@newrelic/preflight 1.67.3 → 1.68.0

package/dist/proxy/upstream-http.js

@@ -7,6 +7,7 @@
  */
 import { request as httpRequest } from 'node:http';
 import { request as httpsRequest } from 'node:https';
+import { isIP } from 'node:net';
 import { Transform } from 'node:stream';
 import { performance } from 'node:perf_hooks';
 import { createLogger } from '../shared/index.js';
@@ -37,6 +38,27 @@ export class ByteCountTransform extends Transform {
 // ---------------------------------------------------------------------------
 // HttpUpstream
 // ---------------------------------------------------------------------------
+// Hosts where cleartext http: is acceptable. URL.hostname keeps brackets on IPv6 literals.
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+function bareHost(hostname) {
+    return hostname.replace(/^\[(.*)\]$/, '$1');
+}
+function isLoopbackHost(hostname) {
+    return LOOPBACK_HOSTS.has(bareHost(hostname).toLowerCase());
+}
+// True only for an IP literal that validateSsrfUrl rejects as private. Hostnames are
+// never resolved here, so a metadata FQDN can't pass as private.
+function isPrivateTarget(label, url) {
+    if (isIP(bareHost(url.hostname)) === 0)
+        return false;
+    try {
+        validateSsrfUrl(label, url);
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
 export class HttpUpstream {
     name;
     transportType = 'http';
@@ -50,8 +72,29 @@ export class HttpUpstream {
         this.name = config.name;
         this.url = new URL(config.url);
         this.allowPrivateHosts = config.allowPrivateHosts ?? false;
+        const label = `HttpUpstream "${this.name}"`;
         if (!this.allowPrivateHosts) {
-            validateSsrfUrl(`HttpUpstream "${this.name}"`, this.url);
+            validateSsrfUrl(label, this.url);
+        }
+        if (this.url.protocol === 'http:' && !isLoopbackHost(this.url.hostname)) {
+            const privateTarget = this.allowPrivateHosts && isPrivateTarget(label, this.url);
+            if (!(privateTarget && config.allowInsecureHttp === true)) {
+                const host = this.url.hostname;
+                let message;
+                if (privateTarget) {
+                    message = `${label}: http:// to private host "${host}" requires https:// or allowInsecureHttp: true on this upstream`;
+                }
+                else if (this.allowPrivateHosts && isIP(bareHost(host)) === 0) {
+                    message = `${label}: http:// to host "${host}" is not allowed; allowInsecureHttp only applies to a private IP address (hostnames are not resolved for this check), so use https:// or the host's private IP address`;
+                }
+                else if (this.allowPrivateHosts) {
+                    message = `${label}: http:// to public address "${host}" is not allowed; allowInsecureHttp only applies to a private IP address, so use https://`;
+                }
+                else {
+                    message = `${label}: http:// to host "${host}" is not allowed; use https:// (http:// is only accepted for localhost, 127.0.0.1 and ::1, or for a private IP address with both allowPrivateHosts and allowInsecureHttp)`;
+                }
+                throw new Error(message);
+            }
         }
         this.timeoutMs = config.timeoutMs ?? 30_000;
     }

package/dist/proxy/upstream-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-http.js","sourceRoot":"","sources":["../../src/proxy/upstream-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,IAAI,WAAW,EAA6C,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE5E,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;AAE1C,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,YAAY;IACZ,mBAAmB;IACnB,SAAS;IACT,IAAI;IACJ,UAAU;IACV,qBAAqB;IACrB,oBAAoB;CACrB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/C,KAAK,GAAG,CAAC,CAAC;IAED,UAAU,CAAC,KAAa,EAAE,SAAyB,EAAE,QAA2B;QACvF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;CACF;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,OAAO,YAAY;IACd,IAAI,CAAS;IACb,aAAa,GAAG,MAAe,CAAC;IACxB,GAAG,CAAM;IACT,SAAS,CAAS;IAClB,iBAAiB,CAAU;IAE5C,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,CAAC,IAAI,kBAAkB,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,KAAK,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,eAAe,CAAC,iBAAiB,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,IAAI,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,IAAI,gBAAgB,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAAY;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAE9E,0BAA0B;QAC1B,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvD,IAAI,KAAK,IAAI,IAAI,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;YACrD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAEhC,MAAM,WAAW,GAAG,SAAS,CAC3B,IAAI,CAAC,GAAG,EACR;gBACE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,MAAM;gBAC5B,OAAO;gBACP,OAAO,EAAE,IAAI,CAAC,SAAS;gBACvB,0EAA0E;gBAC1E,2EAA2E;gBAC3E,qEAAqE;gBACrE,GAAG,CAAC,IAAI,CAAC,iBAAiB;oBACxB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,iBAAiB,IAAI,CAAC,IAAI,cAAc,CAAC,EAAE,CAAC;aAChF,EACD,CAAC,WAAW,EAAE,EAAE;gBACd,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;gBACpD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,IAAI,GAAG,CAAC;gBAEjD,MAAM,SAAS,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;qBAC1D,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;qBACb,IAAI,EAAE;qBACN,WAAW,EAAE,CAAC;gBACjB,MAAM,WAAW,GAAG,SAAS,KAAK,mBAAmB,CAAC;gBAEtD,qDAAqD;gBACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/D,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;wBAChE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;gBAED,IAAI,WAAW,EAAE,CAAC;oBAChB,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;oBAC1B,sDAAsD;oBACtD,MAAM,OAAO,GAAG,IAAI,kBAAkB,EAAE,CAAC;oBACzC,IAAI,WAAW,GAAG,KAAK,CAAC;oBAExB,MAAM,UAAU,GAAG,GAAG,EAAE;wBACtB,IAAI,WAAW;4BAAE,OAAO;wBACxB,WAAW,GAAG,IAAI,CAAC;wBACnB,OAAO,CAAC;4BACN,UAAU;4BACV,WAAW,EAAE,IAAI;4BACjB,iBAAiB,EAAE,OAAO,CAAC,KAAK;4BAChC,iBAAiB;yBAClB,CAAC,CAAC;oBACL,CAAC,CAAC;oBAEF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;wBAC1B,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC3E,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;4BACvB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;wBACxB,CAAC;wBACD,iEAAiE;wBACjE,WAAW,CAAC,OAAO,EAAE,CAAC;wBACtB,OAAO,CAAC,OAAO,EAAE,CAAC;wBAClB,UAAU,EAAE,CAAC;oBACf,CAAC,CAAC,CAAC;oBAEH,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAEpC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;oBAElC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;wBAC9B,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAClE,UAAU,EAAE,CAAC;oBACf,CAAC,CAAC,CAAC;oBAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;wBACnB,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;4BAC3B,WAAW,CAAC,OAAO,EAAE,CAAC;wBACxB,CAAC;wBACD,UAAU,EAAE,CAAC;oBACf,CAAC,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,uEAAuE;oBACvE,MAAM,MAAM,GAAa,EAAE,CAAC;oBAC5B,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;wBACvC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACrB,CAAC,CAAC,CAAC;oBACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;wBACzB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;wBAC3C,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;wBACrD,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;wBAC1B,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;wBACtB,OAAO,CAAC;4BACN,UAAU;4BACV,WAAW,EAAE,KAAK;4BAClB,iBAAiB,EAAE,YAAY,CAAC,MAAM;4BACtC,iBAAiB;yBAClB,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;oBACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;wBAC9B,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAChE,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;wBACtE,IAAI,gBAAgB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;4BAC/C,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;wBACxB,CAAC;6BAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;4BAC9B,sEAAsE;4BACtE,4EAA4E;4BAC5E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;4BAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;wBACvD,CAAC;wBACD,OAAO,CAAC;4BACN,UAAU;4BACV,WAAW,EAAE,KAAK;4BAClB,iBAAiB,EAAE,gBAAgB;4BACnC,iBAAiB;yBAClB,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CACF,CAAC;YAEF,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBAC7B,WAAW,CAAC,OAAO,CACjB,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,qBAAqB,IAAI,CAAC,SAAS,IAAI,CAAC,CACzE,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC9B,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;gBACpD,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBACpF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;oBACvB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,OAAO,CAAC;oBACN,UAAU,EAAE,GAAG;oBACf,WAAW,EAAE,KAAK;oBAClB,iBAAiB,EAAE,CAAC;oBACpB,iBAAiB;iBAClB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,8BAA8B;YAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,GAAG,EAAE,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"upstream-http.js","sourceRoot":"","sources":["../../src/proxy/upstream-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,IAAI,WAAW,EAA6C,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE5E,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;AAE1C,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,YAAY;IACZ,mBAAmB;IACnB,SAAS;IACT,IAAI;IACJ,UAAU;IACV,qBAAqB;IACrB,oBAAoB;CACrB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/C,KAAK,GAAG,CAAC,CAAC;IAED,UAAU,CAAC,KAAa,EAAE,SAAyB,EAAE,QAA2B;QACvF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;CACF;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,2FAA2F;AAC3F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAElE,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,qFAAqF;AACrF,iEAAiE;AACjE,SAAS,eAAe,CAAC,KAAa,EAAE,GAAQ;IAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC;QACH,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,OAAO,YAAY;IACd,IAAI,CAAS;IACb,aAAa,GAAG,MAAe,CAAC;IACxB,GAAG,CAAM;IACT,SAAS,CAAS;IAClB,iBAAiB,CAAU;IAE5C,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,CAAC,IAAI,kBAAkB,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,KAAK,CAAC;QAC3D,MAAM,KAAK,GAAG,iBAAiB,IAAI,CAAC,IAAI,GAAG,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxE,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,IAAI,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACjF,IAAI,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC/B,IAAI,OAAe,CAAC;gBACpB,IAAI,aAAa,EAAE,CAAC;oBAClB,OAAO,GAAG,GAAG,KAAK,8BAA8B,IAAI,iEAAiE,CAAC;gBACxH,CAAC;qBAAM,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChE,OAAO,GAAG,GAAG,KAAK,sBAAsB,IAAI,wKAAwK,CAAC;gBACvN,CAAC;qBAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBAClC,OAAO,GAAG,GAAG,KAAK,gCAAgC,IAAI,2FAA2F,CAAC;gBACpJ,CAAC;qBAAM,CAAC;oBACN,OAAO,GAAG,GAAG,KAAK,sBAAsB,IAAI,2KAA2K,CAAC;gBAC1N,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,IAAI,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,IAAI,gBAAgB,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAAY;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAE9E,0BAA0B;QAC1B,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvD,IAAI,KAAK,IAAI,IAAI,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;YACrD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAEhC,MAAM,WAAW,GAAG,SAAS,CAC3B,IAAI,CAAC,GAAG,EACR;gBACE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,MAAM;gBAC5B,OAAO;gBACP,OAAO,EAAE,IAAI,CAAC,SAAS;gBACvB,0EAA0E;gBAC1E,2EAA2E;gBAC3E,qEAAqE;gBACrE,GAAG,CAAC,IAAI,CAAC,iBAAiB;oBACxB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,iBAAiB,IAAI,CAAC,IAAI,cAAc,CAAC,EAAE,CAAC;aAChF,EACD,CAAC,WAAW,EAAE,EAAE;gBACd,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;gBACpD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,IAAI,GAAG,CAAC;gBAEjD,MAAM,SAAS,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;qBAC1D,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;qBACb,IAAI,EAAE;qBACN,WAAW,EAAE,CAAC;gBACjB,MAAM,WAAW,GAAG,SAAS,KAAK,mBAAmB,CAAC;gBAEtD,qDAAqD;gBACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/D,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;wBAChE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;gBAED,IAAI,WAAW,EAAE,CAAC;oBAChB,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;oBAC1B,sDAAsD;oBACtD,MAAM,OAAO,GAAG,IAAI,kBAAkB,EAAE,CAAC;oBACzC,IAAI,WAAW,GAAG,KAAK,CAAC;oBAExB,MAAM,UAAU,GAAG,GAAG,EAAE;wBACtB,IAAI,WAAW;4BAAE,OAAO;wBACxB,WAAW,GAAG,IAAI,CAAC;wBACnB,OAAO,CAAC;4BACN,UAAU;4BACV,WAAW,EAAE,IAAI;4BACjB,iBAAiB,EAAE,OAAO,CAAC,KAAK;4BAChC,iBAAiB;yBAClB,CAAC,CAAC;oBACL,CAAC,CAAC;oBAEF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;wBAC1B,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC3E,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;4BACvB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;wBACxB,CAAC;wBACD,iEAAiE;wBACjE,WAAW,CAAC,OAAO,EAAE,CAAC;wBACtB,OAAO,CAAC,OAAO,EAAE,CAAC;wBAClB,UAAU,EAAE,CAAC;oBACf,CAAC,CAAC,CAAC;oBAEH,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAEpC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;oBAElC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;wBAC9B,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAClE,UAAU,EAAE,CAAC;oBACf,CAAC,CAAC,CAAC;oBAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;wBACnB,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;4BAC3B,WAAW,CAAC,OAAO,EAAE,CAAC;wBACxB,CAAC;wBACD,UAAU,EAAE,CAAC;oBACf,CAAC,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,uEAAuE;oBACvE,MAAM,MAAM,GAAa,EAAE,CAAC;oBAC5B,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;wBACvC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACrB,CAAC,CAAC,CAAC;oBACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;wBACzB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;wBAC3C,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;wBACrD,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;wBAC1B,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;wBACtB,OAAO,CAAC;4BACN,UAAU;4BACV,WAAW,EAAE,KAAK;4BAClB,iBAAiB,EAAE,YAAY,CAAC,MAAM;4BACtC,iBAAiB;yBAClB,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;oBACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;wBAC9B,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAChE,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;wBACtE,IAAI,gBAAgB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;4BAC/C,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;wBACxB,CAAC;6BAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;4BAC9B,sEAAsE;4BACtE,4EAA4E;4BAC5E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;4BAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;wBACvD,CAAC;wBACD,OAAO,CAAC;4BACN,UAAU;4BACV,WAAW,EAAE,KAAK;4BAClB,iBAAiB,EAAE,gBAAgB;4BACnC,iBAAiB;yBAClB,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CACF,CAAC;YAEF,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBAC7B,WAAW,CAAC,OAAO,CACjB,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,qBAAqB,IAAI,CAAC,SAAS,IAAI,CAAC,CACzE,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC9B,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;gBACpD,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBACpF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;oBACvB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,OAAO,CAAC;oBACN,UAAU,EAAE,GAAG;oBACf,WAAW,EAAE,KAAK;oBAClB,iBAAiB,EAAE,CAAC;oBACpB,iBAAiB;iBAClB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,8BAA8B;YAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,GAAG,EAAE,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/proxy/upstream-stdio.d.ts

