@lannguyensi/harness 0.43.0 → 0.44.0

package/dist/cli/policy/intercept.js

@@ -10,7 +10,8 @@ import * as path from "node:path";
 import { intercept, recordPolicyDecisionOnSession, resolveGitContext, resolveKubeContext, } from "../../runtime/index.js";
 import { resolveGeneratedDir, writePendingApproval } from "../../runtime/pending-approval.js";
 import { parseBashPrefix } from "../../runtime/bash-prefix-parse.js";
-import { MAX_NORMALIZE_LENGTH, normalizeCommand, } from "../../runtime/command-normalize.js";
+import { MAX_NORMALIZE_LENGTH, normalizeCommand, normalizeCommandAmpAware, segmentViewOf, } from "../../runtime/command-normalize.js";
+import { extractShellCommand, SHELL_ALIASES } from "../../runtime/tool-name-aliases.js";
 import { loadManifest } from "../loader.js";
 import { checkPauseFromLoader } from "../pause-check.js";
 async function readStdin(stream) {
@@ -92,11 +93,13 @@ function readBashCommand(input) {
     const cmd = input.command;
     return typeof cmd === "string" && cmd.length > 0 ? cmd : null;
 }
+// Derived from `SHELL_ALIASES` rather than hand-copying its members (fix
+// round 2): `tool-name-aliases.ts`'s own header warns against the copy,
+// and since fix round 1 the precompute-matches-matcher argument above
+// depends on this set and the alias expansion agreeing. Deriving it means
+// they cannot drift apart.
 function isCodexShellTool(toolName) {
-    return (toolName === "Bash" ||
-        toolName === "shell" ||
-        toolName === "exec_command" ||
-        toolName === "functions.exec_command");
+    return typeof toolName === "string" && SHELL_ALIASES.includes(toolName);
 }
 function extractPerCallCwd(input) {
     if (!input || typeof input !== "object" || Array.isArray(input))
@@ -303,45 +306,166 @@ export async function runInterceptCli(opts = {}) {
     // literal `preflight:`. An explicit env var still wins: it is the
     // operator's deliberate override of the derived value.
     //
-    // Deliberately CWD-ONLY, not target-directory-aware: a command that
-    // explicitly names a different repository (`git -C <B>`, `env -C
-    // <B>`, a leading `cd <B> &&`) still resolves ${REPO}/${BRANCH} from
-    // the hook's own cwd, so a preflight recorded for repo A still
-    // authorises a command that explicitly reads repo B — unchanged from
-    // the shipped 0.42.0 behaviour. A per-command target-directory
-    // resolution was built and reviewed (run
-    // 2026-07-27-gate-target-repo-resolution) but removed before shipping:
-    // three consecutive review rounds each found a different way one
-    // global `targetDir` per event leaked into the wrong evaluation (Risk
-    // Gate risk declassification; a push-gate multi-invocation fail-open;
-    // a non-git gated verb sharing a chain with a targeted git call, first
-    // via `&&`, then still open via `|` / `||`). Each fix was partial
-    // because a single per-event `targetDir` cannot express "this
-    // invocation targets repo B, but the gated verb after it runs in the
-    // caller's cwd" — the correct fix attributes a target to the SEGMENT
-    // that satisfies a policy's own trigger, which needs the policy
-    // builtins to become per-policy, not per-event. The extraction itself
-    // (`command-normalize.ts`'s `targetDir`/`targetBase`) stays in the
-    // tree, fully tested, as the foundation for that redesign — tracked as
-    // follow-up task `98ad072f`.
+    // `cwdGitContext` below is the DEFAULT / FALLBACK builtins basis, not
+    // the only one used anymore (task `98ad072f`, T-003). A command that
+    // explicitly names a different repository (`git -C <B>`, `env -C <B>`,
+    // a leading `cd <B> &&`) still resolves `builtins.REPO`/`.BRANCH` (and
+    // `currentHeadSha`, below) from THIS cwd for the majority of policies —
+    // any policy whose `requires:` doesn't reference `${REPO}`/`${BRANCH}`/
+    // `at_head` stays exactly on this cwd-only path, as does any policy
+    // whose own trigger-satisfying segment names no foreign target. Only a
+    // MATCHED policy that (a) uses `${REPO}`/`${BRANCH}`/`at_head` and (b)
+    // whose own `bash_match`-satisfying segment names a different,
+    // resolvable git repository gets a per-policy override — resolved
+    // lazily, inside `intercept()`, from the `commandSegments` view threaded
+    // below, never from this `cwdGitContext`. A prior attempt (run
+    // `2026-07-27-gate-target-repo-resolution`) tried a single global
+    // `targetDir` per event instead and was removed before shipping: three
+    // consecutive review rounds each found a different way one event-wide
+    // target leaked into the wrong evaluation (Risk Gate risk
+    // declassification; a push-gate multi-invocation fail-open; a non-git
+    // gated verb sharing a chain with a targeted git call). This
+    // `cwdGitContext` variable, and the `builtins` object built from it
+    // below, remain exactly what they were before this task — the resolved
+    // fallback every policy without a foreign attribution still uses,
+    // including the Risk Gate's own `resolverGit` further down, which
+    // this task does not touch at all.
     const cwd = resolvePolicyCwd(event, opts.codexCommandCwd);
     const cwdGitContext = resolveGitContext(cwd);
-    // Computed once here (not per-policy) so `intercept()` below can
-    // thread the SAME `NormalizedCommand` into every `bash_match` trigger
-    // check instead of each one recomputing it.
-    const normalizedCommand = event.tool_name === "Bash"
-        ? (() => {
-            const cmd = readBashCommand(event.tool_input);
-            return cmd === null ? undefined : normalizeCommand(cmd);
-        })()
-        : undefined;
+    // Computed once here (not per-policy) so `intercept()` below can thread
+    // the SAME `NormalizedCommand` into every `bash_match` trigger check
+    // instead of each one recomputing it.
+    //
+    // Fix round 1, finding F4: derive this from `extractShellCommand(event)`
+    // — the SAME function `policyMatchesEvent`'s `bash_match` branch itself
+    // calls (`src/runtime/tool-name-aliases.ts`) — instead of the narrower
+    // `event.tool_name === "Bash"` + `readBashCommand(event.tool_input)` pair
+    // this used before, which only ever looked at `tool_input.command`. A
+    // Codex shell event (`tool_name: "shell"` / `"exec_command"` /
+    // `"functions.exec_command"`, which `expandToolNameAliases` maps onto
+    // `match: "Bash"` policies) commonly carries its command under
+    // `raw_input`/`input` rather than `tool_input`, or under a `cmd` key —
+    // `extractShellCommand` reads all of those, `readBashCommand` read none
+    // of them. Before this fix such an event still reached the `bash_match`
+    // branch (via alias expansion) but with no precomputed value, so
+    // `policyMatchesEvent`'s per-policy fallback ran BOTH normalisation
+    // passes once PER MATCHING POLICY instead of once per event.
