@machina.ai/cell-cli-core 1.36.0-rc1 → 1.38.1-rc2

package/dist/src/sandbox/windows/WindowsSandboxManager.d.ts

@@ -3,7 +3,8 @@
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-import { type SandboxManager, type SandboxRequest, type SandboxedCommand, type GlobalSandboxOptions } from '../../services/sandboxManager.js';
+import { type SandboxManager, type SandboxRequest, type SandboxedCommand, type GlobalSandboxOptions, type ParsedSandboxDenial } from '../../services/sandboxManager.js';
+import type { ShellExecutionResult } from '../../services/shellExecutionService.js';
 /**
  * A SandboxManager implementation for Windows that uses Restricted Tokens,
  * Job Objects, and Low Integrity levels for process isolation.
@@ -11,10 +12,18 @@ import { type SandboxManager, type SandboxRequest, type SandboxedCommand, type G
  */
 export declare class WindowsSandboxManager implements SandboxManager {
     private readonly options;
+    static readonly HELPER_EXE = "GeminiSandbox.exe";
     private readonly helperPath;
     private initialized;
-    private readonly lowIntegrityCache;
+    private readonly allowedCache;
+    private readonly deniedCache;
+    private readonly denialCache;
     constructor(options: GlobalSandboxOptions);
+    isKnownSafeCommand(args: string[]): boolean;
+    isDangerousCommand(args: string[]): boolean;
+    parseDenials(result: ShellExecutionResult): ParsedSandboxDenial | undefined;
+    getWorkspace(): string;
+    getOptions(): GlobalSandboxOptions;
     /**
      * Ensures a file or directory exists.
      */
@@ -28,4 +37,9 @@ export declare class WindowsSandboxManager implements SandboxManager {
      * Grants "Low Mandatory Level" access to a path using icacls.
      */
     private grantLowIntegrityAccess;
+    /**
+     * Explicitly denies access to a path for Low Integrity processes using icacls.
+     */
+    private denyLowIntegrityAccess;
+    private isSystemDirectory;
 }

package/dist/src/sandbox/windows/WindowsSandboxManager.js

@@ -7,12 +7,20 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { fileURLToPath } from 'node:url';
-import { GOVERNANCE_FILES, sanitizePaths, } from '../../services/sandboxManager.js';
+import { GOVERNANCE_FILES, findSecretFiles, sanitizePaths, resolveSandboxPaths, } from '../../services/sandboxManager.js';
 import { sanitizeEnvironment, getSecureSanitizationConfig, } from '../../services/environmentSanitization.js';
 import { debugLogger } from '../../utils/debugLogger.js';
-import { spawnAsync } from '../../utils/shell-utils.js';
+import { spawnAsync, getCommandName } from '../../utils/shell-utils.js';
+import { isNodeError } from '../../utils/errors.js';
+import { isKnownSafeCommand, isDangerousCommand, isStrictlyApproved, } from './commandSafety.js';
+import { verifySandboxOverrides } from '../utils/commandUtils.js';
+import { parseWindowsSandboxDenials } from './windowsSandboxDenialUtils.js';
+import { isSubpath, resolveToRealPath, assertValidPathString, } from '../../utils/paths.js';
+import { createSandboxDenialCache, } from '../utils/sandboxDenialUtils.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
+// S-1-16-4096 is the SID for "Low Mandatory Level" (Low Integrity)
+const LOW_INTEGRITY_SID = '*S-1-16-4096';
 /**
  * A SandboxManager implementation for Windows that uses Restricted Tokens,
  * Job Objects, and Low Integrity levels for process isolation.
