@qduc/term2 0.9.0 → 0.9.1

package/dist/tools/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../source/tools/utils.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAE5E;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,UAAkB,OAAO,CAAC,GAAG,EAAE,EAC/B,OAUC;IAED,MAAM,qBAAqB,GAAG,OAAO,EAAE,qBAAqB,IAAI,KAAK,CAAC;IACtE,MAAM,2BAA2B,GAAG,OAAO,EAAE,2BAA2B,IAAI,KAAK,CAAC;IAElF,sCAAsC;IACtC,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAEzG,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAEpH,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAElD,kHAAkH;IAClH,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC;IAC3G,IAAI,QAAQ,GAAG,kBAAkB,KAAK,iBAAiB,IAAI,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAErG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,qDAAqD;QACrD,MAAM,SAAS,GACb,kBAAkB,KAAK,MAAM;YAC7B,kBAAkB,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;YAChD,kBAAkB,KAAK,cAAc;YACrC,kBAAkB,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAE3D,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,2BAA2B,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,CAAC,UAAkB,EAAE,QAAgB,EAAW,EAAE;YACjE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;YAClG,OAAO,UAAU,KAAK,cAAc,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC5E,CAAC,CAAC;QAEF,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnF,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpF,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,gCAAgC,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../source/tools/utils.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,UAAkB,OAAO,CAAC,GAAG,EAAE,EAC/B,OAUC;IAED,MAAM,qBAAqB,GAAG,OAAO,EAAE,qBAAqB,IAAI,KAAK,CAAC;IACtE,MAAM,2BAA2B,GAAG,OAAO,EAAE,2BAA2B,IAAI,KAAK,CAAC;IAElF,sCAAsC;IACtC,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAEzG,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAEpH,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAElD,kHAAkH;IAClH,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC;IAC3G,IAAI,QAAQ,GAAG,kBAAkB,KAAK,iBAAiB,IAAI,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAErG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,+DAA+D;QAC/D,qEAAqE;QACrE,MAAM,SAAS,GACb,kBAAkB,KAAK,gBAAgB,IAAI,kBAAkB,CAAC,UAAU,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAExG,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,2BAA2B,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,CAAC,UAAkB,EAAE,QAAgB,EAAW,EAAE;YACjE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;YAClG,OAAO,UAAU,KAAK,cAAc,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC5E,CAAC,CAAC;QAEF,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnF,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpF,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,gCAAgC,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC"}

package/dist/utils/command-safety/handlers/script-handler.d.ts

@@ -0,0 +1,3 @@
+import type { CommandHandler } from './types.js';
+export declare const scriptHandler: CommandHandler;
+//# sourceMappingURL=script-handler.d.ts.map

package/dist/utils/command-safety/handlers/script-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"script-handler.d.ts","sourceRoot":"","sources":["../../../../source/utils/command-safety/handlers/script-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAA+C,MAAM,YAAY,CAAC;AA0E9F,eAAO,MAAM,aAAa,EAAE,cAyC3B,CAAC"}

