@lannguyensi/harness 0.59.2 → 0.61.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +66 -0
- package/README.md +1 -1
- package/dist/cli/apply/apply.d.ts +20 -0
- package/dist/cli/apply/apply.js +13 -7
- package/dist/cli/apply/apply.js.map +1 -1
- package/dist/cli/apply/install-codex-config.d.ts +26 -4
- package/dist/cli/apply/install-codex-config.js +299 -120
- package/dist/cli/apply/install-codex-config.js.map +1 -1
- package/dist/cli/approve/understanding.d.ts +6 -6
- package/dist/cli/approve/understanding.js +62 -58
- package/dist/cli/approve/understanding.js.map +1 -1
- package/dist/cli/bounded-stdin.d.ts +27 -0
- package/dist/cli/bounded-stdin.js +82 -0
- package/dist/cli/bounded-stdin.js.map +1 -0
- package/dist/cli/doctor/format.js +22 -0
- package/dist/cli/doctor/format.js.map +1 -1
- package/dist/cli/doctor/index.js +60 -31
- package/dist/cli/doctor/index.js.map +1 -1
- package/dist/cli/doctor/settings-drift.js +12 -2
- package/dist/cli/doctor/settings-drift.js.map +1 -1
- package/dist/cli/doctor/types.d.ts +17 -0
- package/dist/cli/dry-run.js +7 -0
- package/dist/cli/dry-run.js.map +1 -1
- package/dist/cli/index.js +46 -144
- package/dist/cli/index.js.map +1 -1
- package/dist/cli/pack/auto-approve-path.js +47 -13
- package/dist/cli/pack/auto-approve-path.js.map +1 -1
- package/dist/cli/pack/hook-bootstrap.d.ts +71 -5
- package/dist/cli/pack/hook-bootstrap.js +92 -18
- package/dist/cli/pack/hook-bootstrap.js.map +1 -1
- package/dist/cli/pack/hook-branch-protection.d.ts +6 -0
- package/dist/cli/pack/hook-branch-protection.js +11 -2
- package/dist/cli/pack/hook-branch-protection.js.map +1 -1
- package/dist/cli/pack/hook-codex-post-tool-use.js +2 -2
- package/dist/cli/pack/hook-codex-post-tool-use.js.map +1 -1
- package/dist/cli/pack/hook-codex-pre-tool-use.d.ts +6 -0
- package/dist/cli/pack/hook-codex-pre-tool-use.js +52 -7
- package/dist/cli/pack/hook-codex-pre-tool-use.js.map +1 -1
- package/dist/cli/pack/hook-post-merge-gate-record.d.ts +7 -0
- package/dist/cli/pack/hook-post-merge-gate-record.js +39 -2
- package/dist/cli/pack/hook-post-merge-gate-record.js.map +1 -1
- package/dist/cli/pack/hook-post-merge-gate.d.ts +6 -0
- package/dist/cli/pack/hook-post-merge-gate.js +17 -2
- package/dist/cli/pack/hook-post-merge-gate.js.map +1 -1
- package/dist/cli/pack/hook-post-tool-use.js +2 -2
- package/dist/cli/pack/hook-post-tool-use.js.map +1 -1
- package/dist/cli/pack/hook-pre-tool-use.d.ts +7 -0
- package/dist/cli/pack/hook-pre-tool-use.js +84 -18
- package/dist/cli/pack/hook-pre-tool-use.js.map +1 -1
- package/dist/cli/pack/hook-runtime-reality.d.ts +2 -0
- package/dist/cli/pack/hook-runtime-reality.js +49 -9
- package/dist/cli/pack/hook-runtime-reality.js.map +1 -1
- package/dist/cli/pack/hook-solution-acceptance-writeguard.d.ts +6 -0
- package/dist/cli/pack/hook-solution-acceptance-writeguard.js +11 -2
- package/dist/cli/pack/hook-solution-acceptance-writeguard.js.map +1 -1
- package/dist/cli/pack/hook-solution-acceptance.d.ts +6 -0
- package/dist/cli/pack/hook-solution-acceptance.js +11 -2
- package/dist/cli/pack/hook-solution-acceptance.js.map +1 -1
- package/dist/cli/pack/hook-subagent-start.d.ts +2 -0
- package/dist/cli/pack/hook-subagent-start.js +21 -4
- package/dist/cli/pack/hook-subagent-start.js.map +1 -1
- package/dist/cli/policy/intercept.d.ts +2 -0
- package/dist/cli/policy/intercept.js +14 -13
- package/dist/cli/policy/intercept.js.map +1 -1
- package/dist/cli/record/index.d.ts +11 -2
- package/dist/cli/record/index.js +114 -25
- package/dist/cli/record/index.js.map +1 -1
- package/dist/cli/session-start/branch-check.d.ts +3 -29
- package/dist/cli/session-start/branch-check.js +10 -37
- package/dist/cli/session-start/branch-check.js.map +1 -1
- package/dist/cli/session-start/index.d.ts +3 -32
- package/dist/cli/session-start/index.js +19 -31
- package/dist/cli/session-start/index.js.map +1 -1
- package/dist/cli/session-start/shared-options.d.ts +103 -0
- package/dist/cli/session-start/shared-options.js +107 -0
- package/dist/cli/session-start/shared-options.js.map +1 -0
- package/dist/cli/session-start/stale-base-check.d.ts +3 -28
- package/dist/cli/session-start/stale-base-check.js +10 -37
- package/dist/cli/session-start/stale-base-check.js.map +1 -1
- package/dist/cli/session-start/toolchain-parity.d.ts +5 -21
- package/dist/cli/session-start/toolchain-parity.js +9 -38
- package/dist/cli/session-start/toolchain-parity.js.map +1 -1
- package/dist/cli/smoke/index.d.ts +1 -1
- package/dist/cli/smoke/index.js +8 -11
- package/dist/cli/smoke/index.js.map +1 -1
- package/dist/policy-packs/builtin/post-merge-gate-runtime.d.ts +11 -0
- package/dist/policy-packs/builtin/post-merge-gate-runtime.js +11 -0
- package/dist/policy-packs/builtin/post-merge-gate-runtime.js.map +1 -1
- package/dist/policy-packs/builtin/post-merge-gate.js +5 -2
- package/dist/policy-packs/builtin/post-merge-gate.js.map +1 -1
- package/dist/policy-packs/builtin/understanding-before-execution/expiry-reason.d.ts +36 -0
- package/dist/policy-packs/builtin/understanding-before-execution/expiry-reason.js +73 -0
- package/dist/policy-packs/builtin/understanding-before-execution/expiry-reason.js.map +1 -0
- package/dist/policy-packs/builtin/understanding-before-execution/index.d.ts +3 -2
- package/dist/policy-packs/builtin/understanding-before-execution/index.js +5 -2
- package/dist/policy-packs/builtin/understanding-before-execution/index.js.map +1 -1
- package/dist/policy-packs/builtin/understanding-before-execution/markers.js +1 -0
- package/dist/policy-packs/builtin/understanding-before-execution/markers.js.map +1 -1
- package/dist/policy-packs/builtin/understanding-before-execution/persisted-reports.d.ts +253 -1
- package/dist/policy-packs/builtin/understanding-before-execution/persisted-reports.js +429 -13
- package/dist/policy-packs/builtin/understanding-before-execution/persisted-reports.js.map +1 -1
- package/dist/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.d.ts +1 -1
- package/dist/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.js +2 -2