+    // `isCodexShellTool` scopes the precompute to exactly the tool-name set
+    // `SHELL_ALIASES` expands (Bash plus the three Codex shell aliases), so
+    // this does not start normalising unrelated tool calls that merely
+    // happen to carry a `command`/`cmd`-named argument for some other
+    // purpose.
+    //
+    // Fix round 2: that set is NOT, as this comment previously claimed, the
+    // only way a `match: "Bash"` policy's `bash_match` branch can be
+    // reached. `trigger.match` is a SUBSTRING test over the expanded alias
+    // list, so `BashOutput` and `KillBash` — real Claude Code tool names —
+    // satisfy `match: "Bash"` too and do reach that branch (measured: both
+    // return `policyMatchesEvent === true`). They simply fall through to
+    // the per-policy fallback here, exactly as they did before this change,
+    // so nothing is gated differently; the precompute just does not
+    // de-duplicate for them.
+    //
+    // This also makes the precomputed value and the matcher's own value
+    // PROVABLY consistent for the common case: both are now the same
+    // `extractShellCommand(event)` call, so the latent
+    // `raw_input`/`input`/`cmd` divergence `InterceptOptions.normalizedCommand`'s
+    // own JSDoc warns about (nothing verifies the threaded value came from
+    // the event's real command) can no longer actually diverge for a
+    // `tool_name` in `SHELL_ALIASES` — the one production call site
+    // (`runInterceptCli`) derives both from the identical event via the
+    // identical function. It remains an unenforced INVARIANT, not a checked
+    // one: nothing stops a future second caller from threading a mismatched
+    // value in, and `event.tool_input`/`raw_input`/`input` could still
+    // change between the moment this is read and any later read of the same
+    // event object, however unlikely in practice.
+    //
+    // TWO behavioural differences, both checked (fix round 2 corrects the
+    // prior wording, which named only the first):
+    //
+    // 1. `readBashCommand` required a NON-EMPTY string; `extractShellCommand`
+    //    accepts an empty one. An empty command now becomes
+    //    `bashCommand = ""` instead of `null`, so `normalizedCommand`
+    //    becomes a defined `normalizeCommand("") = {normalized: "",
+    //    truncated: false, ...}` instead of staying `undefined` —
+    //    behaviourally identical either way (a pure function of the empty
+    //    string, now computed once instead of falling back per policy), and
+    //    `truncated` can never be `true` for an empty string, so the
+    //    `MAX_NORMALIZE_LENGTH` stderr line just below cannot fire from it.
+    //
+    // 2. That stderr line's SCOPE widened. Under the old ternary
+    //    `bashCommand` was unconditionally `null` for any non-`Bash`
+    //    `tool_name`, so `normalizedCommand` stayed `undefined` and the
+    //    guard could never fire for a Codex shell event, nor for a command
+    //    carried under `raw_input`/`input` or a `cmd` key. Measured at
+    //    HEAD: a `tool_name: "shell"` event with a 100,001-char
+    //    `raw_input.cmd` now emits the line. The direction is
+    //    safety-positive — a previously SILENT loss of normalised-form
+    //    coverage on those events is now reported — but it is a real change
+    //    in observable output, so it is named here rather than implied.
+    const bashCommand = isCodexShellTool(event.tool_name) ? extractShellCommand(event) : null;
+    const normalizedCommand = bashCommand === null ? undefined : normalizeCommand(bashCommand);
+    // Per-segment view for `intercept()`'s per-policy attribution (task
+    // `98ad072f`, T-003) — deferred behind a memoised thunk, mirroring
+    // `ampNormalizedCommandThunk` below (D-015 fix round, run
+    // 2026-08-02-per-repo-gate-scoping-redesign, correcting this comment's
+    // own prior claim). CORRECTED: this is NOT "the same class as
+    // `normalizeCommand`'s own eager call just above" — `segmentViewOf` runs
+    // its OWN full segmentation walk over `bashCommand` (`command-
+    // normalize.ts`'s `segmentAndCanonicalize`, a SEPARATE call from the one
+    // `normalizeCommand` just made on the SAME string), and computing it
+    // unconditionally, for every Bash event, regardless of whether any
+    // policy in the manifest even uses `${REPO}`/`${BRANCH}`/`at_head`, was
+    // measured as a real, avoidable second pass — +206% at
+    // `MAX_NORMALIZE_LENGTH` (2.73 → 8.36 ms; see `segmentViewOf`'s own doc
+    // comment in `command-normalize.ts`). Threading it as a self-memoising
+    // thunk instead — the exact shape `ampNormalizedCommandThunk` below
+    // already uses for the same reason — lets `intercept()`'s
+    // `usesPerRepoBuiltins` gate decide whether the walk happens at all: a
+    // manifest with none of those policies never calls `segmentViewOf`, and
+    // a manifest that DOES still only pays the cost once per event, on
+    // first use, not once per Bash event regardless of need.
+    let commandSegmentsCache;
+    const commandSegmentsThunk = bashCommand === null
+        ? undefined
+        : () => {
+            if (commandSegmentsCache === undefined) {
+                commandSegmentsCache = segmentViewOf(bashCommand);
+            }
+            return commandSegmentsCache;
+        };
+    // Memoised thunk for the ampersand-aware SECOND normalisation pass
+    // (task aabbad63). Unlike `normalizedCommand` above — eagerly computed
+    // once per Bash event, because `policyMatchesEvent`'s first two arms
+    // may need it on every raw-miss — the amp-aware pass is consulted only
+    // as a THIRD, additional arm, and only when a policy's regex has
+    // already missed BOTH the raw command and `normalizedCommand`; most
+    // events never reach it at all. Computing it eagerly here would pay
+    // its segmentation cost on the common path for every single Bash call
+    // inside the ~1000ms hook budget, whether or not any policy ends up
+    // needing it. Wrapping it in a lazily-evaluated, self-memoising thunk
+    // instead lets `policyMatchesEvent` call it from inside the manifest-
+    // wide `matching` loop below (once per policy that still hasn't
+    // matched) while the actual segmentation work happens AT MOST ONCE per
+    // event — the same "computed once per event, not once per policy"
+    // discipline `normalizedCommand` already has, just deferred until
+    // first use instead of forced up front.
+    let ampNormalizedCommandCache;
+    const ampNormalizedCommandThunk = bashCommand === null
+        ? undefined
+        : () => (ampNormalizedCommandCache ??= normalizeCommandAmpAware(bashCommand));
     // Above `MAX_NORMALIZE_LENGTH`, `normalizeCommand` skips normalisation
     // entirely and `truncated` comes back `true`. Raw matching still
-    // applies regardless (`policyMatchesEvent`'s raw-OR-normalised
-    // construction), so an oversized command only loses the ADDITIONAL
-    // normalised-form coverage — but that skip must not be silent, so one
-    // stderr line reports it here, keeping the module itself pure and
-    // I/O-free.
