@qduc/term2 0.7.3 → 0.9.0

package/dist/utils/shell/command-logger.test.js

@@ -0,0 +1,32 @@
+import { it, expect } from 'vitest';
+import { logCommandExecution } from './command-logger.js';
+const buildSettingsService = (overrides = {}) => ({
+    get: (key) => {
+        switch (key) {
+            case 'debug.debugBashTool':
+                return true;
+            case 'logging.suppressConsoleOutput':
+                return true;
+            case 'environment.nodeEnv':
+                return 'test';
+            default:
+                return overrides[key];
+        }
+    },
+    set: () => { },
+});
+it('logCommandExecution does not write to console when suppressed', () => {
+    const originalConsoleError = console.error;
+    const calls = [];
+    console.error = (...args) => {
+        calls.push(args);
+    };
+    try {
+        logCommandExecution(buildSettingsService(), 'echo hi', false, true);
+        expect(calls.length).toBe(0);
+    }
+    finally {
+        console.error = originalConsoleError;
+    }
+});
+//# sourceMappingURL=command-logger.test.js.map

package/dist/utils/shell/command-logger.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-logger.test.js","sourceRoot":"","sources":["../../../source/utils/shell/command-logger.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,oBAAoB,GAAG,CAAC,YAAqC,EAAE,EAAE,EAAE,CAAC,CAAC;IACzE,GAAG,EAAE,CAAc,GAAW,EAAK,EAAE;QACnC,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,qBAAqB;gBACxB,OAAO,IAAS,CAAC;YACnB,KAAK,+BAA+B;gBAClC,OAAO,IAAS,CAAC;YACnB,KAAK,qBAAqB;gBACxB,OAAO,MAAW,CAAC;YACrB;gBACE,OAAO,SAAS,CAAC,GAAG,CAAM,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC;CACd,CAAC,CAAC;AAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACvE,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,OAAO,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE;QAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,mBAAmB,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAEpE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,KAAK,GAAG,oBAAoB,CAAC;IACvC,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/utils/shell/command-safety/constants.d.ts

@@ -0,0 +1,21 @@
+export declare const ALLOWED_COMMANDS: Set<string>;
+export declare const BLOCKED_COMMANDS: Set<string>;
+/**
+ * Validate command safety using an AST parser.
+ * Returns true when a command requires user approval.
+ * Throws for invalid/empty inputs.
+ */
+export declare enum SafetyStatus {
+    GREEN = "GREEN",
+    YELLOW = "YELLOW",
+    RED = "RED"
+}
+export declare const SYSTEM_PATHS: string[];
+export declare const SENSITIVE_EXTENSIONS: string[];
+export declare const SAFE_JSON_FILES: Set<string>;
+export declare const SUSPICIOUS_JSON_PATTERNS: RegExp[];
+export declare const HOME_PATTERNS: RegExp[];
+export declare const SENSITIVE_PATHS: string[];
+export declare const SAFE_GIT_COMMANDS: Set<string>;
+export declare const DANGEROUS_GIT_COMMANDS: Set<string>;
+//# sourceMappingURL=constants.d.ts.map

package/dist/utils/shell/command-safety/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/command-safety/constants.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,gBAAgB,aAuE3B,CAAC;AAEH,eAAO,MAAM,gBAAgB,aAkB3B,CAAC;AAEH;;;;GAIG;AACH,oBAAY,YAAY;IACtB,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,GAAG,QAAQ;CACZ;AAGD,eAAO,MAAM,YAAY,UAA6D,CAAC;AAEvF,eAAO,MAAM,oBAAoB,UAA2B,CAAC;AAG7D,eAAO,MAAM,eAAe,aAqB1B,CAAC;AAGH,eAAO,MAAM,wBAAwB,UAkDpC,CAAC;AAEF,eAAO,MAAM,aAAa,UAUzB,CAAC;AAEF,eAAO,MAAM,eAAe,UAU3B,CAAC;AAGF,eAAO,MAAM,iBAAiB,aAmC5B,CAAC;AAEH,eAAO,MAAM,sBAAsB,aAwCjC,CAAC"}

