAAC,EAAE;YAC7G,CAAC,CAAC,EAAE,CAAC;KACN,CAAC,CAAC;AAAA,CACH;AAED,SAAS,yBAAyB,CACjC,IAAuB,EACvB,OAAe,EACf,OAAuB,EACvB,KAA+B,EAC/B,KAAc,EACQ;IACtB,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IACjF,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE;QAChC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU,EAAE,KAAK,CAAC,mBAAmB;YACpC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,4DAA4D,CAAC;YAC7F,CAAC,CAAC,SAAS;gBACV,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,kCAAkC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;KACpF,CAAC,CAAC;AAAA,CACH;AACD,KAAK,UAAU,uBAAuB,CACrC,IAAuB,EACvB,OAA2B,EAC3B,KAAgB,EAChB,OAAuB,EACQ;IAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAC1C,MAAM,OAAO,GAAG,UAAU,EAAE,cAAc,EAAE,EAAE,CAAC;IAC/C,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/G,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE;YAChC,UAAU,EAAE,UAAU,CACrB,IAAI,EACJ,QAAQ,EACR,4EAA4E,CAC5E;SACD,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5G,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAClF,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC7C,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE;YAChC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,0DAA0D,CAAC;SAClG,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,8BAA8B,CAAC,OAAO,CAAC,cAAc,IAAI,6BAA6B,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,CACrE,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,KAAK,SAAS,CACvD,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE;YACzD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC;YACvD,MAAM;YACN,OAAO,EAAE,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC;SAChE,CAAC,CAAC;QACH,2BAA2B,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,4BAA4B,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,yBAAyB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;AAAA,CACD;AAED,KAAK,UAAU,cAAc,CAC5B,IAAuB,EACvB,OAA2B,EAC3B,KAAgB,EAChB,OAAuB,EACQ;IAC/B,IAAI,+BAA+B,CAAC,IAAI,EAAE,OAAO,CAAC;QAAE,OAAO,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAClH,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,6BAA6B,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;IAC3C,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAC9B,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,IAAI,OAAO,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YACpC,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC;YACnE,IAAI,GAAG,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACrC,OAAO,GAAG,MAAM,CAAC;YACjB,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzC,OAAO,GAAG,gBAAgB,CAAC;YAC3B,IAAI,GAAG,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACP,OAAO,GAAG,SAAS,CAAC;YACpB,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IACD,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACrC,IAAI,KAAqC,CAAC;QAC1C,IAAI,CAAC;YACJ,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;gBAC5B,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,GAAG,EAAE,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC;gBAC1C,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;gBACtC,WAAW,EAAE,IAAI;aACjB,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACjG,OAAO;QACR,CAAC;QACD,IAAI,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAChC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACtD,IAAI,yBAAyB,GAAG,KAAK,CAAC;QACtC,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC;YAC7C,IAAI,yBAAyB;gBAAE,OAAO;YACtC,yBAAyB,GAAG,IAAI,CAAC;YACjC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC;gBACtB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAA,CAChF,CAAC;YACF,IAAI,OAAO,CAAC,2BAA2B,EAAE,CAAC;gBACzC,2FAA2F;gBAC3F,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,GAAG,CAAC;oBAAE,QAAQ,EAAE,CAAC;gBAC1D,OAAO;YACR,CAAC;YACD,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;oBACnE,KAAK,EAAE,QAAQ;oBACf,WAAW,EAAE,IAAI;iBACjB,CAAC,CAAC;gBACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;oBAC9B,MAAM,CAAC,IAAI,EAAE,CAAC;oBACd,QAAQ,EAAE,CAAC;gBAAA,CACX,EAAE,IAAI,CAAC,CAAC;gBACT,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC9B,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,IAAI,IAAI,KAAK,CAAC;wBAAE,QAAQ,EAAE,CAAC;gBAAA,CAC3B,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;oBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,QAAQ,EAAE,CAAC;gBAAA,CACX,CAAC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACR,QAAQ,EAAE,CAAC;YACZ,CAAC;QAAA,CACD,CAAC;QACF,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;YACvB,IAAI,KAAK,CAAC,GAAG,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACvC,0EAA0E;gBAC1E,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;iBAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACJ,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACR,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvB,CAAC;YACF,CAAC;;gBAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,UAAU,CAAC,GAAG,EAAE,CAAC;gBAChB,0BAA0B,CAAC,KAAK,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;YAAA,CAClE,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;QAAA,CAChB,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;YACrB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS,EAAE,CAAC;QAAA,CACZ,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,EAAE,CAAC;;YAClC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;YAC9B,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS,EAAE,CAAC;QAAA,CACZ,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;YACpB,eAAe,KAAK,IAAI,CAAC,SAAS,CAAC;YACnC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC5C,mBAAmB,GAAG,IAAI,CAAC;gBAC3B,SAAS,EAAE,CAAC;YACb,CAAC;QAAA,CACD,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;YACpB,eAAe,KAAK,IAAI,CAAC,SAAS,CAAC;YACnC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC5C,mBAAmB,GAAG,IAAI,CAAC;gBAC3B,SAAS,EAAE,CAAC;YACb,CAAC;QAAA,CACD,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,CACN,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE;gBACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC/B,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC/B,eAAe;gBACf,eAAe;gBACf,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;aACxD,CAAC,CACF,CAAC;QAAA,CACF,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,CACN,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;gBAClD,MAAM;gBACN,MAAM;gBACN,eAAe;gBACf,eAAe;gBACf,mBAAmB;gBACnB,QAAQ;gBACR,SAAS;aACT,CAAC,CACF,CAAC;QAAA,CACF,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAAA,CACvC,CAAC,CAAC;AAAA,CACH;AACD,SAAS,iBAAiB,CAAC,KAAa,EAAE,OAAoB,EAAE,GAAsB,EAAU;IAC/F,OAAO,KAAK,CAAC,OAAO,CACnB,8DAA8D,EAC9D,CAAC,MAAM,EAAE,MAA0B,EAAE,IAAwB,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAA,CAClD,CACD,CAAC;AAAA,CACF;AACD,SAAS,wBAAwB,CAAC,KAAa,EAAW;IACzD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpE,OAAO,CACN,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,KAAK;QAClB,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzC,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAChD,CAAC;AAAA,CACF;AAOD,SAAS,qBAAqB,CAC7B,IAAuB,EACvB,OAAwB,EACxB,OAAuB,EACvB,GAAsB,EACG;IACzB,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,sBAAsB,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC7F,MAAM,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,KAAK,UAAU,wBAAwB,CAAC,QAAkB,EAAE,OAAe,EAAiC;IAC3G,IAAI,GAAG,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IAErD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,IAAI,CAAC;QACJ,OAAO,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM;YACrB,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YACrE,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC;YACpB,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC;YAChC,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM;QACP,CAAC;IACF,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,WAAW,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;AAAA,CACnD;AAED,SAAS,uBAAuB,CAC/B,IAAuB,EACvB,OAAe,EACf,QAAkB,EAClB,IAA0B,EACJ;IACtB,IAAI,MAAM,GAA6B,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzD,IAAI,kBAA8C,CAAC;IACnD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,kBAAkB,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,+CAA+C,CAAC,CAAC;IACrG,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC5D,kBAAkB,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,kCAAkC,CAAC,CAAC;IACrF,CAAC;SAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACzB,kBAAkB,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;SAAM,CAAC;QACP,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,GAAG,UAAU,CAAC;aAC9E,CAAC;YACL,kBAAkB,GAAG,UAAU,CAC9B,IAAI,EACJ,kBAAkB,EAClB,sEAAsE,CACtE,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE;QAChC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;QAC9C,QAAQ,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,EAAE;QACV,eAAe,EAAE,IAAI,CAAC,SAAS;QAC/B,MAAM;QACN,UAAU,EAAE,kBAAkB;KAC9B,CAAC,CAAC;AAAA,CACH;AAED,SAAS,oBAAoB,CAC5B,IAAuB,EACvB,OAAe,EACf,QAAiB,EACjB,SAAkB,EAClB,KAAc,EACQ;IACtB,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE;QAChC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO;QAChE,UAAU,EACT,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,qBAAqB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;KACxG,CAAC,CAAC;AAAA,CACH;AAED,KAAK,UAAU,WAAW,CACzB,IAAuB,EACvB,OAAwB,EACxB,KAAgB,EAChB,OAAuB,EACQ;IAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE;YAChC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,wDAAwD,OAAO,CAAC,GAAG,EAAE,CAAC;SAC7G,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,+BAA+B,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE;YAChC,UAAU,EAAE,UAAU,CACrB,IAAI,EACJ,QAAQ,EACR,gGAAgG,CAChG;SACD,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACrB,SAAS,GAAG,IAAI,CAAC;QACjB,UAAU,CAAC,KAAK,EAAE,CAAC;IAAA,CACnB,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,EAAE,CAAC;;QAClC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;QAC9B,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,CAAC,KAAK,EAAE,CAAC;IAAA,CACnB,EAAE,SAAS,CAAC,CAAC;IAEd,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,mBAAmB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC1F,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE;gBAChC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,yCAAyC,OAAO,CAAC,GAAG,EAAE,CAAC;aAC9F,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACvE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,OAAO;SACjB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,IAAI,6BAA6B,CAAC,CAAC;QAC/G,OAAO,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;AAAA,CACD;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,SAA4B,EAAW;IACvE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,UAAU,GAAG,OAAO;aACxB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;aAC1D,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,IAAI,MAAM,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAAA,CAC/C,CAAC,CAAC;AAAA,CACH;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,IAAuB,EACvB,KAAgB,EAChB,OAAO,GAAmB,EAAE,EACG;IAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACvF,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzG,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE;YAChC,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,2BAA2B,CAAC;SACpG,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACzF,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;AAAA,CAC5D;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,KAAmC,EACnC,KAAgB,EAChB,OAAO,GAAmB,EAAE,EACK;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAC5B,CAAC,IAAI,EAAE,EAAE,CACR,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,eAAe;QACpC,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO;QAC7C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,OAAO,CAC9C,CAAC;IACF,MAAM,UAAU,GACf,KAAK,CAAC,eAAe,KAAK,YAAY;QACrC,CAAC,CAAC;YACA,GAAG,OAAO;YACV,cAAc,EAAE,IAAI,CAAC,GAAG,CACvB,oCAAoC,EACpC,IAAI,CAAC,GAAG,CACP,wCAAwC,EACxC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,wCAAwC,CAAC,CAC3F,CACD;SACD;QACF,CAAC,CAAC,OAAO,CAAC;IACZ,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;AAAA,CACjF","sourcesContent":["import { type ChildProcessWithoutNullStreams, spawn } from \"node:child_process\";\nimport { performance } from \"node:perf_hooks\";\nimport type { PortablePathFlavor } from \"../lsp/portable-path.ts\";\nimport { matchesHookIf, matchesHookInput } from \"./matcher.ts\";\nimport type {\n\tCommandHookHandler,\n\tHookDiagnostic,\n\tHookDiagnosticCode,\n\tHookExecutionResult,\n\tHookExecutionStatus,\n\tHookHandlerCommon,\n\tHookInput,\n\tHookOutputClassification,\n\tHookRunOptions,\n\tHookStructuredOutput,\n\tHttpHookHandler,\n\tLoadedHookHandler,\n} from \"./types.ts\";\n\nexport const DEFAULT_HOOK_TIMEOUT_SECONDS = 600;\nexport const DEFAULT_USER_PROMPT_HOOK_TIMEOUT_SECONDS = 30;\nexport const DEFAULT_SESSION_END_HOOK_TIMEOUT_SECONDS = 1.5;\nexport const MAX_SESSION_END_HOOK_TIMEOUT_SECONDS = 60;\nexport const DEFAULT_MAX_HOOK_OUTPUT_BYTES = 1024 * 1024;\n\ninterface CompletedCommandState {\n\tstdout: Buffer;\n\tstderr: Buffer;\n\tstdoutTruncated: boolean;\n\tstderrTruncated: boolean;\n\toutputLimitExceeded: boolean;\n\ttimedOut: boolean;\n\tcancelled: boolean;\n}\n\ninterface BoundedBufferAppendResult {\n\tvalue: Buffer;\n\ttruncated: boolean;\n}\n\ntype WindowsProcessTreeTerminator = (pid: number) => void;\n\nfunction forceTerminateChildProcess(\n\tchild: ChildProcessWithoutNullStreams,\n\tplatform: NodeJS.Platform,\n\tterminateWindowsTree: WindowsProcessTreeTerminator,\n): void {\n\tif (child.pid && platform === \"win32\") {\n\t\tterminateWindowsTree(child.pid);\n\t} else if (child.pid) {\n\t\ttry {\n\t\t\tprocess.kill(-child.pid, \"SIGKILL\");\n\t\t} catch {\n\t\t\tif (child.exitCode === null && child.signalCode === null) child.kill(\"SIGKILL\");\n\t\t}\n\t} else if (child.exitCode === null && child.signalCode === null) {\n\t\tchild.kill(\"SIGKILL\");\n\t}\n}\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\nfunction isStructuredOutput(value: unknown): value is HookStructuredOutput {\n\tif (!isObject(value)) return false;\n\treturn (\n\t\t(value.continue === undefined || typeof value.continue === \"boolean\") &&\n\t\t(value.stopReason === undefined || typeof value.stopReason === \"string\") &&\n\t\t(value.systemMessage === undefined || typeof value.systemMessage === \"string\") &&\n\t\t(value.decision === undefined || typeof value.decision === \"string\") &&\n\t\t(value.reason === undefined || typeof value.reason === \"string\") &&\n\t\t(value.hookSpecificOutput === undefined || isObject(value.hookSpecificOutput))\n\t);\n}\nexport function classifyHookOutput(stdout: string): HookOutputClassification {\n\tif (stdout.length === 0) return { kind: \"empty\" };\n\tif (!stdout.trimStart().startsWith(\"{\")) return { kind: \"text\", text: stdout, malformedJson: false };\n\ttry {\n\t\tconst value: unknown = JSON.parse(stdout);\n\t\treturn isStructuredOutput(value) ? { kind: \"json\", value } : { kind: \"text\", text: stdout, malformedJson: true };\n\t} catch {\n\t\treturn { kind: \"text\", text: stdout, malformedJson: true };\n\t}\n}\n\nexport function defaultHookTimeoutSeconds(input: HookInput): number {\n\tif (input.hook_event_name === \"SessionEnd\") return DEFAULT_SESSION_END_HOOK_TIMEOUT_SECONDS;\n\tif (input.hook_event_name === \"UserPromptSubmit\") return DEFAULT_USER_PROMPT_HOOK_TIMEOUT_SECONDS;\n\treturn DEFAULT_HOOK_TIMEOUT_SECONDS;\n}\n\nfunction hookTimeoutSeconds(handler: HookHandlerCommon, input: HookInput, options?: HookRunOptions): number {\n\tif (options?.timeoutSeconds !== undefined) return options.timeoutSeconds;\n\tconst timeout = handler.timeout ?? defaultHookTimeoutSeconds(input);\n\treturn input.hook_event_name === \"SessionEnd\" ? Math.min(timeout, MAX_SESSION_END_HOOK_TIMEOUT_SECONDS) : timeout;\n}\nexport function sanitizedHookEnvironment(source: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {\n\tconst result: NodeJS.ProcessEnv = {};\n\tfor (const [key, value] of Object.entries(source)) {\n\t\tif (key.startsWith(\"OTEL_\")) continue;\n\t\tif (/^(?:GRIP|PI)_.*(?:TOKEN|CREDENTIAL|API_KEY|SECRET|PASSWORD)/i.test(key)) continue;\n\t\tresult[key] = value;\n\t}\n\treturn result;\n}\nfunction appendBounded(current: Buffer, chunk: Buffer, maximum: number): BoundedBufferAppendResult {\n\tif (current.length >= maximum) return { value: current, truncated: chunk.length > 0 };\n\tconst remaining = maximum - current.length;\n\treturn { value: Buffer.concat([current, chunk.subarray(0, remaining)]), truncated: chunk.length > remaining };\n}\nfunction exitTwoBlocks(input: HookInput): boolean {\n\treturn (\n\t\tinput.hook_event_name === \"PreToolUse\" ||\n\t\tinput.hook_event_name === \"UserPromptSubmit\" ||\n\t\tinput.hook_event_name === \"Stop\" ||\n\t\tinput.hook_event_name === \"PreCompact\"\n\t);\n}\nfunction structuredBlockingReason(output: HookOutputClassification, input: HookInput): string | undefined {\n\tif (output.kind !== \"json\") return undefined;\n\tif (output.value.continue === false && typeof output.value.stopReason === \"string\") return output.value.stopReason;\n\tif (input.hook_event_name === \"PreToolUse\") {\n\t\tconst specific = output.value.hookSpecificOutput;\n\t\tif (\n\t\t\tspecific?.hookEventName === input.hook_event_name &&\n\t\t\tspecific.permissionDecision === \"deny\" &&\n\t\t\ttypeof specific.permissionDecisionReason === \"string\"\n\t\t) {\n\t\t\treturn specific.permissionDecisionReason;\n\t\t}\n\t}\n\tif (output.value.decision === \"block\" && typeof output.value.reason === \"string\") return output.value.reason;\n\treturn undefined;\n}\nfunction diagnostic(hook: LoadedHookHandler, code: HookDiagnosticCode, message: string): HookDiagnostic {\n\treturn { level: \"warning\", code, message, source: hook.source, event: hook.event };\n}\nfunction resultBase(\n\thook: LoadedHookHandler,\n\tstarted: number,\n\tpartial: Partial<HookExecutionResult>,\n): HookExecutionResult {\n\treturn {\n\t\thook,\n\t\tstatus: \"error\",\n\t\texitCode: null,\n\t\tstdout: \"\",\n\t\tstderr: \"\",\n\t\tstdoutTruncated: false,\n\t\tstderrTruncated: false,\n\t\toutput: { kind: \"empty\" },\n\t\tblocking: false,\n\t\tdurationMs: performance.now() - started,\n\t\t...partial,\n\t};\n}\n\nfunction completedCommandStatus(state: CompletedCommandState): HookExecutionStatus {\n\tif (state.outputLimitExceeded) return \"error\";\n\tif (state.timedOut) return \"timeout\";\n\tif (state.cancelled) return \"cancelled\";\n\treturn \"completed\";\n}\n\nfunction completedCommandDiagnostic(\n\thook: LoadedHookHandler,\n\tstate: CompletedCommandState,\n\toutput: HookOutputClassification,\n): HookDiagnostic | undefined {\n\tif (state.outputLimitExceeded) {\n\t\treturn diagnostic(hook, \"execution\", \"Hook output exceeded the execution limit\");\n\t}\n\tif (output.kind !== \"text\" || !output.malformedJson) return undefined;\n\treturn diagnostic(hook, \"malformed-output\", \"Hook stdout looked like JSON but was malformed; output was ignored\");\n}\n\nfunction completedCommandResult(\n\thook: LoadedHookHandler,\n\tstarted: number,\n\tinput: HookInput,\n\texitCode: number | null,\n\tstate: CompletedCommandState,\n): HookExecutionResult {\n\tconst stdout = state.stdout.toString(\"utf8\");\n\tconst stderr = state.stderr.toString(\"utf8\");\n\tconst output = state.outputLimitExceeded ? { kind: \"empty\" as const } : classifyHookOutput(stdout);\n\tconst outputDiagnostic = completedCommandDiagnostic(hook, state, output);\n\tconst blocking =\n\t\t!state.timedOut && !state.cancelled && !state.outputLimitExceeded && exitCode === 2 && exitTwoBlocks(input);\n\treturn resultBase(hook, started, {\n\t\tstatus: completedCommandStatus(state),\n\t\texitCode,\n\t\tstdout,\n\t\tstderr,\n\t\tstdoutTruncated: state.stdoutTruncated,\n\t\tstderrTruncated: state.stderrTruncated,\n\t\toutput,\n\t\tdiagnostic: outputDiagnostic,\n\t\tblocking,\n\t\t...(blocking\n\t\t\t? { blockingReason: structuredBlockingReason(output, input) ?? (stderr.trim() || \"Hook blocked the action\") }\n\t\t\t: {}),\n\t});\n}\n\nfunction shellQuote(value: string): string {\n\treturn `'${value.replace(/'/g, `'\\\\''`)}'`;\n}\n\nfunction projectHookUsesWorkspaceBackend(hook: LoadedHookHandler, options: HookRunOptions): boolean {\n\tif (hook.source.kind !== \"project\" && hook.source.kind !== \"local\") return false;\n\treturn options.toolOperations?.getBackendInfo?.()?.type !== \"local\";\n}\n\nconst WORKSPACE_HOOK_RUNNER = String.raw`\nconst { spawn } = require(\"node:child_process\");\nconst spec = JSON.parse(Buffer.from(process.argv[1], \"base64\").toString(\"utf8\"));\nconst env = { ...process.env };\nfor (const name of Object.keys(env)) {\n  if (name.startsWith(\"OTEL_\") || /^(?:GRIP|PI)_.*(?:TOKEN|CREDENTIAL|API_KEY|SECRET|PASSWORD)/i.test(name)) delete env[name];\n}\nconst frame = (stream, data) => process.stdout.write(\"GRIPHOOK1 \" + stream + \" \" + Buffer.from(data).toString(\"base64\") + \"\\n\");\nlet failed = false;\nconst child = spawn(spec.file, spec.args, { cwd: spec.cwd, env, stdio: [\"pipe\", \"pipe\", \"pipe\"], windowsHide: true });\nchild.stdout.on(\"data\", (data) => frame(\"stdout\", data));\nchild.stderr.on(\"data\", (data) => frame(\"stderr\", data));\nchild.on(\"error\", (error) => { failed = true; frame(\"stderr\", Buffer.from(String(error))); process.exitCode = 127; });\nchild.on(\"close\", (code) => { if (!failed) process.exitCode = code === null ? 