@machina.ai/cell-cli 1.60.0-rc1 → 1.64.0-rc2

package/dist/src/utils/sandboxBuiltinProfiles.js

@@ -60,7 +60,6 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     (subpath (param "INCLUDE_DIR_0"))
@@ -139,6 +138,37 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
 (deny ipc-posix-shm*
     (ipc-posix-name-prefix "docker")
     (ipc-posix-name-prefix "com.docker.")
+)
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\\.json$")
+    (regex #"/gemini-credentials\\.json$")
+    (regex #"/mcp-oauth-tokens\\.json$")
+    (regex #"/a2a-oauth-tokens\\.json$")
+    (regex #"/google_accounts\\.json$")
+    (regex #"/trusted_hooks\\.json$")
+    (regex #"/trustedFolders\\.json$")
+    (regex #"/policy_integrity\\.json$")
+    (regex #"/\\.env($|\\..*)")
+)
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\\.json$")
+    (regex #"/gemini-credentials\\.json$")
+    (regex #"/mcp-oauth-tokens\\.json$")
+    (regex #"/a2a-oauth-tokens\\.json$")
+    (regex #"/google_accounts\\.json$")
+    (regex #"/trusted_hooks\\.json$")
+    (regex #"/trustedFolders\\.json$")
+    (regex #"/policy_integrity\\.json$")
+    (regex #"/\\.env($|\\..*)")
 )`,
     'permissive-proxied': `(version 1)
 (deny default)
@@ -196,7 +226,6 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     (subpath (param "INCLUDE_DIR_0"))
@@ -275,10 +304,45 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
 (deny ipc-posix-shm*
     (ipc-posix-name-prefix "docker")
     (ipc-posix-name-prefix "com.docker.")
+)
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\\.json$")
+    (regex #"/gemini-credentials\\.json$")
+    (regex #"/mcp-oauth-tokens\\.json$")
+    (regex #"/a2a-oauth-tokens\\.json$")
+    (regex #"/google_accounts\\.json$")
+    (regex #"/trusted_hooks\\.json$")
+    (regex #"/trustedFolders\\.json$")
+    (regex #"/policy_integrity\\.json$")
+    (regex #"/\\.env($|\\..*)")
+)
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\\.json$")
+    (regex #"/gemini-credentials\\.json$")
+    (regex #"/mcp-oauth-tokens\\.json$")
+    (regex #"/a2a-oauth-tokens\\.json$")
+    (regex #"/google_accounts\\.json$")
+    (regex #"/trusted_hooks\\.json$")
+    (regex #"/trustedFolders\\.json$")
+    (regex #"/policy_integrity\\.json$")
+    (regex #"/\\.env($|\\..*)")
 )`,
     'restrictive-open': `(version 1)
 (deny default)
 (allow file-read*)
+(allow file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))
+)
 (allow process-exec)
 (allow process-fork)
 (allow signal (target self))
@@ -332,7 +396,6 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     (subpath (param "INCLUDE_DIR_0"))
@@ -388,10 +451,45 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
 (deny ipc-posix-shm*
     (ipc-posix-name-prefix "docker")
     (ipc-posix-name-prefix "com.docker.")
+)
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\\.json$")
+    (regex #"/gemini-credentials\\.json$")
+    (regex #"/mcp-oauth-tokens\\.json$")
+    (regex #"/a2a-oauth-tokens\\.json$")
+    (regex #"/google_accounts\\.json$")
+    (regex #"/trusted_hooks\\.json$")
+    (regex #"/trustedFolders\\.json$")
+    (regex #"/policy_integrity\\.json$")
+    (regex #"/\\.env($|\\..*)")
+)
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\\.json$")
+    (regex #"/gemini-credentials\\.json$")
+    (regex #"/mcp-oauth-tokens\\.json$")
+    (regex #"/a2a-oauth-tokens\\.json$")
+    (regex #"/google_accounts\\.json$")
+    (regex #"/trusted_hooks\\.json$")
+    (regex #"/trustedFolders\\.json$")
+    (regex #"/policy_integrity\\.json$")
+    (regex #"/\\.env($|\\..*)")
 )`,
     'restrictive-proxied': `(version 1)
 (deny default)
 (allow file-read*)
+(allow file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))
+)
 (allow process-exec)
 (allow process-fork)
 (allow signal (target self))
@@ -445,7 +543,6 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     (subpath (param "INCLUDE_DIR_0"))
@@ -501,6 +598,37 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
 (deny ipc-posix-shm*
     (ipc-posix-name-prefix "docker")
     (ipc-posix-name-prefix "com.docker.")