@@ -7,7 +7,6 @@
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { ForwardResult, ProxyUpstream, UpstreamConfig } from './types.js';
-export declare const DANGEROUS_ENV_KEYS: Set<string>;
 export declare function sanitizeEnv(env: Record<string, string> | undefined, upstreamName: string): Record<string, string> | undefined;
 export declare function validateCommand(upstreamName: string, command: string, allowBareCommand: boolean): void;
 /**

package/dist/proxy/upstream-stdio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-stdio.d.ts","sourceRoot":"","sources":["../../src/proxy/upstream-stdio.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAOjE,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAY/E,eAAO,MAAM,kBAAkB,aAe7B,CAAC;AAEH,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,YAAY,EAAE,MAAM,GACnB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAmBpC;AAMD,wBAAgB,eAAe,CAC7B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,OAAO,GACxB,IAAI,CAQN;AAuED;;;;;;;;GAQG;AACH,qBAAa,aAAc,YAAW,aAAa;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAG,OAAO,CAAU;IAC1C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,SAAS,CAAqC;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;gBAE5B,MAAM,EAAE,cAAc;IAQ5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA+BxB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsC3B,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;YAyDjF,gBAAgB;CAiE/B"}
+{"version":3,"file":"upstream-stdio.d.ts","sourceRoot":"","sources":["../../src/proxy/upstream-stdio.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAQjE,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAY/E,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,YAAY,EAAE,MAAM,GACnB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAUpC;AAMD,wBAAgB,eAAe,CAC7B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,OAAO,GACxB,IAAI,CAQN;AAuED;;;;;;;;GAQG;AACH,qBAAa,aAAc,YAAW,aAAa;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAG,OAAO,CAAU;IAC1C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,SAAS,CAAqC;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;gBAE5B,MAAM,EAAE,cAAc;IAQ5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA+BxB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsC3B,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;YAyDjF,gBAAgB;CAiE/B"}

package/dist/proxy/upstream-stdio.js

@@ -11,6 +11,7 @@ import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
 import { z } from 'zod';
 import { createLogger } from '../shared/index.js';
+import { stripDangerousEnv } from '../lib/child-env.js';
 const logger = createLogger('proxy-stdio');
 // ---------------------------------------------------------------------------
 // Env sanitization — strips keys that enable dynamic-linker or Node injection.
@@ -19,35 +20,10 @@ const logger = createLogger('proxy-stdio');
 // from the caller-supplied env has no effect — PATH always flows through.
 // PATH hijacking is prevented instead by validateCommand requiring absolute paths.
 // ---------------------------------------------------------------------------
-export const DANGEROUS_ENV_KEYS = new Set([
-    'LD_PRELOAD',
-    'LD_LIBRARY_PATH',
-    'DYLD_INSERT_LIBRARIES',
-    'DYLD_LIBRARY_PATH',
-    'NODE_OPTIONS',
-    'PYTHONPATH',
-    'PYTHONSTARTUP',
-    'RUBYOPT',
-    'PERL5LIB',
-    'LD_AUDIT',
-    'GCONV_PATH',
-    'BASH_ENV',
-    'ENV',
-    'ELECTRON_RUN_AS_NODE',
-]);
 export function sanitizeEnv(env, upstreamName) {
     if (!env)
         return undefined;
-    const sanitized = {};
-    const stripped = [];
-    for (const [key, value] of Object.entries(env)) {
-        if (DANGEROUS_ENV_KEYS.has(key)) {
-            stripped.push(key);
-        }
-        else {
-            sanitized[key] = value;
-        }
-    }
+    const { env: sanitized, stripped } = stripDangerousEnv(env);
     if (stripped.length > 0) {
         logger.warn(`StdioUpstream "${upstreamName}": stripped dangerous env keys`, { keys: stripped });
     }

