@weave_protocol/adapter-msaf 0.1.0

package/README.md

@@ -0,0 +1,277 @@
+# 🛡️ @weave_protocol/adapter-msaf
+
+[![npm version](https://img.shields.io/npm/v/@weave_protocol/adapter-msaf.svg)](https://www.npmjs.com/package/@weave_protocol/adapter-msaf)
+[![npm](https://img.shields.io/npm/dm/@weave_protocol/adapter-msaf.svg)](https://www.npmjs.com/package/@weave_protocol/adapter-msaf)
+[![license](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
+
+**WARD.md enforcement for [Microsoft Agent Framework](https://devblogs.microsoft.com/agent-framework/) (MSAF) via the middleware pipeline.**
+
+> *AGENTS.md tells your agent what to do. SKILL.md tells your agent how to do it. **WARD.md tells your agent what it can't.** This package makes Microsoft Agent Framework listen.*
+
+Part of the [Weave Protocol](https://github.com/Tyox-all/Weave_Protocol) security suite. Third cross-platform harness adapter (after [adapter-claudecode](../adapter-claudecode) and [adapter-antigravity](../adapter-antigravity)).
+
+---
+
+## What it does
+
+When a Microsoft Agent Framework agent is about to invoke a tool (shell command, file edit, HTTP request, etc.), the WARD middleware fires in the function-middleware layer, reads your project's `WARD.md`, and **throws a `WardDeniedError`** if the call violates the declared policy. MSAF's middleware pipeline short-circuits, the tool never runs.
+
+Because MSAF middleware is registered programmatically (not via a config file), there's no global hook to install — you wire it into your agent setup in one line.
+
+```typescript
+import { WardMiddleware } from '@weave_protocol/adapter-msaf';
+
+const ward = new WardMiddleware();   // auto-loads ./WARD.md
+agent.useFunctionMiddleware(ward.functionMiddleware());
+```
+
+That's it. Every tool call your MSAF agent makes is now gated by your WARD.md.
+
+---
+
+## Why this is shaped differently from the other adapters
+
+| | adapter-claudecode | adapter-antigravity | **adapter-msaf** |
+|---|---|---|---|
+| Install pattern | `init` writes to `~/.claude/settings.json` | `init` writes to `~/.gemini/antigravity-cli/settings.json` | **You import a class and pass it to your agent** |
+| Invocation | CLI subprocess (stdin/stdout) | CLI subprocess (stdin/stdout) | **In-process middleware function** |
+| Scope | Global (all Claude Code sessions) | Global (all Antigravity surfaces) | **Per-agent (whichever agents you wire it into)** |
+
+MSAF doesn't have a global config file for hooks — middleware lives in your agent code. That's a deliberate design choice in MSAF (it wants explicit, code-level policy registration). So instead of `init` writing config, it prints the integration snippet for you to paste.
+
+---
+
+## Quick start
+
+```bash
+# Install
+npm install @weave_protocol/adapter-msaf
+```
+
+Then in your MSAF agent setup:
+
+```typescript
+import { WardMiddleware } from '@weave_protocol/adapter-msaf';
+
+// Construct — auto-loads WARD.md from cwd, .weave/, or .msaf/
+const ward = new WardMiddleware();
+
+// Or explicit path:
+//   const ward = new WardMiddleware({ wardPath: './policies/strict.WARD.md' });
+
+// Or inline source (useful for tests):
+//   const ward = new WardMiddleware({ wardSource: someMdContent });
+
+// Register
+agent.useFunctionMiddleware(ward.functionMiddleware());
+```
+
+Drop a `WARD.md` in your project root (`npx @weave_protocol/ward init`) and you're done.