package/dist/utils/command-safety/handlers/script-handler.js

@@ -0,0 +1,92 @@
+import { SafetyStatus } from '../constants.js';
+const INLINE_EVAL_FLAGS = new Set(['-e', '--eval', '-p']);
+const INTERPRETER_METADATA_FLAGS = new Set(['-h', '--help', '-v', '--version']);
+const SHELL_INTERPRETERS = new Set(['bash', 'sh', 'zsh', 'dash']);
+const SCRIPT_INTERPRETERS = new Set(['node', 'nodejs', 'python', 'python3']);
+const SCRIPT_EXTENSIONS = ['.js', '.mjs', '.cjs', '.ts', '.tsx', '.py', '.sh', '.bash', '.zsh', '.dash', '.pl', '.rb'];
+function getCommandName(node, extractWordText) {
+    return node?.name?.text || (node?.name && extractWordText(node.name));
+}
+function getSuffixWords(node, extractWordText) {
+    if (!Array.isArray(node?.suffix)) {
+        return [];
+    }
+    return node.suffix
+        .map((arg) => extractWordText(arg))
+        .filter((value) => {
+        return typeof value === 'string' && value.length > 0;
+    });
+}
+function isMetadataCommand(args) {
+    return args.some((arg) => INTERPRETER_METADATA_FLAGS.has(arg));
+}
+function isInlineEvalCommand(args) {
+    return args.some((arg) => INLINE_EVAL_FLAGS.has(arg));
+}
+function isInlineShellCommand(args) {
+    return args.some((arg) => {
+        if (!arg.startsWith('-') || arg.startsWith('--')) {
+            return false;
+        }
+        return arg.includes('c');
+    });
+}
+function isLikelyScriptPath(value) {
+    if (!value || value.startsWith('-') || value.startsWith('--')) {
+        return false;
+    }
+    if (value.startsWith('/')) {
+        return false;
+    }
+    if (value.startsWith('./') || value.startsWith('../')) {
+        return true;
+    }
+    if (value.includes('/')) {
+        return true;
+    }
+    return SCRIPT_EXTENSIONS.some((extension) => value.endsWith(extension));
+}
+function buildSandboxResult(reason) {
+    return {
+        status: SafetyStatus.YELLOW,
+        reasons: [reason],
+        execution: {
+            requiresSandbox: true,
+            sandboxReason: reason,
+        },
+    };
+}
+export const scriptHandler = {
+    handle(node, helpers) {
+        const { extractWordText } = helpers;
+        const commandName = getCommandName(node, extractWordText);
+        const args = getSuffixWords(node, extractWordText);
+        if (!commandName) {
+            return { status: SafetyStatus.GREEN, reasons: [] };
+        }
+        if (SCRIPT_INTERPRETERS.has(commandName)) {
+            if (isMetadataCommand(args)) {
+                return { status: SafetyStatus.GREEN, reasons: [] };
+            }
+            if (isInlineEvalCommand(args)) {
+                return buildSandboxResult(`${commandName} inline evaluation requires sandbox`);
+            }
+            if ((commandName === 'python' || commandName === 'python3') && args.includes('-c')) {
+                return buildSandboxResult(`${commandName} inline evaluation requires sandbox`);
+            }
+            const firstPositionalArg = args.find((arg) => !arg.startsWith('-'));
+            if (firstPositionalArg && isLikelyScriptPath(firstPositionalArg)) {
+                return buildSandboxResult(`${commandName} script execution requires sandbox: ${firstPositionalArg}`);
+            }
+            return { status: SafetyStatus.GREEN, reasons: [] };
+        }
+        if (SHELL_INTERPRETERS.has(commandName) && isInlineShellCommand(args)) {
+            return buildSandboxResult(`${commandName} inline shell execution requires sandbox`);
+        }
+        if (isLikelyScriptPath(commandName)) {
+            return buildSandboxResult(`local script execution requires sandbox: ${commandName}`);
+        }
+        return { status: SafetyStatus.GREEN, reasons: [] };
+    },
+};
+//# sourceMappingURL=script-handler.js.map

package/dist/utils/command-safety/handlers/script-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"script-handler.js","sourceRoot":"","sources":["../../../../source/utils/command-safety/handlers/script-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1D,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;AAChF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAClE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAE7E,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAEvH,SAAS,cAAc,CAAC,IAAS,EAAE,eAAyD;IAC1F,OAAO,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,IAAS,EAAE,eAAyD;IAC1F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,IAAI,CAAC,MAAM;SACf,GAAG,CAAC,CAAC,GAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;SACvC,MAAM,CAAC,CAAC,KAAyB,EAAmB,EAAE;QACrD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAc;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAc;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAc;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACvB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,OAAO;QACL,MAAM,EAAE,YAAY,CAAC,MAAM;QAC3B,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,SAAS,EAAE;YACT,eAAe,EAAE,IAAI;YACrB,aAAa,EAAE,MAAM;SACtB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAmB;IAC3C,MAAM,CAAC,IAAS,EAAE,OAA8B;QAC9C,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAEnD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACrD,CAAC;QAED,IAAI,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACrD,CAAC;YAED,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,OAAO,kBAAkB,CAAC,GAAG,WAAW,qCAAqC,CAAC,CAAC;YACjF,CAAC;YAED,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnF,OAAO,kBAAkB,CAAC,GAAG,WAAW,qCAAqC,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACpE,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACjE,OAAO,kBAAkB,CAAC,GAAG,WAAW,uCAAuC,kBAAkB,EAAE,CAAC,CAAC;YACvG,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACrD,CAAC;QAED,IAAI,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,OAAO,kBAAkB,CAAC,GAAG,WAAW,0CAA0C,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,kBAAkB,CAAC,4CAA4C,WAAW,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrD,CAAC;CACF,CAAC"}

package/dist/utils/command-safety/handlers/script-handler.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=script-handler.test.d.ts.map

package/dist/utils/command-safety/handlers/script-handler.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"script-handler.test.d.ts","sourceRoot":"","sources":["../../../../source/utils/command-safety/handlers/script-handler.test.ts"],"names":[],"mappings":""}