@@ -20,17 +28,41 @@ const __dirname = path.dirname(__filename);
  */
 export class WindowsSandboxManager {
     options;
+    static HELPER_EXE = 'GeminiSandbox.exe';
     helperPath;
     initialized = false;
-    lowIntegrityCache = new Set();
+    allowedCache = new Set();
+    deniedCache = new Set();
+    denialCache = createSandboxDenialCache();
     constructor(options) {
         this.options = options;
-        this.helperPath = path.resolve(__dirname, 'GeminiSandbox.exe');
+        this.helperPath = path.resolve(__dirname, WindowsSandboxManager.HELPER_EXE);
+    }
+    isKnownSafeCommand(args) {
+        const toolName = args[0]?.toLowerCase();
+        const approvedTools = this.options.modeConfig?.approvedTools ?? [];
+        if (toolName && approvedTools.some((t) => t.toLowerCase() === toolName)) {
+            return true;
+        }
+        return isKnownSafeCommand(args);
+    }
+    isDangerousCommand(args) {
+        return isDangerousCommand(args);
+    }
+    parseDenials(result) {
+        return parseWindowsSandboxDenials(result, this.denialCache);
+    }
+    getWorkspace() {
+        return this.options.workspace;
+    }
+    getOptions() {
+        return this.options;
     }
     /**
      * Ensures a file or directory exists.
      */
     touch(filePath, isDirectory) {
+        assertValidPathString(filePath);
         try {
             // If it exists (even as a broken symlink), do nothing
             if (fs.lstatSync(filePath))
@@ -111,49 +143,172 @@ export class WindowsSandboxManager {
         await this.ensureInitialized();
         const sanitizationConfig = getSecureSanitizationConfig(req.policy?.sanitizationConfig);
         const sanitizedEnv = sanitizeEnvironment(req.env, sanitizationConfig);
-        // 1. Handle filesystem permissions for Low Integrity
-        // Grant "Low Mandatory Level" write access to the workspace.
-        await this.grantLowIntegrityAccess(this.options.workspace);
-        // Grant "Low Mandatory Level" read access to allowedPaths.
-        const allowedPaths = sanitizePaths(req.policy?.allowedPaths) || [];
+        const isReadonlyMode = this.options.modeConfig?.readonly ?? true;
+        const allowOverrides = this.options.modeConfig?.allowOverrides ?? true;
+        // Reject override attempts in plan mode
+        verifySandboxOverrides(allowOverrides, req.policy);
+        const command = req.command;
+        const args = req.args;
+        // Native commands __read and __write are passed directly to GeminiSandbox.exe
+        const isYolo = this.options.modeConfig?.yolo ?? false;
+        // Fetch persistent approvals for this command
+        const commandName = await getCommandName(command, args);
+        const persistentPermissions = allowOverrides
+            ? this.options.policyManager?.getCommandPermissions(commandName)
+            : undefined;
+        // Merge all permissions
+        const mergedAdditional = {
+            fileSystem: {
+                read: [
+                    ...(persistentPermissions?.fileSystem?.read ?? []),
+                    ...(req.policy?.additionalPermissions?.fileSystem?.read ?? []),
+                ],
+                write: [
+                    ...(persistentPermissions?.fileSystem?.write ?? []),
+                    ...(req.policy?.additionalPermissions?.fileSystem?.write ?? []),
+                ],
+            },
+            network: isYolo ||
+                persistentPermissions?.network ||
+                req.policy?.additionalPermissions?.network ||
+                false,
+        };
+        if (req.command === '__read' && req.args[0]) {
+            mergedAdditional.fileSystem.read.push(req.args[0]);
+        }
+        else if (req.command === '__write' && req.args[0]) {
+            mergedAdditional.fileSystem.write.push(req.args[0]);
+        }
+        const defaultNetwork = this.options.modeConfig?.network ?? req.policy?.networkAccess ?? false;
+        const networkAccess = defaultNetwork || mergedAdditional.network;
+        const { allowed: allowedPaths, forbidden: forbiddenPaths } = await resolveSandboxPaths(this.options, req);
+        // Track all roots where Low Integrity write access has been granted.
+        // New files created within these roots will inherit the Low label.
