@securecode-ai/mcp 0.5.4 → 0.5.6

package/dist/utils/testRunner.js

@@ -0,0 +1,246 @@
+"use strict";
+/**
+ * Shared test runner — the core service for run_tests (both public MCP tool
+ * and agent action). Handles:
+ *   - Request validation
+ *   - Human approval (every execution, no exceptions)
+ *   - Sandbox execution via localTestRunner (generated) or runTestCommand (existing)
+ *   - Bounded, redacted output
+ *
+ * Security model:
+ *   - Approval is required before every execution — no batch grants, no timed grants.
+ *   - The approval hash binds to mode, command/script hash, runner, timeout, workspace.
+ *   - No execution occurs if approval is denied or times out.
+ *   - No host fallback when no sandbox is available.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateRunTestsRequest = validateRunTestsRequest;
+exports.runTests = runTests;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const broker_1 = require("../approval/broker");
+const localTestRunner_1 = require("./localTestRunner");
+const testCommandPolicy_1 = require("./testCommandPolicy");
+const testSafety_1 = require("./testSafety");
+const MAX_SCRIPT_SIZE = 64 * 1024;
+const MAX_SETUP_SCRIPT_SIZE = 32 * 1024;
+const MAX_OUTPUT = 16 * 1024;
+const DEFAULT_TIMEOUT_MS = 60_000;
+const SAFE_RUNNERS = new Set(['node', 'tsx', 'bun', 'deno', 'python', 'python3']);
+function sha256Prefix(s) {
+    return crypto.createHash('sha256').update(s).digest('hex').substring(0, 16);
+}
+function hashWorkspaceFile(workspaceRoot, relPath) {
+    try {
+        const p = path.join(workspaceRoot, relPath);
+        if (!fs.existsSync(p))
+            return null;
+        const content = fs.readFileSync(p, 'utf8').slice(0, 65536);
+        return sha256Prefix(content);
+    }
+    catch {
+        return null;
+    }
+}
+function workspaceContentHash(workspaceRoot) {
+    const pkg = hashWorkspaceFile(workspaceRoot, 'package.json');
+    const lock = hashWorkspaceFile(workspaceRoot, 'package-lock.json')
+        || hashWorkspaceFile(workspaceRoot, 'pnpm-lock.yaml')
+        || hashWorkspaceFile(workspaceRoot, 'yarn.lock')
+        || hashWorkspaceFile(workspaceRoot, 'bun.lock')
+        || hashWorkspaceFile(workspaceRoot, 'requirements.txt')
+        || hashWorkspaceFile(workspaceRoot, 'pyproject.toml');
+    if (!pkg && !lock)
+        return null;
+    return `${pkg || 'none'}:${lock || 'none'}`;
+}
+function truncateOutput(s) {
+    if (s.length <= MAX_OUTPUT)
+        return s;
+    return s.slice(0, MAX_OUTPUT) + '\n… [truncated]';
+}
+function mapVerdict(verdict) {
+    switch (verdict) {
+        case 'pass': return 'passed';
+        case 'fail': return 'failed';
+        case 'error': return 'error';
+        case 'timeout': return 'timeout';
+        case 'blocked': return 'blocked';
+        case 'sandbox-unavailable': return 'sandbox-unavailable';
+        default: return 'error';
+    }
+}
+function validateRunTestsRequest(req, workspaceRoot) {
+    if (!req.mode || (req.mode !== 'existing' && req.mode !== 'generated')) {
+        return { ok: false, error: 'mode must be "existing" or "generated"' };
+    }
+    if (req.mode === 'existing') {
+        const result = (0, testCommandPolicy_1.validateTestCommand)({
+            packageManager: req.packageManager,
+            testFiles: req.testFiles,
+            testPattern: req.testPattern,
+            timeoutMs: req.timeoutMs,
+        }, workspaceRoot);
+        if (!result.ok)
+            return { ok: false, error: result.error };
+        return { ok: true, command: result.command };
+    }
+    // Generated mode
+    if (!req.script || req.script.trim().length === 0) {
+        return { ok: false, error: 'generated mode requires "script" (non-empty string)' };
+    }
+    if (req.script.length > MAX_SCRIPT_SIZE) {
+        return { ok: false, error: `script too large (max ${MAX_SCRIPT_SIZE} bytes, got ${req.script.length})` };
+    }
+    if (!req.runner || !SAFE_RUNNERS.has(req.runner)) {
+        return { ok: false, error: `runner must be one of: ${[...SAFE_RUNNERS].join(', ')}. Got: ${req.runner || '(none)'}` };
+    }
+    if (req.setupScript && req.setupScript.length > MAX_SETUP_SCRIPT_SIZE) {
+        return { ok: false, error: `setupScript too large (max ${MAX_SETUP_SCRIPT_SIZE} bytes)` };
+    }
+    const safety = (0, testSafety_1.checkTestSafety)(req.script, workspaceRoot);
+    if (!safety.allowed) {
+        return { ok: false, error: `script blocked by safety check: ${safety.reason}` };
+    }
+    if (req.setupScript) {
+        const setupSafety = (0, testSafety_1.checkTestSafety)(req.setupScript, workspaceRoot);
+        if (!setupSafety.allowed) {
+            return { ok: false, error: `setupScript blocked by safety check: ${setupSafety.reason}` };
+        }
+    }
+    return { ok: true };
+}
+function buildApprovalSummary(req, command) {