package/dist/utils/command-safety/handlers/script-handler.test.js

@@ -0,0 +1,44 @@
+import test from 'ava';
+import { SafetyStatus } from '../constants.js';
+import { classifyCommandDetailed } from '../index.js';
+test('script handler classifies inline interpreter eval commands as sandbox-required', (t) => {
+    const cases = [
+        'node -e "console.log(1)"',
+        'node --eval "console.log(1)"',
+        'node -p "1 + 1"',
+        'python -c "print(1)"',
+        'python3 -c "print(1)"',
+        'bash -c "echo hello"',
+        'sh -c "echo hello"',
+        'zsh -c "echo hello"',
+        'dash -c "echo hello"',
+    ];
+    for (const command of cases) {
+        const result = classifyCommandDetailed(command);
+        t.is(result.status, SafetyStatus.YELLOW, command);
+        t.true(result.execution.requiresSandbox, command);
+        t.truthy(result.execution.sandboxReason, command);
+    }
+});
+test('script handler classifies direct script targets as sandbox-required', (t) => {
+    const cases = ['node temp.js', 'python test.py', './run.sh', 'scripts/build.sh', 'node_modules/.bin/eslint'];
+    for (const command of cases) {
+        const result = classifyCommandDetailed(command);
+        t.is(result.status, SafetyStatus.YELLOW, command);
+        t.true(result.execution.requiresSandbox, command);
+    }
+});
+test('script handler leaves interpreter metadata commands as green', (t) => {
+    const cases = ['node --version', 'python --version', 'bash --version', 'sh --help'];
+    for (const command of cases) {
+        const result = classifyCommandDetailed(command);
+        t.is(result.status, SafetyStatus.GREEN, command);
+        t.false(result.execution.requiresSandbox ?? false, command);
+    }
+});
+test('script handler propagates sandbox requirement through nested command substitutions', (t) => {
+    const result = classifyCommandDetailed('echo $(node -e "console.log(1)")');
+    t.is(result.status, SafetyStatus.YELLOW);
+    t.true(result.execution.requiresSandbox);
+});
+//# sourceMappingURL=script-handler.test.js.map

package/dist/utils/command-safety/handlers/script-handler.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"script-handler.test.js","sourceRoot":"","sources":["../../../../source/utils/command-safety/handlers/script-handler.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,KAAK,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,IAAI,CAAC,gFAAgF,EAAE,CAAC,CAAC,EAAE,EAAE;IAC3F,MAAM,KAAK,GAAG;QACZ,0BAA0B;QAC1B,8BAA8B;QAC9B,iBAAiB;QACjB,sBAAsB;QACtB,uBAAuB;QACvB,sBAAsB;QACtB,oBAAoB;QACpB,qBAAqB;QACrB,sBAAsB;KACvB,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,CAAC,CAAC,EAAE,EAAE;IAChF,MAAM,KAAK,GAAG,CAAC,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,EAAE,0BAA0B,CAAC,CAAC;IAE7G,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8DAA8D,EAAE,CAAC,CAAC,EAAE,EAAE;IACzE,MAAM,KAAK,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAEpF,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,IAAI,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oFAAoF,EAAE,CAAC,CAAC,EAAE,EAAE;IAC/F,MAAM,MAAM,GAAG,uBAAuB,CAAC,kCAAkC,CAAC,CAAC;IAE3E,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC"}

package/dist/utils/command-safety/index.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test.d.ts.map

package/dist/utils/command-safety/index.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../../../source/utils/command-safety/index.test.ts"],"names":[],"mappings":""}

package/dist/utils/command-safety/index.test.js

@@ -0,0 +1,22 @@
+import test from 'ava';
+import { classifyCommandDetailed, validateCommandSafety } from './index.js';
+import { SafetyStatus } from './constants.js';
+test('classifyCommandDetailed returns merged execution metadata for sandbox-required commands', (t) => {
+    const result = classifyCommandDetailed('node -e "console.log(1)"');
+    t.is(result.status, SafetyStatus.YELLOW);
+    t.true(result.reasons.length > 0);
+    t.deepEqual(result.execution, {
+        requiresSandbox: true,
+        sandboxReason: 'node inline evaluation requires sandbox',
+    });
+});
+test('classifyCommandDetailed keeps execution metadata empty for normal commands', (t) => {
+    const result = classifyCommandDetailed('ls');
+    t.is(result.status, SafetyStatus.GREEN);
+    t.deepEqual(result.execution, {});
+});
+test('validateCommandSafety remains backward compatible', (t) => {
+    t.false(validateCommandSafety('ls'));
+    t.true(validateCommandSafety('node -e "console.log(1)"'));
+});
+//# sourceMappingURL=index.test.js.map

package/dist/utils/command-safety/index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../../../source/utils/command-safety/index.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,KAAK,CAAC;AACvB,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,IAAI,CAAC,yFAAyF,EAAE,CAAC,CAAC,EAAE,EAAE;IACpG,MAAM,MAAM,GAAG,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;IAEnE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE;QAC5B,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,yCAAyC;KACzD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4EAA4E,EAAE,CAAC,CAAC,EAAE,EAAE;IACvF,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAE7C,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mDAAmD,EAAE,CAAC,CAAC,EAAE,EAAE;IAC9D,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,0BAA0B,CAAC,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC"}

package/dist/utils/command-safety.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Validate command safety using an AST parser.
+ * Returns true when a command requires user approval.
+ * Throws for invalid/empty inputs.
+ */
+export declare enum SafetyStatus {
+    GREEN = "GREEN",
+    YELLOW = "YELLOW",
+    RED = "RED"
+}
+/**
+ * Classify command into a SafetyStatus (GREEN/YELLOW/RED)
+ */
+export declare function classifyCommand(commandString: string): SafetyStatus;
+/**
+ * Validate command safety using an AST parser.
+ * Returns true when a command requires user approval.
+ * Throws for invalid/empty inputs OR hard-blocked RED classifications.
+ */
+export declare function validateCommandSafety(command: string): boolean;
+//# sourceMappingURL=command-safety.d.ts.map

