@jeger-ai/opengantry 3.7.0 → 3.8.0

package/README.md

@@ -141,30 +141,26 @@ See [`docs/DOMAINS.md`](docs/DOMAINS.md) for adapter details and [`docs/AGENT-GR
 
 ## Try it in 60 seconds: `gantry cage`
 
-No setup. Wrap any agent command:
+No setup. Start your agent inside the cage, exactly as you normally would:
 
 ```bash
-npx -p @jeger-ai/opengantry opengantry-cage -- <agent command>
-# installed: gantry cage -- <agent command>
+npx -p @jeger-ai/opengantry opengantry-cage -- claude
+# installed (npm install -g @jeger-ai/opengantry): gantry cage -- claude, gantry cage -- aider
 ```
 
-Cage checks once, after the command exits, so use it for one-shot, headless agent runs rather than interactive sessions (install once; `npx` re-resolves the package on each launch):
+While the session runs, cage checks about once a second and restores changes to CI configs, `.env` / `.env.*`, `.git/config`, `.git/hooks/` (and `core.hooksPath`) and your manifest `forbidden_zones` from an in-memory snapshot. Lockfile changes are listed but kept. A `git push` from inside the session is refused when the outgoing commits touch those paths, and the agent sees why. When you quit, cage prints one report: everything it restored, any refused pushes, exit `3` if anything was touched (otherwise the agent's own exit code).
 
-```bash
-npm install -g @jeger-ai/opengantry
-gantry cage -- claude -p "Fix the failing test in auth.spec.ts"
-gantry cage -- aider --message "Refactor DB queries" --no-auto-commits --yes-always
+Nothing is printed into the agent's screen while it runs: events go to a session log in your temp dir (path shown at start), with a terminal bell per restore. If the agent keeps rewriting the same file, cage stops restoring it after 3 tries, marks it contested and restores it once at exit.
 
-# single-task shell functions
-c-run() { gantry cage -- claude -p "$*"; }
-a-run() { gantry cage -- aider --message "$*" --no-auto-commits --yes-always; }
-```
+To protect more of your own repo (migrations, infrastructure, key files), let cage propose rules, review them, and commit `.cage.yaml`:
 
-Don't alias `claude` or `aider` themselves: both open an interactive REPL, and a protected-file edit early in a long session stays in place (and can be pushed) until you quit. Keep Aider's auto-commits off: cage restores the working tree, not git history or a remote, so a committed or pushed change needs a manual fix.
+```bash
+gantry cage suggest --write      # writes .cage.yaml.suggested; review it, keep what you want as .cage.yaml, commit
+```
 
-After the command exits, cage restores changes to CI configs, `.env` / `.env.*`, `.git/config`, `.git/hooks/` (and `core.hooksPath`), and your manifest `forbidden_zones`. Lockfile changes are listed but kept. Exit `3` means something was reverted; otherwise the command's own exit code passes through.
+`.cage.yaml` can only add protection; it can never switch a built-in rule off. To relax one path for a single run, pass `--allow-override <path>`: cage then reports that path instead of restoring it, and says so at start and in the report.
 
-Cage detects and reverts **after** the command exits. It does not see reads, network calls, or writes outside the protected set. For scope enforcement during a run, use missions (below). Details: [`docs/FEATURES.md`](docs/FEATURES.md#zero-config-cage-gantry-cage).
+Cage restores; it does not block. A change can be committed in the second before the next check, `git push --no-verify` skips the push guard, and a committed change stays in local history (cage restores the working tree only). Reads, network calls and writes outside the protected set are not seen. `--no-watch` checks once at exit instead. For scope enforced on every write, use missions (below). Details: [`docs/FEATURES.md`](docs/FEATURES.md#zero-config-cage-gantry-cage).
 
 ---
 
@@ -243,6 +239,10 @@ On failure, external agents ingest `findings[]`:
 }
 ```
 
+**v3.8.0:** per-project cage rules: `.cage.yaml` adds paths and globs to the protected set (additive only, self-protected, fail closed), `gantry cage suggest` proposes them for review, and `--allow-override <path>` reports instead of restoring one path for a run, always announced ([ADR-0048](.gitagent/out-of-scope/ADR-0048-cage-trust-model.md)). See [Try it in 60 seconds](#try-it-in-60-seconds-gantry-cage).
+
+**v3.7.1:** `gantry cage` restores protected files live during interactive agent sessions (default; `--no-watch` for exit-only) and refuses `git push` of protected paths from inside the session. See [Try it in 60 seconds](#try-it-in-60-seconds-gantry-cage).