package/dist/utils/shell/command-safety/constants.js

@@ -0,0 +1,265 @@
+// 1. CONSTANTS
+// Note: 'sed' is useful for read-only transformations. We allow it by default
+// but add guards below to prevent in-place edits (-i) and unapproved redirections.
+export const ALLOWED_COMMANDS = new Set([
+    // navigation / listing
+    'pwd',
+    'cd',
+    'ls',
+    'find',
+    // file viewing
+    'cat',
+    'head',
+    'tail',
+    'nl',
+    'sed',
+    // searching / matching
+    'grep',
+    'rg',
+    'fd',
+    // counting / metadata
+    'wc',
+    'stat',
+    'file',
+    'du',
+    'df',
+    // path utilities (string-only, no file mutation)
+    'basename',
+    'dirname',
+    'realpath',
+    // text inspection / transformation to stdout
+    'sort',
+    'uniq',
+    'cut',
+    'tr',
+    'strings',
+    'echo',
+    'printf',
+    'seq',
+    'comm',
+    'column',
+    'diff',
+    // binary / hex inspection (read-only dumps)
+    'xxd',
+    'od',
+    'hexdump',
+    // shell no-ops / lookups (output-only, do not mutate state)
+    'true',
+    'false',
+    'which',
+    'type',
+    // structured data inspection
+    'jq',
+    // checksums
+    'sha256sum',
+    'sha1sum',
+    'md5sum',
+    // basic identity / environment context
+    'whoami',
+    'id',
+    'uname',
+    'date',
+    // Git read-only commands
+    'git',
+]);
+export const BLOCKED_COMMANDS = new Set([
+    // Inherently destructive filesystem operations
+    'rm',
+    'rmdir',
+    'mkfs',
+    'dd',
+    // Privilege escalation and system shutdown
+    'sudo',
+    'su',
+    'shutdown',
+    'reboot',
+    // Dangerous wrappers / process control
+    'eval',
+    'exec',
+    'kill',
+    'killall',
+]);
+/**
+ * Validate command safety using an AST parser.
+ * Returns true when a command requires user approval.
+ * Throws for invalid/empty inputs.
+ */
+export var SafetyStatus;
+(function (SafetyStatus) {
+    SafetyStatus["GREEN"] = "GREEN";
+    SafetyStatus["YELLOW"] = "YELLOW";
+    SafetyStatus["RED"] = "RED";
+})(SafetyStatus || (SafetyStatus = {}));
+// Constants for path analysis
+export const SYSTEM_PATHS = ['/etc', '/dev', '/proc', '/var', '/usr', '/boot', '/bin'];
+export const SENSITIVE_EXTENSIONS = ['.env', '.pem', '.key'];
+// Safe JSON files that are common project configuration files
+export const SAFE_JSON_FILES = new Set([
+    'package.json',
+    'package-lock.json',
+    'tsconfig.json',
+    'jsconfig.json',
+    'eslint.config.json',
+    '.eslintrc.json',
+    'prettier.config.json',
+    '.prettierrc.json',
+    'jest.config.json',
+    'babel.config.json',
+    '.babelrc.json',
+    'ava.config.json',
+    'xo.config.json',
+    'tslint.json',
+    'renovate.json',
+    'nx.json',
+    'project.json',
+    'vercel.json',
+    'now.json',
+    'composer.json',
+]);
+// Patterns that indicate potentially sensitive JSON files (credentials, tokens, etc.)
+export const SUSPICIOUS_JSON_PATTERNS = [
+    // Credentials and secrets (exact and with suffixes)
+    /^secrets?\.json$/i,
+    /^secrets?[-_.].*\.json$/i,
+    /^credentials?\.json$/i,
+    /^credentials?[-_.].*\.json$/i,