- package/dist/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.js.map +1 -1
- package/dist/policy-packs/builtin/understanding-before-execution/task-markers.d.ts +36 -0
- package/dist/policy-packs/builtin/understanding-before-execution/task-markers.js +50 -0
- package/dist/policy-packs/builtin/understanding-before-execution/task-markers.js.map +1 -1
- package/dist/policy-packs/builtin/understanding-before-execution.d.ts +3 -2
- package/dist/policy-packs/builtin/understanding-before-execution.js +4 -1
- package/dist/policy-packs/builtin/understanding-before-execution.js.map +1 -1
- package/dist/runtime/bash-prefix-parse.js +319 -126
- package/dist/runtime/bash-prefix-parse.js.map +1 -1
- package/dist/runtime/deletion-target-resolve.js +24 -1
- package/dist/runtime/deletion-target-resolve.js.map +1 -1
- package/dist/runtime/destructive-shell-floor.js +15 -1
- package/dist/runtime/destructive-shell-floor.js.map +1 -1
- package/dist/runtime/intercept.d.ts +38 -0
- package/dist/runtime/intercept.js +224 -5
- package/dist/runtime/intercept.js.map +1 -1
- package/dist/runtime/read-only-bash.js +11 -1
- package/dist/runtime/read-only-bash.js.map +1 -1
- package/dist/runtime/shell-word.d.ts +42 -1
- package/dist/runtime/shell-word.js +174 -6
- package/dist/runtime/shell-word.js.map +1 -1
- package/package.json +1 -1
|
@@ -14,6 +14,7 @@ import * as fs from "node:fs";
|
|
|
14
14
|
import * as path from "node:path";
|
|
15
15
|
import { atomicWriteFile } from "../../../io/atomic-write.js";
|
|
16
16
|
import { safeJsonParse } from "../../../io/safe-json-parse.js";
|
|
17
|
+
import { sha256Hex } from "../../../runtime/approval-signing.js";
|
|
17
18
|
const DEFAULT_REPORTS_DIRNAME = ".understanding-gate";
|
|
18
19
|
const REPORTS_SUBDIR = "reports";
|
|
19
20
|
/**
|
|
@@ -64,10 +65,10 @@ function parseFilenameIsoMs(name) {
|
|
|
64
65
|
const ms = Date.parse(`${m[1]}T${m[2]}:${m[3]}:${m[4]}.${m[5]}Z`);
|
|
65
66
|
return Number.isNaN(ms) ? null : ms;
|
|
66
67
|
}
|
|
67
|
-
function readPersistedReport(filePath, mtimeMs) {
|
|
68
|
+
function readPersistedReport(filePath, mtimeMs, boundedRaw) {
|
|
68
69
|
let raw;
|
|
69
70
|
try {
|
|
70
|
-
raw = fs.readFileSync(filePath, "utf8");
|
|
71
|
+
raw = boundedRaw ?? fs.readFileSync(filePath, "utf8");
|
|
71
72
|
}
|
|
72
73
|
catch {
|
|
73
74
|
return null;
|
|
@@ -86,6 +87,8 @@ function readPersistedReport(filePath, mtimeMs) {
|
|
|
86
87
|
sessionId: typeof obj["sessionId"] === "string" ? obj["sessionId"] : null,
|
|
87
88
|
approvalStatus: typeof obj["approvalStatus"] === "string" ? obj["approvalStatus"] : null,
|
|
88
89
|
approvedAt: typeof obj["approvedAt"] === "string" ? obj["approvedAt"] : null,
|
|
90
|
+
expiredBy: typeof obj["expiredBy"] === "string" ? obj["expiredBy"] : null,
|
|
91
|
+
expiredAt: typeof obj["expiredAt"] === "string" ? obj["expiredAt"] : null,
|
|
89
92
|
createdAt,
|
|
90
93
|
createdAtMs,
|
|
91
94
|
};
|
|
@@ -265,7 +268,7 @@ const DETAIL_VALUE_MAX_LENGTH = 120;
|
|
|
265
268
|
* forge extra `reason:`-looking lines) are replaced with a space and
|
|
266
269
|
* the result is capped so one field cannot blow out the surface.
|
|
267
270
|
*/
|
|
268
|
-
function sanitizeDetailValue(value) {
|
|
271
|
+
export function sanitizeDetailValue(value) {
|
|
269
272
|
// Deliberately strips C0/DEL control characters (including newline,
|
|
270
273
|
// which could otherwise forge an extra `reason:`-looking stderr line).
|
|
271
274
|
const flattened = value.replace(/[\x00-\x1f\x7f]/g, " ");
|
|
@@ -292,8 +295,8 @@ function sanitizeDetailValue(value) {
|
|
|
292
295
|
* best-effort cleanup so a missing report dir or unrelated I/O issue
|
|
293
296
|
* does not escalate into a session-breaking hook failure.
|
|
294
297
|
*/
|
|
295
|
-
export function expirePersistedReport(reportsDir, sessionId, now = new Date()) {
|
|
296
|
-
const reports =
|
|
298
|
+
export function expirePersistedReport(reportsDir, sessionId, now = new Date(), trigger) {
|
|
299
|
+
const reports = listPersistedReportsBounded(reportsDir);
|
|
297
300
|
if (reports.length === 0) {
|
|
298
301
|
return { ok: false, reason: `no reports under ${reportsDir}` };
|
|
299
302
|
}
|
|
@@ -310,13 +313,12 @@ export function expirePersistedReport(reportsDir, sessionId, now = new Date()) {
|
|
|
310
313
|
reason: `latest report ${sanitizeDetailValue(path.basename(latest.filePath))} already has approvalStatus=${sanitizeDetailValue(latest.approvalStatus ?? "<missing>")}, nothing to expire`,
|
|
311
314
|
};
|
|
312
315
|
}
|
|
313
|
-
|
|
314
|
-
|
|
315
|
-
|
|
316
|
-
|
|
317
|
-
catch (err) {
|
|
318
|
-
return { ok: false, reason: `failed to read ${latest.filePath}: ${err.message}` };
|
|
316
|
+
// Bounded like the listing: the file may have been swapped since.
|
|
317
|
+
const read = readReportFileBounded(latest.filePath);
|
|
318
|
+
if (!read.ok) {
|
|
319
|
+
return { ok: false, reason: `failed to read ${latest.filePath}: ${read.detail}` };
|
|
319
320
|
}
|
|
321
|
+
const raw = read.raw;
|
|
320
322
|
let parsed;
|
|
321
323
|
try {
|
|
322
324
|
parsed = JSON.parse(raw);
|
|
@@ -327,6 +329,13 @@ export function expirePersistedReport(reportsDir, sessionId, now = new Date()) {
|
|
|
327
329
|
const previousStatus = typeof parsed["approvalStatus"] === "string" ? parsed["approvalStatus"] : null;
|
|
328
330
|
parsed["approvalStatus"] = "expired";
|
|
329
331
|
parsed["expiredAt"] = now.toISOString();
|
|
332
|
+
if (trigger !== undefined && trigger !== "") {
|
|
333
|
+
parsed["expiredBy"] = trigger;
|
|
334
|
+
}
|
|
335
|
+
else {
|
|
336
|
+
// No event to record: drop a stale one from an earlier expiry.
|
|
337
|
+
delete parsed["expiredBy"];
|
|
338
|
+
}
|
|
330
339
|
try {
|
|
331
340
|
atomicWriteFile(latest.filePath, `${JSON.stringify(parsed, null, 2)}\n`);
|
|
332
341
|
}
|
|
@@ -356,7 +365,7 @@ export function expirePersistedReport(reportsDir, sessionId, now = new Date()) {
|
|
|
356
365
|
* `understanding-gate approve` CLI, which writes no signed marker).