package/dist/proxy/upstream-stdio.js.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-stdio.js","sourceRoot":"","sources":["../../src/proxy/upstream-stdio.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAE3C,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,mFAAmF;AACnF,8EAA8E;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACxC,YAAY;IACZ,iBAAiB;IACjB,uBAAuB;IACvB,mBAAmB;IACnB,cAAc;IACd,YAAY;IACZ,eAAe;IACf,SAAS;IACT,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,KAAK;IACL,sBAAsB;CACvB,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CACzB,GAAuC,EACvC,YAAoB;IAEpB,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAE3B,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,kBAAkB,YAAY,gCAAgC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E,MAAM,UAAU,eAAe,CAC7B,YAAoB,EACpB,OAAe,EACf,gBAAyB;IAEzB,IAAI,CAAC,gBAAgB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,kBAAkB,YAAY,eAAe,OAAO,6BAA6B;YAC/E,sDAAsD;YACtD,iFAAiF,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAanC,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAY,CAAC;QAC7D,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,QAAQ,IAAI,MAAM;YAClB,OAAQ,MAAkC,CAAC,MAAM,KAAK,QAAQ,EAC9D,CAAC;YACD,OAAO,MAAwB,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAmB,EACnB,EAA+B,EAC/B,MAAe;IAEf,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACxE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;KAClD,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAmB,EACnB,EAA+B,EAC/B,IAAY,EACZ,OAAe;IAEf,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,EAAE,IAAI,IAAI;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KACzB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/C,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE;QACxB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;KAClD,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,OAAO,aAAa;IACf,IAAI,CAAS;IACb,aAAa,GAAG,OAAgB,CAAC;IAClC,MAAM,GAAkB,IAAI,CAAC;IAC7B,SAAS,GAAgC,IAAI,CAAC;IACrC,MAAM,CAAiB;IAExC,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,IAAI,sBAAsB,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAQ,CAAC;QACrC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC;QAE3E,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAE3F,IAAI,CAAC,SAAS,GAAG,IAAI,oBAAoB,CAAC;YACxC,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC;YAC5C,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAE3E,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAE5F,wEAAwE;QACxE,uCAAuC;QACvC,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;YAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CACT,mBAAmB,IAAI,CAAC,IAAI,sDAAsD,CACnF,CAAC;gBACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QAEtB,IAAI,SAAS,GAAyC,IAAI,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,MAAM,CAAC,KAAK,EAAE;gBACd,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC/B,SAAS,GAAG,UAAU,CACpB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAC7C,qBAAqB,CACtB,CAAC;oBACF,SAAS,CAAC,KAAK,EAAE,CAAC;gBACpB,CAAC,CAAC;aACH,CAAC,CAAC;YACH,IAAI,SAAS,KAAK,IAAI;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,SAAS,KAAK,IAAI;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,CACT,mBAAmB,IAAI,CAAC,IAAI,2BAA2B,qBAAqB,4BAA4B,CACzG,CAAC;YACF,yEAAyE;YACzE,2EAA2E;YAC3E,yEAAyE;YACzE,sBAAsB;YACtB,MAAM,SAAS,GAAI,SAAgD,CAAC,UAAU,CACjC,CAAC;YAC9C,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,gBAAgB,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAqB,EAAE,GAAmB,EAAE,IAAY;QACpE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;YACjF,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,WAAW,EAAE,KAAK;gBAClB,iBAAiB,EAAE,IAAI;gBACvB,iBAAiB,EAAE,CAAC;aACrB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;YACxF,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,WAAW,EAAE,KAAK;gBAClB,iBAAiB,EAAE,IAAI;gBACvB,iBAAiB,EAAE,CAAC;aACrB,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAChD,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACpD,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,WAAW,EAAE,KAAK;gBAClB,iBAAiB,EAAE,IAAI;gBACvB,iBAAiB;aAClB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACpD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;gBACnC,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;YAEH,kFAAkF;YAClF,kFAAkF;YAClF,mFAAmF;YACnF,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACtE,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,WAAW,EAAE,KAAK;gBAClB,iBAAiB,EAAE,IAAI;gBACvB,iBAAiB;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,GAAmB;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAO,CAAC;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;QAE9C,sEAAsE;QACtE,qEAAqE;QACrE,kEAAkE;QAClE,wEAAwE;QACxE,MAAM,cAAc,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YACtD,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE;gBACxB,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,mBAAmB,IAAI,CAAC,CAAC,CAAC;YAC7E,CAAC,EAAE,mBAAmB,CAAC,CAAC;YACxB,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,IAAI,eAAiC,CAAC;QACtC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,YAAY;gBACf,eAAe,GAAG,MAAM,CAAC,QAAQ,CAC/B,MAA+C,EAC/C,SAAS,EACT,OAAO,CACR,CAAC;gBACF,MAAM;YACR,KAAK,YAAY;gBACf,eAAe,GAAG,MAAM,CAAC,SAAS,CAChC,MAAgD,EAChD,OAAO,CACR,CAAC;gBACF,MAAM;YACR,KAAK,gBAAgB;gBACnB,eAAe,GAAG,MAAM,CAAC,aAAa,CACpC,MAAoD,EACpD,OAAO,CACR,CAAC;gBACF,MAAM;YACR,KAAK,gBAAgB;gBACnB,eAAe,GAAG,MAAM,CAAC,YAAY,CACnC,MAAmD,EACnD,OAAO,CACR,CAAC;gBACF,MAAM;YACR,KAAK,MAAM;gBACT,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvC,MAAM;YACR,KAAK,YAAY;gBACf,gFAAgF;gBAChF,OAAO;oBACL,eAAe,EAAE,YAAY;oBAC7B,YAAY,EAAE,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE;oBAClD,UAAU,EAAE,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE;iBAC/E,CAAC;YACJ;gBACE,eAAe,GAAG,MAAM,CAAC,OAAO,CAC9B,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAA0C,EACtE,CAAC,CAAC,GAAG,EAAE,EACP,OAAO,CACR,CAAC;QACN,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;IACzD,CAAC;CACF"}
+{"version":3,"file":"upstream-stdio.js","sourceRoot":"","sources":["../../src/proxy/upstream-stdio.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAE3C,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,mFAAmF;AACnF,8EAA8E;AAE9E,MAAM,UAAU,WAAW,CACzB,GAAuC,EACvC,YAAoB;IAEpB,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAE3B,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAE5D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,kBAAkB,YAAY,gCAAgC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E,MAAM,UAAU,eAAe,CAC7B,YAAoB,EACpB,OAAe,EACf,gBAAyB;IAEzB,IAAI,CAAC,gBAAgB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,kBAAkB,YAAY,eAAe,OAAO,6BAA6B;YAC/E,sDAAsD;YACtD,iFAAiF,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAanC,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAY,CAAC;QAC7D,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,QAAQ,IAAI,MAAM;YAClB,OAAQ,MAAkC,CAAC,MAAM,KAAK,QAAQ,EAC9D,CAAC;YACD,OAAO,MAAwB,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAmB,EACnB,EAA+B,EAC/B,MAAe;IAEf,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACxE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;KAClD,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAmB,EACnB,EAA+B,EAC/B,IAAY,EACZ,OAAe;IAEf,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,EAAE,IAAI,IAAI;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KACzB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/C,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE;QACxB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;KAClD,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,OAAO,aAAa;IACf,IAAI,CAAS;IACb,aAAa,GAAG,OAAgB,CAAC;IAClC,MAAM,GAAkB,IAAI,CAAC;IAC7B,SAAS,GAAgC,IAAI,CAAC;IACrC,MAAM,CAAiB;IAExC,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,IAAI,sBAAsB,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAQ,CAAC;QACrC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC;QAE3E,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAE3F,IAAI,CAAC,SAAS,GAAG,IAAI,oBAAoB,CAAC;YACxC,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC;YAC5C,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAE3E,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAE5F,wEAAwE;QACxE,uCAAuC;QACvC,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;YAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CACT,mBAAmB,IAAI,CAAC,IAAI,sDAAsD,CACnF,CAAC;gBACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QAEtB,IAAI,SAAS,GAAyC,IAAI,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,MAAM,CAAC,KAAK,EAAE;gBACd,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC/B,SAAS,GAAG,UAAU,CACpB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAC7C,qBAAqB,CACtB,CAAC;oBACF,SAAS,CAAC,KAAK,EAAE,CAAC;gBACpB,CAAC,CAAC;aACH,CAAC,CAAC;YACH,IAAI,SAAS,KAAK,IAAI;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,SAAS,KAAK,IAAI;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,CACT,mBAAmB,IAAI,CAAC,IAAI,2BAA2B,qBAAqB,4BAA4B,CACzG,CAAC;YACF,yEAAyE;YACzE,2EAA2E;YAC3E,yEAAyE;YACzE,sBAAsB;YACtB,MAAM,SAAS,GAAI,SAAgD,CAAC,UAAU,CACjC,CAAC;YAC9C,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,gBAAgB,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAqB,EAAE,GAAmB,EAAE,IAAY;QACpE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;YACjF,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,WAAW,EAAE,KAAK;gBAClB,iBAAiB,EAAE,IAAI;gBACvB,iBAAiB,EAAE,CAAC;aACrB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;YACxF,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,WAAW,EAAE,KAAK;gBAClB,iBAAiB,EAAE,IAAI;gBACvB,iBAAiB,EAAE,CAAC;aACrB,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAChD,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACpD,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,WAAW,EAAE,KAAK;gBAClB,iBAAiB,EAAE,IAAI;gBACvB,iBAAiB;aAClB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACpD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;gBACnC,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;YAEH,kFAAkF;YAClF,kFAAkF;YAClF,mFAAmF;YACnF,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACtE,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,WAAW,EAAE,KAAK;gBAClB,iBAAiB,EAAE,IAAI;gBACvB,iBAAiB;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,GAAmB;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAO,CAAC;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;QAE9C,sEAAsE;QACtE,qEAAqE;QACrE,kEAAkE;QAClE,wEAAwE;QACxE,MAAM,cAAc,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YACtD,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE;gBACxB,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,mBAAmB,IAAI,CAAC,CAAC,CAAC;YAC7E,CAAC,EAAE,mBAAmB,CAAC,CAAC;YACxB,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,IAAI,eAAiC,CAAC;QACtC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,YAAY;gBACf,eAAe,GAAG,MAAM,CAAC,QAAQ,CAC/B,MAA+C,EAC/C,SAAS,EACT,OAAO,CACR,CAAC;gBACF,MAAM;YACR,KAAK,YAAY;gBACf,eAAe,GAAG,MAAM,CAAC,SAAS,CAChC,MAAgD,EAChD,OAAO,CACR,CAAC;gBACF,MAAM;YACR,KAAK,gBAAgB;gBACnB,eAAe,GAAG,MAAM,CAAC,aAAa,CACpC,MAAoD,EACpD,OAAO,CACR,CAAC;gBACF,MAAM;YACR,KAAK,gBAAgB;gBACnB,eAAe,GAAG,MAAM,CAAC,YAAY,CACnC,MAAmD,EACnD,OAAO,CACR,CAAC;gBACF,MAAM;YACR,KAAK,MAAM;gBACT,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvC,MAAM;YACR,KAAK,YAAY;gBACf,gFAAgF;gBAChF,OAAO;oBACL,eAAe,EAAE,YAAY;oBAC7B,YAAY,EAAE,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE;oBAClD,UAAU,EAAE,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE;iBAC/E,CAAC;YACJ;gBACE,eAAe,GAAG,MAAM,CAAC,OAAO,CAC9B,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAA0C,EACtE,CAAC,CAAC,GAAG,EAAE,EACP,OAAO,CACR,CAAC;QACN,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/redaction-patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction-patterns.d.ts","sourceRoot":"","sources":["../src/redaction-patterns.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAiB/C,CAAC"}
+{"version":3,"file":"redaction-patterns.d.ts","sourceRoot":"","sources":["../src/redaction-patterns.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAkB/C,CAAC"}

