@posthog/wizard 2.37.0 → 2.38.1

package/dist/security-BMVH_bjk.js

@@ -0,0 +1,431 @@
+import { s as logToFile } from "./debug-CaRHQrDY.js";
+import { a as wizardCanUseTool, b as recordExternalScan, y as isWizardDocumentationPath } from "./agent-interface-kOuzXg84.js";
+//#region src/lib/yara-scanner.ts
+const POST_WRITE_EDIT = [{
+	phase: "PostToolUse",
+	tool: "Write"
+}, {
+	phase: "PostToolUse",
+	tool: "Edit"
+}];
+const POST_READ_GREP = [{
+	phase: "PostToolUse",
+	tool: "Read"
+}, {
+	phase: "PostToolUse",
+	tool: "Grep"
+}];
+const PRE_BASH = [{
+	phase: "PreToolUse",
+	tool: "Bash"
+}];
+const RULES = [
+	{
+		name: "pii_in_capture_call",
+		description: "Detects PII fields passed to posthog.capture() — violates 'NEVER send PII in capture()' commandment",
+		severity: "high",
+		category: "posthog_pii",
+		appliesTo: POST_WRITE_EDIT,
+		patterns: [
+			/\.capture\s*\([^)]{0,200}email/i,
+			/\.capture\s*\([^)]{0,200}phone/i,
+			/\.capture\s*\([^)]{0,200}full[_\s]?name/i,
+			/\.capture\s*\([^)]{0,200}first[_\s]?name/i,
+			/\.capture\s*\([^)]{0,200}last[_\s]?name/i,
+			/\.capture\s*\([^)]{0,200}(street|mailing|home|billing)[_\s]?address/i,
+			/\.capture\s*\([^)]{0,200}(ssn|social[_\s]?security)/i,
+			/\.capture\s*\([^)]{0,200}(date[_\s]?of[_\s]?birth|dob|birthday)/i,
+			/\.capture\s*\([^)]{0,200}\$ip/,
+			/\.identify\s*\([^)]{0,200}(ssn|social[_\s]?security)/i,
+			/\.identify\s*\([^)]{0,200}(card[_\s]?number|cvv|credit[_\s]?card)/i,
+			/\.identify\s*\([^)]{0,200}(date[_\s]?of[_\s]?birth|dob|birthday)/i,
+			/\.identify\s*\([^)]{0,200}(street|mailing|home|billing)[_\s]?address/i,
+			/\$set[^}]{0,200}email/i,
+			/\$set[^}]{0,200}phone/i
+		]
+	},
+	{
+		name: "hardcoded_posthog_key",
+		description: "Detects hardcoded PostHog API keys in source — violates 'use environment variables' commandment",
+		severity: "high",
+		category: "posthog_hardcoded_key",
+		appliesTo: POST_WRITE_EDIT,
+		patterns: [
+			/phc_[a-zA-Z0-9]{20,}/,
+			/phx_[a-zA-Z0-9]{20,}/,
+			/apiKey\s*[:=]\s*['"][a-zA-Z0-9_]{20,}['"]/,
+			/api_key\s*[:=]\s*['"][a-zA-Z0-9_]{20,}['"]/,
+			/POSTHOG_PROJECT_TOKEN\s*[:=]\s*['"][a-zA-Z0-9_]{20,}['"]/
+		]
+	},
+	{
+		name: "autocapture_disabled",
+		description: "Detects agent disabling autocapture — violates 'don't disable autocapture' commandment",
+		severity: "medium",
+		category: "posthog_autocapture",
+		appliesTo: POST_WRITE_EDIT,
+		patterns: [
+			/autocapture\s*:\s*false/,
+			/autocapture\s*:\s*'false'/,
+			/autocapture\s*:\s*"false"/,
+			/autocapture\s*=\s*False/,
+			/disable_autocapture\s*[:=]\s*(true|True|1)/
+		]
+	},
+	{
+		name: "hardcoded_posthog_host",
+		description: "Detects hardcoded PostHog host URLs in source — should use environment variables",
+		severity: "high",
+		category: "posthog_hardcoded_key",
+		appliesTo: POST_WRITE_EDIT,
+		patterns: [/['"]https:\/\/(us|eu)\.i\.posthog\.com['"]/]
+	},
+	{
+		name: "session_recording_disabled",
+		description: "Detects agent disabling session recording",
+		severity: "medium",
+		category: "posthog_config",
+		appliesTo: POST_WRITE_EDIT,
+		patterns: [/disable_session_recording\s*:\s*true/i, /disable_session_recording\s*=\s*True/]
+	},
+	{
+		name: "opt_out_capturing",
+		description: "Detects agent opting out of PostHog capturing entirely",
+		severity: "medium",
+		category: "posthog_config",
+		appliesTo: POST_WRITE_EDIT,
+		patterns: [/opt_out_capturing\s*[:=]\s*(true|True|1)/i, /opted_out\s*[:=]\s*(true|True|1)/i]
+	},
+	{
+		name: "prompt_injection_wizard_override",
+		description: "Detects classic prompt injection attempting to override agent instructions",
+		severity: "critical",
+		category: "prompt_injection",
+		appliesTo: POST_READ_GREP,
+		patterns: [
+			/ignore previous instructions/i,
+			/disregard all/i,
+			/forget your instructions/i,
+			/override your rules/i,
+			/act as a different/i,
+			/new instructions:/i
+		]
+	},
+	{
+		name: "prompt_injection_wizard_specific",
+		description: "Detects wizard-specific manipulation or tool abuse attempts in project files",
+		severity: "medium",
+		category: "prompt_injection",
+		appliesTo: POST_READ_GREP,
+		patterns: [
+			/skip posthog/i,
+			/do not install posthog/i,
+			/remove posthog/i,
+			/uninstall posthog/i,
+			/delete the posthog/i,
+			/run the following command/i,
+			/execute this shell command/i,
+			/you are now a\s/i
+		]
+	},
+	{
+		name: "prompt_injection_base64",
+		description: "Detects suspicious base64-encoded blocks in file content that may contain obfuscated prompt injection",
+		severity: "critical",
+		category: "prompt_injection",
+		appliesTo: POST_READ_GREP,
+		patterns: [/(?:\/\/|#|\/\*)\s*[A-Za-z0-9+/]{100,}={0,2}/]
+	},
+	{
+		name: "secret_exfiltration_via_command",
+		description: "Detects shell commands attempting to exfiltrate secrets or credentials",
+		severity: "critical",
+		category: "exfiltration",
+		appliesTo: PRE_BASH,
+		patterns: [
+			/curl\s+.*\$\{?[A-Z_]*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)/i,
+			/wget\s+.*\$\{?[A-Z_]*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)/i,
+			/(\$\{?[A-Z_]*(KEY|TOKEN|SECRET|PASSWORD)|\.env|credentials)\S*.*\|\s*curl/i,
+			/(\$\{?[A-Z_]*(KEY|TOKEN|SECRET|PASSWORD)|\.env|credentials)\S*.*\|\s*wget/i,
+			/\|\s*nc\s/,
+			/\|\s*netcat\s/,
+			/base64.*\|\s*(curl|wget|nc\s)/i,
+			/cat\s+.*\.env.*\|\s*(curl|wget)/,
+			/curl.*phc_[a-zA-Z0-9]/,
+			/wget.*phc_[a-zA-Z0-9]/
+		]
+	},
+	{
+		name: "destructive_rm",
+		description: "Detects rm -rf or rm -r commands that could mass-delete files",
+		severity: "critical",
+		category: "filesystem_safety",
+		appliesTo: PRE_BASH,
+		patterns: [
+			/\brm\s+(-[a-zA-Z]*r[a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*r)\b/,
+			/\brm\s+(-[a-zA-Z]*\s+)*-[a-zA-Z]*r[a-zA-Z]*\s+(-[a-zA-Z]*\s+)*-[a-zA-Z]*f\b/,