+    /^tokens?\.json$/i,
+    /^tokens?[-_.].*\.json$/i,
+    /^auth\.json$/i,
+    /^auth[-_.].*\.json$/i,
+    /^api[-_]?keys?\.json$/i,
+    /^api[-_]?keys?[-_.].*\.json$/i,
+    /^service[-_]?accounts?\.json$/i,
+    /^service[-_]?accounts?[-_.].*\.json$/i,
+    // Private keys
+    /^private\.json$/i,
+    /^private[-_.].*\.json$/i,
+    /^key\.json$/i,
+    /^key[-_.].*\.json$/i,
+    /^id_rsa.*\.json$/i,
+    // Cloud provider credentials
+    /^firebase[-_]?adminsdk.*\.json$/i,
+    /^google[-_]?credentials.*\.json$/i,
+    /^gcloud.*\.json$/i,
+    /^azure.*\.json$/i,
+    /^aws.*\.json$/i,
+    /^service[-_]account\.json$/i,
+    /^client[-_]secret.*\.json$/i,
+    /^oauth.*client.*\.json$/i,
+    // SSO and authentication providers
+    /^okta.*\.json$/i,
+    /^sso.*\.json$/i,
+    /^saml.*\.json$/i,
+    // Monitoring and logging credentials
+    /^sentry.*\.json$/i,
+    /^newrelic.*\.json$/i,
+    /^datadog.*\.json$/i,
+    // Key storage formats
+    /.*\.keystore\.json$/i,
+    /.*\.keypair\.json$/i,
+    /.*\.p8\.json$/i,
+    /.*\.p12\.json$/i,
+    // Vault and secret management
+    /^vault.*\.json$/i,
+];
+export const HOME_PATTERNS = [
+    /^~/, // Tilde
+    /^\$HOME/, // $HOME variable
+    /^\$\{HOME\}/, // ${HOME} variable
+    /^\$USER/, // $USER variable
+    /^\$LOGNAME/, // $LOGNAME variable
+    /^\$XDG_/, // XDG variables
+    /^\/home\//, // Linux home directories
+    /^\/Users\//, // macOS home directories
+    /^\/root($|\/)/, // Root's home
+];
+export const SENSITIVE_PATHS = [
+    '/.ssh',
+    '/.gnupg',
+    '/.aws',
+    '/.kube',
+    '/.env',
+    '/.git',
+    '/.config',
+    '/.bash_history',
+    '/.zsh_history',
+];
+// Git command classification
+export const SAFE_GIT_COMMANDS = new Set([
+    // Status and information
+    'status',
+    'log',
+    'show',
+    'diff',
+    'reflog',
+    // Inspection
+    'ls-files',
+    'ls-tree',
+    'ls-remote',
+    'describe',
+    'rev-parse',
+    'rev-list',
+    'show-ref',
+    'show-branch',
+    'name-rev',
+    // History viewing
+    'blame',
+    'shortlog',
+    'whatchanged',
+    // Object inspection
+    'cat-file',
+    'count-objects',
+    'verify-pack',
+    'verify-commit',
+    'verify-tag',
+    // Other read-only commands
+    'grep',
+    'help',
+    'version',
+    'fsck',
+    'check-ignore',
+    'check-attr',
+    'check-ref-format',
+]);
+export const DANGEROUS_GIT_COMMANDS = new Set([
+    // Write operations
+    'push',
+    'commit',
+    'add',
+    'rm',
+    'mv',
+    // Destructive operations
+    'reset',
+    'clean',
+    'rebase',
+    'merge',
+    'cherry-pick',
+    'revert',
+    // History rewriting
+    'filter-branch',
+    'filter-repo',
+    'replace',
+    // Branch/tag management
+    'checkout',
+    'switch',
+    'restore',
+    'branch',
+    'tag',
+    // Configuration changes
+    'config',
+    'remote',
+    // Submodule operations
+    'submodule',
+    'subtree',
+    // Other write operations
+    'stash',
+    'apply',
+    'fetch',
+    'pull',
+    'clone',
+    'init',
+    'gc',
+    'prune',
+    'worktree',
+]);
+//# sourceMappingURL=constants.js.map