+    if (req.mode === 'existing' && command) {
+        const files = command.selectedFiles.length > 0
+            ? `\nFiles: ${command.selectedFiles.join(', ')}`
+            : '';
+        const pattern = req.testPattern ? `\nPattern: ${req.testPattern}` : '';
+        return `Run existing tests in sandbox\nCommand: ${(0, testCommandPolicy_1.formatValidatedCommand)(command)}\nTimeout: ${command.timeoutMs}ms${files}${pattern}`;
+    }
+    const setupInfo = req.setupScript ? `\nSetup script: ${req.setupScript.length} bytes` : '';
+    return `Run generated test script in sandbox\nRunner: ${req.runner}\nScript: ${req.script.length} bytes (hash ${sha256Prefix(req.script)})${setupInfo}\nTimeout: ${req.timeoutMs || DEFAULT_TIMEOUT_MS}ms`;
+}
+function buildOperationParts(req, command, workspaceRoot) {
+    const wsHash = workspaceContentHash(workspaceRoot);
+    if (req.mode === 'existing' && command) {
+        return [
+            req.mode,
+            command.executable,
+            command.args,
+            command.selectedFiles,
+            req.testPattern,
+            command.timeoutMs,
+            wsHash,
+        ];
+    }
+    return [
+        req.mode,
+        req.runner,
+        req.script ? sha256Prefix(req.script) : null,
+        req.setupScript ? sha256Prefix(req.setupScript) : null,
+        req.timeoutMs || DEFAULT_TIMEOUT_MS,
+        wsHash,
+    ];
+}
+async function runTests(req, workspaceRoot, options) {
+    const startTime = Date.now();
+    const validation = validateRunTestsRequest(req, workspaceRoot);
+    if (!validation.ok) {
+        return {
+            approved: false,
+            mode: req.mode,
+            status: 'denied',
+            exitCode: -1,
+            output: `Validation error: ${validation.error}`,
+            durationMs: Date.now() - startTime,
+        };
+    }
+    const command = validation.command;
+    const summary = buildApprovalSummary(req, command);
+    const operationParts = buildOperationParts(req, command, workspaceRoot);
+    const ownsBroker = !options?.broker;
+    const broker = options?.broker ?? new broker_1.ApprovalBroker();
+    if (ownsBroker)
+        await broker.start();
+    try {
+        const approval = await broker.requestApproval('securecode.run-tests', summary, operationParts, 60_000, 'paid-generation', workspaceRoot);
+        if (!approval.approved) {
+            return {
+                approved: false,
+                requestId: approval.requestId,
+                mode: req.mode,
+                status: 'denied',
+                exitCode: -1,
+                output: `Test execution ${approval.reason}.`,
+                durationMs: Date.now() - startTime,
+            };
+        }
+        let testResult;
+        if (req.mode === 'existing' && command) {
+            testResult = await (0, localTestRunner_1.runTestCommand)(command.executable, command.args, workspaceRoot, {
+                timeoutMs: command.timeoutMs,
+                signal: options?.signal,
+                sandboxBackend: options?.sandboxBackend,
+            });
+        }
+        else {
+            testResult = await (0, localTestRunner_1.runLocalTest)(req.script, req.runner, workspaceRoot, {
+                setupScript: req.setupScript || null,
+                timeoutMs: req.timeoutMs || DEFAULT_TIMEOUT_MS,
+                signal: options?.signal,
+                sandboxBackend: options?.sandboxBackend,
+            });
+        }
+        return {
+            approved: true,
+            requestId: approval.requestId,
+            mode: req.mode,
+            status: mapVerdict(testResult.verdict),
+            exitCode: testResult.exitCode,
+            output: truncateOutput(testResult.output),
+            backend: testResult.backend,
+            command: command ? { executable: command.executable, args: command.args } : undefined,
+            durationMs: Date.now() - startTime,
+        };
+    }
+    finally {
+        if (ownsBroker)
+            await broker.stop();
+    }
+}
+//# sourceMappingURL=testRunner.js.map

package/dist/utils/testRunner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testRunner.js","sourceRoot":"","sources":["../../src/utils/testRunner.