package/dist/utils/command-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-safety.d.ts","sourceRoot":"","sources":["../../source/utils/command-safety.ts"],"names":[],"mappings":"AAuDA;;;;GAIG;AACH,oBAAY,YAAY;IACpB,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,GAAG,QAAQ;CACd;AAyGD;;GAEG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,YAAY,CAyMnE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAyB9D"}

package/dist/utils/command-safety.devnull.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=command-safety.devnull.test.d.ts.map

package/dist/utils/command-safety.devnull.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-safety.devnull.test.d.ts","sourceRoot":"","sources":["../../source/utils/command-safety.devnull.test.ts"],"names":[],"mappings":""}

package/dist/utils/command-safety.devnull.test.js

@@ -0,0 +1,13 @@
+import test from 'ava';
+import { analyzePathRisk } from './command-safety/path-analysis.js';
+import { SafetyStatus, classifyCommand } from './command-safety/index.js';
+test('analyzePathRisk - /dev/null should be GREEN', t => {
+    const result = analyzePathRisk('/dev/null');
+    t.is(result, SafetyStatus.GREEN, '/dev/null should be considered safe');
+});
+test('classifyCommand - cat prod.sh 2>/dev/null | head -200 should be GREEN', t => {
+    const command = 'cat prod.sh 2>/dev/null | head -200';
+    const status = classifyCommand(command);
+    t.is(status, SafetyStatus.GREEN, 'command with /dev/null redirection should be GREEN');
+});
+//# sourceMappingURL=command-safety.devnull.test.js.map

package/dist/utils/command-safety.devnull.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-safety.devnull.test.js","sourceRoot":"","sources":["../../source/utils/command-safety.devnull.test.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,KAAK,CAAC;AACvB,OAAO,EAAC,eAAe,EAAC,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAC,YAAY,EAAE,eAAe,EAAC,MAAM,2BAA2B,CAAC;AAExE,IAAI,CAAC,6CAA6C,EAAE,CAAC,CAAC,EAAE;IACpD,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,qCAAqC,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAE,CAAC,CAAC,EAAE;IAC9E,MAAM,OAAO,GAAG,qCAAqC,CAAC;IACtD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,oDAAoD,CAAC,CAAC;AAC3F,CAAC,CAAC,CAAC"}