+			/\brm\s+(-[a-zA-Z]*\s+)*-[a-zA-Z]*f[a-zA-Z]*\s+(-[a-zA-Z]*\s+)*-[a-zA-Z]*r\b/
+		]
+	},
+	{
+		name: "git_force_push",
+		description: "Detects git push --force which can overwrite remote history",
+		severity: "critical",
+		category: "filesystem_safety",
+		appliesTo: PRE_BASH,
+		patterns: [/git\s+push\s+.*--force/, /git\s+push\s+.*-f\b/]
+	},
+	{
+		name: "git_reset_hard",
+		description: "Detects git reset --hard which discards all uncommitted changes",
+		severity: "critical",
+		category: "filesystem_safety",
+		appliesTo: PRE_BASH,
+		patterns: [/git\s+reset\s+--hard/]
+	},
+	{
+		name: "wrong_posthog_package",
+		description: "Detects installing the wrong PostHog npm package — should be posthog-js or posthog-node",
+		severity: "high",
+		category: "supply_chain",
+		appliesTo: PRE_BASH,
+		patterns: [
+			/npm\s+install\s+(?:--save\s+|--save-dev\s+|-[SD]\s+)*posthog(?!\s*-)/,
+			/pnpm\s+(?:add|install)\s+(?:--save\s+|--save-dev\s+|-[SD]\s+)*posthog(?!\s*-)/,
+			/yarn\s+add\s+(?:--dev\s+|-D\s+)*posthog(?!\s*-)/,
+			/bun\s+(?:add|install)\s+(?:--dev\s+|-[dD]\s+)*posthog(?!\s*-)/
+		]
+	},
+	{
+		name: "npm_install_global",
+		description: "Detects global npm installs — should never install packages globally",
+		severity: "high",
+		category: "supply_chain",
+		appliesTo: PRE_BASH,
+		patterns: [/npm\s+install\s+-g\b/, /npm\s+install\s+--global\b/]
+	}
+];
+/** Maximum content length to scan (100 KB). Inputs beyond this are truncated. */
+const MAX_SCAN_LENGTH = 1e5;
+/**
+* Scan content against rules applicable to a given hook phase and tool.
+* Returns all matching rules (one match per rule, first pattern wins).
+*/
+function scan(content, phase, tool) {
+	const scanContent = content.length > MAX_SCAN_LENGTH ? content.slice(0, MAX_SCAN_LENGTH) : content;
+	const applicableRules = RULES.filter((r) => r.appliesTo.some((a) => a.phase === phase && a.tool === tool));
+	const matches = [];
+	for (const rule of applicableRules) for (const pattern of rule.patterns) {
+		const match = pattern.exec(scanContent);
+		if (match) {
+			matches.push({
+				rule,
+				matchedText: match[0],
+				offset: match.index
+			});
+			break;
+		}
+	}
+	return matches.length > 0 ? {
+		matched: true,
+		matches
+	} : { matched: false };
+}
+//#endregion
+//#region src/lib/agent/runner/harness/pi/security.ts
+/**
+* Fail-closed security for the pi backend (#525). pi has no built-in
+* permission layer, so we attach an extension that intercepts every tool call
+* — built-in (bash/read/edit/write/grep) AND custom — through pi's `tool_call`
+* hook and reuses the EXACT anthropic policy: `wizardCanUseTool` (the bash
+* allowlist + .env fencing) plus the YARA pre-scan. A `tool_result` hook
+* post-scans output. Both fail closed: a scanner error blocks, and a critical
+* post-scan violation latches so every subsequent tool call is blocked and the
+* run terminates as a YARA violation.
+*
+* This is the one fence. Subagents run their own pi session with the SAME
+* extension installed (see subagent.ts), so a child cannot escape it.
+*/
+/** yara-scanner match → the report shape `recordExternalScan` expects. */
+function toReportViolation(m) {
+	return {
+		rule: m.rule.name,
+		severity: m.rule.severity,
+		category: m.rule.category,
+		description: m.rule.description
+	};
+}
+const str = (v) => typeof v === "string" ? v : "";
+/**
+* Translate a pi tool name to the claude-cased name + input the shared policy
+* expects. pi field names (from the live tool stream): bash{command},
+* read/edit/write{path}, write adds {content}, edit adds {edits}, grep{path}.
+*/
+function toClaudePolicyCall(toolName, input) {
+	switch (toolName) {
+		case "bash": return {
+			name: "Bash",
+			input: { command: str(input.command) }
+		};
+		case "read": return {
+			name: "Read",
+			input: { file_path: input.path }
+		};
+		case "write": return {
+			name: "Write",
+			input: { file_path: input.path }
+		};
+		case "edit": return {
+			name: "Edit",
+			input: { file_path: input.path }
+		};
+		case "grep": return {
+			name: "Grep",
+			input: { path: input.path }
+		};
+		default: return {
+			name: toolName,
+			input
+		};
+	}
+}
+/**
+* YARA scan of the content a tool is about to act on, BEFORE it executes.
+* - bash → scan the command (PreToolUse/Bash: exfiltration, destructive, force-push)
+* - write/edit → scan the content being written (PostToolUse/Write|Edit:
+*   hardcoded keys, PII), with the same wizard-doc `posthog_pii` suppression the
+*   anthropic path uses so the agent's own event-plan files aren't blocked.
+* Returns a block reason, or undefined to allow. Read/grep are post-scanned on
+* their output (in the tool_result hook), not here.
+*/
+function preExecutionYaraBlock(toolName, input) {
+	let content;
+	let target;
+	let phase;
+	switch (toolName) {
+		case "bash":
+			content = str(input.command);
+			target = "Bash";
+			phase = "PreToolUse";
+			break;
+		case "write":
+			content = str(input.content);
+			target = "Write";
+			phase = "PostToolUse";
+			break;
+		case "edit":
+			content = JSON.stringify(input.edits ?? "");
+			target = "Edit";
+			phase = "PostToolUse";
+			break;
+		default: return;
+	}
+	if (!content) return void 0;
+	const result = scan(content, phase, target);
+	let matches = result.matched ? result.matches : [];
+	if ((target === "Write" || target === "Edit") && isWizardDocumentationPath(str(input.path))) matches = matches.filter((m) => m.rule.category !== "posthog_pii");
+	recordExternalScan(phase, target, matches.map(toReportViolation), "blocked");
+	if (matches.length === 0) return void 0;
+	const m = matches[0];
+	return `[YARA] ${m.rule.name}: ${m.rule.description}. Blocked for security.`;
+}
+/**
+* The pure gate decision for a single tool call. Reuses `wizardCanUseTool`
+* (deny → block) then the YARA content scan (match → block). Fail-closed: any
+* thrown error blocks.