1 : code; });\nchild.stdin.on(\"error\", () => {});\nchild.stdin.end(Buffer.from(spec.stdinBase64, \"base64\"));\n`;\n\ninterface WorkspaceHookPreparation {\n\tok: boolean;\n\tcommand?: string;\n\tinput: HookInput;\n}\n\ninterface WorkspaceHookOutputState {\n\tmaximum: number;\n\tstdout: Buffer;\n\tstderr: Buffer;\n\tstdoutTruncated: boolean;\n\tstderrTruncated: boolean;\n\tpending: string;\n\toutputLimitExceeded: boolean;\n\toutputController: AbortController;\n}\n\nfunction prepareWorkspaceHook(\n\thandler: CommandHookHandler,\n\tinput: HookInput,\n\tcwd: string,\n\tpathFlavor: PortablePathFlavor,\n): WorkspaceHookPreparation {\n\tconst workspaceInput = { ...input, cwd };\n\tconst stdin = Buffer.from(JSON.stringify(workspaceInput));\n\tif (stdin.byteLength > 256 * 1024) return { ok: false, input: workspaceInput };\n\tlet file = handler.command;\n\tlet args = handler.args ?? [];\n\tif (handler.args === undefined) {\n\t\tif (handler.shell === \"powershell\" || (handler.shell === undefined && pathFlavor === \"windows\")) {\n\t\t\tfile = pathFlavor === \"windows\" ? \"powershell.exe\" : \"pwsh\";\n\t\t\targs = [\"-NoProfile\", \"-Command\", handler.command];\n\t\t} else {\n\t\t\tfile = handler.shell === \"bash\" ? \"bash\" : \"/bin/sh\";\n\t\t\targs = [\"-c\", handler.command];\n\t\t}\n\t}\n\tconst spec = Buffer.from(JSON.stringify({ file, args, cwd, stdinBase64: stdin.toString(\"base64\") })).toString(\n\t\t\"base64\",\n\t);\n\treturn {\n\t\tok: true,\n\t\tcommand: `node -e ${shellQuote(WORKSPACE_HOOK_RUNNER)} ${shellQuote(spec)}`,\n\t\tinput: workspaceInput,\n\t};\n}\n\nfunction createWorkspaceHookOutputState(maximum: number): WorkspaceHookOutputState {\n\treturn {\n\t\tmaximum,\n\t\tstdout: Buffer.alloc(0),\n\t\tstderr: Buffer.alloc(0),\n\t\tstdoutTruncated: false,\n\t\tstderrTruncated: false,\n\t\tpending: \"\",\n\t\toutputLimitExceeded: false,\n\t\toutputController: new AbortController(),\n\t};\n}\n\nfunction exceedWorkspaceHookOutputLimit(state: WorkspaceHookOutputState): void {\n\tif (state.outputLimitExceeded) return;\n\tstate.outputLimitExceeded = true;\n\tstate.outputController.abort();\n}\n\nfunction consumeWorkspaceHookLine(state: WorkspaceHookOutputState, line: string): void {\n\tconst match = /^GRIPHOOK1 (stdout|stderr) ([A-Za-z0-9+/]*={0,2})$/.exec(line);\n\tif (!match) {\n\t\tconst next = appendBounded(state.stderr, Buffer.from(`${line}\\n`), state.maximum);\n\t\tstate.stderr = next.value;\n\t\tstate.stderrTruncated ||= next.truncated;\n\t\tif (next.truncated) exceedWorkspaceHookOutputLimit(state);\n\t\treturn;\n\t}\n\tconst chunk = Buffer.from(match[2], \"base64\");\n\tif (match[1] === \"stdout\") {\n\t\tconst next = appendBounded(state.stdout, chunk, state.maximum);\n\t\tstate.stdout = next.value;\n\t\tstate.stdoutTruncated ||= next.truncated;\n\t} else {\n\t\tconst next = appendBounded(state.stderr, chunk, state.maximum);\n\t\tstate.stderr = next.value;\n\t\tstate.stderrTruncated ||= next.truncated;\n\t}\n\tif (state.stdoutTruncated || state.stderrTruncated) exceedWorkspaceHookOutputLimit(state);\n}\n\nfunction consumeWorkspaceHookData(state: WorkspaceHookOutputState, data: Buffer): void {\n\tif (state.outputLimitExceeded) return;\n\tstate.pending += data.toString(\"utf8\");\n\tconst maximumFrameChars = Math.ceil((state.maximum * 4) / 3) + 1024;\n\tif (state.pending.length > maximumFrameChars) {\n\t\tstate.pending = state.pending.slice(0, maximumFrameChars);\n\t\tstate.stderrTruncated = true;\n\t\texceedWorkspaceHookOutputLimit(state);\n\t\treturn;\n\t}\n\tconst lines = state.pending.split(\"\\n\");\n\tstate.pending = lines.pop() ?? \"\";\n\tfor (const line of lines) consumeWorkspaceHookLine(state, line.replace(/\\r$/, \"\"));\n}\n\nfunction completeWorkspaceHookOutput(state: WorkspaceHookOutputState): void {\n\tif (state.pending) consumeWorkspaceHookLine(state, state.pending);\n}\n\nfunction completedWorkspaceHookResult(\n\thook: LoadedHookHandler,\n\tstarted: number,\n\tinput: HookInput,\n\tstate: WorkspaceHookOutputState,\n\texitCode: number | null,\n): HookExecutionResult {\n\tconst stdout = state.stdout.toString(\"utf8\");\n\tconst stderr = state.stderr.toString(\"utf8\");\n\tconst output = state.outputLimitExceeded ? { kind: \"empty\" as const } : classifyHookOutput(stdout);\n\tlet outputDiagnostic: HookDiagnostic | undefined;\n\tif (output.kind === \"text\" && output.malformedJson) {\n\t\toutputDiagnostic = diagnostic(\n\t\t\thook,\n\t\t\t\"malformed-output\",\n\t\t\t\"Hook stdout looked like JSON but was malformed; output was ignored\",\n\t\t);\n\t} else if (state.outputLimitExceeded) {\n\t\toutputDiagnostic = diagnostic(hook, \"execution\", \"Project hook output exceeded the workspace execution limit\");\n\t}\n\tconst blocking = !state.outputLimitExceeded && exitCode === 2 && exitTwoBlocks(input);\n\treturn resultBase(hook, started, {\n\t\tstatus: state.outputLimitExceeded ? \"error\" : \"completed\",\n\t\texitCode,\n\t\tstdout,\n\t\tstderr,\n\t\tstdoutTruncated: state.stdoutTruncated,\n\t\tstderrTruncated: state.stderrTruncated,\n\t\toutput,\n\t\tdiagnostic: outputDiagnostic,\n\t\tblocking,\n\t\t...(blocking\n\t\t\t? { blockingReason: structuredBlockingReason(output, input) ?? (stderr.trim() || \"Hook blocked the action\") }\n\t\t\t: {}),\n\t});\n}\n\nfunction failedWorkspaceHookResult(\n\thook: LoadedHookHandler,\n\tstarted: number,\n\toptions: HookRunOptions,\n\tstate: WorkspaceHookOutputState,\n\terror: unknown,\n): HookExecutionResult {\n\tconst cancelled = !state.outputLimitExceeded && options.signal?.aborted === true;\n\treturn resultBase(hook, started, {\n\t\tstatus: cancelled ? \"cancelled\" : \"error\",\n\t\tstdout: state.stdout.toString(\"utf8\"),\n\t\tstderr: state.stderr.toString(\"utf8\"),\n\t\tstdoutTruncated: state.stdoutTruncated,\n\t\tstderrTruncated: state.stderrTruncated,\n\t\tdiagnostic: state.outputLimitExceeded\n\t\t\t? diagnostic(hook, \"execution\", \"Project hook output exceeded the workspace execution limit\")\n\t\t\t: cancelled\n\t\t\t\t? undefined\n\t\t\t\t: diagnostic(hook, \"execution\", `Workspace project hook failed: ${String(error)}`),\n\t});\n}\nasync function executeWorkspaceCommand(\n\thook: LoadedHookHandler,\n\thandler: CommandHookHandler,\n\tinput: HookInput,\n\toptions: HookRunOptions,\n): Promise<HookExecutionResult> {\n\tconst started = performance.now();\n\tconst operations = options.toolOperations;\n\tconst backend = operations?.getBackendInfo?.();\n\tif (!operations || !backend || backend.type === \"local\" || (backend.type === \"remote\" && !backend.configured)) {\n\t\treturn resultBase(hook, started, {\n\t\t\tdiagnostic: diagnostic(\n\t\t\t\thook,\n\t\t\t\t\"policy\",\n\t\t\t\t\"Project hook was not executed because the workspace backend is unavailable\",\n\t\t\t),\n\t\t});\n\t}\n\tconst pathFlavor = backend.type === \"remote\" && backend.configured ? backend.workspace.pathFlavor : \"posix\";\n\tconst preparation = prepareWorkspaceHook(handler, input, backend.cwd, pathFlavor);\n\tif (!preparation.ok || !preparation.command) {\n\t\treturn resultBase(hook, started, {\n\t\t\tdiagnostic: diagnostic(hook, \"policy\", \"Project hook input exceeds the workspace execution limit\"),\n\t\t});\n\t}\n\tconst state = createWorkspaceHookOutputState(options.maxOutputBytes ?? DEFAULT_MAX_HOOK_OUTPUT_BYTES);\n\tconst signals = [options.signal, state.outputController.signal].filter(\n\t\t(signal): signal is AbortSignal => signal !== undefined,\n\t);\n\tconst signal = signals.length === 1 ? signals[0] : AbortSignal.any(signals);\n\ttry {\n\t\tconst result = await operations.exec(preparation.command, {\n\t\t\tcwd: backend.cwd,\n\t\t\tonData: (data) => consumeWorkspaceHookData(state, data),\n\t\t\tsignal,\n\t\t\ttimeout: hookTimeoutSeconds(handler, preparation.input, options),\n\t\t});\n\t\tcompleteWorkspaceHookOutput(state);\n\t\treturn completedWorkspaceHookResult(hook, started, preparation.input, state, result.exitCode);\n\t} catch (error) {\n\t\treturn failedWorkspaceHookResult(hook, started, options, state, error);\n\t}\n}\n\nasync function executeCommand(\n\thook: LoadedHookHandler,\n\thandler: CommandHookHandler,\n\tinput: HookInput,\n\toptions: HookRunOptions,\n): Promise<HookExecutionResult> {\n\tif (projectHookUsesWorkspaceBackend(hook, options)) return executeWorkspaceCommand(hook, handler, input, options);\n\tconst started = performance.now();\n\tconst timeoutMs = hookTimeoutSeconds(handler, input, options) * 1000;\n\tconst maximum = options.maxOutputBytes ?? DEFAULT_MAX_HOOK_OUTPUT_BYTES;\n\tconst useExec = handler.args !== undefined;\n\tlet command = handler.command;\n\tlet args = handler.args ?? [];\n\tif (!useExec) {\n\t\tif (handler.shell === \"powershell\") {\n\t\t\tcommand = process.platform === \"win32\" ? \"powershell.exe\" : \"pwsh\";\n\t\t\targs = [\"-NoProfile\", \"-Command\", handler.command];\n\t\t} else if (handler.shell === \"bash\") {\n\t\t\tcommand = \"bash\";\n\t\t\targs = [\"-c\", handler.command];\n\t\t} else if (process.platform === \"win32\") {\n\t\t\tcommand = \"powershell.exe\";\n\t\t\targs = [\"-NoProfile\", \"-Command\", handler.command];\n\t\t} else {\n\t\t\tcommand = \"/bin/sh\";\n\t\t\targs = [\"-c\", handler.command];\n\t\t}\n\t}\n\treturn await new Promise((resolve) => {\n\t\tlet child: ChildProcessWithoutNullStreams;\n\t\ttry {\n\t\t\tchild = spawn(command, args, {\n\t\t\t\tcwd: input.cwd,\n\t\t\t\tenv: sanitizedHookEnvironment(options.env),\n\t\t\t\tstdio: [\"pipe\", \"pipe\", \"pipe\"],\n\t\t\t\tdetached: process.platform !== \"win32\",\n\t\t\t\twindowsHide: true,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tresolve(resultBase(hook, started, { diagnostic: diagnostic(hook, \"execution\", String(error)) }));\n\t\t\treturn;\n\t\t}\n\t\tlet stdout: Buffer = Buffer.alloc(0);\n\t\tlet stderr: Buffer = Buffer.alloc(0);\n\t\tlet stdoutTruncated = false;\n\t\tlet stderrTruncated = false;\n\t\tlet outputLimitExceeded = false;\n\t\tlet settled = false;\n\t\tlet timedOut = false;\n\t\tlet cancelled = false;\n\t\tconst platform = options.platform ?? process.platform;\n\t\tlet windowsTerminationStarted = false;\n\t\tconst terminateWindowsTree = (pid: number) => {\n\t\t\tif (windowsTerminationStarted) return;\n\t\t\twindowsTerminationStarted = true;\n\t\t\tconst fallback = () => {\n\t\t\t\tif (child.exitCode === null && child.signalCode === null) child.kill(\"SIGKILL\");\n\t\t\t};\n\t\t\tif (options.terminateWindowsProcessTree) {\n\t\t\t\t// The abstraction is invoked before any direct-child fallback, matching taskkill ordering.\n\t\t\t\tif (!options.terminateWindowsProcessTree(pid)) fallback();\n\t\t\t\treturn;\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst killer = spawn(\"taskkill\", [\"/PID\", String(pid), \"/T\", \"/F\"], {\n\t\t\t\t\tstdio: \"ignore\",\n\t\t\t\t\twindowsHide: true,\n\t\t\t\t});\n\t\t\t\tconst bound = setTimeout(() => {\n\t\t\t\t\tkiller.kill();\n\t\t\t\t\tfallback();\n\t\t\t\t}, 1000);\n\t\t\t\tbound.unref();\n\t\t\t\tkiller.once(\"close\", (code) => {\n\t\t\t\t\tclearTimeout(bound);\n\t\t\t\t\tif (code !== 0) fallback();\n\t\t\t\t});\n\t\t\t\tkiller.once(\"error\", () => {\n\t\t\t\t\tclearTimeout(bound);\n\t\t\t\t\tfallback();\n\t\t\t\t});\n\t\t\t} catch {\n\t\t\t\tfallback();\n\t\t\t}\n\t\t};\n\t\tconst terminate = () => {\n\t\t\tif (child.pid && platform === \"win32\") {\n\t\t\t\t// taskkill /T /F gets a bounded opportunity before direct-child fallback.