@machina.ai/cell-cli-core 1.36.0-rc1 → 1.38.1-rc2

package/dist/src/services/sandboxManager.js

@@ -3,8 +3,12 @@
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { isKnownSafeCommand as isMacSafeCommand, isDangerousCommand as isMacDangerousCommand, } from '../sandbox/utils/commandSafety.js';
+import { isKnownSafeCommand as isWindowsSafeCommand, isDangerousCommand as isWindowsDangerousCommand, } from '../sandbox/windows/commandSafety.js';
+import { isNodeError } from '../utils/errors.js';
 import { sanitizeEnvironment, getSecureSanitizationConfig, } from './environmentSanitization.js';
 /**
  * Files that represent the governance or "constitution" of the repository
@@ -15,11 +19,91 @@ export const GOVERNANCE_FILES = [
     { path: '.geminiignore', isDirectory: false },
     { path: '.git', isDirectory: true },
 ];
+/**
+ * Files that contain sensitive secrets or credentials and should be
+ * completely hidden (deny read/write) in any sandbox.
+ */
+export const SECRET_FILES = [
+    { pattern: '.env' },
+    { pattern: '.env.*' },
+];
+/**
+ * Checks if a given file name matches any of the secret file patterns.
+ */
+export function isSecretFile(fileName) {
+    return SECRET_FILES.some((s) => {
+        if (s.pattern.endsWith('*')) {
+            const prefix = s.pattern.slice(0, -1);
+            return fileName.startsWith(prefix);
+        }
+        return fileName === s.pattern;
+    });
+}
+/**
+ * Returns arguments for the Linux 'find' command to locate secret files.
+ */
+export function getSecretFileFindArgs() {
+    const args = ['('];
+    SECRET_FILES.forEach((s, i) => {
+        if (i > 0)
+            args.push('-o');
+        args.push('-name', s.pattern);
+    });
+    args.push(')');
+    return args;
+}
+/**
+ * Finds all secret files in a directory up to a certain depth.
+ * Default is shallow scan (depth 1) for performance.
+ */
+export async function findSecretFiles(baseDir, maxDepth = 1) {
+    const secrets = [];
+    const skipDirs = new Set([
+        'node_modules',
+        '.git',
+        '.venv',
+        '__pycache__',
+        'dist',
+        'build',
+        '.next',
+        '.idea',
+        '.vscode',
+    ]);
+    async function walk(dir, depth) {
+        if (depth > maxDepth)
+            return;
+        try {
+            const entries = await fs.readdir(dir, { withFileTypes: true });
+            for (const entry of entries) {
+                const fullPath = path.join(dir, entry.name);
+                if (entry.isDirectory()) {
+                    if (!skipDirs.has(entry.name)) {
+                        await walk(fullPath, depth + 1);
+                    }
+                }
+                else if (entry.isFile()) {
+                    if (isSecretFile(entry.name)) {
+                        secrets.push(fullPath);
+                    }
+                }
+            }
+        }
+        catch {
+            // Ignore read errors
+        }
+    }
+    await walk(baseDir, 1);
+    return secrets;
+}
 /**
  * A no-op implementation of SandboxManager that silently passes commands
  * through while applying environment sanitization.
  */
 export class NoopSandboxManager {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
     /**
      * Prepares a command by sanitizing the environment and passing through
      * the original program and arguments.
@@ -33,41 +117,120 @@ export class NoopSandboxManager {
             env: sanitizedEnv,
         };
     }
+    isKnownSafeCommand(args) {
+        return os.platform() === 'win32'
+            ? isWindowsSafeCommand(args)
+            : isMacSafeCommand(args);
+    }
+    isDangerousCommand(args) {
+        return os.platform() === 'win32'
+            ? isWindowsDangerousCommand(args)
+            : isMacDangerousCommand(args);
+    }
+    parseDenials() {
+        return undefined;
+    }
+    getWorkspace() {
+        return this.options?.workspace ?? process.cwd();
+    }
+    getOptions() {
+        return this.options;
+    }
 }
 /**
- * SandboxManager that implements actual sandboxing.
+ * A SandboxManager implementation that just runs locally (no sandboxing yet).
  */
 export class LocalSandboxManager {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
     async prepareCommand(_req) {
         throw new Error('Tool sandboxing is not yet implemented.');
     }
+    isKnownSafeCommand(_args) {
+        return false;
+    }
+    isDangerousCommand(_args) {
+        return false;
+    }
+    parseDenials() {
+        return undefined;
+    }
+    getWorkspace() {
+        return this.options?.workspace ?? process.cwd();
+    }
+    getOptions() {
+        return this.options;
+    }
+}
+/**
+ * Resolves sanitized allowed and forbidden paths for a request.
+ * Filters the workspace from allowed paths and ensures forbidden paths take precedence.
+ */
+export async function resolveSandboxPaths(options, req) {
+    const forbidden = sanitizePaths(await options.forbiddenPaths?.());
+    const allowed = sanitizePaths(req.policy?.allowedPaths);
+    const workspaceIdentity = getPathIdentity(options.workspace);
+    const forbiddenIdentities = new Set(forbidden.map(getPathIdentity));
+    const filteredAllowed = allowed.filter((p) => {
+        const identity = getPathIdentity(p);
+        return identity !== workspaceIdentity && !forbiddenIdentities.has(identity);
+    });
+    return {
+        allowed: filteredAllowed,
+        forbidden,
+    };
 }
 /**
  * Sanitizes an array of paths by deduplicating them and ensuring they are absolute.
+ * Always returns an array (empty if input is null/undefined).
  */
 export function sanitizePaths(paths) {
-    if (!paths)
-        return undefined;
-    // We use a Map to deduplicate paths based on their normalized,
-    // platform-specific identity e.g. handling case-insensitivity on Windows)
-    // while preserving the original string casing.
+    if (!paths || paths.length === 0)
+        return [];
     const uniquePathsMap = new Map();
     for (const p of paths) {
         if (!path.isAbsolute(p)) {
             throw new Error(`Sandbox path must be absolute: ${p}`);
         }
-        // Normalize the path (resolves slashes and redundant components)
-        let key = path.normalize(p);
-        // Windows file systems are case-insensitive, so we lowercase the key for
-        // deduplication
-        if (os.platform() === 'win32') {
-            key = key.toLowerCase();
-        }
+        const key = getPathIdentity(p);
         if (!uniquePathsMap.has(key)) {
             uniquePathsMap.set(key, p);
         }
     }
     return Array.from(uniquePathsMap.values());
 }
+/** Returns a normalized identity for a path, stripping trailing slashes and handling case sensitivity. */
+export function getPathIdentity(p) {
+    let norm = path.normalize(p);
+    // Strip trailing slashes (except for root paths)
+    if (norm.length > 1 && (norm.endsWith('/') || norm.endsWith('\\'))) {
+        norm = norm.slice(0, -1);
+    }
+    const platform = os.platform();
+    const isCaseInsensitive = platform === 'win32' || platform === 'darwin';
+    return isCaseInsensitive ? norm.toLowerCase() : norm;
+}
+/**
+ * Resolves symlinks for a given path to prevent sandbox escapes.
+ * If a file does not exist (ENOENT), it recursively resolves the parent directory.
+ * Other errors (e.g. EACCES) are re-thrown.
+ */
+export async function tryRealpath(p) {
+    try {
+        return await fs.realpath(p);
+    }
+    catch (e) {
+        if (isNodeError(e) && e.code === 'ENOENT') {
+            const parentDir = path.dirname(p);
+            if (parentDir === p) {
+                return p;
+            }
+            return path.join(await tryRealpath(parentDir), path.basename(p));
+        }
+        throw e;
+    }
+}
 export { createSandboxManager } from './sandboxManagerFactory.js';
 //# sourceMappingURL=sandboxManager.js.map