+*/
+function evaluateToolCall(toolName, input, ctx = {}) {
+	try {
+		const policy = toClaudePolicyCall(toolName, input);
+		const decision = wizardCanUseTool(policy.name, policy.input, {
+			disallowedTools: ctx.disallowedTools,
+			wizardAskPending: ctx.getWizardAskPending?.() ?? false
+		});
+		if (decision.behavior === "deny") return {
+			block: true,
+			reason: decision.message
+		};
+		const yaraReason = preExecutionYaraBlock(toolName, input);
+		if (yaraReason) return {
+			block: true,
+			reason: yaraReason
+		};
+		return { block: false };
+	} catch (err) {
+		logToFile("[pi-security] gate error — failing closed:", err);
+		return {
+			block: true,
+			reason: "Security check failed; tool blocked (fail-closed)."
+		};
+	}
+}
+/** pi result tool name → YARA target for the post-scan (skip the rest). */
+function postScanTarget(toolName) {
+	switch (toolName) {
+		case "read": return "Read";
+		case "bash": return "Bash";
+		default: return;
+	}
+}
+/**
+* Build the pi security extension + the shared state the backend inspects.
+* Install the returned factory via `extensionFactories`; pass the same factory
+* into every subagent session so the fence is inherited.
+*/
+function createSecurityExtension(ctx = {}) {
+	const state = {
+		criticalViolation: false,
+		blockedCount: 0,
+		toolCalls: 0
+	};
+	const factory = (pi) => {
+		pi.on("tool_call", (event) => {
+			if (state.criticalViolation) return {
+				block: true,
+				reason: "Run terminated by a security violation."
+			};
+			state.toolCalls += 1;
+			if (state.toolCalls > 250) return {
+				block: true,
+				reason: `Stopped: exceeded 250 tool calls (runaway guard).`
+			};
+			const decision = evaluateToolCall(event.toolName, event.input ?? {}, ctx);
+			if (decision.block) {
+				state.blockedCount += 1;
+				logToFile(`[pi-security] BLOCK ${event.toolName}: ${decision.reason}`);
+				return {
+					block: true,
+					reason: decision.reason
+				};
+			}
+			return {};
+		});
+		pi.on("tool_result", (event) => {
+			const target = postScanTarget(event.toolName);
+			if (!target) return {};
+			const text = (event.content ?? []).map((c) => c && c.type === "text" ? c.text : "").join("\n");
+			if (!text) return {};
+			try {
+				const result = scan(text, "PostToolUse", target);
+				const matches = result.matched ? result.matches : [];
+				recordExternalScan("PostToolUse", target, matches.map(toReportViolation), "aborted");
+				if (matches.length > 0) {
+					state.criticalViolation = true;
+					logToFile(`[pi-security] POST-SCAN VIOLATION ${event.toolName}: ${matches[0].rule.name}`);
+				}
+			} catch (err) {
+				state.criticalViolation = true;
+				logToFile("[pi-security] post-scan error — failing closed:", err);
+			}
+			return {};
+		});
+	};
+	return {
+		factory,
+		state
+	};
+}
+//#endregion
+export { createSecurityExtension };
+
+//# sourceMappingURL=security-BMVH_bjk.js.map

package/dist/security-BMVH_bjk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-BMVH_bjk.js","names":[],"sources":["../src/lib/yara-scanner.ts","../src/lib/agent/runner/harness/pi/security.ts"],"sourcesContent":["/**\n * YARA content scanner for the PostHog wizard.\n *\n * This file is the single source of truth for all wizard YARA rules.\n *\n * Scans tool inputs (pre-execution) and outputs (post-execution) for\n * security violations including PII leakage, hardcoded secrets,\n * prompt injection, and secret exfiltration.\n *\n * We use YARA-style regex rules rather than the real YARA C library to\n * avoid native binary dependencies in an npx-distributed npm package.\n *\n * This is Layer 2 (L2) in the wizard's defense-in-depth model,\n * complementing the prompt-based commandments (L0) and the\n * canUseTool() allowlist (L1).\n */\n\n// ─── Types ───────────────────────────────────────────────────────\n\nexport type YaraSeverity = 'critical' | 'high' | 'medium' | 'low';\n\nexport type YaraCategory =\n  | 'posthog_pii'\n  | 'posthog_hardcoded_key'\n  | 'posthog_autocapture'\n  | 'posthog_config'\n  | 'prompt_injection'\n  | 'exfiltration'\n  | 'filesystem_safety'\n  | 'supply_chain';\n\nexport type HookPhase = 'PreToolUse' | 'PostToolUse';\nexport type ToolTarget = 'Bash' | 'Write' | 'Edit' | 'Read' | 'Grep';\n\nexport interface YaraRule {\n  /** Rule name matching the .yar file (e.g. 'pii_in_capture_call') */\n  name: string;\n  description: string;\n  severity: YaraSeverity;\n  category: YaraCategory;\n  /** Which hook+tool combinations this rule applies to */\n  appliesTo: Array<{ phase: HookPhase; tool: ToolTarget }>;\n  /** Compiled regex patterns — any match triggers the rule */\n  patterns: RegExp[];\n}\n\nexport interface YaraMatch {\n  rule: YaraRule;\n  /** The matched substring */\n  matchedText: string;\n  /** Byte offset in the scanned content */\n  offset: number;\n}\n\nexport type ScanResult =\n  | { matched: false }\n  | { matched: true; matches: YaraMatch[] };\n\n// ─── Rule Definitions ────────────────────────────────────────────\n//\n// Patterns are compiled once at module load time for performance.