@sema-ai/core 1.275.1

package/dist/core/scheduler.js

@@ -0,0 +1,54 @@
+/**
+ * design/105 — Scheduler seam（自唤醒/自调度）。「手」腿（`ExecutionEnv`）的**跨-task** 未来意图能力：一个 run 里的模型
+ * 把「未来要做的活」（cron 排程 / 延迟唤醒）持久化交给一个**常驻 backend**（TOC = shell daemon），由它在未来重起一个
+ * **新** task。
+ *
+ * 🔴 与 {@link import("./background-shell.js").BackgroundShellCapability} 的根本区别（design/105 §3.1 D1）：
+ * background-shell 的进程 ⊆ task（在每条退出路径 dispose，不跨 suspend）；scheduler 的意图必须 **SURVIVE task 结束**
+ * （schedule 的全部意义就是当前 task 结束后 daemon 还能重起）——镜像反转，**绝不 dispose-on-exit**。
+ *
+ * core 薄壳裁定：core 只出接口 + 工具壳 + `hasScheduler` 门控；**持久化存储 / cron 时钟 / idle 触发 / 起新 task 全在
+ * backend（daemon）**——core 是 request-driven 不常驻，绝不假装调度器。NodeExecutionEnv 不自带 daemon（不同于
+ * background-shell 自带 spawn），而是**委托一个注入的 backend**（飞轮的 shell daemon 实现本接口）。
+ */
+/** scheduler 操作的类型化错误。`code` 给程序分类，`message` 给模型自纠。 */
+export class SchedulerError extends Error {
+    code;
+    cause;
+    constructor(code, message, cause) {
+        super(message);
+        this.code = code;
+        this.cause = cause;
+        this.name = "SchedulerError";
+    }
+}
+/**
+ * 结构 + 语义检测：`env` 是否暴露 scheduler 能力且声明 `supported:true`。挂载门控用此（对齐 `hasBackgroundShell`）。
+ */
+export function hasScheduler(env) {
+    const e = env;
+    return (typeof e.schedule === "function" &&
+        typeof e.cancel === "function" &&
+        typeof e.list === "function" &&
+        typeof e.schedulerCapabilities === "object" &&
+        e.schedulerCapabilities !== null &&
+        e.schedulerCapabilities.supported === true);
+}
+/**
+ * core 层的 cron 表达式白名单校验（工具壳调，先于 `env.schedule`）。模型可控的 `expr` 只允许 cron 字段字符
+ * （数字、`* / , -`、空白）——拒 shell 元字符（design/105 §3.7：daemon 即便误用 shell 解析也无可注入字符）。
+ * 这是 core 侧的第一道闸；daemon 侧 MUST 仍用 cron 库解析（不 shell-exec）作第二道。
+ */
+const CRON_EXPR_RE = /^[0-9*/,\-\s]+$/;
+export function isValidCronExpr(expr) {
+    if (typeof expr !== "string")
+        return false;
+    const trimmed = expr.trim();
+    if (trimmed.length === 0 || trimmed.length > 100)
+        return false; // 有界 + 非空
+    if (!CRON_EXPR_RE.test(trimmed))
+        return false; // 白名单字符（无 shell 元字符）
+    const fields = trimmed.split(/\s+/);
+    return fields.length === 5 || fields.length === 6; // 标准 5 段或带秒 6 段
+}
+//# sourceMappingURL=scheduler.js.map

package/dist/core/scheduler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler.js","sourceRoot":"","sources":["../../src/core/scheduler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAiBH,uDAAuD;AACvD,MAAM,OAAO,cAAe,SAAQ,KAAK;IAE5B;IAEA;IAHX,YACW,IAAwB,EACjC,OAAe,EACN,KAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,SAAI,GAAJ,IAAI,CAAoB;QAExB,UAAK,GAAL,KAAK,CAAU;QAGxB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AA6FD;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,GAAiB;IAC5C,MAAM,CAAC,GAAG,GAAmC,CAAC;IAC9C,OAAO,CACL,OAAO,CAAC,CAAC,QAAQ,KAAK,UAAU;QAChC,OAAO,CAAC,CAAC,MAAM,KAAK,UAAU;QAC9B,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU;QAC5B,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ;QAC3C,CAAC,CAAC,qBAAqB,KAAK,IAAI;QAChC,CAAC,CAAC,qBAAqB,CAAC,SAAS,KAAK,IAAI,CAC3C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC,CAAC,UAAU;IAC1E,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,qBAAqB;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,gBAAgB;AACrE,CAAC"}

