@iowarp/clio-coder 0.4.9 → 0.5.0

package/src/domains/safety/path-policy.ts

@@ -1,6 +1,6 @@
 import { homedir } from "node:os";
 import path from "node:path";
-import { canonicalizeExistingPath } from "../../core/path-canonical.js";
+import { canonicalizeExistingPath, canonicalizeRawPath, type PathWalkMemo } from "../../core/path-canonical.js";
 
 export type PathPolicyKind = "zeroAccessPaths" | "readOnlyPaths" | "noWritePaths" | "noDeletePaths";
 export type PathPolicyOperation = "read" | "write" | "delete";
@@ -91,10 +91,14 @@ export function evaluatePathPolicy(
 	operation: PathPolicyOperation,
 	targetPath: string,
 	cwd = policy.root,
+	memo?: PathWalkMemo,
 ): PathPolicyDecision {
 	const expanded = expandTilde(targetPath);
+	// Physical, the way the kernel resolves the path: `data/link/../x` lands
+	// beside the link's target. An unresolvable path matches its lexical form;
+	// path policy only adds blocks, and the syscall fails on it anyway.
 	const lexicalTarget = path.isAbsolute(expanded) ? path.resolve(expanded) : path.resolve(cwd, expanded);
-	const resolvedTarget = canonicalizeExistingPath(lexicalTarget);
+	const resolvedTarget = canonicalizeRawPath(expanded, cwd, memo) ?? canonicalizeExistingPath(lexicalTarget, memo);
 	const normalizedResolvedTarget = normalizeSeparators(resolvedTarget);
 	const normalizedRelativeTarget = normalizeSeparators(path.relative(policy.root, resolvedTarget));
 	const normalizedRawTarget = normalizeSeparators(targetPath);

package/src/domains/safety/policy-engine.ts

@@ -3,11 +3,23 @@ import { readFileSync } from "node:fs";
 import path from "node:path";
 import { artifactDefaultPath } from "../../core/artifact-paths.js";
 import { pathBoundaryCovers, resolvePathBoundary } from "../../core/path-boundary.js";
-import { canonicalizeExistingPath } from "../../core/path-canonical.js";
+import {
+	canonicalizeExistingPath,
+	canonicalizePath,
+	canonicalizeRawPath,
+	createPathWalkMemo,
+	type PathWalkMemo,
+} from "../../core/path-canonical.js";
 import { ToolNames } from "../../core/tool-names.js";
 import { clioConfigDir } from "../../core/xdg.js";
 import { type DeclaredCheck, loadProjectVerifierCatalog } from "../../tools/verify/catalog.js";
-import { type ActionClass, type Classification, type ClassifierCall, classify } from "./action-classifier.js";
+import {
+	type ActionClass,
+	type Classification,
+	type ClassifierCall,
+	classify,
+	normalizeCallPaths,
+} from "./action-classifier.js";
 import type { DamageControlMatch, DamageControlRule } from "./damage-control.js";
 import {
 	DEFAULT_DAMAGE_CONTROL_PATH_POLICY,
@@ -27,15 +39,18 @@ import {
 	type ProjectCommandPolicy,
 } from "./project-policy.js";
 import {
+	commandArgumentSegments,
 	extractCommandDeleteTargets,
 	extractCommandWriteTargets,
 	inlineShellScript,
 	invokesClioSkillMutation,
 	scanShellLike,
+	scanShellLikeDeep,
 } from "./protected-artifacts.js";
+import { isReadScopeTool, readScopeEscape, readScopeExemptRoots, readScopeSpellings } from "./read-scope.js";
 import { formatRejection, type RejectionMessage } from "./rejection-feedback.js";
 import { getCachedDefaultRulePacks, type PackId, type RulePacks } from "./rule-pack-loader.js";
-import { activeClioSkillRoots, skillMutationReason } from "./skill-authority.js";
+import { activeClioSkillRoots, mutationCandidates, skillMutationReason } from "./skill-authority.js";
 
 import { gateProjectSafetyPolicy, workspaceTrustDirectory } from "./workspace-trust.js";
 
