@namzu/cli 35.0.0 → 36.0.0

package/dist/schedule/policy.js

@@ -1,414 +0,0 @@
-/**
- * What a scheduled run may do, compiled to the kernel's rules.
- *
- * Order is the meaning (first match wins), and it is:
- *
- * 1. the kernel's dangerous-command floor (`gateFor` puts it first; it DENIES,
- *    it never parks — an operator cannot approve `rm -rf /` later);
- * 2. the scheduled-run floor (`floor.ts`, one `predicate` rule): no command
- *    that stops, disables or removes the scheduler service, no `schedule`
- *    subcommand but a read-only one, and nothing that resolves into
- *    `NAMZU_HOME` (a run cannot rewrite its own job, its history, the
- *    daemon's endpoint token or the credentials beside them). A command line
- *    is decided on the words bash will pass, as the SDK's lexer reads them;
- * 3. every `deny` any config file wrote — user, project, managed — each file
- *    read on its own, so a project's allow cannot hide a user's deny;
- * 4. the job's own rules. ALLOWS COME ONLY FROM HERE: no config file can widen
- *    a job the operator confirmed;
- * 5. `unmatched`, as the review mode: `park` → `prompt` with every batch held
- *    for the operator, `deny` → `strict`, `allow` → `auto` (a path outside the
- *    roots and a sandbox escape still hold).
- *
- * The scheduled-run floor reads a command line the way bash does (see
- * `floor.ts`), but it reads a line, not the programs it starts: a script that
- * builds the command from its own data is beyond it. The controls that do not
- * depend on reading are elsewhere: a job folder may not contain `NAMZU_HOME`,
- * and a job file edited behind the CLI's back is held until someone confirms
- * it.
- */
-import { homedir } from 'node:os';
-import { BROWSER_ACT_TOOL_NAME, BROWSER_TOOL_NAME, } from '@namzu/sdk';
-import { isBrowserProfileName } from '../browser/control.js';
-import { canonicalBrowserSiteKey, compileBrowserSites, } from '../permissions/browser-sites.js';
-import { compilePermissions, isPermissionEffect, } from '../permissions/rules.js';
-import { READ_ONLY_VERBS, isFloorRule, scheduledRunFloorRule } from './floor.js';
-const NETWORK_TOOLS = ['web_fetch', 'web_search'];
-/** The browser tools: reached only through a job's browser grant, never through its rules. */
-const BROWSER_TOOLS = [BROWSER_TOOL_NAME, BROWSER_ACT_TOOL_NAME];
-const GRANT_LEVELS = ['read', 'ask', 'act'];
-const WRITE_TOOLS = ['write', 'edit', 'bash'];
-const READ_ONLY = {
-    read: 'allow',
-    glob: 'allow',
-    grep: 'allow',
-    ls: 'allow',
-    write: 'deny',
-    edit: 'deny',
-    bash: 'deny',
-    web_fetch: 'deny',
-    web_search: 'deny',
-};
-/**
- * The presets, expanded at creation and stored verbatim, so a later change to
- * what a preset means never changes an existing job. Neither reaches the
- * network: web access is opt-in, rule by rule.
- */
-export const PRESETS = {
-    'read-only': { rules: READ_ONLY, unmatched: 'deny' },
-    'edit-in-folder': {
-        rules: { ...READ_ONLY, write: 'allow', edit: 'allow', bash: 'ask' },
-        unmatched: 'park',
-    },
-};
-export function isPresetName(value) {
-    return value === 'read-only' || value === 'edit-in-folder';
-}
-/**
- * A browser grant as a job stores it: a profile name, at least one site,
- * each key canonical and none of them `*`, each level `read`, `ask` or
- * `act`. `ask` parks the call for the operator, so it needs
- * `unmatched: park`: under `deny` every ask would be refused and under
- * `allow` approved without anyone seeing it.
- */
-export function checkBrowserGrant(input, unmatched) {
-    if (!isBrowserProfileName(input.profile)) {
-        throw new Error(`"${input.profile}" is not a browser profile name: lowercase letters, digits and single hyphens.`);
-    }
-    const entries = Object.entries(input.sites);
-    if (entries.length === 0) {
-        throw new Error('A browser grant needs at least one site, e.g. --browser-site https://github.com=read.');
-    }
-    const sites = {};
-    for (const [raw, level] of entries) {
-        if (raw.trim() === '*') {
-            throw new Error('A scheduled job cannot grant every site ("*"); every site it does not list is denied. List each site.');
-        }
-        if (!GRANT_LEVELS.includes(level)) {
-            throw new Error(`browser site ${raw}: "${level}" is not read, ask or act.`);
-        }
-        const key = canonicalBrowserSiteKey(raw);
-        if (!key.ok)
-            throw new Error(`browser site ${raw}: ${key.reason}`);
-        const existing = sites[key.key];
-        if (existing !== undefined && existing !== level) {
-            throw new Error(`browser site ${key.key} is listed twice, as ${existing} and ${level}.`);
-        }
-        sites[key.key] = level;
-    }
-    if (unmatched !== 'park' && Object.values(sites).includes('ask')) {
-        throw new Error(`A browser site at "ask" waits for you, which needs unmatched: park; with ${unmatched} it would be ${unmatched === 'deny' ? 'refused every time' : 'approved without asking'}. Use read or act, or --unmatched park.`);
-    }
-    return {
-        profile: input.profile,
-        sites,
-        ...(input.headed ? { headed: true } : {}),
-    };
-}
-/**
- * A preset and/or explicit rules, into the set a job stores. Explicit rules
- * override the preset's per tool. `unmatched` must come from somewhere — the
- * preset or the caller — and `execution` defaults to `host` (the CLI's
- * boundary) but is always written.