package/dist/core/secret-env.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Canonical "local-spawn shell secret-env protection" (sema D1) — FIRST-PARTY, vendor-independent.
+ *
+ * When the engine (or a downstream host/exec adapter) spawns a local shell for an AUTONOMOUS model, the child's
+ * inherited env MUST be fail-closed: a model-chosen `printenv DEEPSEEK_API_KEY` via the `bash` tool would
+ * otherwise exfiltrate the orchestrator's brain key / git token / DB creds (the gate authorizes WHICH tool runs,
+ * NOT isolation). The `scrub` policy drops secret-pattern keys (keeps PATH/build/locale → low breakage).
+ *
+ * This lives in `src/core/` — NOT `src/vendor/` — on purpose. It is OUR security invariant (D1 is a first-party
+ * edit, not openclaw upstream), shared by the (currently-vendored) {@link NodeExecutionEnv} AND a downstream
+ * adapter (service host adapter, [265]). Keeping the single source of the secret PATTERN here means:
+ *   1. A consumer imports it instead of mirroring a regex that would silently DRIFT when the pattern is extended.
+ *   2. The public export points at a STABLE first-party path that SURVIVES the planned de-vendoring refactor —
+ *      when NodeExecutionEnv is naturalized out of `src/vendor/`, this module does not move and nothing rebinds.
+ *
+ * The `inheritEnv` THREE-STATE assembly (`"all"` opt-out / `"scrub"` default / `string[]` allowlist) is a
+ * per-adapter concern (each exec env owns how it composes its child env); only the secret PATTERN is shared.
+ */
+/** Is `key` a secret-pattern env var (one the fail-closed `scrub` policy drops before spawning a shell)? */
+export declare function isSecretEnvKey(key: string): boolean;
+/** Drop every secret-pattern key (see {@link isSecretEnvKey}) from an env object — the fail-closed `scrub` policy. */
+export declare function scrubSecretEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+//# sourceMappingURL=secret-env.d.ts.map

package/dist/core/secret-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env.d.ts","sourceRoot":"","sources":["../../src/core/secret-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,4GAA4G;AAC5G,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,sHAAsH;AACtH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAMxE"}

package/dist/core/secret-env.js

@@ -0,0 +1,35 @@
+/**
+ * Canonical "local-spawn shell secret-env protection" (sema D1) — FIRST-PARTY, vendor-independent.
+ *
+ * When the engine (or a downstream host/exec adapter) spawns a local shell for an AUTONOMOUS model, the child's
+ * inherited env MUST be fail-closed: a model-chosen `printenv DEEPSEEK_API_KEY` via the `bash` tool would
+ * otherwise exfiltrate the orchestrator's brain key / git token / DB creds (the gate authorizes WHICH tool runs,
+ * NOT isolation). The `scrub` policy drops secret-pattern keys (keeps PATH/build/locale → low breakage).
+ *
+ * This lives in `src/core/` — NOT `src/vendor/` — on purpose. It is OUR security invariant (D1 is a first-party
+ * edit, not openclaw upstream), shared by the (currently-vendored) {@link NodeExecutionEnv} AND a downstream
+ * adapter (service host adapter, [265]). Keeping the single source of the secret PATTERN here means:
+ *   1. A consumer imports it instead of mirroring a regex that would silently DRIFT when the pattern is extended.
+ *   2. The public export points at a STABLE first-party path that SURVIVES the planned de-vendoring refactor —
+ *      when NodeExecutionEnv is naturalized out of `src/vendor/`, this module does not move and nothing rebinds.
+ *
+ * The `inheritEnv` THREE-STATE assembly (`"all"` opt-out / `"scrub"` default / `string[]` allowlist) is a
+ * per-adapter concern (each exec env owns how it composes its child env); only the secret PATTERN is shared.
+ */
+// Suffix-anchored on a word boundary (`^` or `_`): matches `AWS_SECRET_ACCESS_KEY`/`DB_PASSWORD`/`*_TOKEN` but
+// NOT `KEYBOARD_LAYOUT`/`TOKENIZER`. Case-insensitive. No `g` flag → `.test()` is stateless + safe to share.
+const SECRET_ENV_RE = /(^|_)(KEY|TOKEN|SECRET|SECRETS|PASSWORD|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATEKEY|APIKEY|ACCESS_KEY|SESSION_TOKEN)$/i;
+/** Is `key` a secret-pattern env var (one the fail-closed `scrub` policy drops before spawning a shell)? */
+export function isSecretEnvKey(key) {
+    return SECRET_ENV_RE.test(key);
+}
+/** Drop every secret-pattern key (see {@link isSecretEnvKey}) from an env object — the fail-closed `scrub` policy. */
+export function scrubSecretEnv(env) {
+    const out = {};
+    for (const k of Object.keys(env)) {
+        if (!isSecretEnvKey(k))
+            out[k] = env[k];
+    }
+    return out;
+}
+//# sourceMappingURL=secret-env.js.map