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuGH,0DA0CC;AAqCD,4BA6FC;AAjRD,+CAAiC;AACjC,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAoD;AACpD,uDAAuF;AACvF,2DAA6G;AAC7G,6CAA+C;AAE/C,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAuClF,SAAS,YAAY,CAAC,CAAS;IAC3B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CAAC,aAAqB,EAAE,OAAe;IAC7D,IAAI,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3D,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,aAAqB;IAC/C,MAAM,GAAG,GAAG,iBAAiB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,iBAAiB,CAAC,aAAa,EAAE,mBAAmB,CAAC;WAC3D,iBAAiB,CAAC,aAAa,EAAE,gBAAgB,CAAC;WAClD,iBAAiB,CAAC,aAAa,EAAE,WAAW,CAAC;WAC7C,iBAAiB,CAAC,aAAa,EAAE,UAAU,CAAC;WAC5C,iBAAiB,CAAC,aAAa,EAAE,kBAAkB,CAAC;WACpD,iBAAiB,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,GAAG,GAAG,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC7B,IAAI,CAAC,CAAC,MAAM,IAAI,UAAU;QAAE,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,iBAAiB,CAAC;AACtD,CAAC;AAED,SAAS,UAAU,CAAC,OAAmC;IACnD,QAAQ,OAAO,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC7B,KAAK,MAAM,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC7B,KAAK,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC;QAC7B,KAAK,SAAS,CAAC,CAAC,OAAO,SAAS,CAAC;QACjC,KAAK,SAAS,CAAC,CAAC,OAAO,SAAS,CAAC;QACjC,KAAK,qBAAqB,CAAC,CAAC,OAAO,qBAAqB,CAAC;QACzD,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC;IAC5B,CAAC;AACL,CAAC;AAOD,SAAgB,uBAAuB,CAAC,GAAoB,EAAE,aAAqB;IAC/E,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;IAC1E,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAA,uCAAmB,EAAC;YAC/B,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;SAC3B,EAAE,aAAa,CAAC,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAM,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACjD,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,eAAe,eAAe,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,MAAM,IAAI,QAAQ,EAAE,EAAE,CAAC;IAC1H,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,qBAAqB,SAAS,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,4BAAe,EAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,IAAA,4BAAe,EAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wCAAwC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9F,CAAC;IACL,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAoB,EAAE,OAA8B;IAC9E,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YAC1C,CAAC,CAAC,YAAY,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,2CAA2C,IAAA,0CAAsB,EAAC,OAAO,CAAC,cAAc,OAAO,CAAC,SAAS,KAAK,KAAK,GAAG,OAAO,EAAE,CAAC;IAC3I,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,WAAW,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,OAAO,iDAAiD,GAAG,CAAC,MAAM,aAAa,GAAG,CAAC,MAAO,CAAC,MAAM,gBAAgB,YAAY,CAAC,GAAG,CAAC,MAAO,CAAC,IAAI,SAAS,cAAc,GAAG,CAAC,SAAS,IAAI,kBAAkB,IAAI,CAAC;AACjN,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAoB,EAAE,OAAyC,EAAE,aAAqB;IAC/G,MAAM,MAAM,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,EAAE,CAAC;QACrC,OAAO;YACH,GAAG,CAAC,IAAI;YACR,OAAO,CAAC,UAAU;YAClB,OAAO,CAAC,IAAI;YACZ,OAAO,CAAC,aAAa;YACrB,GAAG,CAAC,WAAW;YACf,OAAO,CAAC,SAAS;YACjB,MAAM;SACT,CAAC;IACN,CAAC;IACD,OAAO;QACH,GAAG,CAAC,IAAI;QACR,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;QAC5C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;QACtD,GAAG,CAAC,SAAS,IAAI,kBAAkB;QACnC,MAAM;KACT,CAAC;AACN,CAAC;AAEM,KAAK,UAAU,QAAQ,CAC1B,GAAoB,EACpB,aAAqB,EACrB,OAKC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACH,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,CAAC,CAAC;YACZ,MAAM,EAAE,qBAAqB,UAAU,CAAC,KAAK,EAAE;YAC/C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACrC,CAAC;IACN,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACnC,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAE5E,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,IAAI,uBAAc,EAAE,CAAC;IACvD,IAAI,UAAU;QAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAErC,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CACzC,sBAAsB,EACtB,OAAO,EACP,cAAc,EACd,MAAM,EACN,iBAAiB,EACjB,aAAa,CAChB,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO;gBACH,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,kBAAkB,QAAQ,CAAC,MAAM,GAAG;gBAC5C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACrC,CAAC;QACN,CAAC;QAED,IAAI,UAA2B,CAAC;QAChC,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,EAAE,CAAC;YACrC,UAAU,GAAG,MAAM,IAAA,gCAAc,EAC7B,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,IAAI,EACZ,aAAa,EACb;gBACI,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,cAAc,EAAE,OAAO,EAAE,cAAc;aAC1C,CACJ,CAAC;QACN,CAAC;aAAM,CAAC;YACJ,UAAU,GAAG,MAAM,IAAA,8BAAY,EAC3B,GAAG,CAAC,MAAO,EACX,GAAG,CAAC,MAAO,EACX,aAAa,EACb;gBACI,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;gBACpC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,kBAAkB;gBAC9C,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,cAAc,EAAE,OAAO,EAAE,cAAc;aAC1C,CACJ,CAAC;QACN,CAAC;QAED,OAAO;YACH,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YACtC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC;YACzC,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YACrF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACrC,CAAC;IACN,CAAC;YAAS,CAAC;QACP,IAAI,UAAU;YAAE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;AACL,CAAC"}

package/dist/utils/testSafety.d.ts

@@ -1,4 +1,42 @@
-export declare function checkTestSafety(script: string, _workspaceRoot: string): {
+/**
+ * Static test safety analyzer — defense-in-depth, NOT a security boundary.