package/dist/redaction-patterns.js

@@ -13,6 +13,7 @@ export const REDACTION_PATTERNS = [
     /\bAIzaSy[0-9A-Za-z_-]{33}\b/g,
     /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
     /\bnpm_[A-Za-z0-9]{36}\b/g,
+    /\bglpat-[A-Za-z0-9_.-]{20,300}/g,
     /\bxox[a-z]-[0-9A-Za-z-]+/g,
     /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{24,}\b/g,
     /\bpypi-[A-Za-z0-9_-]{20,}\b/g,

package/dist/redaction-patterns.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction-patterns.js","sourceRoot":"","sources":["../src/redaction-patterns.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,0FAA0F;AAC1F,0FAA0F;AAC1F,uFAAuF;AACvF,4FAA4F;AAC5F,sFAAsF;AACtF,2BAA2B;AAC3B,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,oGAAoG;IACpG,gFAAgF;IAChF,sFAAsF;IACtF,uBAAuB;IACvB,8BAA8B;IAC9B,kEAAkE;IAClE,0BAA0B;IAC1B,2BAA2B;IAC3B,+CAA+C;IAC/C,8BAA8B;IAC9B,0BAA0B;IAC1B,uFAAuF;IACvF,2CAA2C;IAC3C,4BAA4B;IAC5B,sDAAsD;IACtD,qDAAqD;CACtD,CAAC"}
+{"version":3,"file":"redaction-patterns.js","sourceRoot":"","sources":["../src/redaction-patterns.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,0FAA0F;AAC1F,0FAA0F;AAC1F,uFAAuF;AACvF,4FAA4F;AAC5F,sFAAsF;AACtF,2BAA2B;AAC3B,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,oGAAoG;IACpG,gFAAgF;IAChF,sFAAsF;IACtF,uBAAuB;IACvB,8BAA8B;IAC9B,kEAAkE;IAClE,0BAA0B;IAC1B,iCAAiC;IACjC,2BAA2B;IAC3B,+CAA+C;IAC/C,8BAA8B;IAC9B,0BAA0B;IAC1B,uFAAuF;IACvF,2CAA2C;IAC3C,4BAA4B;IAC5B,sDAAsD;IACtD,qDAAqD;CACtD,CAAC"}

package/dist/secret-command.d.ts

@@ -0,0 +1,57 @@
+export type SecretField = 'licenseKey' | 'nrApiKey' | 'digestWebhookUrl';
+/** No CLI flag carries a secret today, so `cli` is not a possible source. */
+export type SecretSource = 'env' | 'command' | 'file' | 'unset';
+export type SecretSources = {
+    readonly [F in SecretField]: SecretSource;
+};
+export type ResolvedSecret = {
+    readonly source: 'env' | 'file';
+    readonly value: string;
+} | {
+    readonly source: 'command';
+    readonly value: string | undefined;
+} | {
+    readonly source: 'unset';
+    readonly value: undefined;
+};
+export type SecretCommandFailure = 'not-absolute' | 'not-runnable' | 'timeout' | 'output-too-large' | 'killed' | 'non-zero-exit' | 'empty-output';
+/**
+ * Names the field and the failure class only. The command's stdout, stderr
+ * and argv never appear in the message: stdout is the secret, and the other
+ * two can carry pieces of it.
+ */
+export declare class SecretCommandError extends Error {
+    readonly field: SecretField;
+    readonly failure: SecretCommandFailure;
+    constructor(field: SecretField, failure: SecretCommandFailure, extra?: string);
+}
+/**
+ * Runs `argv` (absolute executable path first) with no shell and a stripped env, and returns its stdout minus
+ * one trailing newline. Throws SecretCommandError on any failure.
+ */
+export declare function resolveSecretCommand(field: SecretField, argv: readonly string[], timeoutMs?: number): string;
+type SecretInputs = {
+    readonly env: string | undefined;
+    readonly command: readonly string[] | undefined;
+    readonly file: string | undefined;
+};
+/**
+ * Whether any source would supply a non-empty value, without running the
+ * command. Follows resolveSecret's precedence: a non-empty env var decides
+ * alone, and a blank one is treated as unset.
+ */
+export declare function isSecretConfigured(sources: SecretInputs): boolean;
+/**
+ * Precedence: non-empty env var > helper command > plaintext file value. A
+ * blank env var counts as unset, so it cannot shadow the other two. The
+ * command runs only when no env var supplied the value. With `optional`, a failing
+ * command is logged as a warning and the secret is treated as unset instead of
+ * stopping startup; the plaintext value is not used as a fallback. With
+ * `skipCommand`, a winning command is reported as the source but not run.
+ */
+export declare function resolveSecret(field: SecretField, sources: SecretInputs, options?: {
+    readonly optional?: boolean;
+    readonly skipCommand?: boolean;
+}): ResolvedSecret;
+export {};
+//# sourceMappingURL=secret-command.d.ts.map

package/dist/secret-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-command.d.ts","sourceRoot":"","sources":["../src/secret-command.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,kBAAkB,CAAC;AAEzE,6EAA6E;AAC7E,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAChE,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,EAAE,CAAC,IAAI,WAAW,GAAG,YAAY;CAAE,CAAC;AAE1E,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAE3D;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAClE;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAE5D,MAAM,MAAM,oBAAoB,GAC5B,cAAc,GACd,cAAc,GACd,SAAS,GACT,kBAAkB,GAClB,QAAQ,GACR,eAAe,GACf,cAAc,CAAC;AAYnB;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;gBAE3B,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,SAAK;CAS1E;AAKD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,SAA4B,GACpC,MAAM,CAuCR;AAED,KAAK,YAAY,GAAG;IAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAGjE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,YAAY,EACrB,OAAO,GAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GAC5E,cAAc,CAiBhB"}

