@pickle-pee/runtime 0.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (149) hide show
  1. package/README.md +99 -0
  2. package/dist/adapters/index.d.ts +3 -0
  3. package/dist/adapters/index.js +10 -0
  4. package/dist/adapters/index.js.map +1 -0
  5. package/dist/adapters/kernel-session-adapter.d.ts +73 -0
  6. package/dist/adapters/kernel-session-adapter.js +10 -0
  7. package/dist/adapters/kernel-session-adapter.js.map +1 -0
  8. package/dist/adapters/pi-mono-event-bridge.d.ts +54 -0
  9. package/dist/adapters/pi-mono-event-bridge.js +159 -0
  10. package/dist/adapters/pi-mono-event-bridge.js.map +1 -0
  11. package/dist/adapters/pi-mono-session-adapter.d.ts +75 -0
  12. package/dist/adapters/pi-mono-session-adapter.js +490 -0
  13. package/dist/adapters/pi-mono-session-adapter.js.map +1 -0
  14. package/dist/create-app-runtime.d.ts +52 -0
  15. package/dist/create-app-runtime.js +163 -0
  16. package/dist/create-app-runtime.js.map +1 -0
  17. package/dist/domain/index.d.ts +1 -0
  18. package/dist/domain/index.js +5 -0
  19. package/dist/domain/index.js.map +1 -0
  20. package/dist/events/event-bus.d.ts +23 -0
  21. package/dist/events/event-bus.js +85 -0
  22. package/dist/events/event-bus.js.map +1 -0
  23. package/dist/events/index.d.ts +3 -0
  24. package/dist/events/index.js +6 -0
  25. package/dist/events/index.js.map +1 -0
  26. package/dist/events/runtime-event.d.ts +158 -0
  27. package/dist/events/runtime-event.js +13 -0
  28. package/dist/events/runtime-event.js.map +1 -0
  29. package/dist/governance/tool-governor.d.ts +63 -0
  30. package/dist/governance/tool-governor.js +639 -0
  31. package/dist/governance/tool-governor.js.map +1 -0
  32. package/dist/index.d.ts +33 -0
  33. package/dist/index.js +76 -0
  34. package/dist/index.js.map +1 -0
  35. package/dist/planning/index.d.ts +6 -0
  36. package/dist/planning/index.js +16 -0
  37. package/dist/planning/index.js.map +1 -0
  38. package/dist/planning/plan-engine.d.ts +49 -0
  39. package/dist/planning/plan-engine.js +174 -0
  40. package/dist/planning/plan-engine.js.map +1 -0
  41. package/dist/planning/plan-events.d.ts +14 -0
  42. package/dist/planning/plan-events.js +94 -0
  43. package/dist/planning/plan-events.js.map +1 -0
  44. package/dist/planning/plan-orchestrator.d.ts +56 -0
  45. package/dist/planning/plan-orchestrator.js +167 -0
  46. package/dist/planning/plan-orchestrator.js.map +1 -0
  47. package/dist/planning/plan-types.d.ts +36 -0
  48. package/dist/planning/plan-types.js +9 -0
  49. package/dist/planning/plan-types.js.map +1 -0
  50. package/dist/runtime-context.d.ts +21 -0
  51. package/dist/runtime-context.js +37 -0
  52. package/dist/runtime-context.js.map +1 -0
  53. package/dist/services/event-normalizer.d.ts +22 -0
  54. package/dist/services/event-normalizer.js +162 -0
  55. package/dist/services/event-normalizer.js.map +1 -0
  56. package/dist/services/index.d.ts +1 -0
  57. package/dist/services/index.js +7 -0
  58. package/dist/services/index.js.map +1 -0
  59. package/dist/session/session-events.d.ts +11 -0
  60. package/dist/session/session-events.js +52 -0
  61. package/dist/session/session-events.js.map +1 -0
  62. package/dist/session/session-facade.d.ts +88 -0
  63. package/dist/session/session-facade.js +439 -0
  64. package/dist/session/session-facade.js.map +1 -0
  65. package/dist/session/session-state.d.ts +14 -0
  66. package/dist/session/session-state.js +75 -0
  67. package/dist/session/session-state.js.map +1 -0
  68. package/dist/subagent/aggregation.d.ts +25 -0
  69. package/dist/subagent/aggregation.js +124 -0
  70. package/dist/subagent/aggregation.js.map +1 -0
  71. package/dist/subagent/index.d.ts +10 -0
  72. package/dist/subagent/index.js +29 -0
  73. package/dist/subagent/index.js.map +1 -0
  74. package/dist/subagent/path-scope.d.ts +24 -0
  75. package/dist/subagent/path-scope.js +86 -0
  76. package/dist/subagent/path-scope.js.map +1 -0
  77. package/dist/subagent/result-types.d.ts +61 -0
  78. package/dist/subagent/result-types.js +9 -0
  79. package/dist/subagent/result-types.js.map +1 -0
  80. package/dist/subagent/stop-condition.d.ts +34 -0
  81. package/dist/subagent/stop-condition.js +76 -0