- */
-export function expandPermissions(input) {
-    if (!input.preset && !input.rules && !input.browser) {
-        throw new Error('A permission set needs a preset (read-only, edit-in-folder), rules or a browser grant; there is no default.');
-    }
-    const named = BROWSER_TOOLS.filter((tool) => input.rules?.[tool] !== undefined);
-    if (named.length > 0) {
-        throw new Error(`The rules name ${named.join(' and ')}; a scheduled job reaches the browser only through a browser grant (--browser <profile> --browser-site <site>=read|ask|act).`);
-    }
-    const preset = input.preset ? PRESETS[input.preset] : undefined;
-    const unmatched = input.unmatched ?? preset?.unmatched;
-    if (!unmatched) {
-        throw new Error('unmatched is required: park (wait for the operator), deny, or allow.');
-    }
-    const rules = { ...(preset?.rules ?? {}), ...(input.rules ?? {}) };
-    const compiled = compilePermissions(rules);
-    if (compiled.diagnostics.length > 0) {
-        throw new Error(`The permission rules do not compile: ${compiled.diagnostics.map(describeDiagnostic).join('; ')}`);
-    }
-    const browser = input.browser ? checkBrowserGrant(input.browser, unmatched) : undefined;
-    return {
-        unmatched,
-        execution: input.execution ?? 'host',
-        rules,
-        ...(input.additionalDirectories && input.additionalDirectories.length > 0
-            ? { additionalDirectories: [...input.additionalDirectories] }
-            : {}),
-        preset: input.preset && !input.rules ? input.preset : 'custom',
-        ...(browser ? { browser } : {}),
-    };
-}
-function describeDiagnostic(d) {
-    return `${d.pattern ? `${d.tool}."${d.pattern}"` : d.tool}: ${d.message}`;
-}
-function effectsOf(permission) {
-    if (permission === undefined)
-        return [];
-    if (isPermissionEffect(permission))
-        return [permission];
-    return Object.values(permission).filter(isPermissionEffect);
-}
-/** Whether the set lets a run reach the network: a web tool not denied, or a browser grant. */
-export function allowsNetwork(set) {
-    return (set.browser !== undefined ||
-        NETWORK_TOOLS.some((t) => effectsOf(set.rules[t]).some((e) => e !== 'deny')));
-}
-/**
- * Whether a run under this set can run a shell command: a `bash` rule that is
- * not `deny`, or, with no `bash` rule, an `unmatched` that is not `deny`.
- */
-export function allowsCommands(set) {
-    const effects = effectsOf(set.rules.bash);
-    return effects.length > 0 ? effects.some((e) => e !== 'deny') : set.unmatched !== 'deny';
-}
-/** Whether a run under this set can change the folder (write, edit, bash, or an unmatched call). */
-export function allowsWrites(set) {
-    if (set.unmatched !== 'deny')
-        return true;
-    return WRITE_TOOLS.some((t) => effectsOf(set.rules[t]).some((e) => e !== 'deny'));
-}
-/** Only the `deny` entries of one config file's table. */
-export function denialsOf(table) {
-    const out = {};
-    for (const [tool, permission] of Object.entries(table)) {
-        if (permission === 'deny')
-            out[tool] = 'deny';
-        else if (permission && typeof permission === 'object') {
-            const denied = Object.fromEntries(Object.entries(permission).filter(([, effect]) => effect === 'deny'));
-            if (Object.keys(denied).length > 0)
-                out[tool] = denied;
-        }
-    }
-    return out;
-}
-/**
- * Rules that keep a scheduled run away from its own scheduler and its own
- * records: one `predicate` rule, decided on the SDK's reading of each command
- * line (see `floor.ts`). `folders` is where the run's relative paths start.