package/dist/utils/shell/command-safety/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../source/utils/shell/command-safety/constants.ts"],"names":[],"mappings":"AAAA,eAAe;AACf,8EAA8E;AAC9E,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IACtC,uBAAuB;IACvB,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,MAAM;IAEN,eAAe;IACf,KAAK;IACL,MAAM;IACN,MAAM;IACN,IAAI;IACJ,KAAK;IAEL,uBAAuB;IACvB,MAAM;IACN,IAAI;IACJ,IAAI;IAEJ,sBAAsB;IACtB,IAAI;IACJ,MAAM;IACN,MAAM;IACN,IAAI;IACJ,IAAI;IAEJ,iDAAiD;IACjD,UAAU;IACV,SAAS;IACT,UAAU;IAEV,6CAA6C;IAC7C,MAAM;IACN,MAAM;IACN,KAAK;IACL,IAAI;IACJ,SAAS;IACT,MAAM;IACN,QAAQ;IACR,KAAK;IACL,MAAM;IACN,QAAQ;IACR,MAAM;IAEN,4CAA4C;IAC5C,KAAK;IACL,IAAI;IACJ,SAAS;IAET,4DAA4D;IAC5D,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IAEN,6BAA6B;IAC7B,IAAI;IAEJ,YAAY;IACZ,WAAW;IACX,SAAS;IACT,QAAQ;IAER,uCAAuC;IACvC,QAAQ;IACR,IAAI;IACJ,OAAO;IACP,MAAM;IAEN,yBAAyB;IACzB,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IACtC,+CAA+C;IAC/C,IAAI;IACJ,OAAO;IACP,MAAM;IACN,IAAI;IAEJ,2CAA2C;IAC3C,MAAM;IACN,IAAI;IACJ,UAAU;IACV,QAAQ;IAER,uCAAuC;IACvC,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;CACV,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,+BAAe,CAAA;IACf,iCAAiB,CAAA;IACjB,2BAAW,CAAA;AACb,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED,8BAA8B;AAC9B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAEvF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAE7D,8DAA8D;AAC9D,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IACrC,cAAc;IACd,mBAAmB;IACnB,eAAe;IACf,eAAe;IACf,oBAAoB;IACpB,gBAAgB;IAChB,sBAAsB;IACtB,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,aAAa;IACb,eAAe;IACf,SAAS;IACT,cAAc;IACd,aAAa;IACb,UAAU;IACV,eAAe;CAChB,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,oDAAoD;IACpD,mBAAmB;IACnB,0BAA0B;IAC1B,uBAAuB;IACvB,8BAA8B;IAC9B,kBAAkB;IAClB,yBAAyB;IACzB,eAAe;IACf,sBAAsB;IACtB,wBAAwB;IACxB,+BAA+B;IAC/B,gCAAgC;IAChC,uCAAuC;IAEvC,eAAe;IACf,kBAAkB;IAClB,yBAAyB;IACzB,cAAc;IACd,qBAAqB;IACrB,mBAAmB;IAEnB,6BAA6B;IAC7B,kCAAkC;IAClC,mCAAmC;IACnC,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,6BAA6B;IAC7B,6BAA6B;IAC7B,0BAA0B;IAE1B,mCAAmC;IACnC,iBAAiB;IACjB,gBAAgB;IAChB,iBAAiB;IAEjB,qCAAqC;IACrC,mBAAmB;IACnB,qBAAqB;IACrB,oBAAoB;IAEpB,sBAAsB;IACtB,sBAAsB;IACtB,qBAAqB;IACrB,gBAAgB;IAChB,iBAAiB;IAEjB,8BAA8B;IAC9B,kBAAkB;CACnB,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,iBAAiB;IAC5B,aAAa,EAAE,mBAAmB;IAClC,SAAS,EAAE,iBAAiB;IAC5B,YAAY,EAAE,oBAAoB;IAClC,SAAS,EAAE,gBAAgB;IAC3B,WAAW,EAAE,yBAAyB;IACtC,YAAY,EAAE,yBAAyB;IACvC,eAAe,EAAE,cAAc;CAChC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,OAAO;IACP,SAAS;IACT,OAAO;IACP,QAAQ;IACR,OAAO;IACP,OAAO;IACP,UAAU;IACV,gBAAgB;IAChB,eAAe;CAChB,CAAC;AAEF,6BAA6B;AAC7B,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,yBAAyB;IACzB,QAAQ;IACR,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,aAAa;IACb,UAAU;IACV,SAAS;IACT,WAAW;IACX,UAAU;IACV,WAAW;IACX,UAAU;IACV,UAAU;IACV,aAAa;IACb,UAAU;IACV,kBAAkB;IAClB,OAAO;IACP,UAAU;IACV,aAAa;IACb,oBAAoB;IACpB,UAAU;IACV,eAAe;IACf,aAAa;IACb,eAAe;IACf,YAAY;IACZ,2BAA2B;IAC3B,MAAM;IACN,MAAM;IACN,SAAS;IACT,MAAM;IACN,cAAc;IACd,YAAY;IACZ,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,mBAAmB;IACnB,MAAM;IACN,QAAQ;IACR,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,yBAAyB;IACzB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,aAAa;IACb,QAAQ;IACR,oBAAoB;IACpB,eAAe;IACf,aAAa;IACb,SAAS;IACT,wBAAwB;IACxB,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,KAAK;IACL,wBAAwB;IACxB,QAAQ;IACR,QAAQ;IACR,uBAAuB;IACvB,WAAW;IACX,SAAS;IACT,yBAAyB;IACzB,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,IAAI;IACJ,OAAO;IACP,UAAU;CACX,CAAC,CAAC"}