package/dist/secret-command.js

@@ -0,0 +1,117 @@
+import { spawnSync } from 'node:child_process';
+import { isAbsolute } from 'node:path';
+import { createLogger } from './shared/index.js';
+import { stripDangerousEnv } from './lib/child-env.js';
+const logger = createLogger('secret-command');
+const FAILURE_MESSAGES = {
+    'not-absolute': 'the first array element must be an absolute path to the executable',
+    'not-runnable': 'the executable could not be started',
+    timeout: 'the command timed out',
+    'output-too-large': 'the command printed more output than a secret can be',
+    killed: 'the command was killed by a signal',
+    'non-zero-exit': 'the command exited with a non-zero status',
+    'empty-output': 'the command printed nothing to stdout',
+};
+/**
+ * Names the field and the failure class only. The command's stdout, stderr
+ * and argv never appear in the message: stdout is the secret, and the other
+ * two can carry pieces of it.
+ */
+export class SecretCommandError extends Error {
+    field;
+    failure;
+    constructor(field, failure, extra = '') {
+        super(`Could not read ${field} from ${field}Command: ${FAILURE_MESSAGES[failure]}${extra}. ` +
+            'Preflight does not show the command output; run the command yourself to see why it failed.');
+        this.name = 'SecretCommandError';
+        this.field = field;
+        this.failure = failure;
+    }
+}
+const SECRET_COMMAND_TIMEOUT_MS = 20_000;
+const MAX_OUTPUT_BYTES = 64 * 1024;
+/**
+ * Runs `argv` (absolute executable path first) with no shell and a stripped env, and returns its stdout minus
+ * one trailing newline. Throws SecretCommandError on any failure.
+ */
+export function resolveSecretCommand(field, argv, timeoutMs = SECRET_COMMAND_TIMEOUT_MS) {
+    const [executable, ...args] = argv;
+    if (executable === undefined || !isAbsolute(executable)) {
+        throw new SecretCommandError(field, 'not-absolute');
+    }
+    const { env, stripped } = stripDangerousEnv(process.env);
+    if (stripped.length > 0) {
+        logger.debug('Stripped injection-capable env vars from secret helper env', {
+            field,
+            envNames: stripped,
+        });
+    }
+    const result = spawnSync(executable, args, {
+        shell: false,
+        env,
+        timeout: timeoutMs,
+        maxBuffer: MAX_OUTPUT_BYTES,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+        windowsHide: true,
+    });
+    if (result.error) {
+        const code = result.error.code;
+        if (code === 'ETIMEDOUT')
+            throw new SecretCommandError(field, 'timeout', ` after ${timeoutMs}ms`);
+        if (code === 'ENOBUFS')
+            throw new SecretCommandError(field, 'output-too-large');
+        throw new SecretCommandError(field, 'not-runnable', code ? ` (${code})` : '');
+    }
+    if (result.signal)
+        throw new SecretCommandError(field, 'killed', ` (${result.signal})`);
+    if (result.status !== 0) {
+        throw new SecretCommandError(field, 'non-zero-exit', ` (${String(result.status)})`);
+    }
+    const output = result.stdout.replace(/\r?\n$/, '');
+    if (output.trim() === '')
+        throw new SecretCommandError(field, 'empty-output');
+    return output;
+}
+/**
+ * Whether any source would supply a non-empty value, without running the
+ * command. Follows resolveSecret's precedence: a non-empty env var decides
+ * alone, and a blank one is treated as unset.
+ */
+export function isSecretConfigured(sources) {
+    if (sources.env?.trim())
+        return true;
+    return sources.command !== undefined || Boolean(sources.file);
+}
+/**
+ * Precedence: non-empty env var > helper command > plaintext file value. A
+ * blank env var counts as unset, so it cannot shadow the other two. The
+ * command runs only when no env var supplied the value. With `optional`, a failing
+ * command is logged as a warning and the secret is treated as unset instead of
+ * stopping startup; the plaintext value is not used as a fallback. With
+ * `skipCommand`, a winning command is reported as the source but not run.
+ */
+export function resolveSecret(field, sources, options = {}) {
+    if (sources.env?.trim())
+        return { source: 'env', value: sources.env };
+    if (sources.command !== undefined) {
+        if (sources.file !== undefined) {
+            logger.warn(`Both ${field} and ${field}Command are set; using ${field}Command`, { field });
+        }
+        if (options.skipCommand)
+            return { source: 'command', value: undefined };
+        try {
+            return { source: 'command', value: resolveSecretCommand(field, sources.command) };
+        }
+        catch (err) {
+            if (!options.optional || !(err instanceof SecretCommandError))
+                throw err;
+            logger.warn(`${err.message} Continuing without ${field}.`, { field, failure: err.failure });
+            return { source: 'unset', value: undefined };
+        }
+    }
+    if (sources.file !== undefined)
+        return { source: 'file', value: sources.file };
+    return { source: 'unset', value: undefined };
+}
+//# sourceMappingURL=secret-command.js.map

package/dist/secret-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-command.js","sourceRoot":"","sources":["../src/secret-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAuB9C,MAAM,gBAAgB,GAAmD;IACvE,cAAc,EAAE,oEAAoE;IACpF,cAAc,EAAE,qCAAqC;IACrD,OAAO,EAAE,uBAAuB;IAChC,kBAAkB,EAAE,sDAAsD;IAC1E,MAAM,EAAE,oCAAoC;IAC5C,eAAe,EAAE,2CAA2C;IAC5D,cAAc,EAAE,uCAAuC;CACxD,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,KAAK,CAAc;IACnB,OAAO,CAAuB;IAEvC,YAAY,KAAkB,EAAE,OAA6B,EAAE,KAAK,GAAG,EAAE;QACvE,KAAK,CACH,kBAAkB,KAAK,SAAS,KAAK,YAAY,gBAAgB,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI;YACpF,4FAA4F,CAC/F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAkB,EAClB,IAAuB,EACvB,SAAS,GAAG,yBAAyB;IAErC,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACnC,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,4DAA4D,EAAE;YACzE,KAAK;YACL,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE;QACzC,KAAK,EAAE,KAAK;QACZ,GAAG;QACH,OAAO,EAAE,SAAS;QAClB,SAAS,EAAE,gBAAgB;QAC3B,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;QACnC,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,GAAI,MAAM,CAAC,KAA+B,CAAC,IAAI,CAAC;QAC1D,IAAI,IAAI,KAAK,WAAW;YACtB,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,SAAS,IAAI,CAAC,CAAC;QAC1E,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QAChF,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACxF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAqB;IACtD,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAkB,EAClB,OAAqB,EACrB,UAA2E,EAAE;IAE7E,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IACtE,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,KAAK,0BAA0B,KAAK,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,OAAO,CAAC,WAAW;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,YAAY,kBAAkB,CAAC;gBAAE,MAAM,GAAG,CAAC;YACzE,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,uBAAuB,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5F,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC/C,CAAC"}

package/dist/security/audit-trail.d.ts

@@ -7,7 +7,7 @@ import type { NrEventData } from '../shared/index.js';
 import type { ToolCallRecord } from '../storage/types.js';
 import type { ProxyToolCallRecord } from '../proxy/types.js';
 import type { LocalStore } from '../storage/local-store.js';
-export type AuditAction = 'FileRead' | 'FileWrite' | 'FileEdit' | 'BashCommand' | 'McpToolCall' | 'AgentSpawn' | 'Search' | 'Other';
+export type AuditAction = 'FileRead' | 'FileWrite' | 'FileEdit' | 'BashCommand' | 'McpToolCall' | 'AgentSpawn' | 'Search' | 'HookInstall' | 'Other';
 export type AlertSeverity = 'critical' | 'high' | 'medium';
 export interface SecurityAlert {
     readonly severity: AlertSeverity;
@@ -88,6 +88,12 @@ export declare class AuditTrailManager {
     constructor(options: AuditTrailManagerOptions);
     recordToolCall(record: ToolCallRecord): AuditRecord;
     recordProxyCall(record: ProxyToolCallRecord): AuditRecord;
+    /**
+     * Records that `nr_observe_install_hooks` wrote Preflight's hook entries to
+     * `settingsPath`. Not a tool call, so there is no security alert to run.
+     * The entry is kept in memory and persisted like any other audit record.
+     */
+    recordHeadlessHookInstall(settingsPath: string): AuditRecord;
     private commit;
     /**
      * Merges this process's own in-memory `entries` (capped at