package/dist/utils/command-safety.js

@@ -0,0 +1,348 @@
+import parse from 'bash-parser';
+import path from 'path';
+import { loggingService } from '../services/logging-service.js';
+// 1. CONSTANTS
+// Note: 'sed' is useful for read-only transformations. We allow it by default
+// but add guards below to prevent in-place edits (-i) and unapproved redirections.
+const ALLOWED_COMMANDS = new Set([
+    'ls',
+    'pwd',
+    'grep',
+    'cat',
+    'echo',
+    'head',
+    'tail',
+    'sed',
+]);
+const BLOCKED_COMMANDS = new Set([
+    // Filesystem
+    'rm',
+    'rmdir',
+    'mkfs',
+    'dd',
+    'mv',
+    'cp',
+    // System
+    'sudo',
+    'su',
+    'chmod',
+    'chown',
+    'shutdown',
+    'reboot',
+    // Network/Web
+    'curl',
+    'wget',
+    'ssh',
+    'scp',
+    'netstat',
+    // Package Managers / installers
+    'apt',
+    'yum',
+    'npm',
+    'yarn',
+    'pnpm',
+    'pip',
+    'gem',
+    // Dangerous wrappers / misc
+    'eval',
+    'exec',
+    'kill',
+    'killall',
+]);
+/* legacy containsDangerousCommand removed — replaced by classifyCommand + path analysis */
+/**
+ * Validate command safety using an AST parser.
+ * Returns true when a command requires user approval.
+ * Throws for invalid/empty inputs.
+ */
+export var SafetyStatus;
+(function (SafetyStatus) {
+    SafetyStatus["GREEN"] = "GREEN";
+    SafetyStatus["YELLOW"] = "YELLOW";
+    SafetyStatus["RED"] = "RED";
+})(SafetyStatus || (SafetyStatus = {}));
+// Extract a best-effort string for a word/arg node, including expansions.
+function extractWordText(word) {
+    if (!word)
+        return undefined;
+    if (typeof word === 'string')
+        return word;
+    if (typeof word.text === 'string')
+        return word.text;
+    if (typeof word.value === 'string')
+        return word.value;
+    if (typeof word.content === 'string')
+        return word.content;
+    if (word.parameter)
+        return `$${word.parameter}`;
+    if (Array.isArray(word.parts)) {
+        return word.parts
+            .map((part) => extractWordText(part) ?? '')
+            .join('');
+    }
+    return undefined;
+}
+// 2. PATH ANALYSIS HELPER
+function analyzePathRisk(inputPath) {
+    const candidate = inputPath?.trim();
+    if (!candidate)
+        return SafetyStatus.GREEN;
+    // RED: Explicit home-dotfiles (.ssh, .env, etc.) even before expansion
+    if (candidate.startsWith('~') ||
+        candidate.startsWith('$HOME') ||
+        candidate.startsWith('${HOME}')) {
+        const sliced = candidate.replace(/^~/, '').replace(/^\$\{?HOME\}?/, '');
+        // Check for dotfiles after home prefix
+        if (/^\/\.\w+/.test(sliced) ||
+            sliced.includes('/.ssh') ||
+            sliced.includes('/.env')) {
+            loggingService.security('Path risk: home dotfile', {
+                path: candidate,
+            });
+            return SafetyStatus.RED;
+        }
+    }
+    // RED: Absolute System Paths
+    if (path.isAbsolute(candidate)) {
+        const SYSTEM_PATHS = [
+            '/etc',
+            '/dev',
+            '/proc',
+            '/var',
+            '/usr',
+            '/boot',
+            '/bin',
+        ];
+        if (SYSTEM_PATHS.some(sys => candidate.startsWith(sys))) {
+            loggingService.security('Path risk: absolute system path', {
+                path: candidate,
+            });
+            return SafetyStatus.RED;
+        }
+        // Home dotfiles when absolute
+        if (/^\/(home|Users)\/[^/]+\/\.\w+/.test(candidate) ||
+            candidate.includes('/.ssh') ||
+            candidate.includes('/.gitconfig')) {
+            loggingService.security('Path risk: absolute home dotfile', {
+                path: candidate,
+            });
+            return SafetyStatus.RED;
+        }
+        // Other absolute paths are suspicious -> audit
+        loggingService.security('Path risk: absolute non-system path', {
+            path: candidate,
+        });
+        return SafetyStatus.YELLOW;
+    }
+    // RED: Directory Traversal
+    if (candidate.includes('..')) {
+        loggingService.security('Path risk: directory traversal detected', {
+            path: candidate,
+        });
+        return SafetyStatus.RED;
+    }
+    // Hidden files -> YELLOW
+    const filename = path.basename(candidate);
+    if (filename.startsWith('.')) {
+        loggingService.security('Path risk: hidden file', { path: candidate });
+        return SafetyStatus.YELLOW;
+    }
+    // Sensitive extensions
+    const SENSITIVE_EXTENSIONS = ['.env', '.pem', '.key', '.json'];
+    if (SENSITIVE_EXTENSIONS.some(ext => filename.endsWith(ext))) {
+        loggingService.security('Path risk: sensitive extension', {
+            path: candidate,
+        });
+        return SafetyStatus.YELLOW;
+    }
+    return SafetyStatus.GREEN;
+}
+/**
+ * Classify command into a SafetyStatus (GREEN/YELLOW/RED)
+ */
+export function classifyCommand(commandString) {
+    try {
+        const reasons = [];
+        const truncatedCommand = commandString.substring(0, 200);
+        loggingService.security('Classifying command safety', {
+            command: truncatedCommand,
+        });
+        const ast = parse(commandString, { mode: 'bash' });
+        let worstStatus = SafetyStatus.GREEN;
+        function upgradeStatus(s, reason) {
+            if (worstStatus === SafetyStatus.RED)
+                return;
+            if (s === SafetyStatus.RED)
+                worstStatus = SafetyStatus.RED;
+            else if (s === SafetyStatus.YELLOW &&
+                worstStatus === SafetyStatus.GREEN)
+                worstStatus = SafetyStatus.YELLOW;
+            if (reason)
+                reasons.push(`${s}: ${reason}`);
+        }
+        function traverse(node) {
+            if (!node)
+                return;
+            if (Array.isArray(node))
+                return node.forEach(traverse);
+            if (node.type === 'Command') {
+                const name = node.name?.text ||
+                    (node.name &&
+                        node.name.parts &&
+                        node.name.parts.map((p) => p.text).join(''));
+                if (typeof name === 'string') {
+                    if (BLOCKED_COMMANDS.has(name)) {
+                        upgradeStatus(SafetyStatus.RED, `blocked command: ${name}`);
+                        return;
+                    }
+                    if (!ALLOWED_COMMANDS.has(name)) {
+                        upgradeStatus(SafetyStatus.YELLOW, `unknown or unlisted command: ${name}`);
+                    }
+                }
+                const cmdName = typeof name === 'string' ? name : undefined;
+                if (node.suffix) {
+                    let hasOutputRedirect = false;
+                    let hasInPlaceEdit = false;