+
 **v3.7.0:** zero-config `gantry cage -- <cmd>` (and `npx -p @jeger-ai/opengantry opengantry-cage -- <cmd>`) restores CI configs, `.env*`, git hooks/config and manifest forbidden zones after a one-shot agent run, reports lockfile changes, and exits 3 on tampering. See [Try it in 60 seconds](#try-it-in-60-seconds-gantry-cage).
 
 **v3.6.0:** `gate_adapter: tsc|eslint` fails closed on chained `gate_command`s (`GXT_GATE_ADAPTER_MISCONFIG`). `gantry hooks install` arms the tracked pre-commit hook so `gantry tmvc guard --strict` blocks commits outside the pinned mission. Optional local sqlite-vec contract drift index (`gantry contract embed`, `legislate --from-intent --embedding-file`). See [`docs/CHANGELOG.md`](docs/CHANGELOG.md) upgrade notes.

package/dist/cli/commands/cage.d.ts

@@ -3,6 +3,22 @@ export interface CageCliOptions {
     json?: boolean;
     reportOnly?: boolean;
     maxFileBytes?: string;
+    /** Commander sets false for `--no-watch`. */
+    watch?: boolean;
+    watchIntervalMs?: string;
+    allowOverride?: string[];
 }
 export declare function runCageCommand(options: CageCliOptions): Promise<void>;
+/** `gantry cage-guard pre-push --root <dir> [--plan <file>]`: called by the cage session pre-push hook. */
+export declare function runCageGuardPrePush(options: {
+    root: string;
+    plan?: string;
+}): Promise<void>;
+export interface CageSuggestCliOptions {
+    write?: boolean;
+    force?: boolean;
+    json?: boolean;
+}
+/** `gantry cage suggest`: propose `.cage.yaml` entries; prints them, or writes `.cage.yaml.suggested`. */
+export declare function runCageSuggestCommand(options: CageSuggestCliOptions): Promise<void>;
 //# sourceMappingURL=cage.d.ts.map

package/dist/cli/commands/cage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cage.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/cage.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AASD,wBAAsB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB3E"}
+{"version":3,"file":"cage.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/cage.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AASD,wBAAsB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA0C3E;AAED,2GAA2G;AAC3G,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAejG;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,0GAA0G;AAC1G,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBzF"}

package/dist/cli/commands/cage.js

@@ -1,8 +1,14 @@
-import { logError, setExitCode } from "../lib/cli-io.js";
+import fs from "node:fs";
+import path from "node:path";
+import { logError, readStdinIfEmpty, setExitCode } from "../lib/cli-io.js";
 import { emitCliJson, runUserCommandAsync } from "../lib/command-boundary.js";
-import { formatCageReport } from "../lib/cage/cage-report.js";
-import { runCage } from "../lib/cage/cage-run.js";
-function parseMaxFileBytes(raw) {
+import { CAGE_SESSION_LOG_ENV, findPushViolations } from "../lib/cage/cage-push-guard.js";
+import { formatCageOverrideBanner, formatCageReport } from "../lib/cage/cage-report.js";
+import { buildCagePlan, parseSerializedCagePlan } from "../lib/cage/cage-rules.js";
+import { resolveCageRoot, runCage } from "../lib/cage/cage-run.js";
+import { assertOutsideCageSession, formatCageSuggestionsYaml, suggestCageRules, writeCageSuggestions, } from "../lib/cage/cage-suggest.js";
+import { CAGE_CONFIG_FILE } from "../lib/cage/cage-config.js";
+function parseNonNegativeInt(raw) {
     if (raw === undefined)
         return { ok: true, value: undefined };
     const t = raw.trim();
@@ -17,14 +23,34 @@ export async function runCageCommand(options) {
         setExitCode(2);
         return;
     }
-    const max = parseMaxFileBytes(options.maxFileBytes);
-    if (!max.ok) {
-        logError("cage: --max-file-bytes must be a non-negative integer");
+    const max = parseNonNegativeInt(options.maxFileBytes);
+    const interval = parseNonNegativeInt(options.watchIntervalMs);
+    if (!max.ok || !interval.ok || interval.value === 0) {
+        logError("cage: --max-file-bytes must be a non-negative integer and --watch-interval-ms a positive integer");
         setExitCode(2);
         return;
     }
     await runUserCommandAsync({ json: options.json }, async () => {
-        const report = await runCage({ command, reportOnly: options.reportOnly, maxFileBytes: max.value });
+        const report = await runCage({
+            command,
+            reportOnly: options.reportOnly,
+            maxFileBytes: max.value,
+            watch: options.watch !== false,
+            watchIntervalMs: interval.value,
+            allowOverride: options.allowOverride,
+            // The only lines printed before the command starts; nothing is written while it runs except a bell.