package/dist/core/secret-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env.js","sourceRoot":"","sources":["../../src/core/secret-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,+GAA+G;AAC/G,6GAA6G;AAC7G,MAAM,aAAa,GACjB,qHAAqH,CAAC;AAExH,4GAA4G;AAC5G,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,cAAc,CAAC,GAAsB;IACnD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/select-model.d.ts

@@ -0,0 +1,26 @@
+import type { Model } from "../internal/llm.js";
+/** Coarse price/capability tier, declared on a model via `model.params.tier`. */
+export type ModelTier = "cheap" | "standard" | "premium";
+/** Declarative "pick a model by capability/price" criteria (design/11 Layer 2). */
+export interface ModelCriteria {
+    /** Required capabilities. `vision` = accepts images; `reasoning` = supports extended thinking. */
+    needs?: Array<"vision" | "reasoning">;
+    /** Minimum usable context window (`contextTokens ?? contextWindow`). */
+    minContext?: number;
+    /** Require an exact tier — read from `model.params.tier` (`"cheap" | "standard" | "premium"`). */
+    tier?: ModelTier;
+    /** Tiebreak among the matches by total `cost` ($/Mtok input+output). Default `"cheapest"`. */
+    prefer?: "cheapest" | "premium";
+}
+/**
+ * Pick a model from a catalog by capability + price. Filters by `needs`/`minContext`/`tier`, then
+ * ranks the survivors by total list cost (`prefer: "cheapest"` default, or `"premium"` = priciest as
+ * a capability proxy). Returns `undefined` when nothing matches. The capability/price fields already
+ * live on `Model` (`input`, `reasoning`, `contextWindow`, `cost`); `tier` is opt-in via
+ * `model.params.tier`. This is the static version of cost-aware routing (RouteLLM is the dynamic,
+ * per-query north star — see design/11); compose it into `roles` via a `{ select }` RoleSpec.
+ */
+export declare function selectModel(models: Record<string, Model> | Model[], criteria?: ModelCriteria): Model | undefined;
+/** Throwing variant of {@link selectModel}. */
+export declare function selectModelOrThrow(models: Record<string, Model> | Model[], criteria?: ModelCriteria): Model;
+//# sourceMappingURL=select-model.d.ts.map

package/dist/core/select-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"select-model.d.ts","sourceRoot":"","sources":["../../src/core/select-model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEhD,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAEzD,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,kGAAkG;IAClG,KAAK,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,WAAW,CAAC,CAAC;IACtC,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACjC;AAgCD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,EAAE,EACvC,QAAQ,GAAE,aAAkB,GAC3B,KAAK,GAAG,SAAS,CAWnB;AAED,+CAA+C;AAC/C,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,EAAE,EACvC,QAAQ,GAAE,aAAkB,GAC3B,KAAK,CAMP"}

