@winspan/claude-forge 8.54.4 → 9.12.0

package/dist/daemon/rules/whitelist.js

@@ -0,0 +1,210 @@
+/**
+ * Enforcement bypass whitelist (Phase 2c safety-net #1).
+ *
+ * Tools / Bash command prefixes that ALWAYS pass PreToolUseHandler without
+ * touching the rule engine. Used as an "early-exit" gate before
+ * RuleRegistry.findFirstMatch so:
+ *   • Read / Glob / Grep never write `tool_intercepts` rows (noise reduction)
+ *   • Project-essential commands (`cf bypass`, `npm test`, `node`, etc.) keep
+ *     working after the user flips `pre_tool_intercept.enabled=true` (otherwise
+ *     the very command needed to disable enforcement would be denied — a
+ *     "install-time deadlock").
+ *
+ * Two whitelist tracks:
+ *   1. `tools`            — exact ToolName match (case-sensitive, as emitted by
+ *                           Claude Code). Currently only the read-only triplet.
+ *   2. `bashReadOnly`     — pure read-only shell commands (ls/cat/git status…).
+ *   3. `bashProjectEssential` — non-read-only but mandatory for the project to
+ *                           function (cf CLI itself, npm/tsc/vitest, scripts).
+ *
+ * Bash matching uses a STRICT prefix check on the lowercased command. To avoid
+ * trivial bypass (`ls; rm -rf /` would match `ls` prefix), any command
+ * containing a shell metacharacter (see `hasShellInjectionMetachar`) is refused
+ * whitelist treatment.
+ */
+/** Config key holding the comma-separated per-project disable list (Phase D). */
+export const PROJECT_DISABLED_PREFIXES_KEY = 'pre_tool_intercept.disabled_project_prefixes';
+/**
+ * injection-guard (2026-06-05, decision 75344363 T1) — SINGLE source of truth
+ * for the "does this Bash command contain a shell metacharacter that could
+ * smuggle a second command past a prefix whitelist?" check.
+ *
+ * `isWhitelisted` (enforcement bypass) consults this predicate. A command
+ * containing ANY of these is REFUSED the exemption and falls back onto the
+ * normal rule-engine path:
+ *
+ *   `;`   command sequencing            (`cf bypass; rm -rf ~`)
+ *   `&`   background / `&&` chaining     (`... warn && rm foo`)
+ *   `|`   pipe / `||` short-circuit      (`... approve x | tee log`)
+ *   `$`   command/var substitution       (`... warn $(rm -rf /tmp/x)` / `${...}`)
+ *   `` ` `` backtick substitution        (`... warn \`rm -rf /tmp/x\``)
+ *   `>`   redirect (incl. `>>`)          (`... warn > /tmp/x`)
+ *   `<`   input/heredoc redirect         (`... < /etc/passwd`)
+ *   `\n` / `\r`  newline-separated       (multi-line command injection)
+ *
+ * NOTE: this targets shell metacharacters ONLY, not ordinary quoted content.
+ * A legitimate `--reason "中文 原因"` (spaces + double quotes around plain
+ * text) contains no metachar above and is therefore NOT flagged. Quotes/spaces
+ * are intentionally absent from the reject set.
+ */
+const SHELL_INJECTION_METACHAR = /[;&|$`><\n\r]/;
+/**
+ * injection-guard (2026-06-05) — true when `cmd` contains a shell metacharacter
+ * that could chain a second command past a prefix-based whitelist. See
+ * `SHELL_INJECTION_METACHAR` for the exact set and rationale.
+ */
+export function hasShellInjectionMetachar(cmd) {
+    return SHELL_INJECTION_METACHAR.test(cmd);
+}
+export const ENFORCEMENT_BYPASS_WHITELIST = {
+    /** Tool names that bypass enforcement unconditionally. */
+    tools: new Set(['Read', 'Glob', 'Grep']),
+    /**
+     * Read-only Bash command prefixes. Match is case-insensitive against the
+     * trimmed command. Order is irrelevant — `Array.some` covers all.
+     */
+    bashReadOnly: [
+        'ls', 'cat', 'head', 'tail', 'find',
+        'git status', 'git log', 'git diff', 'git show', 'git blame',
+        'gh pr view', 'gh issue view',
+        'wc', 'file', 'stat', 'tree',
+        'pwd', 'which', 'echo',
+    ],
+    /**
+     * Project-essential Bash command prefixes. Not strictly read-only but
+     * required for the user's normal workflow (CLI itself, testing, build).