\n// Design spec: policies/yara/RULES.md\n\nconst POST_WRITE_EDIT: Array<{ phase: HookPhase; tool: ToolTarget }> = [\n  { phase: 'PostToolUse', tool: 'Write' },\n  { phase: 'PostToolUse', tool: 'Edit' },\n];\n\nconst POST_READ_GREP: Array<{ phase: HookPhase; tool: ToolTarget }> = [\n  { phase: 'PostToolUse', tool: 'Read' },\n  { phase: 'PostToolUse', tool: 'Grep' },\n];\n\nconst PRE_BASH: Array<{ phase: HookPhase; tool: ToolTarget }> = [\n  { phase: 'PreToolUse', tool: 'Bash' },\n];\n\n// ── §1 PostHog API Violations ────────────────────────────────────\n\nconst pii_in_capture_call: YaraRule = {\n  name: 'pii_in_capture_call',\n  description:\n    \"Detects PII fields passed to posthog.capture() — violates 'NEVER send PII in capture()' commandment\",\n  severity: 'high',\n  category: 'posthog_pii',\n  appliesTo: POST_WRITE_EDIT,\n  patterns: [\n    // Direct PII field names in capture properties\n    /\\.capture\\s*\\([^)]{0,200}email/i,\n    /\\.capture\\s*\\([^)]{0,200}phone/i,\n    /\\.capture\\s*\\([^)]{0,200}full[_\\s]?name/i,\n    /\\.capture\\s*\\([^)]{0,200}first[_\\s]?name/i,\n    /\\.capture\\s*\\([^)]{0,200}last[_\\s]?name/i,\n    /\\.capture\\s*\\([^)]{0,200}(street|mailing|home|billing)[_\\s]?address/i,\n    /\\.capture\\s*\\([^)]{0,200}(ssn|social[_\\s]?security)/i,\n    /\\.capture\\s*\\([^)]{0,200}(date[_\\s]?of[_\\s]?birth|dob|birthday)/i,\n    /\\.capture\\s*\\([^)]{0,200}\\$ip/,\n    // identify() allows email/phone/name (standard PostHog user properties),\n    // but highly sensitive PII is still blocked in identify().\n    /\\.identify\\s*\\([^)]{0,200}(ssn|social[_\\s]?security)/i,\n    /\\.identify\\s*\\([^)]{0,200}(card[_\\s]?number|cvv|credit[_\\s]?card)/i,\n    /\\.identify\\s*\\([^)]{0,200}(date[_\\s]?of[_\\s]?birth|dob|birthday)/i,\n    /\\.identify\\s*\\([^)]{0,200}(street|mailing|home|billing)[_\\s]?address/i,\n    // PII in $set properties via capture (bound to same object)\n    /\\$set[^}]{0,200}email/i,\n    /\\$set[^}]{0,200}phone/i,\n  ],\n};\n\nconst hardcoded_posthog_key: YaraRule = {\n  name: 'hardcoded_posthog_key',\n  description:\n    \"Detects hardcoded PostHog API keys in source — violates 'use environment variables' commandment\",\n  severity: 'high',\n  category: 'posthog_hardcoded_key',\n  appliesTo: POST_WRITE_EDIT,\n  patterns: [\n    // PostHog project API key (phc_ prefix, 20+ alphanumeric chars)\n    /phc_[a-zA-Z0-9]{20,}/,\n    // PostHog personal API key (phx_ prefix)\n    /phx_[a-zA-Z0-9]{20,}/,\n    // Hardcoded key assignment patterns\n    /apiKey\\s*[:=]\\s*['\"][a-zA-Z0-9_]{20,}['\"]/,\n    /api_key\\s*[:=]\\s*['\"][a-zA-Z0-9_]{20,}['\"]/,\n    /POSTHOG_PROJECT_TOKEN\\s*[:=]\\s*['\"][a-zA-Z0-9_]{20,}['\"]/,\n  ],\n};\n\nconst autocapture_disabled: YaraRule = {\n  name: 'autocapture_disabled',\n  description:\n    \"Detects agent disabling autocapture — violates 'don't disable autocapture' commandment\",\n  severity: 'medium',\n  category: 'posthog_autocapture',\n  appliesTo: POST_WRITE_EDIT,\n  patterns: [\n    /autocapture\\s*:\\s*false/,\n    /autocapture\\s*:\\s*'false'/,\n    /autocapture\\s*:\\s*\"false\"/,\n    /autocapture\\s*=\\s*False/,\n    /disable_autocapture\\s*[:=]\\s*(true|True|1)/,\n  ],\n};\n\n// ── §1b Additional PostHog config rules ──────────────────────────\n\nconst hardcoded_posthog_host: YaraRule = {\n  name: 'hardcoded_posthog_host',\n  description:\n    'Detects hardcoded PostHog host URLs in source — should use environment variables',\n  severity: 'high',\n  category: 'posthog_hardcoded_key',\n  appliesTo: POST_WRITE_EDIT,\n  patterns: [/['\"]https:\\/\\/(us|eu)\\.i\\.posthog\\.com['\"]/],\n};\n\nconst session_recording_disabled: YaraRule = {\n  name: 'session_recording_disabled',\n  description: 'Detects agent disabling session recording',\n  severity: 'medium',\n  category: 'posthog_config',\n  appliesTo: POST_WRITE_EDIT,\n  patterns: [\n    /disable_session_recording\\s*:\\s*true/i,\n    /disable_session_recording\\s*=\\s*True/,\n  ],\n};\n\nconst opt_out_capturing: YaraRule = {\n  name: 'opt_out_capturing',\n  description: 'Detects agent opting out of PostHog capturing entirely',\n  severity: 'medium',\n  category: 'posthog_config',\n  appliesTo: POST_WRITE_EDIT,\n  patterns: [\n    // Match opt_out_capturing as a config property (in init options), not as a method call.\n    // posthog.opt_out_capturing() is a legitimate GDPR-required API.\n    /opt_out_capturing\\s*[:=]\\s*(true|True|1)/i,\n    /opted_out\\s*[:=]\\s*(true|True|1)/i,\n  ],\n};\n\n// ── §2 Prompt Injection ──────────────────────────────────────────\n\nconst prompt_injection_wizard_override: YaraRule = {\n  name: 'prompt_injection_wizard_override',\n  description:\n    'Detects classic prompt injection attempting to override agent instructions',\n  severity: 'critical',\n  category: 'prompt_injection',\n  appliesTo: POST_READ_GREP,\n  patterns: [\n    // Direct instruction override — classic injection patterns\n    /ignore previous instructions/i,\n    /disregard all/i,\n    /forget your instructions/i,\n    /override your rules/i,\n    // Role manipulation\n    /act as a different/i,\n    /new instructions:/i,\n  ],\n};\n\nconst prompt_injection_wizard_specific: YaraRule = {\n  name: 'prompt_injection_wizard_specific',\n  description:\n    'Detects wizard-specific manipulation or tool abuse attempts in project files',\n  severity: 'medium',\n  category: 'prompt_injection',\n  appliesTo: POST_READ_GREP,\n  patterns: [\n    // Wizard-specific manipulation\n    /skip posthog/i,\n    /do not install posthog/i,\n    /remove posthog/i,\n    /uninstall posthog/i,\n    /delete the posthog/i,\n    // Tool abuse via file content\n    /run the following command/i,\n    /execute this shell command/i,\n    // Role hijacking — require \"you are now a\" to avoid false positives\n    // on legitimate phrases like \"you are now ready to...