+                    // First pass: detect dangerous sed patterns
+                    for (const arg of node.suffix) {
+                        if (arg?.type === 'Redirect') {
+                            // Check if it's an output redirect (>, >>)
+                            const op = arg.op?.text || arg.op;
+                            if (op === '>' || op === '>>') {
+                                hasOutputRedirect = true;
+                            }
+                        }
+                        const argText = extractWordText(arg);
+                        if (argText && argText.startsWith('-')) {
+                            if (cmdName === 'sed' && argText.startsWith('-i')) {
+                                hasInPlaceEdit = true;
+                            }
+                        }
+                    }
+                    // Second pass: classify arguments
+                    for (const arg of node.suffix) {
+                        // Redirects: analyze path risk. For `sed`, only mark output redirects as YELLOW
+                        if (arg?.type === 'Redirect') {
+                            const fileText = extractWordText(arg.file ?? arg);
+                            const op = arg.op?.text || arg.op;
+                            if (cmdName === 'sed' &&
+                                (op === '>' || op === '>>')) {
+                                upgradeStatus(SafetyStatus.YELLOW, `sed with output redirection to ${fileText ?? '<unknown>'}`);
+                            }
+                            const pathStatus = analyzePathRisk(fileText);
+                            upgradeStatus(pathStatus, `redirect to ${fileText ?? '<unknown>'}`);
+                            continue;
+                        }
+                        const argText = extractWordText(arg);
+                        // Flags are normally ignored, but for `sed` the -i flag is dangerous
+                        // because it performs in-place edits. Detect -i and variants (e.g. -i, -i.bak, -i'')
+                        if (argText && argText.startsWith('-')) {
+                            if (cmdName === 'sed' && argText.startsWith('-i')) {
+                                upgradeStatus(SafetyStatus.RED, `sed in-place edit detected: ${argText}`);
+                                continue;
+                            }
+                            continue; // other flags ignored
+                        }
+                        const pathStatus = analyzePathRisk(argText);
+                        // For `sed`, file arguments are only risky if combined with dangerous operations
+                        if (cmdName === 'sed' && argText) {
+                            // If there's an in-place edit or output redirect, path risk matters
+                            // Otherwise, reading files with sed is safe (GREEN)
+                            if (hasInPlaceEdit || hasOutputRedirect) {
+                                if (pathStatus === SafetyStatus.RED)
+                                    upgradeStatus(pathStatus, `sed file argument ${argText}`);
+                                else
+                                    upgradeStatus(SafetyStatus.YELLOW, `sed file argument ${argText}`);
+                            }
+                            else {
+                                // Read-only sed: only escalate if path itself is risky
+                                if (pathStatus !== SafetyStatus.GREEN) {
+                                    upgradeStatus(pathStatus, `sed file argument ${argText}`);
+                                }
+                                // Otherwise GREEN - read-only sed is safe
+                            }
+                            continue;
+                        }
+                        // Unknown/opaque args fall back to YELLOW
+                        if (!argText)
+                            upgradeStatus(SafetyStatus.YELLOW, 'opaque or unparseable argument');
+                        else
+                            upgradeStatus(pathStatus, `argument ${argText}`);
+                    }
+                }
+            }
+            // recurse common shapes
+            if (node.type === 'LogicalExpression') {
+                traverse(node.left);
+                traverse(node.right);
+                return;
+            }
+            if (node.type === 'Pipeline') {
+                (node.commands || []).forEach(traverse);
+                return;
+            }
+            if (node.type === 'Subshell') {
+                traverse(node.list);
+                return;
+            }
+            if (node.type === 'CommandSubstitution') {
+                (node.commands || []).forEach(traverse);
+                return;
+            }
+            if (node.type === 'Script' || node.type === 'Program') {
+                (node.commands || []).forEach(traverse);
+                return;
+            }
+            for (const k of Object.keys(node)) {
+                const v = node[k];
+                if (v && typeof v === 'object')
+                    traverse(v);
+            }
+        }
+        if (ast && ast.commands) {
+            ast.commands.forEach(traverse);
+        }
+        loggingService.security('Command classification result', {
+            command: truncatedCommand,
+            status: worstStatus,
+            reasons,
+        });
+        return worstStatus;
+    }
+    catch (e) {
+        // Fail-safe: unparsable -> audit
+        loggingService.warn('Failed to parse command, classifying as YELLOW', {
+            command: commandString.substring(0, 200),
+            error: e instanceof Error ? e.message : String(e),
+        });
+        return SafetyStatus.YELLOW;
+    }
+}
+/**
+ * Validate command safety using an AST parser.
+ * Returns true when a command requires user approval.
+ * Throws for invalid/empty inputs OR hard-blocked RED classifications.
+ */
+export function validateCommandSafety(command) {
+    if (!command ||
+        typeof command !== 'string' ||
+        command.trim().length === 0) {
+        throw new Error('Command cannot be empty');
+    }
+    loggingService.security('Validating command safety', {
+        command: command.substring(0, 200),
+    });
+    const status = classifyCommand(command);
+    if (status === SafetyStatus.RED) {
+        loggingService.security('Command validation failed: RED (forbidden)', {
+            command: command.substring(0, 200),
+        });
+        throw new Error('Command classified as RED (forbidden)');
+    }
+    loggingService.security('Validation result', {
+        command: command.substring(0, 200),
+        status,
+    });
+    return status === SafetyStatus.YELLOW;
+}
+//# sourceMappingURL=command-safety.js.map