\n\t\t\t\tterminateWindowsTree(child.pid);\n\t\t\t} else if (child.pid) {\n\t\t\t\ttry {\n\t\t\t\t\tprocess.kill(-child.pid, \"SIGTERM\");\n\t\t\t\t} catch {\n\t\t\t\t\tchild.kill(\"SIGTERM\");\n\t\t\t\t}\n\t\t\t} else child.kill(\"SIGTERM\");\n\t\t\tsetTimeout(() => {\n\t\t\t\tforceTerminateChildProcess(child, platform, terminateWindowsTree);\n\t\t\t}, 250).unref();\n\t\t};\n\t\tconst onAbort = () => {\n\t\t\tcancelled = true;\n\t\t\tterminate();\n\t\t};\n\t\tif (options.signal?.aborted) onAbort();\n\t\telse options.signal?.addEventListener(\"abort\", onAbort, { once: true });\n\t\tconst timer = setTimeout(() => {\n\t\t\ttimedOut = true;\n\t\t\tterminate();\n\t\t}, timeoutMs);\n\t\tchild.stdout.on(\"data\", (data: Buffer) => {\n\t\t\tconst next = appendBounded(stdout, data, maximum);\n\t\t\tstdout = next.value;\n\t\t\tstdoutTruncated ||= next.truncated;\n\t\t\tif (next.truncated && !outputLimitExceeded) {\n\t\t\t\toutputLimitExceeded = true;\n\t\t\t\tterminate();\n\t\t\t}\n\t\t});\n\t\tchild.stderr.on(\"data\", (data: Buffer) => {\n\t\t\tconst next = appendBounded(stderr, data, maximum);\n\t\t\tstderr = next.value;\n\t\t\tstderrTruncated ||= next.truncated;\n\t\t\tif (next.truncated && !outputLimitExceeded) {\n\t\t\t\toutputLimitExceeded = true;\n\t\t\t\tterminate();\n\t\t\t}\n\t\t});\n\t\tchild.on(\"error\", (error) => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timer);\n\t\t\toptions.signal?.removeEventListener(\"abort\", onAbort);\n\t\t\tresolve(\n\t\t\t\tresultBase(hook, started, {\n\t\t\t\t\tstdout: stdout.toString(\"utf8\"),\n\t\t\t\t\tstderr: stderr.toString(\"utf8\"),\n\t\t\t\t\tstdoutTruncated,\n\t\t\t\t\tstderrTruncated,\n\t\t\t\t\tdiagnostic: diagnostic(hook, \"execution\", String(error)),\n\t\t\t\t}),\n\t\t\t);\n\t\t});\n\t\tchild.on(\"close\", (code) => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timer);\n\t\t\toptions.signal?.removeEventListener(\"abort\", onAbort);\n\t\t\tresolve(\n\t\t\t\tcompletedCommandResult(hook, started, input, code, {\n\t\t\t\t\tstdout,\n\t\t\t\t\tstderr,\n\t\t\t\t\tstdoutTruncated,\n\t\t\t\t\tstderrTruncated,\n\t\t\t\t\toutputLimitExceeded,\n\t\t\t\t\ttimedOut,\n\t\t\t\t\tcancelled,\n\t\t\t\t}),\n\t\t\t);\n\t\t});\n\t\tchild.stdin.on(\"error\", () => undefined);\n\t\tchild.stdin.end(JSON.stringify(input));\n\t});\n}\nfunction interpolateHeader(value: string, allowed: Set<string>, env: NodeJS.ProcessEnv): string {\n\treturn value.replace(\n\t\t/\\$(?:\\{([A-Za-z_][A-Za-z0-9_]*)\\}|([A-Za-z_][A-Za-z0-9_]*))/g,\n\t\t(_match, braced: string | undefined, bare: string | undefined) => {\n\t\t\tconst name = braced ?? bare ?? \"\";\n\t\t\treturn allowed.has(name) ? (env[name] ?? \"\") : \"\";\n\t\t},\n\t);\n}\nfunction httpHookTransportAllowed(value: string): boolean {\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(value);\n\t} catch {\n\t\treturn false;\n\t}\n\tif (url.protocol === \"https:\") return true;\n\tif (url.protocol !== \"http:\") return false;\n\tconst hostname = url.hostname.replace(/^\\[|\\]$/g, \"\").toLowerCase();\n\treturn (\n\t\thostname === \"localhost\" ||\n\t\thostname === \"::1\" ||\n\t\t/^127(?:\\.[0-9]{1,3}){3}$/.test(hostname) ||\n\t\t/^::ffff:127(?:\\.[0-9]{1,3}){3}$/.test(hostname)\n\t);\n}\n\ninterface HttpHookResponseBody {\n\tstdout: string;\n\ttruncated: boolean;\n}\n\nfunction createHttpHookHeaders(\n\thook: LoadedHookHandler,\n\thandler: HttpHookHandler,\n\toptions: HookRunOptions,\n\tenv: NodeJS.ProcessEnv,\n): Record<string, string> {\n\tconst settingsAllowed = new Set(hook.httpHookAllowedEnvVars ?? handler.allowedEnvVars ?? []);\n\tconst hostAllowed = options.httpHookAllowedEnvVars ? new Set(options.httpHookAllowedEnvVars) : undefined;\n\tconst allowed = new Set([...settingsAllowed].filter((name) => !hostAllowed || hostAllowed.has(name)));\n\tconst headers: Record<string, string> = { \"content-type\": \"application/json\" };\n\tfor (const [key, value] of Object.entries(handler.headers ?? {})) {\n\t\theaders[key] = interpolateHeader(value, allowed, env);\n\t}\n\treturn headers;\n}\n\nasync function readHttpHookResponseBody(response: Response, maximum: number): Promise<HttpHookResponseBody> {\n\tlet raw: Buffer = Buffer.alloc(0);\n\tlet truncated = false;\n\tif (!response.body) return { stdout: \"\", truncated };\n\n\tconst reader = response.body.getReader();\n\ttry {\n\t\twhile (true) {\n\t\t\tconst next = await reader.read();\n\t\t\tif (next.done) break;\n\t\t\tconst bounded = appendBounded(raw, Buffer.from(next.value), maximum);\n\t\t\traw = bounded.value;\n\t\t\ttruncated ||= bounded.truncated;\n\t\t\tif (!truncated) continue;\n\t\t\tawait reader.cancel();\n\t\t\tbreak;\n\t\t}\n\t} finally {\n\t\treader.releaseLock();\n\t}\n\treturn { stdout: raw.toString(\"utf8\"), truncated };\n}\n\nfunction completedHttpHookResult(\n\thook: LoadedHookHandler,\n\tstarted: number,\n\tresponse: Response,\n\tbody: HttpHookResponseBody,\n): HookExecutionResult {\n\tlet output: HookOutputClassification = { kind: \"empty\" };\n\tlet responseDiagnostic: HookDiagnostic | undefined;\n\tif (body.truncated) {\n\t\tresponseDiagnostic = diagnostic(hook, \"execution\", \"HTTP hook output exceeded the execution limit\");\n\t} else if (response.status >= 300 && response.status < 400) {\n\t\tresponseDiagnostic = diagnostic(hook, \"policy\", \"HTTP hook redirects are rejected\");\n\t} else if (!response.ok) {\n\t\tresponseDiagnostic = diagnostic(hook, \"execution\", `HTTP hook returned ${response.status}`);\n\t} else {\n\t\tconst classified = classifyHookOutput(body.stdout);\n\t\tif (classified.kind === \"json\" || classified.kind === \"empty\") output = classified;\n\t\telse {\n\t\t\tresponseDiagnostic = diagnostic(\n\t\t\t\thook,\n\t\t\t\t\"malformed-output\",\n\t\t\t\t\"HTTP hook 2xx response was not structured JSON; response was ignored\",\n\t\t\t);\n\t\t}\n\t}\n\treturn resultBase(hook, started, {\n\t\tstatus: body.truncated ? \"error\" : \"completed\",\n\t\texitCode: response.ok && !body.truncated ? 0 : 1,\n\t\tstdout: body.stdout,\n\t\tstderr: \"\",\n\t\tstdoutTruncated: body.truncated,\n\t\toutput,\n\t\tdiagnostic: responseDiagnostic,\n\t});\n}\n\nfunction failedHttpHookResult(\n\thook: LoadedHookHandler,\n\tstarted: number,\n\ttimedOut: boolean,\n\tcancelled: boolean,\n\terror: unknown,\n): HookExecutionResult {\n\treturn resultBase(hook, started, {\n\t\tstatus: timedOut ? \"timeout\" : cancelled ? \"cancelled\" : \"error\",\n\t\tdiagnostic:\n\t\t\ttimedOut || cancelled ? undefined : diagnostic(hook, \"execution\", `HTTP hook failed: ${String(error)}`),\n\t});\n}\n\nasync function executeHttp(\n\thook: LoadedHookHandler,\n\thandler: HttpHookHandler,\n\tinput: HookInput,\n\toptions: HookRunOptions,\n): Promise<HookExecutionResult> {\n\tconst started = performance.now();\n\tif (!httpHookTransportAllowed(handler.url)) {\n\t\treturn resultBase(hook, started, {\n\t\t\tdiagnostic: diagnostic(hook, \"policy\", `HTTP hook requires HTTPS unless it targets loopback: ${handler.url}`),\n\t\t});\n\t}\n\tif (projectHookUsesWorkspaceBackend(hook, options)) {\n\t\treturn resultBase(hook, started, {\n\t\t\tdiagnostic: diagnostic(\n\t\t\t\thook,\n\t\t\t\t\"policy\",\n\t\t\t\t\"Project HTTP hooks are disabled on non-local workspace backends to prevent host-network escape\",\n\t\t\t),\n\t\t});\n\t}\n\n\tconst controller = new AbortController();\n\tconst timeoutMs = hookTimeoutSeconds(handler, input, options) * 1000;\n\tlet timedOut = false;\n\tlet cancelled = false;\n\tconst onAbort = () => {\n\t\tcancelled = true;\n\t\tcontroller.abort();\n\t};\n\tif (options.signal?.aborted) onAbort();\n\telse options.signal?.addEventListener(\"abort\", onAbort, { once: true });\n\tconst timer = setTimeout(() => {\n\t\ttimedOut = true;\n\t\tcontroller.abort();\n\t}, timeoutMs);\n\n\ttry {\n\t\tconst env = sanitizedHookEnvironment(options.env);\n\t\tif (options.allowedHttpHookUrls && !urlAllowed(handler.url, options.allowedHttpHookUrls)) {\n\t\t\treturn resultBase(hook, started, {\n\t\t\t\tdiagnostic: diagnostic(hook, \"policy\", `HTTP hook URL is blocked by the host: ${handler.url}`),\n\t\t\t});\n\t\t}\n\t\tconst headers = createHttpHookHeaders(hook, handler, options, env);\n\t\tconst response = await (options.fetch ?? globalThis.fetch)(handler.url, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders,\n\t\t\tbody: JSON.stringify(input),\n\t\t\tsignal: controller.signal,\n\t\t\tredirect: \"error\",\n\t\t});\n\t\tconst body = await readHttpHookResponseBody(response, options.maxOutputBytes ?? DEFAULT_MAX_HOOK_OUTPUT_BYTES);\n\t\treturn completedHttpHookResult(hook, started, response, body);\n\t} catch (error) {\n\t\treturn failedHttpHookResult(hook, started, timedOut, cancelled, error);\n\t} finally {\n\t\tclearTimeout(timer);\n\t\toptions.signal?.removeEventListener(\"abort\", onAbort);\n\t}\n}\n\nfunction urlAllowed(url: string, allowlist: readonly string[]): boolean {\n\treturn allowlist.some((pattern) => {\n\t\tif (pattern === url) return true;\n\t\tconst expression = pattern\n\t\t\t.split(\"*\")\n\t\t\t.map((part) => part.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\"))\n\t\t\t.join(\".*\");\n\t\treturn new RegExp(`^${expression}$`).test(url);\n\t});\n}\n\nexport async function executeHook(\n\thook: LoadedHookHandler,\n\tinput: HookInput,\n\toptions: HookRunOptions = {},\n): Promise<HookExecutionResult> {\n\tconst started = performance.now();\n\tif (options.signal?.aborted) return resultBase(hook, started, { status: \"cancelled\" });\n\tif (hook.handler.type === \"prompt\" || hook.handler.type === \"agent\" || hook.handler.type === \"mcp_tool\") {\n\t\treturn resultBase(hook, started, {\n\t\t\tstatus: \"unsupported\",\n\t\t\tdiagnostic: diagnostic(hook, \"unsupported-handler\", `${hook.handler.type} handlers are unsupported`),\n\t\t});\n\t}\n\tif (hook.handler.type === \"command\") return executeCommand(hook, hook.handler, input, options);\n\tif (hook.handler.type === \"http\") return executeHttp(hook, hook.handler, input, options);\n\treturn resultBase(hook, started, { status: \"unsupported\" });\n}\n\nexport async function executeMatchingHooks(\n\thooks: readonly LoadedHookHandler[],\n\tinput: HookInput,\n\toptions: HookRunOptions = {},\n): Promise<HookExecutionResult[]> {\n\tconst matching = hooks.filter(\n\t\t(hook) =>\n\t\t\thook.event === input.hook_event_name &&\n\t\t\tmatchesHookInput(hook.matcher, input).matches &&\n\t\t\tmatchesHookIf(hook.handler.if, input).matches,\n\t);\n\tconst runOptions =\n\t\tinput.hook_event_name === \"SessionEnd\"\n\t\t\t? {\n\t\t\t\t\t...options,\n\t\t\t\t\ttimeoutSeconds: Math.min(\n\t\t\t\t\t\tMAX_SESSION_END_HOOK_TIMEOUT_SECONDS,\n\t\t\t\t\t\tMath.max(\n\t\t\t\t\t\t\tDEFAULT_SESSION_END_HOOK_TIMEOUT_SECONDS,\n\t\t\t\t\t\t\t...matching.map((hook) => hook.handler.timeout ?? DEFAULT_SESSION_END_HOOK_TIMEOUT_SECONDS),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t}\n\t\t\t: options;\n\treturn Promise.all(matching.map((hook) => executeHook(hook, input, runOptions)));\n}\n"]}