+        const writableRoots = [];
+        // 1. Workspace access
+        const isApproved = allowOverrides
+            ? await isStrictlyApproved(command, args, this.options.modeConfig?.approvedTools)
+            : false;
+        if (!isReadonlyMode || isApproved) {
+            await this.grantLowIntegrityAccess(this.options.workspace);
+            writableRoots.push(this.options.workspace);
+        }
+        // 2. Globally included directories
+        const includeDirs = sanitizePaths(this.options.includeDirectories);
+        for (const includeDir of includeDirs) {
+            await this.grantLowIntegrityAccess(includeDir);
+            writableRoots.push(includeDir);
+        }
+        // 3. Explicitly allowed paths from the request policy
         for (const allowedPath of allowedPaths) {
-            await this.grantLowIntegrityAccess(allowedPath);
+            const resolved = resolveToRealPath(allowedPath);
+            try {
+                await fs.promises.access(resolved, fs.constants.F_OK);
+            }
+            catch {
+                throw new Error(`Sandbox request rejected: Allowed path does not exist: ${resolved}. ` +
+                    'On Windows, granular sandbox access can only be granted to existing paths to avoid broad parent directory permissions.');
+            }
+            await this.grantLowIntegrityAccess(resolved);
+            writableRoots.push(resolved);
         }
-        // TODO: handle forbidden paths
-        // 2. Protected governance files
+        // 4. Additional write paths (e.g. from internal __write command)
+        const additionalWritePaths = sanitizePaths(mergedAdditional.fileSystem?.write);
+        for (const writePath of additionalWritePaths) {
+            const resolved = resolveToRealPath(writePath);
+            try {
+                await fs.promises.access(resolved, fs.constants.F_OK);
+                await this.grantLowIntegrityAccess(resolved);
+                continue;
+            }
+            catch {
+                // If the file doesn't exist, it's only allowed if it resides within a granted root.
+                const isInherited = writableRoots.some((root) => isSubpath(root, resolved));
+                if (!isInherited) {
+                    throw new Error(`Sandbox request rejected: Additional write path does not exist and its parent directory is not allowed: ${resolved}. ` +
+                        'On Windows, granular sandbox access can only be granted to existing paths to avoid broad parent directory permissions.');
+                }
+            }
+        }
+        // 2. Collect secret files and apply protective ACLs
+        // On Windows, we explicitly deny access to secret files for Low Integrity
+        // processes to ensure they cannot be read or written.
+        const secretsToBlock = [];
+        const searchDirs = new Set([
+            this.options.workspace,
+            ...allowedPaths,
+            ...includeDirs,
+        ]);
+        for (const dir of searchDirs) {
+            try {
+                // We use maxDepth 3 to catch common nested secrets while keeping performance high.
+                const secretFiles = await findSecretFiles(dir, 3);
+                for (const secretFile of secretFiles) {
+                    try {
+                        secretsToBlock.push(secretFile);
+                        await this.denyLowIntegrityAccess(secretFile);
+                    }
+                    catch (e) {
+                        debugLogger.log(`WindowsSandboxManager: Failed to secure secret file ${secretFile}`, e);
+                    }
+                }
+            }
+            catch (e) {
+                debugLogger.log(`WindowsSandboxManager: Failed to find secret files in ${dir}`, e);
+            }
+        }
+        // Denies access to forbiddenPaths for Low Integrity processes.
+        // Note: Denying access to arbitrary paths (like system files) via icacls
+        // is restricted to avoid host corruption. External commands rely on
+        // Low Integrity read/write restrictions, while internal commands
+        // use the manifest for enforcement.
+        for (const forbiddenPath of forbiddenPaths) {
+            try {
+                await this.denyLowIntegrityAccess(forbiddenPath);
+            }
+            catch (e) {
+                debugLogger.log(`WindowsSandboxManager: Failed to secure forbidden path ${forbiddenPath}`, e);
+            }
+        }
+        // 3. Protected governance files
         // These must exist on the host before running the sandbox to prevent
         // the sandboxed process from creating them with Low integrity.
         // By being created as Medium integrity, they are write-protected from Low processes.
         for (const file of GOVERNANCE_FILES) {
             const filePath = path.join(this.options.workspace, file.path);
             this.touch(filePath, file.isDirectory);
-            // We resolve real paths to ensure protection for both the symlink and its target.