+    // applies regardless (`policyMatchesEvent`'s raw-OR-normalised-OR-amp-
+    // normalised construction), so an oversized command only loses the
+    // ADDITIONAL normalised-form coverage — but that skip must not be
+    // silent, so one stderr line reports it here, keeping the module itself
+    // pure and I/O-free. This one line also covers the amp-aware SECOND
+    // pass (`normalizeCommandAmpAware`, task `aabbad63`, fix round 1 finding
+    // F6): it shares the identical `MAX_NORMALIZE_LENGTH` bound over the
+    // identical `bashCommand`, so its own `truncated` can never disagree
+    // with `normalizedCommand`'s for this call — no separate stderr line
+    // names the amp pass's own skip, nor does one need to.
     if (normalizedCommand?.truncated === true) {
         stderr.write(`harness policy intercept${hookSuffix(opts.hookName)}: Bash command exceeds ${MAX_NORMALIZE_LENGTH} chars; normalised-form matching skipped for this call (raw match only)\n`);
     }
@@ -444,6 +568,10 @@ export async function runInterceptCli(opts = {}) {
             ...(cwdGitContext.sha.length > 0 && { currentHeadSha: cwdGitContext.sha }),
             ...(riskContext && { riskContext }),
             ...(normalizedCommand && { normalizedCommand }),
+            ...(ampNormalizedCommandThunk && { ampNormalizedCommandThunk }),
+            ...(commandSegmentsThunk && { commandSegmentsThunk }),
+            ...(process.env.HARNESS_REPO !== undefined && { repoOverridden: true }),
+            ...(process.env.HARNESS_BRANCH !== undefined && { branchOverridden: true }),
         });
     }
     finally {

package/dist/cli/policy/intercept.js.map

@@ -1 +1 @@
-{"version":3,"file":"intercept.js","sourceRoot":"","sources":["../../../src/cli/policy/intercept.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,kEAAkE;AAElE,OAAO,EACL,iBAAiB,GAIlB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,SAAS,EACT,6BAA6B,EAC7B,iBAAiB,EACjB,kBAAkB,GAKnB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,GAEjB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAiEzD,KAAK,UAAU,SAAS,CAAC,MAA6B;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,uEAAuE;AACvE,SAAS,MAAM,CAAC,EAAgB;IAC9B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,QAA4B;IAC9C,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,QAAwB,EAAE,QAAiB;IAC3E,MAAM,MAAM,GAAG,2BAA2B,UAAU,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,OAAO,GACzG,QAAQ,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EACnE,EAAE,CAAC;IACH,MAAM,KAAK,GAAa,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAyB;IACjD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,0EAA0E;IAC1E,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,GAAG,GAAI,KAA+B,CAAC,OAAO,CAAC;IACrD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAiB;IACzC,OAAO,CACL,QAAQ,KAAK,MAAM;QACnB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,wBAAwB,CACtC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,IAAI,GAAG,KAA6C,CAAC;IAC3D,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,2BAA2B;IAClC,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgB,EAAE,eAAwB;IAClE,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IAC5E,IAAI,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACrE,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;QACD,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,2BAA2B,EAAE,CAAC;QAC9C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiB,EACjB,IAAyB;IAEzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsC,CAAC;IACnE,MAAM,UAAU,GAAG,GAAkB,EAAE,CACrC,CAAC,OAAO,KAAK,iBAAiB,CAAC;QAC7B,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;KACV,CAAC,CAAC,CAAC;IACN,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS;YACzB,kEAAkE;YAClE,gEAAgE;YAChE,6DAA6D;YAC7D,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,+DAA+D;YAC/D,+DAA+D;YAC/D,iEAAiE;YACjE,mCAAmC;YACnC,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,GAAG,UAAU,EAAE,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;gBAClD,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS;YAC9B,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,UAAU,EAAE,EACZ,QAAQ,EACR,SAAS,CACV,CAAC;YACF,iEAAiE;YACjE,kEAAkE;YAClE,gEAAgE;YAChE,mEAAmE;YACnE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,2BAA2B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,2BAA2B;oBAC7E,GAAG,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,IAAI,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc;IAC1C,OAAO;QACL,KAAK,CAAC,KAAK;YACT,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,sCAAsC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA4B,EAAE;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAc,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,2BAA2B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,2BAA4B,GAAa,CAAC,OAAO,IAAI,CAC1G,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,CAAC;QACC,MAAM,SAAS,GAA+C;YAC5D,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,kBAAkB;YAC7B,MAAM;SACP,CAAC;QACF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAChF,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrD,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,2BAA2B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,2BAA4B,GAAa,CAAC,OAAO,IAAI,CAC1G,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,MAAoB,CAAC;IACzB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,GAAG,MAAM;YACb,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC;YAChC,CAAC,CAAC,oBAAoB,CAAC,wCAAwC,CAAC,CAAC;IACrE,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,2DAA2D;IAC3D,iEAAiE;IACjE,mEAAmE;IACnE,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,kEAAkE;IAClE,iEAAiE;IACjE,8DAA8D;IAC9D,uDAAuD;IACvD,sEAAsE;IACtE,mDAAmD;IACnD,MAAM,cAAc,GAAG,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,wEAAwE;IACxE,sEAAsE;IACtE,oDAAoD;IACpD,MAAM,gBAAgB,GACpB,cAAc;QACd,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,uEAAuE;IACvE,0EAA0E;IAC1E,qEAAqE;IACrE,yEAAyE;IACzE,kEAAkE;IAClE,uDAAuD;IACvD,EAAE;IACF,oEAAoE;IACpE,iEAAiE;IACjE,qEAAqE;IACrE,+DAA+D;IAC/D,qEAAqE;IACrE,+DAA+D;IAC/D,yCAAyC;IACzC,uEAAuE;IACvE,iEAAiE;IACjE,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,kEAAkE;IAClE,8DAA8D;IAC9D,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,sEAAsE;IACtE,mEAAmE;IACnE,uEAAuE;IACvE,6BAA6B;IAC7B,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7C,iEAAiE;IACjE,sEAAsE;IACtE,4CAA4C;IAC5C,MAAM,iBAAiB,GACrB,KAAK,CAAC,SAAS,KAAK,MAAM;QACxB,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9C,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1D,CAAC,CAAC,EAAE;QACN,CAAC,CAAC,SAAS,CAAC;IAChB,uEAAuE;IACvE,iEAAiE;IACjE,+DAA+D;IAC/D,mEAAmE;IACnE,sEAAsE;IACtE,kEAAkE;IAClE,YAAY;IACZ,IAAI,iBAAiB,EAAE,SAAS,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,CAAC,KAAK,CACV,2BAA2B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,oBAAoB,2EAA2E,CAC9K,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,UAAU,EAAE,gBAAgB;QAC5B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,aAAa,CAAC,IAAI;QACpD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,aAAa,CAAC,MAAM;QAC1D,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QACrE,GAAG,EAAE,GAAG;KACT,CAAC;IAEF,8DAA8D;IAC9D,qEAAqE;IACrE,sEAAsE;IACtE,qDAAqD;IACrD,IAAI,WAAwC,CAAC;IAC7C,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GACR,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;YAChE,CAAC,CAAC;gBACE,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;gBAC/B,SAAS,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE;aACpC;YACH,CAAC,CAAC,kBAAkB,EAAE,CAAC;QAC3B,sEAAsE;QACtE,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,qEAAqE;QACrE,iEAAiE;QACjE,kEAAkE;QAClE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,8DAA8D;QAC9D,iEAAiE;QACjE,kEAAkE;QAClE,EAAE;QACF,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,6DAA6D;QAC7D,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,qEAAqE;QACrE,sEAAsE;QACtE,8DAA8D;QAC9D,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,gBAAgB;QAChB,MAAM,UAAU,GACd,KAAK,CAAC,SAAS,KAAK,MAAM;YACxB,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC9C,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACpD,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;YACxB,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,aAAa,CAAC;YAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACpD,CAAC,CAAC,UAAU,CAAC,QAAQ;gBACrB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3C,6DAA6D;YAC7D,yDAAyD;YACzD,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;QAC/D,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;YACrC,IAAI,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvF,gEAAgE;YAChE,kEAAkE;YAClE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;QAC9C,CAAC,CAAC,EAAE,CAAC;QACL,WAAW,GAAG;YACZ,GAAG,EAAE,WAAW;YAChB,GAAG;YACH,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC;YAC1C,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;YACjC,GAAG,EAAE,WAAW;YAChB,WAAW,EAAE,IAAI,CAAC,OAAO;YACzB,aAAa,EAAE,IAAI,CAAC,SAAS;SAC9B,CAAC;IACJ,CAAC;IAED,IAAI,MAA6C,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,SAAS,CAAC;YACvB,QAAQ;YACR,KAAK;YACL,MAAM;YACN,QAAQ;YACR,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;YACpF,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAClC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC;YAC1E,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;YACnC,GAAG,CAAC,iBAAiB,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,sEAAsE;QACtE,oEAAoE;QACpE,oDAAoD;QACpD,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;IACrB,CAAC;IAED,mEAAmE;IACnE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,mEAAmE;IACnE,uEAAuE;IACvE,qEAAqE;IACrE,gFAAgF;IAChF,kEAAkE;IAClE,6DAA6D;IAC7D,EAAE;IACF,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,mEAAmE;IACnE,0DAA0D;IAC1D,mCAAmC;IACnC,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC;QACnD,CAAC,CAAC,OAAO,KAAK,kBAAkB,CACnC,CAAC;IACF,IACE,MAAM,CAAC,SAAS;QAChB,cAAc,KAAK,SAAS;QAC5B,cAAc,CAAC,MAAM,GAAG,CAAC;QACzB,aAAa,EAAE,OAAO,KAAK,kBAAkB,EAC7C,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY;eACjC,CAAC,YAAY,KAAK,SAAS;gBAC5B,CAAC,CAAC,mBAAmB,CAAC;oBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChE,YAAY;iBACb,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,oBAAoB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,sDAAsD;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,gEAAgE;IAChE,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,oEAAoE;IACpE,gEAAgE;IAChE,wCAAwC;IACxC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO;gBAAE,SAAS;YAC3C,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,SAAS,KAAK,IAAI;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAgB,EAAE,QAAkB,EAAE,QAAiB;IAChF,MAAM,aAAa,GACjB,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAC3E,CAAC,CAAC,IAAI,KAAK,CAAC,eAAe,GAAG;QAC9B,CAAC,CAAC,WAAW,CAAC;IAClB,MAAM,YAAY,GAChB,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAC/D,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG;QACxB,CAAC,CAAC,WAAW,CAAC;IAClB,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CACjC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACvD,CAAC,IAAI,EAAE,CAAC;IACT,OAAO,CACL,2BAA2B,UAAU,CAAC,QAAQ,CAAC,4BAA4B;QAC3E,mBAAmB,aAAa,cAAc,YAAY,GAAG;QAC7D,8BAA8B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QAC9D,iGAAiG,CAClG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"intercept.js","sourceRoot":"","sources":["../../../src/cli/policy/intercept.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,kEAAkE;AAElE,OAAO,EACL,iBAAiB,GAIlB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,SAAS,EACT,6BAA6B,EAC7B,iBAAiB,EACjB,kBAAkB,GAKnB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,GAId,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACxF,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAiEzD,KAAK,UAAU,SAAS,CAAC,MAA6B;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED,uEAAuE;AACvE,SAAS,MAAM,CAAC,EAAgB;IAC9B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,QAA4B;IAC9C,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,QAAwB,EAAE,QAAiB;IAC3E,MAAM,MAAM,GAAG,2BAA2B,UAAU,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,OAAO,GACzG,QAAQ,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EACnE,EAAE,CAAC;IACH,MAAM,KAAK,GAAa,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAyB;IACjD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,0EAA0E;IAC1E,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,GAAG,GAAI,KAA+B,CAAC,OAAO,CAAC;IACrD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,0EAA0E;AAC1E,2BAA2B;AAC3B,SAAS,gBAAgB,CAAC,QAAiB;IACzC,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAK,aAAmC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,IAAI,GAAG,KAA6C,CAAC;IAC3D,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,2BAA2B;IAClC,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgB,EAAE,eAAwB;IAClE,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IAC5E,IAAI,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACrE,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;QACD,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,2BAA2B,EAAE,CAAC;QAC9C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAiB,EACjB,IAAyB;IAEzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsC,CAAC;IACnE,MAAM,UAAU,GAAG,GAAkB,EAAE,CACrC,CAAC,OAAO,KAAK,iBAAiB,CAAC;QAC7B,UAAU,EAAE,OAAO;QACnB,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3B,SAAS;KACV,CAAC,CAAC,CAAC;IACN,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS;YACzB,kEAAkE;YAClE,gEAAgE;YAChE,6DAA6D;YAC7D,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,+DAA+D;YAC/D,+DAA+D;YAC/D,iEAAiE;YACjE,mCAAmC;YACnC,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,GAAG,UAAU,EAAE,