+            onStart: ({ sessionLog, protectedFiles, watch, overrides, configCommitted }) => {
+                const mode = watch ? "watching" : "checking at exit";
+                const logPart = sessionLog ? `; live events: ${sessionLog}` : "";
+                console.error(`cage: ${mode} ${String(protectedFiles)} protected file(s)${logPart}`);
+                if (configCommitted === false) {
+                    console.error(`cage: warning: ${CAGE_CONFIG_FILE} is untracked or has uncommitted changes; review and commit it`);
+                }
+                const banner = formatCageOverrideBanner(overrides);
+                if (banner)
+                    console.error(banner);
+            },
+        });
         if (options.json) {
             emitCliJson(report);
         }
@@ -36,4 +62,47 @@ export async function runCageCommand(options) {
             setExitCode(report.exit_code);
     });
 }
+/** `gantry cage-guard pre-push --root <dir> [--plan <file>]`: called by the cage session pre-push hook. */
+export async function runCageGuardPrePush(options) {
+    const stdin = await readStdinIfEmpty("");
+    // The session plan (with its overrides) when the hook passes one; a fresh plan otherwise.
+    const plan = options.plan ? parseSerializedCagePlan(fs.readFileSync(options.plan, "utf8")) : buildCagePlan(options.root);
+    const violations = findPushViolations(plan, stdin);
+    if (violations.length === 0)
+        return;
+    const list = violations.map((v) => `${v.path} (${v.rule})`).join(", ");
+    console.error(`gantry cage: push refused: outgoing commits change protected paths: ${list}`);
+    console.error("gantry cage: revert those commits, or push outside the cage session.");
+    const logPath = process.env[CAGE_SESSION_LOG_ENV];
+    if (logPath && fs.existsSync(logPath)) {
+        const event = { at: new Date().toISOString(), event: "push_refused", paths: violations };
+        fs.appendFileSync(logPath, `${JSON.stringify(event)}\n`);
+    }
+    setExitCode(1);
+}
+/** `gantry cage suggest`: propose `.cage.yaml` entries; prints them, or writes `.cage.yaml.suggested`. */
+export async function runCageSuggestCommand(options) {
+    await runUserCommandAsync({ json: options.json }, () => {
+        assertOutsideCageSession();
+        const root = resolveCageRoot(process.cwd());
+        const result = suggestCageRules(root);
+        const yaml = formatCageSuggestionsYaml(result, fs.existsSync(path.join(root, CAGE_CONFIG_FILE)));
+        const n = result.suggestions.length;
+        let written = null;
+        if (options.write && n > 0)
+            written = writeCageSuggestions(root, yaml, options.force === true);
+        if (options.json) {
+            emitCliJson({ ...result, written: written ? path.basename(written) : null });
+        }
+        else if (!options.write) {
+            process.stdout.write(yaml);
+        }
+        const covered = `${String(result.already_covered)} already protected`;
+        if (written)
+            console.error(`cage suggest: wrote ${path.basename(written)} (${String(n)} entr${n === 1 ? "y" : "ies"}; ${covered}); review it, then move what you keep into ${CAGE_CONFIG_FILE}`);
+        else
+            console.error(`cage suggest: ${String(n)} new suggestion(s); ${covered}`);
+        return Promise.resolve();
+    });
+}
 //# sourceMappingURL=cage.js.map

package/dist/cli/commands/cage.js.map

@@ -1 +1 @@
-{"version":3,"file":"cage.js","sourceRoot":"","sources":["../../../src/cli/commands/cage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AASlD,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC7D,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAC3C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,yDAAyD,CAAC,CAAC;QACpE,WAAW,CAAC,CAAC,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,QAAQ,CAAC,uDAAuD,CAAC,CAAC;QAClE,WAAW,CAAC,CAAC,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IAED,MAAM,mBAAmB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACnG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,WAAW,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,MAAM,CAAC;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC;YAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"cage.js","sourceRoot":"","sources":["../../../src/cli/commands/cage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAa9D,SAAS,mBAAmB,CAAC,GAAuB;IAClD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC7D,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAC3C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,yDAAyD,CAAC,CAAC;QACpE,WAAW,CAAC,CAAC,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QACpD,QAAQ,CAAC,kGAAkG,CAAC,CAAC;QAC7G,WAAW,CAAC,CAAC,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IAED,MAAM,mBAAmB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC3B,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE,GAAG,CAAC,KAAK;YACvB,KAAK,EAAE,OAAO,CAAC,KAAK,KAAK,KAAK;YAC9B,eAAe,EAAE,QAAQ,CAAC,KAAK;YAC/B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,oGAAoG;YACpG,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE;gBAC7E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC;gBACrD,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,MAAM,CAAC,cAAc,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;gBACrF,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;oBAC9B,OAAO,CAAC,KAAK,CAAC,kBAAkB,gBAAgB,gEAAgE,CAAC,CAAC;gBACpH,CAAC;gBACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;gBACnD,IAAI,MAAM;oBAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;SACF,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,WAAW,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,MAAM,CAAC;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC;YAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAwC;IAChF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACzC,0FAA0F;IAC1F,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzH,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO,CAAC,KAAK,CAAC,uEAAuE,IAAI,EAAE,CAAC,CAAC;IAC7F,OAAO,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAClD,IAAI,OAAO,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACzF,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,WAAW,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAQD,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAA8B;IACxE,MAAM,mBAAmB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE;QACrD,wBAAwB,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,yBAAyB,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACjG,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;QACpC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,WAAW,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,oBAAoB,CAAC;QACtE,IAAI,OAAO;YAAE,OAAO,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,8CAA8C,gBAAgB,EAAE,CAAC,CAAC;;YAC5L,OAAO,CAAC,KAAK,CAAC,iBAAiB,MAAM,CAAC,CAAC,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;QAC/E,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/lib/cage/cage-config.d.ts

@@ -0,0 +1,29 @@
+/** Per-project cage config at the cage root. Additive only: it can protect more, never less. */
+export declare const CAGE_CONFIG_FILE = ".cage.yaml";
+export type CageConfigMode = "revert" | "report";
+/** One `protect:` entry: a root-relative path (file or directory tree) or a glob over root-relative paths. */
+export interface CageProtectEntry {
+    kind: "path" | "glob";
+    /** Normalized POSIX value: no leading `./`, no trailing `/`. */
+    value: string;
+    mode: CageConfigMode;
+}
+export interface CageConfig {
+    present: boolean;
+    entries: CageProtectEntry[];
+}
+/** Root-relative POSIX path or glob; rejects absolute, `..`, and empty values. */
+export declare function normalizeCageRelPath(raw: string): string | null;
+/**
+ * Read `.cage.yaml` at the cage root. A missing file is the zero-config default; anything unreadable,
+ * malformed or subtractive throws so cage fails closed before the wrapped command runs.
+ */
+export declare function loadCageConfig(root: string): CageConfig;
+/**
+ * Whether `.cage.yaml` is on record: tracked and identical to `HEAD`. Null outside a git work tree.
+ * Unreviewed rules can only protect more, so cage warns rather than refuses.
+ */
+export declare function cageConfigCommitted(root: string): boolean | null;
+/** `*` and `?` stay inside one path segment; `**` spans any depth (`**\/x` also matches top-level `x`). */
+export declare function cageGlobToRegExp(glob: string): RegExp;
+//# sourceMappingURL=cage-config.d.ts.map

package/dist/cli/lib/cage/cage-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cage-config.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-config.ts"],"names":[],"mappings":"AAMA,gGAAgG;AAChG,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjD,8GAA8G;AAC9G,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAoCD,kFAAkF;AAClF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK/D;AA2CD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAUvD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAMhE;AAED,2GAA2G;AAC3G,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiBrD"}

package/dist/cli/lib/cage/cage-config.js

@@ -0,0 +1,143 @@
+import fs from "node:fs";
+import path from "node:path";
+import { parseDocument } from "yaml";
+import { GantryUserError } from "../errors.js";
+import { gitRun } from "../git/git.js";
+/** Per-project cage config at the cage root. Additive only: it can protect more, never less. */
+export const CAGE_CONFIG_FILE = ".cage.yaml";
+/** Keys that would loosen protection. Named in the error so authors know relaxation is a runtime flag. */
+const SUBTRACTIVE_KEYS = new Set([
+    "relax",
+    "exclude",
+    "excludes",
+    "allow",
+    "allow_override",
+    "allow_overrides",
+    "ignore",
+    "unprotect",
+    "override",
+    "overrides",
+    "disable",
+    "skip",
+]);
+const ENTRY_KEYS = new Set(["path", "glob", "mode"]);
+function configError(message) {
+    return new GantryUserError("GXT_CAGE_CONFIG_INVALID", `cage: ${CAGE_CONFIG_FILE}: ${message}`, `${CAGE_CONFIG_FILE} is additive only (protect: entries). Relax a rule for one run with --allow-override <path>.`, 2);
+}
+function unknownKey(key, where) {
+    if (SUBTRACTIVE_KEYS.has(key)) {
+        return configError(`${where}: "${key}" would remove protection; subtractive keys are not allowed`);
+    }
+    return configError(`${where}: unknown key "${key}"`);
+}
+/** Root-relative POSIX path or glob; rejects absolute, `..`, and empty values. */
+export function normalizeCageRelPath(raw) {
