@qduc/term2 0.10.0 → 0.10.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/components/layout/StatusBar.d.ts.map +1 -1
- package/dist/components/layout/StatusBar.js +33 -30
- package/dist/components/layout/StatusBar.js.map +1 -1
- package/dist/components/message/CommandMessage.d.ts +1 -0
- package/dist/components/message/CommandMessage.d.ts.map +1 -1
- package/dist/components/message/CommandMessage.js +6 -3
- package/dist/components/message/CommandMessage.js.map +1 -1
- package/dist/components/message/MessageList.js +1 -1
- package/dist/components/message/MessageList.js.map +1 -1
- package/dist/components/prompt/ApprovalPrompt.d.ts.map +1 -1
- package/dist/components/prompt/ApprovalPrompt.js +7 -5
- package/dist/components/prompt/ApprovalPrompt.js.map +1 -1
- package/dist/services/approval/approval-flow-coordinator.d.ts.map +1 -1
- package/dist/services/approval/approval-flow-coordinator.js +12 -2
- package/dist/services/approval/approval-flow-coordinator.js.map +1 -1
- package/dist/services/approval/shell-sandbox-approval.d.ts.map +1 -1
- package/dist/services/approval/shell-sandbox-approval.js +5 -4
- package/dist/services/approval/shell-sandbox-approval.js.map +1 -1
- package/dist/services/session/turn-workflow.d.ts.map +1 -1
- package/dist/services/session/turn-workflow.js +7 -1
- package/dist/services/session/turn-workflow.js.map +1 -1
- package/dist/tools/system/shell.d.ts +1 -3
- package/dist/tools/system/shell.d.ts.map +1 -1
- package/dist/tools/system/shell.js +32 -15
- package/dist/tools/system/shell.js.map +1 -1
- package/dist/tools/types.d.ts +1 -0
- package/dist/tools/types.d.ts.map +1 -1
- package/dist/utils/shell/sandbox/docker-host-control-grants.d.ts +8 -0
- package/dist/utils/shell/sandbox/docker-host-control-grants.d.ts.map +1 -1
- package/dist/utils/shell/sandbox/docker-host-control-grants.js +21 -0
- package/dist/utils/shell/sandbox/docker-host-control-grants.js.map +1 -1
- package/dist/utils/shell/sandbox/docker-host-control.d.ts +21 -0
- package/dist/utils/shell/sandbox/docker-host-control.d.ts.map +1 -1
- package/dist/utils/shell/sandbox/docker-host-control.js +132 -0
- package/dist/utils/shell/sandbox/docker-host-control.js.map +1 -1
- package/dist/utils/shell/sandbox/sandbox-failure-classifier.d.ts +8 -1
- package/dist/utils/shell/sandbox/sandbox-failure-classifier.d.ts.map +1 -1
- package/dist/utils/shell/sandbox/sandbox-failure-classifier.js +13 -1
- package/dist/utils/shell/sandbox/sandbox-failure-classifier.js.map +1 -1
- package/dist/utils/streaming/extract-command-messages.d.ts +2 -0
- package/dist/utils/streaming/extract-command-messages.d.ts.map +1 -1
- package/dist/utils/streaming/extract-command-messages.js +26 -4
- package/dist/utils/streaming/extract-command-messages.js.map +1 -1
- package/package.json +1 -1
|
@@ -2,6 +2,138 @@ import fs from 'node:fs';
|
|
|
2
2
|
import os from 'node:os';
|
|
3
3
|
import path from 'node:path';
|
|
4
4
|
import { SANDBOX_TEMP_DIR } from '../temp-dir.js';
|
|
5
|
+
const DOCKER_BINARIES = new Set(['docker', 'docker-compose']);
|
|
6
|
+
// Programs that run another program, so the Docker invocation is one token later.