+ *
+ * The real boundary is the verification sandbox (`verificationSandbox.ts`):
+ * Docker with `--network=none --read-only`, or Deno with `--allow-none`.
+ * This module exists to reject obviously dangerous scripts *before* we
+ * pay for a sandbox spawn, and as a second layer in case a sandbox backend
+ * is somehow misconfigured.
+ *
+ * Policy: deny-by-default. Only specific known-safe imports and globals
+ * are permitted. Anything else is blocked. The previous implementation
+ * was allow-by-default with a 4-module blocklist — it let `http`, `https`,
+ * `fs`, `dns`, `os`, `tls`, `vm`, `dgram`, `fetch`, `eval`, `new Function`,
+ * dynamic `import()`, and `process.env` access all pass. That gap is the
+ * reason this module was rewritten.
+ *
+ * What this analyzer checks (in priority order):
+ *   1. Static import / require specifiers — against an allowlist.
+ *   2. Dynamic require/import — blocked outright (cannot be statically
+ *      analyzed).
+ *   3. Global function calls that execute strings as code — `eval`,
+ *      `new Function`, `setTimeout(string)`, `setInterval(string)`,
+ *      `setImmediate(string)`.
+ *   4. Network-related globals and Node built-ins (covered by #1 for
+ *      imports; here for member-style access like `globalThis.fetch`).
+ *   5. Process/env access — `process.env`, `process.argv`, `process.cwd`,
+ *      `process.execPath`, `process.cwd()`.
+ *   6. Reflection tricks that resolve to dangerous globals —
+ *      `globalThis['eval']`, `globalThis['Function']`, `this['eval']`,
+ *      bracket access with string literals that match dangerous names.
+ *
+ * Obfuscation handling: we catch literal bracket access like
+ * `globalThis["eval"]` and `process["env"]`. We do NOT attempt to defeat
+ * arbitrary runtime-computed string construction (e.g., `String.fromCharCode`
+ * to build a name) — that is the sandbox's job. This analyzer only catches
+ * what a defender can see statically.
+ */
+export interface TestSafetyResult {
     allowed: boolean;
     reason: string;
-};
+}
+export declare function checkTestSafety(script: string, _workspaceRoot: string): TestSafetyResult;

package/dist/utils/testSafety.js

@@ -1,38 +1,217 @@
 "use strict";
+/**
+ * Static test safety analyzer — defense-in-depth, NOT a security boundary.
+ *
+ * The real boundary is the verification sandbox (`verificationSandbox.ts`):
+ * Docker with `--network=none --read-only`, or Deno with `--allow-none`.
+ * This module exists to reject obviously dangerous scripts *before* we
+ * pay for a sandbox spawn, and as a second layer in case a sandbox backend
+ * is somehow misconfigured.
+ *
+ * Policy: deny-by-default. Only specific known-safe imports and globals
+ * are permitted. Anything else is blocked. The previous implementation
+ * was allow-by-default with a 4-module blocklist — it let `http`, `https`,
+ * `fs`, `dns`, `os`, `tls`, `vm`, `dgram`, `fetch`, `eval`, `new Function`,
+ * dynamic `import()`, and `process.env` access all pass. That gap is the
+ * reason this module was rewritten.
+ *
+ * What this analyzer checks (in priority order):
+ *   1. Static import / require specifiers — against an allowlist.
+ *   2. Dynamic require/import — blocked outright (cannot be statically
+ *      analyzed).