package/dist/utils/shell/command-safety/find-helpers.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Check if a find command has dangerous execution flags (-exec, -execdir, -ok, -okdir, -delete)
+ */
+export declare function hasFindDangerousExecution(args: any[]): {
+    dangerous: boolean;
+    reason?: string;
+};
+/**
+ * Check for suspicious find flags that warrant YELLOW classification
+ */
+export declare function hasFindSuspiciousFlags(args: any[]): {
+    suspicious: boolean;
+    reason?: string;
+};
+//# sourceMappingURL=find-helpers.d.ts.map

package/dist/utils/shell/command-safety/find-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-helpers.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/command-safety/find-helpers.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG;IACtD,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAuEA;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG;IACnD,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA+DA"}

package/dist/utils/shell/command-safety/find-helpers.js

@@ -0,0 +1,131 @@
+import { extractWordText } from './utils.js';
+/**
+ * Check if a find command has dangerous execution flags (-exec, -execdir, -ok, -okdir, -delete)
+ */
+export function hasFindDangerousExecution(args) {
+    for (let i = 0; i < args.length; i++) {
+        const argText = extractWordText(args[i]);
+        if (!argText)
+            continue;
+        // Check for -delete flag
+        if (argText === '-delete') {
+            return { dangerous: true, reason: 'find -delete (destructive)' };
+        }
+        // Check for execution flags
+        const execFlags = ['-exec', '-execdir', '-ok', '-okdir'];
+        if (!execFlags.includes(argText))
+            continue;
+        // Found an exec flag - analyze the command it executes
+        // Find the terminator (; or +)
+        let terminatorIndex = -1;
+        for (let j = i + 1; j < args.length; j++) {
+            const term = extractWordText(args[j]);
+            if (term === ';' || term === '+' || term === '\\;' || term === '\\+') {
+                terminatorIndex = j;
+                break;
+            }
+        }
+        if (terminatorIndex === -1)
+            continue;
+        // Extract the command between exec flag and terminator
+        const execArgs = args.slice(i + 1, terminatorIndex);
+        // Check for redirects (which indicate shell operations). These are suspicious,
+        // but not necessarily destructive without knowing the surrounding task.
+        const hasRedirect = execArgs.some((a) => a?.type === 'Redirect');
+        if (hasRedirect)
+            continue;
+        const execCommand = execArgs.map((a) => extractWordText(a)).filter(Boolean);
+        if (execCommand.length === 0)
+            continue;
+        const cmdName = execCommand[0];
+        if (!cmdName) {
+            return {
+                dangerous: true,
+                reason: `find ${argText} with undefined command`,
+            };
+        }
+        // Check if {} is the command itself (executing found files)
+        if (cmdName === '{}') {
+            return {
+                dangerous: true,
+                reason: `find ${argText} {} (executes found files directly)`,
+            };
+        }
+        // Check for destructive commands
+        const destructiveCmds = ['rm', 'shred', 'dd', 'mkfs', 'truncate'];
+        if (destructiveCmds.includes(cmdName)) {
+            return {
+                dangerous: true,
+                reason: `find ${argText} ${cmdName} (destructive)`,
+            };
+        }
+        // Check for shell metacharacters in command. These make the command harder to
+        // reason about, so they should remain YELLOW through hasFindSuspiciousFlags.
+        const fullExecCmd = execCommand.join(' ');
+        if (/[|&;$`<>]/.test(fullExecCmd))
+            continue;
+    }
+    return { dangerous: false };
+}
+/**
+ * Check for suspicious find flags that warrant YELLOW classification
+ */
+export function hasFindSuspiciousFlags(args) {
+    for (const arg of args) {
+        const argText = extractWordText(arg);
+        if (!argText)
+            continue;
+        // File output flags
+        if (['-fprint', '-fprint0', '-fprintf', '-fls'].some((flag) => argText.startsWith(flag))) {
+            return {
+                suspicious: true,
+                reason: `find ${argText} (file output)`,
+            };
+        }
+        // Symlink following
+        if (['-L', '-follow', '-H'].includes(argText)) {
+            return {
+                suspicious: true,
+                reason: `find ${argText} (symlink following)`,
+            };
+        }
+        // SUID/SGID permission searches
+        if (argText === '-perm') {
+            // Check the next argument for dangerous permission patterns
+            const nextIdx = args.indexOf(arg) + 1;
+            if (nextIdx < args.length) {
+                const permValue = extractWordText(args[nextIdx]);
+                if (permValue) {
+                    // Numeric SUID/SGID patterns (e.g., -4000, /6000)
+                    const hasNumericSuid = /[-/]?[2467]000/.test(permValue);
+                    // Symbolic SUID/SGID patterns (e.g., -u+s, /g+s, +s)
+                    const hasSymbolicSuid = /[ug]?\+s/.test(permValue);
+                    if (hasNumericSuid || hasSymbolicSuid) {
+                        return {
+                            suspicious: true,
+                            reason: `find -perm ${permValue} (SUID/SGID search)`,
+                        };
+                    }
+                }
+            }
+        }
+        // Inode-based searches (can bypass path restrictions)
+        if (argText === '-inum') {
+            return {
+                suspicious: true,
+                reason: 'find -inum (inode-based access bypasses path checks)',
+            };
+        }
+        // Read-only exec (still suspicious, requires approval)
+        if (['-exec', '-execdir', '-ok', '-okdir'].includes(argText)) {
+            // If we reach here, hasFindDangerousExecution already passed (not RED)
+            // but any -exec usage should still be YELLOW
+            return {
+                suspicious: true,
+                reason: `find ${argText} (command execution)`,
+            };
+        }
+    }
+    return { suspicious: false };
+}
+//# sourceMappingURL=find-helpers.js.map