@@ -75,6 +90,12 @@ export interface SafetyPolicyDecision {
 	 * autonomy mapping asks for unrecognized execution below full-auto.
 	 */
 	execRecognition?: "recognized" | "unrecognized";
+	/**
+	 * Set on an allowed read, ls, grep, or find whose path resolves outside the
+	 * workspace and outside Clio's own readable roots. The net passed; the
+	 * autonomy mapping asks for it below full-auto.
+	 */
+	readScope?: "outside-workspace";
 }
 
 export interface SafetyPolicyMetadata {
@@ -93,6 +114,12 @@ export interface SafetyPolicyMetadata {
 
 export interface SafetyPolicyEngine {
 	evaluate(call: ClassifierCall, posture?: string): SafetyPolicyDecision;
+	/**
+	 * False when a zero-access entry covers the path. The per-entry filter of a
+	 * listing or a search asks this about every result, so it runs the path
+	 * policy alone instead of a whole admission.
+	 */
+	readablePath(target: string): boolean;
 	metadata(posture?: string): SafetyPolicyMetadata;
 }
 
@@ -124,19 +151,48 @@ const BUILTIN_ALLOWLIST: ReadonlyArray<{ id: string; re: RegExp }> = [
 	{ id: "builtin:git-log", re: /^git\s+log\s+--oneline(?:\s+-n\s+[1-9]\d{0,2})?(?:\s+--\s+[\w./-]+)?$/ },
 ];
 
-const PROJECT_SCRIPT_COMMANDS: ReadonlyArray<{ id: string; re: RegExp }> = [
+/**
+ * Test runners run without an ask at auto-edit and full-auto (#377). They
+ * execute repository-authored code, which the maintainer accepted so a
+ * headless run can verify its own work by the project's own command. Every id
+ * here maps to a `detectValidationCommand` label, and
+ * `tests/contracts/test-runner-vocabulary.test.ts` fails when the two drift.
+ * Arguments stay bare words: quoting, substitution, and operators fall through
+ * to the rails below.
+ */
+export const TEST_RUNNER_COMMANDS: ReadonlyArray<{ id: string; re: RegExp }> = [
 	{ id: "builtin:npm-test", re: /^npm\s+(?:test|run\s+test)(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
-	{ id: "builtin:npm-lint", re: /^npm\s+run\s+lint(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
-	{ id: "builtin:npm-build", re: /^npm\s+run\s+build(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
-	{ id: "builtin:npm-typecheck", re: /^npm\s+run\s+typecheck(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
-	{ id: "builtin:npm-ci-script", re: /^npm\s+run\s+ci(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+	{ id: "builtin:node-test", re: /^node\s+--test(?:\s+[\w=./:-]+)*$/ },
 	{ id: "builtin:pytest", re: /^pytest(?:\s+[\w=./:-]+)*$/ },
 	{ id: "builtin:python-pytest", re: /^python(?:3(?:\.\d+)?)?\s+-m\s+pytest(?:\s+[\w=./:-]+)*$/ },
+	{ id: "builtin:python-unittest", re: /^python(?:3(?:\.\d+)?)?\s+-m\s+unittest(?:\s+[\w=./:-]+)*$/ },
 	{ id: "builtin:cargo-test", re: /^cargo\s+test(?:\s+[\w=./:-]+)*$/ },
 	{ id: "builtin:go-test", re: /^go\s+test(?:\s+[\w=./:-]+)*$/ },
+	{ id: "builtin:ctest", re: /^ctest(?:\s+[\w=./:-]+)*$/ },
 	{ id: "builtin:make-test", re: /^make\s+test(?:\s+[\w=./:-]+)*$/ },
+	{ id: "builtin:make-check", re: /^make\s+check(?:\s+[\w=./:-]+)*$/ },
+	{ id: "builtin:ninja-test", re: /^ninja\s+test(?:\s+[\w=./:-]+)*$/ },
+	{ id: "builtin:meson-test", re: /^meson\s+test(?:\s+[\w=./:-]+)*$/ },
+	{ id: "builtin:mvn-test", re: /^mvn\s+test(?:\s+[\w=./:-]+)*$/ },
+	{ id: "builtin:gradle-test", re: /^(?:gradle|(?:\.\/)?gradlew)\s+test(?:\s+[\w=./:-]+)*$/ },
 ];
 