-            try {
-                const realPath = fs.realpathSync(filePath);
-                if (realPath !== filePath) {
-                    // If it's a symlink, the target is already implicitly protected
-                    // if it's outside the Low integrity workspace (likely Medium).
-                    // If it's inside, we ensure it's not accidentally Low.
-                }
-            }
-            catch {
-                // Ignore realpath errors
-            }
         }
-        // 3. Construct the helper command
-        // GeminiSandbox.exe <network:0|1> <cwd> <command> [args...]
+        // 4. Forbidden paths manifest
+        // We use a manifest file to avoid command-line length limits.
+        const allForbidden = Array.from(new Set([...secretsToBlock, ...forbiddenPaths]));
+        const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gemini-cli-forbidden-'));
+        const manifestPath = path.join(tempDir, 'manifest.txt');
+        fs.writeFileSync(manifestPath, allForbidden.join('\n'));
+        // 5. Construct the helper command
+        // GeminiSandbox.exe <network:0|1> <cwd> --forbidden-manifest <path> <command> [args...]
         const program = this.helperPath;
-        // If the command starts with __, it's an internal command for the sandbox helper itself.
-        const args = [
-            req.policy?.networkAccess ? '1' : '0',
+        const finalArgs = [
+            networkAccess ? '1' : '0',
             req.cwd,
-            req.command,
-            ...req.args,
+            '--forbidden-manifest',
+            manifestPath,
+            command,
+            ...args,
         ];
+        const finalEnv = { ...sanitizedEnv };
         return {
             program,
-            args,
-            env: sanitizedEnv,
+            args: finalArgs,
+            env: finalEnv,
+            cwd: req.cwd,
+            cleanup: () => {
+                try {
+                    fs.rmSync(tempDir, { recursive: true, force: true });
+                }
+                catch {
+                    // Ignore errors
+                }
+            },
         };
     }
     /**
@@ -163,26 +318,88 @@ export class WindowsSandboxManager {
         if (os.platform() !== 'win32') {
             return;
         }
-        const resolvedPath = path.resolve(targetPath);
-        if (this.lowIntegrityCache.has(resolvedPath)) {
+        const resolvedPath = resolveToRealPath(targetPath);
+        if (this.allowedCache.has(resolvedPath)) {
             return;
         }
-        // Never modify integrity levels for system directories
-        const systemRoot = process.env['SystemRoot'] || 'C:\\Windows';
-        const programFiles = process.env['ProgramFiles'] || 'C:\\Program Files';
-        const programFilesX86 = process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)';
-        if (resolvedPath.toLowerCase().startsWith(systemRoot.toLowerCase()) ||
-            resolvedPath.toLowerCase().startsWith(programFiles.toLowerCase()) ||
-            resolvedPath.toLowerCase().startsWith(programFilesX86.toLowerCase())) {
+        // Explicitly reject UNC paths to prevent credential theft/SSRF,
+        // but allow local extended-length and device paths.
+        if (resolvedPath.startsWith('\\\\') &&
+            !resolvedPath.startsWith('\\\\?\\') &&
+            !resolvedPath.startsWith('\\\\.\\')) {
+            debugLogger.log('WindowsSandboxManager: Rejecting UNC path for Low Integrity grant:', resolvedPath);
+            return;
+        }
+        if (this.isSystemDirectory(resolvedPath)) {
             return;
         }
         try {
-            await spawnAsync('icacls', [resolvedPath, '/setintegritylevel', 'Low']);
-            this.lowIntegrityCache.add(resolvedPath);
+            // 1. Grant explicit Modify access to the Low Integrity SID
+            // 2. Set the Mandatory Label to Low to allow "Write Up" from Low processes
+            await spawnAsync('icacls', [
+                resolvedPath,
+                '/grant',
+                `${LOW_INTEGRITY_SID}:(OI)(CI)(M)`,
+                '/setintegritylevel',
+                '(OI)(CI)Low',
+            ]);
+            this.allowedCache.add(resolvedPath);
         }
         catch (e) {
             debugLogger.log('WindowsSandboxManager: icacls failed for', resolvedPath, e);
         }
     }
+    /**
+     * Explicitly denies access to a path for Low Integrity processes using icacls.