+     * Without these, flipping enforcement ON would brick the install:
+     *   • `cf` denied → user can't `cf config set pre_tool_intercept.enabled false`
+     *   • `npm test` denied → no way to verify changes
+     *   • `node` / `npx` denied → tooling stalls
+     *
+     * Note the trailing space on `cf ` / `node ` etc. — bare `cf` (no args) is
+     * still allowed because the trimmed command equals `cf` (length 2) and would
+     * be matched by `'cf '` only if we use a more lenient check. We deliberately
+     * include both `'cf '` and `'cf\t'` so tab-separated invocations also match;
+     * the bare-token edge case is rare and not worth special-casing.
+     */
+    bashProjectEssential: [
+        'cf ', 'cf\t', // claude-forge short alias
+        'claude-forge ', // long alias
+        'npm test', 'npm run', 'npm install', 'npm ci', 'npm --',
+        'node ', 'node --',
+        'npx ',
+        'vitest', 'tsc',
+        './scripts/dev-daemon.sh', './scripts/',
+    ],
+};
+/**
+ * Returns `true` when the (toolName, input) pair is whitelisted and the
+ * PreToolUseHandler should early-exit (no rule lookup, no row written).
+ *
+ * Bash early-exit honors a safety guard: any command containing a shell
+ * metacharacter (`hasShellInjectionMetachar`: `; & | $ \` > < \n`) is REJECTED
+ * from the whitelist even when the first token would otherwise match, to defeat
+ * trivial bypass like `ls; rm -rf ~` or substitution like `cat $(rm rf)`.
+ */
+export function isWhitelisted(toolName, input) {
+    if (ENFORCEMENT_BYPASS_WHITELIST.tools.has(toolName))
+        return true;
+    if (toolName === 'Bash' && typeof input.command === 'string') {
+        const cmd = input.command.trim();
+        if (cmd.length === 0)
+            return false;
+        // Reject any shell metacharacter — even if the first token is whitelisted,
+        // the tail could chain / substitute an arbitrary command.
+        if (hasShellInjectionMetachar(cmd))
+            return false;
+        const cmdLower = cmd.toLowerCase();
+        const allPrefixes = [
+            ...ENFORCEMENT_BYPASS_WHITELIST.bashReadOnly,
+            ...ENFORCEMENT_BYPASS_WHITELIST.bashProjectEssential,
+        ];
+        return allPrefixes.some((p) => cmdLower.startsWith(p.toLowerCase()));
+    }
+    return false;
+}
+/**
+ * 8-in-1 Phase D (2026-05-27): per-project intercept disable.
+ *
+ * Returns true when the project path falls under one of the user-configured
+ * disabled prefixes (comma-separated `forge_config` key). PreToolUseHandler
+ * calls this BEFORE `isWhitelisted` — projects on the disabled list skip the
+ * rule engine entirely (and never write `tool_intercepts` rows).
+ *
+ * Empty / unset config → returns false (default behaviour unchanged).
+ *
+ * Path matching:
+ *   • String `startsWith` (case-sensitive).
+ *   • Empty prefixes (multiple commas, trailing comma) are ignored.
+ *   • A trailing `/` on either side is NOT required — but users SHOULD
+ *     include one when there's ambiguity (e.g. `/Users/me/proj` would also
+ *     match `/Users/me/proj-fork`; use `/Users/me/proj/` to anchor).
+ *
+ * Failures (storage read throws) degrade silently to `false` — better to
+ * keep enforcement on than crash the pipeline.
+ */
+export function isProjectInterceptDisabled(projectPath, configStore) {
+    if (!projectPath)
+        return false;
+    try {
+        const raw = configStore.get(PROJECT_DISABLED_PREFIXES_KEY);
+        if (!raw)
+            return false;
+        const prefixes = raw.split(',').map((p) => p.trim()).filter(Boolean);
+        return prefixes.some((p) => projectPath.startsWith(p));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Daemon-startup self-test (called from src/daemon/index.ts).
+ *
+ * Hard-coded assertions that must hold for the project to be usable after
+ * enforcement is enabled. If any of these fail, the daemon refuses to start —
+ * better to fail loudly at boot than brick the install on first user command.
+ *
+ * Throws on first failed assertion with a message identifying the broken
+ * whitelist entry. Callers should treat the throw as fatal.