+/**
+ * Repository scripts that are not test runners. They still count as validation
+ * evidence (`npm run <verification script>`) but keep a one-shot confirmation
+ * at every autonomy level.
+ */
+export const PROJECT_SCRIPT_COMMANDS: ReadonlyArray<{ id: string; re: RegExp }> = [
+	{ id: "builtin:npm-lint", re: /^npm\s+run\s+lint(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+	{ id: "builtin:npm-build", re: /^npm\s+run\s+build(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+	{ id: "builtin:npm-typecheck", re: /^npm\s+run\s+typecheck(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+	{ id: "builtin:npm-ci-script", re: /^npm\s+run\s+ci(?:\s+--\s+[\w=./:-]+(?:\s+[\w=./:-]+)*)?$/ },
+];
+
+function matchesRepositoryCommand(command: string): boolean {
+	return [...TEST_RUNNER_COMMANDS, ...PROJECT_SCRIPT_COMMANDS].some((entry) => entry.re.test(command));
+}
+
 /**
  * What the recognized spelling looks like, carried on every unrecognized-bash
  * decision. It rides the decision's reasons so the approval overlay, the audit
@@ -210,6 +266,7 @@ export function createSafetyPolicyEngine(options: SafetyPolicyEngineOptions = {}
 	const writeRootCwd = path.resolve(options.cwd ?? process.cwd());
 	const writeRoots = (options.writeRoots ?? []).map((root) => resolvePathBoundary(writeRootCwd, root));
 	const skillRoots = activeClioSkillRoots(cwd);
+	const readExemptRoots = readScopeExemptRoots();
 	const packs = options.rulePacks ?? getCachedDefaultRulePacks();
 	const projectPolicy = options.projectPolicy ?? gateProjectSafetyPolicy(cwd, loadProjectSafetyPolicy(cwd));
 	const projectPolicyRoot =
@@ -239,7 +296,8 @@ export function createSafetyPolicyEngine(options: SafetyPolicyEngineOptions = {}
 	const sourcedRules: SourcedRule[] = packs.base.rules.map((rule) => ({ rule, source: "damage-control:base" }));
 
 	return {
-		evaluate(call, posture) {
+		evaluate(rawCall, posture) {
+			const call = normalizeCallPaths(rawCall);
 			const rawClassification = classify(call);
 			const command = commandArg(call.args);
 			const callCwd = cwdArg(call.args, cwd);
@@ -338,12 +396,23 @@ export function createSafetyPolicyEngine(options: SafetyPolicyEngineOptions = {}
 			}
 			// Reuse the canonical authority boundary scan for parent deletions,
 			// shell cwd changes and aliases that a literal path-policy lookup misses.
+			// Both authority checks below judge the same targets, so they share one
+			// resolution and one walk memo, both dropped when this call is decided.
+			const walkMemo = createPathWalkMemo();
+			const candidates = mutationCandidates(
+				pathPolicyTargets(
+					catalogCommand === null ? call : { tool: ToolNames.Bash, args: { command: catalogCommand } },
+					callCwd,
+				),
+				callCwd,
+				mutationCommand,
+				walkMemo,
+			);
 			if (
 				skillMutationReason(
 					[path.join(clioConfigDir(), "settings.yaml"), workspaceTrustDirectory()],
-					pathPolicyTargets(catalogCommand === null ? call : { tool: ToolNames.Bash, args: { command: catalogCommand } }),
-					callCwd,
-					mutationCommand,
+					candidates,
+					walkMemo,
 				) !== null
 			) {
 				return blockDecision(base, {
@@ -354,14 +423,9 @@ export function createSafetyPolicyEngine(options: SafetyPolicyEngineOptions = {}
 				});
 			}
 			const skillReason =
-				mutationCommand !== null && invokesClioSkillMutation(mutationCommand)
+				mutationCommand !== null && invokesClioSkillMutation(mutationCommand, true)
 					? "resource installation and lifecycle changes require the operator CLI or an explicit operator install choice; draft outside installed resource roots"
-					: skillMutationReason(
-							skillRoots,
-							pathPolicyTargets(catalogCommand === null ? call : { tool: ToolNames.Bash, args: { command: catalogCommand } }),
-							callCwd,
-							mutationCommand,
-						);
+					: skillMutationReason(skillRoots, candidates, walkMemo);
 			if (skillReason !== null) {
 				return blockDecision(base, {
 					ruleId: "skill-authority",
@@ -379,7 +443,7 @@ export function createSafetyPolicyEngine(options: SafetyPolicyEngineOptions = {}
 			// protection (`.env`, `~/.ssh/`, `credentials.yaml`, ...) active on a
 			// broken config, which is the fail-closed intent; project-authored
 			// additions and exemptions stay gated on validity inside the loader.
-			const pathBlock = evaluateProjectPathPolicy(pathPolicy, call, callCwd);
+			const pathBlock = evaluateProjectPathPolicy(pathPolicy, call, callCwd, walkMemo);
 			if (pathBlock !== null) {
 				const blockInput: Omit<
 					SafetyPolicyDecision,
@@ -422,6 +486,18 @@ export function createSafetyPolicyEngine(options: SafetyPolicyEngineOptions = {}
 				}
 			}
 