+     */
+    async denyLowIntegrityAccess(targetPath) {
+        if (os.platform() !== 'win32') {
+            return;
+        }
+        const resolvedPath = resolveToRealPath(targetPath);
+        if (this.deniedCache.has(resolvedPath)) {
+            return;
+        }
+        // Never modify ACEs for system directories
+        if (this.isSystemDirectory(resolvedPath)) {
+            return;
+        }
+        // icacls flags: (OI) Object Inherit, (CI) Container Inherit, (F) Full Access Deny.
+        // Omit /T (recursive) for performance; (OI)(CI) ensures inheritance for new items.
+        // Windows dynamically evaluates existing items, though deep explicit Allow ACEs
+        // could potentially bypass this inherited Deny rule.
+        const DENY_ALL_INHERIT = '(OI)(CI)(F)';
+        // icacls fails on non-existent paths, so we cannot explicitly deny
+        // paths that do not yet exist (unlike macOS/Linux).
+        // Skip to prevent sandbox initialization failure.
+        try {
+            await fs.promises.stat(resolvedPath);
+        }
+        catch (e) {
+            if (isNodeError(e) && e.code === 'ENOENT') {
+                return;
+            }
+            throw e;
+        }
+        try {
+            await spawnAsync('icacls', [
+                resolvedPath,
+                '/deny',
+                `${LOW_INTEGRITY_SID}:${DENY_ALL_INHERIT}`,
+            ]);
+            this.deniedCache.add(resolvedPath);
+        }
+        catch (e) {
+            throw new Error(`Failed to deny access to forbidden path: ${resolvedPath}. ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    isSystemDirectory(resolvedPath) {
+        const systemRoot = process.env['SystemRoot'] || 'C:\\Windows';
+        const programFiles = process.env['ProgramFiles'] || 'C:\\Program Files';
+        const programFilesX86 = process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)';
+        return (resolvedPath.toLowerCase().startsWith(systemRoot.toLowerCase()) ||
+            resolvedPath.toLowerCase().startsWith(programFiles.toLowerCase()) ||
+            resolvedPath.toLowerCase().startsWith(programFilesX86.toLowerCase()));
+    }
 }
 //# sourceMappingURL=WindowsSandboxManager.js.map

package/dist/src/sandbox/windows/WindowsSandboxManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"WindowsSandboxManager.js","sourceRoot":"","sources":["../../../../src/sandbox/windows/WindowsSandboxManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAIL,gBAAgB,EAEhB,aAAa,GACd,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAE3C;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IAKH;IAJZ,UAAU,CAAS;IAC5B,WAAW,GAAG,KAAK,CAAC;IACX,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEvD,YAA6B,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;QACxD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,QAAgB,EAAE,WAAoB;QAClD,IAAI,CAAC;YACH,sDAAsD;YACtD,IAAI,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAAE,OAAO;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;YACD,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAC7B,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,WAAW,CAAC,GAAG,CACb,8CAA8C,IAAI,CAAC,UAAU,4BAA4B,CAC1F,CAAC;gBACF,mEAAmE;gBACnE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC5D,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC;oBAC9D,MAAM,QAAQ,GAAG;wBACf,SAAS,EAAE,oBAAoB;wBAC/B,IAAI,CAAC,IAAI,CACP,UAAU,EACV,eAAe,EACf,aAAa,EACb,YAAY,EACZ,SAAS,CACV;wBACD,IAAI,CAAC,IAAI,CACP,UAAU,EACV,eAAe,EACf,WAAW,EACX,YAAY,EACZ,SAAS,CACV;wBACD,8BAA8B;wBAC9B,IAAI,CAAC,IAAI,CACP,UAAU,EACV,eAAe,EACf,aAAa,EACb,MAAM,EACN,SAAS,CACV;wBACD,IAAI,CAAC,IAAI,CACP,UAAU,EACV,eAAe,EACf,WAAW,EACX,MAAM,EACN,SAAS,CACV;wBACD,IAAI,CAAC,IAAI,CACP,UAAU,EACV,eAAe,EACf,aAAa,EACb,MAAM,EACN,SAAS,CACV;qBACF,CAAC;oBAEF,IAAI,QAAQ,GAAG,KAAK,CAAC;oBACrB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;wBAC3B,IAAI,CAAC;4BACH,WAAW,CAAC,GAAG,CACb,kDAAkD,GAAG,KAAK,CAC3D,CAAC;4BACF,wDAAwD;4BACxD,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