+
+Verify with:
+
+```bash
+npx weave-msaf status
+```
+
+---
+
+## How WARD.md is resolved
+
+When the middleware is constructed (or `weave-msaf status` runs), it looks in this order:
+
+1. Explicit `wardPath` constructor option
+2. Explicit `wardSource` constructor option (raw markdown)
+3. `$WEAVE_WARD_PATH` env var
+4. `<cwd>/WARD.md`
+5. `<cwd>/.weave/WARD.md`
+6. `<cwd>/.msaf/WARD.md`
+
+First match wins. If nothing is found:
+- Default (fail-open): every call is allowed; a warning is logged once
+- `failMode: 'closed'`: constructor throws
+
+---
+
+## Tool mapping
+
+MSAF tool names are user-defined, but several common conventions emerge from the local agent runtime and the Copilot/Claude Code SDK harness integrations. Built-in mappings cover them:
+
+| MSAF tool | WARD capability | Path arg | fs op |
+|---|---|---|---|
+| `ShellExec` / `Bash` / `RunCommand` | `shell_exec` | (command heuristic) | varies |
+| `FileWrite` / `FileEdit` / `EditFile` / `Edit` / `Write` | `file_write` | `path` or `file_path` | `write` |
+| `FileRead` / `ReadFile` / `Read` | `file_read` | `path` or `file_path` | `read` |
+| `FileDelete` | `file_delete` | `path` | `delete` |
+| `ListDirectory` | `file_list` | `path` | `list` |
+| `HttpRequest` / `WebFetch` | `http_request` | `url` | — |
+| `SendEmail` | `send_email` | — | — |
+| `PostMessage` | `send_message` | — | — |
+| `CreateIssue` | `create_issue` | — | — |
+| `Subagent` | `subagent` | — | — |
+
+Your WARD.md can use either the MSAF tool name or the generic capability. Explicit allow/deny/approval rules beat default decisions.
+
+**Custom mappings:**
+
+```typescript
+const ward = new WardMiddleware({
+  toolMappings: {
+    MyCorpAPI: { capability: 'http_request', urlField: 'endpoint' },
+    AzureCLI:  { capability: 'shell_exec',   commandField: 'cmd' },
+  }
+});
+```
+
+The Bash command heuristic also catches Azure CLI credential paths (`~/.azure/`) on top of SSH/AWS/GCP — relevant for MSAF users.
+
+---
+
+## Callbacks for logging and attestation
+
+```typescript
+const ward = new WardMiddleware({
+  onAllow: (call, result) => {
+    log.info('ward.allow', { tool: call.toolName });
+  },
+  onDeny: async (call, result) => {
+    log.warn('ward.deny', { tool: call.toolName, reasons: result.reasons });
+    // (Optional) return true to override the deny — emergency escape valve
+    // return false;  // (default) — let WARD deny stand
+  },
+});
+```
+
+`onDeny` returning `true` lets you override a WARD decision at runtime (for human-in-the-loop approval, for instance). Logged but allowed. Use sparingly.
+
+---
+
+## CLI
+
+```bash
+weave-msaf init [--language=ts|csharp|python]
+    Print the integration snippet you paste into your agent code
+
+weave-msaf status
+    Show the active WARD policy (resolved from cwd) and built-in mappings
+
+weave-msaf test <tool> [--input=JSON]
+    Dry-run a tool call against your WARD.md without invoking MSAF
+
+weave-msaf help
+```
+
+### Examples
+
+```bash
+# What would happen if my agent tried to exfil Azure creds?
+weave-msaf test ShellExec --input='{"command":"cat ~/.azure/credentials"}'
+
+# What about a forbidden HTTP endpoint?
+weave-msaf test HttpRequest --input='{"url":"https://evil.example.com"}'
+
+# Get the integration snippet
+weave-msaf init --language=ts
+```
+
+---
+
+## Catching denials
+
+The middleware throws `WardDeniedError` (a named class) so callers can handle WARD failures distinctly:
+
+```typescript
+import { WardDeniedError } from '@weave_protocol/adapter-msaf';
+
+try {
+  await agent.run(userPrompt);
+} catch (err) {
+  if (err instanceof WardDeniedError) {
+    console.warn(`Agent action blocked by WARD: ${err.reasons.join(', ')}`);
+    // Optionally surface to user, route to human-in-the-loop, etc.