package/dist/core/hooks/index.d.ts

@@ -0,0 +1,9 @@
+export { aggregateHookResults, capModelVisibleHookField, MAX_MODEL_VISIBLE_HOOK_FIELD_CHARS, } from "./aggregate.ts";
+export { freezeLoadedHooks, hookSettingsSources, type LoadHooksOptions, loadHooks } from "./config.ts";
+export { classifyHookOutput, DEFAULT_HOOK_TIMEOUT_SECONDS, DEFAULT_MAX_HOOK_OUTPUT_BYTES, DEFAULT_SESSION_END_HOOK_TIMEOUT_SECONDS, DEFAULT_USER_PROMPT_HOOK_TIMEOUT_SECONDS, defaultHookTimeoutSeconds, executeHook, executeMatchingHooks, sanitizedHookEnvironment, } from "./executor.ts";
+export { hookMatcherValue, type MatcherResult, matchesHookIf, matchesHookInput, matchHookValue } from "./matcher.ts";
+export { canonicalProjectHookCwd, canonicalProjectHookIdentity, hasProjectHookConfiguration, PROJECT_HOOK_TRUST_STORE_FILENAME, PROJECT_HOOK_TRUST_STORE_VERSION, type ProjectHookTrustResult, ProjectHookTrustStore, } from "./trust-store.ts";
+export * from "./types.ts";
+import type { HookAggregateResult, HookInput, HookRunOptions, LoadedHooks } from "./types.ts";
+export declare function runHooks(loaded: LoadedHooks, input: HookInput, options?: HookRunOptions): Promise<HookAggregateResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/core/hooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/index.ts"],"names":[],"mappings":"AACA,OAAO,EACN,oBAAoB,EACpB,wBAAwB,EACxB,kCAAkC,GAClC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACvG,OAAO,EACN,kBAAkB,EAClB,4BAA4B,EAC5B,6BAA6B,EAC7B,wCAAwC,EACxC,wCAAwC,EACxC,yBAAyB,EACzB,WAAW,EACX,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,KAAK,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACrH,OAAO,EACN,uBAAuB,EACvB,4BAA4B,EAC5B,2BAA2B,EAC3B,iCAAiC,EACjC,gCAAgC,EAChC,KAAK,sBAAsB,EAC3B,qBAAqB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,cAAc,YAAY,CAAC;AAI3B,OAAO,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9F,wBAAsB,QAAQ,CAC7B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,mBAAmB,CAAC,CAG9B","sourcesContent":["// biome-ignore-all lint/performance/noBarrelFile: This is the public hooks subpath entry point.\nexport {\n\taggregateHookResults,\n\tcapModelVisibleHookField,\n\tMAX_MODEL_VISIBLE_HOOK_FIELD_CHARS,\n} from \"./aggregate.ts\";\nexport { freezeLoadedHooks, hookSettingsSources, type LoadHooksOptions, loadHooks } from \"./config.ts\";\nexport {\n\tclassifyHookOutput,\n\tDEFAULT_HOOK_TIMEOUT_SECONDS,\n\tDEFAULT_MAX_HOOK_OUTPUT_BYTES,\n\tDEFAULT_SESSION_END_HOOK_TIMEOUT_SECONDS,\n\tDEFAULT_USER_PROMPT_HOOK_TIMEOUT_SECONDS,\n\tdefaultHookTimeoutSeconds,\n\texecuteHook,\n\texecuteMatchingHooks,\n\tsanitizedHookEnvironment,\n} from \"./executor.ts\";\nexport { hookMatcherValue, type MatcherResult, matchesHookIf, matchesHookInput, matchHookValue } from \"./matcher.ts\";\nexport {\n\tcanonicalProjectHookCwd,\n\tcanonicalProjectHookIdentity,\n\thasProjectHookConfiguration,\n\tPROJECT_HOOK_TRUST_STORE_FILENAME,\n\tPROJECT_HOOK_TRUST_STORE_VERSION,\n\ttype ProjectHookTrustResult,\n\tProjectHookTrustStore,\n} from \"./trust-store.ts\";\nexport * from \"./types.ts\";\n\nimport { aggregateHookResults } from \"./aggregate.ts\";\nimport { executeMatchingHooks } from \"./executor.ts\";\nimport type { HookAggregateResult, HookInput, HookRunOptions, LoadedHooks } from \"./types.ts\";\n\nexport async function runHooks(\n\tloaded: LoadedHooks,\n\tinput: HookInput,\n\toptions: HookRunOptions = {},\n): Promise<HookAggregateResult> {\n\tconst results = await executeMatchingHooks(loaded.handlers, input, options);\n\treturn aggregateHookResults(input, results);\n}\n"]}

package/dist/core/hooks/index.js

@@ -0,0 +1,14 @@
+// biome-ignore-all lint/performance/noBarrelFile: This is the public hooks subpath entry point.
+export { aggregateHookResults, capModelVisibleHookField, MAX_MODEL_VISIBLE_HOOK_FIELD_CHARS, } from "./aggregate.js";
+export { freezeLoadedHooks, hookSettingsSources, loadHooks } from "./config.js";
+export { classifyHookOutput, DEFAULT_HOOK_TIMEOUT_SECONDS, DEFAULT_MAX_HOOK_OUTPUT_BYTES, DEFAULT_SESSION_END_HOOK_TIMEOUT_SECONDS, DEFAULT_USER_PROMPT_HOOK_TIMEOUT_SECONDS, defaultHookTimeoutSeconds, executeHook, executeMatchingHooks, sanitizedHookEnvironment, } from "./executor.js";
+export { hookMatcherValue, matchesHookIf, matchesHookInput, matchHookValue } from "./matcher.js";
+export { canonicalProjectHookCwd, canonicalProjectHookIdentity, hasProjectHookConfiguration, PROJECT_HOOK_TRUST_STORE_FILENAME, PROJECT_HOOK_TRUST_STORE_VERSION, ProjectHookTrustStore, } from "./trust-store.js";
+export * from "./types.js";
+import { aggregateHookResults } from "./aggregate.js";
+import { executeMatchingHooks } from "./executor.js";
+export async function runHooks(loaded, input, options = {}) {
+    const results = await executeMatchingHooks(loaded.handlers, input, options);
+    return aggregateHookResults(input, results);
+}
+//# sourceMappingURL=index.js.map

package/dist/core/hooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/hooks/index.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,EACN,oBAAoB,EACpB,wBAAwB,EACxB,kCAAkC,GAClC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAyB,SAAS,EAAE,MAAM,aAAa,CAAC;AACvG,OAAO,EACN,kBAAkB,EAClB,4BAA4B,EAC5B,6BAA6B,EAC7B,wCAAwC,EACxC,wCAAwC,EACxC,yBAAyB,EACzB,WAAW,EACX,oBAAoB,EACpB,wBAAwB,GACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAsB,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACrH,OAAO,EACN,uBAAuB,EACvB,4BAA4B,EAC5B,2BAA2B,EAC3B,iCAAiC,EACjC,gCAAgC,EAEhC,qBAAqB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,cAAc,YAAY,CAAC;AAE3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC7B,MAAmB,EACnB,KAAgB,EAChB,OAAO,GAAmB,EAAE,EACG;IAC/B,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5E,OAAO,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAAA,CAC5C","sourcesContent":["// biome-ignore-all lint/performance/noBarrelFile: This is the public hooks subpath entry point.\nexport {\n\taggregateHookResults,\n\tcapModelVisibleHookField,\n\tMAX_MODEL_VISIBLE_HOOK_FIELD_CHARS,\n} from \"./aggregate.ts\";\nexport { freezeLoadedHooks, hookSettingsSources, type LoadHooksOptions, loadHooks } from \"./config.ts\";\nexport {\n\tclassifyHookOutput,\n\tDEFAULT_HOOK_TIMEOUT_SECONDS,\n\tDEFAULT_MAX_HOOK_OUTPUT_BYTES,\n\tDEFAULT_SESSION_END_HOOK_TIMEOUT_SECONDS,\n\tDEFAULT_USER_PROMPT_HOOK_TIMEOUT_SECONDS,\n\tdefaultHookTimeoutSeconds,\n\texecuteHook,\n\texecuteMatchingHooks,\n\tsanitizedHookEnvironment,\n} from \"./executor.ts\";\nexport { hookMatcherValue, type MatcherResult, matchesHookIf, matchesHookInput, matchHookValue } from \"./matcher.ts\";\nexport {\n\tcanonicalProjectHookCwd,\n\tcanonicalProjectHookIdentity,\n\thasProjectHookConfiguration,\n\tPROJECT_HOOK_TRUST_STORE_FILENAME,\n\tPROJECT_HOOK_TRUST_STORE_VERSION,\n\ttype ProjectHookTrustResult,\n\tProjectHookTrustStore,\n} from \"./trust-store.ts\";\nexport * from \"./types.ts\";\n\nimport { aggregateHookResults } from \"./aggregate.ts\";\nimport { executeMatchingHooks } from \"./executor.ts\";\nimport type { HookAggregateResult, HookInput, HookRunOptions, LoadedHooks } from \"./types.ts\";\n\nexport async function runHooks(\n\tloaded: LoadedHooks,\n\tinput: HookInput,\n\toptions: HookRunOptions = {},\n): Promise<HookAggregateResult> {\n\tconst results = await executeMatchingHooks(loaded.handlers, input, options);\n\treturn aggregateHookResults(input, results);\n}\n"]}

package/dist/core/hooks/matcher.d.ts

@@ -0,0 +1,10 @@
+import type { HookInput } from "./types.ts";
+export interface MatcherResult {
+    matches: boolean;
+    error?: string;
+}
+export declare function matchHookValue(matcher: string | undefined, value: string): MatcherResult;
+export declare function hookMatcherValue(input: HookInput): string | undefined;
+export declare function matchesHookInput(matcher: string | undefined, input: HookInput): MatcherResult;
+export declare function matchesHookIf(pattern: string | undefined, input: HookInput): MatcherResult;
+//# sourceMappingURL=matcher.d.ts.map

package/dist/core/hooks/matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5C,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAUxF;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAmBrE;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,aAAa,CAI7F;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,aAAa,CA2B1F","sourcesContent":["import type { HookInput } from \"./types.ts\";\n\nconst EXACT_MATCHER = /^[A-Za-z0-9_\\- ,|]+$/;\n\nexport interface MatcherResult {\n\tmatches: boolean;\n\terror?: string;\n}\n\nexport function matchHookValue(matcher: string | undefined, value: string): MatcherResult {\n\tif (matcher === undefined || matcher === \"\" || matcher === \"*\") return { matches: true };\n\tif (EXACT_MATCHER.test(matcher)) {\n\t\treturn { matches: matcher.split(/[|,]/).some((alternative) => alternative.trim() === value) };\n\t}\n\ttry {\n\t\treturn { matches: new RegExp(matcher).test(value) };\n\t} catch (error) {\n\t\treturn { matches: false, error: `Invalid hook matcher ${JSON.stringify(matcher)}: ${String(error)}` };\n\t}\n}\n\nexport function hookMatcherValue(input: HookInput): string | undefined {\n\tswitch (input.hook_event_name) {\n\t\tcase \"SessionStart\":\n\t\t\treturn input.source;\n\t\tcase \"PreToolUse\":\n\t\tcase \"PostToolUse\":\n\t\tcase \"PostToolUseFailure\":\n\t\t\treturn input.tool_name;\n\t\tcase \"StopFailure\":\n\t\t\treturn input.error;\n\t\tcase \"PreCompact\":\n\t\tcase \"PostCompact\":\n\t\t\treturn input.trigger;\n\t\tcase \"SessionEnd\":\n\t\t\treturn input.reason;\n\t\tcase \"UserPromptSubmit\":\n\t\tcase \"Stop\":\n\t\t\treturn undefined;\n\t}\n}\n\nexport function matchesHookInput(matcher: string | undefined, input: HookInput): MatcherResult {\n\tconst value = hookMatcherValue(input);\n\t// Claude ignores matcher fields on events without matcher support.\n\treturn value === undefined ? { matches: true } : matchHookValue(matcher, value);\n}\n\nexport function matchesHookIf(pattern: string | undefined, input: HookInput): MatcherResult {\n\tif (pattern === undefined) return { matches: true };\n\tif (\n\t\tinput.hook_event_name !== \"PreToolUse\" &&\n\t\tinput.hook_event_name !== \"PostToolUse\" &&\n\t\tinput.hook_event_name !== \"PostToolUseFailure\"\n\t) {\n\t\treturn { matches: false };\n\t}\n\tconst open = pattern.indexOf(\"(\");\n\tif (open < 1 || !pattern.endsWith(\")\")) return matchHookValue(pattern, input.tool_name);\n\tif (pattern.slice(0, open) !== input.tool_name) return { matches: false };\n\tconst argumentPattern = pattern.slice(open + 1, -1);\n\tconst candidate =\n\t\ttypeof input.tool_input.command === \"string\"\n\t\t\t? input.tool_input.command\n\t\t\t: typeof input.tool_input.file_path === \"string\"\n\t\t\t\t? input.tool_input.file_path\n\t\t\t\t: JSON.stringify(input.tool_input);\n\tif (argumentPattern === \"*\") return { matches: true };\n\t// Permission-rule globs are intentionally limited here to their common '*' form.\n\tconst escaped = argumentPattern.replace(/[.+?^${}()|[\\]\\\\]/g, \"\\\\$&\").replaceAll(\"*\", \".*\");\n\ttry {\n\t\treturn { matches: new RegExp(`^${escaped}$`).test(candidate) };\n\t} catch (error) {\n\t\treturn { matches: false, error: `Invalid hook if condition ${JSON.stringify(pattern)}: ${String(error)}` };\n\t}\n}\n"]}