  82. package/dist/subagent/stop-condition.js.map +1 -0
  83. package/dist/subagent/task-types.d.ts +48 -0
  84. package/dist/subagent/task-types.js +10 -0
  85. package/dist/subagent/task-types.js.map +1 -0
  86. package/dist/subagent/task-validator.d.ts +22 -0
  87. package/dist/subagent/task-validator.js +79 -0
  88. package/dist/subagent/task-validator.js.map +1 -0
  89. package/dist/subagent/verification.d.ts +22 -0
  90. package/dist/subagent/verification.js +55 -0
  91. package/dist/subagent/verification.js.map +1 -0
  92. package/dist/test/aggregation.test.d.ts +1 -0
  93. package/dist/test/aggregation.test.js +201 -0
  94. package/dist/test/aggregation.test.js.map +1 -0
  95. package/dist/test/create-app-runtime.test.d.ts +1 -0
  96. package/dist/test/create-app-runtime.test.js +286 -0
  97. package/dist/test/create-app-runtime.test.js.map +1 -0
  98. package/dist/test/event-bus.test.d.ts +1 -0
  99. package/dist/test/event-bus.test.js +81 -0
  100. package/dist/test/event-bus.test.js.map +1 -0
  101. package/dist/test/event-normalizer.test.d.ts +1 -0
  102. package/dist/test/event-normalizer.test.js +143 -0
  103. package/dist/test/event-normalizer.test.js.map +1 -0
  104. package/dist/test/path-scope.test.d.ts +1 -0
  105. package/dist/test/path-scope.test.js +71 -0
  106. package/dist/test/path-scope.test.js.map +1 -0
  107. package/dist/test/pi-mono-event-bridge.test.d.ts +1 -0
  108. package/dist/test/pi-mono-event-bridge.test.js +125 -0
  109. package/dist/test/pi-mono-event-bridge.test.js.map +1 -0
  110. package/dist/test/pi-mono-live.test.d.ts +1 -0
  111. package/dist/test/pi-mono-live.test.js +289 -0
  112. package/dist/test/pi-mono-live.test.js.map +1 -0
  113. package/dist/test/pi-mono-session-adapter.test.d.ts +1 -0
  114. package/dist/test/pi-mono-session-adapter.test.js +260 -0
  115. package/dist/test/pi-mono-session-adapter.test.js.map +1 -0
  116. package/dist/test/plan-engine.test.d.ts +1 -0
  117. package/dist/test/plan-engine.test.js +235 -0
  118. package/dist/test/plan-engine.test.js.map +1 -0
  119. package/dist/test/plan-events.test.d.ts +1 -0
  120. package/dist/test/plan-events.test.js +81 -0
  121. package/dist/test/plan-events.test.js.map +1 -0
  122. package/dist/test/plan-orchestrator.test.d.ts +1 -0
  123. package/dist/test/plan-orchestrator.test.js +324 -0
  124. package/dist/test/plan-orchestrator.test.js.map +1 -0
  125. package/dist/test/runtime-context.test.d.ts +1 -0
  126. package/dist/test/runtime-context.test.js +70 -0
  127. package/dist/test/runtime-context.test.js.map +1 -0
  128. package/dist/test/session-facade.test.d.ts +1 -0
  129. package/dist/test/session-facade.test.js +1011 -0
  130. package/dist/test/session-facade.test.js.map +1 -0
  131. package/dist/test/session-state.test.d.ts +1 -0
  132. package/dist/test/session-state.test.js +118 -0
  133. package/dist/test/session-state.test.js.map +1 -0
  134. package/dist/test/stop-condition.test.d.ts +1 -0
  135. package/dist/test/stop-condition.test.js +105 -0
  136. package/dist/test/stop-condition.test.js.map +1 -0
  137. package/dist/test/stubs/stub-kernel-session-adapter.d.ts +45 -0
  138. package/dist/test/stubs/stub-kernel-session-adapter.js +186 -0
  139. package/dist/test/stubs/stub-kernel-session-adapter.js.map +1 -0
  140. package/dist/test/task-validator.test.d.ts +1 -0
  141. package/dist/test/task-validator.test.js +97 -0
  142. package/dist/test/task-validator.test.js.map +1 -0
  143. package/dist/test/tool-governor.test.d.ts +1 -0
  144. package/dist/test/tool-governor.test.js +379 -0
  145. package/dist/test/tool-governor.test.js.map +1 -0
  146. package/dist/types/index.d.ts +77 -0
  147. package/dist/types/index.js +9 -0
  148. package/dist/types/index.js.map +1 -0
  149. package/package.json +28 -0
@@ -0,0 +1,639 @@
1
+ "use strict";
2
+ /**
3
+ * ToolGovernor — the runtime integration point for tool governance.
4
+ *
5
+ * Wraps ToolCatalog, PermissionEngine, MutationQueue, and AuditLog into a
6
+ * single object that the SessionFacade uses to enforce governance on every
7
+ * tool execution event. The governor is created once per AppRuntime and
8
+ * shared across all sessions.