|
|
357
366
|
*/
|
|
358
367
|
export function checkPersistedReport(reportsDir, sessionId) {
|
|
359
|
-
const reports =
|
|
368
|
+
const reports = listPersistedReportsBounded(reportsDir);
|
|
360
369
|
if (reports.length === 0) {
|
|
361
370
|
return {
|
|
362
371
|
claimsApproved: false,
|
|
@@ -374,9 +383,11 @@ export function checkPersistedReport(reportsDir, sessionId) {
|
|
|
374
383
|
}
|
|
375
384
|
const safeFileName = sanitizeDetailValue(path.basename(latest.filePath));
|
|
376
385
|
if (latest.approvalStatus !== "approved") {
|
|
386
|
+
const boundaryExpiry = describeBoundaryExpiry(latest);
|
|
387
|
+
const expirySuffix = boundaryExpiry !== undefined ? `; ${boundaryExpiry}` : "";
|
|
377
388
|
return {
|
|
378
389
|
claimsApproved: false,
|
|
379
|
-
detail: `latest report ${safeFileName} has approvalStatus=${sanitizeDetailValue(latest.approvalStatus ?? "<missing>")}`,
|
|
390
|
+
detail: `latest report ${safeFileName} has approvalStatus=${sanitizeDetailValue(latest.approvalStatus ?? "<missing>")}${expirySuffix}`,
|
|
380
391
|
report: latest,
|
|
381
392
|
};
|
|
382
393
|
}
|
|
@@ -390,4 +401,409 @@ export function checkPersistedReport(reportsDir, sessionId) {
|
|
|
390
401
|
report: latest,
|
|
391
402
|
};
|
|
392
403
|
}
|
|
404
|
+
/**
|
|
405
|
+
* `approval expired because <event> at <time>` for a report a PostToolUse
|
|
406
|
+
* boundary expired (`expirePersistedReport` stamps `expiredBy` and
|
|
407
|
+
* `expiredAt`), `undefined` for any other report, including an older one or
|
|
408
|
+
* one a package producer wrote that carries no `expiredBy`. Both values come
|
|
409
|
+
* from a JSON file the gated agent can write, so both pass
|
|
410
|
+
* `sanitizeDetailValue`.
|
|
411
|
+
*/
|
|
412
|
+
export function describeBoundaryExpiry(report) {
|
|
413
|
+
if (report.approvalStatus !== "expired")
|
|
414
|
+
return undefined;
|
|
415
|
+
if (report.expiredBy === null || report.expiredBy === "")
|
|
416
|
+
return undefined;
|
|
417
|
+
const when = report.expiredAt !== null && report.expiredAt !== ""
|
|
418
|
+
? ` at ${sanitizeDetailValue(report.expiredAt)}`
|
|
419
|
+
: "";
|
|
420
|
+
return `approval expired because ${sanitizeDetailValue(report.expiredBy)}${when}`;
|
|
421
|
+
}
|
|
422
|
+
/**
|
|
423
|
+
* Report fields the approval and expiry lifecycles rewrite. They are left
|
|
424
|
+
* out of {@link canonicalReportHash}: `rewriteReportApproved` flips
|
|
425
|
+
* `approvalStatus`/`approvedAt`/`approvedBy`, may stamp `sessionId`, and
|
|
426
|
+
* drops `expiredAt`/`expiredBy`; `expirePersistedReport` later sets
|
|
427
|
+
* `approvalStatus`/`expiredAt`/`expiredBy` again. The hash must survive all
|
|
428
|
+
* of that for an untouched report, so it covers only the content the
|
|
429
|
+
* operator actually reviewed.
|
|
430
|
+
*/
|
|
431
|
+
const LIFECYCLE_REPORT_FIELDS = new Set([
|
|
432
|
+
"approvalStatus",
|
|
433
|
+
"approvedAt",
|
|
434
|
+
"approvedBy",
|
|
435
|
+
"expiredAt",
|
|
436
|
+
"expiredBy",
|
|
437
|
+
"sessionId",
|
|
438
|
+
]);
|
|
439
|
+
/**
|
|
440
|
+
* Deepest array/object nesting {@link canonicalReportHash} serialises (the
|
|
441
|
+
* report object itself is level 1). `sortKeysDeep` and `JSON.stringify`
|
|
442
|
+
* recurse once per level, and any agent-written `*.json` file in the reports
|
|
443
|
+
* directory reaches them through the gate-read scan, so without a bound a
|
|
444
|
+
* file nested a few thousand levels deep overflows the stack and the hook
|
|
445
|
+
* process dies instead of deciding. A real report nests a handful of levels.
|
|
446
|
+
*/
|
|
447
|
+
const MAX_CANONICAL_REPORT_DEPTH = 64;
|
|
448
|
+
/**
|
|
449
|
+
* Largest report file, in bytes, the canonical hash reads from disk (1 MiB).
|
|
450
|
+
* Every `*.json` entry of the reports directory reaches the hash through the
|
|
451
|
+
* gate-read scan, and the agent can write that directory, so without a bound
|
|
452
|
+
* a planted file of a few hundred megabytes made the hook run out of heap or
|
|
453
|
+
* past its time budget instead of deciding (a hook that dies or overruns is a
|
|
454
|
+
* non-blocking error for the runtime). A real report is a few kilobytes, far
|
|
455
|
+
* below the cap. A file over the cap matches nothing at gate read, and both
|
|
456
|
+
* producers refuse to approve such a report.
|
|
457
|
+
*/
|
|
458
|
+
export const MAX_HASHED_REPORT_BYTES = 1024 * 1024;
|
|
459
|
+
/**
|
|
460
|
+
* Iterative walk over the arrays and objects of `value` (the value itself is
|
|
461
|
+
* level 1) that stops at the first one nested deeper than `max` levels.
|
|
462
|
+
* Iterative, so the walk itself cannot overflow the stack. Only arrays and
|
|
463
|
+
* objects are pushed: a scalar child (string, number, boolean, null) cannot
|
|
464
|
+
* nest, so a wide array of scalars costs no stack slot per element, and
|
|
465
|
+
* `visited` counts the root plus the containers below it. Exported for tests.
|
|
466
|
+
*/
|
|
467
|
+
export function walkContainerDepth(value, max) {
|
|
468
|
+
const nodes = [value];
|
|
469
|
+
const depths = [1];
|
|
470
|
+
let visited = 0;
|
|
471
|
+
while (nodes.length > 0) {
|
|
472
|
+
const node = nodes.pop();
|
|
473
|
+
const depth = depths.pop() ?? 1;
|
|
474
|
+
visited += 1;
|
|
475
|
+
if (node === null || typeof node !== "object")
|
|
476
|
+
continue;
|
|
477
|
+
if (depth > max)
|
|
478
|
+
return { tooDeep: true, visited };
|
|
479
|
+
for (const child of Array.isArray(node) ? node : Object.values(node)) {
|
|
480
|
+
if (child !== null && typeof child === "object") {
|
|
481
|
+
nodes.push(child);
|
|
482
|
+
depths.push(depth + 1);
|
|
483
|
+
}
|
|
484
|
+
}
|
|
485
|
+
}
|
|
486
|
+
return { tooDeep: false, visited };
|
|
487
|
+
}
|
|
488
|
+
/** True when `value` nests arrays/objects deeper than `max` levels. */
|
|
489
|
+
function nestsDeeperThan(value, max) {
|
|
490
|
+
return walkContainerDepth(value, max).tooDeep;
|
|
491
|
+
}
|
|
492
|
+
function sortKeysDeep(value) {
|
|
493
|
+
if (Array.isArray(value))
|
|
494
|
+
return value.map(sortKeysDeep);
|
|
495
|
+
if (value !== null && typeof value === "object") {
|
|
496
|
+
const entries = Object.entries(value)
|
|
497
|
+
.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
|
|
498
|
+
.map(([k, v]) => [k, sortKeysDeep(v)]);
|
|
499
|
+
// `Object.fromEntries` defines own properties, so a report key named
|
|
500
|
+
// `__proto__` stays data instead of re-parenting the copy.