+ *   3. Global function calls that execute strings as code — `eval`,
+ *      `new Function`, `setTimeout(string)`, `setInterval(string)`,
+ *      `setImmediate(string)`.
+ *   4. Network-related globals and Node built-ins (covered by #1 for
+ *      imports; here for member-style access like `globalThis.fetch`).
+ *   5. Process/env access — `process.env`, `process.argv`, `process.cwd`,
+ *      `process.execPath`, `process.cwd()`.
+ *   6. Reflection tricks that resolve to dangerous globals —
+ *      `globalThis['eval']`, `globalThis['Function']`, `this['eval']`,
+ *      bracket access with string literals that match dangerous names.
+ *
+ * Obfuscation handling: we catch literal bracket access like
+ * `globalThis["eval"]` and `process["env"]`. We do NOT attempt to defeat
+ * arbitrary runtime-computed string construction (e.g., `String.fromCharCode`
+ * to build a name) — that is the sandbox's job. This analyzer only catches
+ * what a defender can see statically.
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkTestSafety = checkTestSafety;
-const BLOCKED_MODULES = new Set(['child_process', 'net', 'cluster', 'worker_threads']);
-const BLOCKED_PATTERNS = [
-    { pattern: /process\.exit\s*\(/g, reason: () => 'process.exit() masks test results — use console.error + throw instead' },
-    { pattern: /require\s*\(\s*[a-zA-Z_$][a-zA-Z0-9_$]*\s*\)/g, reason: () => 'dynamic require with variable is not statically checkable' },
+// ── Import allowlist ────────────────────────────────────────────────────────
+//
+// Allowed import specifiers (after the leading `node:` / `bun:` prefix is
+// stripped for built-ins). Built-ins are kept on a tiny allowlist because
+// even `node:` built-ins like `fs` are dangerous. The sandbox is the real
+// boundary, but we still block here so we don't waste a container start
+// on something obviously bad.
+const ALLOWED_NODE_BUILTINS = new Set([
+    'assert', 'console', 'crypto', 'path', 'util', 'module',
+    'string_decoder', 'url',
+]);
+const ALLOWED_PREFIXES = [
+    './', '../', // relative imports — needed to load the vulnerable module
+    'effect', // the user's framework
+    'bun:', // bun:* built-ins (test framework, etc.)
+    '@synara/', // user's workspace packages
 ];
-const ALLOWED_IMPORT_PREFIXES = ['node:', 'effect', 'bun', 'bun:', '@synara/', './', '../'];
-const BLOCKED_MODULE_REASONS = {
-    child_process: 'child_process is blocked — use only for testing command injection with mock spawns',
-    net: 'net is blocked — use HTTP libraries instead',
-    cluster: 'cluster is blocked',
-    worker_threads: 'worker_threads is blocked',
-};
+// Modules blocked even if a prefix matches (defense-in-depth).
+const BLOCKED_MODULE_NAMES = new Set([
+    'child_process', 'node:child_process',
+    'net', 'node:net',
+    'http', 'node:http',
+    'https', 'node:https',
+    'http2', 'node:http2',
+    'dgram', 'node:dgram',
+    'dns', 'node:dns',
+    'dns/promises', 'node:dns/promises',
+    'tls', 'node:tls',
+    'fs', 'node:fs',
+    'fs/promises', 'node:fs/promises',
+    'os', 'node:os',
+    'vm', 'node:vm',
+    'worker_threads', 'node:worker_threads',
+    'cluster', 'node:cluster',
+    'repl', 'node:repl',
+    'process', 'node:process',
+    'inspector', 'node:inspector',
+    'perf_hooks', 'node:perf_hooks', // timing side-channels
+]);
+// ── Dangerous globals & member access ───────────────────────────────────────
+const DANGEROUS_GLOBAL_CALLS = [
+    { pattern: /\beval\s*\(/, reason: 'eval() executes arbitrary strings as code' },
+    { pattern: /\bnew\s+Function\s*\(/, reason: 'new Function() executes arbitrary strings as code' },
+    { pattern: /\bnew\s+AsyncFunction\s*\(/, reason: 'new AsyncFunction() executes arbitrary strings as code' },
+    { pattern: /\bnew\s+GeneratorFunction\s*\(/, reason: 'new GeneratorFunction() executes arbitrary strings as code' },
+];
+// setTimeout/setInterval/setImmediate with a STRING argument is eval-by-proxy.