|
|
7
|
+
const COMMAND_WRAPPERS = new Set([
|
|
8
|
+
'env',
|
|
9
|
+
'sudo',
|
|
10
|
+
'doas',
|
|
11
|
+
'command',
|
|
12
|
+
'exec',
|
|
13
|
+
'builtin',
|
|
14
|
+
'nohup',
|
|
15
|
+
'nice',
|
|
16
|
+
'ionice',
|
|
17
|
+
'stdbuf',
|
|
18
|
+
'time',
|
|
19
|
+
'timeout',
|
|
20
|
+
'xargs',
|
|
21
|
+
]);
|
|
22
|
+
// Shell punctuation that returns the scanner to command position: control
|
|
23
|
+
// operators, grouping, and redirection.
|
|
24
|
+
const OPERATOR_CHARS = ';|&()<>{}';
|
|
25
|
+
const ENV_ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
|
|
26
|
+
const WRAPPER_OPTION = /^-|^\d+(?:\.\d+)?[smhd]?$/;
|
|
27
|
+
/**
|
|
28
|
+
* Splits a command into words and operators. Quoting matters: without it,
|
|
29
|
+
* `git commit -m "fix(docker): update"` would look like a Docker invocation
|
|
30
|
+
* after a subshell, and a false positive refuses the command outright.
|
|
31
|
+
*/
|
|
32
|
+
function tokenizeShellCommand(command) {
|
|
33
|
+
const tokens = [];
|
|
34
|
+
let word = '';
|
|
35
|
+
let quote;
|
|
36
|
+
const endWord = () => {
|
|
37
|
+
if (word)
|
|
38
|
+
tokens.push({ value: word, isOperator: false });
|
|
39
|
+
word = '';
|
|
40
|
+
};
|
|
41
|
+
for (let index = 0; index < command.length; index++) {
|
|
42
|
+
const char = command[index];
|
|
43
|
+
if (quote) {
|
|
44
|
+
if (char === quote)
|
|
45
|
+
quote = undefined;
|
|
46
|
+
else
|
|
47
|
+
word += char;
|
|
48
|
+
continue;
|
|
49
|
+
}
|
|
50
|
+
if (char === "'" || char === '"') {
|
|
51
|
+
quote = char;
|
|
52
|
+
continue;
|
|
53
|
+
}
|
|
54
|
+
if (char === '\\') {
|
|
55
|
+
word += command[++index] ?? '';
|
|
56
|
+
continue;
|
|
57
|
+
}
|
|
58
|
+
if (char === '\n') {
|
|
59
|
+
// A newline separates commands exactly like `;`.
|
|
60
|
+
endWord();
|
|
61
|
+
tokens.push({ value: ';', isOperator: true });
|
|
62
|
+
continue;
|
|
63
|
+
}
|
|
64
|
+
if (/\s/.test(char)) {
|
|
65
|
+
endWord();
|
|
66
|
+
continue;
|
|
67
|
+
}
|
|
68
|
+
if (OPERATOR_CHARS.includes(char)) {
|
|
69
|
+
endWord();
|
|
70
|
+
tokens.push({ value: char, isOperator: true });
|
|
71
|
+
continue;
|
|
72
|
+
}
|
|
73
|
+
word += char;
|
|
74
|
+
}
|
|
75
|
+
endWord();
|
|
76
|
+
return tokens;
|
|
77
|
+
}
|
|
78
|
+
/**
|
|
79
|
+
* Recognizes direct Docker CLI invocations wherever the shell can put them:
|
|
80
|
+
* after operators, inside subshells or brace groups, on a later line, behind a
|
|
81
|
+
* wrapper such as `sudo`/`timeout`, or preceded by environment assignments.
|
|
82
|
+
* Matching on command position rather than substring keeps `cat Dockerfile`
|
|
83
|
+
* and `git commit -m "docker"` out. Docker reached indirectly (through a script
|
|
84
|
+
* or package command) is out of reach of any command-string check.