package/dist/core/select-model.js

@@ -0,0 +1,58 @@
+function asList(models) {
+    return Array.isArray(models) ? models : Object.values(models);
+}
+/**
+ * Total list price ($/Mtok, input + output) — a coarse capability/cost proxy for ranking. A model
+ * with **no `cost` object at all** sorts as `Infinity` so missing metadata is never mistaken for the
+ * cheapest option (a genuine free model still declares `cost.input: 0` and ranks correctly).
+ */
+function costOf(m) {
+    if (!m.cost) {
+        return Number.POSITIVE_INFINITY;
+    }
+    return (m.cost.input ?? 0) + (m.cost.output ?? 0);
+}
+function matches(m, c) {
+    for (const need of c.needs ?? []) {
+        if (need === "vision" && !m.input?.includes("image"))
+            return false;
+        if (need === "reasoning" && !m.reasoning)
+            return false;
+    }
+    if (c.minContext != null && (m.contextTokens ?? m.contextWindow ?? 0) < c.minContext) {
+        return false;
+    }
+    if (c.tier != null && m.params?.tier !== c.tier) {
+        return false;
+    }
+    return true;
+}
+/**
+ * Pick a model from a catalog by capability + price. Filters by `needs`/`minContext`/`tier`, then
+ * ranks the survivors by total list cost (`prefer: "cheapest"` default, or `"premium"` = priciest as
+ * a capability proxy). Returns `undefined` when nothing matches. The capability/price fields already
+ * live on `Model` (`input`, `reasoning`, `contextWindow`, `cost`); `tier` is opt-in via
+ * `model.params.tier`. This is the static version of cost-aware routing (RouteLLM is the dynamic,
+ * per-query north star — see design/11); compose it into `roles` via a `{ select }` RoleSpec.
+ */
+export function selectModel(models, criteria = {}) {
+    const candidates = asList(models).filter((m) => matches(m, criteria));
+    if (candidates.length === 0) {
+        return undefined;
+    }
+    const premium = criteria.prefer === "premium";
+    return candidates.reduce((best, m) => {
+        const c = costOf(m);
+        const b = costOf(best);
+        return premium ? (c > b ? m : best) : c < b ? m : best;
+    });
+}
+/** Throwing variant of {@link selectModel}. */
+export function selectModelOrThrow(models, criteria = {}) {
+    const m = selectModel(models, criteria);
+    if (!m) {
+        throw new Error(`selectModel: no model in the catalog matches ${JSON.stringify(criteria)}`);
+    }
+    return m;
+}
+//# sourceMappingURL=select-model.js.map

package/dist/core/select-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"select-model.js","sourceRoot":"","sources":["../../src/core/select-model.ts"],"names":[],"mappings":"AAiBA,SAAS,MAAM,CAAC,MAAuC;IACrD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,CAAQ;IACtB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAClC,CAAC;IACD,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,OAAO,CAAC,CAAQ,EAAE,CAAgB;IACzC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;QACrF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,IAAK,CAAC,CAAC,MAAwC,EAAE,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,MAAuC,EACvC,WAA0B,EAAE;IAE5B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC;IAC9C,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,kBAAkB,CAChC,MAAuC,EACvC,WAA0B,EAAE;IAE5B,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gDAAgD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/core/sensitive-path-policy.d.ts

@@ -0,0 +1,24 @@
+import type { ExecutionEnv } from "../internal/harness.js";
+import type { ToolPolicy } from "./tool-policy.js";
+/**
+ * Build a composable policy that DENIES writes (via the guarded fs tools) whose canonical target
+ * lands on a sensitive path. `patterns` are deployment-supplied (no default list is shipped — the
+ * set of escalation-vector paths is deployment-specific); an empty list is a no-op allow.
+ *
+ * `env` is the same ExecutionEnv the hands run against (inject the one you pass to the Runner), so
+ * canonicalization sees the task's real filesystem (a remote/E2B task resolves in its container).
+ * `rootPath` is the raw tracked cwd a relative path resolves against (omit = paths resolve as given).
+ *
+ * Fail-open by design: a tool with no string `path`, or a path that cannot be canonicalized, returns
+ * `allow` here — this guard adds a denial on top of the other gates, it is not the only line of
+ * defense, and it must not turn an unrelated tool call into a spurious deny. The verdict it owns is
+ * narrow and certain: "the real target IS a guarded path → deny".
+ */
+export declare function createSensitivePathPolicy(opts: {
+    env: ExecutionEnv;
+    patterns: string[];
+    rootPath?: string;
+    /** Override the guarded tool set (default: `Write`, `Edit`, `MultiEdit`-legacy → Edit). */
+    tools?: string[];
+}): ToolPolicy;
+//# sourceMappingURL=sensitive-path-policy.d.ts.map