\"\n    /you are now a\\s/i,\n  ],\n};\n\nconst prompt_injection_base64: YaraRule = {\n  name: 'prompt_injection_base64',\n  description:\n    'Detects suspicious base64-encoded blocks in file content that may contain obfuscated prompt injection',\n  severity: 'critical',\n  category: 'prompt_injection',\n  appliesTo: POST_READ_GREP,\n  patterns: [\n    // Long base64 strings (100+ chars) in comments or string literals\n    // that aren't typical data URIs or legitimate base64 content\n    /(?:\\/\\/|#|\\/\\*)\\s*[A-Za-z0-9+/]{100,}={0,2}/,\n  ],\n};\n\n// ── §3 Secret Exfiltration ───────────────────────────────────────\n\nconst secret_exfiltration_via_command: YaraRule = {\n  name: 'secret_exfiltration_via_command',\n  description:\n    'Detects shell commands attempting to exfiltrate secrets or credentials',\n  severity: 'critical',\n  category: 'exfiltration',\n  appliesTo: PRE_BASH,\n  patterns: [\n    // curl/wget with environment variable secrets\n    /curl\\s+.*\\$\\{?[A-Z_]*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)/i,\n    /wget\\s+.*\\$\\{?[A-Z_]*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)/i,\n    // Piping sensitive content to network tools\n    /(\\$\\{?[A-Z_]*(KEY|TOKEN|SECRET|PASSWORD)|\\.env|credentials)\\S*.*\\|\\s*curl/i,\n    /(\\$\\{?[A-Z_]*(KEY|TOKEN|SECRET|PASSWORD)|\\.env|credentials)\\S*.*\\|\\s*wget/i,\n    /\\|\\s*nc\\s/,\n    /\\|\\s*netcat\\s/,\n    // Base64 encoding piped to network\n    /base64.*\\|\\s*(curl|wget|nc\\s)/i,\n    // Reading .env and sending\n    /cat\\s+.*\\.env.*\\|\\s*(curl|wget)/,\n    // PostHog key exfiltration specifically\n    /curl.*phc_[a-zA-Z0-9]/,\n    /wget.*phc_[a-zA-Z0-9]/,\n  ],\n};\n\n// ── §4 Filesystem Safety ─────────────────────────────────────────\n\nconst destructive_rm: YaraRule = {\n  name: 'destructive_rm',\n  description: 'Detects rm -rf or rm -r commands that could mass-delete files',\n  severity: 'critical',\n  category: 'filesystem_safety',\n  appliesTo: PRE_BASH,\n  patterns: [\n    // Combined flags: rm -rf, rm -fr, rm -rfi, etc.\n    /\\brm\\s+(-[a-zA-Z]*r[a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*r)\\b/,\n    // Separated flags: rm -r -f, rm -f -r (with optional other flags)\n    /\\brm\\s+(-[a-zA-Z]*\\s+)*-[a-zA-Z]*r[a-zA-Z]*\\s+(-[a-zA-Z]*\\s+)*-[a-zA-Z]*f\\b/,\n    /\\brm\\s+(-[a-zA-Z]*\\s+)*-[a-zA-Z]*f[a-zA-Z]*\\s+(-[a-zA-Z]*\\s+)*-[a-zA-Z]*r\\b/,\n  ],\n};\n\nconst git_force_push: YaraRule = {\n  name: 'git_force_push',\n  description: 'Detects git push --force which can overwrite remote history',\n  severity: 'critical',\n  category: 'filesystem_safety',\n  appliesTo: PRE_BASH,\n  patterns: [/git\\s+push\\s+.*--force/, /git\\s+push\\s+.*-f\\b/],\n};\n\nconst git_reset_hard: YaraRule = {\n  name: 'git_reset_hard',\n  description:\n    'Detects git reset --hard which discards all uncommitted changes',\n  severity: 'critical',\n  category: 'filesystem_safety',\n  appliesTo: PRE_BASH,\n  patterns: [/git\\s+reset\\s+--hard/],\n};\n\n// ── §5 Supply Chain ──────────────────────────────────────────────\n\nconst wrong_posthog_package: YaraRule = {\n  name: 'wrong_posthog_package',\n  description:\n    'Detects installing the wrong PostHog npm package — should be posthog-js or posthog-node',\n  severity: 'high',\n  category: 'supply_chain',\n  appliesTo: PRE_BASH,\n  patterns: [\n    // Match \"npm install posthog\" but not \"posthog-js\", \"posthog-node\", etc.\n    /npm\\s+install\\s+(?:--save\\s+|--save-dev\\s+|-[SD]\\s+)*posthog(?!\\s*-)/,\n    /pnpm\\s+(?:add|install)\\s+(?:--save\\s+|--save-dev\\s+|-[SD]\\s+)*posthog(?!\\s*-)/,\n    /yarn\\s+add\\s+(?:--dev\\s+|-D\\s+)*posthog(?!\\s*-)/,\n    /bun\\s+(?:add|install)\\s+(?:--dev\\s+|-[dD]\\s+)*posthog(?!\\s*-)/,\n  ],\n};\n\nconst npm_install_global: YaraRule = {\n  name: 'npm_install_global',\n  description:\n    'Detects global npm installs — should never install packages globally',\n  severity: 'high',\n  category: 'supply_chain',\n  appliesTo: PRE_BASH,\n  patterns: [/npm\\s+install\\s+-g\\b/, /npm\\s+install\\s+--global\\b/],\n};\n\n// ─── Rule Registry ───────────────────────────────────────────────\n\nexport const RULES: YaraRule[] = [\n  // §1 PostHog API violations\n  pii_in_capture_call,\n  hardcoded_posthog_key,\n  autocapture_disabled,\n  hardcoded_posthog_host,\n  session_recording_disabled,\n  opt_out_capturing,\n  // §2 Prompt injection\n  prompt_injection_wizard_override,\n  prompt_injection_wizard_specific,\n  prompt_injection_base64,\n  // §3 Secret exfiltration\n  secret_exfiltration_via_command,\n  // §4 Filesystem safety\n  destructive_rm,\n  git_force_push,\n  git_reset_hard,\n  // §5 Supply chain\n  wrong_posthog_package,\n  npm_install_global,\n];\n\n// ─── Scan Engine ─────────────────────────────────────────────────\n\n/** Maximum content length to scan (100 KB). Inputs beyond this are truncated. */\nconst MAX_SCAN_LENGTH = 100_000;\n\n/**\n * Scan content against rules applicable to a given hook phase and tool.\n * Returns all matching rules (one match per rule, first pattern wins).