+  } else {
+    throw err;
+  }
+}
+```
+
+---
+
+## A sample WARD.md for an MSAF agent
+
+```markdown
+---
+ward: "1.0"
+agent: msaf-coding-agent
+---
+
+# WARD.md
+
+## Filesystem
+
+allow:
+  - read: /Users/me/projects/**
+  - write: /Users/me/projects/**
+deny:
+  - read: ~/.ssh/**
+  - read: ~/.azure/**
+  - read: ~/.aws/**
+  - write: /etc/**
+default: deny
+
+## Network
+
+allow:
+  - url: "https://api.github.com/**"
+  - url: "https://management.azure.com/**"
+  - url: "https://*.openai.azure.com/**"
+default: deny
+
+## Capabilities
+
+allow:
+  - file_read
+  - file_write
+  - file_list
+requireApproval:
+  - shell_exec
+  - http_request
+  - subagent
+deny:
+  - file_delete
+default: deny
+
+## Behavioral Limits
+
+maxIterations: 50
+maxCostUSD: 5.00
+maxRuntimeSeconds: 600
+```
+
+With this, the MSAF agent can work inside your projects directory but can't read SSH/AWS/Azure credentials, requires approval for shell or HTTP, and is hard-blocked from spawning subagents or deleting files.
+
+---
+
+## Roadmap
+
+v0.1 (this release):
+- ✅ TypeScript middleware library + CLI
+- ✅ Function middleware (per-tool gating)
+- ✅ Agent middleware (turn-level hook, pass-through scaffold)
+- ✅ 20-tool built-in mappings (MSAF local runtime + Copilot SDK + Claude Code SDK patterns)
+- ✅ Bash command heuristic includes Azure credential paths
+- ✅ Allow/deny callbacks for logging and override
+- ✅ `WardDeniedError` typed exception
+
+v0.2 planned:
+- [ ] Native .NET package (NuGet) for first-class C# integration
+- [ ] Native Python package (PyPI) — for MSAF Python users
+- [ ] Behavioral-limit enforcement in agent middleware (iteration / cost caps)
+- [ ] Domere attestation integration in `onAllow`/`onDeny`
+- [ ] Chat middleware variant (gate at the model-call layer)
+
+---
+
+## License
+
+Apache 2.0 — see [LICENSE](../LICENSE).

package/SKILL.md

@@ -0,0 +1,102 @@
+---
+name: adapter-msaf
+description: Use this skill when the user wants to enforce a WARD.md security policy inside Microsoft Agent Framework (MSAF) via its middleware pipeline. Triggers on requests to "secure my Agent Framework agent", "block MSAF from doing X", "add WARD middleware to my agent", "lock down my Copilot SDK agent", or any work involving the `weave-msaf` command or programmatic WARD enforcement in a Microsoft agent setup. Also useful when reviewing a user's MSAF agent code for missing security middleware, or when a user wants to know how to express their WARD.md as runtime enforcement in C#/TypeScript/Python.
+---
+
+# Microsoft Agent Framework adapter for Weave Protocol
+
+The `@weave_protocol/adapter-msaf` package enforces [WARD.md](https://www.npmjs.com/package/@weave_protocol/ward) policies inside Microsoft Agent Framework (MSAF) via its middleware pipeline. Unlike the Claude Code and Antigravity adapters which use config-file hooks, this adapter is a **library** that the user registers programmatically in their agent setup.
+
+## When to use
+
+- User is building an MSAF agent and wants policy enforcement at the tool-call layer
+- User wants the same WARD.md they use elsewhere (Claude Code, Antigravity, MCP) to apply to their MSAF agent
+- User wants typed exceptions (`WardDeniedError`) to catch and handle WARD denials in their code
+- User wants per-agent enforcement (not global, since one process may run multiple agents with different policies)
+
+## Architecture difference from claudecode / antigravity adapters
+
+MSAF middleware is **registered programmatically**, not via a config file. So:
+- No `init` writes to disk; instead it prints the integration snippet
+- Middleware is per-agent, not global
+- Runs in-process (no subprocess invocation overhead)
+
+The user must paste a small code snippet into their MSAF agent setup. The CLI helps with `init` (snippet generator), `status` (verify policy resolution), and `test` (dry-run a call).