+const TIMER_STRING_ARG = /\b(setTimeout|setInterval|setImmediate)\s*\(\s*['"`]/;
+const DANGEROUS_PROCESS_ACCESS = [
+    { pattern: /\bprocess\.env\b/, reason: 'process.env access can leak host secrets — pass values explicitly' },
+    { pattern: /\bprocess\.argv\b/, reason: 'process.argv access can leak host arguments' },
+    { pattern: /\bprocess\.execPath\b/, reason: 'process.execPath exposes the host runtime path' },
+    { pattern: /\bprocess\.cwd\s*\(/, reason: 'process.cwd() exposes the host filesystem layout' },
+    { pattern: /\bprocess\.getuid\s*\(/, reason: 'process.getuid() exposes host user identity' },
+    { pattern: /\bprocess\.getgid\s*\(/, reason: 'process.getgid() exposes host group identity' },
+];
+// Network & fs globals reachable without import (Node 18+ has global fetch).
+const DANGEROUS_GLOBAL_REFERENCES = [
+    { pattern: /\bfetch\s*\(/, reason: 'fetch() can exfiltrate data over the network' },
+    { pattern: /\bnavigator\b/, reason: 'navigator access is not needed in a unit test' },
+];
+// Dynamic import (ESM) and dynamic require (CJS) — both are unsafe because
+// the specifier can be computed at runtime.
+const DYNAMIC_IMPORT = /\bimport\s*\(\s*[^"'\s`]/;
+const DYNAMIC_REQUIRE = /\brequire\s*\(\s*(?![`'"])[^)]*\)/;
+const STATIC_REQUIRE = /\brequire\s*\(\s*['"`]([^`'"]+)['"`]\s*\)/g;
+const STATIC_IMPORT_FROM = /\bimport\s+[^;]*?\s+from\s*['"`]([^`'"]+)['"`]/g;
+const STATIC_IMPORT_BARE = /\bimport\s+['"`]([^`'"]+)['"`]/g;
+const STATIC_EXPORT_FROM = /\bexport\s+[^;]*?\s+from\s*['"`]([^`'"]+)['"`]/g;
+// Bracket-access reflection: globalThis["eval"], process["env"], etc.
+// Matches `<identifier|keyword>["<dangerous-name>"]` and `['...']`.
+function buildBracketAccessRegex(name) {
+    // Capture a bracket access where the property is a string literal matching
+    // the dangerous name. The receiver is any identifier-like token (we
+    // accept anything that's not a quote, to keep this simple).
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`\\b[^'"\\\`\\s]+\\s*\\[\\s*['"\`\\s]*${escaped}['"\`\\s]*\\]`, 'i');
+}
+const DANGEROUS_BRACKET_NAMES = [
+    'eval', 'Function', 'AsyncFunction', 'GeneratorFunction',
+    'fetch', 'process', 'require', 'import',
+    'child_process', 'net', 'http', 'https', 'fs', 'os', 'vm',
+    'exec', 'execSync', 'spawn', 'spawnSync', 'fork',
+    // Dangerous properties of `process` accessed via bracket (process["env"]).
+    // Blocking the property name on any receiver is intentional — bracket
+    // access to "env" is a known reflection trick and tests shouldn't need it.
+    'env', 'argv', 'execPath', 'mainModule',
+];
+// ── Main entry ──────────────────────────────────────────────────────────────
 function checkTestSafety(script, _workspaceRoot) {
-    for (const { pattern, reason } of BLOCKED_PATTERNS) {
-        pattern.lastIndex = 0;
+    // 1. Dangerous call patterns (eval, Function, etc.)
+    for (const { pattern, reason } of DANGEROUS_GLOBAL_CALLS) {
         if (pattern.test(script)) {
-            return { allowed: false, reason: reason('') };
+            return { allowed: false, reason };
         }
     }
-    const importRegex = /(?:import\s+[^;]+?from\s*|require\s*\(\s*)["']([^"']+)["']/g;
-    let match;
-    while ((match = importRegex.exec(script)) !== null) {
-        const mod = match[1];
-        if (BLOCKED_MODULES.has(mod)) {
-            return { allowed: false, reason: BLOCKED_MODULE_REASONS[mod] || mod };
+    // 2. Timer-with-string (eval-by-proxy)
+    if (TIMER_STRING_ARG.test(script)) {
+        return { allowed: false, reason: 'setTimeout/setInterval/setImmediate with a string argument is eval-by-proxy' };
+    }
+    // 3. process.* access that leaks host state
+    for (const { pattern, reason } of DANGEROUS_PROCESS_ACCESS) {
+        if (pattern.test(script)) {
+            return { allowed: false, reason };
+        }
+    }
+    // 4. Global network refs
+    for (const { pattern, reason } of DANGEROUS_GLOBAL_REFERENCES) {
+        if (pattern.test(script)) {
+            return { allowed: false, reason };
         }
-        if (mod.startsWith('node:') || mod.startsWith('./') || mod.startsWith('../'))
-            continue;
-        if (mod.startsWith('effect') || mod.startsWith('bun') || mod.startsWith('@synara/'))
-            continue;
-        if (ALLOWED_IMPORT_PREFIXES.some(p => mod.startsWith(p)))
-            continue;
+    }
+    // 5. Dynamic import / dynamic require — non-static specifiers
+    if (DYNAMIC_IMPORT.test(script)) {
+        return { allowed: false, reason: 'dynamic import() with a computed specifier cannot be statically analyzed' };
+    }
+    if (DYNAMIC_REQUIRE.test(script)) {
+        return { allowed: false, reason: 'dynamic require with variable is not statically checkable' };
+    }
+    // 6. Bracket-access reflection (globalThis["eval"], process["env"], etc.)