|
|
501
|
+
return Object.fromEntries(entries);
|
|
502
|
+
}
|
|
503
|
+
return value;
|
|
504
|
+
}
|
|
505
|
+
/**
|
|
506
|
+
* The hash an approval marker signs as its `reportContentHash`, and the one
|
|
507
|
+
* the gate recomputes at read time (task fa423e9b): sha256 over a key-sorted
|
|
508
|
+
* JSON serialisation of the parsed report with the lifecycle fields in
|
|
509
|
+
* `LIFECYCLE_REPORT_FIELDS` removed. A raw-bytes hash cannot do this job: the
|
|
510
|
+
* producers hash before `rewriteReportApproved` re-serialises the file and
|
|
511
|
+
* `expirePersistedReport` rewrites it again, so the raw bytes of an untouched
|
|
512
|
+
* report never match what the marker signed. One function on purpose, shared
|
|
513
|
+
* by both producers (`harness approve understanding`, the auto-approval path)
|
|
514
|
+
* and the verifier.
|
|
515
|
+
*
|
|
516
|
+
* Total: returns null instead of throwing for a report nested deeper than
|
|
517
|
+
* `MAX_CANONICAL_REPORT_DEPTH`. The verifier counts such a file as one that
|
|
518
|
+
* matches nothing; both producers refuse to approve such a report, so no
|
|
519
|
+
* marker is ever signed without a content binding because of it. Report
|
|
520
|
+
* files reach it only after {@link readReportFileBounded} bounded their type
|
|
521
|
+
* and size (the gate-read scan and `harness approve understanding` through
|
|
522
|
+
* {@link hashReportFile}, the auto-approval path directly).
|
|
523
|
+
*/
|
|
524
|
+
export function canonicalReportHash(report) {
|
|
525
|
+
// `Object.fromEntries` (not `kept[key] = value`): a report key named
|
|
526
|
+
// `__proto__` must stay hashed data, not re-parent the copy and vanish.
|
|
527
|
+
const kept = Object.fromEntries(Object.entries(report).filter(([key]) => !LIFECYCLE_REPORT_FIELDS.has(key)));
|
|
528
|
+
if (nestsDeeperThan(kept, MAX_CANONICAL_REPORT_DEPTH))
|
|
529
|
+
return null;
|
|
530
|
+
return sha256Hex(JSON.stringify(sortKeysDeep(kept)));
|
|
531
|
+
}
|
|
532
|
+
function errorCode(err) {
|
|
533
|
+
const code = err?.code;
|
|
534
|
+
return typeof code === "string" ? code : String(err);
|
|
535
|
+
}
|
|
536
|
+
/**
|
|
537
|
+
* Read a report file for hashing, bounded by type and size. This is the one
|
|
538
|
+
* read every canonical report hash goes through: the gate-read scan (via
|
|
539
|
+
* {@link hashReportFile}) and both producers. The path is opened once,
|
|
540
|
+
* read-only and non-blocking (`O_NONBLOCK`: opening a FIFO with no writer
|
|
541
|
+
* returns at once instead of waiting for one); its type and size come from
|
|
542
|
+
* `fstat` on that descriptor, and the content is read through the same
|
|
543
|
+
* descriptor, so nothing can be swapped in between (no separate stat of the
|
|
544
|
+
* path, which a symlink flipped to a FIFO used to race). Refused without
|
|
545
|
+
* reading: anything that is not a regular file, and a file larger than
|
|
546
|
+
* `MAX_HASHED_REPORT_BYTES`. The read stops one byte past the fstat size
|
|
547
|
+
* (never more than the cap plus one byte); a file that grows into that byte
|
|
548
|
+
* while being read is refused too. The descriptor is always closed. Never
|
|
549
|
+
* throws.
|
|
550
|
+
*/
|
|
551
|
+
export function readReportFileBounded(filePath) {
|
|
552
|
+
let fd;
|
|
553
|
+
try {
|
|
554
|
+
fd = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);
|
|
555
|
+
}
|
|
556
|
+
catch (err) {
|
|
557
|
+
return { ok: false, reason: "unreadable", detail: `could not be opened (${errorCode(err)})` };
|
|
558
|
+
}
|
|
559
|
+
try {
|
|
560
|
+
const stat = fs.fstatSync(fd);
|
|
561
|
+
if (!stat.isFile())
|
|
562
|
+
return { ok: false, reason: "not-regular", detail: "not a regular file" };
|
|
563
|
+
if (stat.size > MAX_HASHED_REPORT_BYTES) {
|
|
564
|
+
return {
|
|
565
|
+
ok: false,
|
|
566
|
+
reason: "too-large",
|
|
567
|
+
detail: `${stat.size} bytes, over the ${MAX_HASHED_REPORT_BYTES}-byte cap for hashing its content`,
|
|
568
|
+
};
|
|
569
|
+
}
|
|
570
|
+
const buf = Buffer.allocUnsafe(stat.size + 1);
|
|
571
|
+
let total = 0;
|
|
572
|
+
while (total < buf.length) {
|
|
573
|
+
const n = fs.readSync(fd, buf, total, buf.length - total, null);
|
|
574
|
+
if (n === 0)
|
|
575
|
+
break;
|
|
576
|
+
total += n;
|
|
577
|
+
}
|
|
578
|
+
if (total > stat.size)
|
|
579
|
+
return { ok: false, reason: "grew", detail: "grew while being read" };
|
|
580
|
+
return { ok: true, raw: buf.toString("utf8", 0, total), mtimeMs: stat.mtimeMs };
|
|
581
|
+
}
|
|
582
|
+
catch (err) {
|
|
583
|
+
return { ok: false, reason: "unreadable", detail: `could not be read (${errorCode(err)})` };
|
|
584
|
+
}
|
|
585
|
+
finally {
|
|
586
|
+
try {
|
|
587
|
+
fs.closeSync(fd);
|
|
588
|
+
}
|
|
589
|
+
catch {
|
|
590
|
+
// Already gone; nothing left to release.
|
|
591
|
+
}
|
|
592
|
+
}
|
|
593
|
+
}
|
|
594
|
+
/**
|
|
595
|
+
* Canonical hash of the report file at `filePath`, read through
|
|
596
|
+
* {@link readReportFileBounded}, or why it has none: not a regular file, over
|
|
597
|
+
* `MAX_HASHED_REPORT_BYTES`, unreadable, grown while read, not a JSON object,
|
|
598
|
+
* or nested too deeply. `harness approve understanding` refuses a report on
|
|
599
|
+
* any of these (the `detail` is its message); the gate-read scan counts such
|
|
600
|
+
* a file as one that matches nothing. Never throws.