;4BAC/D,WAAW,CAAC,GAAG,CACb,kEAAkE,IAAI,CAAC,UAAU,EAAE,CACpF,CAAC;4BACF,QAAQ,GAAG,IAAI,CAAC;4BAChB,MAAM;wBACR,CAAC;wBAAC,OAAO,CAAC,EAAE,CAAC;4BACX,WAAW,CAAC,GAAG,CACb,kDAAkD,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACvG,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAED,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,WAAW,CAAC,GAAG,CACb,kFAAkF,CACnF,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,GAAG,CACb,mDAAmD,UAAU,0BAA0B,CACxF,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,GAAG,CACb,0CAA0C,IAAI,CAAC,UAAU,EAAE,CAC5D,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,WAAW,CAAC,GAAG,CACb,6DAA6D,EAC7D,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,GAAmB;QACtC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAC/B,CAAC;QAEF,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAEtE,qDAAqD;QACrD,6DAA6D;QAC7D,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE3D,2DAA2D;QAC3D,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC;QACnE,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAClD,CAAC;QAED,+BAA+B;QAE/B,gCAAgC;QAChC,qEAAqE;QACrE,+DAA+D;QAC/D,qFAAqF;QACrF,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAEvC,kFAAkF;YAClF,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAC3C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC1B,gEAAgE;oBAChE,+DAA+D;oBAC/D,uDAAuD;gBACzD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,4DAA4D;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC;QAEhC,yFAAyF;QACzF,MAAM,IAAI,GAAG;YACX,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YACrC,GAAG,CAAC,GAAG;YACP,GAAG,CAAC,OAAO;YACX,GAAG,GAAG,CAAC,IAAI;SACZ,CAAC;QAEF,OAAO;YACL,OAAO;YACP,IAAI;YACJ,GAAG,EAAE,YAAY;SAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,uBAAuB,CAAC,UAAkB;QACtD,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC;QAC9D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,mBAAmB,CAAC;QACxE,MAAM,eAAe,GACnB,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,yBAAyB,CAAC;QAEhE,IACE,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YAC/D,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;YACjE,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,EACpE,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,WAAW,CAAC,GAAG,CACb,0CAA0C,EAC1C,YAAY,EACZ,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"WindowsSandboxManager.js","sourceRoot":"","sources":["../../../../src/sandbox/windows/WindowsSandboxManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAIL,gBAAgB,EAChB,eAAe,EAEf,aAAa,EAGb,mBAAmB,GACpB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AAExC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAE3C,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IAQH;IAP7B,MAAM,CAAU,UAAU,GAAG,mBAAmB,CAAC;IAChC,UAAU,CAAS;IAC5B,WAAW,GAAG,KAAK,CAAC;IACX,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,WAAW,GAAuB,wBAAwB,EAAE,CAAC;IAE9E,YAA6B,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;QACxD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC9E,CAAC;IAED,kBAAkB,CAAC,IAAc;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACxC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,IAAI,EAAE,CAAC;QACnE,IAAI,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,kBAAkB,CAAC,IAAc;QAC/B,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,YAAY,CAAC,MAA4B;QACvC,OAAO,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;IAChC,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,QAAgB,EAAE,WAAoB;QAClD,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,sDAAsD;YACtD,IAAI,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAAE,OAAO;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;YACD,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAC7B,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,WAAW,CAAC,GAAG,CACb,8CAA8C,IAAI,CAAC,UAAU,4BAA4B,CAC1F,CAAC;gBACF,mEAAmE;gBACnE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC5D,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC;oBAC9D,MAAM,QAAQ,GAAG;wBACf,SAAS,EAAE