|
|
85
|
+
*/
|
|
86
|
+
export function requestsDockerHostControl(command) {
|
|
87
|
+
let atCommandPosition = true;
|
|
88
|
+
let afterWrapper = false;
|
|
89
|
+
for (const { value, isOperator } of tokenizeShellCommand(command)) {
|
|
90
|
+
if (isOperator) {
|
|
91
|
+
atCommandPosition = true;
|
|
92
|
+
afterWrapper = false;
|
|
93
|
+
continue;
|
|
94
|
+
}
|
|
95
|
+
if (!atCommandPosition)
|
|
96
|
+
continue;
|
|
97
|
+
if (ENV_ASSIGNMENT.test(value))
|
|
98
|
+
continue;
|
|
99
|
+
const name = value.split('/').pop() ?? '';
|
|
100
|
+
if (DOCKER_BINARIES.has(name))
|
|
101
|
+
return true;
|
|
102
|
+
if (COMMAND_WRAPPERS.has(name)) {
|
|
103
|
+
afterWrapper = true;
|
|
104
|
+
continue;
|
|
105
|
+
}
|
|
106
|
+
// A wrapper's own flags and durations still precede the real command.
|
|
107
|
+
if (afterWrapper && WRAPPER_OPTION.test(value))
|
|
108
|
+
continue;
|
|
109
|
+
atCommandPosition = false;
|
|
110
|
+
afterWrapper = false;
|
|
111
|
+
}
|
|
112
|
+
return false;
|
|
113
|
+
}
|
|
114
|
+
// Docker cannot read its own config under the sandbox, so it loses the
|
|
115
|
+
// desktop-linux context and reports failure against the default socket. Both
|
|
116
|
+
// that form and a direct permission failure mean "the sandbox stood in the way".
|
|
117
|
+
const DOCKER_DAEMON_BLOCK_PATTERNS = [
|
|
118
|
+
/permission denied while trying to connect to the docker (?:api|daemon)/i,
|
|
119
|
+
/cannot connect to the docker daemon/i,
|
|
120
|
+
/docker\.sock[^\n]*(?:permission denied|operation not permitted)/i,
|
|
121
|
+
/(?:permission denied|operation not permitted)[^\n]*docker\.sock/i,
|
|
122
|
+
];
|
|
123
|
+
/**
|
|
124
|
+
* Detects a sandboxed command that failed because it could not reach the Docker
|
|
125
|
+
* daemon. This is the only signal available for Docker reached indirectly —
|
|
126
|
+
* through a script, `make` target, or package command — where the command
|
|
127
|
+
* string itself never mentions Docker.
|
|
128
|
+
*/
|
|
129
|
+
export function detectDockerDaemonBlock(stderr) {
|
|
130
|
+
return DOCKER_DAEMON_BLOCK_PATTERNS.some((pattern) => pattern.test(stderr));
|
|
131
|
+
}
|
|
132
|
+
/**
|
|
133
|
+
* Instruction shown to the agent when the sandbox blocked Docker, encouraging a
|
|
134
|
+
* same-command retry so the user can approve host control for it.
|
|
135
|
+
*/
|
|
136
|
+
export const DOCKER_HOST_CONTROL_RETRY_INSTRUCTION = 'Sandbox blocked this command from reaching the Docker daemon. Retry the same command; the user will be prompted to allow Docker host control for it.';
|
|
5
137
|
/**
|
|
6
138
|
* Docker Desktop's Unix socket controls the host daemon, so this deliberately
|
|
7
139
|
* recognizes only its canonical per-user macOS endpoint.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"docker-host-control.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/docker-host-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAQlD;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE;IACzD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IACpE,IAAI,UAAoB,CAAC;IACzB,IAAI,CAAC;QACH,UAAU,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,UAAU,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,iDAAiD,UAAU,GAAG,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAChF,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE/B,OAAO;QACL,UAAU;QACV,SAAS;QACT,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"docker-host-control.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/docker-host-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAQlD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE9D,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,KAAK;IACL,MAAM;IACN,MAAM;IACN,SAAS;IACT,MAAM;IACN,SAAS;IACT,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,SAAS;IACT,OAAO;CACR,CAAC,CAAC;AAEH,0EAA0E;AAC1E,wCAAwC;AACxC,MAAM,cAAc,GAAG,WAAW,CAAC;AACnC,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAClD,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAOnD;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,KAA4B,CAAC;IAEjC,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,IAAI,KAAK,KAAK;gBAAE,KAAK,GAAG,SAAS,CAAC;;gBACjC,IAAI,IAAI,IAAI,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,iDAAiD;YACjD,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,IAAI,IAAI,IAAI,CAAC;IACf,CAAC;IAED,OAAO,EAAE,CAAC;IACV,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,IAAI,iBAAiB,GAAG,IAAI,CAAC;IAC7B,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,KAAK,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,IAAI,UAAU,EAAE,CAAC;YACf,iBAAiB,GAAG,IAAI,CAAC;YACzB,YAAY,GAAG,KAAK,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,iBAAiB;YAAE,SAAS;QACjC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAEzC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC1C,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,sEAAsE;QACtE,IAAI,YAAY,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAEzD,iBAAiB,GAAG,KAAK,CAAC;QAC1B,YAAY,GAAG,KAAK,CAAC;IACvB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,6EAA6E;AAC7E,iFAAiF;AACjF,MAAM,4BAA4B,GAAG;IACnC,yEAAyE;IACzE,sCAAsC;IACtC,kEAAkE;IAClE,kEAAkE;CACnE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAChD,sJAAsJ,CAAC;AAEzJ;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE;IACzD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IACpE,IAAI,UAAoB,CAAC;IACzB,IAAI,CAAC;QACH,UAAU,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,UAAU,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,iDAAiD,UAAU,GAAG,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAChF,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE/B,OAAO;QACL,UAAU;QACV,SAAS;QACT,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC"}
|
|
@@ -12,6 +12,10 @@ export type SandboxFailureClassification = {
|
|
|
12
12
|
confidence: SandboxFailureConfidence;
|
|
13
13
|
stderr: string;
|
|
14
14
|
deniedRead: DeniedReadInfo;
|
|
15
|
+
} | {
|
|
16
|
+
type: 'docker_blocked';
|
|
17
|
+
confidence: SandboxFailureConfidence;
|
|
18
|
+
stderr: string;
|
|
15
19
|
};
|
|
16
20
|
export interface ClassifySandboxFailureOptions {
|
|
17
21
|
command: string;
|
|
@@ -19,6 +23,9 @@ export interface ClassifySandboxFailureOptions {
|
|
|
19
23
|
annotatedStderr: string;
|
|
20
24
|
sandboxed: boolean;
|
|
21
25
|
readPolicy?: SandboxReadPolicy;
|
|
26
|
+
/** The run already held Docker host control, so a daemon failure is Docker's, not the sandbox's. */
|
|
27
|
+
dockerHostControlActive?: boolean;
|
|
28
|
+
exitCode?: number | null;
|
|
22
29
|
}
|
|
23
|
-
export declare function classifySandboxFailure({ command, rawStderr, annotatedStderr, sandboxed, readPolicy, }: ClassifySandboxFailureOptions): SandboxFailureClassification | null;
|
|
30
|
+
export declare function classifySandboxFailure({ command, rawStderr, annotatedStderr, sandboxed, readPolicy, dockerHostControlActive, exitCode, }: ClassifySandboxFailureOptions): SandboxFailureClassification | null;
|
|
24
31
|
//# sourceMappingURL=sandbox-failure-classifier.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sandbox-failure-classifier.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-failure-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;
|
|
1
|
+
{"version":3,"file":"sandbox-failure-classifier.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-failure-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAGlF,MAAM,MAAM,wBAAwB,GAAG,oBAAoB,GAAG,gBAAgB,CAAC;AAE/E,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,CAAC;AAEzD,MAAM,MAAM,4BAA4B,GACpC;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,UAAU,EAAE,wBAAwB,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,wBAAwB,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,cAAc,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,wBAAwB,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,oGAAoG;IACpG,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAUD,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACP,SAAS,EACT,eAAe,EACf,SAAS,EACT,UAAU,EACV,uBAAuB,EACvB,QAAQ,GACT,EAAE,6BAA6B,GAAG,4BAA4B,GAAG,IAAI,CAoDrE"}
|
|
@@ -1,15 +1,27 @@
|
|
|
1
1
|
import { detectDeniedRead } from './denied-read-detector.js';
|
|
2
|
+
import { detectDockerDaemonBlock } from './docker-host-control.js';
|
|
2
3
|
function hasRuntimeAnnotation(rawStderr, annotatedStderr) {
|
|
3
4
|
return annotatedStderr !== rawStderr;
|
|
4
5
|
}
|
|
5
6
|
function hasProxyAllowlistBlock(stderr) {
|
|
6
7
|
return /blocked-by-allowlist/i.test(stderr) || (/\b403\s+Forbidden\b/i.test(stderr) && /allowlist/i.test(stderr));
|
|
7
8
|
}
|
|
8
|
-
export function classifySandboxFailure({ command, rawStderr, annotatedStderr, sandboxed, readPolicy, }) {
|
|
9
|
+
export function classifySandboxFailure({ command, rawStderr, annotatedStderr, sandboxed, readPolicy, dockerHostControlActive, exitCode, }) {
|
|
9
10
|
if (!sandboxed) {
|
|
10
11
|
return null;
|
|
11
12
|
}
|
|
12
13
|
const runtimeAnnotated = hasRuntimeAnnotation(rawStderr, annotatedStderr);
|
|
14
|
+
// Checked before the generic branches: a blocked daemon connection is
|
|
15
|
+
// actionable (the user can grant host control) where "blocked" is not.