package/dist/security/audit-trail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-trail.d.ts","sourceRoot":"","sources":["../../src/security/audit-trail.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,qBAAqB,CAAC;AACtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAW5D,MAAM,MAAM,WAAW,GACnB,UAAU,GACV,WAAW,GACX,UAAU,GACV,aAAa,GACb,aAAa,GACb,YAAY,GACZ,QAAQ,GACR,OAAO,CAAC;AAEZ,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wGAAwG;IACxG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAY,SAAQ,gBAAgB;IACnD;;+CAE2C;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnD;AAMD,eAAO,MAAM,+BAA+B,EAAE,MAAM,EAanD,CAAC;AAEF,eAAO,MAAM,oCAAoC,EAAE,MAAM,EAwBxD,CAAC;AAEF,eAAO,MAAM,gCAAgC,EAAE,MAAM,EAKpD,CAAC;AAIF,eAAO,MAAM,iCAAiC,EAAE,MAAM,EAAuC,CAAC;AAW9F,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EACjD,MAAM,EAAE,gBAAgB,GACvB,IAAI,CAKN;AAmID,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE;IACN,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GACA,WAAW,CA0Bb;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE;IACN,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GACA,WAAW,CAqBb;AAmID,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kHAAkH;IAClH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,iFAAiF;IACjF,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuB;IAC7C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAE/C,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAU;IAC7C;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;gBAErC,OAAO,EAAE,wBAAwB;IAY7C,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,WAAW;IAMnD,eAAe,CAAC,MAAM,EAAE,mBAAmB,GAAG,WAAW;IAKzD,OAAO,CAAC,MAAM;IA0Cd;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,WAAW,CAAC,KAAK,GAAE,MAA4C,GAAG,SAAS,WAAW,EAAE;IAsBxF,qBAAqB,IAAI,SAAS,WAAW,EAAE;IAI/C,UAAU,IAAI,YAAY;IAmB1B,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAQtC,OAAO,CAAC,aAAa;CAmBtB"}
+{"version":3,"file":"audit-trail.d.ts","sourceRoot":"","sources":["../../src/security/audit-trail.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,qBAAqB,CAAC;AACtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAW5D,MAAM,MAAM,WAAW,GACnB,UAAU,GACV,WAAW,GACX,UAAU,GACV,aAAa,GACb,aAAa,GACb,YAAY,GACZ,QAAQ,GACR,aAAa,GACb,OAAO,CAAC;AAEZ,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wGAAwG;IACxG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAY,SAAQ,gBAAgB;IACnD;;+CAE2C;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnD;AAMD,eAAO,MAAM,+BAA+B,EAAE,MAAM,EAanD,CAAC;AAEF,eAAO,MAAM,oCAAoC,EAAE,MAAM,EAwBxD,CAAC;AAEF,eAAO,MAAM,gCAAgC,EAAE,MAAM,EAKpD,CAAC;AAIF,eAAO,MAAM,iCAAiC,EAAE,MAAM,EAAuC,CAAC;AAW9F,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EACjD,MAAM,EAAE,gBAAgB,GACvB,IAAI,CAKN;AAmID,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE;IACN,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GACA,WAAW,CA0Bb;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE;IACN,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GACA,WAAW,CAqBb;AAoID,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kHAAkH;IAClH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,iFAAiF;IACjF,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuB;IAC7C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAE/C,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAU;IAC7C;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;gBAErC,OAAO,EAAE,wBAAwB;IAY7C,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,WAAW;IAMnD,eAAe,CAAC,MAAM,EAAE,mBAAmB,GAAG,WAAW;IAKzD;;;;OAIG;IACH,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW;IAiB5D,OAAO,CAAC,MAAM;IA0Cd;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,WAAW,CAAC,KAAK,GAAE,MAA4C,GAAG,SAAS,WAAW,EAAE;IAsBxF,qBAAqB,IAAI,SAAS,WAAW,EAAE;IAI/C,UAAU,IAAI,YAAY;IAmB1B,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAQtC,OAAO,CAAC,aAAa;CAmBtB"}

package/dist/security/audit-trail.js

@@ -3,6 +3,7 @@
  * sensitive file access and destructive commands, and emits NR events for
  * alerting.
  */
+import { randomUUID } from 'node:crypto';
 import { createLogger } from '../shared/index.js';
 import { redactSensitive } from '../config.js';
 import { isSyntheticSessionId } from '../hooks/session-resolver.js';
@@ -250,6 +251,7 @@ function isAuditAction(value) {
         value === 'McpToolCall' ||
         value === 'AgentSpawn' ||
         value === 'Search' ||
+        value === 'HookInstall' ||
         value === 'Other');
 }
 function isAlertSeverity(value) {
@@ -362,6 +364,28 @@ export class AuditTrailManager {
         const detail = `McpToolCall: ${record.serverName}/${record.toolName}`;
         return this.commit(record, 'McpToolCall', detail);
     }
+    /**
+     * Records that `nr_observe_install_hooks` wrote Preflight's hook entries to
+     * `settingsPath`. Not a tool call, so there is no security alert to run.
+     * The entry is kept in memory and persisted like any other audit record.
+     */
+    recordHeadlessHookInstall(settingsPath) {
+        const auditRecord = {
+            id: randomUUID(),
+            timestamp: Date.now(),
+            sessionId: resolveAuditSessionId(null, this.sessionId),
+            action: 'HookInstall',
+            tool: 'nr_observe_install_hooks',
+            detail: `HookInstall: ${redactSensitive(settingsPath)}`,
+            developer: this.developer,
+        };
+        if (this.entries.length >= AuditTrailManager.MAX_ENTRIES)
+            this.entries.shift();
+        this.entries.push(auditRecord);
+        this.persistToDisk(auditRecord);
+        logger.info('Hook install recorded', { settingsPath: redactSensitive(settingsPath) });
+        return auditRecord;
+    }
     commit(record, action, detail) {
         const alert = detectSecurityAlert(record, this.rules);
         const rawFilePath = record.filePath;