+			// Managed library changes can be authorized by the operator. Direct
+			// mutations and all hard path/trust blocks above remain non-overridable.
+			if (mutationCommand !== null && invokesClioSkillMutation(mutationCommand)) {
+				const input = {
+					ruleId: "library-confirm",
+					reasonCode: "library-confirm",
+					reasons: ["Library changes require one-shot operator confirmation"],
+					policySource: "builtin-classifier" as const,
+				};
+				return posture === "confirmed" ? allowDecision(base, input) : askDecision(base, input);
+			}
+
 			// The authored ask rail (sd-01 M3) decides only among calls that
 			// survived every hard block above. A confirmed posture admits the
 			// matched command; an unconfirmed one parks it for confirmation.
@@ -508,8 +584,22 @@ export function createSafetyPolicyEngine(options: SafetyPolicyEngineOptions = {}
 			// Catalog argv already went through canonical command recognition above.
 			// Package scripts and the frontend validator retain their fixed typed surface.
 			if (classification.actionClass === "execute") allowInput.execRecognition = "recognized";
+			// Search scope: the zero-access list above is the only path rail a
+			// read-class tool meets, so a path through a link or a plain `..` used
+			// to be read, listed, and searched at every level. The net still passes
+			// it; the flag lets the autonomy mapping ask below full-auto.
+			if (isReadScopeTool(call.tool) && posture !== "confirmed") {
+				const escaped = readScopeEscape(pathArg(call.args) ?? ".", callCwd, cwd, readExemptRoots, walkMemo);
+				if (escaped !== null) {
+					allowInput.readScope = "outside-workspace";
+					allowInput.reasons = [...allowInput.reasons, `read-path-outside-workspace: ${escaped}`];
+				}
+			}
 			return allowDecision(base, allowInput);
 		},
+		readablePath(target) {
+			return evaluatePathPolicy(zeroAccessPolicy, "read", target, cwd).kind === "allow";
+		},
 		metadata() {
 			return {
 				version: 1,
@@ -580,7 +670,7 @@ function stripQuotes(token: string): string {
  */
 function bashPathTokenCandidates(command: string): string[] {
 	const candidates: string[] = [];
-	for (const scanned of scanShellLike(command)) {
+	for (const scanned of scanShellLikeDeep(command)) {
 		if (scanned.operator) continue;
 		const token = scanned.value;
 		if (token.length === 0) continue;
@@ -616,16 +706,20 @@ function evaluateProjectPathPolicy(
 	policy: CompiledPathPolicy,
 	call: ClassifierCall,
 	callCwd: string,
+	memo: PathWalkMemo,
 ): Extract<PathPolicyDecision, { kind: "block" }> | null {
 	if (policy.entries.length === 0) return null;
-	for (const target of pathPolicyTargets(call)) {
-		const decision = evaluatePathPolicy(policy, target.operation, target.path, callCwd);
+	for (const target of pathPolicyTargets(call, callCwd)) {
+		const decision = evaluatePathPolicy(policy, target.operation, target.path, callCwd, memo);
 		if (decision.kind === "block") return decision;
 	}
 	return null;
 }
 