|
|
16
|
+
// Reporting this replaces the command's output, so a command that succeeded
|
|
17
|
+
// is taken at its word however its stderr reads.
|
|
18
|
+
if (!dockerHostControlActive && exitCode !== 0 && detectDockerDaemonBlock(annotatedStderr)) {
|
|
19
|
+
return {
|
|
20
|
+
type: 'docker_blocked',
|
|
21
|
+
confidence: runtimeAnnotated ? 'runtime_annotation' : 'stderr_pattern',
|
|
22
|
+
stderr: annotatedStderr,
|
|
23
|
+
};
|
|
24
|
+
}
|
|
13
25
|
const proxyAllowlistBlocked = hasProxyAllowlistBlock(annotatedStderr) || hasProxyAllowlistBlock(rawStderr);
|
|
14
26
|
if (readPolicy === 'strict') {
|
|
15
27
|
const deniedRead = detectDeniedRead(command, annotatedStderr);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sandbox-failure-classifier.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-failure-classifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAuB,MAAM,2BAA2B,CAAC;
|
|
1
|
+
{"version":3,"file":"sandbox-failure-classifier.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-failure-classifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAuB,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAoCnE,SAAS,oBAAoB,CAAC,SAAiB,EAAE,eAAuB;IACtE,OAAO,eAAe,KAAK,SAAS,CAAC;AACvC,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,OAAO,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACpH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EACrC,OAAO,EACP,SAAS,EACT,eAAe,EACf,SAAS,EACT,UAAU,EACV,uBAAuB,EACvB,QAAQ,GACsB;IAC9B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAE1E,sEAAsE;IACtE,uEAAuE;IACvE,4EAA4E;IAC5E,iDAAiD;IACjD,IAAI,CAAC,uBAAuB,IAAI,QAAQ,KAAK,CAAC,IAAI,uBAAuB,CAAC,eAAe,CAAC,EAAE,CAAC;QAC3F,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB;YACtE,MAAM,EAAE,eAAe;SACxB,CAAC;IACJ,CAAC;IAED,MAAM,qBAAqB,GAAG,sBAAsB,CAAC,eAAe,CAAC,IAAI,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAE3G,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC9D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB;gBACtE,MAAM,EAAE,eAAe;gBACvB,UAAU;aACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACrD,UAAU,EAAE,oBAAoB;YAChC,MAAM,EAAE,eAAe;SACxB,CAAC;IACJ,CAAC;IAED,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,gBAAgB;YAC5B,MAAM,EAAE,eAAe;SACxB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
|
|
@@ -1,4 +1,6 @@
|
|
|
1
1
|
import type { CommandMessage } from '../../tools/types.js';
|
|
2
|
+
export declare const markToolCallAsLlmAutoApproved: (callId?: string | null) => void;
|
|
3
|
+
export declare const clearLlmAutoApprovalMarkers: () => void;
|
|
2
4
|
export declare const markToolCallAsApprovalRejection: (callId?: string | null) => void;
|
|
3
5
|
export declare const clearApprovalRejectionMarkers: () => void;
|
|
4
6
|
export declare const extractCommandMessages: (items?: readonly unknown[]) => CommandMessage[];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"extract-command-messages.d.ts","sourceRoot":"","sources":["../../../source/utils/streaming/extract-command-messages.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"extract-command-messages.d.ts","sourceRoot":"","sources":["../../../source/utils/streaming/extract-command-messages.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,eAAO,MAAM,6BAA6B,YAAa,MAAM,GAAG,IAAI,KAAG,IAItE,CAAC;AAEF,eAAO,MAAM,2BAA2B,QAAO,IAE9C,CAAC;AAEF,eAAO,MAAM,+BAA+B,YAAa,MAAM,GAAG,IAAI,KAAG,IAKxE,CAAC;AAEF,eAAO,MAAM,6BAA6B,QAAO,IAEhD,CAAC;AA0DF,eAAO,MAAM,sBAAsB,WAAW,SAAS,OAAO,EAAE,KAAQ,cAAc,EA6FrF,CAAC"}