+    for (const name of DANGEROUS_BRACKET_NAMES) {
+        const re = buildBracketAccessRegex(name);
+        if (re.test(script)) {
+            return { allowed: false, reason: `bracket access to "${name}" is blocked — use the safe form directly if needed` };
+        }
+    }
+    // 7. Static import / require specifiers — allowlist
+    const checkSpecifier = (mod) => {
+        if (BLOCKED_MODULE_NAMES.has(mod)) {
+            return { allowed: false, reason: `module "${mod}" is blocked — use the sandbox boundary for fs/net/process access` };
+        }
+        // node: prefix — strip and check the built-in allowlist.
+        if (mod.startsWith('node:')) {
+            const name = mod.slice('node:'.length);
+            if (!ALLOWED_NODE_BUILTINS.has(name)) {
+                return { allowed: false, reason: `node built-in "${mod}" is not on the allowlist (allowed: ${[...ALLOWED_NODE_BUILTINS].join(', ')})` };
+            }
+            return null;
+        }
+        // Bare built-in (no node: prefix) — block unless it's on the allowlist.
+        // We block bare 'fs', 'net', etc. even though Node resolves them to the
+        // same thing as node:fs.
+        if (ALLOWED_NODE_BUILTINS.has(mod))
+            return null;
+        if (mod === 'node')
+            return null; // not a real import
+        if (ALLOWED_PREFIXES.some(p => mod.startsWith(p)))
+            return null;
+        // Bare module names that aren't on an allowed prefix and aren't a
+        // built-in. These are third-party packages. We allow them — the
+        // sandbox will deny network access if they try to fetch anything.
+        // But we keep the known-dangerous ones in BLOCKED_MODULE_NAMES above.
+        return null;
+    };
+    const importPatterns = [
+        { re: STATIC_IMPORT_FROM, label: 'import' },
+        { re: STATIC_IMPORT_BARE, label: 'import' },
+        { re: STATIC_EXPORT_FROM, label: 'export' },
+        { re: STATIC_REQUIRE, label: 'require' },
+    ];
+    for (const { re } of importPatterns) {
+        re.lastIndex = 0;
+        let m;
+        while ((m = re.exec(script)) !== null) {
+            const mod = m[1];
+            const verdict = checkSpecifier(mod);
+            if (verdict)
+                return verdict;
+        }
+    }
+    // 8. process.exit() — masks test results and prevents the runner from
+    // capturing PASS/FAIL markers. (Was blocked before; keep the behavior.)
+    if (/\bprocess\.exit\s*\(/.test(script)) {
+        return { allowed: false, reason: 'process.exit() masks test results — use console.error + throw instead' };
     }
     return { allowed: true, reason: '' };
 }

package/dist/utils/testSafety.js.map

@@ -1 +1 @@
-{"version":3,"file":"testSafety.js","sourceRoot":"","sources":["../../src/utils/testSafety.ts"],"names":[],"mappings":";;AAgBA,0CAqBC;AArCD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEvF,MAAM,gBAAgB,GAAgE;IAClF,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,uEAAuE,EAAE;IACzH,EAAE,OAAO,EAAE,+CAA+C,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,2DAA2D,EAAE;CAC1I,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAE5F,MAAM,sBAAsB,GAA2B;IACnD,aAAa,EAAE,oFAAoF;IACnG,GAAG,EAAE,6CAA6C;IAClD,OAAO,EAAE,oBAAoB;IAC7B,cAAc,EAAE,2BAA2B;CAC9C,CAAC;AAEF,SAAgB,eAAe,CAAC,MAAc,EAAE,cAAsB;IAClE,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACjD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAClD,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,6DAA6D,CAAC;IAClF,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QACvF,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QAC9F,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;IACvE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"testSafety.js","sourceRoot":"","sources":["../../src/utils/testSafety.