|
|
601
|
+
*/
|
|
602
|
+
export function hashReportFile(filePath) {
|
|
603
|
+
const read = readReportFileBounded(filePath);
|
|
604
|
+
if (!read.ok)
|
|
605
|
+
return read;
|
|
606
|
+
const parsed = safeJsonParse(read.raw);
|
|
607
|
+
if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
|
|
608
|
+
return { ok: false, reason: "not-json-object", detail: "not a JSON object" };
|
|
609
|
+
}
|
|
610
|
+
const hash = canonicalReportHash(parsed);
|
|
611
|
+
if (hash === null) {
|
|
612
|
+
return { ok: false, reason: "too-deep", detail: "nested too deeply to hash its content" };
|
|
613
|
+
}
|
|
614
|
+
return { ok: true, hash };
|
|
615
|
+
}
|
|
616
|
+
/** Canonical hash of the report file at `filePath` ({@link hashReportFile}); null when it has none. */
|
|
617
|
+
export function canonicalReportHashOfFile(filePath) {
|
|
618
|
+
const hashed = hashReportFile(filePath);
|
|
619
|
+
return hashed.ok ? hashed.hash : null;
|
|
620
|
+
}
|
|
621
|
+
/**
|
|
622
|
+
* Hash every `*.json` entry of `dir` (any session, any `approvalStatus`)
|
|
623
|
+
* through {@link canonicalReportHashOfFile} and report which of the `wanted`
|
|
624
|
+
* hashes occur. Stops as soon as every wanted hash was found. Every entry
|
|
625
|
+
* counts as a report file; one that is not a regular file, is larger than
|
|
626
|
+
* `MAX_HASHED_REPORT_BYTES`, cannot be opened or read, grows while read, is
|
|
627
|
+
* not a JSON object, or nests too deeply matches nothing. The cost is linear
|
|
628
|
+
* in the number and size of the report files (each read at most up to the
|
|
629
|
+
* cap), and the usual allow path scans nearly all of them: the directory
|
|
630
|
+
* listing comes back in name order and report names start with a timestamp,
|
|
631
|
+
* so the approved (newest) report tends to come last.
|
|
632
|
+
*/
|
|
633
|
+
function scanReportHashes(dir, wanted) {
|
|
634
|
+
const scan = { files: 0, matched: new Set() };
|
|
635
|
+
let names;
|
|
636
|
+
try {
|
|
637
|
+
names = fs.readdirSync(dir);
|
|
638
|
+
}
|
|
639
|
+
catch {
|
|
640
|
+
return scan;
|
|
641
|
+
}
|
|
642
|
+
for (const name of names) {
|
|
643
|
+
if (!name.endsWith(".json"))
|
|
644
|
+
continue;
|
|
645
|
+
const full = path.join(dir, name);
|
|
646
|
+
scan.files += 1;
|
|
647
|
+
const hash = canonicalReportHashOfFile(full);
|
|
648
|
+
if (hash !== null && wanted.has(hash)) {
|
|
649
|
+
scan.matched.add(hash);
|
|
650
|
+
if (scan.matched.size === wanted.size)
|
|
651
|
+
break;
|
|
652
|
+
}
|
|
653
|
+
}
|
|
654
|
+
return scan;
|
|
655
|
+
}
|
|
656
|
+
/**
|
|
657
|
+
* Gate-read cross-check of a matched approval marker against the persisted
|
|
658
|
+
* reports (task fa423e9b). Both PreToolUse hooks call it after
|
|
659
|
+
* `checkOperatorApprovalMarkers` matched, through `verifyMatchedMarkerReport`.
|
|
660
|
+
*
|
|
661
|
+
* Rule: a marker with a non-null signed `reportContentHash` is valid iff at
|
|
662
|
+
* least one parseable report file in `reportsDir` (any session, any
|
|
663
|
+
* `approvalStatus`) has a canonical hash equal to it. The hash already
|
|
664
|
+
* leaves the lifecycle fields out, so approving, expiring or re-approving
|
|
665
|
+
* the report never changes it. The signed hash therefore proves one thing:
|
|
666
|
+
* the content the operator approved is still on disk unmodified. Editing
|
|
667
|
+
* that file (in place, by swap, by symlink, by an unparseable rewrite)
|
|
668
|
+
* removes the only match and the marker stops opening the gate. Comparing
|
|
669
|
+
* against the session's newest approved report instead would deny
|
|
670
|
+
* legitimate approvals (a newer report approved for the same claim, two
|
|
671
|
+
* sessions on one claim) and would let a swap pass by moving the swapped
|
|
672
|
+
* report out of the selection.
|
|
673
|
+
*
|
|
674
|
+
* Bounded input: only a regular file of at most `MAX_HASHED_REPORT_BYTES`
|
|
675
|
+
* (1 MiB) that parses as a JSON object nested at most 64 levels deep has a
|
|
676
|
+
* canonical hash, read through {@link readReportFileBounded} (opened
|
|
677
|
+
* non-blocking, typed and sized by `fstat` on the open descriptor, read
|
|
678
|
+
* through it). Every other `*.json` entry (a FIFO, a directory, a device, a
|
|
679
|
+
* symlink to one of them, a file over the cap, an unreadable, unparseable or
|
|
680
|
+
* too deeply nested file) still counts as a report file but matches nothing,
|
|
681
|
+
* so it can neither open the gate nor make the scan block, run out of
|
|
682
|
+
* memory or die instead of deciding.
|
|
683
|
+
*
|
|
684
|
+
* Residuals: (1) the check proves only that some file carries the approved
|
|
685
|
+
* content. Any regular `*.json` file within the size cap whose content
|
|
686
|
+
* equals it keeps a match, whether it was kept before the edit (a copy) or
|
|
687
|
+
* re-created after it (the agent wrote that content, so it can write it
|
|
688
|
+
* again), and the marker still opens the gate. (2) A reports directory that
|
|
689
|
+
* is empty, unreadable or holds no `*.json` entry at all (every report
|
|
690
|
+
* deleted, the directory made unreadable, the reports renamed) falls back to
|
|
691
|
+
* the "no report file" allow, the same as before this check existed. The
|
|
692
|
+
* marker and the operator's approval itself are untouched in both cases;
|
|
693
|
+
* only the audit trail loses its claim to be the approved content. (3) The
|
|
694
|
+
* cap bounds each file, not their number: the scan time grows with the
|
|
695
|
+
* total volume of report files, so an agent that plants hundreds of
|
|
696
|
+
* megabytes of files just under the cap can still push one scan past the
|
|
697
|
+
* hook's time budget, which the runtime treats as a non-blocking error (the
|
|
698
|
+
* same allow as before this check existed).
|
|
699
|
+
*
|
|
700
|
+
* Removing the approved report while other report files remain is a deny:
|
|
701
|
+
* nothing on disk carries the signed content any more. `harness gc --apply`
|
|
702
|
+
* can do that legitimately: it ages approved reports out by their createdAt
|
|
703
|
+
* but markers by their file mtime, so a report written long before its
|
|
704
|
+
* approval can go while the marker stays. Re-approving recovers.
|
|
705
|
+
*
|
|
706
|
+
* `primary` is the marker that satisfied the gate (task-scoped first),
|
|
707
|
+
* `fallback` a session marker that matched behind a task marker. The
|
|
708
|
+
* fallback is consulted only when the primary fails the check, so a task
|
|
709
|
+
* marker signed for another report does not hide a session marker that
|
|
710
|
+
* verifies. Unchanged behaviour: a null hash on the accepted marker (no
|
|
711
|
+
* report resolved, or `--force` over a report the producer could not hash:
|
|
712
|
+
* too deeply nested or over the size cap) and a reports directory with no
|
|
713
|
+
* `*.json` entry at all both allow. A forced approval of a hashable report
|
|
714
|
+
* signs its hash and is checked like any other.