- */
-export function scheduledRunFloor(namzuHome, userHome = homedir(), folders = []) {
-    return [scheduledRunFloorRule({ namzuHome, userHome, folders })];
-}
-function modeFor(unmatched) {
-    return unmatched === 'park' ? 'prompt' : unmatched === 'deny' ? 'strict' : 'auto';
-}
-function lineFor(tool, permission) {
-    if (isPermissionEffect(permission))
-        return [`${tool}: ${permission}`];
-    return Object.entries(permission).map(([pattern, effect]) => `${tool} "${pattern}": ${effect}`);
-}
-/** Compile a job's permission set against every config file's denies. */
-export function compileJobPolicy(set, options) {
-    const diagnostics = [];
-    const configDenies = [];
-    const denyLines = [];
-    for (const layer of options.layers) {
-        const denied = denialsOf(layer.permissions);
-        const compiled = compilePermissions(denied);
-        configDenies.push(...compiled.rules);
-        for (const d of compiled.diagnostics)
-            diagnostics.push(`${layer.path}: ${describeDiagnostic(d)}`);
-        for (const [tool, permission] of Object.entries(denied))
-            for (const line of lineFor(tool, permission))
-                denyLines.push(`${line} (from ${layer.path})`);
-    }
-    const own = compilePermissions(set.rules);
-    for (const d of own.diagnostics)
-        diagnostics.push(`job: ${describeDiagnostic(d)}`);
-    const siteDenies = options.layers.flatMap((layer) => (layer.browserDenies ?? []).map((site) => ({ site, path: layer.path })));
-    const browser = set.browser ? compileBrowserGrant(set.browser, siteDenies) : undefined;
-    if (browser)
-        diagnostics.push(...browser.diagnostics.map((d) => `job: ${d}`));
-    // Web tools are denied by name unless the job itself lets them run: the
-    // gate's read-only default would otherwise approve a fetch. The browser
-    // tools always end up here: without a grant nothing else decides them,
-    // and with one this catches every call its site rules did not.
-    const networkDenied = [
-        ...NETWORK_TOOLS.filter((t) => set.rules[t] === undefined),
-        ...BROWSER_TOOLS,
-    ];
-    const rules = [
-        ...scheduledRunFloor(options.namzuHome, homedir(), options.folder ? [options.folder.path, options.folder.canonical] : []),
-        ...configDenies,
-        ...own.rules,
-        ...(browser?.rules ?? []),
-        { type: 'deny_by_name', toolNames: [...networkDenied] },
-    ];
-    const lines = [
-        'dangerous commands (rm -rf /, mkfs, curl | sh, sudo …): deny, always',
-        `the scheduler's commands (but ${READ_ONLY_VERBS.join(', ')}), and anything naming NAMZU_HOME or the browser's profiles: deny`,
-        ...denyLines,
-        ...Object.entries(set.rules).flatMap(([tool, permission]) => lineFor(tool, permission)),
-        ...(set.browser ? browserGrantLines(set.browser, siteDenies) : []),
-        `anything else: ${set.unmatched === 'park' ? 'wait for the operator' : set.unmatched === 'deny' ? 'deny' : 'run without asking'}`,
-    ];
-    return {
-        rules,
-        diagnostics,
-        mode: modeFor(set.unmatched),
-        network: allowsNetwork(set),
-        writes: allowsWrites(set),
-        lines,
-    };
-}
-/**
- * The policy a `script`/`script+agent` job's SCRIPT BODY is checked
- * against — never {@link compileJobPolicy}'s full set, which also carries
- * `allow`/`ask` rules and `unmatched` that exist to referee a model
- * improvising calls one at a time. A script has no such referee: it is
- * fixed text an operator read and confirmed. Requiring an `allow` rule for
- * it to pass duplicates that confirmation with a second, laxer one (a
- * blanket `bash: allow` was the shape this forced), and because a
- * `script+agent` job has only one permission set, that same blanket rule
- * then governed the model's OWN bash calls in the agent phase too. Dropping
- * `allow`/`ask`/`unmatched` from the script's own check removes the reason
- * to ever write one: only `deny` rules (the operator's, or any config
- * file's) and the floor can still refuse a confirmed script.
- *
- * The job's `unmatched`/`rules` (with `allow`/`ask` included) still govern
- * the AGENT phase exactly as {@link compileJobPolicy} always has — this
- * function changes nothing about that path.
- */
-export function compileScriptCheckPolicy(set, options) {
-    const diagnostics = [];
-    const configDenies = [];
-    for (const layer of options.layers) {
-        const compiled = compilePermissions(denialsOf(layer.permissions));
-        configDenies.push(...compiled.rules);
-        for (const d of compiled.diagnostics)
-            diagnostics.push(`${layer.path}: ${describeDiagnostic(d)}`);
-    }
-    const ownDenies = compilePermissions(denialsOf(set.rules));
-    for (const d of ownDenies.diagnostics)
-        diagnostics.push(`job: ${describeDiagnostic(d)}`);
-    return {
-        floorRules: scheduledRunFloor(options.namzuHome, homedir(), options.folder ? [options.folder.path, options.folder.canonical] : []),
-        denyRules: [...configDenies, ...ownDenies.rules],
-        diagnostics,
-    };
-}
-const GRANT_WORDS = {
-    read: 'open and read, never change',
-    ask: 'open and read; each change waits for you',
-    act: 'open, read and change without asking',
-};
-/**
- * A job's browser grant as gate rules: the sites it lists at their level,
- * any site a config file denies denied (a grant cannot reopen it), every
- * other site denied, looking at the held page allowed, and `back`,
- * `forward` and `reload` allowed (the host still checks where they land).