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;gBAClD,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS;YAC9B,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,UAAU,EAAE,EACZ,QAAQ,EACR,SAAS,CACV,CAAC;YACF,iEAAiE;YACjE,kEAAkE;YAClE,gEAAgE;YAChE,mEAAmE;YACnE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,2BAA2B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,2BAA2B;oBAC7E,GAAG,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,IAAI,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc;IAC1C,OAAO;QACL,KAAK,CAAC,KAAK;YACT,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,sCAAsC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA4B,EAAE;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAc,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,2BAA2B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,2BAA4B,GAAa,CAAC,OAAO,IAAI,CAC1G,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,CAAC;QACC,MAAM,SAAS,GAA+C;YAC5D,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,kBAAkB;YAC7B,MAAM;SACP,CAAC;QACF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAChF,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrD,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,2BAA2B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,2BAA4B,GAAa,CAAC,OAAO,IAAI,CAC1G,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,MAAoB,CAAC;IACzB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,GAAG,MAAM;YACb,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC;YAChC,CAAC,CAAC,oBAAoB,CAAC,wCAAwC,CAAC,CAAC;IACrE,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,2DAA2D;IAC3D,iEAAiE;IACjE,mEAAmE;IACnE,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,kEAAkE;IAClE,iEAAiE;IACjE,8DAA8D;IAC9D,uDAAuD;IACvD,sEAAsE;IACtE,mDAAmD;IACnD,MAAM,cAAc,GAAG,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,wEAAwE;IACxE,sEAAsE;IACtE,oDAAoD;IACpD,MAAM,gBAAgB,GACpB,cAAc;QACd,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAClC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,EAAE,CAAC;IACL,uEAAuE;IACvE,0EAA0E;IAC1E,qEAAqE;IACrE,yEAAyE;IACzE,kEAAkE;IAClE,uDAAuD;IACvD,EAAE;IACF,sEAAsE;IACtE,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,uEAAuE;IACvE,+DAA+D;IAC/D,kEAAkE;IAClE,yEAAyE;IACzE,+DAA+D;IAC/D,kEAAkE;IAClE,uEAAuE;IACvE,sEAAsE;IACtE,0DAA0D;IAC1D,sEAAsE;IACtE,6DAA6D;IAC7D,oEAAoE;IACpE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,mCAAmC;IACnC,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7C,wEAAwE;IACxE,qEAAqE;IACrE,sCAAsC;IACtC,EAAE;IACF,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,+DAA+D;IAC/D,sEAAsE;IACtE,+DAA+D;IAC/D,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,oEAAoE;IACpE,6DAA6D;IAC7D,wEAAwE;IACxE,wEAAwE;IACxE,mEAAmE;IACnE,kEAAkE;IAClE,WAAW;IACX,EAAE;IACF,wEAAwE;IACxE,iEAAiE;IACjE,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,gEAAgE;IAChE,yBAAyB;IACzB,EAAE;IACF,oEAAoE;IACpE,iEAAiE;IACjE,mDAAmD;IACnD,8EAA8E;IAC9E,uEAAuE;IACvE,iEAAiE;IACjE,gEAAgE;IAChE,oEAAoE;IACpE,wEAAwE;IACxE,wEAAwE;IACxE,mEAAmE;IACnE,wEAAwE;IACxE,8CAA8C;IAC9C,EAAE;IACF,sEAAsE;IACtE,8CAA8C;IAC9C,EAAE;IACF,0EAA0E;IAC1E,wDAAwD;IACxD,kEAAkE;IAClE,gEAAgE;IAChE,8DAA8D;IAC9D,sEAAsE;IACtE,wEAAwE;IACxE,iEAAiE;IACjE,wEAAwE;IACxE,EAAE;IACF,6DAA6D;IAC7D,iEAAiE;IACjE,oEAAoE;IACpE,uEAAuE;IACvE,mEAAmE;IACnE,4DAA4D;IAC5D,0DAA0D;IAC1D,mEAAmE;IACnE,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,MAAM,iBAAiB,GACrB,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,0DAA0D;IAC1D,uEAAuE;IACvE,8DAA8D;IAC9D,yEAAyE;IACzE,+DAA+D;IAC/D,yEAAyE;IACzE,qEAAqE;IACrE,mEAAmE;IACnE,wEAAwE;IACxE,uDAAuD;IACvD,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,0DAA0D;IAC1D,uEAAuE;IACvE,wEAAwE;IACxE,mEAAmE;IACnE,yDAAyD;IACzD,IAAI,oBAAyD,CAAC;IAC9D,MAAM,oBAAoB,GACxB,WAAW,KAAK,IAAI;QAClB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,GAAG,EAAE;YACH,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,oBAAoB,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YACpD,CAAC;YACD,OAAO,oBAAoB,CAAC;QAC9B,CAAC,CAAC;IACR,mEAAmE;IACnE,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,iEAAiE;IACjE,oEAAoE;IACpE,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,gEAAgE;IAChE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,wCAAwC;IACxC,IAAI,yBAAgE,CAAC;IACrE,MAAM,yBAAyB,GAC7B,WAAW,KAAK,IAAI;QAClB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,yBAAyB,KAAK,wBAAwB,CAAC,WAAW,CAAC,CAAC,CAAC;IAClF,uEAAuE;IACvE,iEAAiE;IACjE,uEAAuE;IACvE,mEAAmE;IACnE,kEAAkE;IAClE,wEAAwE;IACxE,oEAAoE;IACpE,yEAAyE;IACzE,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,uDAAuD;IACvD,IAAI,iBAAiB,EAAE,SAAS,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,CAAC,KAAK,CACV,2BAA2B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,oBAAoB,2EAA2E,CAC9K,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,UAAU,EAAE,gBAAgB;QAC5B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,aAAa,CAAC,IAAI;QACpD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,aAAa,CAAC,MAAM;QAC1D,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QACrE,GAAG,EAAE,GAAG;KACT,CAAC;IAEF,8DAA8D;IAC9D,qEAAqE;IACrE,sEAAsE;IACtE,qDAAqD;IACrD,IAAI,WAAwC,CAAC;IAC7C,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GACR,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;YAChE,CAAC,CAAC;gBACE,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;gBAC/B,SAAS,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE;aACpC;YACH,CAAC,CAAC,kBAAkB,EAAE,CAAC;QAC3B,sEAAsE;QACtE,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,qEAAqE;QACrE,iEAAiE;QACjE,kEAAkE;QAClE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,8DAA8D;QAC9D,iEAAiE;QACjE,kEAAkE;QAClE,EAAE;QACF,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,6DAA6D;QAC7D,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,qEAAqE;QACrE,sEAAsE;QACtE,8DAA8D;QAC9D,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,gBAAgB;QAChB,MAAM,UAAU,GACd,KAAK,CAAC,SAAS,KAAK,MAAM;YACxB,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC9C,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACpD,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;YACxB,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,aAAa,CAAC;YAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACpD,CAAC,CAAC,UAAU,CAAC,QAAQ;gBACrB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3C,6DAA6D;YAC7D,yDAAyD;YACzD,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;QAC/D,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;YACrC,IAAI,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvF,gEAAgE;YAChE,kEAAkE;YAClE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;QAC9C,CAAC,CAAC,EAAE,CAAC;QACL,WAAW,GAAG;YACZ,GAAG,EAAE,WAAW;YAChB,GAAG;YACH,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC;YAC1C,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;YACjC,GAAG,EAAE,WAAW;YAChB,WAAW,EAAE,IAAI,CAAC,OAAO;YACzB,aAAa,EAAE,IAAI,CAAC,SAAS;SAC9B,CAAC