-function pathPolicyTargets(call: ClassifierCall): Array<{ operation: PathPolicyOperation; path: string }> {
+function pathPolicyTargets(
+	call: ClassifierCall,
+	callCwd: string,
+): Array<{ operation: PathPolicyOperation; path: string }> {
 	const args = call.args;
 	switch (call.tool) {
 		case ToolNames.Read:
@@ -633,7 +727,7 @@ function pathPolicyTargets(call: ClassifierCall): Array<{ operation: PathPolicyO
 		case ToolNames.Grep:
 		case ToolNames.Find: {
 			const target = pathArg(args) ?? ".";
-			return [{ operation: "read", path: target }];
+			return readScopeSpellings(target, callCwd).map((spelling) => ({ operation: "read" as const, path: spelling }));
 		}
 		case ToolNames.Data: {
 			// data streams one named file; a zero-access path is refused here,
@@ -772,6 +866,17 @@ function evaluateBashPolicy(
 			execRecognition: "unrecognized",
 		};
 	}
+	const testRunner = TEST_RUNNER_COMMANDS.find((entry) => entry.re.test(recognitionCommand));
+	if (testRunner !== undefined) {
+		return {
+			kind: "allow",
+			ruleId: testRunner.id,
+			reasonCode: testRunner.id,
+			reasons: [`matched built-in test runner '${testRunner.id}'`, projectScriptPreview(recognitionCommand, callCwd)],
+			policySource: "builtin-command-allowlist",
+			execRecognition: "recognized",
+		};
+	}
 	if (PROJECT_SCRIPT_COMMANDS.some((entry) => entry.re.test(recognitionCommand))) {
 		return {
 			kind: posture === "confirmed" ? "allow" : "ask",
@@ -787,13 +892,10 @@ function evaluateBashPolicy(
 	}
 	const chain = recognizeCommandChain(recognitionCommand, callCwd, workspaceRoot, policy);
 	if (chain !== null) {
-		const chainReasons = [`every step of the && chain is recognized: ${chain.ruleIds.join(", ")}`];
-		if (chain.requiresConfirmation) {
-			for (const segment of recognitionCommand.split("&&").map((part) => part.trim())) {
-				if (PROJECT_SCRIPT_COMMANDS.some((entry) => entry.re.test(segment)))
-					chainReasons.push(projectScriptPreview(segment, callCwd));
-			}
-		}
+		const chainReasons = [
+			`every step of the && chain is recognized: ${chain.ruleIds.join(", ")}`,
+			...(chain.requiresConfirmation ? chain.scriptPreviews : []),
+		];
 		if (chain.requiresConfirmation && posture !== "confirmed") {
 			return {
 				kind: "ask",
@@ -820,10 +922,11 @@ function evaluateBashPolicy(
 	// the full string, so a destructive verb behind an operator was caught before
 	// this point.
 	if (hasSequencingOperators(command)) {
-		const scriptSegments = recognitionCommand
-			.split(/&&|\|\||[;|\n]/)
-			.map((part) => part.trim())
-			.filter((part) => PROJECT_SCRIPT_COMMANDS.some((entry) => entry.re.test(part)));
+		// Redirection syntax changes where output goes, not whether repository
+		// code executes. Match parsed argv so `2>&1` cannot erase this net rail.
+		const scriptSegments = commandArgumentSegments(recognitionCommand)
+			.map((args) => args.join(" "))
+			.filter((part) => matchesRepositoryCommand(part));
 		if (scriptSegments.length > 0 && posture !== "confirmed") {
 			return {
 				kind: "ask",
@@ -991,6 +1094,7 @@ const CHAIN_MAX_SEGMENTS = 6;
 interface ChainRecognition {
 	ruleIds: ReadonlyArray<string>;
 	requiresConfirmation: boolean;
+	scriptPreviews: ReadonlyArray<string>;
 }
 