9
+ *
10
+ * Lifecycle:
11
+ * 1. beforeExecution() — called when a tool_starts event arrives
12
+ * 2. afterExecution() — called when a tool_completed event arrives
13
+ * 3. recordSessionApproval() — called when user grants session approval
14
+ */
15
+ Object.defineProperty(exports, "__esModule", { value: true });
16
+ exports.createToolGovernor = createToolGovernor;
17
+ const node_crypto_1 = require("node:crypto");
18
+ const tools_1 = require("@pickle-pee/tools");
19
+ const SIMPLE_ARG_PATTERN = /^[./~:@A-Za-z0-9_=-]+$/;
20
+ const LS_SAFE_FLAG_CHARS = new Set(["a", "A", "l", "h", "F", "G", "1", "t", "r", "S", "d"]);
21
+ const PWD_SAFE_FLAG_CHARS = new Set(["L", "P"]);
22
+ const GREP_SAFE_FLAGS = new Set([
23
+ "-n",
24
+ "--line-number",
25
+ "-i",
26
+ "--ignore-case",
27
+ "-F",
28
+ "--fixed-strings",
29
+ "-E",
30
+ "--extended-regexp",
31
+ "-G",
32
+ "--basic-regexp",
33
+ "-P",
34
+ "--perl-regexp",
35
+ "-w",
36
+ "--word-regexp",
37
+ "-x",
38
+ "--line-regexp",
39
+ "-v",
40
+ "--invert-match",
41
+ "-c",
42
+ "--count",
43
+ "-l",
44
+ "--files-with-matches",
45
+ "-L",
46
+ "--files-without-match",
47
+ "-H",
48
+ "-h",
49
+ "-o",
50
+ "--only-matching",
51
+ "-q",
52
+ "--quiet",
53
+ "-s",
54
+ "--no-messages",
55
+ "-r",
56
+ "-R",
57
+ "--recursive",
58
+ "-m",
59
+ "--max-count",
60
+ "-A",
61
+ "--after-context",
62
+ "-B",
63
+ "--before-context",
64
+ "-C",
65
+ "--context",
66
+ "-e",
67
+ "--regexp",
68
+ "-f",
69
+ "--file",
70
+ "--include",
71
+ "--exclude",
72
+ "--exclude-dir",
73
+ "--binary-files",
74
+ "--color",
75
+ "--help",
76
+ "--version",
77
+ "--",
78
+ ]);
79
+ const GREP_FLAGS_WITH_VALUE = new Set([
80
+ "-m",
81
+ "--max-count",
82
+ "-A",
83
+ "--after-context",
84
+ "-B",
85
+ "--before-context",
86
+ "-C",
87
+ "--context",
88
+ "-e",
89
+ "--regexp",
90
+ "-f",
91
+ "--file",
92
+ "--include",
93
+ "--exclude",
94
+ "--exclude-dir",
95
+ "--binary-files",
96
+ "--color",
97
+ ]);
98
+ const RG_SAFE_FLAGS = new Set([
99
+ "-e",
100
+ "--regexp",
101
+ "-f",
102
+ "-i",
103
+ "--ignore-case",
104
+ "-S",
105
+ "--smart-case",
106
+ "-F",
107
+ "--fixed-strings",
108
+ "-w",
109
+ "--word-regexp",
110
+ "-v",
111
+ "--invert-match",
112
+ "-c",
113
+ "--count",
114
+ "-l",
115
+ "--files-with-matches",
116
+ "--files-without-match",
117
+ "-n",
118
+ "--line-number",
119
+ "-o",
120
+ "--only-matching",
121
+ "-A",
122
+ "--after-context",
123
+ "-B",
124
+ "--before-context",
125
+ "-C",
126
+ "--context",
127
+ "-H",
128
+ "-h",
129
+ "--heading",
130
+ "--no-heading",
131
+ "-q",
132
+ "--quiet",
133
+ "--column",
134
+ "-g",
135
+ "--glob",
136
+ "-t",
137
+ "--type",
138
+ "-T",
139
+ "--type-not",
140
+ "--type-list",
141
+ "--hidden",
142
+ "--no-ignore",
143
+ "-u",
144
+ "-m",
145
+ "--max-count",
146
+ "--max-depth",
147
+ "-L",
148
+ "--follow",
149
+ "--color",
150
+ "--json",
151
+ "--stats",
152
+ "--help",
153
+ "--version",
154
+ "--debug",
155
+ "--",
156
+ ]);
157
+ const FD_SAFE_FLAGS = new Set([
158
+ "-H",
159
+ "--hidden",
160
+ "-I",
161
+ "--no-ignore",
162
+ "-u",
163
+ "-L",
164
+ "--follow",
165
+ "-p",
166
+ "--full-path",
167
+ "-0",
168
+ "--print0",
169
+ "-a",
170
+ "--absolute-path",
171
+ "-l",
172
+ "--list-details",
173
+ "-t",
174
+ "--type",
175
+ "-e",
176
+ "--extension",
177
+ "-g",
178
+ "--glob",
179
+ "-E",
180
+ "--exclude",
181
+ "-d",
182
+ "--max-depth",
183
+ "-c",
184
+ "--color",
185
+ "-s",
186
+ "--case-sensitive",
187
+ "-i",
188
+ "--ignore-case",
189
+ "--and",
190
+ "--or",
191
+ "--size",
192
+ "--changed-within",
193
+ "--changed-before",
194
+ "--base-directory",
195
+ "--search-path",
196
+ "--strip-cwd-prefix",
197
+ "--help",
198
+ "--version",
199
+ "--",
200
+ ]);
201
+ const FD_FLAGS_WITH_VALUE = new Set([
202
+ "-t",
203
+ "--type",
204
+ "-e",
205
+ "--extension",
206
+ "-g",
207
+ "--glob",
208
+ "-E",
209
+ "--exclude",
210
+ "-d",
211
+ "--max-depth",
212
+ "-c",
213
+ "--color",
214
+ "--size",
215
+ "--changed-within",
216
+ "--changed-before",
217
+ "--base-directory",
218
+ "--search-path",
219
+ ]);
220
+ const FIND_DANGEROUS_FLAGS = new Set([
221
+ "-delete",
222
+ "-exec",
223
+ "-execdir",
224
+ "-ok",
225
+ "-okdir",
226
+ "-fprint",
227
+ "-fprint0",
228
+ "-fprintf",
229
+ "-fls",
230
+ ]);
231
+ const RG_FLAGS_WITH_VALUE = new Set([
232
+ "-e",
233
+ "--regexp",
234
+ "-f",
235
+ "-A",
236
+ "--after-context",
237
+ "-B",
238
+ "--before-context",
239
+ "-C",
240
+ "--context",
241
+ "-g",
242
+ "--glob",
243
+ "-t",
244
+ "--type",
245
+ "-T",
246
+ "--type-not",
247
+ "-m",
248
+ "--max-count",
249
+ "--max-depth",
250
+ "--color",