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;;AA6GH,0CA6FC;AAnMD,+EAA+E;AAC/E,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,wEAAwE;AACxE,8BAA8B;AAE9B,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IAClC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;IACvD,gBAAgB,EAAE,KAAK;CAC1B,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG;IACrB,IAAI,EAAE,KAAK,EAAW,0DAA0D;IAChF,QAAQ,EAAc,uBAAuB;IAC7C,MAAM,EAAgB,yCAAyC;IAC/D,UAAU,EAAY,4BAA4B;CACrD,CAAC;AAEF,+DAA+D;AAC/D,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACjC,eAAe,EAAE,oBAAoB;IACrC,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,KAAK,EAAE,UAAU;IACjB,cAAc,EAAE,mBAAmB;IACnC,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,kBAAkB;IACjC,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,SAAS;IACf,gBAAgB,EAAE,qBAAqB;IACvC,SAAS,EAAE,cAAc;IACzB,MAAM,EAAE,WAAW;IACnB,SAAS,EAAE,cAAc;IACzB,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,iBAAiB,EAAG,uBAAuB;CAC5D,CAAC,CAAC;AAEH,+EAA+E;AAE/E,MAAM,sBAAsB,GAA+C;IACvE,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,2CAA2C,EAAE;IAC/E,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,mDAAmD,EAAE;IACjG,EAAE,OAAO,EAAE,4BAA4B,EAAE,MAAM,EAAE,wDAAwD,EAAE;IAC3G,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,4DAA4D,EAAE;CACtH,CAAC;AAEF,+EAA+E;AAC/E,MAAM,gBAAgB,GAAW,sDAAsD,CAAC;AAExF,MAAM,wBAAwB,GAA+C;IACzE,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,mEAAmE,EAAE;IAC5G,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,6CAA6C,EAAE;IACvF,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,gDAAgD,EAAE;IAC9F,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,kDAAkD,EAAE;IAC9F,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,6CAA6C,EAAE;IAC5F,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,8CAA8C,EAAE;CAChG,CAAC;AAEF,6EAA6E;AAC7E,MAAM,2BAA2B,GAA+C;IAC5E,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,8CAA8C,EAAE;IACnF,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,+CAA+C,EAAE;CACxF,CAAC;AAEF,2EAA2E;AAC3E,4CAA4C;AAC5C,MAAM,cAAc,GAAW,0BAA0B,CAAC;AAC1D,MAAM,eAAe,GAAW,mCAAmC,CAAC;AACpE,MAAM,cAAc,GAAW,4CAA4C,CAAC;AAC5E,MAAM,kBAAkB,GAAW,iDAAiD,CAAC;AACrF,MAAM,kBAAkB,GAAW,iCAAiC,CAAC;AACrE,MAAM,kBAAkB,GAAW,iDAAiD,CAAC;AAErF,sEAAsE;AACtE,oEAAoE;AACpE,SAAS,uBAAuB,CAAC,IAAY;IACzC,2EAA2E;IAC3E,oEAAoE;IACpE,4DAA4D;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO,IAAI,MAAM,CAAC,wCAAwC,OAAO,eAAe,EAAE,GAAG,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC5B,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,mBAAmB;IACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ;IACvC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IACzD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM;IAChD,2EAA2E;IAC3E,sEAAsE;IACtE,2EAA2E;IAC3E,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY;CAC1C,CAAC;AAEF,+EAA+E;AAE/E,SAAgB,eAAe,CAAC,MAAc,EAAE,cAAsB;IAClE,oDAAoD;IACpD,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;IACL,CAAC;IAED,uCAAuC;IACvC,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,6EAA6E,EAAE,CAAC;IACrH,CAAC;IAED,4CAA4C;IAC5C,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,wBAAwB,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;IACL,CAAC;IAED,yBAAyB;IACzB,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,2BAA2B,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,0EAA0E,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;IACnG,CAAC;IAED,0EAA0E;IAC1E,KAAK,MAAM,IAAI,IAAI,uBAAuB,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,IAAI,qDAAqD,EAAE,CAAC;QACvH,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,MAAM,cAAc,GAAG,CAAC,GAAW,EAA2B,EAAE;QAC5D,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,GAAG,mEAAmE,EAAE,CAAC;QACzH,CAAC;QACD,yDAAyD;QACzD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,GAAG,uCAAuC,CAAC,GAAG,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5I,CAAC;YACD,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,yBAAyB;QACzB,IAAI,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,oBAAoB;QACrD,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,kEAAkE;QAClE,gEAAgE;QAChE,kEAAkE;QAClE,sEAAsE;QACtE,OAAO,IAAI,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,cAAc,GAAyC;QACzD,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE;QAC3C,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE;QAC3C,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE;QAC3C,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE;KAC3C,CAAC;IAEF,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,cAAc,EAAE,CAAC;QAClC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACjB,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAChC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uEAAuE,EAAE,CAAC;IAC/G,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACzC,CAAC"}