+    const norm = raw.trim().replace(/\\/g, "/").replace(/^(\.\/)+/, "").replace(/\/+$/, "");
+    if (!norm || norm === "." || norm.startsWith("/") || /^[A-Za-z]:/.test(norm))
+        return null;
+    if (norm.split("/").some((seg) => seg === ".." || seg === "." || seg === ""))
+        return null;
+    return norm;
+}
+function parseEntry(raw, index) {
+    const where = `protect[${String(index)}]`;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw configError(`${where}: expected a mapping with path: or glob:`);
+    }
+    const obj = raw;
+    for (const key of Object.keys(obj)) {
+        if (!ENTRY_KEYS.has(key))
+            throw unknownKey(key, where);
+    }
+    const hasPath = "path" in obj;
+    if (hasPath === "glob" in obj)
+        throw configError(`${where}: set exactly one of path: or glob:`);
+    const kind = hasPath ? "path" : "glob";
+    const rawValue = obj[kind];
+    const value = typeof rawValue === "string" ? normalizeCageRelPath(rawValue) : null;
+    if (!value)
+        throw configError(`${where}: ${kind} must be a root-relative path without ".." or a leading "/"`);
+    const mode = obj.mode ?? "revert";
+    if (mode !== "revert" && mode !== "report")
+        throw configError(`${where}: mode must be revert or report`);
+    return { kind, value, mode };
+}
+function parseConfigText(text) {
+    const doc = parseDocument(text, { uniqueKeys: true });
+    if (doc.errors.length > 0)
+        throw configError(`invalid YAML: ${doc.errors[0].message.split("\n")[0]}`);
+    let data;
+    try {
+        // No aliases: a protect list has no use for them, and they are the YAML expansion-bomb vector.
+        data = doc.toJS({ maxAliasCount: 0 });
+    }
+    catch (err) {
+        throw configError(`invalid YAML: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (data === null || data === undefined)
+        return { present: true, entries: [] };
+    if (typeof data !== "object" || Array.isArray(data))
+        throw configError("expected a mapping with a protect: list");
+    const obj = data;
+    for (const key of Object.keys(obj)) {
+        if (key !== "protect")
+            throw unknownKey(key, "top level");
+    }
+    const protect = obj.protect ?? [];
+    if (!Array.isArray(protect))
+        throw configError("protect: must be a list");
+    return { present: true, entries: protect.map((e, i) => parseEntry(e, i)) };
+}
+/**
+ * Read `.cage.yaml` at the cage root. A missing file is the zero-config default; anything unreadable,
+ * malformed or subtractive throws so cage fails closed before the wrapped command runs.
+ */
+export function loadCageConfig(root) {
+    const file = path.join(root, CAGE_CONFIG_FILE);
+    let text;
+    try {
+        text = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { present: false, entries: [] };
+        throw configError(`unreadable (${err.code ?? "ERROR"})`);
+    }
+    return parseConfigText(text);
+}
+/**
+ * Whether `.cage.yaml` is on record: tracked and identical to `HEAD`. Null outside a git work tree.
+ * Unreviewed rules can only protect more, so cage warns rather than refuses.
+ */
+export function cageConfigCommitted(root) {
+    const tracked = gitRun(root, ["ls-files", "--", CAGE_CONFIG_FILE]);
+    if (!tracked.ok)
+        return null;
+    if (!tracked.stdout.trim())
+        return false;
+    const status = gitRun(root, ["status", "--porcelain", "--", CAGE_CONFIG_FILE]);
+    return status.ok ? status.stdout.trim() === "" : null;
+}
+/** `*` and `?` stay inside one path segment; `**` spans any depth (`**\/x` also matches top-level `x`). */
+export function cageGlobToRegExp(glob) {
+    let re = "";
+    for (let i = 0; i < glob.length; i += 1) {
+        const ch = glob[i];
+        if (ch === "*" && glob[i + 1] === "*") {
+            const slash = glob[i + 2] === "/";
+            re += slash ? "(?:.*/)?" : ".*";
+            i += slash ? 2 : 1;
+        }
+        else if (ch === "*") {
+            re += "[^/]*";
+        }
+        else if (ch === "?") {
+            re += "[^/]";
+        }
+        else {
+            re += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+        }
+    }
+    return new RegExp(`^${re}$`);
+}
+//# sourceMappingURL=cage-config.js.map

package/dist/cli/lib/cage/cage-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cage-config.js","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAiB7C,0GAA0G;AAC1G,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,OAAO;IACP,SAAS;IACT,UAAU;IACV,OAAO;IACP,gBAAgB;IAChB,iBAAiB;IACjB,QAAQ;IACR,WAAW;IACX,UAAU;IACV,WAAW;IACX,SAAS;IACT,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE1E,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,IAAI,eAAe,CACxB,yBAAyB,EACzB,SAAS,gBAAgB,KAAK,OAAO,EAAE,EACvC,GAAG,gBAAgB,8FAA8F,EACjH,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,KAAa;IAC5C,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC,GAAG,KAAK,MAAM,GAAG,6DAA6D,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,KAAK,kBAAkB,GAAG,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1F,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,GAAY,EAAE,KAAa;IAC7C,MAAM,KAAK,GAAG,WAAW,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;IAC1C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,WAAW,CAAC,GAAG,KAAK,0CAA0C,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