;IACJ,CAAC;IAED,IAAI,MAA6C,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,SAAS,CAAC;YACvB,QAAQ;YACR,KAAK;YACL,MAAM;YACN,QAAQ;YACR,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;YACpF,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAClC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC;YAC1E,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;YACnC,GAAG,CAAC,iBAAiB,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAC/C,GAAG,CAAC,yBAAyB,IAAI,EAAE,yBAAyB,EAAE,CAAC;YAC/D,GAAG,CAAC,oBAAoB,IAAI,EAAE,oBAAoB,EAAE,CAAC;YACrD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;YACvE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,sEAAsE;QACtE,oEAAoE;QACpE,oDAAoD;QACpD,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;IACrB,CAAC;IAED,mEAAmE;IACnE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,mEAAmE;IACnE,uEAAuE;IACvE,qEAAqE;IACrE,gFAAgF;IAChF,kEAAkE;IAClE,6DAA6D;IAC7D,EAAE;IACF,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,mEAAmE;IACnE,0DAA0D;IAC1D,mCAAmC;IACnC,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC;QACnD,CAAC,CAAC,OAAO,KAAK,kBAAkB,CACnC,CAAC;IACF,IACE,MAAM,CAAC,SAAS;QAChB,cAAc,KAAK,SAAS;QAC5B,cAAc,CAAC,MAAM,GAAG,CAAC;QACzB,aAAa,EAAE,OAAO,KAAK,kBAAkB,EAC7C,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY;eACjC,CAAC,YAAY,KAAK,SAAS;gBAC5B,CAAC,CAAC,mBAAmB,CAAC;oBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChE,YAAY;iBACb,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,oBAAoB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,sDAAsD;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,gEAAgE;IAChE,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,oEAAoE;IACpE,gEAAgE;IAChE,wCAAwC;IACxC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO;gBAAE,SAAS;YAC3C,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,SAAS,KAAK,IAAI;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAgB,EAAE,QAAkB,EAAE,QAAiB;IAChF,MAAM,aAAa,GACjB,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAC3E,CAAC,CAAC,IAAI,KAAK,CAAC,eAAe,GAAG;QAC9B,CAAC,CAAC,WAAW,CAAC;IAClB,MAAM,YAAY,GAChB,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAC/D,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG;QACxB,CAAC,CAAC,WAAW,CAAC;IAClB,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CACjC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACvD,CAAC,IAAI,EAAE,CAAC;IACT,OAAO,CACL,2BAA2B,UAAU,CAAC,QAAQ,CAAC,4BAA4B;QAC3E,mBAAmB,aAAa,cAAc,YAAY,GAAG;QAC7D,8BAA8B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QAC9D,iGAAiG,CAClG,CAAC;AACJ,CAAC"}

package/dist/policy-packs/builtin/post-merge-gate-runtime.d.ts

@@ -27,6 +27,21 @@ export declare function buildMergedTagContent(args: {
  * indirection defeats this match before the producer ever runs — not
  * attempted to close here (the MCP merge path, `pull_requests_merge`, is
  * the other documented gap; see the pack's instructions.md).
+ *
+ * Task 76671e5a: bare `&` added to the boundary alternation (`&&` kept to
+ * its left only to mirror `src/runtime/command-normalize.ts`'s alternation
+ * order for readability — NOT because order is load-bearing here, unlike
+ * that module). Same fix as `d834a065` applied to every policy trigger —
+ * bash starts a new command after a single `&`, so `A=x&gh pr merge` used
+ * to miss this trigger entirely and the producer silently never recorded
+ * the merged-tip fact for that spelling. Broadening a TRIGGER only widens
+ * when the producer fires (a strictly safer direction, mirrors the
+ * deny-side reasoning below), unlike the escape allowlist further down.
+ * Measured: swapping to `&|&&` produces a byte-identical match set for this
+ * matcher (a `RegExp.test` existential check over every start offset, not a
+ * segmenter — the reasoning that makes order matter in
+ * `command-normalize.ts`'s `BOUNDARY_RE`/`AMP_BOUNDARY_RE` does not transfer
+ * to a plain `.test()` matcher like this one).
  */
 export declare const GH_PR_MERGE_BASH_RE: RegExp;
 /**
@@ -34,29 +49,94 @@ export declare const GH_PR_MERGE_BASH_RE: RegExp;
  * list. Deliberately NOT "every Bash command" — read-only git
  * (status/log/diff/branch) and unrelated shell stay unaffected. Same
  * anchoring convention as `GH_PR_MERGE_BASH_RE`.
+ *
+ * Task 76671e5a: bare `&` added to the boundary alternation, same reasoning
+ * as `GH_PR_MERGE_BASH_RE` above — this is a DENY-scope matcher, so
+ * broadening it is the STRICTER direction (more commands recognized as
+ * curated mutations, none dropped). Verified disjoint from the escape
+ * allowlist below on a single-command corpus (no verb overlap), so this
+ * broadening cannot lock out the documented recovery path.
  */
 export declare const CURATED_MUTATION_BASH_RE: RegExp;
 /**
  * Escape allowlist, git verbs (03-decisions.md): the exact recovery path
- * the deny message recommends, plus read-only stash inspection. Checked
- * BEFORE the curated-mutation match and before any manifest/ledger access
- * — see hook-post-merge-gate.ts for the ordering guarantee.
+ * the deny message recommends, plus read-only stash inspection. Since task
+ * 19356be7 this list no longer short-circuits the blocker — the deny
+ * match decides gate-eligibility, and every one of these verbs stays free
+ * simply because it is not a curated mutation (verb disjointness, pinned).
+ * The list remains the deny message's recovery vocabulary and a
+ * diagnostics aid.
+ *
+ * Task 76671e5a, DELIBERATELY LEFT on the old (no bare-`&`) boundary
+ * alphabet: this is an ALLOW-side matcher, so broadening it is the LOOSER
+ * direction. Its remaining consumers (diagnostics, docs interpolation)
+ * still must not silently widen what reads as "recovery". Pinned by a
+ * regression test asserting this regex's source never gains the `&|`
+ * boundary token.
  */
 export declare const ESCAPE_GIT_BASH_RE: RegExp;
 /**
- * Escape allowlist, harness verbs (03-decisions.md): any invocation of
- * harness's own CLI (recovery commands like `harness session-start
- * branch-check`, diagnostics, a future self-check) always passes,
- * regardless of spelling — mirrors the `npx` / absolute-path /
- * `./node_modules/.bin` robustness the `deny-kill-switch-bash` regex in
+ * Escape allowlist, harness verbs (03-decisions.md): names any invocation
+ * of harness's own CLI (recovery commands like `harness session-start
+ * branch-check`, diagnostics, a future self-check), regardless of
+ * spelling — mirrors the `npx` / absolute-path / `./node_modules/.bin`
+ * robustness the `deny-kill-switch-bash` regex in
  * `src/cli/init/templates.ts` already established for the same class of
- * bypass concern.
+ * bypass concern. Since task 19356be7 its only job is the deny message's
+ * / diagnostics' vocabulary: a bare harness command stays free through
+ * verb disjointness with the curated deny list, not through a
+ * short-circuit.