package/dist/utils/command-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-safety.js","sourceRoot":"","sources":["../../source/utils/command-safety.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,aAAa,CAAC;AAChC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAC,cAAc,EAAC,MAAM,gCAAgC,CAAC;AAE9D,eAAe;AACf,8EAA8E;AAC9E,mFAAmF;AACnF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC7B,IAAI;IACJ,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;CACR,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC7B,aAAa;IACb,IAAI;IACJ,OAAO;IACP,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,SAAS;IACT,MAAM;IACN,IAAI;IACJ,OAAO;IACP,OAAO;IACP,UAAU;IACV,QAAQ;IACR,cAAc;IACd,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,SAAS;IACT,gCAAgC;IAChC,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,4BAA4B;IAC5B,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;CACZ,CAAC,CAAC;AAEH,2FAA2F;AAE3F;;;;GAIG;AACH,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACpB,+BAAe,CAAA;IACf,iCAAiB,CAAA;IACjB,2BAAW,CAAA;AACf,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED,0EAA0E;AAC1E,SAAS,eAAe,CAAC,IAAS;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACpD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACtD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IAC1D,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK;aACZ,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC/C,IAAI,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,0BAA0B;AAC1B,SAAS,eAAe,CAAC,SAA6B;IAClD,MAAM,SAAS,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,SAAS;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC;IAE1C,uEAAuE;IACvE,IACI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QAC7B,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EACjC,CAAC;QACC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACxE,uCAAuC;QACvC,IACI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;YACvB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YACxB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAC1B,CAAC;YACC,cAAc,CAAC,QAAQ,CAAC,yBAAyB,EAAE;gBAC/C,IAAI,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,GAAG,CAAC;QAC5B,CAAC;IACL,CAAC;IAED,6BAA6B;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG;YACjB,MAAM;YACN,MAAM;YACN,OAAO;YACP,MAAM;YACN,MAAM;YACN,OAAO;YACP,MAAM;SACT,CAAC;QACF,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACtD,cAAc,CAAC,QAAQ,CAAC,iCAAiC,EAAE;gBACvD,IAAI,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,GAAG,CAAC;QAC5B,CAAC;QACD,8BAA8B;QAC9B,IACI,+BAA+B,CAAC,IAAI,CAAC,SAAS,CAAC;YAC/C,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3B,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,EACnC,CAAC;YACC,cAAc,CAAC,QAAQ,CAAC,kCAAkC,EAAE;gBACxD,IAAI,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,GAAG,CAAC;QAC5B,CAAC;QACD,+CAA+C;QAC/C,cAAc,CAAC,QAAQ,CAAC,qCAAqC,EAAE;YAC3D,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,2BAA2B;IAC3B,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,cAAc,CAAC,QAAQ,CAAC,yCAAyC,EAAE;YAC/D,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED,yBAAyB;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,cAAc,CAAC,QAAQ,CAAC,wBAAwB,EAAE,EAAC,IAAI,EAAE,SAAS,EAAC,CAAC,CAAC;QACrE,OAAO,YAAY,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,uBAAuB;IACvB,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/D,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3D,cAAc,CAAC,QAAQ,CAAC,gCAAgC,EAAE;YACtD,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,OAAO,YAAY,CAAC,KAAK,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,aAAqB;IACjD,IAAI,CAAC;QACD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzD,cAAc,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAClD,OAAO,EAAE,gBAAgB;SAC5B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,EAAE,EAAC,IAAI,EAAE,MAAM,EAAC,CAAC,CAAC;QACjD,IAAI,WAAW,GAAiB,YAAY,CAAC,KAAK,CAAC;QAEnD,SAAS,aAAa,CAAC,CAAe,EAAE,MAAe;YACnD,IAAI,WAAW,KAAK,YAAY,CAAC,GAAG;gBAAE,OAAO;YAC7C,IAAI,CAAC,KAAK,YAAY,CAAC,GAAG;gBAAE,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC;iBACtD,IACD,CAAC,KAAK,YAAY,CAAC,MAAM;gBACzB,WAAW,KAAK,YAAY,CAAC,KAAK;gBAElC,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC;YACtC,IAAI,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,SAAS,QAAQ,CAAC,IAAS;YACvB,IAAI,CAAC,IAAI;gBAAE,OAAO;YAElB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAEvD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,GACN,IAAI,CAAC,IAAI,EAAE,IAAI;oBACf,CAAC,IAAI,CAAC,IAAI;wBACN,IAAI,CAAC,IAAI,CAAC,KAAK;wBACf,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC3B,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC7B,aAAa,CACT,YAAY,CAAC,GAAG,