- * What none of these decides falls to the trailing deny.
- */
-export function compileBrowserGrant(grant, denies = []) {
-    const sites = {
-        ...grant.sites,
-        '*': 'deny',
-    };
-    for (const { site } of denies)
-        sites[site] = 'deny';
-    const compiled = compileBrowserSites(sites);
-    return {
-        rules: [
-            ...compiled.rules,
-            {
-                type: 'argument_pattern',
-                toolNames: [BROWSER_TOOL_NAME],
-                argument: 'action',
-                pattern: '^(?:back|forward|reload)$',
-                decision: 'allow',
-            },
-        ],
-        diagnostics: compiled.diagnostics,
-    };
-}
-/** The grant in words, one line each, for a confirmation and `schedule show`. */
-export function browserGrantLines(grant, denies = []) {
-    const denied = new Map(denies.map((d) => [d.site, d.path]));
-    return [
-        `browser: profile ${grant.profile}, ${grant.headed ? 'in a visible window' : 'no window'}`,
-        ...Object.entries(grant.sites).map(([site, level]) => denied.has(site)
-            ? `browser ${site}: deny (from ${denied.get(site)})`
-            : `browser ${site}: ${GRANT_WORDS[level]}`),
-        'browser any other site: deny',
-        'browser sign-in, CAPTCHA or a code: the run stops and tells you',
-    ];
-}
-/**
- * Tools refused only by `unmatched: deny`: a write or a delegation that no
- * exemption lets through when nothing allows it. The agent tools go
- * together: without `Agent` the rest have nothing to act on.
- */
-const STRICT_UNREACHABLE = [
-    'Agent',
-    'send_message',
-    'cancel_agent',
-    'wait_for_task',
-    'agent_task_list',
-    'agent_models',
-    'save_memory',
-    'update_memory',
-    'delete_memory',
-];
-/** The background-job tools, which manage what `bash` started. */
-const JOB_TOOLS = ['job', 'wait_for_job'];
-/**
- * Whether `rule` could let `tool` through (allow it or send it to review).
- * Unknown shapes answer yes: withholding a tool the run could have used is the
- * mistake this must not make.
- */
-function mayReach(rule, tool) {
-    switch (rule.type) {
-        case 'deny_by_name':
-        case 'deny_dangerous_patterns':
-            return false;
-        case 'allow_by_name':
-            return rule.toolNames.includes(tool);
-        case 'argument_pattern':
-            return rule.decision !== 'deny' && rule.toolNames.includes(tool);
-        case 'custom_pattern': {
-            if (rule.decision === 'deny')
-                return false;
-            const named = /^\^([A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/.exec(rule.pattern);
-            return named ? named[1] === tool : true;
-        }
-        case 'predicate':
-            return !isFloorRule(rule);
-        default:
-            return true;
-    }
-}
-/**
- * Tools a scheduled run under this policy can never use, so their schemas
- * need not be sent with every model call. In a browser job's run, `bash`,
- * `edit`, `write`, the web tools and the agent and memory tools were about
- * half of each request, sent six times a run and refused every time they
- * could have been called.
- *
- * A tool is withheld when a `deny_by_name` names it and no rule before it
- * could let it through; under `unmatched: deny`, also the delegation and
- * memory-writing tools no rule names; and the background-job tools once
- * `bash` is withheld.