+ *
+ * Task 76671e5a: DELIBERATELY LEFT narrow, same reasoning as
+ * `ESCAPE_GIT_BASH_RE` immediately above — an allow-side matcher, so
+ * broadening its boundary alphabet is the loosening direction.
  */
 export declare const ESCAPE_HARNESS_BASH_RE: RegExp;
-/** True when `command` matches any escape pattern. Checked first, unconditionally. */
+/**
+ * True when `command` matches any escape pattern. Since task 19356be7
+ * this is DIAGNOSTICS ONLY — the blocker's decision is
+ * `isGateEligibleCommand` below; when escape and deny both match, deny
+ * wins. (Under the original escape-first ordering this function was the
+ * blocker's first, unconditional check, which let `harness preflight &&
+ * git push origin master` — the documented normal workflow — skip the
+ * gate entirely.)
+ */
 export declare function isEscapeCommand(command: string): boolean;
 /** True when `command` matches the curated v1 deny-scope. */
 export declare function isCuratedMutationCommand(command: string): boolean;
+/**
+ * The blocker's single classification entry point (task 19356be7): a
+ * command is gate-eligible iff the curated mutation matcher fires.
+ * Everything else — the whole recovery vocabulary, read-only git,
+ * unrelated shell — is allowed by the hook BEFORE any manifest load or
+ * ledger query, preserving the recovery-never-starved property the
+ * escape-first ordering used to provide.
+ *
+ * A thin wrapper over `isCuratedMutationCommand` by DELIBERATE choice,
+ * not by accident. An earlier iteration of this task pre-processed the
+ * command here, stripping the bodies of quoted-delimiter heredocs fed to
+ * a harness invocation, so that an `harness approve understanding <<'…'`
+ * report body mentioning a mutation verb would not become gate-eligible.
+ * Two review rounds found two successive families of UNDER-blocks in that
+ * pre-processing (bodies consumed that bash really executes), both rooted
+ * in the same cause: deciding where a heredoc body BEGINS requires
+ * re-implementing bash's quote and word grammar on the permissive side of
+ * a security boundary. Tasks `dbc6d303` and `5b1b24fb` had already been
+ * halted for that same reason. It was therefore removed rather than
+ * patched a third time; see
+ * `.ai/runs/2026-08-02-post-merge-gate-escape-precedence/03-decisions.md`
+ * D5/D6 for the measurement history, and task `5b1b24fb` for the real
+ * fix, which belongs at the `bash_match` layer for every surface at once.
+ *
+ * Accepted consequence, OVER-block direction: a harness report heredoc
+ * whose body carries a boundary-anchored mutation verb IS gate-eligible.
+ * It only denies while the branch tip equals a recorded merged tip, and
+ * `git switch <default>` — the gate's own recommended recovery — stays
+ * free. Same residual class as the quoted-text false positives this
+ * change already accepts. Do NOT reintroduce a strip here without a
+ * design that does not re-derive bash's grammar.
+ */
+export declare function isGateEligibleCommand(command: string): boolean;
 /**
  * Defensive `tool_output.exit_code` reader for the PostToolUse Bash
  * payload — Contract A. Returns `null` on ANY shape other than a plain

package/dist/policy-packs/builtin/post-merge-gate-runtime.js

@@ -29,10 +29,24 @@
 //     scope" section). Read-only git (status/log/diff/branch) and
 //     unrelated shell are never touched.
 //
-//   - The escape allowlist is checked FIRST in the blocker, unconditionally,
-//     before manifest load or any ledger query — see hook-post-merge-gate.ts.
-//     This module only supplies the matcher; the ordering guarantee lives
-//     in the hook, not here.
+//   - DENY WINS over the escape allowlist (task 19356be7, REVERSES the
+//     original escape-first decision): the blocker classifies a command as
+//     gate-eligible iff the curated mutation matcher fires
+//     (`isGateEligibleCommand` below). The escape allowlist no longer
+//     short-circuits the whole command — under escape-first, any chained
+//     command containing an escape verb anywhere (`harness preflight &&
+//     git push origin master`, the documented normal workflow) skipped the
+//     gate entirely. Measured before changing, over a 66-row corpus with
+//     bash ground truth: per-segment evaluation and deny-wins are
+//     0-divergent — a consequence of the pinned verb disjointness between
+//     the escape and deny lists — so the simplest (deny-wins) is
+//     implemented. The third candidate, escape-at-start-only, was measured
+//     and REJECTED: it diverges on 26 rows and still exempts three of the
+//     four lines this task exists to close (`git switch master && git push
+//     origin master` and friends). The recovery-never-starved property is preserved
+//     structurally: a non-eligible command is allowed before any manifest
+//     load or ledger query, exactly where the escape short-circuit used to
+//     sit (see hook-post-merge-gate.ts for the ordering).
 //
 //   - Fails OPEN (allows) when the ledger is unreachable, unlike
 //     branch-protection's fail-closed posture: without the ledger,
@@ -70,33 +84,80 @@ export function buildMergedTagContent(args) {
  * indirection defeats this match before the producer ever runs — not
  * attempted to close here (the MCP merge path, `pull_requests_merge`, is
  * the other documented gap; see the pack's instructions.md).
+ *
+ * Task 76671e5a: bare `&` added to the boundary alternation (`&&` kept to
+ * its left only to mirror `src/runtime/command-normalize.ts`'s alternation
+ * order for readability — NOT because order is load-bearing here, unlike
+ * that module). Same fix as `d834a065` applied to every policy trigger —
+ * bash starts a new command after a single `&`, so `A=x&gh pr merge` used
+ * to miss this trigger entirely and the producer silently never recorded
+ * the merged-tip fact for that spelling. Broadening a TRIGGER only widens
+ * when the producer fires (a strictly safer direction, mirrors the
+ * deny-side reasoning below), unlike the escape allowlist further down.
+ * Measured: swapping to `&|&&` produces a byte-identical match set for this
+ * matcher (a `RegExp.test` existential check over every start offset, not a
+ * segmenter — the reasoning that makes order matter in
+ * `command-normalize.ts`'s `BOUNDARY_RE`/`AMP_BOUNDARY_RE` does not transfer
+ * to a plain `.test()` matcher like this one).
  */
-export const GH_PR_MERGE_BASH_RE = /(?:^|\n|;|\||&&|\()\s*(?:\w+=\S+\s+)*gh\s+pr\s+merge\b/;
+export const GH_PR_MERGE_BASH_RE = /(?:^|\n|;|\||&&|&|\()\s*(?:\w+=\S+\s+)*gh\s+pr\s+merge\b/;
 /**
  * Blocker deny-scope v1 (03-decisions.md): the curated mutation command
  * list. Deliberately NOT "every Bash command" — read-only git
  * (status/log/diff/branch) and unrelated shell stay unaffected. Same
  * anchoring convention as `GH_PR_MERGE_BASH_RE`.