,oBAAoB;wBAC/B,IAAI,CAAC,IAAI,CACP,UAAU,EACV,eAAe,EACf,aAAa,EACb,YAAY,EACZ,SAAS,CACV;wBACD,IAAI,CAAC,IAAI,CACP,UAAU,EACV,eAAe,EACf,WAAW,EACX,YAAY,EACZ,SAAS,CACV;wBACD,8BAA8B;wBAC9B,IAAI,CAAC,IAAI,CACP,UAAU,EACV,eAAe,EACf,aAAa,EACb,MAAM,EACN,SAAS,CACV;wBACD,IAAI,CAAC,IAAI,CACP,UAAU,EACV,eAAe,EACf,WAAW,EACX,MAAM,EACN,SAAS,CACV;wBACD,IAAI,CAAC,IAAI,CACP,UAAU,EACV,eAAe,EACf,aAAa,EACb,MAAM,EACN,SAAS,CACV;qBACF,CAAC;oBAEF,IAAI,QAAQ,GAAG,KAAK,CAAC;oBACrB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;wBAC3B,IAAI,CAAC;4BACH,WAAW,CAAC,GAAG,CACb,kDAAkD,GAAG,KAAK,CAC3D,CAAC;4BACF,wDAAwD;4BACxD,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;4BAC/D,WAAW,CAAC,GAAG,CACb,kEAAkE,IAAI,CAAC,UAAU,EAAE,CACpF,CAAC;4BACF,QAAQ,GAAG,IAAI,CAAC;4BAChB,MAAM;wBACR,CAAC;wBAAC,OAAO,CAAC,EAAE,CAAC;4BACX,WAAW,CAAC,GAAG,CACb,kDAAkD,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACvG,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAED,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,WAAW,CAAC,GAAG,CACb,kFAAkF,CACnF,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,GAAG,CACb,mDAAmD,UAAU,0BAA0B,CACxF,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,GAAG,CACb,0CAA0C,IAAI,CAAC,UAAU,EAAE,CAC5D,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,WAAW,CAAC,GAAG,CACb,6DAA6D,EAC7D,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,GAAmB;QACtC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAC/B,CAAC;QAEF,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAEtE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,IAAI,IAAI,CAAC;QACjE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,IAAI,IAAI,CAAC;QAEvE,wCAAwC;QACxC,sBAAsB,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAEnD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAEtB,8EAA8E;QAE9E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,IAAI,KAAK,CAAC;QAEtD,8CAA8C;QAC9C,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,qBAAqB,GAAG,cAAc;YAC1C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,qBAAqB,CAAC,WAAW,CAAC;YAChE,CAAC,CAAC,SAAS,CAAC;QAEd,wBAAwB;QACxB,MAAM,gBAAgB,GAAuB;YAC3C,UAAU,EAAE;gBACV,IAAI,EAAE;oBACJ,GAAG,CAAC,qBAAqB,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC;oBAClD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC;iBAC/D;gBACD,KAAK,EAAE;oBACL,GAAG,CAAC,qBAAqB,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC;oBACnD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAqB,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC;iBAChE;aACF;YACD,OAAO,EACL,MAAM;gBACN,qBAAqB,EAAE,OAAO;gBAC9B,GAAG,CAAC,MAAM,EAAE,qBAAqB,EAAE,OAAO;gBAC1C,KAAK;SACR,CAAC;QAEF,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,gBAAgB,CAAC,UAAW,CAAC,IAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,gBAAgB,CAAC,UAAW,CAAC,KAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,cAAc,GAClB,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,KAAK,CAAC;QACzE,MAAM,aAAa,GAAG,cAAc,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAEjE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,GACxD,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAE/C,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,sBAAsB;QACtB,MAAM,UAAU,GAAG,cAAc;YAC/B,CAAC,CAAC,MAAM,kBAAkB,CACtB,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CACvC;YACH,CAAC,CAAC,KAAK,CAAC;QAEV,IAAI,CAAC,cAAc,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC3D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAED,mCAAmC;QACnC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACnE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;YAC/C,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAED,sDAAsD;QACtD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,0DAA0D,QAAQ,IAAI;oBACpE,wHAAwH,CAC3H,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;YAC7C,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,iEAAiE;QACjE,MAAM,oBAAoB,GAAG,aAAa,CACxC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CACnC,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YAAC,MAAM,CAAC;gBACP,oFAAoF;gBACpF,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9C,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAC1B,CAAC;gBAEF,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACb,2GAA2G,QAAQ,IAAI;wBACrH,wHAAwH,CAC3H,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,0EAA0E;QAC1E,sDAAsD;QACtD,MAAM,cAAc,GAAa,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,SAAS;YACtB,GAAG,YAAY;YACf,GAAG,WAAW;SACf,CAAC,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,mFAAmF;gBACnF,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAClD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;oBACrC,IAAI,CAAC;wBACH,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;wBAChC,MAAM,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;oBAChD,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,WAAW,CAAC,GAAG,CACb,uDAAuD,UAAU,EAAE,EACnE,CAAC,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,WAAW,CAAC,GAAG,CACb,yDAAyD,GAAG,EAAE,EAC9D,CAAC,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,yEAAyE;QACzE,oEAAoE;QACpE,iEAAiE;QACjE,oCAAoC;QACpC,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,WAAW,CAAC,GAAG,CACb,0DAA0D,aAAa,EAAE,EACzE,CAAC,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,qEAAqE;QACrE,+DAA+D;QAC/D,qFAAqF;QACrF,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,CAAC;QAED,8BAA8B;QAC9B,8DAA8D;QAC9D,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAC7B,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,cAAc,CAAC,CAAC,CAChD,CAAC;QACF,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAC5B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAChD,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACxD,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAExD,kCAAkC;QAClC,wFAAwF;QACxF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC;QAEhC,MAAM,SAAS,GAAG;YAChB,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YACzB,GAAG,CAAC,GAAG;YACP,sBAAsB;YACtB,YAAY;YACZ,OAAO;YACP,GAAG,IAAI;SACR,CAAC;QAEF,MAAM,QAAQ,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;QAErC,OAAO;YACL,OAAO;YACP,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,OAAO,EAAE,GAAG,EAAE;gBACZ,IAAI,CAAC;oBACH,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,CAAC;gBAAC,MAAM,CAAC;oBACP,gBAAgB;gBAClB,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,uBAAuB,CAAC,UAAkB;QACtD,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACxC,OAAO;QACT,CAAC;QAED,gEAAgE;QAChE,oDAAoD;QACpD,IACE,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC;YAC/B,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC;YACnC,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EACnC,CAAC;YACD,WAAW,CAAC,GAAG,CACb,oEAAoE,EACpE,YAAY,CACb,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,2DAA2D;YAC3D,2EAA2E;YAC3E,MAAM,UAAU,CAAC,QAAQ,EAAE;gBACzB,YAAY;gBACZ,QAAQ;gBACR,GAAG,iBAAiB,cAAc;gBAClC,oBAAoB;gBACpB,aAAa;aACd,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,WAAW,CAAC,GAAG,CACb,0CAA0C,EAC1C,YAAY,EACZ,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAAC,UAAkB;QACrD,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACvC,OAAO;QACT,CAAC;QAED,2CAA2C;QAC3C,IAAI,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QAED,mFAAmF;QACnF,mFAAmF;QACnF,gFAAgF;QAChF,qDAAqD;QACrD,MAAM,gBAAgB,GAAG,aAAa,CAAC;QAEvC,mEAAmE;QACnE,oDAAoD;QACpD,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,QAAQ,EAAE;gBACzB,YAAY;gBACZ,OAAO;gBACP,GAAG,iBAAiB,IAAI,gBAAgB,EAAE;aAC3C,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,4CAA4C,YAAY,KACtD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC3C,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,YAAoB;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC;QAC9D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,mBAAmB,CAAC;QACxE,MAAM,eAAe,GACnB,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,yBAAyB,CAAC;QAEhE,OAAO,CACL,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YAC/D,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;YACjE,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CACrE,CAAC;IACJ,CAAC"}