package/dist/src/services/sandboxManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandboxManager.js","sourceRoot":"","sources":["../../../src/services/sandboxManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAE5B,MAAM,8BAA8B,CAAC;AAgFtC;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE;IAC1C,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,EAAE;IAC7C,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE;CAC3B,CAAC;AAEX;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,GAAmB;QACtC,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAC/B,CAAC;QAEF,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAEtE,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,YAAY;SAClB,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAmB;IAC9B,KAAK,CAAC,cAAc,CAAC,IAAoB;QACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAgB;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,+DAA+D;IAC/D,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,iEAAiE;QACjE,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAE5B,yEAAyE;QACzE,gBAAgB;QAChB,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;YAC9B,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7C,CAAC;AACD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"sandboxManager.js","sourceRoot":"","sources":["../../../src/services/sandboxManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,kBAAkB,IAAI,gBAAgB,EACtC,kBAAkB,IAAI,qBAAqB,GAC5C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,kBAAkB,IAAI,oBAAoB,EAC1C,kBAAkB,IAAI,yBAAyB,GAChD,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAE5B,MAAM,8BAA8B,CAAC;AAqItC;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE;IAC1C,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,EAAE;IAC7C,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE;CAC3B,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,EAAE,OAAO,EAAE,MAAM,EAAE;IACnB,EAAE,OAAO,EAAE,QAAQ,EAAE;CACb,CAAC;AAEX;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7B,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACtC,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,QAAQ,KAAK,CAAC,CAAC,OAAO,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,IAAI,GAAa,CAAC,GAAG,CAAC,CAAC;IAC7B,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,QAAQ,GAAG,CAAC;IAEZ,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,cAAc;QACd,MAAM;QACN,OAAO;QACP,aAAa;QACb,MAAM;QACN,OAAO;QACP,OAAO;QACP,OAAO;QACP,SAAS;KACV,CAAC,CAAC;IAEH,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,KAAa;QAC5C,IAAI,KAAK,GAAG,QAAQ;YAAE,OAAO;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC9B,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;oBAClC,CAAC;gBACH,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC1B,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC7B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACzB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IACT;IAApB,YAAoB,OAA8B;QAA9B,YAAO,GAAP,OAAO,CAAuB;IAAG,CAAC;IAEtD;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,GAAmB;QACtC,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAC/B,CAAC;QAEF,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAEtE,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,YAAY;SAClB,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,IAAc;QAC/B,OAAO,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;YAC9B,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC;YAC5B,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,kBAAkB,CAAC,IAAc;QAC/B,OAAO,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;YAC9B,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC;YACjC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,YAAY;QACV,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACV;IAApB,YAAoB,OAA8B;QAA9B,YAAO,GAAP,OAAO,CAAuB;IAAG,CAAC;IAEtD,KAAK,CAAC,cAAc,CAAC,IAAoB;QACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,kBAAkB,CAAC,KAAe;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kBAAkB,CAAC,KAAe;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,YAAY;QACV,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA6B,EAC7B,GAAmB;IAKnB,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAExD,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IAEpE,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,QAAQ,KAAK,iBAAiB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,eAAe;QACxB,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAuB;IACnD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE5C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,IAAI,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAE7B,iDAAiD;IACjD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,MAAM,iBAAiB,GAAG,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC;IACxE,OAAO,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,CAAS;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;gBACpB,OAAO,CAAC,CAAC;YACX,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC"}