|
|
@@ -1,6 +1,15 @@
|
|
|
1
1
|
import { getCallIdFromItem, normalizeToolArguments, getOutputText, } from '../../tools/format-helpers.js';
|
|
2
2
|
import { getToolFormatter } from '../../tools/command-message-formatters.js';
|
|
3
3
|
const approvalRejectionCallIds = new Set();
|
|
4
|
+
const llmAutoApprovalCallIds = new Set();
|
|
5
|
+
export const markToolCallAsLlmAutoApproved = (callId) => {
|
|
6
|
+
if (callId) {
|
|
7
|
+
llmAutoApprovalCallIds.add(callId);
|
|
8
|
+
}
|
|
9
|
+
};
|
|
10
|
+
export const clearLlmAutoApprovalMarkers = () => {
|
|
11
|
+
llmAutoApprovalCallIds.clear();
|
|
12
|
+
};
|
|
4
13
|
export const markToolCallAsApprovalRejection = (callId) => {
|
|
5
14
|
if (!callId) {
|
|
6
15
|
return;
|
|
@@ -17,6 +26,14 @@ const isApprovalRejectionForItem = (item) => {
|
|
|
17
26
|
}
|
|
18
27
|
return approvalRejectionCallIds.has(callId);
|
|
19
28
|
};
|
|
29
|
+
const consumeLlmAutoApprovalForItem = (item) => {
|
|
30
|
+
const callId = getCallIdFromItem(item);
|
|
31
|
+
if (!callId || !llmAutoApprovalCallIds.has(callId)) {
|
|
32
|
+
return false;
|
|
33
|
+
}
|
|
34
|
+
llmAutoApprovalCallIds.delete(callId);
|
|
35
|
+
return true;
|
|
36
|
+
};
|
|
20
37
|
const normalizeToolItem = (item) => {
|
|
21
38
|
if (!item) {
|
|
22
39
|
return null;
|
|
@@ -77,14 +94,18 @@ export const extractCommandMessages = (items = []) => {
|
|
|
77
94
|
continue;
|
|
78
95
|
}
|
|
79
96
|
const isApprovalRejection = isApprovalRejectionForItem(item);
|
|
97
|
+
const autoApprovedByLlm = consumeLlmAutoApprovalForItem(item);
|
|
80
98
|
const formatter = getToolFormatter(normalizedItem.toolName);
|
|
81
99
|
if (formatter) {
|
|
82
100
|
const results = formatter(item, index, toolCallArgumentsById);
|
|
83
|
-
|
|
84
|
-
|
|
101
|
+
results.forEach((msg) => {
|
|
102
|
+
if (isApprovalRejection) {
|
|
85
103
|
msg.isApprovalRejection = true;
|
|
86
|
-
}
|
|
87
|
-
|
|
104
|
+
}
|
|
105
|
+
if (autoApprovedByLlm) {
|
|
106
|
+
msg.autoApprovedByLlm = true;
|
|
107
|
+
}
|
|
108
|
+
});
|
|
88
109
|
messages.push(...results);
|
|
89
110
|
continue;
|
|
90
111
|
}
|
|
@@ -115,6 +136,7 @@ export const extractCommandMessages = (items = []) => {
|
|
|
115
136
|
output,
|
|
116
137
|
success,
|
|
117
138
|
isApprovalRejection,
|
|
139
|
+
...(autoApprovedByLlm ? { autoApprovedByLlm: true } : {}),
|
|
118
140
|
toolName: normalizedItem.toolName,
|
|
119
141
|
toolArgs: args,
|
|
120
142
|
...(callId ? { callId } : {}),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"extract-command-messages.js","sourceRoot":"","sources":["../../../source/utils/streaming/extract-command-messages.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,GAEd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAG7E,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAU,CAAC;
|
|
1
|
+