+
+## Primary API
+
+```typescript
+import { WardMiddleware } from '@weave_protocol/adapter-msaf';
+
+const ward = new WardMiddleware({
+  // wardPath: './WARD.md'  // or auto-resolve from cwd
+  // failMode: 'closed'      // or 'open' (default)
+  // toolMappings: { ... }   // custom tool name → capability
+  // onAllow: (call, result) => { ... }
+  // onDeny:  (call, result) => { ... }
+});
+
+agent.useFunctionMiddleware(ward.functionMiddleware());
+```
+
+## WARD resolution order
+
+1. `wardPath` option (explicit)
+2. `wardSource` option (raw markdown)
+3. `$WEAVE_WARD_PATH`
+4. `<cwd>/WARD.md`
+5. `<cwd>/.weave/WARD.md`
+6. `<cwd>/.msaf/WARD.md`
+
+## CLI
+
+```bash
+weave-msaf init [--language=ts|csharp|python]    # print integration snippet
+weave-msaf status                                 # show active WARD + mappings
+weave-msaf test <tool> [--input=JSON]             # dry-run a tool call
+```
+
+## Tool mapping
+
+Covers MSAF's local agent runtime tools, Copilot SDK patterns, and Claude Code SDK integration (since MSAF can use them as a sub-harness):
+
+- `ShellExec`/`Bash`/`RunCommand` → `shell_exec` (with command heuristic)
+- `FileWrite`/`FileEdit`/`Edit`/`Write` → `file_write`
+- `FileRead`/`Read` → `file_read`
+- `FileDelete` → `file_delete`
+- `ListDirectory` → `file_list`
+- `HttpRequest`/`WebFetch` → `http_request`
+- `SendEmail` → `send_email`
+- `PostMessage` → `send_message`
+- `CreateIssue` → `create_issue`
+- `Subagent` → `subagent`
+
+WARD.md can use either MSAF tool names or generic capabilities. Custom mappings via `toolMappings` option.
+
+Bash command heuristic includes **Azure credential paths** (`~/.azure/`) — the realistic threat vector for MSAF users.
+
+## Decision rules
+
+| Situation | Action |
+|---|---|
+| User asks how to enforce WARD in their MSAF agent | Show `init` snippet + `WardMiddleware` construction |
+| User wants to test policy without running the agent | `weave-msaf test <tool>` |
+| User reports a tool call was blocked | Suggest catching `WardDeniedError` |
+| User wants emergency override capability | Use `onDeny` callback returning `true` |
+| User wants stricter failure mode | `failMode: 'closed'` |
+| User uses non-standard tool names | `toolMappings: { MyTool: { capability: '...' } }` |
+
+## Pairs with
+
+- `@weave_protocol/ward` — the policy format being enforced
+- `@weave_protocol/adapter-claudecode` — same WARD.md, enforced in Claude Code
+- `@weave_protocol/adapter-antigravity` — same WARD.md, enforced in Antigravity
+- `@weave_protocol/hundredmen` — enforces the same WARD.md on MCP servers
+- `@weave_protocol/cli` — `weave init` scaffolds projects with a WARD.md
+
+## Anti-patterns
+
+- **Don't try to globally install this adapter via a config file.** MSAF doesn't work that way. Each agent registration is explicit.
+- **Don't catch `WardDeniedError` and silently swallow it** — if a WARD says no, that's the policy. If you need to override, use the `onDeny` callback explicitly so the decision is logged.
+- **Don't ship to production with `failMode: 'open'` and no WARD.md.** That's silent no-enforcement. Either ship a WARD.md or use `failMode: 'closed'` so a missing policy is loud.
+- **Don't use this for MDASH** — MDASH is Microsoft's internal vulnerability-scanning research platform, not the Microsoft Agent Framework. This adapter targets MSAF (the public developer-facing framework).

package/dist/cli.d.ts

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+/**
+ * weave-msaf CLI
+ *
+ *   weave-msaf init [--language=ts|csharp|python]   Print integration snippet
+ *   weave-msaf status                                Show active WARD policy
+ *   weave-msaf test <tool> [--input=JSON]            Dry-run a tool call
+ *   weave-msaf help
+ *
+ * Note: Unlike the Claude Code / Antigravity adapters, MSAF middleware is
+ * programmatic — registered in the user's agent code, not via a config file.