package/dist/core/sensitive-path-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-path-policy.d.ts","sourceRoot":"","sources":["../../src/core/sensitive-path-policy.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,KAAK,EAAqC,UAAU,EAAE,MAAM,kBAAkB,CAAC;AA6CtF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,GAAG,EAAE,YAAY,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,GAAG,UAAU,CA2Cb"}

package/dist/core/sensitive-path-policy.js

@@ -0,0 +1,96 @@
+import { canonicalizeTarget, fileArgPath } from "../tools/fs/safety.js";
+import { canonicalToolName } from "./tool-name-aliases.js";
+/** fs hand tools that take a `path` and write — the reliably-guardable surface. */
+const DEFAULT_GUARDED_TOOLS = ["Write", "Edit", "MultiEdit"];
+/** Compile one path-segment glob (`*` → any run of non-slash chars) to an anchored RegExp. */
+function segmentGlobToRegExp(segment) {
+    const escaped = segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
+    return new RegExp(`^${escaped}$`);
+}
+function compilePatterns(patterns) {
+    const out = [];
+    for (const raw of patterns) {
+        const segments = raw.split("/").filter(Boolean).map(segmentGlobToRegExp);
+        if (segments.length > 0)
+            out.push({ raw, segments });
+    }
+    return out;
+}
+/**
+ * Does the canonical path contain a guarded pattern as a CONTIGUOUS run of full path segments?
+ * `.git/hooks` matches `/repo/.git/hooks/pre-commit`; `.ssh` matches any `.ssh` segment;
+ * `.claude*` matches `.claude` / `.claude.json` segments. Returns the matched raw pattern, or null.
+ */
+function matchSensitive(canonicalKey, compiled) {
+    // channel [384] sweep: win32 canonical keys are BACKSLASH-form — a "/"-only split yielded ONE giant
+    // segment there, so no pattern ever matched = the sensitive-path deny was silently FAIL-OPEN on
+    // Windows. Split on both families (pattern syntax itself stays "/").
+    const segs = canonicalKey.split(/[\\/]/).filter(Boolean);
+    for (const pat of compiled) {
+        const n = pat.segments.length;
+        for (let i = 0; i + n <= segs.length; i++) {
+            if (pat.segments.every((re, j) => re.test(segs[i + j])))
+                return pat.raw;
+        }
+    }
+    return null;
+}
+/**
+ * Build a composable policy that DENIES writes (via the guarded fs tools) whose canonical target
+ * lands on a sensitive path. `patterns` are deployment-supplied (no default list is shipped — the
+ * set of escalation-vector paths is deployment-specific); an empty list is a no-op allow.
+ *
+ * `env` is the same ExecutionEnv the hands run against (inject the one you pass to the Runner), so
+ * canonicalization sees the task's real filesystem (a remote/E2B task resolves in its container).
+ * `rootPath` is the raw tracked cwd a relative path resolves against (omit = paths resolve as given).
+ *
+ * Fail-open by design: a tool with no string `path`, or a path that cannot be canonicalized, returns
+ * `allow` here — this guard adds a denial on top of the other gates, it is not the only line of
+ * defense, and it must not turn an unrelated tool call into a spurious deny. The verdict it owns is
+ * narrow and certain: "the real target IS a guarded path → deny".
+ */
+export function createSensitivePathPolicy(opts) {
+    const compiled = compilePatterns(opts.patterns);
+    // design/116 review S8: canonicalize BOTH sides (the 4th name-matching manifest surface, sibling of
+    // tool-policy/active-skill-scope/session-rule-policy) — else a live MultiEdit-alias call (canonical Edit)
+    // slips a guard authored as ["Edit","Write"], and a pre-rename authored list silently stops guarding.
+    const guarded = new Set((opts.tools ?? DEFAULT_GUARDED_TOOLS).map(canonicalToolName));
+    return {
+        async check(req, signal) {
+            if (compiled.length === 0 || !guarded.has(canonicalToolName(req.toolName)))
+                return { action: "allow" };
+            const path = fileArgPath(req.args); // batch-B: accept CC `file_path` AND legacy `path` (else a file_path write SLIPS this guard — fail-open hole)
+            // No resolvable path → ALLOW (fail-OPEN). This guard is an ADDITIVE deny-list for SPECIFIC sensitive paths, not
+            // a containment boundary: a write we can't resolve simply isn't one of the named sensitive targets, and other
+            // gates (containment/egress) handle the unresolvable case. (Contrast active-skill-scope / session-rule-policy,
+            // which ARE containment — writes must land INSIDE an allow-set — so there an unresolvable path fails CLOSED.)
+            if (typeof path !== "string" || path.length === 0)
+                return { action: "allow" };
+            const canon = await canonicalizeTarget(opts.env, path, signal, opts.rootPath);
+            if (!canon.ok) {
+                // FAIL-CLOSED for an unresolvable SYMLINK (P-5 + siblings): we KNOW it's a symlink but couldn't follow
+                // it to its real target (env has no/failed readLink, or the hop cap was hit) — it could point onto a
+                // guarded path, so deny the write. Benign resolution errors (UNC / bad path) stay fail-open (additive
+                // guard — containment/other gates handle those).
+                if (canon.unresolvedSymlink) {
+                    return {
+                        action: "deny",
+                        reason: `write to "${path}" is blocked: it is a symlink whose real target could not be resolved (it could point onto a guarded sensitive path)`,
+                        decisionReason: "safety",
+                    };
+                }
+                return { action: "allow" };
+            }
+            const hit = matchSensitive(canon.key, compiled);
+            if (hit) {
+                return {
+                    action: "deny",
+                    reason: `write to "${path}" is blocked: its real target resolves onto the guarded sensitive path "${hit}"`,
+                    decisionReason: "safety",
+                };
+            }
+            return { action: "allow" };
+        },
+    };
+}
+//# sourceMappingURL=sensitive-path-policy.js.map