|
|
715
|
+
*
|
|
716
|
+
* The `detail` is the block reason. It names the failing marker kind and the
|
|
717
|
+
* one-command fix, which is also the single migration step for a marker
|
|
718
|
+
* written before the canonical hash existed. It carries no report-derived
|
|
719
|
+
* value, so nothing in it needs sanitising.
|
|
720
|
+
*/
|
|
721
|
+
export function verifyApprovedReportHash(reportsDir, primary, fallback = null) {
|
|
722
|
+
if (primary.reportContentHash === null)
|
|
723
|
+
return { ok: true, kind: primary.kind };
|
|
724
|
+
if (fallback !== null && fallback.reportContentHash === null) {
|
|
725
|
+
return { ok: true, kind: fallback.kind };
|
|
726
|
+
}
|
|
727
|
+
const wanted = new Set([primary.reportContentHash]);
|
|
728
|
+
if (fallback !== null && fallback.reportContentHash !== null) {
|
|
729
|
+
wanted.add(fallback.reportContentHash);
|
|
730
|
+
}
|
|
731
|
+
const scan = scanReportHashes(reportsDir, wanted);
|
|
732
|
+
if (scan.files === 0 || scan.matched.has(primary.reportContentHash)) {
|
|
733
|
+
return { ok: true, kind: primary.kind };
|
|
734
|
+
}
|
|
735
|
+
if (fallback !== null &&
|
|
736
|
+
fallback.reportContentHash !== null &&
|
|
737
|
+
scan.matched.has(fallback.reportContentHash)) {
|
|
738
|
+
return { ok: true, kind: fallback.kind };
|
|
739
|
+
}
|
|
740
|
+
const kinds = fallback !== null
|
|
741
|
+
? `${primary.kind} and ${fallback.kind} approval markers were`
|
|
742
|
+
: `${primary.kind} approval marker was`;
|
|
743
|
+
return {
|
|
744
|
+
ok: false,
|
|
745
|
+
detail: `no report in the reports directory matches the content the ${kinds} signed for ` +
|
|
746
|
+
`(the approved report was changed or removed after approval); re-run \`harness approve understanding\``,
|
|
747
|
+
};
|
|
748
|
+
}
|
|
749
|
+
/**
|
|
750
|
+
* {@link listPersistedReports} for every read a PreToolUse hook (or the
|
|
751
|
+
* PostToolUse boundary) makes of the reports directory. The directory holds
|
|
752
|
+
* files the gated agent can write, so every entry is opened once through
|
|
753
|
+
* {@link readReportFileBounded}: non-blocking, typed and sized by `fstat` on
|
|
754
|
+
* the open descriptor, read through it. A `*.json` entry that is not a
|
|
755
|
+
* regular file (a FIFO, a directory, a device, a symlink to one of them), is
|
|
756
|
+
* over `MAX_HASHED_REPORT_BYTES`, cannot be opened or read, or grows while it
|
|
757
|
+
* is read is left out of `reports`, as if it were not there, and recorded in
|
|
758
|
+
* `skipped`: it can neither block the hook nor run it out of memory. There is
|
|
759
|
+
* no separate stat of the path (a symlink flipped to a FIFO between that stat
|
|
760
|
+
* and the read used to hang the read), and the modification time comes from
|
|
761
|
+
* the same descriptor.
|
|
762
|
+
*
|
|
763
|
+
* A caller that must not let the selection fall back to an older report when
|
|
764
|
+
* a newer one is unreadable (the auto-approval precondition) declines when
|
|
765
|
+
* `skipped` is not empty. The operator commands (`harness approve
|
|
766
|
+
* understanding`, `harness gc`) keep the unbounded {@link listPersistedReports}
|
|
767
|
+
* on purpose: they must still see an oversized report to refuse or age it.
|
|
768
|
+
*
|
|
769
|
+
* Placement: this block sits at the end of the file, and
|
|
770
|
+
* {@link readPersistedReport} takes the already-read text (`boundedRaw`), so
|
|
771
|
+
* the line numbers the decision record
|
|
772
|
+
* docs/decisions/2026-08-27-ug-auto-mode-approval.md cites in this file stay
|
|
773
|
+
* put (tests/decisions-citations-resolve.test.ts pins them).
|
|
774
|
+
*/
|
|
775
|
+
export function listPersistedReportsBoundedWithSkips(dir) {
|
|
776
|
+
let names = [];
|
|
777
|
+
try {
|
|
778
|
+
names = fs.readdirSync(dir);
|
|
779
|
+
}
|
|
780
|
+
catch {
|
|
781
|
+
// No readable directory: no reports.
|
|
782
|
+
}
|
|
783
|
+
const reports = [];
|
|
784
|
+
const skipped = [];
|
|
785
|
+
for (const name of names.filter((n) => n.endsWith(".json"))) {
|
|
786
|
+
const full = path.join(dir, name);
|
|
787
|
+
const read = readReportFileBounded(full);
|
|
788
|
+
if (!read.ok) {
|
|
789
|
+
skipped.push({ filePath: full, reason: read.reason, detail: read.detail });
|
|
790
|
+
continue;
|
|
791
|
+
}
|
|
792
|
+
const report = readPersistedReport(full, read.mtimeMs, read.raw);
|
|
793
|
+
if (report !== null)
|
|
794
|
+
reports.push(report);
|
|
795
|
+
}
|
|
796
|
+
reports.sort((a, b) => b.createdAtMs - a.createdAtMs);
|
|
797
|
+
return { reports, skipped };
|
|
798
|
+
}
|
|
799
|
+
/**
|
|
800
|
+
* {@link listPersistedReportsBoundedWithSkips} without the skipped entries,
|
|
801
|
+
* for the callers that treat a skipped entry as no evidence
|
|
802
|
+
* ({@link checkPersistedReport}, {@link expirePersistedReport}). Expiry acts
|
|
803
|
+
* on the newest report that was within the cap, so an oversized newest
|
|
804
|
+
* approved report is left as it is and the next in-cap one is expired.