+)
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\\.json$")
+    (regex #"/gemini-credentials\\.json$")
+    (regex #"/mcp-oauth-tokens\\.json$")
+    (regex #"/a2a-oauth-tokens\\.json$")
+    (regex #"/google_accounts\\.json$")
+    (regex #"/trusted_hooks\\.json$")
+    (regex #"/trustedFolders\\.json$")
+    (regex #"/policy_integrity\\.json$")
+    (regex #"/\\.env($|\\..*)")
+)
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\\.json$")
+    (regex #"/gemini-credentials\\.json$")
+    (regex #"/mcp-oauth-tokens\\.json$")
+    (regex #"/a2a-oauth-tokens\\.json$")
+    (regex #"/google_accounts\\.json$")
+    (regex #"/trusted_hooks\\.json$")
+    (regex #"/trustedFolders\\.json$")
+    (regex #"/policy_integrity\\.json$")
+    (regex #"/\\.env($|\\..*)")
 )`,
     'strict-open': `(version 1)
 (deny default)
@@ -509,7 +637,8 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     (literal (string-append (param "HOME_DIR") "/.gitconfig"))
@@ -587,7 +716,6 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     (subpath (param "INCLUDE_DIR_0"))
@@ -643,6 +771,37 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
 (deny ipc-posix-shm*
     (ipc-posix-name-prefix "docker")
     (ipc-posix-name-prefix "com.docker.")
+)
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\\.json$")
+    (regex #"/gemini-credentials\\.json$")
+    (regex #"/mcp-oauth-tokens\\.json$")
+    (regex #"/a2a-oauth-tokens\\.json$")
+    (regex #"/google_accounts\\.json$")
+    (regex #"/trusted_hooks\\.json$")
+    (regex #"/trustedFolders\\.json$")
+    (regex #"/policy_integrity\\.json$")
+    (regex #"/\\.env($|\\..*)")
+)
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\\.json$")
+    (regex #"/gemini-credentials\\.json$")
+    (regex #"/mcp-oauth-tokens\\.json$")
+    (regex #"/a2a-oauth-tokens\\.json$")
+    (regex #"/google_accounts\\.json$")
+    (regex #"/trusted_hooks\\.json$")
+    (regex #"/trustedFolders\\.json$")
+    (regex #"/policy_integrity\\.json$")
+    (regex #"/\\.env($|\\..*)")
 )`,
     'strict-proxied': `(version 1)
 (deny default)
@@ -651,7 +810,8 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     (literal (string-append (param "HOME_DIR") "/.gitconfig"))
@@ -729,7 +889,6 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     (subpath (param "INCLUDE_DIR_0"))
@@ -785,6 +944,37 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
 (deny ipc-posix-shm*
     (ipc-posix-name-prefix "docker")
     (ipc-posix-name-prefix "com.docker.")