package/dist/core/sensitive-path-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-path-policy.js","sourceRoot":"","sources":["../../src/core/sensitive-path-policy.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AAE7D,8FAA8F;AAC9F,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrF,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;AACpC,CAAC;AAOD,SAAS,eAAe,CAAC,QAAkB;IACzC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACzE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,YAAoB,EAAE,QAA2B;IACvE,oGAAoG;IACpG,gGAAgG;IAChG,qEAAqE;IACrE,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,GAAG,CAAC,GAAG,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAMzC;IACC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,oGAAoG;IACpG,0GAA0G;IAC1G,sGAAsG;IACtG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,qBAAqB,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACtF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAoB,EAAE,MAAoB;YACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACvG,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,8GAA8G;YAClJ,gHAAgH;YAChH,8GAA8G;YAC9G,+GAA+G;YAC/G,8GAA8G;YAC9G,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAE9E,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9E,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,uGAAuG;gBACvG,qGAAqG;gBACrG,sGAAsG;gBACtG,iDAAiD;gBACjD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;oBAC5B,OAAO;wBACL,MAAM,EAAE,MAAM;wBACd,MAAM,EAAE,aAAa,IAAI,sHAAsH;wBAC/I,cAAc,EAAE,QAAQ;qBACzB,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAChD,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,aAAa,IAAI,2EAA2E,GAAG,GAAG;oBAC1G,cAAc,EAAE,QAAQ;iBACzB,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/session-policy-store.d.ts