package/dist/security/audit-trail.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-trail.js","sourceRoot":"","sources":["../../src/security/audit-trail.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKlD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAoD3C,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,+BAA+B,GAAa;IACvD,0BAA0B;IAC1B,sBAAsB;IACtB,iBAAiB;IACjB,SAAS;IACT,SAAS;IACT,yBAAyB;IACzB,6BAA6B;IAC7B,kBAAkB;IAClB,sCAAsC;IACtC,mBAAmB;IACnB,oBAAoB;IACpB,mCAAmC;CACpC,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAa;IAC5D,+DAA+D;IAC/D,wFAAwF;IACxF,kEAAkE;IAClE,iMAAiM;IACjM,gCAAgC;IAChC,uBAAuB;IACvB,2FAA2F;IAC3F,0DAA0D;IAC1D,sBAAsB;IACtB,2BAA2B;IAC3B,gFAAgF;IAChF,iEAAiE;IACjE,4DAA4D;IAC5D,wBAAwB;IACxB,mBAAmB;IACnB,sBAAsB;IACtB,oBAAoB;IACpB,iBAAiB;IACjB,yDAAyD;IACzD,2DAA2D;IAC3D,2DAA2D;IAC3D,8DAA8D;IAC9D,8DAA8D;CAC/D,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAa;IACxD,WAAW;IACX,WAAW;IACX,QAAQ;IACR,SAAS;CACV,CAAC;AAEF,MAAM,gCAAgC,GAAG,6CAA6C,CAAC;AAEvF,MAAM,CAAC,MAAM,iCAAiC,GAAa,CAAC,gCAAgC,CAAC,CAAC;AAE9F,MAAM,qBAAqB,GAA2C;IACpE,SAAS,EAAE,YAAY;IACvB,OAAO,EAAE,UAAU;IACnB,SAAS,EAAE,YAAY;CACxB,CAAC;AACF,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAEzD,CAAC;AAEF,MAAM,UAAU,sBAAsB,CACpC,MAAiD,EACjD,MAAwB;IAExB,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,MAAM,eAAe,GAAgC;IACnD,IAAI,EAAE,UAAU;IAChB,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,YAAY;IACnB,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,QAAQ;CACf,CAAC;AAEF,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC;AAC9C,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,WAAW,CAAC,MAAsB;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAA8B,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,OAA6B,CAAC;IACrD,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAsC,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,OAA6B,CAAC;IAErD,kEAAkE;IAClE,wEAAwE;IACxE,sEAAsE;IACtE,8DAA8D;IAC9D,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,QAAQ;QAAE,OAAO,GAAG,IAAI,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5D,IAAI,OAAO;QAAE,OAAO,GAAG,IAAI,KAAK,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,IAAI,gBAAgB;QAAE,OAAO,GAAG,IAAI,KAAK,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC;IAC7E,IAAI,OAAO;QAAE,OAAO,GAAG,IAAI,KAAK,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,SAAS,UAAU,CAAC,KAAa,EAAE,QAA2B;IAC5D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAoBD,MAAM,aAAa,GAAkC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAEzF,SAAS,eAAe,CAAC,CAAkB;IACzC,OAAO;QACL;YACE,SAAS,EAAE,qBAAqB;YAChC,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,CAAC,CAAC,WAAW;YACvB,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,IAAI;YAChD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC,CAAC,EAAE;SACtD;QACD;YACE,SAAS,EAAE,gBAAgB;YAC3B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,CAAC,CAAC,SAAS;YACrB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,EAAE;SACjD;QACD;YACE,SAAS,EAAE,kBAAkB;YAC7B,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,CAAC,CAAC,OAAO;YACnB,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI;YAC5C,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,CAAC,EAAE;SAClD;QACD;YACE,SAAS,EAAE,eAAe;YAC1B,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ;YAC1E,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;SACvC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAsB,EACtB,KAA2B;IAE3B,IAAI,IAA+B,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC9D,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjF,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACnF,IAAI,GAAG;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;SACnD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,UAAU,oBAAoB,CAClC,MAAmB,EACnB,KAKC;IAED,MAAM,KAAK,GAAgB;QACzB,SAAS,EAAE,cAAc;QACzB,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QAC9C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;IAEF,qBAAqB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1C,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEtC,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI;QAAE,KAAK,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI;QAAE,KAAK,CAAC,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE5E,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,KAAK,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC;QACrC,KAAK,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;QACxD,KAAK,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,sBAAsB,CAAC,GAAG,KAAK,CAAC;IACxC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAmB,EACnB,KAKC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAgB;QACzB,SAAS,EAAE,eAAe;QAC1B,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;IAEF,qBAAqB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1C,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEtC,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI;QAAE,KAAK,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI;QAAE,KAAK,CAAC,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAC5B,eAA0C,EAC1C,gBAA+B;IAE/B,MAAM,GAAG,GAAG,eAAe,IAAI,gBAAgB,CAAC;IAChD,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,CACL,KAAK,KAAK,UAAU;QACpB,KAAK,KAAK,WAAW;QACrB,KAAK,KAAK,UAAU;QACpB,KAAK,KAAK,aAAa;QACvB,KAAK,KAAK,aAAa;QACvB,KAAK,KAAK,YAAY;QACtB,KAAK,KAAK,QAAQ;QAClB,KAAK,KAAK,OAAO,CAClB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,CAAC;AACxE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC7D,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,IAAI,KAAK,QAAQ;QACxB,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,aAAa,CAAC,MAAM,CAAC,EACtB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;IACrC,MAAM,SAAS,GACb,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,EAAE,GACN,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,KAAK,CAAC,EAAE;QACV,CAAC,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAE/D,IAAI,aAAwC,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC;IACrC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,QAAmC,CAAC;QAC9C,IAAI,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnE,aAAa,GAAG;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,WAAW,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE;QACF,SAAS;QACT,SAAS;QACT,OAAO;QACP,SAAS;QACT,MAAM;QACN,IAAI;QACJ,MAAM;QACN,SAAS;QACT,QAAQ;QACR,OAAO;QACP,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;gEAGgE;AAChE,SAAS,gBAAgB,CACvB,CAAmE;IAEnE,OAAO,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AACrE,CAAC;AAkBD,MAAM,OAAO,iBAAiB;IACX,SAAS,CAAS;IAC3B,SAAS,CAAgB;IAChB,KAAK,CAAuB;IAC5B,UAAU,CAAoB;IAEvC,OAAO,GAAkB,EAAE,CAAC;IAC5B,kBAAkB,GAAkB,EAAE,CAAC;IACvC,MAAM,CAAU,WAAW,GAAG,MAAM,CAAC;IAC7C;;;;;;;;OAQG;IACK,MAAM,CAAU,iBAAiB,GAAG,IAAI,CAAC;IAEjD,YAAY,OAAiC;QAC3C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC;YAC3B,SAAS,EAAE,OAAO,CAAC,iBAAiB,IAAI,+BAA+B;YACvE,WAAW,EAAE,OAAO,CAAC,mBAAmB,IAAI,oCAAoC;YAChF,OAAO,EAAE,OAAO,CAAC,eAAe,IAAI,gCAAgC;YACpE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,IAAI,iCAAiC;SACxE,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC/C,CAAC;IAED,cAAc,CAAC,MAAsB;QACnC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,eAAe,CAAC,MAA2B;QACzC,MAAM,MAAM,GAAG,gBAAgB,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAEO,MAAM,CAAC,MAAsB,EAAE,MAAmB,EAAE,MAAc;QACxE,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAEtD,MAAM,WAAW,GAAG,MAAM,CAAC,QAA8B,CAAC;QAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,OAA6B,CAAC;QACxD,MAAM,WAAW,GAAgB;YAC/B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,qBAAqB,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;YAClE,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACxE,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAC9E,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,yEAAyE;YACzE,wEAAwE;YACxE,QAAQ,EAAE,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YACxE,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,aAAa,EAAE,KAAK;SACrB,CAAC;QAEF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,iBAAiB,CAAC,WAAW;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/B,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,iBAAiB,CAAC,WAAW;gBACjE,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1C,MAAM,YAAY,GAA8C;gBAC9D,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,MAAM;aACP,CAAC;YACF,sBAAsB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAChC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,WAAW,CAAC,QAAgB,iBAAiB,CAAC,iBAAiB;QAC7D,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACrD,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM;oBAAE,SAAS;gBACtB,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,iEAAiE;QACjE,uEAAuE;QACvE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5E,CAAC;IAED,qBAAqB;QACnB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,UAAU;QACR,MAAM,gBAAgB,GAA2B,EAAE,CAAC;QACpD,IAAI,cAAc,GAAG,CAAC,CAAC;QAEvB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,cAAc,EAAE,CAAC;gBACjB,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC;gBACzC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YACjC,cAAc;YACd,gBAAgB;SACjB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAyB;QAC7B,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,kBAAkB,GAAG,EAAE,CAAC;QAC7B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,MAAmB;QACvC,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QAC7B,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;YAC7B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACjC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE;gBACxF,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC"}
+{"version":3,"file":"audit-trail.js","sourceRoot":"","sources":["../../src/security/audit-trail.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKlD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAqD3C,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,+BAA+B,GAAa;IACvD,0BAA0B;IAC1B,sBAAsB;IACtB,iBAAiB;IACjB,SAAS;IACT,SAAS;IACT,yBAAyB;IACzB,6BAA6B;IAC7B,kBAAkB;IAClB,sCAAsC;IACtC,mBAAmB;IACnB,oBAAoB;IACpB,mCAAmC;CACpC,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAa;IAC5D,+DAA+D;IAC/D,wFAAwF;IACxF,kEAAkE;IAClE,iMAAiM;IACjM,gCAAgC;IAChC,uBAAuB;IACvB,2FAA2F;IAC3F,0DAA0D;IAC1D,sBAAsB;IACtB,2BAA2B;IAC3B,gFAAgF;IAChF,iEAAiE;IACjE,4DAA4D;IAC5D,wBAAwB;IACxB,mBAAmB;IACnB,sBAAsB;IACtB,oBAAoB;IACpB,iBAAiB;IACjB,yDAAyD;IACzD,2DAA2D;IAC3D,2DAA2D;IAC3D,8DAA8D;IAC9D,8DAA8D;CAC/D,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAa;IACxD,WAAW;IACX,WAAW;IACX,QAAQ;IACR,SAAS;CACV,CAAC;AAEF,MAAM,gCAAgC,GAAG,6CAA6C,CAAC;AAEvF,MAAM,CAAC,MAAM,iCAAiC,GAAa,CAAC,gCAAgC,CAAC,CAAC;AAE9F,MAAM,qBAAqB,GAA2C;IACpE,SAAS,EAAE,YAAY;IACvB,OAAO,EAAE,UAAU;IACnB,SAAS,EAAE,YAAY;CACxB,CAAC;AACF,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAEzD,CAAC;AAEF,MAAM,UAAU,sBAAsB,CACpC,MAAiD,EACjD,MAAwB;IAExB,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,MAAM,eAAe,GAAgC;IACnD,IAAI,EAAE,UAAU;IAChB,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,YAAY;IACnB,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,QAAQ;CACf,CAAC;AAEF,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC;AAC9C,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,WAAW,CAAC,MAAsB;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAA8B,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,OAA6B,CAAC;IACrD,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAsC,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,OAA6B,CAAC;IAErD,kEAAkE;IAClE,wEAAwE;IACxE,sEAAsE;IACtE,8DAA8D;IAC9D,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,QAAQ;QAAE,OAAO,GAAG,IAAI,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5D,IAAI,OAAO;QAAE,OAAO,GAAG,IAAI,KAAK,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,IAAI,gBAAgB;QAAE,OAAO,GAAG,IAAI,KAAK,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC;IAC7E,IAAI,OAAO;QAAE,OAAO,GAAG,IAAI,KAAK,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,SAAS,UAAU,CAAC,KAAa,EAAE,QAA2B;IAC5D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAoBD,MAAM,aAAa,GAAkC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAEzF,SAAS,eAAe,CAAC,CAAkB;IACzC,OAAO;QACL;YACE,SAAS,EAAE,qBAAqB;YAChC,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,CAAC,CAAC,WAAW;YACvB,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,IAAI;YAChD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC,CAAC,EAAE;SACtD;QACD;YACE,SAAS,EAAE,gBAAgB;YAC3B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,CAAC,CAAC,SAAS;YACrB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,EAAE;SACjD;QACD;YACE,SAAS,EAAE,kBAAkB;YAC7B,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,CAAC,CAAC,OAAO;YACnB,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI;YAC5C,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,CAAC,EAAE;SAClD;QACD;YACE,SAAS,EAAE,eAAe;YAC1B,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ;YAC1E,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;SACvC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAsB,EACtB,KAA2B;IAE3B,IAAI,IAA+B,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC9D,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjF,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACnF,IAAI,GAAG;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;SACnD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,UAAU,oBAAoB,CAClC,MAAmB,EACnB,KAKC;IAED,MAAM,KAAK,GAAgB;QACzB,SAAS,EAAE,cAAc;QACzB,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QAC9C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;IAEF,qBAAqB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1C,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEtC,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI;QAAE,KAAK,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI;QAAE,KAAK,CAAC,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE5E,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,KAAK,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC;QACrC,KAAK,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;QACxD,KAAK,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,sBAAsB,CAAC,GAAG,KAAK,CAAC;IACxC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAmB,EACnB,KAKC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAgB;QACzB,SAAS,EAAE,eAAe;QAC1B,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;IAEF,qBAAqB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1C,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEtC,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI;QAAE,KAAK,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI;QAAE,KAAK,CAAC,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAC5B,eAA0C,EAC1C,gBAA+B;IAE/B,MAAM,GAAG,GAAG,eAAe,IAAI,gBAAgB,CAAC;IAChD,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,CACL,KAAK,KAAK,UAAU;QACpB,KAAK,KAAK,WAAW;QACrB,KAAK,KAAK,UAAU;QACpB,KAAK,KAAK,aAAa;QACvB,KAAK,KAAK,aAAa;QACvB,KAAK,KAAK,YAAY;QACtB,KAAK,KAAK,QAAQ;QAClB,KAAK,KAAK,aAAa;QACvB,KAAK,KAAK,OAAO,CAClB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,CAAC;AACxE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC7D,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,IAAI,KAAK,QAAQ;QACxB,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,aAAa,CAAC,MAAM,CAAC,EACtB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;IACrC,MAAM,SAAS,GACb,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,EAAE,GACN,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,KAAK,CAAC,EAAE;QACV,CAAC,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAE/D,IAAI,aAAwC,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC;IACrC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,QAAmC,CAAC;QAC9C,IAAI,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnE,aAAa,GAAG;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,WAAW,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE;QACF,SAAS;QACT,SAAS;QACT,OAAO;QACP,SAAS;QACT,MAAM;QACN,IAAI;QACJ,MAAM;QACN,SAAS;QACT,QAAQ;QACR,OAAO;QACP,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;gEAGgE;AAChE,SAAS,gBAAgB,CACvB,CAAmE;IAEnE,OAAO,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AACrE,CAAC;AAkBD,MAAM,OAAO,iBAAiB;IACX,SAAS,CAAS;IAC3B,SAAS,CAAgB;IAChB,KAAK,CAAuB;IAC5B,UAAU,CAAoB;IAEvC,OAAO,GAAkB,EAAE,CAAC;IAC5B,kBAAkB,GAAkB,EAAE,CAAC;IACvC,MAAM,CAAU,WAAW,GAAG,MAAM,CAAC;IAC7C;;;;;;;;OAQG;IACK,MAAM,CAAU,iBAAiB,GAAG,IAAI,CAAC;IAEjD,YAAY,OAAiC;QAC3C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC;YAC3B,SAAS,EAAE,OAAO,CAAC,iBAAiB,IAAI,+BAA+B;YACvE,WAAW,EAAE,OAAO,CAAC,mBAAmB,IAAI,oCAAoC;YAChF,OAAO,EAAE,OAAO,CAAC,eAAe,IAAI,gCAAgC;YACpE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,IAAI,iCAAiC;SACxE,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC/C,CAAC;IAED,cAAc,CAAC,MAAsB;QACnC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,eAAe,CAAC,MAA2B;QACzC,MAAM,MAAM,GAAG,gBAAgB,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,yBAAyB,CAAC,YAAoB;QAC5C,MAAM,WAAW,GAAgB;YAC/B,EAAE,EAAE,UAAU,EAAE;YAChB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACtD,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,gBAAgB,eAAe,CAAC,YAAY,CAAC,EAAE;YACvD,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,iBAAiB,CAAC,WAAW;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/B,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,YAAY,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACtF,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,MAAsB,EAAE,MAAmB,EAAE,MAAc;QACxE,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAEtD,MAAM,WAAW,GAAG,MAAM,CAAC,QAA8B,CAAC;QAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,OAA6B,CAAC;QACxD,MAAM,WAAW,GAAgB;YAC/B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,qBAAqB,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;YAClE,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACxE,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAC9E,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,yEAAyE;YACzE,wEAAwE;YACxE,QAAQ,EAAE,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YACxE,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,aAAa,EAAE,KAAK;SACrB,CAAC;QAEF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,iBAAiB,CAAC,WAAW;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/B,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,iBAAiB,CAAC,WAAW;gBACjE,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1C,MAAM,YAAY,GAA8C;gBAC9D,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,IAAI,EAAE,MAAM,CAAC,QAAQ;gBACrB,MAAM;aACP,CAAC;YACF,sBAAsB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAChC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,WAAW,CAAC,QAAgB,iBAAiB,CAAC,iBAAiB;QAC7D,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACrD,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM;oBAAE,SAAS;gBACtB,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACrC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,iEAAiE;QACjE,uEAAuE;QACvE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5E,CAAC;IAED,qBAAqB;QACnB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,UAAU;QACR,MAAM,gBAAgB,GAA2B,EAAE,CAAC;QACpD,IAAI,cAAc,GAAG,CAAC,CAAC;QAEvB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,cAAc,EAAE,CAAC;gBACjB,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC;gBACzC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YACjC,cAAc;YACd,gBAAgB;SACjB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAyB;QAC7B,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,kBAAkB,GAAG,EAAE,CAAC;QAC7B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,MAAmB;QACvC,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QAC7B,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;YAC7B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACjC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE;gBACxF,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAUnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAOhD,qBAAa,WAAW;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,kBAAkB,CAAoE;IAE9F,IAAI,iBAAiB,IAAI,OAAO,2BAA2B,EAAE,iBAAiB,GAAG,SAAS,CAEzF;IAED,IAAI,iBAAiB,CAAC,KAAK,EAAE,OAAO,2BAA2B,EAAE,iBAAiB,GAAG,SAAS,EAE7F;gBAEW,OAAO,EAAE,aAAa;IAyBlC,OAAO,CAAC,gBAAgB;IA6DlB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnC;;;;;;;;;;;;;;OAcG;IACG,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAStC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B;AAED,wBAAgB,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,WAAW,CAuB1E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAUnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAOhD,qBAAa,WAAW;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,kBAAkB,CAAoE;IAE9F,IAAI,iBAAiB,IAAI,OAAO,2BAA2B,EAAE,iBAAiB,GAAG,SAAS,CAEzF;IAED,IAAI,iBAAiB,CAAC,KAAK,EAAE,OAAO,2BAA2B,EAAE,iBAAiB,GAAG,SAAS,EAE7F;gBAEW,OAAO,EAAE,aAAa;IAyBlC,OAAO,CAAC,gBAAgB;IAkElB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnC;;;;;;;;;;;;;;OAcG;IACG,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAStC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B;AAED,wBAAgB,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,WAAW,CAuB1E"}