+ * So `init` here prints the integration snippet for the user to paste rather
+ * than writing to a settings.json.
+ */
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG"}

package/dist/cli.js

@@ -0,0 +1,260 @@
+#!/usr/bin/env node
+/**
+ * weave-msaf CLI
+ *
+ *   weave-msaf init [--language=ts|csharp|python]   Print integration snippet
+ *   weave-msaf status                                Show active WARD policy
+ *   weave-msaf test <tool> [--input=JSON]            Dry-run a tool call
+ *   weave-msaf help
+ *
+ * Note: Unlike the Claude Code / Antigravity adapters, MSAF middleware is
+ * programmatic — registered in the user's agent code, not via a config file.
+ * So `init` here prints the integration snippet for the user to paste rather
+ * than writing to a settings.json.
+ */
+import { resolve } from 'node:path';
+import { resolveWardForCwd, evaluateCall } from './policy.js';
+import { TOOL_MAPPINGS } from './types.js';
+// ─── ANSI colors ───────────────────────────────────────────────
+const tty = process.stdout.isTTY && !process.env.NO_COLOR;
+const c = {
+    reset: tty ? '\x1b[0m' : '',
+    bold: tty ? '\x1b[1m' : '',
+    dim: tty ? '\x1b[2m' : '',
+    red: tty ? '\x1b[31m' : '',
+    green: tty ? '\x1b[32m' : '',
+    yellow: tty ? '\x1b[33m' : '',
+    blue: tty ? '\x1b[34m' : '',
+    cyan: tty ? '\x1b[36m' : '',
+    gray: tty ? '\x1b[90m' : '',
+};
+function banner() {
+    console.error(`
+${c.cyan}${c.bold}🛡️  weave-msaf${c.reset}
+${c.gray}WARD.md enforcement for Microsoft Agent Framework via middleware${c.reset}
+`);
+}
+// ─── help ──────────────────────────────────────────────────────
+function help() {
+    banner();
+    console.error(`${c.bold}Usage:${c.reset} weave-msaf <command> [options]\n`);
+    console.error(`${c.bold}Commands:${c.reset}`);
+    console.error(`  ${c.cyan}init${c.reset} ${c.gray}[--language=ts|csharp|python]${c.reset}     Print integration snippet for your code`);
+    console.error(`  ${c.cyan}status${c.reset}                                Show active WARD policy`);
+    console.error(`  ${c.cyan}test${c.reset} ${c.gray}<tool> [--input=JSON]${c.reset}             Dry-run a tool call against your WARD.md`);
+    console.error(`  ${c.cyan}help${c.reset}                                  Show this message\n`);
+    console.error(`${c.bold}Examples:${c.reset}`);
+    console.error(`  ${c.gray}$${c.reset} weave-msaf init --language=ts`);
+    console.error(`  ${c.gray}$${c.reset} weave-msaf status`);
+    console.error(`  ${c.gray}$${c.reset} weave-msaf test ShellExec --input='{"command":"rm -rf ~/.azure"}'\n`);
+    console.error(`${c.gray}Docs: https://github.com/Tyox-all/Weave_Protocol/tree/main/adapter-msaf${c.reset}\n`);
+}
+// ─── arg helpers ───────────────────────────────────────────────
+function parseFlag(args, name) {
+    for (const a of args) {
+        if (a === `--${name}`)
+            return '';
+        if (a.startsWith(`--${name}=`))
+            return a.slice(`--${name}=`.length);
+    }
+    return undefined;
+}
+// ─── init ──────────────────────────────────────────────────────
+function runInit(args) {
+    banner();
+    const language = parseFlag(args, 'language') || 'ts';
+    console.error(`${c.bold}Integration snippet for ${c.cyan}${language}${c.reset}${c.bold}${c.reset}\n`);
+    if (language === 'csharp' || language === 'cs' || language === '.net') {
+        console.log(`// In your MSAF agent setup:
+// (.NET / C#)
+
+using Microsoft.AgentFramework;
+
+// 1. Install: dotnet add package Weave.Protocol.AdapterMsaf
+//    (.NET wrapper coming in v0.2 — for now use the Node bridge or call
+//     the WARD CLI as a subprocess from your MSAF middleware.)