- */
-export function withheldTools(set, policy) {
-    const out = new Set();
-    policy.rules.forEach((rule, index) => {
-        if (rule.type !== 'deny_by_name')
-            return;
-        const earlier = policy.rules.slice(0, index);
-        for (const tool of rule.toolNames)
-            if (!earlier.some((r) => mayReach(r, tool)))
-                out.add(tool);
-    });
-    if (set.unmatched === 'deny') {
-        for (const tool of STRICT_UNREACHABLE)
-            if (!policy.rules.some((r) => mayReach(r, tool)))
-                out.add(tool);
-    }
-    if (out.has('bash'))
-        for (const tool of JOB_TOOLS)
-            out.add(tool);
-    return [...out].sort();
-}
-//# sourceMappingURL=policy.js.map

package/dist/schedule/policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/schedule/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAEN,qBAAqB,EACrB,iBAAiB,GAGjB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAE5D,OAAO,EAEN,uBAAuB,EACvB,mBAAmB,GACnB,MAAM,iCAAiC,CAAA;AAExC,OAAO,EAKN,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAKhF,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,YAAY,CAAU,CAAA;AAC1D,8FAA8F;AAC9F,MAAM,aAAa,GAAG,CAAC,iBAAiB,EAAE,qBAAqB,CAAU,CAAA;AACzE,MAAM,YAAY,GAAwC,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;AAChF,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAU,CAAA;AAEtD,MAAM,SAAS,GAAsB;IACpC,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,MAAM;IACb,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,MAAM;IACjB,UAAU,EAAE,MAAM;CAClB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAEhB;IACH,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE;IACpD,gBAAgB,EAAE;QACjB,KAAK,EAAE,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE;QACnE,SAAS,EAAE,MAAM;KACjB;CACD,CAAA;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,gBAAgB,CAAA;AAC3D,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAChC,KAA8C,EAC9C,SAA6C;IAE7C,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACd,IAAI,KAAK,CAAC,OAAO,gFAAgF,CACjG,CAAA;IACF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACd,uFAAuF,CACvF,CAAA;IACF,CAAC;IACD,MAAM,KAAK,GAA6C,EAAE,CAAA;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACd,uGAAuG,CACvG,CAAA;QACF,CAAC;QACD,IAAI,CAAE,YAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,MAAM,KAAK,4BAA4B,CAAC,CAAA;QAC5E,CAAC;QACD,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,GAAG,wBAAwB,QAAQ,QAAQ,KAAK,GAAG,CAAC,CAAA;QACzF,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAiC,CAAA;IACnD,CAAC;IACD,IAAI,SAAS,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACd,4EAA4E,SAAS,gBAAgB,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,yCAAyC,CACrN,CAAA;IACF,CAAC;IACD,OAAO;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK;QACL,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAA;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACvD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACd,6GAA6G,CAC7G,CAAA;IACF,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAA;IAC/E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACd,kBAAkB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,8HAA8H,CACnK,CAAA;IACF,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,EAAE,SAAS,CAAA;IACtD,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;IACxF,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAA;IAClE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC1C,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACd,wCAAwC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjG,CAAA;IACF,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACvF,OAAO;QACN,SAAS;QACT,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,MAAM;QACpC,KAAK;QACL,GAAG,CAAC,KAAK,CAAC,qBAAqB,IAAI,KAAK,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC;YACxE,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,GAAG,KAAK,CAAC,qBAAqB,CAAC,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;QACN,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAC9D,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/B,CAAA;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAoB;IAC/C,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAA;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,UAAsC;IACxD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACvC,IAAI,kBAAkB,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAC5D,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAAC,GAA0B;IACvD,OAAO,CACN,GAAG,CAAC,OAAO,KAAK,SAAS;QACzB,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAC5E,CAAA;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAA0B;IACxD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM,CAAA;AACzF,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,YAAY,CAAC,GAA0B;IACtD,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IACzC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAA;AAClF,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,SAAS,CAAC,KAAwB;IACjD,MAAM,GAAG,GAAmC,EAAE,CAAA;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,IAAI,UAAU,KAAK,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAA;aACxC,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,CAChC,CAAA;YACrC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAA;QACvD,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAChC,SAAiB,EACjB,WAAmB,OAAO,EAAE,EAC5B,UAA6B,EAAE;IAE/B,OAAO,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;AACjE,CAAC;AAaD,SAAS,OAAO,CAAC,SAA6C;IAC7D,OAAO,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;AAClF,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,UAA0B;IACxD,IAAI,kBAAkB,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,GAAG,IAAI,KAAK,UAAU,EAAE,CAAC,CAAA;IACrE,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,MAAM,MAAM,EAAE,CAAC,CAAA;AAChG,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAC/B,GAA0B,EAC1B,OAKC;IAED,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,MAAM,YAAY,GAAwB,EAAE,CAAA;IAC5C,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;QAC3C,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,WAAW;YACnC,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACtD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,KAAK,CAAC,IAAI,GAAG,CAAC,CAAA;IAC9F,CAAC;IACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACzC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW;QAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAClF,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACnD,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CACvE,CAAA;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACtF,IAAI,OAAO;QAAE,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7E,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,aAAa,GAAG;QACrB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;QAC1D,GAAG,aAAa;KAChB,CAAA;IACD,MAAM,KAAK,GAAwB;QAClC,GAAG,iBAAiB,CACnB,OAAO,CAAC,SAAS,EACjB,OAAO,EAAE,EACT,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACrE;QACD,GAAG,YAAY;QACf,GAAG,GAAG,CAAC,KAAK;QACZ,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;QACzB,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,GAAG,aAAa,CAAC,EAAE;KACvD,CAAA;IACD,MAAM,KAAK,GAAG;QACb,sEAAsE;QACtE,iCAAiC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,mEAAmE;QAC9H,GAAG,SAAS;QACZ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACvF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,kBAAkB,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,EAAE;KACjI,CAAA;IACD,OAAO;QACN,KAAK;QACL,WAAW;QACX,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAC5B,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC;QAC3B,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC;QACzB,KAAK;KACL,CAAA;AACF,CAAC;AAiBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CACvC,GAA0B,EAC1B,OAIC;IAED,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,MAAM,YAAY,GAAwB,EAAE,CAAA;IAC5C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;QACjE,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,WAAW;YACnC,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;IAC1D,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,WAAW;QAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACxF,OAAO;QACN,UAAU,EAAE,iBAAiB,CAC5B,OAAO,CAAC,SAAS,EACjB,OAAO,EAAE,EACT,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACrE;QACD,SAAS,EAAE,CAAC,GAAG,YAAY,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;QAChD,WAAW;KACX,CAAA;AACF,CAAC;AAED,MAAM,WAAW,GAA6C;IAC7D,IAAI,EAAE,6BAA6B;IACnC,GAAG,EAAE,0CAA0C;IAC/C,GAAG,EAAE,sCAAsC;CAC3C,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAA2B,EAC3B,SAA+C,EAAE;IAKjD,MAAM,KAAK,GAAqC;QAC/C,GAAG,KAAK,CAAC,KAAK;QACd,GAAG,EAAE,MAAM;KACX,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAA;IACnD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAC3C,OAAO;QACN,KAAK,EAAE;YACN,GAAG,QAAQ,CAAC,KAAK;YACjB;gBACC,IAAI,EAAE,kBAAkB;gBACxB,SAAS,EAAE,CAAC,iBAAiB,CAAC;gBAC9B,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,2BAA2B;gBACpC,QAAQ,EAAE,OAAO;aACjB;SACD;QACD,WAAW,EAAE,QAAQ,CAAC,WAAW;KACjC,CAAA;AACF,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAChC,KAA2B,EAC3B,SAAsE,EAAE;IAExE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3D,OAAO;QACN,oBAAoB,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,WAAW,EAAE;QAC1F,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CACpD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YACf,CAAC,CAAC,WAAW,IAAI,gBAAgB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG;YACpD,CAAC,CAAC,WAAW,IAAI,KAAK,WAAW,CAAC,KAAK,CAAC,EAAE,CAC3C;QACD,8BAA8B;QAC9B,iEAAiE;KACjE,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,kBAAkB,GAAG;IAC1B,OAAO;IACP,cAAc;IACd,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,cAAc;IACd,aAAa;IACb,eAAe;IACf,eAAe;CACN,CAAA;AACV,kEAAkE;AAClE,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,cAAc,CAAU,CAAA;AAElD;;;;GAIG;AACH,SAAS,QAAQ,CAAC,IAAuB,EAAE,IAAY;IACtD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,cAAc,CAAC;QACpB,KAAK,yBAAyB;YAC7B,OAAO,KAAK,CAAA;QACb,KAAK,eAAe;YACnB,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACrC,KAAK,kBAAkB;YACtB,OAAO,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACjE,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACvB,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAA;YAC1C,MAAM,KAAK,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACvE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QACxC,CAAC;QACD,KAAK,WAAW;YACf,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAC1B;YACC,OAAO,IAAI,CAAA;IACb,CAAC;AACF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC5B,GAA0B,EAC1B,MAAwC;IAExC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACpC,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;YAAE,OAAM;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC5C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;IACF,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,kBAAkB;YACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,KAAK,MAAM,IAAI,IAAI,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AACvB,CAAC"}

package/dist/schedule/resume-command.js

@@ -1,72 +0,0 @@
-/**
- * The command that opens a scheduled run's conversation, for every place that
- * tells the operator how to answer a park.
- *
- * Conversations are stored per folder, so `namzu resume <id>` finds a run's
- * conversation only from the job's folder; anywhere else it says "not found".
- * The command therefore always carries the folder, and the job's extra roots,
- * which a session answering the park must have. Every path is quoted for a
- * POSIX shell.
- */
-import { realpathSync } from 'node:fs';
-import { resolve } from 'node:path';
-import { sanitizeLine } from '../integrations/notifications/desktop/sanitize.js';
-import { schedulePaths } from './paths.js';
-import { foldHistory, readHistory } from './store/history.js';
-import { listJobs } from './store/jobs.js';
-import { readState } from './store/state.js';
-/** A word as a POSIX shell reads it back: bare when safe, else single-quoted. */
-export function shellQuote(value) {
-    return /^[A-Za-z0-9._/@+-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
-}
-/** `cd <folder> && namzu [--add-dir <dir>]… resume <session-id>`. */
-export function resumeCommand(job, sessionId) {
-    const addDirs = (job.permissions.additionalDirectories ?? [])
-        .map((dir) => ` --add-dir ${shellQuote(dir)}`)
-        .join('');
-    return `cd ${shellQuote(job.folder.canonical)} && namzu${addDirs} resume ${shellQuote(sessionId)}`;
-}
-function canonical(path) {
-    try {
-        return realpathSync(path);
-    }
-    catch {
-        return resolve(path);
-    }
-}
-/**
- * The scheduled job whose run owns `sessionId`, when that conversation lives
- * in another folder than `cwd`: what `namzu resume <id>` says instead of a
- * bare "not found". Reads the job store only; never throws.