,GAAG,CAAC;IAC9B,IAAI,OAAO,KAAK,MAAM,IAAI,GAAG;QAAE,MAAM,WAAW,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,IAAI,CAAC,KAAK;QAAE,MAAM,WAAW,CAAC,GAAG,KAAK,KAAK,IAAI,6DAA6D,CAAC,CAAC;IAC9G,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC;IAClC,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ;QAAE,MAAM,WAAW,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IACzG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,WAAW,CAAC,iBAAiB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;IACxG,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,+FAA+F;QAC/F,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,WAAW,CAAC,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC/E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,WAAW,CAAC,yCAAyC,CAAC,CAAC;IAClH,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC/C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7F,MAAM,WAAW,CAAC,eAAgB,GAA6B,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;YAClC,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAChC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,EAAE,IAAI,OAAO,CAAC;QAChB,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC"}

package/dist/cli/lib/cage/cage-process.d.ts

@@ -14,5 +14,5 @@ export declare function signalExitCode(signal: NodeJS.Signals): number;
  *   shared process group, and forwarding it again would double-interrupt.
  * - SIGTERM / SIGHUP are forwarded to the child instead of killing the cage.
  */
-export declare function spawnCaged(argv: readonly string[], cwd: string): Promise<CageProcessResult>;
+export declare function spawnCaged(argv: readonly string[], cwd: string, extraEnv?: NodeJS.ProcessEnv): Promise<CageProcessResult>;
 //# sourceMappingURL=cage-process.d.ts.map

package/dist/cli/lib/cage/cage-process.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cage-process.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-process.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,0DAA0D;IAC1D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAG7D;AAID;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkBjG"}
+{"version":3,"file":"cage-process.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-process.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,0DAA0D;IAC1D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,CAG7D;AAID;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAM,CAAC,UAAe,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAkB5B"}

package/dist/cli/lib/cage/cage-process.js

@@ -14,9 +14,9 @@ const FORWARDED_SIGNALS = ["SIGTERM", "SIGHUP"];
  *   shared process group, and forwarding it again would double-interrupt.
  * - SIGTERM / SIGHUP are forwarded to the child instead of killing the cage.
  */
-export async function spawnCaged(argv, cwd) {
+export async function spawnCaged(argv, cwd, extraEnv = {}) {
     const [command, ...args] = argv;
-    const child = spawn(command, args, { cwd, stdio: "inherit", env: process.env });
+    const child = spawn(command, args, { cwd, stdio: "inherit", env: { ...process.env, ...extraEnv } });
     const ignoreInt = () => { };
     const forward = (sig) => {
         child.kill(sig);

package/dist/cli/lib/cage/cage-process.js.map

@@ -1 +1 @@
-{"version":3,"file":"cage-process.js","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AASzB,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,iBAAiB,GAA8B,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAuB,EAAE,GAAW;IACnE,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,GAAS,EAAE,GAAE,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,GAAmB,EAAQ,EAAE;QAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,iBAAiB;QAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,EAAE;YACtD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3F,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,iBAAiB;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}
+{"version":3,"file":"cage-process.js","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AASzB,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,iBAAiB,GAA8B,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAuB,EACvB,GAAW,EACX,WAA8B,EAAE;IAEhC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrG,MAAM,SAAS,GAAG,GAAS,EAAE,GAAE,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,GAAmB,EAAQ,EAAE;QAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,iBAAiB;QAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,EAAE;YACtD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3F,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,iBAAiB;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}

package/dist/cli/lib/cage/cage-push-guard.d.ts

@@ -0,0 +1,26 @@
+import { type CagePlan, type CageRuleId } from "./cage-rules.js";
+/** Env var the session hook reads to find the cage session log. */
+export declare const CAGE_SESSION_LOG_ENV = "GANTRY_CAGE_SESSION_LOG";
+export interface CagePushGuard {
+    hooksDir: string;
+    /** Env additions for the caged process tree (GIT_CONFIG_* appends, never replaces, existing entries). */
+    env: NodeJS.ProcessEnv;
+    dispose(): void;
+}
+/**
+ * Create a temporary hooks dir outside the repo and the env that points the caged process tree at it.
+ * Returns null outside a git work tree. Nothing is written into the repository.