 /**
@@ -1032,28 +1136,43 @@ function recognizeCommandChain(
 	if (segments.length < 2 || segments.length > CHAIN_MAX_SEGMENTS) return null;
 	const ruleIds: string[] = [];
 	let requiresConfirmation = false;
+	let chainCwd = callCwd;
+	const scriptPreviews: string[] = [];
 	for (const segment of segments) {
 		if (segment.length === 0) return null;
 		if (segment[0] === "cd") {
-			// A `cd` that stays inside the workspace re-bases nothing the net cares
-			// about; one that leaves it is the laundering pattern the action
-			// classifier already escalates, so it is not recognizable here.
+			// Each later command runs in this directory, including project-policy
+			// cwd matching and script previews. Keep both logical and physical
+			// readings inside the workspace before recognizing the transition.
 			if (segment.length !== 2) return null;
 			const target = segment[1] ?? "";
-			if (target.startsWith("~") || !isUnderOrSame(path.resolve(callCwd, target), workspaceRoot)) return null;
+			const nextCwd = path.resolve(chainCwd, target);
+			if (target.startsWith("~") || !isUnderOrSame(nextCwd, workspaceRoot)) return null;
+			// A shell `cd` is logical unless `-P` or `set -P` makes it physical;
+			// recognize it only when both readings stay inside.
+			const physical = canonicalizeRawPath(target, chainCwd);
+			if (physical === null || !isUnderOrSame(physical, workspaceRoot)) return null;
+			chainCwd = nextCwd;
 			ruleIds.push("builtin:cd-workspace");
 			continue;
 		}
 		// Re-rendered from tokens, so quoting is gone: a member that needed its
 		// quotes fails the allowlist regex and the whole chain stays unrecognized.
 		const rendered = segment.join(" ");
-		const projectMatch = matchingProjectCommand(policy, rendered, callCwd);
+		const projectScript = PROJECT_SCRIPT_COMMANDS.some((entry) => entry.re.test(rendered));
+		if (projectScript) scriptPreviews.push(projectScriptPreview(rendered, chainCwd));
+		const projectMatch = matchingProjectCommand(policy, rendered, chainCwd);
 		if (projectMatch) {
 			ruleIds.push(projectMatch.id);
 			if (projectMatch.requireConfirmation) requiresConfirmation = true;
 			continue;
 		}
-		if (PROJECT_SCRIPT_COMMANDS.some((entry) => entry.re.test(rendered))) {
+		const testRunner = TEST_RUNNER_COMMANDS.find((entry) => entry.re.test(rendered));
+		if (testRunner !== undefined) {
+			ruleIds.push(testRunner.id);
+			continue;
+		}
+		if (projectScript) {
 			ruleIds.push("project-script-confirm");
 			requiresConfirmation = true;
 			continue;
@@ -1062,7 +1181,7 @@ function recognizeCommandChain(
 		if (builtin === undefined) return null;
 		ruleIds.push(builtin.id);
 	}
-	return { ruleIds, requiresConfirmation };
+	return { ruleIds, requiresConfirmation, scriptPreviews };
 }
 
 /**
@@ -1087,11 +1206,12 @@ function hasShellOperators(command: string): boolean {
 	return hasSequencingOperators(command) || hasCommandSubstitution(command);
 }
 
+/** A path that cannot be canonicalized is under nothing. */
 function isUnderOrSame(child: string, parent: string): boolean {
-	const rel = path.relative(
-		canonicalizeExistingPath(path.resolve(parent)),
-		canonicalizeExistingPath(path.resolve(child)),
-	);
+	const canonicalParent = canonicalizePath(path.resolve(parent));
+	const canonicalChild = canonicalizePath(path.resolve(child));
+	if (canonicalParent === null || canonicalChild === null) return false;
+	const rel = path.relative(canonicalParent, canonicalChild);
 	return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
 }
 
@@ -1214,7 +1334,7 @@ function packPayload(rules: ReadonlyArray<DamageControlRule>): Array<Record<stri
 function invokesTrustMutation(command: string): boolean {
 	// Wrappers, package launchers, quoted argv and source-tree CLI invocations
 	// must not turn an operator-only grant into model authority.
-	const words = scanShellLike(command)
+	const words = scanShellLikeDeep(command)
 		.filter((token) => !token.operator)
 		.map((token) => token.value);
 	return (