251
+ ]);
252
+ const GENERIC_READONLY_SHELL_COMMANDS = new Set(["cat", "head", "tail", "wc"]);
253
+ // ---------------------------------------------------------------------------
254
+ // Factory
255
+ // ---------------------------------------------------------------------------
256
+ function createToolGovernor() {
257
+ const catalog = (0, tools_1.createToolCatalog)();
258
+ const permissions = (0, tools_1.createPermissionEngine)();
259
+ const mutations = (0, tools_1.createMutationQueue)();
260
+ const audit = (0, tools_1.createAuditLog)();
261
+ const activeExecutions = new Map();
262
+ const sessionApprovals = [];
263
+ function deriveCommandDigest(parameters, explicitDigest) {
264
+ if (explicitDigest)
265
+ return explicitDigest;
266
+ const command = parameters?.command;
267
+ if (typeof command !== "string" || command.length === 0) {
268
+ return undefined;
269
+ }
270
+ return `sha256:${(0, node_crypto_1.createHash)("sha256").update(command).digest("hex")}`;
271
+ }
272
+ function recordDeniedAudit(toolName, toolCallId, riskLevel, reason, targetPath) {
273
+ const toolDef = catalog.get(toolName);
274
+ const now = Date.now();
275
+ const entry = {
276
+ id: `audit_${toolCallId}`,
277
+ toolCallId,
278
+ toolName,
279
+ category: toolDef?.identity.category ?? "unknown",
280
+ status: "denied",
281
+ riskLevel,
282
+ startedAt: now,
283
+ completedAt: now,
284
+ durationMs: 0,
285
+ targetPath,
286
+ error: reason,
287
+ permissionDecision: "deny",
288
+ };
289
+ audit.record(entry);
290
+ }
291
+ return {
292
+ beforeExecution(context) {
293
+ const { sessionId, toolName, toolCallId, workingDirectory, sessionMode, isSubAgent, targetPath, commandDigest, parameters, } = context;
294
+ // 1. Look up tool in catalog
295
+ const toolDef = catalog.get(toolName);
296
+ if (!toolDef) {
297
+ recordDeniedAudit(toolName, toolCallId, "L4", `Tool "${toolName}" is not registered in the catalog`, targetPath);
298
+ return {
299
+ type: "deny",
300
+ reason: `Tool "${toolName}" is not registered in the catalog`,
301
+ riskLevel: "L4",
302
+ };
303
+ }
304
+ // 2. Build PermissionContext from tool definition + execution context
305
+ const command = parameters?.command;
306
+ const effectiveRiskLevel = typeof command === "string" && (0, tools_1.isDestructiveCommand)(command) ? "L4" : (0, tools_1.classifyRisk)(toolDef, parameters);
307
+ const effectiveCommandDigest = deriveCommandDigest(parameters, commandDigest);
308
+ const autoAllowReadOnlyBash = toolName === "bash" && typeof command === "string" && isAutoAllowedReadOnlyBashCommand(command);
309
+ if (autoAllowReadOnlyBash) {
310
+ activeExecutions.set(toolCallId, { toolName, targetPath, riskLevel: effectiveRiskLevel });
311
+ return { type: "allow" };
312
+ }
313
+ const matchingSessionApproval = sessionApprovals.find((entry) => matchesSessionApproval(entry, sessionId, toolName, effectiveRiskLevel, targetPath, effectiveCommandDigest));
314
+ const permContext = {
315
+ sessionId,
316
+ toolIdentity: toolDef.identity,
317
+ toolPolicy: { ...toolDef.policy, riskLevel: effectiveRiskLevel },
318
+ targetPath,
319
+ commandDigest: effectiveCommandDigest,
320
+ workingDirectory,
321
+ sessionMode,
322
+ isSubAgent,
323
+ toolCallId,
324
+ };
325
+ // 3. Evaluate permission
326
+ if (!matchingSessionApproval) {
327
+ const decision = permissions.evaluate(permContext);
328
+ if (decision.verdict === "deny") {
329
+ recordDeniedAudit(toolName, toolCallId, decision.riskLevel, decision.reason ?? "Permission denied", targetPath);
330
+ return {
331
+ type: "deny",
332
+ reason: decision.reason ?? `Permission denied for "${toolName}"`,
333
+ riskLevel: decision.riskLevel,
334
+ };
335
+ }
336
+ if (decision.verdict === "ask_user") {
337
+ return {
338
+ type: "ask_user",
339
+ reason: decision.reason ?? `Tool "${toolName}" requires confirmation`,
340
+ riskLevel: decision.riskLevel,
341
+ };
342
+ }
343
+ }
344
+ // 4. Check mutation queue for per_target concurrency
345
+ if (toolDef.policy.concurrency === "per_target" && targetPath) {
346
+ const enqueueResult = mutations.enqueue({
347
+ filePath: targetPath,
348
+ toolCallId,
349
+ });
350
+ if (enqueueResult.type === "conflict") {
351
+ recordDeniedAudit(toolName, toolCallId, effectiveRiskLevel, enqueueResult.message, targetPath);
352
+ return {
353
+ type: "deny",
354
+ reason: enqueueResult.message,
355
+ riskLevel: effectiveRiskLevel,
356
+ };
357
+ }
358
+ }
359
+ activeExecutions.set(toolCallId, { toolName, targetPath, riskLevel: effectiveRiskLevel });
360
+ return { type: "allow" };
361
+ },
362
+ afterExecution(result) {
363
+ const { toolCallId, toolName, status, targetPath, durationMs } = result;