+)
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\\.json$")
+    (regex #"/gemini-credentials\\.json$")
+    (regex #"/mcp-oauth-tokens\\.json$")
+    (regex #"/a2a-oauth-tokens\\.json$")
+    (regex #"/google_accounts\\.json$")
+    (regex #"/trusted_hooks\\.json$")
+    (regex #"/trustedFolders\\.json$")
+    (regex #"/policy_integrity\\.json$")
+    (regex #"/\\.env($|\\..*)")
+)
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\\.json$")
+    (regex #"/gemini-credentials\\.json$")
+    (regex #"/mcp-oauth-tokens\\.json$")
+    (regex #"/a2a-oauth-tokens\\.json$")
+    (regex #"/google_accounts\\.json$")
+    (regex #"/trusted_hooks\\.json$")
+    (regex #"/trustedFolders\\.json$")
+    (regex #"/policy_integrity\\.json$")
+    (regex #"/\\.env($|\\..*)")
 )`,
 };
 // Map standard 'closed' profiles to their strict counterparts for backward compatibility and fallback support

package/dist/src/utils/sandboxBuiltinProfiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandboxBuiltinProfiles.js","sourceRoot":"","sources":["../../../src/utils/sandboxBuiltinProfiles.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAA2B;IACvE,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuInB;IAEA,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuItB;IAEA,kBAAkB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgHpB;IAEA,qBAAqB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgHvB;IAEA,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6If;IAEA,gBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6IlB;CACD,CAAC;AAEF,8GAA8G;AAC9G,iCAAiC,CAAC,mBAAmB,CAAC;IACpD,iCAAiC,CAAC,aAAa,CAAC,CAAC;AACnD,iCAAiC,CAAC,oBAAoB,CAAC;IACrD,iCAAiC,CAAC,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"sandboxBuiltinProfiles.js","sourceRoot":"","sources":["../../../src/utils/sandboxBuiltinProfiles.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAA2B;IACvE,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqKnB;IAEA,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqKtB;IAEA,kBAAkB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkJpB;IAEA,qBAAqB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkJvB;IAEA,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4Kf;IAEA,gBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4KlB;CACD,CAAC;AAEF,8GAA8G;AAC9G,iCAAiC,CAAC,mBAAmB,CAAC;IACpD,iCAAiC,CAAC,aAAa,CAAC,CAAC;AACnD,iCAAiC,CAAC,oBAAoB,CAAC;IACrD,iCAAiC,CAAC,gBAAgB,CAAC,CAAC"}

package/dist/src/utils/sandboxUtils.d.ts

@@ -16,6 +16,17 @@ export declare const SENSITIVE_SETTINGS_FILENAMES: Set<string>;
  * that must not be mounted into the untrusted sandbox container.
  */
 export declare function isCredentialOrSensitivePath(targetPath: string, rootDir?: string): boolean;
+/**
+ * Checks if a host path is sensitive and should be prohibited from mounting
+ * into the sandbox container. This protects ~/.cell-cli, user home directories,
+ * and sensitive credential files from being accessed or poisoned.
+ */
+export declare function isSensitiveHostPath(hostPath: string): boolean;
+/**
+ * Sanitizes user settings for the sandbox by stripping unvalidated hooks,
+ * command hooks, API keys, and sensitive tokens.
+ */
+export declare function sanitizeSettingsForSandbox(settings: Record<string, unknown>): Record<string, unknown>;
 /**
  * Creates an isolated settings directory in a temporary location, populated with non-sensitive
  * configuration files from the user settings directory while excluding credential and auth files.

package/dist/src/utils/sandboxUtils.js

@@ -4,11 +4,11 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import os from 'node:os';
-import fs from 'node:fs';
 import path from 'node:path';
+import fs from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { quote } from 'shell-quote';
-import { debugLogger, CELL_DIR } from '@google/gemini-cli-core';
+import { debugLogger, CELL_DIR, homedir, resolveToRealPath, } from '@google/gemini-cli-core';
 export const LOCAL_DEV_SANDBOX_IMAGE_NAME = 'cell-cli-sandbox';
 export const SANDBOX_NETWORK_NAME = 'cell-cli-sandbox';
 export const SANDBOX_PROXY_NAME = 'cell-cli-sandbox-proxy';
@@ -22,6 +22,9 @@ export const BUILTIN_SEATBELT_PROFILES = [
     'strict-open',
     'strict-proxied',
 ];
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
 /**
  * Known sensitive or credential file names that must not be mounted into the sandbox container.