+
+// 2. Until v0.2, recommended approach: install @weave_protocol/adapter-msaf
+//    via Node and call \`weave-msaf test\` from a custom .NET function
+//    middleware to evaluate calls. See README for full pattern.
+`);
+    }
+    else if (language === 'python' || language === 'py') {
+        console.log(`# In your MSAF agent setup (Python):
+
+# 1. Install:
+#    pip install weave-protocol-msaf      # coming in v0.2 (Python package)
+#
+#    For now, the npm package can be invoked from Python as a subprocess
+#    for testing. The Python middleware shape is:
+
+class WardFunctionMiddleware:
+    def __init__(self, ward_path="WARD.md"):
+        # load policy
+        ...
+
+    async def pre_invoke(self, ctx):
+        # evaluate ctx.tool_name and ctx.arguments against WARD
+        # call ctx.cancel() if denied
+        ...
+
+# Track issue #N for native Python support timeline.
+`);
+    }
+    else {
+        // TypeScript (default)
+        console.log(`// In your MSAF agent setup (TypeScript):
+
+import { WardMiddleware } from '@weave_protocol/adapter-msaf';
+
+// 1. Construct with auto-resolved WARD.md
+const ward = new WardMiddleware();
+// Or with explicit path:
+//   const ward = new WardMiddleware({ wardPath: './policies/strict.WARD.md' });
+
+// 2. Register as function middleware on your MSAF agent.
+// The exact API depends on your MSAF Node binding; the middleware function
+// follows the documented pre_invoke shape:
+//
+//   async (call, next) => {  ... }
+//
+agent.useFunctionMiddleware(ward.functionMiddleware());
+
+// 3. (Optional) Custom tool mappings if you have non-standard tool names:
+//   const ward = new WardMiddleware({
+//     toolMappings: {
+//       MyCustomTool: { capability: 'custom_capability' }
+//     }
+//   });
+
+// 4. (Optional) Allow/deny callbacks for logging/attestation:
+//   const ward = new WardMiddleware({
+//     onAllow: (call, result) => log('allowed', call.toolName),
+//     onDeny:  (call, result) => log('denied',  call.toolName, result.reasons),
+//   });
+`);
+    }
+    console.error('');
+    console.error(`${c.gray}─${c.reset}`.repeat(60));
+    console.error(`${c.bold}Next:${c.reset}`);
+    console.error(`  ${c.gray}1.${c.reset} Drop a ${c.cyan}WARD.md${c.reset} in your project root (or pass wardPath explicitly)`);
+    console.error(`  ${c.gray}2.${c.reset} Paste the snippet above into your agent setup code`);
+    console.error(`  ${c.gray}3.${c.reset} Run ${c.cyan}weave-msaf status${c.reset} to verify policy is found`);
+    console.error('');
+    return 0;
+}
+// ─── status ────────────────────────────────────────────────────
+function runStatus() {
+    banner();
+    console.error(`${c.bold}Active WARD policy${c.reset}`);
+    console.error(`${c.gray}─${c.reset}`.repeat(60));
+    try {
+        const resolved = resolveWardForCwd(process.cwd());
+        if (!resolved) {
+            console.error(`  ${c.yellow}No WARD.md found${c.reset}`);
+            console.error(`  ${c.gray}Looked at:${c.reset}`);
+            if (process.env.WEAVE_WARD_PATH)
+                console.error(`    ${c.gray}•${c.reset} ${process.env.WEAVE_WARD_PATH} ${c.gray}(WEAVE_WARD_PATH)${c.reset}`);
+            console.error(`    ${c.gray}•${c.reset} ${resolve(process.cwd(), 'WARD.md')}`);
+            console.error(`    ${c.gray}•${c.reset} ${resolve(process.cwd(), '.weave', 'WARD.md')}`);
+            console.error(`    ${c.gray}•${c.reset} ${resolve(process.cwd(), '.msaf', 'WARD.md')}`);
+        }
+        else {
+            console.error(`  ${c.gray}Source:${c.reset}        ${c.cyan}${resolved.source}${c.reset}`);
+            console.error(`  ${c.gray}Name:${c.reset}          ${resolved.policy.name || c.gray + '(unnamed)' + c.reset}`);
+            console.error(`  ${c.gray}Agent:${c.reset}         ${resolved.policy.agent || c.gray + '(none)' + c.reset}`);
+            console.error(`  ${c.gray}WARD version:${c.reset}  ${resolved.policy.version}`);
+        }
+    }
+    catch (err) {
+        console.error(`  ${c.red}Error loading WARD.md:${c.reset} ${err instanceof Error ? err.message : String(err)}`);
+        return 1;
+    }
+    console.error('');
+    console.error(`${c.bold}Built-in tool mappings${c.reset}`);