{"version":3,"file":"extract-command-messages.js","sourceRoot":"","sources":["../../../source/utils/streaming/extract-command-messages.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,GAEd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAG7E,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAU,CAAC;AACnD,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;AAEjD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,MAAsB,EAAQ,EAAE;IAC5E,IAAI,MAAM,EAAE,CAAC;QACX,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAS,EAAE;IACpD,sBAAsB,CAAC,KAAK,EAAE,CAAC;AACjC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,MAAsB,EAAQ,EAAE;IAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IACD,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAS,EAAE;IACtD,wBAAwB,CAAC,KAAK,EAAE,CAAC;AACnC,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAG,CAAC,IAAuC,EAAW,EAAE;IACtF,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,6BAA6B,GAAG,CAAC,IAAuC,EAAW,EAAE;IACzF,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,IAAuC,EAC8B,EAAE;IACvE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,IAAI,CAAC;IACxC,MAAM,gBAAgB,GACpB,IAAI,KAAK,sBAAsB;QAC/B,OAAO,EAAE,IAAI,KAAK,sBAAsB;QACxC,IAAI,KAAK,sBAAsB;QAC/B,OAAO,EAAE,IAAI,KAAK,sBAAsB;QACxC,IAAI,KAAK,6BAA6B;QACtC,OAAO,EAAE,IAAI,KAAK,6BAA6B;QAC/C,IAAI,KAAK,yBAAyB;QAClC,OAAO,EAAE,IAAI,KAAK,yBAAyB,CAAC;IAC9C,MAAM,gBAAgB,GAAG,IAAI,KAAK,uBAAuB,CAAC;IAE1D,IAAI,CAAC,gBAAgB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GACZ,OAAO,EAAE,IAAI;QACb,IAAI,CAAC,IAAI;QACT,CAAC,IAAI,KAAK,yBAAyB,IAAI,OAAO,EAAE,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;QAC/C,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC;KAChC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAK,GAAuB,EAAE,EAAoB,EAAE;IACzF,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEzD,KAAK,MAAM,OAAO,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAA4C,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC;QAC1C,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC5D,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GACR,QAAQ,EAAE,SAAS,IAAI,QAAQ,EAAE,IAAI,IAAI,QAAQ,EAAE,SAAS,IAAI,IAAI,EAAE,SAAS,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,SAAS,CAAC;QACnH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QAED,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAA4C,CAAC;QAC1D,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,SAAS;QACX,CAAC;QAED,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAE9D,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,SAAS,CAAC,IAAsB,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;YAChF,OAAO,CAAC,OAAO,CAAC,CAAC,GAAmB,EAAE,EAAE;gBACtC,IAAI,mBAAmB,EAAE,CAAC;oBACxB,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC;gBACjC,CAAC;gBACD,IAAI,iBAAiB,EAAE,CAAC;oBACtB,GAAG,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBAC/B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;QACvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5G,MAAM,IAAI,GAAG,sBAAsB,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAE5G,IAAI,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC;QACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,CAAC;aAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,OAAO,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,IAAI,WAAW,CAAC;QACxD,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE7C,MAAM,MAAM,GAAG,QAAQ,EAAE,EAAE,IAAI,QAAQ,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,EAAE,CAAC;QACxG,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,CAAC;QAE/B,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,QAAQ;YACZ,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,WAAW;YACnB,OAAO;YACP,MAAM;YACN,OAAO;YACP,mBAAmB;YACnB,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,QAAQ,EAAE,IAAI;YACd,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC"}
|