package/dist/utils/shell/command-safety/find-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-helpers.js","sourceRoot":"","sources":["../../../../source/utils/shell/command-safety/find-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAW;IAInD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,yBAAyB;QACzB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QACnE,CAAC;QAED,4BAA4B;QAC5B,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QAE3C,uDAAuD;QACvD,+BAA+B;QAC/B,IAAI,eAAe,GAAG,CAAC,CAAC,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACrE,eAAe,GAAG,CAAC,CAAC;gBACpB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,eAAe,KAAK,CAAC,CAAC;YAAE,SAAS;QAErC,uDAAuD;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;QAEpD,+EAA+E;QAC/E,wEAAwE;QACxE,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC;QACtE,IAAI,WAAW;YAAE,SAAS;QAE1B,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE5E,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEvC,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,QAAQ,OAAO,yBAAyB;aACjD,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,QAAQ,OAAO,qCAAqC;aAC7D,CAAC;QACJ,CAAC;QAED,iCAAiC;QACjC,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,QAAQ,OAAO,IAAI,OAAO,gBAAgB;aACnD,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,6EAA6E;QAC7E,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,SAAS;IAC9C,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAW;IAIhD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,oBAAoB;QACpB,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACzF,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,QAAQ,OAAO,gBAAgB;aACxC,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,QAAQ,OAAO,sBAAsB;aAC9C,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,4DAA4D;YAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBACjD,IAAI,SAAS,EAAE,CAAC;oBACd,kDAAkD;oBAClD,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACxD,qDAAqD;oBACrD,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAEnD,IAAI,cAAc,IAAI,eAAe,EAAE,CAAC;wBACtC,OAAO;4BACL,UAAU,EAAE,IAAI;4BAChB,MAAM,EAAE,cAAc,SAAS,qBAAqB;yBACrD,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,sDAAsD;aAC/D,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,uEAAuE;YACvE,6CAA6C;YAC7C,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,QAAQ,OAAO,sBAAsB;aAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC"}

package/dist/utils/shell/command-safety/handlers/find-handler.d.ts

@@ -0,0 +1,6 @@
+import type { CommandHandler } from './types.js';
+/**
+ * Handler for find command safety analysis
+ */
+export declare const findHandler: CommandHandler;
+//# sourceMappingURL=find-handler.d.ts.map