|
|
805
|
+
*/
|
|
806
|
+
export function listPersistedReportsBounded(dir) {
|
|
807
|
+
return listPersistedReportsBoundedWithSkips(dir).reports;
|
|
808
|
+
}
|
|
393
809
|
//# sourceMappingURL=persisted-reports.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"persisted-reports.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/persisted-reports.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,kCAAkC;AAClC,EAAE;AACF,0EAA0E;AAC1E,+DAA+D;AAC/D,wEAAwE;AACxE,2EAA2E;AAC3E,kEAAkE;AAClE,mBAAmB;AAEnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAqB/D,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AACtD,MAAM,cAAc,GAAG,SAAS,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACtE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,OAAe;IAC5D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,eAAe,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAChF,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;QAChD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC;IAC7D,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI;QACrF,cAAc,EACZ,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,gBAAgB,CAAY,CAAC,CAAC,CAAC,IAAI;QACtF,UAAU,EAAE,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,IAAI;QACxF,SAAS;QACT,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,SAAS;QAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,MAAM,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,MAAM,CAAC;AAmD3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA0B,EAC1B,SAAiB,EACjB,OAA0B,EAAE;IAE5B,sBAAsB;IACtB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IACD,8DAA8D;IAC9D,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,aAAa,GAAsB,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,SAAS;QACnC,IACE,IAAI,KAAK,aAAa;YACtB,CAAC,CAAC,CAAC,cAAc,KAAK,UAAU,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,EACnE,CAAC;YACD,kEAAkE;YAClE,kEAAkE;YAClE,iDAAiD;YACjD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC;YACpC,IAAI,KAAK,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,GAAG,CAAC,gCAAgC,EAAE,CAAC;gBAC/E,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAA0B,EAC1B,SAAiB;IAEjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA0B,EAC1B,SAAiB,EACjB,OAA0B,EAAE;IAE5B,OAAO,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,iCAAiC,GAAG,6CAA6C,CAAC;AAExF,mFAAmF;AACnF,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,MAAM,GAAG,uBAAuB;QAC/C,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,KAAK;QACrD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AA4BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,UAAU,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gCAAgC,SAAS,KAAK,OAAO,CAAC,MAAM,gCAAgC;SACrG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,+BAA+B,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,CAAC,qBAAqB;SAC1L,CAAC;IACJ,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,cAAc,GAClB,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,gBAAgB,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;IACrC,MAAM,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE;SAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,SAAiB;IAEjB,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,uBAAuB,UAAU,EAAE;YAC3C,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,gCAAgC,SAAS,KAAK,OAAO,CAAC,MAAM,gCAAgC;YACpG,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,iBAAiB,YAAY,uBACnC,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,CAC1D,EAAE;YACF,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,MAAM,EACJ,GAAG,iCAAiC,YAAY,YAAY,OAAO;YACnE,0BAA0B,cAAc,CAAC,CAAC,CAAC,iBAAiB,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;YACrF,gFAAgF;YAChF,6EAA6E;QAC/E,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"persisted-reports.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/persisted-reports.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,kCAAkC;AAClC,EAAE;AACF,0EAA0E;AAC1E,+DAA+D;AAC/D,wEAAwE;AACxE,2EAA2E;AAC3E,kEAAkE;AAClE,mBAAmB;AAEnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AA8BjE,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AACtD,MAAM,cAAc,GAAG,SAAS,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACtE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,OAAe,EAAE,UAAmB;IACjF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,IAAI,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,eAAe,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAChF,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;QAChD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC;IAC7D,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI;QACrF,cAAc,EACZ,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,gBAAgB,CAAY,CAAC,CAAC,CAAC,IAAI;QACtF,UAAU,EAAE,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,IAAI;QACxF,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI;QACrF,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,IAAI;QACrF,SAAS;QACT,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,SAAS;QAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,MAAM,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,MAAM,CAAC;AAmD3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA0B,EAC1B,SAAiB,EACjB,OAA0B,EAAE;IAE5B,sBAAsB;IACtB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IACD,8DAA8D;IAC9D,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACjD,MAAM,aAAa,GAAsB,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,SAAS;QACnC,IACE,IAAI,KAAK,aAAa;YACtB,CAAC,CAAC,CAAC,cAAc,KAAK,UAAU,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,EACnE,CAAC;YACD,kEAAkE;YAClE,kEAAkE;YAClE,iDAAiD;YACjD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC;YACpC,IAAI,KAAK,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,GAAG,CAAC,gCAAgC,EAAE,CAAC;gBAC/E,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAA0B,EAC1B,SAAiB;IAEjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA0B,EAC1B,SAAiB,EACjB,OAA0B,EAAE;IAE5B,OAAO,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,iCAAiC,GAAG,6CAA6C,CAAC;AAExF,mFAAmF;AACnF,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,MAAM,GAAG,uBAAuB;QAC/C,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,KAAK;QACrD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AA4BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE,EACtB,OAAgB;IAEhB,MAAM,OAAO,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,UAAU,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gCAAgC,SAAS,KAAK,OAAO,CAAC,MAAM,gCAAgC;SACrG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,+BAA+B,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,CAAC,qBAAqB;SAC1L,CAAC;IACJ,CAAC;IACD,kEAAkE;IAClE,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,cAAc,GAClB,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,gBAAgB,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;IACrC,MAAM,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC;QACH,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE;SAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,SAAiB;IAEjB,MAAM,OAAO,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,uBAAuB,UAAU,EAAE;YAC3C,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,gCAAgC,SAAS,KAAK,OAAO,CAAC,MAAM,gCAAgC;YACpG,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QACzC,MAAM,cAAc,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,iBAAiB,YAAY,uBACnC,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,CAC1D,GAAG,YAAY,EAAE;YACjB,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,MAAM,EACJ,GAAG,iCAAiC,YAAY,YAAY,OAAO;YACnE,0BAA0B,cAAc,CAAC,CAAC,CAAC,iBAAiB,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;YACrF,gFAAgF;YAChF,6EAA6E;QAC/E,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA2E;IAE3E,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC3E,MAAM,IAAI,GACR,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE;QAClD,CAAC,CAAC,OAAO,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QAChD,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,4BAA4B,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,GAAG,IAAI,CAAC;AAUnD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,GAAW;IAC5D,MAAM,KAAK,GAAc,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,MAAM,GAAa,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,CAAC;QACb,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACxD,IAAI,KAAK,GAAG,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACnD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,uEAAuE;AACvE,SAAS,eAAe,CAAC,KAAc,EAAE,GAAW;IAClD,OAAO,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7D,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,qEAAqE;QACrE,2DAA2D;QAC3D,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA+B;IACjE,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAC7B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAC5E,CAAC;IACF,IAAI,eAAe,CAAC,IAAI,EAAE,0BAA0B,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AASD,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,IAAI,GAAI,GAAoC,EAAE,IAAI,CAAC;IACzD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,wBAAwB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC9F,IAAI,IAAI,CAAC,IAAI,GAAG,uBAAuB,EAAE,CAAC;YACxC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,oBAAoB,uBAAuB,mCAAmC;aACnG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;YAChE,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM;YACnB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAC7F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,sBAAsB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAC9F,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAiC,CAAC,CAAC;IACpE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAsBD;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,MAA2B;IAChE,MAAM,IAAI,GAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;IACtE,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBAAE,MAAM;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,OAA4B,EAC5B,WAAuC,IAAI;IAE3C,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAChF,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,IACE,QAAQ,KAAK,IAAI;QACjB,QAAQ,CAAC,iBAAiB,KAAK,IAAI;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAC5C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GACT,QAAQ,KAAK,IAAI;QACf,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,wBAAwB;QAC9D,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,sBAAsB,CAAC;IAC5C,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EACJ,8DAA8D,KAAK,cAAc;YACjF,uGAAuG;KAC1G,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,oCAAoC,CAAC,GAAW;IAI9D,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACtD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,OAAO,oCAAoC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC"}
|
package/dist/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.d.ts
CHANGED
|
@@ -113,7 +113,7 @@ export interface ApplyPostToolUseExpiryResult {
|
|
|
113
113
|
* side effects exactly so both runtimes share one clearing
|
|
114
114
|
* implementation (task a1348c89).
|
|
115
115
|
*/
|
|
116
|
-
export declare function applyPostToolUseExpiry(generatedDir: string, sessionId: string, toolInput: unknown, toolNameMatched: boolean, reportsDir: string, now?: Date): ApplyPostToolUseExpiryResult;
|
|
116
|
+
export declare function applyPostToolUseExpiry(generatedDir: string, sessionId: string, toolInput: unknown, toolNameMatched: boolean, reportsDir: string, now?: Date, trigger?: string): ApplyPostToolUseExpiryResult;
|
|
117
117
|
/**
|
|
118
118
|
* Compose the stderr diagnostic line for a matched-and-applied PostToolUse
|
|
119
119
|
* expiry. Shared by `harness pack hook post-tool-use` (Claude) and
|
|
@@ -149,7 +149,7 @@ export function matchPostToolUseBoundary(toolName, toolInput, lifecycle, bashToo
|
|
|
149
149
|
* side effects exactly so both runtimes share one clearing
|
|
150
150
|
* implementation (task a1348c89).