\n */\nexport function scan(\n  content: string,\n  phase: HookPhase,\n  tool: ToolTarget,\n): ScanResult {\n  // Cap input length to prevent pathological regex performance\n  const scanContent =\n    content.length > MAX_SCAN_LENGTH\n      ? content.slice(0, MAX_SCAN_LENGTH)\n      : content;\n  const applicableRules = RULES.filter((r) =>\n    r.appliesTo.some((a) => a.phase === phase && a.tool === tool),\n  );\n\n  const matches: YaraMatch[] = [];\n  for (const rule of applicableRules) {\n    for (const pattern of rule.patterns) {\n      const match = pattern.exec(scanContent);\n      if (match) {\n        matches.push({\n          rule,\n          matchedText: match[0],\n          offset: match.index,\n        });\n        break; // One match per rule is sufficient\n      }\n    }\n  }\n\n  return matches.length > 0 ? { matched: true, matches } : { matched: false };\n}\n\n/**\n * Scan all files in a skill directory for prompt injection.\n * Used for context-mill scanning after skill installation.\n */\nexport function scanSkillDirectory(\n  files: Array<{ path: string; content: string }>,\n): ScanResult {\n  const allMatches: YaraMatch[] = [];\n  for (const file of files) {\n    const result = scan(file.content, 'PostToolUse', 'Read');\n    if (result.matched) {\n      allMatches.push(...result.matches);\n    }\n  }\n  return allMatches.length > 0\n    ? { matched: true, matches: allMatches }\n    : { matched: false };\n}\n","/**\n * Fail-closed security for the pi backend (#525). pi has no built-in\n * permission layer, so we attach an extension that intercepts every tool call\n * — built-in (bash/read/edit/write/grep) AND custom — through pi's `tool_call`\n * hook and reuses the EXACT anthropic policy: `wizardCanUseTool` (the bash\n * allowlist + .env fencing) plus the YARA pre-scan. A `tool_result` hook\n * post-scans output. Both fail closed: a scanner error blocks, and a critical\n * post-scan violation latches so every subsequent tool call is blocked and the\n * run terminates as a YARA violation.\n *\n * This is the one fence. Subagents run their own pi session with the SAME\n * extension installed (see subagent.ts), so a child cannot escape it.\n */\n\nimport { wizardCanUseTool } from '@lib/agent/agent-interface';\nimport {\n  scan,\n  type HookPhase,\n  type ToolTarget,\n  type YaraMatch,\n} from '@lib/yara-scanner';\nimport { isWizardDocumentationPath, recordExternalScan } from '@lib/yara-hooks';\nimport { logToFile } from '@utils/debug';\n\n/** yara-scanner match → the report shape `recordExternalScan` expects. */\nfunction toReportViolation(m: YaraMatch) {\n  return {\n    rule: m.rule.name,\n    severity: m.rule.severity,\n    category: m.rule.category,\n    description: m.rule.description,\n  };\n}\n\n/** Runaway backstop: hard cap on tool calls per (sub)agent session. */\nexport const MAX_TOOL_CALLS = 250;\n\nexport interface ToolGateContext {\n  disallowedTools?: readonly string[];\n  /** True while a wizard_ask overlay is open (interactive); blocks Write/Edit. */\n  getWizardAskPending?: () => boolean;\n}\n\nexport interface GateDecision {\n  block: boolean;\n  reason?: string;\n}\n\nconst str = (v: unknown): string => (typeof v === 'string' ? v : '');\n\n/**\n * Translate a pi tool name to the claude-cased name + input the shared policy\n * expects. pi field names (from the live tool stream): bash{command},\n * read/edit/write{path}, write adds {content}, edit adds {edits}, grep{path}.\n */\nfunction toClaudePolicyCall(\n  toolName: string,\n  input: Record<string, unknown>,\n): { name: string; input: Record<string, unknown> } {\n  switch (toolName) {\n    case 'bash':\n      return { name: 'Bash', input: { command: str(input.command) } };\n    case 'read':\n      return { name: 'Read', input: { file_path: input.path } };\n    case 'write':\n      return { name: 'Write', input: { file_path: input.path } };\n    case 'edit':\n      return { name: 'Edit', input: { file_path: input.path } };\n    case 'grep':\n      return { name: 'Grep', input: { path: input.path } };\n    default:\n      // Custom tools (load_skill_menu, set_env_values, dispatch_agent, …) +\n      // find/ls: no path/command, policy allows (their own handlers are fenced).\n      return { name: toolName, input };\n  }\n}\n\n/**\n * YARA scan of the content a tool is about to act on, BEFORE it executes.\n * - bash → scan the command (PreToolUse/Bash: exfiltration, destructive, force-push)\n * - write/edit → scan the content being written (PostToolUse/Write|Edit:\n *   hardcoded keys, PII), with the same wizard-doc `posthog_pii` suppression the\n *   anthropic path uses so the agent's own event-plan files aren't blocked.\n * Returns a block reason, or undefined to allow. Read/grep are post-scanned on\n * their output (in the tool_result hook), not here.\n */\nfunction preExecutionYaraBlock(\n  toolName: string,\n  input: Record<string, unknown>,\n): string | undefined {\n  let content: string;\n  let target: ToolTarget;\n  let phase: HookPhase;\n  switch (toolName) {\n    case 'bash':\n      content = str(input.command);\n      target = 'Bash';\n      phase = 'PreToolUse';\n      break;\n    case 'write':\n      content = str(input.content);\n      target = 'Write';\n      phase = 'PostToolUse';\n      break;\n    case 'edit':\n      content = JSON.stringify(input.edits ?? '');\n      target = 'Edit';\n      phase = 'PostToolUse';\n      break;\n    default:\n      return undefined;\n  }\n  if (!content) return undefined;\n\n  const result = scan(content, phase, target);\n  let matches = result.matched ? result.matches : [];\n  if (\n    (target === 'Write' || target === 'Edit') &&\n    isWizardDocumentationPath(str(input.path))\n  ) {\n    matches = matches.filter((m) => m.rule.category !