364
+ const active = activeExecutions.get(toolCallId);
365
+ // 1. Release mutation queue entry if applicable
366
+ const toolDef = catalog.get(active?.toolName ?? toolName);
367
+ if (toolDef?.policy.concurrency === "per_target") {
368
+ mutations.complete(toolCallId);
369
+ }
370
+ // 2. Record in audit log
371
+ const now = Date.now();
372
+ const entry = {
373
+ id: `audit_${toolCallId}`,
374
+ toolCallId,
375
+ toolName,
376
+ category: toolDef?.identity.category ?? "unknown",
377
+ status,
378
+ riskLevel: active?.riskLevel ?? toolDef?.policy.riskLevel ?? "L4",
379
+ startedAt: durationMs ? now - durationMs : now,
380
+ completedAt: now,
381
+ durationMs: durationMs ?? 0,
382
+ targetPath: targetPath ?? active?.targetPath,
383
+ };
384
+ audit.record(entry);
385
+ activeExecutions.delete(toolCallId);
386
+ },
387
+ recordSessionApproval(entry) {
388
+ sessionApprovals.push(entry);
389
+ permissions.recordApproval(entry);
390
+ },
391
+ get catalog() {
392
+ return catalog;
393
+ },
394
+ get permissions() {
395
+ return permissions;
396
+ },
397
+ get mutations() {
398
+ return mutations;
399
+ },
400
+ get audit() {
401
+ return audit;
402
+ },
403
+ };
404
+ }
405
+ function isAutoAllowedReadOnlyBashCommand(command) {
406
+ const tokens = tokenizeShellCommand(command);
407
+ if (tokens === null || tokens.length === 0) {
408
+ return false;
409
+ }
410
+ const head = tokens[0];
411
+ if (head === "pwd") {
412
+ return tokens.slice(1).every((token) => isSafeShortFlag(token, PWD_SAFE_FLAG_CHARS));
413
+ }
414
+ if (head === "ls") {
415
+ return tokens
416
+ .slice(1)
417
+ .every((token) => isSafeShortFlag(token, LS_SAFE_FLAG_CHARS) || SIMPLE_ARG_PATTERN.test(token));
418
+ }
419
+ if (GENERIC_READONLY_SHELL_COMMANDS.has(head)) {
420
+ return tokens.slice(1).every((token) => !hasUnsafeShellContent(token));
421
+ }
422
+ if (head === "grep") {
423
+ return validateGrepArgs(tokens.slice(1));
424
+ }
425
+ if (head === "rg") {
426
+ return validateRipgrepArgs(tokens.slice(1));
427
+ }
428
+ if (head === "find") {
429
+ return validateFindArgs(tokens.slice(1));
430
+ }
431
+ if (head === "fd") {
432
+ return validateFdArgs(tokens.slice(1));
433
+ }
434
+ return false;
435
+ }
436
+ function isSafeShortFlag(token, allowedChars) {
437
+ if (!token.startsWith("-") || token === "--") {
438
+ return false;
439
+ }
440
+ for (const char of token.slice(1)) {
441
+ if (!allowedChars.has(char)) {
442
+ return false;
443
+ }
444
+ }
445
+ return token.length > 1;
446
+ }
447
+ function validateRipgrepArgs(args) {
448
+ for (let index = 0; index < args.length; index += 1) {
449
+ const token = args[index] ?? "";
450
+ if (hasUnsafeShellContent(token)) {
451
+ return false;
452
+ }
453
+ if (!token.startsWith("-") || token === "--") {
454
+ continue;
455
+ }
456
+ const [flag, inlineValue] = token.split("=", 2);
457
+ if (!RG_SAFE_FLAGS.has(flag)) {
458
+ return false;
459
+ }
460
+ if (inlineValue !== undefined) {
461
+ if (!RG_FLAGS_WITH_VALUE.has(flag) || hasUnsafeShellContent(inlineValue)) {
462
+ return false;
463
+ }
464
+ continue;
465
+ }
466
+ if (RG_FLAGS_WITH_VALUE.has(flag)) {
467
+ const next = args[index + 1];
468
+ if (typeof next !== "string" || next.length === 0 || hasUnsafeShellContent(next)) {
469
+ return false;
470
+ }
471
+ index += 1;
472
+ }
473
+ }
474
+ return true;
475
+ }
476
+ function validateGrepArgs(args) {
477
+ for (let index = 0; index < args.length; index += 1) {
478
+ const token = args[index] ?? "";
479
+ if (hasUnsafeShellContent(token)) {
480
+ return false;
481
+ }
482
+ if (!token.startsWith("-") || token === "--") {
483
+ continue;
484
+ }
485
+ const [flag, inlineValue] = token.split("=", 2);
486
+ if (!GREP_SAFE_FLAGS.has(flag)) {
487
+ return false;
488
+ }
489
+ if (inlineValue !== undefined) {
490
+ if (!GREP_FLAGS_WITH_VALUE.has(flag) || hasUnsafeShellContent(inlineValue)) {
491
+ return false;
492
+ }
493
+ continue;
494
+ }
495
+ if (GREP_FLAGS_WITH_VALUE.has(flag)) {
496
+ const next = args[index + 1];
497
+ if (typeof next !== "string" || next.length === 0 || hasUnsafeShellContent(next)) {
498
+ return false;
499
+ }
500
+ index += 1;
501
+ }
502
+ }
503
+ return true;
504
+ }
505
+ function validateFindArgs(args) {
506
+ for (const token of args) {
507
+ if (hasUnsafeShellContent(token)) {
508
+ return false;
509
+ }
510
+ if (FIND_DANGEROUS_FLAGS.has(token)) {
511
+ return false;
512
+ }
513
+ }
514
+ return true;
515
+ }
516
+ function validateFdArgs(args) {
517
+ for (let index = 0; index < args.length; index += 1) {
518
+ const token = args[index] ?? "";
519
+ if (hasUnsafeShellContent(token)) {