+ */
+export declare function createCagePushGuard(plan: CagePlan, sessionLogPath: string | null): CagePushGuard | null;
+/**
+ * Rule for a repo-relative path in an outgoing commit, resolved exactly like the live snapshot.
+ * Report-mode paths (lockfiles, report entries, `--allow-override`) never block a push.
+ */
+export declare function pushGuardRule(plan: CagePlan, rel: string): CageRuleId | null;
+export interface PushGuardViolation {
+    path: string;
+    rule: CageRuleId;
+}
+/** Parse pre-push stdin (`<local ref> <local sha> <remote ref> <remote sha>` per line) and list protected paths. */
+export declare function findPushViolations(plan: CagePlan, prePushStdin: string): PushGuardViolation[];
+//# sourceMappingURL=cage-push-guard.d.ts.map

package/dist/cli/lib/cage/cage-push-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cage-push-guard.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-push-guard.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuC,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AA2BtG,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAK9D,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,yGAAyG;IACzG,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,IAAI,IAAI,CAAC;CACjB;AAwCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,aAAa,GAAG,IAAI,CAavG;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAG5E;AAMD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,oHAAoH;AACpH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAa7F"}

package/dist/cli/lib/cage/cage-push-guard.js

@@ -0,0 +1,114 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { gitRun } from "../git/git.js";
+import { classifyCagePath, serializeCagePlan } from "./cage-rules.js";
+/** Standard client-side git hooks; each session wrapper chains to the repo's real hook of the same name. */
+const GIT_HOOK_NAMES = [
+    "applypatch-msg",
+    "pre-applypatch",
+    "post-applypatch",
+    "pre-commit",
+    "pre-merge-commit",
+    "prepare-commit-msg",
+    "commit-msg",
+    "post-commit",
+    "pre-rebase",
+    "post-checkout",
+    "post-merge",
+    "pre-push",
+    "pre-auto-gc",
+    "post-rewrite",
+    "sendemail-validate",
+    "fsmonitor-watchman",
+    "post-index-change",
+    "reference-transaction",
+    "push-to-checkout",
+];
+const ZERO_SHA = /^0+$/;
+/** Env var the session hook reads to find the cage session log. */
+export const CAGE_SESSION_LOG_ENV = "GANTRY_CAGE_SESSION_LOG";
+/** The session plan, written next to the hooks so the push guard checks exactly what the session protects. */
+const PLAN_FILE = "cage-plan.json";
+function shellQuote(s) {
+    return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+function activeHooksDir(root) {
+    const r = gitRun(root, ["rev-parse", "--path-format=absolute", "--git-path", "hooks"]);
+    const out = r.stdout.trim();
+    return r.ok && out ? path.resolve(out) : null;
+}
+/** The CLI entry the session pre-push hook calls (`dist/cli/index.js`, next to this module's `lib/`). */
+function cliEntry() {
+    return fileURLToPath(new URL("../../index.js", import.meta.url));
+}
+function hookScript(name, realHooks, root, planFile) {
+    const real = shellQuote(path.join(realHooks, name));
+    const guard = name === "pre-push"
+        ? `stdin_copy="$(cat)"\nprintf '%s\\n' "$stdin_copy" | ${shellQuote(process.execPath)} ${shellQuote(cliEntry())} cage-guard pre-push --root ${shellQuote(root)} --plan ${shellQuote(planFile)} || exit 1\n`
+        : "";
+    const chain = name === "pre-push"
+        ? `if [ -x ${real} ]; then printf '%s\\n' "$stdin_copy" | ${real} "$@"; exit $?; fi\n`
+        : `if [ -x ${real} ]; then exec ${real} "$@"; fi\n`;
+    return `#!/bin/sh\n# gantry cage session hook (temporary; removed when the cage session ends)\n${guard}${chain}exit 0\n`;
+}
+function gitConfigEnv(hooksDir) {
+    const raw = process.env.GIT_CONFIG_COUNT;
+    const n = raw && /^\d+$/.test(raw) ? Number.parseInt(raw, 10) : 0;
+    return {
+        GIT_CONFIG_COUNT: String(n + 1),
+        [`GIT_CONFIG_KEY_${String(n)}`]: "core.hooksPath",
+        [`GIT_CONFIG_VALUE_${String(n)}`]: hooksDir,
+    };
+}
+/**
+ * Create a temporary hooks dir outside the repo and the env that points the caged process tree at it.
+ * Returns null outside a git work tree. Nothing is written into the repository.