  */
@@ -31,6 +34,10 @@ export const SENSITIVE_SETTINGS_FILENAMES = new Set([
     'gemini-credentials.json',
     'mcp-oauth-tokens.json',
     'a2a-oauth-tokens.json',
+    'trusted_hooks.json',
+    'trustedfolders.json',
+    'trustedFolders.json',
+    'policy_integrity.json',
 ]);
 /**
  * Returns true if the given file or directory path corresponds to credentials or sensitive data
@@ -76,6 +83,147 @@ export function isCredentialOrSensitivePath(targetPath, rootDir) {
     }
     return false;
 }
+/**
+ * Resolves a path to its real path, falling back to path.resolve if it does not exist (ENOENT).
+ * Rethrows unrecoverable errors so callers can fail closed.
+ */
+function safeResolveToRealPath(targetPath) {
+    let current = path.resolve(targetPath);
+    const parts = [];
+    const visited = new Set();
+    while (current && current !== path.dirname(current)) {
+        const visitKey = os.platform() === 'win32' ? current.toLowerCase() : current;
+        if (visited.has(visitKey)) {
+            throw new Error('Circular symlink detected');
+        }
+        visited.add(visitKey);
+        try {
+            const real = resolveToRealPath(current);
+            return path.resolve(real, ...parts.slice().reverse());
+        }
+        catch (err) {
+            if (isRecord(err) && err['code'] === 'ENOENT') {
+                try {
+                    const stat = fs.lstatSync(current);
+                    if (stat?.isSymbolicLink?.()) {
+                        const target = fs.readlinkSync(current);
+                        current = path.resolve(path.dirname(current), target);
+                        continue;
+                    }
+                }
+                catch (lstatErr) {
+                    if (!isRecord(lstatErr) || lstatErr['code'] !== 'ENOENT') {
+                        throw lstatErr;
+                    }
+                }
+                parts.push(path.basename(current));
+                current = path.dirname(current);
+                continue;
+            }
+            throw err;
+        }
+    }
+    return path.resolve(targetPath);
+}
+/**
+ * Checks if a host path is sensitive and should be prohibited from mounting
+ * into the sandbox container. This protects ~/.cell-cli, user home directories,
+ * and sensitive credential files from being accessed or poisoned.
+ */
+export function isSensitiveHostPath(hostPath) {
+    try {
+        const rawHome = homedir();
+        if (!rawHome || rawHome.trim() === '') {
+            // If home directory cannot be determined, do not resolve it to process.cwd().
+            // Only block user-tilde notations and sensitive files.
+            if (hostPath === '~' ||
+                hostPath === '~/' ||
+                hostPath === '~\\' ||
+                hostPath === '~/.cell-cli' ||
+                hostPath.startsWith('~/.cell-cli/') ||
+                hostPath === '~\\.cell-cli' ||
+                hostPath.startsWith('~\\.cell-cli\\')) {
+                return true;
+            }
+            const resolvedPath = safeResolveToRealPath(hostPath);
+            const baseName = path.basename(resolvedPath).toLowerCase();
+            if (baseName === '.env' ||
+                baseName.startsWith('.env.') ||
+                SENSITIVE_SETTINGS_FILENAMES.has(baseName)) {
+                return true;
+            }
+            return false;
+        }
+        const home = safeResolveToRealPath(rawHome);
+        let expandedPath = hostPath;
+        if (hostPath === '~' || hostPath === '~/' || hostPath === '~\\') {
+            expandedPath = home;
+        }
+        else if (hostPath.startsWith('~/') || hostPath.startsWith('~\\')) {
+            expandedPath = path.join(home, hostPath.slice(2));
+        }
+        const normalized = safeResolveToRealPath(expandedPath);
+        const geminiDirCandidate = path.join(home, CELL_DIR);
+        const geminiDirOnHost = safeResolveToRealPath(geminiDirCandidate);
+        const isWindows = os.platform() === 'win32';
+        const arePathsEqual = (p1, p2) => isWindows
+            ? path.resolve(p1).toLowerCase() === path.resolve(p2).toLowerCase()
+            : path.resolve(p1) === path.resolve(p2);
+        const isSubpathOf = (child, parent) => {
+            const resolvedChild = path.resolve(child);
+            const resolvedParent = path.resolve(parent);
+            const parentWithSep = resolvedParent.endsWith(path.sep)
+                ? resolvedParent
+                : resolvedParent + path.sep;
+            return isWindows
+                ? resolvedChild.toLowerCase().startsWith(parentWithSep.toLowerCase())