- */
-export function scheduledSessionElsewhere(home, sessionId, cwd) {
-    try {
-        const paths = schedulePaths(home);
-        const here = canonical(cwd);
-        for (const job of listJobs(paths).jobs) {
-            if (job.folder.canonical === here)
-                continue;
-            const state = readState(paths, job.id);
-            const owns = state.activeRun?.sessionId === sessionId ||
-                state.lastRun?.sessionId === sessionId ||
-                foldHistory(readHistory(paths, job.id)).some((record) => record.kind === 'run' && record.sessionId === sessionId);
-            if (owns)
-                return { job, command: resumeCommand(job, sessionId) };
-        }
-    }
-    catch {
-        // A job store that cannot be read says nothing; the ordinary refusal stands.
-    }
-    return undefined;
-}
-/**
- * What a parked run waits for, in words: `needs you: <reason>` when a tool
- * asked for a person (a sign-in, a CAPTCHA), which no approval answers, and
- * `waiting for your approval` for a held batch. The reason is the tool's own
- * text, recorded by the daemon; it is flattened to one line here.
- */
-export function parkedRunWords(run) {
-    const reason = run.handoff ? sanitizeLine(run.handoff.reason, 200) : '';
-    return reason ? `needs you: ${reason}` : 'waiting for your approval';
-}
-//# sourceMappingURL=resume-command.js.map

package/dist/schedule/resume-command.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resume-command.js","sourceRoot":"","sources":["../../src/schedule/resume-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAG5C,iFAAiF;AACjF,MAAM,UAAU,UAAU,CAAC,KAAa;IACvC,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAA;AACxF,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAC5B,GAAgD,EAChD,SAAiB;IAEjB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,qBAAqB,IAAI,EAAE,CAAC;SAC3D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;SAC7C,IAAI,CAAC,EAAE,CAAC,CAAA;IACV,OAAO,MAAM,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,OAAO,WAAW,UAAU,CAAC,SAAS,CAAC,EAAE,CAAA;AACnG,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC9B,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACxC,IAAY,EACZ,SAAiB,EACjB,GAAW;IAEX,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC3B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI;gBAAE,SAAQ;YAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YACtC,MAAM,IAAI,GACT,KAAK,CAAC,SAAS,EAAE,SAAS,KAAK,SAAS;gBACxC,KAAK,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS;gBACtC,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CACnE,CAAA;YACF,IAAI,IAAI;gBAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAA;QACjE,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,6EAA6E;IAC9E,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAuD;IACrF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvE,OAAO,MAAM,CAAC,CAAC,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC,CAAC,2BAA2B,CAAA;AACrE,CAAC"}

package/dist/schedule/script-check.js

@@ -1,146 +0,0 @@
-/**
- * The static check every `script`/`script+agent` job's script body — and,
- * for `script+agent`, its wake-gate script — passes before it is ever
- * confirmed to run unattended.
- *
- * A pure `script` job has no model in the loop, ever: nothing reviews a call
- * it makes the way a live agent's tool calls are reviewed one at a time. The
- * design here gives the script body the review a live call's `allow`/`ask`
- * rules and `unmatched` can never usefully give it (there is no person and
- * no per-turn review mode to resolve an undecided call FOR a script), and
- * instead treats the operator's own confirmation of the exact text — bound
- * to it by the job's security digest — as the allowance:
- *
- * - the scheduled-run floor (and, on the whole script, the kernel's
- *   dangerous-command patterns) still refuse anything they always would;
- * - every config file's `deny` rules, and the job's OWN rules narrowed to
- *   their `deny` entries, are checked against EACH lexed command of the
- *   script in turn, so a refusal names the exact command and the rule that
- *   denied it (`compileScriptCheckPolicy`, `policy.ts`);
- * - `allow`/`ask` rules and `unmatched` are never consulted for the script.
- *   Revision (design.md §6, 2026-09-24, after review): the first version of
- *   this design evaluated the WHOLE script against the job's FULL permission
- *   set, so a script needed an `allow` rule (in practice a blanket `bash:
- *   allow`, since a script rarely matches one exact pattern) to pass at
- *   all — and because a `script+agent` job has only one permission set, that
- *   same blanket rule then gave the model UNRESTRICTED bash in the agent
- *   phase too. Dropping `allow`/`ask`/`unmatched` from the script's own
- *   check removes the reason to ever write one for this purpose; the job's
- *   `rules`/`unmatched` (allow included) still govern the agent phase
- *   exactly as before, unchanged.
- *
- * Failing closed: a script the lexer cannot fully account for (a command
- * substitution, a construct it does not model, a syntax error) is refused
- * outright, naming the lexer's own reason. There is no textual-tripwire
- * fallback here the way there is for an opaque ARGUMENT inside an otherwise
- * read line — a whole script that cannot be verified does not get to run
- * unattended, full stop.