EAChB,oBAAoB,IAAI,EAAE,CAC7B,CAAC;wBACF,OAAO;oBACX,CAAC;oBACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC9B,aAAa,CACT,YAAY,CAAC,MAAM,EACnB,gCAAgC,IAAI,EAAE,CACzC,CAAC;oBACN,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;gBAE5D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBACd,IAAI,iBAAiB,GAAG,KAAK,CAAC;oBAC9B,IAAI,cAAc,GAAG,KAAK,CAAC;oBAE3B,4CAA4C;oBAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;wBAC5B,IAAI,GAAG,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;4BAC3B,2CAA2C;4BAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,EAAE,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;4BAClC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gCAC5B,iBAAiB,GAAG,IAAI,CAAC;4BAC7B,CAAC;wBACL,CAAC;wBAED,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;wBACrC,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;4BACrC,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gCAChD,cAAc,GAAG,IAAI,CAAC;4BAC1B,CAAC;wBACL,CAAC;oBACL,CAAC;oBAED,kCAAkC;oBAClC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;wBAC5B,gFAAgF;wBAChF,IAAI,GAAG,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;4BAC3B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;4BAClD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,EAAE,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;4BAElC,IACI,OAAO,KAAK,KAAK;gCACjB,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,EAC7B,CAAC;gCACC,aAAa,CACT,YAAY,CAAC,MAAM,EACnB,kCACI,QAAQ,IAAI,WAChB,EAAE,CACL,CAAC;4BACN,CAAC;4BAED,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;4BAC7C,aAAa,CACT,UAAU,EACV,eAAe,QAAQ,IAAI,WAAW,EAAE,CAC3C,CAAC;4BACF,SAAS;wBACb,CAAC;wBAED,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;wBACrC,qEAAqE;wBACrE,qFAAqF;wBACrF,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;4BACrC,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gCAChD,aAAa,CACT,YAAY,CAAC,GAAG,EAChB,+BAA+B,OAAO,EAAE,CAC3C,CAAC;gCACF,SAAS;4BACb,CAAC;4BACD,SAAS,CAAC,sBAAsB;wBACpC,CAAC;wBAED,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;wBAC5C,iFAAiF;wBACjF,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,EAAE,CAAC;4BAC/B,oEAAoE;4BACpE,oDAAoD;4BACpD,IAAI,cAAc,IAAI,iBAAiB,EAAE,CAAC;gCACtC,IAAI,UAAU,KAAK,YAAY,CAAC,GAAG;oCAC/B,aAAa,CACT,UAAU,EACV,qBAAqB,OAAO,EAAE,CACjC,CAAC;;oCAEF,aAAa,CACT,YAAY,CAAC,MAAM,EACnB,qBAAqB,OAAO,EAAE,CACjC,CAAC;4BACV,CAAC;iCAAM,CAAC;gCACJ,uDAAuD;gCACvD,IAAI,UAAU,KAAK,YAAY,CAAC,KAAK,EAAE,CAAC;oCACpC,aAAa,CACT,UAAU,EACV,qBAAqB,OAAO,EAAE,CACjC,CAAC;gCACN,CAAC;gCACD,0CAA0C;4BAC9C,CAAC;4BACD,SAAS;wBACb,CAAC;wBAED,0CAA0C;wBAC1C,IAAI,CAAC,OAAO;4BACR,aAAa,CACT,YAAY,CAAC,MAAM,EACnB,gCAAgC,CACnC,CAAC;;4BACD,aAAa,CAAC,UAAU,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;oBAC1D,CAAC;gBACL,CAAC;YACL,CAAC;YAED,wBAAwB;YACxB,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACpC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,OAAO;YACX,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC3B,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxC,OAAO;YACX,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,OAAO;YACX,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACtC,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxC,OAAO;YACX,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACpD,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxC,OAAO;YACX,CAAC;YAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YAChD,CAAC;QACL,CAAC;QAED,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACrB,GAAG,CAAC,QAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,cAAc,CAAC,QAAQ,CAAC,+BAA+B,EAAE;YACrD,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,WAAW;YACnB,OAAO;SACV,CAAC,CAAC;QAEH,OAAO,WAAW,CAAC;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,iCAAiC;QACjC,cAAc,CAAC,IAAI,CAAC,gDAAgD,EAAE;YAClE,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YACxC,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACpD,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC;IAC/B,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACjD,IACI,CAAC,OAAO;QACR,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;QACC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IACD,cAAc,CAAC,QAAQ,CAAC,2BAA2B,EAAE;QACjD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;KACrC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,MAAM,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;QAC9B,cAAc,CAAC,QAAQ,CAAC,4CAA4C,EAAE;YAClE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC7D,CAAC;IAED,cAAc,CAAC,QAAQ,CAAC,mBAAmB,EAAE;QACzC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;QAClC,MAAM;KACT,CAAC,CAAC;IACH,OAAO,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;AAC1C,CAAC"}