+ */
+export function assertWhitelistInvariants() {
+    const cases = [
+        { tool: 'Read', input: { file_path: '/tmp/x' }, why: 'Read tool must always bypass enforcement' },
+        { tool: 'Glob', input: { pattern: '**/*.ts' }, why: 'Glob tool must always bypass enforcement' },
+        { tool: 'Grep', input: { pattern: 'foo' }, why: 'Grep tool must always bypass enforcement' },
+        { tool: 'Bash', input: { command: 'cf bypass --ttl 5m' }, why: 'cf bypass must be whitelisted (else deadlock)' },
+        { tool: 'Bash', input: { command: 'cf config get x' }, why: 'cf config commands must be whitelisted' },
+        { tool: 'Bash', input: { command: 'cf config set decision_hint_pending_mode warn' }, why: 'global-governance Phase 2 KILL-SWITCH must never be denied' },
+        { tool: 'Bash', input: { command: 'npm test' }, why: 'npm test must be whitelisted' },
+        { tool: 'Bash', input: { command: 'npm run build' }, why: 'npm run must be whitelisted' },
+        { tool: 'Bash', input: { command: 'node script.js' }, why: 'node must be whitelisted' },
+        { tool: 'Bash', input: { command: 'npx tsc --noEmit' }, why: 'npx must be whitelisted' },
+        { tool: 'Bash', input: { command: 'vitest run' }, why: 'vitest must be whitelisted' },
+        { tool: 'Bash', input: { command: 'tsc' }, why: 'tsc must be whitelisted' },
+        { tool: 'Bash', input: { command: './scripts/dev-daemon.sh restart' }, why: 'project dev-daemon script must be whitelisted' },
+    ];
+    for (const c of cases) {
+        if (!isWhitelisted(c.tool, c.input)) {
+            throw new Error(`[whitelist self-test] FAILED: tool=${c.tool} cmd=${JSON.stringify(c.input)} — ${c.why}`);
+        }
+    }
+    // injection-guard (2026-06-05, decision 75344363 T1): a whitelisted prefix
+    // carrying a shell metacharacter tail (`$(...)`, backtick, `>`, `<`, newline)
+    // must NOT be exempted — the enforcement bypass must fall back onto the normal
+    // deny path. Pin a few representative variants so a future widening of the
+    // guard can't silently reopen the command-injection blind spot.
+    const injectionVariants = [
+        'cat /tmp/x $(rm -rf /tmp/x)',
+        'git status `rm -rf /tmp/x`',
+        'ls > /tmp/x',
+        'ls >> /tmp/x',
+        'cat /etc/passwd < /etc/passwd',
+        'cf bypass\nrm -rf /tmp/x',
+    ];
+    for (const cmd of injectionVariants) {
+        if (isWhitelisted('Bash', { command: cmd })) {
+            throw new Error(`[whitelist self-test] FAILED: injection variant must NOT be enforcement-whitelisted: ${JSON.stringify(cmd)}`);
+        }
+    }
+}
+//# sourceMappingURL=whitelist.js.map

package/dist/daemon/rules/whitelist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whitelist.js","sourceRoot":"","sources":["../../../src/daemon/rules/whitelist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,iFAAiF;AACjF,MAAM,CAAC,MAAM,6BAA6B,GACxC,8CAA8C,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,wBAAwB,GAAG,eAAe,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,0DAA0D;IAC1D,KAAK,EAAE,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhD;;;OAGG;IACH,YAAY,EAAE;QACZ,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;QACnC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW;QAC5D,YAAY,EAAE,eAAe;QAC7B,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;QAC5B,KAAK,EAAE,OAAO,EAAE,MAAM;KACd;IAEV;;;;;;;;;;;;;OAaG;IACH,oBAAoB,EAAE;QACpB,KAAK,EAAE,MAAM,EAAqC,2BAA2B;QAC7E,eAAe,EAAmC,aAAa;QAC/D,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ;QACxD,OAAO,EAAE,SAAS;QAClB,MAAM;QACN,QAAQ,EAAE,KAAK;QACf,yBAAyB,EAAE,YAAY;KAC/B;CACF,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,KAAsB;IACpE,IAAI,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAElE,IAAI,QAAQ,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAEnC,2EAA2E;QAC3E,0DAA0D;QAC1D,IAAI,yBAAyB,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAEjD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,WAAW,GAAsB;YACrC,GAAG,4BAA4B,CAAC,YAAY;YAC5C,GAAG,4BAA4B,CAAC,oBAAoB;SACrD,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAAmB,EACnB,WAAwB;IAExB,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3D,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,KAAK,GAAiE;QAC1E,EAAE,IAAI,EAAE,MAAM,EAAG,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAe,GAAG,EAAE,0CAA0C,EAAE;QAC/G,EAAE,IAAI,EAAE,MAAM,EAAG,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAgB,GAAG,EAAE,0CAA0C,EAAE;QAC/G,EAAE,IAAI,EAAE,MAAM,EAAG,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAoB,GAAG,EAAE,0CAA0C,EAAE;QAC/G,EAAE,IAAI,EAAE,MAAM,EAAG,KAAK,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAK,GAAG,EAAE,+CAA+C,EAAE;QACpH,EAAE,IAAI,EAAE,MAAM,EAAG,KAAK,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAQ,GAAG,EAAE,wCAAwC,EAAE;QAC7G,EAAE,IAAI,EAAE,MAAM,EAAG,KAAK,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,EAAE,GAAG,EAAE,4DAA4D,EAAE;QACzJ,EAAE,IAAI,EAAE,MAAM,EAAG,KAAK,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAe,GAAG,EAAE,8BAA8B,EAAE;QACnG,EAAE,IAAI,EAAE,MAAM,EAAG,KAAK,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,EAAU,GAAG,EAAE,6BAA6B,EAAE;QAClG,EAAE,IAAI,EAAE,MAAM,EAAG,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAS,GAAG,EAAE,0BAA0B,EAAE;QAC/F,EAAE,IAAI,EAAE,MAAM,EAAG,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAO,GAAG,EAAE,yBAAyB,EAAE;QAC9F,EAAE,IAAI,EAAE,MAAM,EAAG,KAAK,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAa,GAAG,EAAE,4BAA4B,EAAE;QACjG,EAAE,IAAI,EAAE,MAAM,EAAG,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAoB,GAAG,EAAE,yBAAyB,EAAE;QAC9F,EAAE,IAAI,EAAE,MAAM,EAAG,KAAK,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,GAAG,EAAE,+CAA+C,EAAE;KAC/H,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,sCAAsC,CAAC,CAAC,IAAI,QAAQ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,iBAAiB,GAAa;QAClC,6BAA6B;QAC7B,4BAA4B;QAC5B,aAAa;QACb,cAAc;QACd,+BAA+B;QAC/B,0BAA0B;KAC3B,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACpC,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,wFAAwF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAC9G,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/daemon/rules/workflow-defaults.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Default workflow_recommend rules (v9.x Phase 5, D4=strict).
+ *
+ * Encodes the CLAUDE.md decision table (lines 110-129 + 144-157 module
+ * coverage) into runnable matchers. UserPromptSubmitHandler step 5 walks
+ * `defaultWorkflowRules` in order — first non-null match wins.
+ *
+ * Adding a new rule:
+ *   1. Place it ABOVE `bmad-default` (which is the fallback).
+ *   2. `recommended_agent_type` MUST be a file in `.claude/agents/<name>.md`.
+ *      Phase 9 lint will warn if the two drift.
+ *   3. Keep matchers cheap (regex + Set lookups). No DB calls — Phase 1
+ *      already pre-computed `edited_files` / `recent_prompt`, etc.
+ *   4. Return matched_keywords actually present in the prompt (used by the
+ *      dashboard to explain "why was X recommended").
+ */
+import type { WorkflowRecommendRule } from './types.js';
+import type { WorkflowType } from '../../core/types.js';
+/**
+ * True when `prompt` looks like a user question — CN/EN question words OR a
+ * trailing `?` / `？`. Exported so `defaults.ts` (RULE_TASK_QUESTION_NEEDS_BMAD)
+ * can reuse the exact same detection without duplicating the regex set.
+ *
+ * NOT a length-gated check; callers (rule matchers) are responsible for the
+ * `length < 20` no-spawn deferral if they want it.
+ */
+export declare function isQuestionPrompt(prompt: string): boolean;
+/**
+ * True when the prompt carries the natural-language "skip BMAD" escape hatch
+ * (`直接修` / `just fix` / `skip spec` / `不需要 spec`).
+ *
+ * Boundary-anchored — "直接修复 X bug" mid-sentence does NOT trigger; only
+ * standalone overrides. The `forge:bypass=` token is handled SEPARATELY by
+ * `PreToolUseHandler.extractBypassToken()`.
+ */
+export declare function hasDirectFixOverride(prompt: string): boolean;
+/** Ordered list — UserPromptHandler picks the first non-null match. */
+export declare const defaultWorkflowRules: WorkflowRecommendRule[];
+/**
+ * Score keyword hits per bucket. A keyword "matches" when either:
+ *   • it appears verbatim in `lowered` (cheap substring; handles spaces), OR
+ *   • it appears as one of the tokenised n-grams (CJK runs).
+ *
+ * Returns the `WorkflowType` of the best bucket plus the keywords that
+ * matched (for `injections.metadata_json` audit). Ties broken by
+ * `KEYWORD_PRIORITY`. Returns `null` when no bucket scored.
+ */
+export declare function scoreKeywordBuckets(prompt: string): {
+    workflow_type: WorkflowType;
+    matched: string[];
+} | null;
+//# sourceMappingURL=workflow-defaults.d.ts.map

package/dist/daemon/rules/workflow-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-defaults.d.ts","sourceRoot":"","sources":["../../../src/daemon/rules/workflow-defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAGV,qBAAqB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EACV,YAAY,EACb,MAAM,qBAAqB,CAAC;AAmE7B;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAMxD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAG5D;AAsRD,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAE,qBAAqB,EAQvD,CAAC;AAqGF;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,GACb;IAAE,aAAa,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAqB3D"}