520
+ return false;
521
+ }
522
+ if (!token.startsWith("-") || token === "--") {
523
+ continue;
524
+ }
525
+ const [flag, inlineValue] = token.split("=", 2);
526
+ if (!FD_SAFE_FLAGS.has(flag)) {
527
+ return false;
528
+ }
529
+ if (inlineValue !== undefined) {
530
+ if (!FD_FLAGS_WITH_VALUE.has(flag) || hasUnsafeShellContent(inlineValue)) {
531
+ return false;
532
+ }
533
+ continue;
534
+ }
535
+ if (FD_FLAGS_WITH_VALUE.has(flag)) {
536
+ const next = args[index + 1];
537
+ if (typeof next !== "string" || next.length === 0 || hasUnsafeShellContent(next)) {
538
+ return false;
539
+ }
540
+ index += 1;
541
+ }
542
+ }
543
+ return true;
544
+ }
545
+ function tokenizeShellCommand(command) {
546
+ const trimmed = command.trim();
547
+ if (trimmed.length === 0) {
548
+ return null;
549
+ }
550
+ const tokens = [];
551
+ let current = "";
552
+ let quote = null;
553
+ for (let index = 0; index < trimmed.length; index += 1) {
554
+ const char = trimmed[index] ?? "";
555
+ if (quote !== null) {
556
+ if (char === quote) {
557
+ quote = null;
558
+ continue;
559
+ }
560
+ if (quote === '"' && char === "\\") {
561
+ const next = trimmed[index + 1];
562
+ if (next !== undefined) {
563
+ current += next;
564
+ index += 1;
565
+ continue;
566
+ }
567
+ }
568
+ current += char;
569
+ continue;
570
+ }
571
+ if (char === "'" || char === '"') {
572
+ quote = char;
573
+ continue;
574
+ }
575
+ if (char === "\\") {
576
+ const next = trimmed[index + 1];
577
+ if (next === undefined) {
578
+ return null;
579
+ }
580
+ current += next;
581
+ index += 1;
582
+ continue;
583
+ }
584
+ if (/\s/.test(char)) {
585
+ if (current.length > 0) {
586
+ tokens.push(current);
587
+ current = "";
588
+ }
589
+ continue;
590
+ }
591
+ if ("|&;<>`()".includes(char)) {
592
+ return null;
593
+ }
594
+ current += char;
595
+ }
596
+ if (quote !== null) {
597
+ return null;
598
+ }
599
+ if (current.length > 0) {
600
+ tokens.push(current);
601
+ }
602
+ return tokens;
603
+ }
604
+ function hasUnsafeShellContent(token) {
605
+ if (/[\n\r`$]/.test(token)) {
606
+ return true;
607
+ }
608
+ if (token.includes("{") && (token.includes(",") || token.includes(".."))) {
609
+ return true;
610
+ }
611
+ return false;
612
+ }
613
+ function matchesSessionApproval(entry, sessionId, toolName, riskLevel, targetPath, commandDigest) {
614
+ return (entry.sessionId === sessionId &&
615
+ entry.toolName === toolName &&
616
+ entry.riskLevel === riskLevel &&
617
+ matchesTargetPattern(entry.targetPattern, targetPath) &&
618
+ matchesCommandDigest(entry.commandDigest, commandDigest));
619
+ }
620
+ function matchesTargetPattern(targetPattern, targetPath) {
621
+ if (targetPath === undefined) {
622
+ return targetPattern === "*";
623
+ }
624
+ if (targetPattern === "*") {
625
+ return false;
626
+ }
627
+ if (targetPattern.endsWith("/**")) {
628
+ const prefix = targetPattern.slice(0, -3);
629
+ return targetPath === prefix || targetPath.startsWith(`${prefix}/`);
630
+ }
631
+ return targetPath === targetPattern;
632
+ }
633
+ function matchesCommandDigest(expected, actual) {
634
+ if (expected === undefined) {
635
+ return actual === undefined;
636
+ }
637
+ return expected === actual;
638
+ }
639
+ //# sourceMappingURL=tool-governor.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"tool-governor.js","sourceRoot":"","sources":["../../src/governance/tool-governor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAiUH,gDAwMC;AAvgBD,6CAAyC;AAYzC,6CAO2B;AA6D3B,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AACpD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAC5F,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAChD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC/B,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,iBAAiB;IACjB,IAAI;IACJ,mBAAmB;IACnB,IAAI;IACJ,gBAAgB;IAChB,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,gBAAgB;IAChB,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,sBAAsB;IACtB,IAAI;IACJ,uBAAuB;IACvB,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,iBAAiB;IACjB,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,iBAAiB;IACjB,IAAI;IACJ,kBAAkB;IAClB,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,QAAQ;IACR,WAAW;IACX,WAAW;IACX,eAAe;IACf,gBAAgB;IAChB,SAAS;IACT,QAAQ;IACR,WAAW;IACX,IAAI;CACJ,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACrC,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,iBAAiB;IACjB,IAAI;IACJ,kBAAkB;IAClB,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,QAAQ;IACR,WAAW;IACX,WAAW;IACX,eAAe;IACf,gBAAgB;IAChB,SAAS;CACT,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC7B,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