== 'posthog_pii');\n  }\n  recordExternalScan(phase, target, matches.map(toReportViolation), 'blocked');\n  if (matches.length === 0) return undefined;\n\n  const m = matches[0];\n  return `[YARA] ${m.rule.name}: ${m.rule.description}. Blocked for security.`;\n}\n\n/**\n * The pure gate decision for a single tool call. Reuses `wizardCanUseTool`\n * (deny → block) then the YARA content scan (match → block). Fail-closed: any\n * thrown error blocks.\n */\nexport function evaluateToolCall(\n  toolName: string,\n  input: Record<string, unknown>,\n  ctx: ToolGateContext = {},\n): GateDecision {\n  try {\n    const policy = toClaudePolicyCall(toolName, input);\n    const decision = wizardCanUseTool(policy.name, policy.input, {\n      disallowedTools: ctx.disallowedTools,\n      wizardAskPending: ctx.getWizardAskPending?.() ?? false,\n    });\n    if (decision.behavior === 'deny') {\n      return { block: true, reason: decision.message };\n    }\n\n    const yaraReason = preExecutionYaraBlock(toolName, input);\n    if (yaraReason) return { block: true, reason: yaraReason };\n\n    return { block: false };\n  } catch (err) {\n    logToFile('[pi-security] gate error — failing closed:', err);\n    return {\n      block: true,\n      reason: 'Security check failed; tool blocked (fail-closed).',\n    };\n  }\n}\n\n/** pi result tool name → YARA target for the post-scan (skip the rest). */\nfunction postScanTarget(toolName: string): ToolTarget | undefined {\n  switch (toolName) {\n    case 'read':\n      return 'Read';\n    case 'bash':\n      return 'Bash';\n    default:\n      return undefined;\n  }\n}\n\n/** Mutable state the backend reads after the run to classify the outcome. */\nexport interface SecurityState {\n  criticalViolation: boolean;\n  blockedCount: number;\n  toolCalls: number;\n}\n\n/**\n * Build the pi security extension + the shared state the backend inspects.\n * Install the returned factory via `extensionFactories`; pass the same factory\n * into every subagent session so the fence is inherited.\n */\nexport function createSecurityExtension(ctx: ToolGateContext = {}): {\n  factory: (pi: PiExtensionApiLike) => void;\n  state: SecurityState;\n} {\n  const state: SecurityState = {\n    criticalViolation: false,\n    blockedCount: 0,\n    toolCalls: 0,\n  };\n\n  const factory = (pi: PiExtensionApiLike): void => {\n    pi.on('tool_call', (event) => {\n      // A latched post-scan violation blocks everything that follows.\n      if (state.criticalViolation) {\n        return {\n          block: true,\n          reason: 'Run terminated by a security violation.',\n        };\n      }\n      state.toolCalls += 1;\n      if (state.toolCalls > MAX_TOOL_CALLS) {\n        return {\n          block: true,\n          reason: `Stopped: exceeded ${MAX_TOOL_CALLS} tool calls (runaway guard).`,\n        };\n      }\n      const decision = evaluateToolCall(event.toolName, event.input ?? {}, ctx);\n      if (decision.block) {\n        state.blockedCount += 1;\n        logToFile(`[pi-security] BLOCK ${event.toolName}: ${decision.reason}`);\n        return { block: true, reason: decision.reason };\n      }\n      return {};\n    });\n\n    pi.on('tool_result', (event) => {\n      const target = postScanTarget(event.toolName);\n      if (!target) return {};\n      const text = (event.content ?? [])\n        .map((c) => (c && c.type === 'text' ? c.text : ''))\n        .join('\\n');\n      if (!text) return {};\n      try {\n        const result = scan(text, 'PostToolUse', target);\n        const matches = result.matched ? result.matches : [];\n        recordExternalScan(\n          'PostToolUse',\n          target,\n          matches.map(toReportViolation),\n          'aborted',\n        );\n        if (matches.length > 0) {\n          state.criticalViolation = true;\n          logToFile(\n            `[pi-security] POST-SCAN VIOLATION ${event.toolName}: ${matches[0].rule.name}`,\n          );\n        }\n      } catch (err) {\n        // Fail closed: a scanner error on output latches a violation.\n        state.criticalViolation = true;\n        logToFile('[pi-security] post-scan error — failing closed:', err);\n      }\n      return {};\n    });\n  };\n\n  return { factory, state };\n}\n\n/**\n * Minimal structural type for pi's ExtensionAPI — just the `on` overloads we\n * use. Kept local so this module has no value import from the pi SDK (so the\n * CommonJS unit tests can load it directly).