|
|
151
151
|
*/
|
|
152
|
-
export function applyPostToolUseExpiry(generatedDir, sessionId, toolInput, toolNameMatched, reportsDir, now) {
|
|
152
|
+
export function applyPostToolUseExpiry(generatedDir, sessionId, toolInput, toolNameMatched, reportsDir, now, trigger) {
|
|
153
153
|
const markerPath = approvalMarkerPathFor(generatedDir, sessionId);
|
|
154
154
|
const wasMarkerPresent = fs.existsSync(markerPath);
|
|
155
155
|
clearApprovalMarker(generatedDir, sessionId);
|
|
@@ -176,7 +176,7 @@ export function applyPostToolUseExpiry(generatedDir, sessionId, toolInput, toolN
|
|
|
176
176
|
// 7402301d the report can no longer satisfy the gate on its own, so
|
|
177
177
|
// this now exists so the audit record agrees with the cleared marker.
|
|
178
178
|
// Best-effort.
|
|
179
|
-
const reportExpiry = expirePersistedReport(reportsDir, sessionId, now);
|
|
179
|
+
const reportExpiry = expirePersistedReport(reportsDir, sessionId, now, trigger);
|
|
180
180
|
return {
|
|
181
181
|
wasMarkerPresent,
|
|
182
182
|
taskMarkerCleared,
|
package/dist/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"post-tool-use-boundary.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,kCAAkC;AAElC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,eAAe,EACf,8BAA8B,GAC/B,MAAM,gDAAgD,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,wEAAwE;AACxE,wEAAwE;AACxE,gEAAgE;AAChE,uEAAuE;AACvE,mEAAmE;AACnE,uEAAuE;AACvE,qEAAqE;AACrE,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,4BAA4B;AAC5B,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,QAA2B;IAE3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,QAA2B;IAE3B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,SAAkB;IACzC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAoC,CAAC;AAC9C,CAAC;AAED;mBACmB;AACnB,MAAM,UAAU,+BAA+B,CAAC,SAAkB;IAChE,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;6BAE6B;AAC7B,MAAM,UAAU,0BAA0B,CAAC,SAAkB;IAC3D,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED;;;iBAGiB;AACjB,MAAM,UAAU,yCAAyC,CAAC,SAAkB;IAC1E,OAAO,8BAA8B,CAAC,SAAS,CAAC,CAAC;AACnD,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,SAAkB,EAClB,SAA6E,EAC7E,gBAAqC,uBAAuB,EAC5D,YAAsB;IAEtB,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACrF,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,qCAAqC;IACrC,MAAM,kBAAkB,GACtB,kBAAkB;QAClB,kBAAkB,CAAC,QAAQ,EAAE,uBAAuB,CAAC;QACrD,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,KAAK,MAAM,CAAC;IAC7E,MAAM,eAAe,GAAG,kBAAkB,IAAI,CAAC,kBAAkB,CAAC;IAClE,uEAAuE;IACvE,gEAAgE;IAChE,YAAY;IACZ,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,CAAC,CAAC,qBAAqB,CACnB,+BAA+B,CAAC,SAAS,CAAC,EAC1C,SAAS,CAAC,iBAAiB,CAC5B;QACH,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,OAAO,EAAE,eAAe,IAAI,SAAS,KAAK,SAAS;QACnD,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,SAAS;KACV,CAAC;AACJ,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,SAAiB,EACjB,SAAkB,EAClB,eAAwB,EACxB,UAAkB,EAClB,GAAU;
|
|
1
|
+
{"version":3,"file":"post-tool-use-boundary.js","sourceRoot":"","sources":["../../../../src/policy-packs/builtin/understanding-before-execution/post-tool-use-boundary.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,kCAAkC;AAElC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,eAAe,EACf,8BAA8B,GAC/B,MAAM,gDAAgD,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,wEAAwE;AACxE,wEAAwE;AACxE,gEAAgE;AAChE,uEAAuE;AACvE,mEAAmE;AACnE,uEAAuE;AACvE,qEAAqE;AACrE,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,4BAA4B;AAC5B,wEAAwE;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,QAA2B;IAE3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,qBAAqB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,QAA2B;IAE3B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,SAAkB;IACzC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAoC,CAAC;AAC9C,CAAC;AAED;mBACmB;AACnB,MAAM,UAAU,+BAA+B,CAAC,SAAkB;IAChE,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;6BAE6B;AAC7B,MAAM,UAAU,0BAA0B,CAAC,SAAkB;IAC3D,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED;;;iBAGiB;AACjB,MAAM,UAAU,yCAAyC,CAAC,SAAkB;IAC1E,OAAO,8BAA8B,CAAC,SAAS,CAAC,CAAC;AACnD,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,SAAkB,EAClB,SAA6E,EAC7E,gBAAqC,uBAAuB,EAC5D,YAAsB;IAEtB,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACrF,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,qCAAqC;IACrC,MAAM,kBAAkB,GACtB,kBAAkB;QAClB,kBAAkB,CAAC,QAAQ,EAAE,uBAAuB,CAAC;QACrD,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,KAAK,MAAM,CAAC;IAC7E,MAAM,eAAe,GAAG,kBAAkB,IAAI,CAAC,kBAAkB,CAAC;IAClE,uEAAuE;IACvE,gEAAgE;IAChE,YAAY;IACZ,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,CAAC,CAAC,qBAAqB,CACnB,+BAA+B,CAAC,SAAS,CAAC,EAC1C,SAAS,CAAC,iBAAiB,CAC5B;QACH,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,OAAO,EAAE,eAAe,IAAI,SAAS,KAAK,SAAS;QACnD,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,SAAS;KACV,CAAC;AACJ,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,SAAiB,EACjB,SAAkB,EAClB,eAAwB,EACxB,UAAkB,EAClB,GAAU,EACV,OAAgB;IAEhB,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACnD,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAE7C,+DAA+D;IAC/D,sEAAsE;IACtE,oEAAoE;IACpE,aAAa;IACb,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,cAAc,GAAG,yBAAyB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACvE,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAClC,uBAAuB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBAC9C,iBAAiB,GAAG,IAAI,CAAC;gBACzB,aAAa,GAAG,MAAM,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,sEAAsE;IACtE,eAAe;IACf,MAAM,YAAY,GAAG,qBAAqB,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEhF,OAAO;QACL,gBAAgB;QAChB,iBAAiB;QACjB,aAAa;QACb,sBAAsB,EAAE,YAAY,CAAC,EAAE;QACvC,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,SAAiB,EACjB,QAAgB,EAChB,SAA6B,EAC7B,MAAoC;IAEpC,MAAM,WAAW,GAAG,SAAS,KAAK,SAAS;QACzC,CAAC,CAAC,eAAe,SAAS,CAAC,MAAM,GAAG;QACpC,CAAC,CAAC,WAAW,CAAC;IAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB;QACvC,CAAC,CAAC,uCAAuC,MAAM,CAAC,aAAa,EAAE;QAC/D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE;QACvC,CAAC,CAAC,8BAA8B,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE;QAC9D,CAAC,CAAC,sCAAsC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;IACxE,OAAO,MAAM,CAAC,gBAAgB;QAC5B,CAAC,CAAC,GAAG,SAAS,yCAAyC,SAAS,UAAU,QAAQ,KAAK,WAAW,IAAI,QAAQ,GAAG,UAAU,EAAE;QAC7H,CAAC,CAAC,GAAG,SAAS,KAAK,QAAQ,YAAY,WAAW,sCAAsC,SAAS,GAAG,QAAQ,GAAG,UAAU,EAAE,CAAC;AAChI,CAAC"}
|