,cAAc;IACd,IAAI;IACJ,iBAAiB;IACjB,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,gBAAgB;IAChB,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,sBAAsB;IACtB,uBAAuB;IACvB,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,iBAAiB;IACjB,IAAI;IACJ,iBAAiB;IACjB,IAAI;IACJ,kBAAkB;IAClB,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,IAAI;IACJ,WAAW;IACX,cAAc;IACd,IAAI;IACJ,SAAS;IACT,UAAU;IACV,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,YAAY;IACZ,aAAa;IACb,UAAU;IACV,aAAa;IACb,IAAI;IACJ,IAAI;IACJ,aAAa;IACb,aAAa;IACb,IAAI;IACJ,UAAU;IACV,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,WAAW;IACX,SAAS;IACT,IAAI;CACJ,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC7B,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,iBAAiB;IACjB,IAAI;IACJ,gBAAgB;IAChB,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,kBAAkB;IAClB,IAAI;IACJ,eAAe;IACf,OAAO;IACP,MAAM;IACN,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,oBAAoB;IACpB,QAAQ;IACR,WAAW;IACX,IAAI;CACJ,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACnC,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;CACf,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACpC,SAAS;IACT,OAAO;IACP,UAAU;IACV,KAAK;IACL,QAAQ;IACR,SAAS;IACT,UAAU;IACV,UAAU;IACV,MAAM;CACN,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACnC,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,IAAI;IACJ,iBAAiB;IACjB,IAAI;IACJ,kBAAkB;IAClB,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,YAAY;IACZ,IAAI;IACJ,aAAa;IACb,aAAa;IACb,SAAS;CACT,CAAC,CAAC;AACH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AAE/E,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAgB,kBAAkB;IACjC,MAAM,OAAO,GAAG,IAAA,yBAAiB,GAAE,CAAC;IACpC,MAAM,WAAW,GAAG,IAAA,8BAAsB,GAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAA,2BAAmB,GAAE,CAAC;IACxC,MAAM,KAAK,GAAG,IAAA,sBAAc,GAAE,CAAC;IAC/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2E,CAAC;IAC5G,MAAM,gBAAgB,GAAyB,EAAE,CAAC;IAElD,SAAS,mBAAmB,CAC3B,UAAyD,EACzD,cAAkC;QAElC,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAE1C,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,CAAC;QACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,OAAO,UAAU,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,SAAS,iBAAiB,CACzB,QAAgB,EAChB,UAAkB,EAClB,SAAoB,EACpB,MAAc,EACd,UAAmB;QAEnB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAe;YACzB,EAAE,EAAE,SAAS,UAAU,EAAE;YACzB,UAAU;YACV,QAAQ;YACR,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,IAAI,SAAS;YACjD,MAAM,EAAE,QAAQ;YAChB,SAAS;YACT,SAAS,EAAE,GAAG;YACd,WAAW,EAAE,GAAG;YAChB,UAAU,EAAE,CAAC;YACb,UAAU;YACV,KAAK,EAAE,MAAM;YACb,kBAAkB,EAAE,MAAM;SAC1B,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,OAAO;QACN,eAAe,CAAC,OAA6B;YAC5C,MAAM,EACL,SAAS,EACT,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,UAAU,EACV,aAAa,EACb,UAAU,GACV,GAAG,OAAO,CAAC;YAEZ,6BAA6B;YAC7B,MAAM,OAAO,GAA+B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,iBAAiB,CAChB,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,SAAS,QAAQ,oCAAoC,EACrD,UAAU,CACV,CAAC;gBACF,OAAO;oBACN,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,SAAS,QAAQ,oCAAoC;oBAC7D,SAAS,EAAE,IAAI;iBACf,CAAC;YACH,CAAC;YAED,sEAAsE;YACtE,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,CAAC;YACpC,MAAM,kBAAkB,GACvB,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,oBAAY,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACzG,MAAM,sBAAsB,GAAG,mBAAmB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC9E,MAAM,qBAAqB,GAC1B,QAAQ,KAAK,MAAM,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,gCAAgC,CAAC,OAAO,CAAC,CAAC;YACjG,IAAI,qBAAqB,EAAE,CAAC;gBAC3B,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC1F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/D,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAC1G,CAAC;YACF,MAAM,WAAW,GAAsB;gBACtC,SAAS;gBACT,YAAY,EAAE,OAAO,CAAC,QAAQ;gBAC9B,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE;gBAChE,UAAU;gBACV,aAAa,EAAE,sBAAsB;gBACrC,gBAAgB;gBAChB,WAAW;gBACX,UAAU;gBACV,UAAU;aACV,CAAC;YAEF,yBAAyB;YACzB,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACnD,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;oBACjC,iBAAiB,CAChB,QAAQ,EACR,UAAU,EACV,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,MAAM,IAAI,mBAAmB,EACtC,UAAU,CACV,CAAC;oBACF,OAAO;wBACN,IAAI,EAAE,MAAM;wBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,0BAA0B,QAAQ,GAAG;wBAChE,SAAS,EAAE,QAAQ,CAAC,SAAS;qBAC7B,CAAC;gBACH,CAAC;gBACD,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;oBACrC,OAAO;wBACN,IAAI,EAAE,UAAU;wBAChB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,SAAS,QAAQ,yBAAyB;wBACrE,SAAS,EAAE,QAAQ,CAAC,SAAS;qBAC7B,CAAC;gBACH,CAAC;YACF,CAAC;YAED,qDAAqD;YACrD,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,KAAK,YAAY,IAAI,UAAU,EAAE,CAAC;gBAC/D,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC;oBACvC,QAAQ,EAAE,UAAU;oBACpB,UAAU;iBACV,CAAC,CAAC;gBACH,IAAI,aAAa,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACvC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;oBAC/F,OAAO;wBACN,IAAI,EAAE,MAAM;wBACZ,MAAM,EAAE,aAAa,CAAC,OAAO;wBAC7B,SAAS,EAAE,kBAAkB;qBAC7B,CAAC;gBACH,CAAC;YACF,CAAC;YAED,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC1F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC1B,CAAC;QAED,cAAc,CAAC,MAA2B;YACzC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;YACxE,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAEhD,gDAAgD;YAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,IAAI,QAAQ,CAAC,CAAC;YAC1D,IAAI,OAAO,EAAE,MAAM,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;gBAClD,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAChC,CAAC;YAED,yBAAyB;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAe;gBACzB,EAAE,EAAE,SAAS,UAAU,EAAE;gBACzB,UAAU;gBACV,QAAQ;gBACR,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,IAAI,SAAS;gBACjD,MAAM;gBACN,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,OAAO,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;gBACjE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG;gBAC9C,WAAW,EAAE,GAAG;gBAChB,UAAU,EAAE,UAAU,IAAI,CAAC;gBAC3B,UAAU,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU;aAC5C,CAAC;YACF,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpB,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QAED,qBAAqB,CAAC,KAAyB;YAC9C,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,OAAO;YACV,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,IAAI,WAAW;YACd,OAAO,WAAW,CAAC;QACpB,CAAC;QAED,IAAI,SAAS;YACZ,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IAAI,KAAK;YACR,OAAO,KAAK,CAAC;QACd,CAAC;KACD,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,OAAe;IACxD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,MAAM;aACX,KAAK,CAAC,CAAC,CAAC;aACR,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,+BAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,YAAiC;IACxE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAuB;IACnD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC9C,SAAS;QACV,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC1E,OAAO,KAAK,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClF,OAAO,KAAK,CAAC;YACd,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB;IAChD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC9C,SAAS;QACV,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC5E,OAAO,KAAK,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QACD,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClF,OAAO,KAAK,CAAC;YACd,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB;IAChD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,IAAuB;IAC9C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC9C,SAAS;QACV,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC1E,OAAO,KAAK,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClF,OAAO,KAAK,CAAC;YACd,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACpB,KAAK,GAAG,IAAI,CAAC;gBACb,SAAS;YACV,CAAC;YACD,IAAI,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACpC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAChC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,IAAI,IAAI,CAAC;oBAChB,KAAK,IAAI,CAAC,CAAC;oBACX,SAAS;gBACV,CAAC;YACF,CAAC;YACD,OAAO,IAAI,IAAI,CAAC;YAChB,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACb,CAAC;YACD,OAAO,IAAI,IAAI,CAAC;YAChB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrB,OAAO,GAAG,EAAE,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,IAAI,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC3C,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAC9B,KAAyB,EACzB,SAAiB,EACjB,QAAgB,EAChB,SAAoB,EACpB,UAA8B,EAC9B,aAAiC;IAEjC,OAAO,CACN,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAC3B,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,oBAAoB,CAAC,KAAK,CAAC,aAAa,EAAE,UAAU,CAAC;QACrD,oBAAoB,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,CAAC,CACxD,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,aAAqB,EAAE,UAA8B;IAClF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,aAAa,KAAK,GAAG,CAAC;IAC9B,CAAC;IACD,IAAI,aAAa,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,OAAO,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,UAAU,KAAK,aAAa,CAAC;AACrC,CAAC;AAED,SAAS,oBAAoB,CAAC,QAA4B,EAAE,MAA0B;IACrF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,KAAK,SAAS,CAAC;IAC7B,CAAC;IACD,OAAO,QAAQ,KAAK,MAAM,CAAC;AAC5B,CAAC"}