package/dist/utils/shell/command-safety/handlers/find-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-handler.d.ts","sourceRoot":"","sources":["../../../../../source/utils/shell/command-safety/handlers/find-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAA+C,MAAM,YAAY,CAAC;AAE9F;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,cA6GzB,CAAC"}

package/dist/utils/shell/command-safety/handlers/find-handler.js

@@ -0,0 +1,106 @@
+import { SafetyStatus } from '../constants.js';
+/**
+ * Handler for find command safety analysis
+ */
+export const findHandler = {
+    handle(node, helpers) {
+        const { extractWordText, analyzePathRisk, hasFindDangerousExecution, hasFindSuspiciousFlags } = helpers;
+        const reasons = [];
+        let status = SafetyStatus.GREEN;
+        if (!node.suffix) {
+            return { status, reasons };
+        }
+        // Check for dangerous find operations first (RED)
+        const dangerResult = hasFindDangerousExecution(node.suffix);
+        if (dangerResult.dangerous) {
+            return {
+                status: SafetyStatus.RED,
+                reasons: [dangerResult.reason || 'find with dangerous flags'],
+            };
+        }
+        // Check for suspicious find flags (YELLOW)
+        const suspiciousResult = hasFindSuspiciousFlags(node.suffix);
+        if (suspiciousResult.suspicious) {
+            status = SafetyStatus.YELLOW;
+            reasons.push(suspiciousResult.reason || 'find with suspicious flags');
+        }
+        // Check path arguments for find
+        // Track if previous arg was a pattern flag like -name, -regex
+        let previousArgWasPatternFlag = false;
+        for (const arg of node.suffix) {
+            if (arg?.type === 'Redirect')
+                continue;
+            const argText = extractWordText(arg);
+            if (!argText)
+                continue;
+            // Track pattern flags
+            if (['-name', '-iname', '-path', '-ipath', '-regex', '-iregex'].includes(argText)) {
+                previousArgWasPatternFlag = true;
+                continue;
+            }
+            // Skip flags
+            if (argText.startsWith('-')) {
+                previousArgWasPatternFlag = false;
+                continue;
+            }
+            // Skip pattern arguments (the values after -name, -regex, etc.)
+            if (previousArgWasPatternFlag) {
+                previousArgWasPatternFlag = false;
+                continue;
+            }
+            // Skip glob patterns (contain wildcards)
+            if (/[*?[\]]/.test(argText))
+                continue;
+            // Skip safe relative paths (. and ./)
+            if (argText === '.' || argText === './')
+                continue;
+            // Skip patterns with backslashes (regex patterns)
+            if (argText.includes('\\'))
+                continue;
+            // Root traversal detection (DoS + information disclosure)
+            if (argText === '/' || argText === '//') {
+                status = SafetyStatus.YELLOW;
+                reasons.push('find / (root traversal - resource intensive)');
+                continue;
+            }
+            // For find, analyzing paths is more lenient:
+            // - System paths like /etc are YELLOW (not RED)
+            // - Home directories and dotfiles are still RED
+            const pathStatus = analyzePathRisk(argText);
+            if (pathStatus === SafetyStatus.RED) {
+                // Keep RED for home directories, dotfiles, and traversal
+                // Downgrade system paths to YELLOW
+                const homeRelatedPatterns = [
+                    /^~/, // Tilde
+                    /^\$/, // Variables like $HOME, $USER
+                    /^\/home\//, // Linux home
+                    /^\/Users\//, // macOS home
+                    /^\/root/, // Root's home
+                    /\/\.ssh/, // SSH keys
+                    /\/\.env/, // Environment files
+                    /\/\.git/, // Git config
+                    /\/\.aws/, // AWS credentials
+                    /\/\.kube/, // Kubernetes config
+                    /\/\.gnupg/, // GPG keys
+                    /\.\./, // Directory traversal
+                ];
+                const isHomeRelated = homeRelatedPatterns.some((pattern) => pattern.test(argText));
+                if (isHomeRelated) {
+                    status = SafetyStatus.RED;
+                    reasons.push(`find dangerous path: ${argText}`);
+                }
+                else {
+                    // System paths like /etc get downgraded to YELLOW
+                    status = SafetyStatus.YELLOW;
+                    reasons.push(`find system path: ${argText}`);
+                }
+            }
+            else if (pathStatus === SafetyStatus.YELLOW) {
+                status = pathStatus;
+                reasons.push(`find path argument ${argText}`);
+            }
+        }
+        return { status, reasons };
+    },
+};
+//# sourceMappingURL=find-handler.js.map