+ *
+ * Task 76671e5a: bare `&` added to the boundary alternation, same reasoning
+ * as `GH_PR_MERGE_BASH_RE` above — this is a DENY-scope matcher, so
+ * broadening it is the STRICTER direction (more commands recognized as
+ * curated mutations, none dropped). Verified disjoint from the escape
+ * allowlist below on a single-command corpus (no verb overlap), so this
+ * broadening cannot lock out the documented recovery path.
  */
-export const CURATED_MUTATION_BASH_RE = /(?:^|\n|;|\||&&|\()\s*(?:\w+=\S+\s+)*(?:git(?:\s+-C\s+\S+)?\s+(?:commit|add|push|merge|rebase|cherry-pick|revert|reset|stash\s+(?:pop|apply))\b|gh\s+pr\s+(?:create|merge)\b)/;
+export const CURATED_MUTATION_BASH_RE = /(?:^|\n|;|\||&&|&|\()\s*(?:\w+=\S+\s+)*(?:git(?:\s+-C\s+\S+)?\s+(?:commit|add|push|merge|rebase|cherry-pick|revert|reset|stash\s+(?:pop|apply))\b|gh\s+pr\s+(?:create|merge)\b)/;
 /**
  * Escape allowlist, git verbs (03-decisions.md): the exact recovery path
- * the deny message recommends, plus read-only stash inspection. Checked
- * BEFORE the curated-mutation match and before any manifest/ledger access
- * — see hook-post-merge-gate.ts for the ordering guarantee.
+ * the deny message recommends, plus read-only stash inspection. Since task
+ * 19356be7 this list no longer short-circuits the blocker — the deny
+ * match decides gate-eligibility, and every one of these verbs stays free
+ * simply because it is not a curated mutation (verb disjointness, pinned).
+ * The list remains the deny message's recovery vocabulary and a
+ * diagnostics aid.
+ *
+ * Task 76671e5a, DELIBERATELY LEFT on the old (no bare-`&`) boundary
+ * alphabet: this is an ALLOW-side matcher, so broadening it is the LOOSER
+ * direction. Its remaining consumers (diagnostics, docs interpolation)
+ * still must not silently widen what reads as "recovery". Pinned by a
+ * regression test asserting this regex's source never gains the `&|`
+ * boundary token.
  */
 export const ESCAPE_GIT_BASH_RE = /(?:^|\n|;|\||&&|\()\s*(?:\w+=\S+\s+)*git(?:\s+-C\s+\S+)?\s+(?:switch\b|checkout\b|pull\b|fetch\b|branch\s+-(?:d|D)\b|stash\s+(?:list|show)\b)/;
 /**
- * Escape allowlist, harness verbs (03-decisions.md): any invocation of
- * harness's own CLI (recovery commands like `harness session-start
- * branch-check`, diagnostics, a future self-check) always passes,
- * regardless of spelling — mirrors the `npx` / absolute-path /
- * `./node_modules/.bin` robustness the `deny-kill-switch-bash` regex in
+ * Escape allowlist, harness verbs (03-decisions.md): names any invocation
+ * of harness's own CLI (recovery commands like `harness session-start
+ * branch-check`, diagnostics, a future self-check), regardless of
+ * spelling — mirrors the `npx` / absolute-path / `./node_modules/.bin`
+ * robustness the `deny-kill-switch-bash` regex in
  * `src/cli/init/templates.ts` already established for the same class of
- * bypass concern.
+ * bypass concern. Since task 19356be7 its only job is the deny message's
+ * / diagnostics' vocabulary: a bare harness command stays free through
+ * verb disjointness with the curated deny list, not through a
+ * short-circuit.
+ *
+ * Task 76671e5a: DELIBERATELY LEFT narrow, same reasoning as
+ * `ESCAPE_GIT_BASH_RE` immediately above — an allow-side matcher, so
+ * broadening its boundary alphabet is the loosening direction.
  */
 export const ESCAPE_HARNESS_BASH_RE = /(?:^|\n|;|\||&&|\()\s*(?:\w+=\S+\s+)*(?:npx\s+|\S*\/)?harness\b/;
-/** True when `command` matches any escape pattern. Checked first, unconditionally. */
+/**
+ * True when `command` matches any escape pattern. Since task 19356be7
+ * this is DIAGNOSTICS ONLY — the blocker's decision is
+ * `isGateEligibleCommand` below; when escape and deny both match, deny
+ * wins. (Under the original escape-first ordering this function was the
+ * blocker's first, unconditional check, which let `harness preflight &&
+ * git push origin master` — the documented normal workflow — skip the
+ * gate entirely.)
+ */
 export function isEscapeCommand(command) {
     return ESCAPE_GIT_BASH_RE.test(command) || ESCAPE_HARNESS_BASH_RE.test(command);
 }
@@ -104,6 +165,41 @@ export function isEscapeCommand(command) {
 export function isCuratedMutationCommand(command) {
     return CURATED_MUTATION_BASH_RE.test(command);
 }
+/**
+ * The blocker's single classification entry point (task 19356be7): a
+ * command is gate-eligible iff the curated mutation matcher fires.
+ * Everything else — the whole recovery vocabulary, read-only git,
+ * unrelated shell — is allowed by the hook BEFORE any manifest load or
+ * ledger query, preserving the recovery-never-starved property the
+ * escape-first ordering used to provide.
+ *
+ * A thin wrapper over `isCuratedMutationCommand` by DELIBERATE choice,
+ * not by accident. An earlier iteration of this task pre-processed the
+ * command here, stripping the bodies of quoted-delimiter heredocs fed to
+ * a harness invocation, so that an `harness approve understanding <<'…'`
+ * report body mentioning a mutation verb would not become gate-eligible.
+ * Two review rounds found two successive families of UNDER-blocks in that
+ * pre-processing (bodies consumed that bash really executes), both rooted
+ * in the same cause: deciding where a heredoc body BEGINS requires
+ * re-implementing bash's quote and word grammar on the permissive side of
+ * a security boundary. Tasks `dbc6d303` and `5b1b24fb` had already been
+ * halted for that same reason. It was therefore removed rather than
+ * patched a third time; see
+ * `.ai/runs/2026-08-02-post-merge-gate-escape-precedence/03-decisions.md`
+ * D5/D6 for the measurement history, and task `5b1b24fb` for the real
+ * fix, which belongs at the `bash_match` layer for every surface at once.
+ *
+ * Accepted consequence, OVER-block direction: a harness report heredoc
+ * whose body carries a boundary-anchored mutation verb IS gate-eligible.
+ * It only denies while the branch tip equals a recorded merged tip, and
+ * `git switch <default>` — the gate's own recommended recovery — stays
+ * free. Same residual class as the quoted-text false positives this
+ * change already accepts. Do NOT reintroduce a strip here without a
+ * design that does not re-derive bash's grammar.
+ */
+export function isGateEligibleCommand(command) {
+    return isCuratedMutationCommand(command);
+}
 /**
  * Defensive `tool_output.exit_code` reader for the PostToolUse Bash
  * payload — Contract A. Returns `null` on ANY shape other than a plain