+                : resolvedChild.startsWith(parentWithSep);
+        };
+        // Block mounting user home directory root directly or any of its parent directories (e.g. /home, /)
+        if (arePathsEqual(normalized, home) || isSubpathOf(home, normalized)) {
+            return true;
+        }
+        // Block mounting ~/.cell-cli, anything inside ~/.cell-cli, or any of its parent directories
+        if (arePathsEqual(normalized, geminiDirOnHost) ||
+            isSubpathOf(normalized, geminiDirOnHost) ||
+            isSubpathOf(geminiDirOnHost, normalized)) {
+            return true;
+        }
+        // Block sensitive secrets, credential stores, and environment files anywhere
+        const baseName = path.basename(normalized).toLowerCase();
+        if (baseName === '.env' ||
+            baseName.startsWith('.env.') ||
+            SENSITIVE_SETTINGS_FILENAMES.has(baseName)) {
+            return true;
+        }
+    }
+    catch {
+        return true; // Fail closed if path resolution fails
+    }
+    return false;
+}
+/**
+ * Sanitizes user settings for the sandbox by stripping unvalidated hooks,
+ * command hooks, API keys, and sensitive tokens.
+ */
+export function sanitizeSettingsForSandbox(settings) {
+    const sanitized = structuredClone(settings);
+    // Remove hooks to prevent configuration poisoning and unvalidated hook execution
+    delete sanitized['hooks'];
+    // Remove command execution hooks in tools if present
+    const tools = sanitized['tools'];
+    if (isRecord(tools)) {
+        const safeTools = { ...tools };
+        delete safeTools['discoveryCommand'];
+        delete safeTools['callCommand'];
+        sanitized['tools'] = safeTools;
+    }
+    // Remove sensitive keys and credentials
+    delete sanitized['apiKey'];
+    delete sanitized['geminiApiKey'];
+    delete sanitized['googleApiKey'];
+    return sanitized;
+}
 /**
  * Creates an isolated settings directory in a temporary location, populated with non-sensitive
  * configuration files from the user settings directory while excluding credential and auth files.

package/dist/src/utils/sandboxUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandboxUtils.js","sourceRoot":"","sources":["../../../src/utils/sandboxUtils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEhE,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,iBAAiB;IACjB,mBAAmB;IACnB,oBAAoB;IACpB,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;IACrB,aAAa;IACb,gBAAgB;CACjB,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAClD,kBAAkB;IAClB,sBAAsB;IACtB,yBAAyB;IACzB,uBAAuB;IACvB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAkB,EAClB,OAAgB;IAEhB,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,OAAO;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,WAAW,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,kBAAkB,GAAG,CAAC,CAAS,EAAE,EAAE;QACvC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3D,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,GAAG,CAAC;QACxE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,IACE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC7B,kBAAkB,CAAC,aAAa,CAAC;QACjC,kBAAkB,CAAC,kBAAkB,CAAC;QACtC,kBAAkB,CAAC,aAAa,CAAC;QACjC,kBAAkB,CAAC,YAAY,CAAC;QAChC,kBAAkB,CAAC,OAAO,CAAC;QAC3B,kBAAkB,CAAC,YAAY,CAAC;QAChC,kBAAkB,CAAC,WAAW,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,kBAAkB,CAAC,UAAU,CAAC,EAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,qBAA6B;IAE7B,MAAM,UAAU,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC;IACzC,MAAM,WAAW,GAAG,EAAE,CAAC,WAAW,CAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAChD,CAAC;IACF,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAEjC,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,qBAAqB,EAAE,WAAW,EAAE;gBAC5C,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CACjB,CAAC,2BAA2B,CAAC,MAAM,EAAE,qBAAqB,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,IAAI,CACd,sDAAsD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACzG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC3D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAExE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+EAA+E;IAC/E,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,iBAAiB,GACrB,gBAAgB,CAAC,KAAK,CACpB,6DAA6D,CAC9D;gBACD,gBAAgB,CAAC,KAAK,CACpB,uDAAuD,CACxD,CAAC;YAEJ,IAAI,iBAAiB,EAAE,CAAC;gBACtB,WAAW,CAAC,GAAG,CACb,0EAA0E,CAC3E,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,6EAA6E;YAC7E,qDAAqD;YACrD,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC;YAC9B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;gBAC9B,WAAW,CAAC,IAAI,CACd,qDAAqD,GAAG,KAAK;oBAC3D,0FAA0F,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