package/dist/utils/shell/command-safety/handlers/find-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-handler.js","sourceRoot":"","sources":["../../../../../source/utils/shell/command-safety/handlers/find-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,MAAM,CAAC,IAAS,EAAE,OAA8B;QAC9C,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,GAAG,OAAO,CAAC;QACxG,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,MAAM,GAAiB,YAAY,CAAC,KAAK,CAAC;QAE9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,CAAC;QAED,kDAAkD;QAClD,MAAM,YAAY,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;YAC3B,OAAO;gBACL,MAAM,EAAE,YAAY,CAAC,GAAG;gBACxB,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,IAAI,2BAA2B,CAAC;aAC9D,CAAC;QACJ,CAAC;QAED,2CAA2C;QAC3C,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,gBAAgB,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,4BAA4B,CAAC,CAAC;QACxE,CAAC;QAED,gCAAgC;QAChC,8DAA8D;QAC9D,IAAI,yBAAyB,GAAG,KAAK,CAAC;QAEtC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,IAAI,GAAG,EAAE,IAAI,KAAK,UAAU;gBAAE,SAAS;YACvC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,sBAAsB;YACtB,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClF,yBAAyB,GAAG,IAAI,CAAC;gBACjC,SAAS;YACX,CAAC;YAED,aAAa;YACb,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,yBAAyB,GAAG,KAAK,CAAC;gBAClC,SAAS;YACX,CAAC;YAED,gEAAgE;YAChE,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,yBAAyB,GAAG,KAAK,CAAC;gBAClC,SAAS;YACX,CAAC;YAED,yCAAyC;YACzC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,SAAS;YAEtC,sCAAsC;YACtC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;gBAAE,SAAS;YAElD,kDAAkD;YAClD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAErC,0DAA0D;YAC1D,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACxC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;gBAC7D,SAAS;YACX,CAAC;YAED,6CAA6C;YAC7C,gDAAgD;YAChD,gDAAgD;YAChD,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,UAAU,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;gBACpC,yDAAyD;gBACzD,mCAAmC;gBACnC,MAAM,mBAAmB,GAAG;oBAC1B,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,8BAA8B;oBACrC,WAAW,EAAE,aAAa;oBAC1B,YAAY,EAAE,aAAa;oBAC3B,SAAS,EAAE,cAAc;oBACzB,SAAS,EAAE,WAAW;oBACtB,SAAS,EAAE,oBAAoB;oBAC/B,SAAS,EAAE,aAAa;oBACxB,SAAS,EAAE,kBAAkB;oBAC7B,UAAU,EAAE,oBAAoB;oBAChC,WAAW,EAAE,WAAW;oBACxB,MAAM,EAAE,sBAAsB;iBAC/B,CAAC;gBAEF,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAEnF,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC;oBAC1B,OAAO,CAAC,IAAI,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;gBAClD,CAAC;qBAAM,CAAC;oBACN,kDAAkD;oBAClD,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;oBAC7B,OAAO,CAAC,IAAI,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;iBAAM,IAAI,UAAU,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;gBAC9C,MAAM,GAAG,UAAU,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;CACF,CAAC"}

package/dist/utils/shell/command-safety/handlers/git-handler.d.ts

@@ -0,0 +1,6 @@
+import type { CommandHandler } from './types.js';
+/**
+ * Handler for git command safety analysis
+ */
+export declare const gitHandler: CommandHandler;
+//# sourceMappingURL=git-handler.d.ts.map

package/dist/utils/shell/command-safety/handlers/git-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-handler.d.ts","sourceRoot":"","sources":["../../../../../source/utils/shell/command-safety/handlers/git-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAA+C,MAAM,YAAY,CAAC;AAe9F;;GAEG;AACH,eAAO,MAAM,UAAU,EAAE,cAkFxB,CAAC"}