package/dist/core/hooks/matcher.js

@@ -0,0 +1,70 @@
+const EXACT_MATCHER = /^[A-Za-z0-9_\- ,|]+$/;
+export function matchHookValue(matcher, value) {
+    if (matcher === undefined || matcher === "" || matcher === "*")
+        return { matches: true };
+    if (EXACT_MATCHER.test(matcher)) {
+        return { matches: matcher.split(/[|,]/).some((alternative) => alternative.trim() === value) };
+    }
+    try {
+        return { matches: new RegExp(matcher).test(value) };
+    }
+    catch (error) {
+        return { matches: false, error: `Invalid hook matcher ${JSON.stringify(matcher)}: ${String(error)}` };
+    }
+}
+export function hookMatcherValue(input) {
+    switch (input.hook_event_name) {
+        case "SessionStart":
+            return input.source;
+        case "PreToolUse":
+        case "PostToolUse":
+        case "PostToolUseFailure":
+            return input.tool_name;
+        case "StopFailure":
+            return input.error;
+        case "PreCompact":
+        case "PostCompact":
+            return input.trigger;
+        case "SessionEnd":
+            return input.reason;
+        case "UserPromptSubmit":
+        case "Stop":
+            return undefined;
+    }
+}
+export function matchesHookInput(matcher, input) {
+    const value = hookMatcherValue(input);
+    // Claude ignores matcher fields on events without matcher support.
+    return value === undefined ? { matches: true } : matchHookValue(matcher, value);
+}
+export function matchesHookIf(pattern, input) {
+    if (pattern === undefined)
+        return { matches: true };
+    if (input.hook_event_name !== "PreToolUse" &&
+        input.hook_event_name !== "PostToolUse" &&
+        input.hook_event_name !== "PostToolUseFailure") {
+        return { matches: false };
+    }
+    const open = pattern.indexOf("(");
+    if (open < 1 || !pattern.endsWith(")"))
+        return matchHookValue(pattern, input.tool_name);
+    if (pattern.slice(0, open) !== input.tool_name)
+        return { matches: false };
+    const argumentPattern = pattern.slice(open + 1, -1);
+    const candidate = typeof input.tool_input.command === "string"
+        ? input.tool_input.command
+        : typeof input.tool_input.file_path === "string"
+            ? input.tool_input.file_path
+            : JSON.stringify(input.tool_input);
+    if (argumentPattern === "*")
+        return { matches: true };
+    // Permission-rule globs are intentionally limited here to their common '*' form.
+    const escaped = argumentPattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
+    try {
+        return { matches: new RegExp(`^${escaped}$`).test(candidate) };
+    }
+    catch (error) {
+        return { matches: false, error: `Invalid hook if condition ${JSON.stringify(pattern)}: ${String(error)}` };
+    }
+}
+//# sourceMappingURL=matcher.js.map

package/dist/core/hooks/matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../../../src/core/hooks/matcher.ts"],"names":[],"mappings":"AAEA,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAO7C,MAAM,UAAU,cAAc,CAAC,OAA2B,EAAE,KAAa,EAAiB;IACzF,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzF,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACvG,CAAC;AAAA,CACD;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAgB,EAAsB;IACtE,QAAQ,KAAK,CAAC,eAAe,EAAE,CAAC;QAC/B,KAAK,cAAc;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC;QACrB,KAAK,YAAY,CAAC;QAClB,KAAK,aAAa,CAAC;QACnB,KAAK,oBAAoB;YACxB,OAAO,KAAK,CAAC,SAAS,CAAC;QACxB,KAAK,aAAa;YACjB,OAAO,KAAK,CAAC,KAAK,CAAC;QACpB,KAAK,YAAY,CAAC;QAClB,KAAK,aAAa;YACjB,OAAO,KAAK,CAAC,OAAO,CAAC;QACtB,KAAK,YAAY;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC;QACrB,KAAK,kBAAkB,CAAC;QACxB,KAAK,MAAM;YACV,OAAO,SAAS,CAAC;IACnB,CAAC;AAAA,CACD;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA2B,EAAE,KAAgB,EAAiB;IAC9F,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,mEAAmE;IACnE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAAA,CAChF;AAED,MAAM,UAAU,aAAa,CAAC,OAA2B,EAAE,KAAgB,EAAiB;IAC3F,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpD,IACC,KAAK,CAAC,eAAe,KAAK,YAAY;QACtC,KAAK,CAAC,eAAe,KAAK,aAAa;QACvC,KAAK,CAAC,eAAe,KAAK,oBAAoB,EAC7C,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1E,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,SAAS,GACd,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,KAAK,QAAQ;QAC3C,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO;QAC1B,CAAC,CAAC,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,KAAK,QAAQ;YAC/C,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS;YAC5B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,eAAe,KAAK,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtD,iFAAiF;IACjF,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5F,IAAI,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC5G,CAAC;AAAA,CACD","sourcesContent":["import type { HookInput } from \"./types.ts\";\n\nconst EXACT_MATCHER = /^[A-Za-z0-9_\\- ,|]+$/;\n\nexport interface MatcherResult {\n\tmatches: boolean;\n\terror?: string;\n}\n\nexport function matchHookValue(matcher: string | undefined, value: string): MatcherResult {\n\tif (matcher === undefined || matcher === \"\" || matcher === \"*\") return { matches: true };\n\tif (EXACT_MATCHER.test(matcher)) {\n\t\treturn { matches: matcher.split(/[|,]/).some((alternative) => alternative.trim() === value) };\n\t}\n\ttry {\n\t\treturn { matches: new RegExp(matcher).test(value) };\n\t} catch (error) {\n\t\treturn { matches: false, error: `Invalid hook matcher ${JSON.stringify(matcher)}: ${String(error)}` };\n\t}\n}\n\nexport function hookMatcherValue(input: HookInput): string | undefined {\n\tswitch (input.hook_event_name) {\n\t\tcase \"SessionStart\":\n\t\t\treturn input.source;\n\t\tcase \"PreToolUse\":\n\t\tcase \"PostToolUse\":\n\t\tcase \"PostToolUseFailure\":\n\t\t\treturn input.tool_name;\n\t\tcase \"StopFailure\":\n\t\t\treturn input.error;\n\t\tcase \"PreCompact\":\n\t\tcase \"PostCompact\":\n\t\t\treturn input.trigger;\n\t\tcase \"SessionEnd\":\n\t\t\treturn input.reason;\n\t\tcase \"UserPromptSubmit\":\n\t\tcase \"Stop\":\n\t\t\treturn undefined;\n\t}\n}\n\nexport function matchesHookInput(matcher: string | undefined, input: HookInput): MatcherResult {\n\tconst value = hookMatcherValue(input);\n\t// Claude ignores matcher fields on events without matcher support.\n\treturn value === undefined ? { matches: true } : matchHookValue(matcher, value);\n}\n\nexport function matchesHookIf(pattern: string | undefined, input: HookInput): MatcherResult {\n\tif (pattern === undefined) return { matches: true };\n\tif (\n\t\tinput.hook_event_name !== \"PreToolUse\" &&\n\t\tinput.hook_event_name !== \"PostToolUse\" &&\n\t\tinput.hook_event_name !== \"PostToolUseFailure\"\n\t) {\n\t\treturn { matches: false };\n\t}\n\tconst open = pattern.indexOf(\"(\");\n\tif (open < 1 || !pattern.endsWith(\")\")) return matchHookValue(pattern, input.tool_name);\n\tif (pattern.slice(0, open) !== input.tool_name) return { matches: false };\n\tconst argumentPattern = pattern.slice(open + 1, -1);\n\tconst candidate =\n\t\ttypeof input.tool_input.command === \"string\"\n\t\t\t? input.tool_input.command\n\t\t\t: typeof input.tool_input.file_path === \"string\"\n\t\t\t\t? input.tool_input.file_path\n\t\t\t\t: JSON.stringify(input.tool_input);\n\tif (argumentPattern === \"*\") return { matches: true };\n\t// Permission-rule globs are intentionally limited here to their common '*' form.\n\tconst escaped = argumentPattern.replace(/[.+?^${}()|[\\]\\\\]/g, \"\\\\$&\").replaceAll(\"*\", \".*\");\n\ttry {\n\t\treturn { matches: new RegExp(`^${escaped}$`).test(candidate) };\n\t} catch (error) {\n\t\treturn { matches: false, error: `Invalid hook if condition ${JSON.stringify(pattern)}: ${String(error)}` };\n\t}\n}\n"]}

package/dist/core/hooks/trust-store.d.ts

@@ -0,0 +1,38 @@
+import { type AuthStorageBackend } from "../auth-storage.ts";
+export declare const PROJECT_HOOK_TRUST_STORE_VERSION: 1;
+export declare const PROJECT_HOOK_TRUST_STORE_FILENAME = "trusted-project-hooks.json";
+export interface ProjectHookTrustResult {
+    trusted: boolean;
+    /** Canonical repository root, or canonical cwd when cwd is not in a repository. */
+    identity?: string;
+    /** A user-readable, nonfatal error. An error result always fails closed. */
+    error?: string;
+}
+/** Return the physical cwd used to load approved project hook settings. */
+export declare function canonicalProjectHookCwd(cwd: string): string;
+/**
+ * Return the physical repository root containing cwd. If no ancestor has a
+ * .git file or directory, return the physical cwd instead.
+ */
+export declare function canonicalProjectHookIdentity(cwd: string): string;
+/**
+ * Detect project hook declarations without loading or executing them.
+ * Malformed and unreadable settings files are ignored.
+ */
+export declare function hasProjectHookConfiguration(cwd: string): boolean;
+/** Persistent, repository-scoped approval for project hooks. */
+export declare class ProjectHookTrustStore {
+    readonly path: string;
+    private readonly agentDir;
+    private readonly storage;
+    constructor(agentDir?: string, storage?: AuthStorageBackend);
+    private secureStoragePath;
+    isTrusted(cwd: string): ProjectHookTrustResult;
+    /** Persist approval for this repository identity. Hook contents are intentionally not fingerprinted. */
+    trustAlways(cwd: string): ProjectHookTrustResult;
+    /** Persist an identity that was canonicalized and displayed before user approval. */
+    trustAlwaysIdentity(identity: string): ProjectHookTrustResult;
+    trust(cwd: string): ProjectHookTrustResult;
+    revoke(cwd: string): ProjectHookTrustResult;
+}
+//# sourceMappingURL=trust-store.d.ts.map