@@ -0,0 +1,102 @@
+/**
+ * design/99 §E6 — per-session permission rules: a durable, session-scoped policy narrowing folded into the
+ * task-time {@link import("./tool-policy.js").ToolPolicy} (see {@link import("./runner/session-rule-policy.js").createSessionRulePolicy}).
+ *
+ * Why core-owned (not a parallel service store): the rules must be ENFORCED by the same policy fold that runs
+ * every tool call, so storage and enforcement can't drift (the [210] capability-token invariant). core defines
+ * the seam + an InMemory default; a deployment supplies a DURABLE cross-replica backend (its CAS-rev semantics
+ * must match this InMemory one byte-for-byte — a cross-backend equivalence test is the contract).
+ *
+ * Safety model:
+ * - **tighten-only by default**: a NORMAL write may only ADD denies / NARROW allowlists / NARROW allowDirs. A
+ *   write that LOOSENS (removes a deny, widens an allowlist/allowDirs) is REFUSED unless it is an OPERATOR
+ *   write. core has NO role system — `operator` is a boolean the caller FREEZES from a verified principal
+ *   (mirrors `steer.trusted`); core never adjudicates operator-ness, it only honors the flag.
+ * - **CAS rev** (optimistic concurrency): a `putRules` with a stale `expectedRev` is rejected, so two replicas
+ *   can't lose an update (mirrors the checkpoint store's `resolve` OCC).
+ * - **structured fields only**: core interprets `toolAllow/Deny`, `allowDirs`, `commandAllow/Deny` (argv[0]
+ *   names). A richer rule DSL is the service's/profile's job — core grows no rule interpreter.
+ * - **NOT A SANDBOX**: command rules inherit the coarse argv[0] matching (wrappers like `sh -c`/`sudo` bypass);
+ *   the real isolation boundary is the executionEnv, never these rules.
+ */
+/** The structured per-session rules. All optional; an absent field imposes no constraint of that kind. */
+export interface SessionPermissionRules {
+    /** If set, ONLY these tool names are allowed (others denied). A narrowing allowlist. */
+    toolAllow?: string[];
+    /** Tool names always denied (deny wins). */
+    toolDeny?: string[];
+    /** If set, WRITE tools (`write_file`/`edit_file`) may only target paths within these dirs; a write-capable
+     *  tool that can't be path-confined (e.g. `bash`) is denied while this is set. Stored RAW; resolved at run time. */
+    allowDirs?: string[];
+    /** If set, ONLY these `bash` command names (argv[0]) are allowed. */
+    commandAllow?: string[];
+    /** `bash` command names (argv[0]) always denied. */
+    commandDeny?: string[];
+}
+/** {@link SessionPermissionRules} plus the monotonic `rev` the store stamps (the OCC key). */
+export interface StoredSessionRules extends SessionPermissionRules {
+    rev: number;
+}
+/** Options for {@link SessionPolicyStore.putRules}. */
+export interface PutRulesOptions {
+    /** CAS: reject the write if the stored `rev` is not this (optimistic concurrency). Omit to skip the check. */
+    expectedRev?: number;
+    /** When true, this write MAY loosen the rules (remove a deny / widen an allowlist or allowDirs). A NORMAL
+     *  (non-operator) write is TIGHTEN-ONLY. core does NOT verify operator-ness — the caller (service) FREEZES
+     *  this from a verified, role-checked principal (mirrors `steer.trusted`). */
+    operator?: boolean;
+}
+/** Typed error from {@link SessionPolicyStore.putRules}. `conflict` = stale `expectedRev`; `loosen_forbidden`
+ *  = a non-operator write tried to relax the rules. */
+export declare class SessionPolicyError extends Error {
+    readonly code: "conflict" | "loosen_forbidden";
+    constructor(code: "conflict" | "loosen_forbidden", message: string);
+}
+/**
+ * The seam a deployment implements for DURABLE, cross-replica per-session rules. Unset on `RunnerDeps` ⇒ the
+ * feature is OFF (no rules read, zero behavior change). Keyed on `(sessionId, principal-owner)`: core passes
+ * the running task's `principal` as the owner key; ownership/operator AUTHORIZATION is the implementation's job
+ * (core has no identity system). `getRules` returns the rules to ENFORCE for a task; `putRules` writes them.
+ */
+/** A (principal, rules) pair for one session — the unit {@link SessionPolicyStore.listBySession} returns. */
+export interface SessionRulesRecord {
+    /** The principal these rules apply to (undefined = the session-wide default). */
+    principal: string | undefined;
+    rules: StoredSessionRules;
+}
+export interface SessionPolicyStore {
+    getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
+    putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
+    /**
+     * 2c session-sync ([271]): every (principal, rules) record for `sessionId` across ALL principals — `getRules`
+     * is per-(sessionId, principal), but a cross-backend session EXPORT must bundle the WHOLE session's policy.
+     * The importer replays each via `putRules(sessionId, record.principal, record.rules)`. Optional — a backend
+     * that supports cross-backend policy export implements it (local backend uses the in-memory/file impl).
+     */
+    listBySession?(sessionId: string): Promise<SessionRulesRecord[]>;
+}
+/** Normalize a rules object's `allowDirs` (lexical `posix.normalize`) so stored rules are `..`-free and the
+ *  tighten diff compares the same canonical-ish form the runtime resolves. */
+export declare function normalizeRules(rules: SessionPermissionRules): SessionPermissionRules;
+/**
+ * Pure tighten-only diff: the reasons `next` LOOSENS `prior` (empty ⇒ `next` is a pure tightening or no-op).
+ * Direction per field — deny-lists: removing an entry loosens. allowlists: removing the list (→ everything
+ * allowed) or adding an entry outside the prior set loosens; prior-undefined → any defined next only narrows.
+ * allowDirs: removing confinement, or adding a dir not within some prior dir, loosens (coarse raw containment).
+ */
+export declare function loosenReasons(prior: SessionPermissionRules, next: SessionPermissionRules): string[];
+/** strip any caller-passed `rev` from a rules object so the store is the sole authority on it. */
+export declare function stripRev(rules: SessionPermissionRules): SessionPermissionRules;
+/**
+ * In-process default {@link SessionPolicyStore} (single-replica). A deployment that needs cross-replica
+ * durability supplies its own backend with the SAME CAS-rev + tighten-only semantics. Single-threaded JS makes
+ * the read-check-write trivially atomic here; a durable backend folds it into a CAS WHERE clause.
+ */
+export declare class InMemorySessionPolicyStore implements SessionPolicyStore {
+    private readonly map;
+    private key;
+    getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
+    putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
+    listBySession(sessionId: string): Promise<SessionRulesRecord[]>;
+}
+//# sourceMappingURL=session-policy-store.d.ts.map