+ */
+export function createCagePushGuard(plan, sessionLogPath) {
+    const root = plan.root;
+    const realHooks = activeHooksDir(root);
+    if (!realHooks)
+        return null;
+    const hooksDir = fs.mkdtempSync(path.join(os.tmpdir(), "gantry-cage-hooks-"));
+    const planFile = path.join(hooksDir, PLAN_FILE);
+    fs.writeFileSync(planFile, serializeCagePlan(plan), { mode: 0o600 });
+    for (const name of GIT_HOOK_NAMES) {
+        fs.writeFileSync(path.join(hooksDir, name), hookScript(name, realHooks, root, planFile), { mode: 0o755 });
+    }
+    const env = { ...gitConfigEnv(hooksDir) };
+    if (sessionLogPath)
+        env[CAGE_SESSION_LOG_ENV] = sessionLogPath;
+    return { hooksDir, env, dispose: () => fs.rmSync(hooksDir, { recursive: true, force: true }) };
+}
+/**
+ * Rule for a repo-relative path in an outgoing commit, resolved exactly like the live snapshot.
+ * Report-mode paths (lockfiles, report entries, `--allow-override`) never block a push.
+ */
+export function pushGuardRule(plan, rel) {
+    const hit = classifyCagePath(plan, rel);
+    return hit && hit.mode === "revert" ? hit.rule : null;
+}
+function outgoingRange(localSha, remoteSha) {
+    return ZERO_SHA.test(remoteSha) ? [localSha, "--not", "--remotes"] : [`${remoteSha}..${localSha}`];
+}
+/** Parse pre-push stdin (`<local ref> <local sha> <remote ref> <remote sha>` per line) and list protected paths. */
+export function findPushViolations(plan, prePushStdin) {
+    const hits = new Map();
+    for (const line of prePushStdin.split(/\r?\n/)) {
+        const [, localSha, , remoteSha] = line.trim().split(/\s+/);
+        if (!localSha || !remoteSha || ZERO_SHA.test(localSha))
+            continue;
+        const r = gitRun(plan.root, ["log", "--format=", "--name-only", ...outgoingRange(localSha, remoteSha)]);
+        if (!r.ok)
+            continue;
+        for (const rel of r.stdout.split(/\r?\n/).map((s) => s.trim()).filter(Boolean)) {
+            const rule = pushGuardRule(plan, rel);
+            if (rule)
+                hits.set(rel, rule);
+        }
+    }
+    return [...hits].map(([p, rule]) => ({ path: p, rule })).sort((a, b) => a.path.localeCompare(b.path));
+}
+//# sourceMappingURL=cage-push-guard.js.map

package/dist/cli/lib/cage/cage-push-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cage-push-guard.js","sourceRoot":"","sources":["../../../../src/cli/lib/cage/cage-push-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAkC,MAAM,iBAAiB,CAAC;AAEtG,4GAA4G;AAC5G,MAAM,cAAc,GAAG;IACrB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,YAAY;IACZ,kBAAkB;IAClB,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,eAAe;IACf,YAAY;IACZ,UAAU;IACV,aAAa;IACb,cAAc;IACd,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,uBAAuB;IACvB,kBAAkB;CACV,CAAC;AAEX,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB,mEAAmE;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D,8GAA8G;AAC9G,MAAM,SAAS,GAAG,gBAAgB,CAAC;AASnC,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,yGAAyG;AACzG,SAAS,QAAQ;IACf,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,SAAiB,EAAE,IAAY,EAAE,QAAgB;IACjF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IACpD,MAAM,KAAK,GACT,IAAI,KAAK,UAAU;QACjB,CAAC,CAAC,uDAAuD,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC,+BAA+B,UAAU,CAAC,IAAI,CAAC,WAAW,UAAU,CAAC,QAAQ,CAAC,cAAc;QAC3M,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,KAAK,GACT,IAAI,KAAK,UAAU;QACjB,CAAC,CAAC,WAAW,IAAI,2CAA2C,IAAI,sBAAsB;QACtF,CAAC,CAAC,WAAW,IAAI,iBAAiB,IAAI,aAAa,CAAC;IACxD,OAAO,0FAA0F,KAAK,GAAG,KAAK,UAAU,CAAC;AAC3H,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO;QACL,gBAAgB,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC,kBAAkB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB;QACjD,CAAC,oBAAoB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ;KAC5C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAc,EAAE,cAA6B;IAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,GAAG,GAAsB,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7D,IAAI,cAAc;QAAE,GAAG,CAAC,oBAAoB,CAAC,GAAG,cAAc,CAAC;IAC/D,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAc,EAAE,GAAW;IACvD,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,SAAiB;IACxD,OAAO,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,KAAK,QAAQ,EAAE,CAAC,CAAC;AACrG,CAAC;AAOD,oHAAoH;AACpH,MAAM,UAAU,kBAAkB,CAAC,IAAc,EAAE,YAAoB;IACrE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,EAAE,QAAQ,EAAE,AAAD,EAAG,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QACxG,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,SAAS;QACpB,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACtC,IAAI,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACxG,CAAC"}