package/dist/core/hooks/trust-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-store.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/trust-store.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,kBAAkB,EAA0B,MAAM,oBAAoB,CAAC;AAErF,eAAO,MAAM,gCAAgC,GAAa,CAAC;AAC3D,eAAO,MAAM,iCAAiC,+BAA+B,CAAC;AAO9E,MAAM,WAAW,sBAAsB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAkCD,2EAA2E;AAC3E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAchE;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAehE;AAED,gEAAgE;AAChE,qBAAa,qBAAqB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAE7C,YAAY,QAAQ,SAAgB,EAAE,OAAO,CAAC,EAAE,kBAAkB,EAKjE;IAED,OAAO,CAAC,iBAAiB;IAMzB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAW7C;IAED,wGAAwG;IACxG,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAM/C;IAED,qFAAqF;IACrF,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAiB5D;IAED,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAEzC;IAED,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAgB1C;CACD","sourcesContent":["import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, statSync } from \"node:fs\";\nimport { dirname, join, parse, resolve } from \"node:path\";\nimport { CONFIG_DIR_NAME, getAgentDir } from \"../../config.ts\";\nimport { type AuthStorageBackend, FileAuthStorageBackend } from \"../auth-storage.ts\";\n\nexport const PROJECT_HOOK_TRUST_STORE_VERSION = 1 as const;\nexport const PROJECT_HOOK_TRUST_STORE_FILENAME = \"trusted-project-hooks.json\";\n\ninterface ProjectHookTrustData {\n\tversion: typeof PROJECT_HOOK_TRUST_STORE_VERSION;\n\ttrustedProjects: Record<string, true>;\n}\n\nexport interface ProjectHookTrustResult {\n\ttrusted: boolean;\n\t/** Canonical repository root, or canonical cwd when cwd is not in a repository. */\n\tidentity?: string;\n\t/** A user-readable, nonfatal error. An error result always fails closed. */\n\terror?: string;\n}\n\nfunction emptyTrustData(): ProjectHookTrustData {\n\treturn { version: PROJECT_HOOK_TRUST_STORE_VERSION, trustedProjects: {} };\n}\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isMissingGitMarkerError(error: unknown): boolean {\n\tif (!isObject(error) || typeof error.code !== \"string\") return false;\n\treturn error.code === \"ENOENT\" || error.code === \"ENOTDIR\";\n}\n\nfunction parseTrustData(text: string | undefined): ProjectHookTrustData {\n\tif (text === undefined) return emptyTrustData();\n\tconst value: unknown = JSON.parse(text);\n\tif (!isObject(value) || value.version !== PROJECT_HOOK_TRUST_STORE_VERSION || !isObject(value.trustedProjects)) {\n\t\tthrow new Error(`expected version ${PROJECT_HOOK_TRUST_STORE_VERSION} trust-store JSON`);\n\t}\n\tconst trustedProjects: Record<string, true> = {};\n\tfor (const [identity, trusted] of Object.entries(value.trustedProjects)) {\n\t\tif (identity.length === 0 || trusted !== true) throw new Error(\"invalid trustedProjects entry\");\n\t\ttrustedProjects[identity] = true;\n\t}\n\treturn { version: PROJECT_HOOK_TRUST_STORE_VERSION, trustedProjects };\n}\n\nfunction readableError(action: string, error: unknown): string {\n\tconst detail = error instanceof Error ? error.message : String(error);\n\treturn `Unable to ${action} project hook trust: ${detail}`;\n}\n\n/** Return the physical cwd used to load approved project hook settings. */\nexport function canonicalProjectHookCwd(cwd: string): string {\n\treturn realpathSync.native(resolve(cwd));\n}\n\n/**\n * Return the physical repository root containing cwd. If no ancestor has a\n * .git file or directory, return the physical cwd instead.\n */\nexport function canonicalProjectHookIdentity(cwd: string): string {\n\tconst canonicalCwd = canonicalProjectHookCwd(cwd);\n\tlet candidate = canonicalCwd;\n\twhile (true) {\n\t\ttry {\n\t\t\tconst git = statSync(join(candidate, \".git\"));\n\t\t\tif (git.isDirectory() || git.isFile()) return candidate;\n\t\t} catch (error) {\n\t\t\tif (!isMissingGitMarkerError(error)) throw error;\n\t\t}\n\t\tconst parent = dirname(candidate);\n\t\tif (parent === candidate || candidate === parse(candidate).root) return canonicalCwd;\n\t\tcandidate = parent;\n\t}\n}\n\n/**\n * Detect project hook declarations without loading or executing them.\n * Malformed and unreadable settings files are ignored.\n */\nexport function hasProjectHookConfiguration(cwd: string): boolean {\n\tconst paths = [\n\t\tjoin(cwd, CONFIG_DIR_NAME, \"settings.json\"),\n\t\tjoin(cwd, \".claude\", \"settings.json\"),\n\t\tjoin(cwd, \".claude\", \"settings.local.json\"),\n\t];\n\tfor (const path of paths) {\n\t\ttry {\n\t\t\tconst value: unknown = JSON.parse(readFileSync(path, \"utf8\"));\n\t\t\tif (isObject(value) && Object.hasOwn(value, \"hooks\")) return true;\n\t\t} catch {\n\t\t\t// Discovery is best-effort and must never make settings executable.\n\t\t}\n\t}\n\treturn false;\n}\n\n/** Persistent, repository-scoped approval for project hooks. */\nexport class ProjectHookTrustStore {\n\treadonly path: string;\n\tprivate readonly agentDir: string;\n\tprivate readonly storage: AuthStorageBackend;\n\n\tconstructor(agentDir = getAgentDir(), storage?: AuthStorageBackend) {\n\t\tthis.agentDir = resolve(agentDir);\n\t\tthis.path = join(this.agentDir, PROJECT_HOOK_TRUST_STORE_FILENAME);\n\t\tconst initial = `${JSON.stringify(emptyTrustData(), null, 2)}\\n`;\n\t\tthis.storage = storage ?? new FileAuthStorageBackend(this.path, initial);\n\t}\n\n\tprivate secureStoragePath(): void {\n\t\tmkdirSync(this.agentDir, { recursive: true, mode: 0o700 });\n\t\tchmodSync(this.agentDir, 0o700);\n\t\tif (existsSync(this.path)) chmodSync(this.path, 0o600);\n\t}\n\n\tisTrusted(cwd: string): ProjectHookTrustResult {\n\t\tlet identity: string;\n\t\ttry {\n\t\t\tidentity = canonicalProjectHookIdentity(cwd);\n\t\t\tthis.secureStoragePath();\n\t\t\treturn this.storage.withLock((current) => ({\n\t\t\t\tresult: { trusted: parseTrustData(current).trustedProjects[identity] === true, identity },\n\t\t\t}));\n\t\t} catch (error) {\n\t\t\treturn { trusted: false, error: readableError(\"read\", error) };\n\t\t}\n\t}\n\n\t/** Persist approval for this repository identity. Hook contents are intentionally not fingerprinted. */\n\ttrustAlways(cwd: string): ProjectHookTrustResult {\n\t\ttry {\n\t\t\treturn this.trustAlwaysIdentity(canonicalProjectHookIdentity(cwd));\n\t\t} catch (error) {\n\t\t\treturn { trusted: false, error: readableError(\"update\", error) };\n\t\t}\n\t}\n\n\t/** Persist an identity that was canonicalized and displayed before user approval. */\n\ttrustAlwaysIdentity(identity: string): ProjectHookTrustResult {\n\t\tif (identity.length === 0 || resolve(identity) !== identity) {\n\t\t\treturn { trusted: false, error: readableError(\"update\", new Error(\"invalid canonical repository identity\")) };\n\t\t}\n\t\ttry {\n\t\t\tthis.secureStoragePath();\n\t\t\treturn this.storage.withLock((current) => {\n\t\t\t\tconst data = parseTrustData(current);\n\t\t\t\tdata.trustedProjects[identity] = true;\n\t\t\t\treturn {\n\t\t\t\t\tresult: { trusted: true, identity },\n\t\t\t\t\tnext: `${JSON.stringify(data, null, 2)}\\n`,\n\t\t\t\t};\n\t\t\t});\n\t\t} catch (error) {\n\t\t\treturn { trusted: false, identity, error: readableError(\"update\", error) };\n\t\t}\n\t}\n\n\ttrust(cwd: string): ProjectHookTrustResult {\n\t\treturn this.trustAlways(cwd);\n\t}\n\n\trevoke(cwd: string): ProjectHookTrustResult {\n\t\tlet identity: string;\n\t\ttry {\n\t\t\tidentity = canonicalProjectHookIdentity(cwd);\n\t\t\tthis.secureStoragePath();\n\t\t\treturn this.storage.withLock((current) => {\n\t\t\t\tconst data = parseTrustData(current);\n\t\t\t\tdelete data.trustedProjects[identity];\n\t\t\t\treturn {\n\t\t\t\t\tresult: { trusted: false, identity },\n\t\t\t\t\tnext: `${JSON.stringify(data, null, 2)}\\n`,\n\t\t\t\t};\n\t\t\t});\n\t\t} catch (error) {\n\t\t\treturn { trusted: false, error: readableError(\"update\", error) };\n\t\t}\n\t}\n}\n"]}

package/dist/core/hooks/trust-store.js

@@ -0,0 +1,167 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { dirname, join, parse, resolve } from "node:path";
+import { CONFIG_DIR_NAME, getAgentDir } from "../../config.js";
+import { FileAuthStorageBackend } from "../auth-storage.js";
+export const PROJECT_HOOK_TRUST_STORE_VERSION = 1;
+export const PROJECT_HOOK_TRUST_STORE_FILENAME = "trusted-project-hooks.json";
+function emptyTrustData() {
+    return { version: PROJECT_HOOK_TRUST_STORE_VERSION, trustedProjects: {} };
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isMissingGitMarkerError(error) {
+    if (!isObject(error) || typeof error.code !== "string")
+        return false;
+    return error.code === "ENOENT" || error.code === "ENOTDIR";
+}
+function parseTrustData(text) {
+    if (text === undefined)
+        return emptyTrustData();
+    const value = JSON.parse(text);
+    if (!isObject(value) || value.version !== PROJECT_HOOK_TRUST_STORE_VERSION || !isObject(value.trustedProjects)) {
+        throw new Error(`expected version ${PROJECT_HOOK_TRUST_STORE_VERSION} trust-store JSON`);
+    }
+    const trustedProjects = {};
+    for (const [identity, trusted] of Object.entries(value.trustedProjects)) {
+        if (identity.length === 0 || trusted !== true)
+            throw new Error("invalid trustedProjects entry");
+        trustedProjects[identity] = true;
+    }
+    return { version: PROJECT_HOOK_TRUST_STORE_VERSION, trustedProjects };
+}
+function readableError(action, error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return `Unable to ${action} project hook trust: ${detail}`;
+}
+/** Return the physical cwd used to load approved project hook settings. */
+export function canonicalProjectHookCwd(cwd) {
+    return realpathSync.native(resolve(cwd));
+}
+/**
+ * Return the physical repository root containing cwd. If no ancestor has a
+ * .git file or directory, return the physical cwd instead.
+ */
+export function canonicalProjectHookIdentity(cwd) {
+    const canonicalCwd = canonicalProjectHookCwd(cwd);
+    let candidate = canonicalCwd;
+    while (true) {
+        try {
+            const git = statSync(join(candidate, ".git"));
+            if (git.isDirectory() || git.isFile())
+                return candidate;
+        }
+        catch (error) {
+            if (!isMissingGitMarkerError(error))
+                throw error;
+        }
+        const parent = dirname(candidate);
+        if (parent === candidate || candidate === parse(candidate).root)
+            return canonicalCwd;
+        candidate = parent;
+    }
+}
+/**
+ * Detect project hook declarations without loading or executing them.
+ * Malformed and unreadable settings files are ignored.
+ */
+export function hasProjectHookConfiguration(cwd) {
+    const paths = [
+        join(cwd, CONFIG_DIR_NAME, "settings.json"),
+        join(cwd, ".claude", "settings.json"),
+        join(cwd, ".claude", "settings.local.json"),
+    ];
+    for (const path of paths) {
+        try {
+            const value = JSON.parse(readFileSync(path, "utf8"));
+            if (isObject(value) && Object.hasOwn(value, "hooks"))
+                return true;
+        }
+        catch {
+            // Discovery is best-effort and must never make settings executable.
+        }
+    }
+    return false;
+}
+/** Persistent, repository-scoped approval for project hooks. */
+export class ProjectHookTrustStore {
+    path;
+    agentDir;
+    storage;
+    constructor(agentDir = getAgentDir(), storage) {
+        this.agentDir = resolve(agentDir);
+        this.path = join(this.agentDir, PROJECT_HOOK_TRUST_STORE_FILENAME);
+        const initial = `${JSON.stringify(emptyTrustData(), null, 2)}\n`;
+        this.storage = storage ?? new FileAuthStorageBackend(this.path, initial);
+    }
+    secureStoragePath() {
+        mkdirSync(this.agentDir, { recursive: true, mode: 0o700 });
+        chmodSync(this.agentDir, 0o700);
+        if (existsSync(this.path))
+            chmodSync(this.path, 0o600);
+    }
+    isTrusted(cwd) {
+        let identity;
+        try {
+            identity = canonicalProjectHookIdentity(cwd);
+            this.secureStoragePath();
+            return this.storage.withLock((current) => ({
+                result: { trusted: parseTrustData(current).trustedProjects[identity] === true, identity },
+            }));
+        }
+        catch (error) {
+            return { trusted: false, error: readableError("read", error) };
+        }
+    }
+    /** Persist approval for this repository identity. Hook contents are intentionally not fingerprinted. */
+    trustAlways(cwd) {
+        try {
+            return this.trustAlwaysIdentity(canonicalProjectHookIdentity(cwd));
+        }
+        catch (error) {
+            return { trusted: false, error: readableError("update", error) };
+        }
+    }
+    /** Persist an identity that was canonicalized and displayed before user approval. */
+    trustAlwaysIdentity(identity) {
+        if (identity.length === 0 || resolve(identity) !== identity) {
+            return { trusted: false, error: readableError("update", new Error("invalid canonical repository identity")) };
+        }
+        try {
+            this.secureStoragePath();
+            return this.storage.withLock((current) => {
+                const data = parseTrustData(current);
+                data.trustedProjects[identity] = true;
+                return {
+                    result: { trusted: true, identity },
+                    next: `${JSON.stringify(data, null, 2)}\n`,
+                };
+            });
+        }
+        catch (error) {
+            return { trusted: false, identity, error: readableError("update", error) };
+        }
+    }
+    trust(cwd) {
+        return this.trustAlways(cwd);
+    }
+    revoke(cwd) {
+        let identity;
+        try {
+            identity = canonicalProjectHookIdentity(cwd);
+            this.secureStoragePath();
+            return this.storage.withLock((current) => {
+                const data = parseTrustData(current);
+                delete data.trustedProjects[identity];
+                return {
+                    result: { trusted: false, identity },
+                    next: `${JSON.stringify(data, null, 2)}\n`,
+                };
+            });
+        }
+        catch (error) {
+            return { trusted: false, error: readableError("update", error) };
+        }
+    }
+}
+//# sourceMappingURL=trust-store.js.map