,oDAAoD;YACpD,WAAW,CAAC,IAAI,CACd,gGAAgG,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;IAC3D,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,KAAK;IACnB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;SACxC,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,OAAiB;IAC3D,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC;IAC5C,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAE5C,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC1C,IACE,aAAa,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,EACtE,CAAC;gBACD,UAAU,IAAI,IAAI,aAAa,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,SAAS,CAAC,IAAI,CAAC,qBAAqB,UAAU,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,gBAAgB,GAAG,EAAE,CAAC;IAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC1C,IACE,aAAa,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,EACtE,CAAC;gBACD,gBAAgB,IAAI,IAAI,aAAa,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,iCAAiC,gBAAgB,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,oBAAoB,GAAG,GAAG,QAAQ,iBAAiB,CAAC;IAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxC,SAAS,CAAC,IAAI,CAAC,UAAU,gBAAgB,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,SAAS,CAAC,IAAI,CACZ,qBAAqB,CAAC,sDAAsD,CAAC,iBAAiB,CAC/F,CACF,CAAC;IAEF,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,WAAW,GACf,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC;IAClE,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,aAAa;QACvC,CAAC,CAAC,WAAW;YACX,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,iCAAiC;QACrC,CAAC,CAAC,WAAW;YACX,CAAC,CAAC,8BAA8B,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,kBAAkB;YACrF,CAAC,CAAC,QAAQ,CAAC;IAEjB,MAAM,IAAI,GAAG,CAAC,GAAG,SAAS,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC;IACtD,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"sandboxUtils.js","sourceRoot":"","sources":["../../../src/utils/sandboxUtils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EACL,WAAW,EACX,QAAQ,EACR,OAAO,EACP,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,iBAAiB;IACjB,mBAAmB;IACnB,oBAAoB;IACpB,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;IACrB,aAAa;IACb,gBAAgB;CACjB,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAClD,kBAAkB;IAClB,sBAAsB;IACtB,yBAAyB;IACzB,uBAAuB;IACvB,uBAAuB;IACvB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAkB,EAClB,OAAgB;IAEhB,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,OAAO;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,WAAW,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,kBAAkB,GAAG,CAAC,CAAS,EAAE,EAAE;QACvC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3D,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,GAAG,CAAC;QACxE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,IACE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC7B,kBAAkB,CAAC,aAAa,CAAC;QACjC,kBAAkB,CAAC,kBAAkB,CAAC;QACtC,kBAAkB,CAAC,aAAa,CAAC;QACjC,kBAAkB,CAAC,YAAY,CAAC;QAChC,kBAAkB,CAAC,OAAO,CAAC;QAC3B,kBAAkB,CAAC,YAAY,CAAC;QAChC,kBAAkB,CAAC,WAAW,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,kBAAkB,CAAC,UAAU,CAAC,EAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,OAAO,OAAO,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GACZ,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC9C,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;oBACnC,IAAI,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;wBAC7B,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;wBACxC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;wBACtD,SAAS;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,QAAiB,EAAE,CAAC;oBAC3B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;wBACzD,MAAM,QAAQ,CAAC;oBACjB,CAAC;gBACH,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBACnC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtC,8EAA8E;YAC9E,uDAAuD;YACvD,IACE,QAAQ,KAAK,GAAG;gBAChB,QAAQ,KAAK,IAAI;gBACjB,QAAQ,KAAK,KAAK;gBAClB,QAAQ,KAAK,aAAa;gBAC1B,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC;gBACnC,QAAQ,KAAK,cAAc;gBAC3B,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,EACrC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,YAAY,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAErD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3D,IACE,QAAQ,KAAK,MAAM;gBACnB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC5B,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAC1C,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAE5C,IAAI,YAAY,GAAG,QAAQ,CAAC;QAC5B,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YAChE,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAEvD,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,eAAe,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