\n */\nexport interface PiExtensionApiLike {\n  on(\n    event: 'tool_call',\n    handler: (event: { toolName: string; input?: Record<string, unknown> }) => {\n      block?: boolean;\n      reason?: string;\n    },\n  ): void;\n  on(\n    event: 'tool_result',\n    handler: (event: {\n      toolName: string;\n      content?: Array<{ type: string; text?: string }>;\n      isError?: boolean;\n    }) => Record<string, never>,\n  ): void;\n}\n"],"mappings":";;;AA+DA,MAAM,kBAAiE,CACrE;CAAE,OAAO;CAAe,MAAM;CAAS,EACvC;CAAE,OAAO;CAAe,MAAM;CAAQ,CACvC;AAED,MAAM,iBAAgE,CACpE;CAAE,OAAO;CAAe,MAAM;CAAQ,EACtC;CAAE,OAAO;CAAe,MAAM;CAAQ,CACvC;AAED,MAAM,WAA0D,CAC9D;CAAE,OAAO;CAAc,MAAM;CAAQ,CACtC;AAmQD,MAAa,QAAoB;CA/PK;EACpC,MAAM;EACN,aACE;EACF,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU;GAER;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GAGA;GACA;GACA;GACA;GAEA;GACA;GACD;EACF;CAEuC;EACtC,MAAM;EACN,aACE;EACF,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU;GAER;GAEA;GAEA;GACA;GACA;GACD;EACF;CAEsC;EACrC,MAAM;EACN,aACE;EACF,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU;GACR;GACA;GACA;GACA;GACA;GACD;EACF;CAIwC;EACvC,MAAM;EACN,aACE;EACF,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU,CAAC,6CAA6C;EACzD;CAE4C;EAC3C,MAAM;EACN,aAAa;EACb,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU,CACR,yCACA,uCACD;EACF;CAEmC;EAClC,MAAM;EACN,aAAa;EACb,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU,CAGR,6CACA,oCACD;EACF;CAIkD;EACjD,MAAM;EACN,aACE;EACF,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU;GAER;GACA;GACA;GACA;GAEA;GACA;GACD;EACF;CAEkD;EACjD,MAAM;EACN,aACE;EACF,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU;GAER;GACA;GACA;GACA;GACA;GAEA;GACA;GAGA;GACD;EACF;CAEyC;EACxC,MAAM;EACN,aACE;EACF,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU,CAGR,8CACD;EACF;CAIiD;EAChD,MAAM;EACN,aACE;EACF,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU;GAER;GACA;GAEA;GACA;GACA;GACA;GAEA;GAEA;GAEA;GACA;GACD;EACF;CAIgC;EAC/B,MAAM;EACN,aAAa;EACb,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU;GAER;GAEA;GACA;GACD;EACF;CAEgC;EAC/B,MAAM;EACN,aAAa;EACb,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU,CAAC,0BAA0B,sBAAsB;EAC5D;CAEgC;EAC/B,MAAM;EACN,aACE;EACF,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU,CAAC,uBAAuB;EACnC;CAIuC;EACtC,MAAM;EACN,aACE;EACF,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU;GAER;GACA;GACA;GACA;GACD;EACF;CAEoC;EACnC,MAAM;EACN,aACE;EACF,UAAU;EACV,UAAU;EACV,WAAW;EACX,UAAU,CAAC,wBAAwB,6BAA6B;EACjE;CAyBA;;AAKD,MAAM,kBAAkB;;;;;AAMxB,SAAgB,KACd,SACA,OACA,MACY;CAEZ,MAAM,cACJ,QAAQ,SAAS,kBACb,QAAQ,MAAM,GAAG,gBAAgB,GACjC;CACN,MAAM,kBAAkB,MAAM,QAAQ,MACpC,EAAE,UAAU,MAAM,MAAM,EAAE,UAAU,SAAS,EAAE,SAAS,KAAK,CAC9D;CAED,MAAM,UAAuB,EAAE;AAC/B,MAAK,MAAM,QAAQ,gBACjB,MAAK,MAAM,WAAW,KAAK,UAAU;EACnC,MAAM,QAAQ,QAAQ,KAAK,YAAY;AACvC,MAAI,OAAO;AACT,WAAQ,KAAK;IACX;IACA,aAAa,MAAM;IACnB,QAAQ,MAAM;IACf,CAAC;AACF;;;AAKN,QAAO,QAAQ,SAAS,IAAI;EAAE,SAAS;EAAM;EAAS,GAAG,EAAE,SAAS,OAAO;;;;;;;;;;;;;;;;;;AClX7E,SAAS,kBAAkB,GAAc;AACvC,QAAO;EACL,MAAM,EAAE,KAAK;EACb,UAAU,EAAE,KAAK;EACjB,UAAU,EAAE,KAAK;EACjB,aAAa,EAAE,KAAK;EACrB;;AAiBH,MAAM,OAAO,MAAwB,OAAO,MAAM,WAAW,IAAI;;;;;;AAOjE,SAAS,mBACP,UACA,OACkD;AAClD,SAAQ,UAAR;EACE,KAAK,OACH,QAAO;GAAE,MAAM;GAAQ,OAAO,EAAE,SAAS,IAAI,MAAM,QAAQ,EAAE;GAAE;EACjE,KAAK,OACH,QAAO;GAAE,MAAM;GAAQ,OAAO,EAAE,WAAW,MAAM,MAAM;GAAE;EAC3D,KAAK,QACH,QAAO;GAAE,MAAM;GAAS,OAAO,EAAE,WAAW,MAAM,MAAM;GAAE;EAC5D,KAAK,OACH,QAAO;GAAE,MAAM;GAAQ,OAAO,EAAE,WAAW,MAAM,MAAM;GAAE;EAC3D,KAAK,OACH,QAAO;GAAE,MAAM;GAAQ,OAAO,EAAE,MAAM,MAAM,MAAM;GAAE;EACtD,QAGE,QAAO;GAAE,MAAM;GAAU;GAAO;;;;;;;;;;;;AAatC,SAAS,sBACP,UACA,OACoB;CACpB,IAAI;CACJ,IAAI;CACJ,IAAI;AACJ,SAAQ,UAAR;EACE,KAAK;AACH,aAAU,IAAI,MAAM,QAAQ;AAC5B,YAAS;AACT,WAAQ;AACR;EACF,KAAK;AACH,aAAU,IAAI,MAAM,QAAQ;AAC5B,YAAS;AACT,WAAQ;AACR;EACF,KAAK;AACH,aAAU,KAAK,UAAU,MAAM,SAAS,GAAG;AAC3C,YAAS;AACT,WAAQ;AACR;EACF,QACE;;AAEJ,KAAI,CAAC,QAAS,QAAO,KAAA;CAErB,MAAM,SAAS,KAAK,SAAS,OAAO,OAAO;CAC3C,IAAI,UAAU,OAAO,UAAU,OAAO,UAAU,EAAE;AAClD,MACG,WAAW,WAAW,WAAW,WAClC,0BAA0B,IAAI,MAAM,KAAK,CAAC,CAE1C,WAAU,QAAQ,QAAQ,MAAM,EAAE,KAAK,aAAa,cAAc;AAEpE,oBAAmB,OAAO,QAAQ,QAAQ,IAAI,kBAAkB,EAAE,UAAU;AAC5E,KAAI,QAAQ,WAAW,EAAG,QAAO,KAAA;CAEjC,MAAM,IAAI,QAAQ;AAClB,QAAO,UAAU,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,YAAY;;;;;;;AAQtD,SAAgB,iBACd,UACA,OACA,MAAuB,EAAE,EACX;AACd,KAAI;EACF,MAAM,SAAS,mBAAmB,UAAU,MAAM;EAClD,MAAM,WAAW,iBAAiB,OAAO,MAAM,OAAO,OAAO;GAC3D,iBAAiB,IAAI;GACrB,kBAAkB,IAAI,uBAAuB,IAAI;GAClD,CAAC;AACF,MAAI,SAAS,aAAa,OACxB,QAAO;GAAE,OAAO;GAAM,QAAQ,SAAS;GAAS;EAGlD,MAAM,aAAa,sBAAsB,UAAU,MAAM;AACzD,MAAI,WAAY,QAAO;GAAE,OAAO;GAAM,QAAQ;GAAY;AAE1D,SAAO,EAAE,OAAO,OAAO;UAChB,KAAK;AACZ,YAAU,8CAA8C,IAAI;AAC5D,SAAO;GACL,OAAO;GACP,QAAQ;GACT;;;;AAKL,SAAS,eAAe,UAA0C;AAChE,SAAQ,UAAR;EACE,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,QACE;;;;;;;;AAgBN,SAAgB,wBAAwB,MAAuB,EAAE,EAG/D;CACA,MAAM,QAAuB;EAC3B,mBAAmB;EACnB,cAAc;EACd,WAAW;EACZ;CAED,MAAM,WAAW,OAAiC;AAChD,KAAG,GAAG,cAAc,UAAU;AAE5B,OAAI,MAAM,kBACR,QAAO;IACL,OAAO;IACP,QAAQ;IACT;AAEH,SAAM,aAAa;AACnB,OAAI,MAAM,YAAA,IACR,QAAO;IACL,OAAO;IACP,QAAQ;IACT;GAEH,MAAM,WAAW,iBAAiB,MAAM,UAAU,MAAM,SAAS,EAAE,EAAE,IAAI;AACzE,OAAI,SAAS,OAAO;AAClB,UAAM,gBAAgB;AACtB,cAAU,uBAAuB,MAAM,SAAS,IAAI,SAAS,SAAS;AACtE,WAAO;KAAE,OAAO;KAAM,QAAQ,SAAS;KAAQ;;AAEjD,UAAO,EAAE;IACT;AAEF,KAAG,GAAG,gBAAgB,UAAU;GAC9B,MAAM,SAAS,eAAe,MAAM,SAAS;AAC7C,OAAI,CAAC,OAAQ,QAAO,EAAE;GACtB,MAAM,QAAQ,MAAM,WAAW,EAAE,EAC9B,KAAK,MAAO,KAAK,EAAE,SAAS,SAAS,EAAE,OAAO,GAAI,CAClD,KAAK,KAAK;AACb,OAAI,CAAC,KAAM,QAAO,EAAE;AACpB,OAAI;IACF,MAAM,SAAS,KAAK,MAAM,eAAe,OAAO;IAChD,MAAM,UAAU,OAAO,UAAU,OAAO,UAAU,EAAE;AACpD,uBACE,eACA,QACA,QAAQ,IAAI,kBAAkB,EAC9B,UACD;AACD,QAAI,QAAQ,SAAS,GAAG;AACtB,WAAM,oBAAoB;AAC1B,eACE,qCAAqC,MAAM,SAAS,IAAI,QAAQ,GAAG,KAAK,OACzE;;YAEI,KAAK;AAEZ,UAAM,oBAAoB;AAC1B,cAAU,mDAAmD,IAAI;;AAEnE,UAAO,EAAE;IACT;;AAGJ,QAAO;EAAE;EAAS;EAAO"}