package/dist/core/hooks/trust-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-store.js","sourceRoot":"","sources":["../../../src/core/hooks/trust-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAA2B,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAErF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAU,CAAC;AAC3D,MAAM,CAAC,MAAM,iCAAiC,GAAG,4BAA4B,CAAC;AAe9E,SAAS,cAAc,GAAyB;IAC/C,OAAO,EAAE,OAAO,EAAE,gCAAgC,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;AAAA,CAC1E;AAED,SAAS,QAAQ,CAAC,KAAc,EAAoC;IACnE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAAA,CAC5E;AAED,SAAS,uBAAuB,CAAC,KAAc,EAAW;IACzD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;AAAA,CAC3D;AAED,SAAS,cAAc,CAAC,IAAwB,EAAwB;IACvE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,cAAc,EAAE,CAAC;IAChD,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,gCAAgC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAChH,MAAM,IAAI,KAAK,CAAC,oBAAoB,gCAAgC,mBAAmB,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,eAAe,GAAyB,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAChG,eAAe,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,gCAAgC,EAAE,eAAe,EAAE,CAAC;AAAA,CACtE;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,KAAc,EAAU;IAC9D,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,aAAa,MAAM,wBAAwB,MAAM,EAAE,CAAC;AAAA,CAC3D;AAED,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,GAAW,EAAU;IAC5D,OAAO,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAAA,CACzC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAU;IACjE,MAAM,YAAY,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,SAAS,GAAG,YAAY,CAAC;IAC7B,OAAO,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YAC9C,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE;gBAAE,OAAO,SAAS,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;QAClD,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,IAAI,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC;QACrF,SAAS,GAAG,MAAM,CAAC;IACpB,CAAC;AAAA,CACD;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAW,EAAW;IACjE,MAAM,KAAK,GAAG;QACb,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,eAAe,CAAC;QAC3C,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC;QACrC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,qBAAqB,CAAC;KAC3C,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC;YACJ,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC9D,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;QACrE,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,gEAAgE;AAChE,MAAM,OAAO,qBAAqB;IACxB,IAAI,CAAS;IACL,QAAQ,CAAS;IACjB,OAAO,CAAqB;IAE7C,YAAY,QAAQ,GAAG,WAAW,EAAE,EAAE,OAA4B,EAAE;QACnE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iCAAiC,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACjE,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAAA,CACzE;IAEO,iBAAiB,GAAS;QACjC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAAA,CACvD;IAED,SAAS,CAAC,GAAW,EAA0B;QAC9C,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,QAAQ,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1C,MAAM,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,QAAQ,EAAE;aACzF,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QAChE,CAAC;IAAA,CACD;IAED,wGAAwG;IACxG,WAAW,CAAC,GAAW,EAA0B;QAChD,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QAClE,CAAC;IAAA,CACD;IAED,qFAAqF;IACrF,mBAAmB,CAAC,QAAgB,EAA0B;QAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,EAAE,CAAC;QAC/G,CAAC;QACD,IAAI,CAAC;YACJ,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;gBACtC,OAAO;oBACN,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACnC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;iBAC1C,CAAC;YAAA,CACF,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5E,CAAC;IAAA,CACD;IAED,KAAK,CAAC,GAAW,EAA0B;QAC1C,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAAA,CAC7B;IAED,MAAM,CAAC,GAAW,EAA0B;QAC3C,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,QAAQ,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;gBACrC,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;gBACtC,OAAO;oBACN,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;oBACpC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;iBAC1C,CAAC;YAAA,CACF,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QAClE,CAAC;IAAA,CACD;CACD","sourcesContent":["import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, statSync } from \"node:fs\";\nimport { dirname, join, parse, resolve } from \"node:path\";\nimport { CONFIG_DIR_NAME, getAgentDir } from \"../../config.ts\";\nimport { type AuthStorageBackend, FileAuthStorageBackend } from \"../auth-storage.ts\";\n\nexport const PROJECT_HOOK_TRUST_STORE_VERSION = 1 as const;\nexport const PROJECT_HOOK_TRUST_STORE_FILENAME = \"trusted-project-hooks.json\";\n\ninterface ProjectHookTrustData {\n\tversion: typeof PROJECT_HOOK_TRUST_STORE_VERSION;\n\ttrustedProjects: Record<string, true>;\n}\n\nexport interface ProjectHookTrustResult {\n\ttrusted: boolean;\n\t/** Canonical repository root, or canonical cwd when cwd is not in a repository. */\n\tidentity?: string;\n\t/** A user-readable, nonfatal error. An error result always fails closed. */\n\terror?: string;\n}\n\nfunction emptyTrustData(): ProjectHookTrustData {\n\treturn { version: PROJECT_HOOK_TRUST_STORE_VERSION, trustedProjects: {} };\n}\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isMissingGitMarkerError(error: unknown): boolean {\n\tif (!isObject(error) || typeof error.code !== \"string\") return false;\n\treturn error.code === \"ENOENT\" || error.code === \"ENOTDIR\";\n}\n\nfunction parseTrustData(text: string | undefined): ProjectHookTrustData {\n\tif (text === undefined) return emptyTrustData();\n\tconst value: unknown = JSON.parse(text);\n\tif (!isObject(value) || value.version !== PROJECT_HOOK_TRUST_STORE_VERSION || !isObject(value.trustedProjects)) {\n\t\tthrow new Error(`expected version ${PROJECT_HOOK_TRUST_STORE_VERSION} trust-store JSON`);\n\t}\n\tconst trustedProjects: Record<string, true> = {};\n\tfor (const [identity, trusted] of Object.entries(value.trustedProjects)) {\n\t\tif (identity.length === 0 || trusted !== true) throw new Error(\"invalid trustedProjects entry\");\n\t\ttrustedProjects[identity] = true;\n\t}\n\treturn { version: PROJECT_HOOK_TRUST_STORE_VERSION, trustedProjects };\n}\n\nfunction readableError(action: string, error: unknown): string {\n\tconst detail = error instanceof Error ? error.message : String(error);\n\treturn `Unable to ${action} project hook trust: ${detail}`;\n}\n\n/** Return the physical cwd used to load approved project hook settings. */\nexport function canonicalProjectHookCwd(cwd: string): string {\n\treturn realpathSync.native(resolve(cwd));\n}\n\n/**\n * Return the physical repository root containing cwd. If no ancestor has a\n * .git file or directory, return the physical cwd instead.\n */\nexport function canonicalProjectHookIdentity(cwd: string): string {\n\tconst canonicalCwd = canonicalProjectHookCwd(cwd);\n\tlet candidate = canonicalCwd;\n\twhile (true) {\n\t\ttry {\n\t\t\tconst git = statSync(join(candidate, \".git\"));\n\t\t\tif (git.isDirectory() || git.isFile()) return candidate;\n\t\t} catch (error) {\n\t\t\tif (!isMissingGitMarkerError(error)) throw error;\n\t\t}\n\t\tconst parent = dirname(candidate);\n\t\tif (parent === candidate || candidate === parse(candidate).root) return canonicalCwd;\n\t\tcandidate = parent;\n\t}\n}\n\n/**\n * Detect project hook declarations without loading or executing them.\n * Malformed and unreadable settings files are ignored.\n */\nexport function hasProjectHookConfiguration(cwd: string): boolean {\n\tconst paths = [\n\t\tjoin(cwd, CONFIG_DIR_NAME, \"settings.json\"),\n\t\tjoin(cwd, \".claude\", \"settings.json\"),\n\t\tjoin(cwd, \".claude\", \"settings.local.json\"),\n\t];\n\tfor (const path of paths) {\n\t\ttry {\n\t\t\tconst value: unknown = JSON.parse(readFileSync(path, \"utf8\"));\n\t\t\tif (isObject(value) && Object.hasOwn(value, \"hooks\")) return true;\n\t\t} catch {\n\t\t\t// Discovery is best-effort and must never make settings executable.\n\t\t}\n\t}\n\treturn false;\n}\n\n/** Persistent, repository-scoped approval for project hooks. */\nexport class ProjectHookTrustStore {\n\treadonly path: string;\n\tprivate readonly agentDir: string;\n\tprivate readonly storage: AuthStorageBackend;\n\n\tconstructor(agentDir = getAgentDir(), storage?: AuthStorageBackend) {\n\t\tthis.agentDir = resolve(agentDir);\n\t\tthis.path = join(this.agentDir, PROJECT_HOOK_TRUST_STORE_FILENAME);\n\t\tconst initial = `${JSON.stringify(emptyTrustData(), null, 2)}\\n`;\n\t\tthis.storage = storage ?? new FileAuthStorageBackend(this.path, initial);\n\t}\n\n\tprivate secureStoragePath(): void {\n\t\tmkdirSync(this.agentDir, { recursive: true, mode: 0o700 });\n\t\tchmodSync(this.agentDir, 0o700);\n\t\tif (existsSync(this.path)) chmodSync(this.path, 0o600);\n\t}\n\n\tisTrusted(cwd: string): ProjectHookTrustResult {\n\t\tlet identity: string;\n\t\ttry {\n\t\t\tidentity = canonicalProjectHookIdentity(cwd);\n\t\t\tthis.secureStoragePath();\n\t\t\treturn this.storage.withLock((current) => ({\n\t\t\t\tresult: { trusted: parseTrustData(current).trustedProjects[identity] === true, identity },\n\t\t\t}));\n\t\t} catch (error) {\n\t\t\treturn { trusted: false, error: readableError(\"read\", error) };\n\t\t}\n\t}\n\n\t/** Persist approval for this repository identity. Hook contents are intentionally not fingerprinted. */\n\ttrustAlways(cwd: string): ProjectHookTrustResult {\n\t\ttry {\n\t\t\treturn this.trustAlwaysIdentity(canonicalProjectHookIdentity(cwd));\n\t\t} catch (error) {\n\t\t\treturn { trusted: false, error: readableError(\"update\", error) };\n\t\t}\n\t}\n\n\t/** Persist an identity that was canonicalized and displayed before user approval. */\n\ttrustAlwaysIdentity(identity: string): ProjectHookTrustResult {\n\t\tif (identity.length === 0 || resolve(identity) !== identity) {\n\t\t\treturn { trusted: false, error: readableError(\"update\", new Error(\"invalid canonical repository identity\")) };\n\t\t}\n\t\ttry {\n\t\t\tthis.secureStoragePath();\n\t\t\treturn this.storage.withLock((current) => {\n\t\t\t\tconst data = parseTrustData(current);\n\t\t\t\tdata.trustedProjects[identity] = true;\n\t\t\t\treturn {\n\t\t\t\t\tresult: { trusted: true, identity },\n\t\t\t\t\tnext: `${JSON.stringify(data, null, 2)}\\n`,\n\t\t\t\t};\n\t\t\t});\n\t\t} catch (error) {\n\t\t\treturn { trusted: false, identity, error: readableError(\"update\", error) };\n\t\t}\n\t}\n\n\ttrust(cwd: string): ProjectHookTrustResult {\n\t\treturn this.trustAlways(cwd);\n\t}\n\n\trevoke(cwd: string): ProjectHookTrustResult {\n\t\tlet identity: string;\n\t\ttry {\n\t\t\tidentity = canonicalProjectHookIdentity(cwd);\n\t\t\tthis.secureStoragePath();\n\t\t\treturn this.storage.withLock((current) => {\n\t\t\t\tconst data = parseTrustData(current);\n\t\t\t\tdelete data.trustedProjects[identity];\n\t\t\t\treturn {\n\t\t\t\t\tresult: { trusted: false, identity },\n\t\t\t\t\tnext: `${JSON.stringify(data, null, 2)}\\n`,\n\t\t\t\t};\n\t\t\t});\n\t\t} catch (error) {\n\t\t\treturn { trusted: false, error: readableError(\"update\", error) };\n\t\t}\n\t}\n}\n"]}