package/dist/server.js

@@ -4,8 +4,8 @@ import { ListResourcesRequestSchema, ReadResourceRequestSchema, ErrorCode, McpEr
 import { createLogger } from './shared/index.js';
 import { VERSION } from './version.js';
 import { registerTools } from './tools/session-stats.js';
-import { readAndCheckHooks } from './install/install-helper.js';
-import { installHooksHeadless } from './install/headless-install.js';
+import { areHooksInstalledAtAnyScope } from './install/install-helper.js';
+import { createHeadlessInstaller } from './install/headless-install.js';
 const logger = createLogger('mcp-server');
 export class NrMcpServer {
     server;
@@ -54,8 +54,13 @@ export class NrMcpServer {
             teamId: options.teamId,
             projectId: options.projectId,
             sessionStartMs: serverStartMs,
-            hooksInstalledFn: () => readAndCheckHooks(),
-            headlessInstaller: installHooksHeadless,
+            hooksInstalledFn: () => areHooksInstalledAtAnyScope(),
+            // Refuses by default. index.ts re-registers the tools with the configured
+            // allowHeadlessInstall once config loads, so this initial set never enables it.
+            headlessInstaller: createHeadlessInstaller({
+                allowHeadlessInstall: false,
+                getAuditTrail: () => this.auditTrailManager,
+            }),
         });
         this.server.setRequestHandler(ListResourcesRequestSchema, async () => {
             const resources = [];