- */
-import { AuthorizationGate, NOOP_LOGGER, lexShellCommandLine, resolveScriptPrograms, } from '@namzu/sdk';
-import { sanitizeLine } from '../integrations/notifications/desktop/sanitize.js';
-const MAX_SHOWN = 240;
-/**
- * Text as a refusal quotes it: sanitized (this can be the job's own
- * confirmed script text, but a fresh re-verification at `__fire` runs this
- * over CURRENT config files, and `fire.ts`'s `blocked-config` reason reaches
- * `schedule show`/`history` and a desktop notification), one line, cut to
- * fit, in backticks.
- */
-function shown(text, max = MAX_SHOWN) {
-    const cut = sanitizeLine(text, max);
-    return cut.includes('`') ? `\`\` ${cut} \`\`` : `\`${cut}\``;
-}
-/** A one-rule-set-only gate: only ever answers `deny` or the default "nothing matched". */
-function denyOnlyGate(rules, denyDangerousPatterns) {
-    return new AuthorizationGate({
-        enabled: true,
-        allowReadOnlyTools: false,
-        denyDangerousPatterns,
-        logDecisions: false,
-        rules: [...rules],
-    }, NOOP_LOGGER);
-}
-/**
- * Verify one script body against the policy a script gets
- * (`compileScriptCheckPolicy`): the lexer can fully account for it, the
- * whole text clears the scheduled-run floor and the kernel's dangerous-
- * command patterns, and no single lexed command in it is denied by a
- * config file or by the job's own `deny` rules.
- */
-export function verifyScheduledScript(body, shell, policy) {
-    const reading = lexShellCommandLine(body, { dialect: shell });
-    if (reading.opaque) {
-        return {
-            ok: false,
-            reason: `the script cannot be verified line-for-line (${reading.reasons[0] ?? 'a construct the lexer does not model'}); a script that cannot be read is refused rather than run unattended`,
-        };
-    }
-    // A command whose own name is decided at runtime (`$(echo rm) -rf x`,
-    // `env $(echo git) push`, `timeout 5 $(echo systemctl) stop …`) is not
-    // opaque — the lexer read it fine — but no deny rule can be trusted to
-    // have matched it: a pattern written against the command's real name
-    // never sees a name that does not appear as such anywhere in the
-    // script's text, and it never sees one hidden behind a re-exec wrapper's
-    // own name either. `resolveScriptPrograms` is the SDK's one answer to
-    // "where does this script actually exec a program" — it unwraps
-    // `sudo`/`env`/`nice`/`timeout`/… with their real option grammars,
-    // reads `find -exec`'s own clauses, and threads `PATH`/`LD_PRELOAD`/…
-    // poisoning from an earlier command through to later ones, so the same
-    // answer the live `bash` tool's escalation and the scheduled-run floor
-    // use is the one a script is checked against too. A script confirmed
-    // once and never reviewed live cannot lean on the operator noticing at
-    // run time the way a live call's own review can; this is the same
-    // posture as opaque, and for the same reason — refused rather than
-    // guessed at.
-    for (const { command, positions } of resolveScriptPrograms(reading.commands, shell)) {
-        for (const position of positions) {
-            if (position.unknown !== undefined) {
-                return {
-                    ok: false,
-                    reason: `the command ${shown(command.text)}'s program cannot be verified ahead of time (${position.unknown}); a script whose commands cannot be verified is refused rather than run unattended`,
-                };
-            }
-        }
-    }
-    // The floor (and the kernel's own dangerous-command patterns) read the
-    // WHOLE script at once, exactly as they would a live call's command
-    // line: both track state across commands (a `cd` earlier in the script,
-    // a pipeline's two sides for `curl … | sh`), which per-command text
-    // alone would lose.
-    const floorGate = denyOnlyGate(policy.floorRules, true);
-    const floorResult = floorGate.evaluate({
-        toolName: 'bash',
-        toolInput: { command: body },
-        toolDef: undefined,
-        commandDialect: shell,
-    });
-    if (floorResult.decision === 'deny') {
-        return { ok: false, reason: floorResult.reason };
-    }
-    // The job's own `deny` rules (and every config file's) are the
-    // operator's own glob patterns, written with one command in mind
-    // ("npm publish*": "deny"); checked per lexed command so a refusal
-    // names the exact command that matched, not "somewhere in the script".
-    if (policy.denyRules.length > 0) {
-        const denyGate = denyOnlyGate(policy.denyRules, false);
-        for (const command of reading.commands) {
-            if (!command.text.trim())
-                continue;
-            const result = denyGate.evaluate({
-                toolName: 'bash',
-                toolInput: { command: command.text },
-                toolDef: undefined,
-                commandDialect: shell,
-            });
-            if (result.decision === 'deny') {
-                const blanketBashDeny = result.reason.includes('denied by name (bash)');
-                return {
-                    ok: false,
-                    reason: `the command ${shown(command.text)} is denied: ${result.reason}${blanketBashDeny ? '; a bash deny rule blocks every script command, so changing the script text cannot fix it' : ''}`,
-                };
-            }
-        }
-    }
-    return { ok: true };
-}
-//# sourceMappingURL=script-check.js.map