+    console.error(`${c.gray}─${c.reset}`.repeat(60));
+    const mappingNames = Object.keys(TOOL_MAPPINGS).slice(0, 12);
+    console.error(`  ${c.gray}${mappingNames.join(', ')}${mappingNames.length < Object.keys(TOOL_MAPPINGS).length ? ', ...' : ''}${c.reset}`);
+    console.error(`  ${c.gray}(${Object.keys(TOOL_MAPPINGS).length} total — see README for full list)${c.reset}`);
+    console.error('');
+    return 0;
+}
+// ─── test ──────────────────────────────────────────────────────
+function runTest(args) {
+    const tool = args[0];
+    if (!tool) {
+        console.error(`${c.red}✗${c.reset} Usage: weave-msaf test <tool> [--input='{"path":"..."}']`);
+        return 2;
+    }
+    banner();
+    const inputArg = parseFlag(args, 'input');
+    let toolInput = {};
+    if (inputArg) {
+        try {
+            toolInput = JSON.parse(inputArg);
+        }
+        catch {
+            console.error(`${c.red}✗${c.reset} --input must be valid JSON`);
+            return 2;
+        }
+    }
+    const resolved = resolveWardForCwd(process.cwd());
+    if (!resolved) {
+        console.error(`${c.yellow}⚠${c.reset} No WARD.md found — call would be allowed by default.`);
+        return 0;
+    }
+    console.error(`Testing ${c.bold}${tool}${c.reset}${inputArg ? ' with ' + c.cyan + JSON.stringify(toolInput) + c.reset : ''}`);
+    console.error(`Policy: ${c.cyan}${resolved.source}${c.reset}\n`);
+    const result = evaluateCall(resolved.policy, { toolName: tool, args: toolInput });
+    const colorMap = {
+        allow: c.green,
+        deny: c.red,
+        require_approval: c.yellow,
+    };
+    const iconMap = { allow: '✓', deny: '✗', require_approval: '⚠' };
+    console.error(`Decision: ${colorMap[result.decision]}${iconMap[result.decision]} ${result.decision.toUpperCase()}${c.reset}`);
+    if (result.reasons.length > 0) {
+        console.error(`\nReasons:`);
+        for (const r of result.reasons)
+            console.error(`  ${c.gray}•${c.reset} ${r}`);
+    }
+    console.error('');
+    return result.decision === 'deny' ? 1 : 0;
+}
+// ─── router ────────────────────────────────────────────────────
+async function main() {
+    const [, , cmd, ...rest] = process.argv;
+    let code = 0;
+    try {
+        switch (cmd) {
+            case 'init':
+                code = runInit(rest);
+                break;
+            case 'status':
+                code = runStatus();
+                break;
+            case 'test':
+                code = runTest(rest);
+                break;
+            case 'help':
+            case '--help':
+            case '-h':
+            case undefined:
+                help();
+                break;
+            default:
+                console.error(`${c.red}Unknown command: ${cmd}${c.reset}\n`);
+                help();
+                code = 2;
+        }
+    }
+    catch (err) {
+        console.error(`${c.red}Error:${c.reset} ${err instanceof Error ? err.message : String(err)}`);
+        if (process.env.DEBUG)
+            console.error(err);
+        code = 2;
+    }
+    process.exit(code);
+}
+main();
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,kEAAkE;AAClE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC1D,MAAM,CAAC,GAAG;IACR,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;IAC3B,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;IAC1B,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;IACzB,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;IAC1B,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;IAC5B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;IAC7B,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;IAC3B,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;IAC3B,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;CAC5B,CAAC;AAEF,SAAS,MAAM;IACb,OAAO,CAAC,KAAK,CAAC;EACd,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK;EACxC,CAAC,CAAC,IAAI,mEAAmE,CAAC,CAAC,KAAK;CACjF,CAAC,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,SAAS,IAAI;IACX,MAAM,EAAE,CAAC;IACT,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,KAAK,mCAAmC,CAAC,CAAC;IAC5E,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,gCAAgC,CAAC,CAAC,KAAK,8CAA8C,CAAC,CAAC;IACxI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,KAAK,yDAAyD,CAAC,CAAC;IACpG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,wBAAwB,CAAC,CAAC,KAAK,uDAAuD,CAAC,CAAC;IACzI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,uDAAuD,CAAC,CAAC;IAChG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,gCAAgC,CAAC,CAAC;IACtE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC;IAC1D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,sEAAsE,CAAC,CAAC;IAC5G,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,0EAA0E,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAChH,CAAC;AAED,kEAAkE;AAClE,SAAS,SAAS,CAAC,IAAc,EAAE,IAAY;IAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kEAAkE;AAClE,SAAS,OAAO,CAAC,IAAc;IAC7B,MAAM,EAAE,CAAC;IACT,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC;IAErD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,2BAA2B,CAAC,CAAC,IAAI,GAAG,QAAQ,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAEtG,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;CAYf,CAAC,CAAC;IACD,CAAC;SAAM,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;CAmBf,CAAC,CAAC;IACD,CAAC;SAAM,CAAC;QACN,uBAAuB;QACvB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6Bf,CAAC,CAAC;IACD,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,KAAK,qDAAqD,CAAC,CAAC;IAC9H,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,qDAAqD,CAAC,CAAC;IAC5F,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC,KAAK,4BAA4B,CAAC,CAAC;IAC5G,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kEAAkE;AAClE,SAAS,SAAS;IAChB,MAAM,EAAE,CAAC;IACT,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,qBAAqB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,mBAAmB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACjD,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe;gBAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/I,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YACzF,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3F,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,KAAK,aAAa,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,GAAG,WAAW,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/G,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,KAAK,YAAY,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,GAAG,QAAQ,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7G,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,yBAAyB,CAAC,CAAC,KAAK,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChH,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,yBAAyB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1I,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,qCAAqC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9G,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kEAAkE;AAClE,SAAS,OAAO,CAAC,IAAc;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,2DAA2D,CAAC,CAAC;QAC9F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,EAAE,CAAC;IAET,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,SAAS,GAA4B,EAAE,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,6BAA6B,CAAC,CAAC;YAChE,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,uDAAuD,CAAC,CAAC;QAC7F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9H,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAClF,MAAM,QAAQ,GAAG;QACf,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,GAAG;QACX,gBAAgB,EAAE,CAAC,CAAC,MAAM;KAClB,CAAC;IACX,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC;IAEjE,OAAO,CAAC,KAAK,CAAC,aAAa,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9H,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,EAAE,AAAD,EAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,MAAM;gBACT,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;gBACrB,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,GAAG,SAAS,EAAE,CAAC;gBACnB,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;gBACrB,MAAM;YACR,KAAK,MAAM,CAAC;YACZ,KAAK,QAAQ,CAAC;YACd,KAAK,IAAI,CAAC;YACV,KAAK,SAAS;gBACZ,IAAI,EAAE,CAAC;gBACP,MAAM;YACR;gBACE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,oBAAoB,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;gBAC7D,IAAI,EAAE,CAAC;gBACP,IAAI,GAAG,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,KAAK,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,GAAG,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,IAAI,EAAE,CAAC"}