package/dist/core/session-policy-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-policy-store.d.ts","sourceRoot":"","sources":["../../src/core/session-policy-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,0GAA0G;AAC1G,MAAM,WAAW,sBAAsB;IACrC,wFAAwF;IACxF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;wHACoH;IACpH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,8FAA8F;AAC9F,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IAChE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,8GAA8G;IAC9G,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;kFAE8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;uDACuD;AACvD,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,kBAAkB;gBAArC,IAAI,EAAE,UAAU,GAAG,kBAAkB,EAC9C,OAAO,EAAE,MAAM;CAKlB;AAED;;;;;GAKG;AACH,6GAA6G;AAC7G,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACpF,QAAQ,CACN,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,sBAAsB,EAC7B,IAAI,CAAC,EAAE,eAAe,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/B;;;;;OAKG;IACH,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;CAClE;AAkCD;8EAC8E;AAC9E,wBAAgB,cAAc,CAAC,KAAK,EAAE,sBAAsB,GAAG,sBAAsB,CAcpF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAwBnG;AAED,kGAAkG;AAClG,wBAAgB,QAAQ,CAAC,KAAK,EAAE,sBAAsB,GAAG,sBAAsB,CAI9E;AAED;;;;GAIG;AACH,qBAAa,0BAA2B,YAAW,kBAAkB;IACnE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAyC;IAE7D,OAAO,CAAC,GAAG;IAIL,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAKnF,QAAQ,CACZ,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,sBAAsB,EAC7B,IAAI,CAAC,EAAE,eAAe,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAkBxB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;CAUtE"}