QAElE,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC;QAC5C,MAAM,aAAa,GAAG,CAAC,EAAU,EAAE,EAAU,EAAE,EAAE,CAC/C,SAAS;YACP,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;YACnE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE;YACpD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5C,MAAM,aAAa,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;gBACrD,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;YAC9B,OAAO,SAAS;gBACd,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;gBACrE,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,oGAAoG;QACpG,IAAI,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4FAA4F;QAC5F,IACE,aAAa,CAAC,UAAU,EAAE,eAAe,CAAC;YAC1C,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC;YACxC,WAAW,CAAC,eAAe,EAAE,UAAU,CAAC,EACxC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACzD,IACE,QAAQ,KAAK,MAAM;YACnB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;YAC5B,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAC1C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,uCAAuC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAiC;IAEjC,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAE5C,iFAAiF;IACjF,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAE1B,qDAAqD;IACrD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC,aAAa,CAAC,CAAC;QAChC,SAAS,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;IACjC,CAAC;IAED,wCAAwC;IACxC,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,SAAS,CAAC,cAAc,CAAC,CAAC;IACjC,OAAO,SAAS,CAAC,cAAc,CAAC,CAAC;IAEjC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,qBAA6B;IAE7B,MAAM,UAAU,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC;IACzC,MAAM,WAAW,GAAG,EAAE,CAAC,WAAW,CAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAChD,CAAC;IACF,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAEjC,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,qBAAqB,EAAE,WAAW,EAAE;gBAC5C,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CACjB,CAAC,2BAA2B,CAAC,MAAM,EAAE,qBAAqB,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,IAAI,CACd,sDAAsD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACzG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC3D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAExE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+EAA+E;IAC/E,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,iBAAiB,GACrB,gBAAgB,CAAC,KAAK,CACpB,6DAA6D,CAC9D;gBACD,gBAAgB,CAAC,KAAK,CACpB,uDAAuD,CACxD,CAAC;YAEJ,IAAI,iBAAiB,EAAE,CAAC;gBACtB,WAAW,CAAC,GAAG,CACb,0EAA0E,CAC3E,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,6EAA6E;YAC7E,qDAAqD;YACrD,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC;YAC9B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;gBAC9B,WAAW,CAAC,IAAI,CACd,qDAAqD,GAAG,KAAK;oBAC3D,0FAA0F,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,oDAAoD;YACpD,WAAW,CAAC,IAAI,CACd,gGAAgG,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;IAC3D,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,KAAK;IACnB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;SACxC,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,OAAiB;IAC3D,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC;IAC5C,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAE5C,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC1C,IACE,aAAa,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,EACtE,CAAC;gBACD,UAAU,IAAI,IAAI,aAAa,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,SAAS,CAAC,IAAI,CAAC,qBAAqB,UAAU,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,gBAAgB,GAAG,EAAE,CAAC;IAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC1C,IACE,aAAa,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,EACtE,CAAC;gBACD,gBAAgB,IAAI,IAAI,aAAa,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,iCAAiC,gBAAgB,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,oBAAoB,GAAG,GAAG,QAAQ,iBAAiB,CAAC;IAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxC,SAAS,CAAC,IAAI,CAAC,UAAU,gBAAgB,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,SAAS,CAAC,IAAI,CACZ,qBAAqB,CAAC,sDAAsD,CAAC,iBAAiB,CAC/F,CACF,CAAC;IAEF,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,WAAW,GACf,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC;IAClE,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,aAAa;QACvC,CAAC,CAAC,WAAW;YACX,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,iCAAiC;QACrC,CAAC,CAAC,WAAW;YACX,CAAC,CAAC,8BAA8B,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,kBAAkB;YACrF,CAAC,CAAC,QAAQ,CAAC;IAEjB,MAAM,IAAI,GAAG,CAAC,GAAG,SAAS,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC;IACtD,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACxC,CAAC"}