@zaip-ai/cli 4.2.0 → 4.3.0

package/dist/services/codex-pre-tool-hook-template.js

@@ -5,9 +5,10 @@ import { lstat, readFile, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
-import { captureCliTurn, rewriteCliInput, selectHookRepositoryRoot, tokenizeLiteralCommand } from "./zaip-pre-tool-support.mjs";
-
+import { captureCliTurn, checkDestructivePatterns, gitInvocation, inside, isLiteralReadSequence, requiresShellMutationRun, reviewedContextReadPaths, reviewedReleasePaths, rewriteCliInput, selectHookExecutionWorkspace, shellSyntax, tokenizeLiteralCommand, validateInlineExecution } from "./zaip-pre-tool-support.mjs";
 const execute = promisify(execFile);
+const nativeAuthority = await import("./zaip-native-tool-authority.mjs").catch(() => null);
+const activation = await import("./zaip-hook-activation.mjs").catch(() => null);
 const installedRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
 let repositoryRoot = installedRoot;
 const deletionCommandPattern = /\b(?:Remove-Item|rm|rmdir|rd|del|erase)\b/i;
@@ -68,7 +69,7 @@ const destructivePatterns = [
     reason: "Remote, SSH, and credential configuration changes are blocked.",
   },
   {
-    pattern: /\bgh\b[\s\S]*\s--repo(?:=|\s)/i,
+    pattern: /\bgh(?:\.exe)?\b[\s\S]*\s(?:--repo|-R)(?:=|\s|(?=[A-Za-z0-9]))/i,
     reason: "GitHub CLI commands must target the current repository.",
   },
   {
@@ -96,13 +97,17 @@ const destructivePatterns = [
     reason: "OS persistence and service changes are blocked.",
   },
   {
-    pattern: /\b(?:diskpart|bcdedit|fsutil|takeown|icacls|Set-Acl|chmod|chown)\b|(?:^|[\s;&|"'(])format(?:\.com)?\b|\bcipher\s+\/w\b/i,
+    pattern: /\b(?:diskpart|bcdedit|fsutil|takeown|icacls|Set-Acl|chmod|chown)\b|(?:^|[;&|({\r\n])\s*(?:&\s*)?["']?format(?:\.(?:com|exe))?["']?(?=\s|$)|\bcipher\s+\/w\b/i,
     reason: "Disk, boot, ownership, and access-control changes are blocked.",
   },
   {
     pattern: /\b(?:runas|sudo|gsudo)\b|Start-Process[\s\S]*-Verb\s+RunAs|\bSet-ExecutionPolicy\b/i,
     reason: "Privilege escalation and persistent execution-policy changes are blocked.",
   },
+  {
+    pattern: /\b(?:Start-Process|saps)\b[^\r\n;|]*(?:[$(]|\b(?:-FilePath\s+)?['"]?git(?:\.exe)?['"]?(?:\s|$))/i,
+    reason: "Dynamic or indirect Git process launch is blocked; use a reviewed repository script.",
+  },
   {
     pattern: /\b(?:winget|choco|scoop)\s+(?:install|uninstall|upgrade)\b|\b(?:npm|pnpm|yarn)\s+(?:install|add|remove|uninstall)[\s\S]*(?:--global|-g)\b/i,
     reason: "System-wide package changes are blocked.",
@@ -112,7 +117,7 @@ const destructivePatterns = [
     reason: "Non-loopback listeners are blocked.",
   },
   {
-    pattern: /\bgh\s+(?:pr\s+(?:create|merge|close|reopen)|issue\s+(?:create|close|reopen|delete)|release\s+(?:create|delete|upload)|repo\s+(?:create|delete|archive)|api\b[\s\S]*(?:--method|-X)\s*(?:POST|PUT|PATCH|DELETE))\b/i,
+    pattern: /\bgh(?:\.exe)?\s+(?:pr\s+(?:create|merge|close|reopen)|issue\s+(?:create|close|reopen|delete)|release\s+(?:create|delete|upload)|repo\s+(?:create|delete|archive)|api\b[\s\S]*(?:(?:--method|-X)(?:=|\s*)(?:POST|PUT|PATCH|DELETE)\b|(?:--field|--raw-field|--input)(?:=|\s+)|(?:^|\s)-[fF](?:=|\s+)))/i,
     reason: "Unreviewed GitHub mutations are blocked; use the bounded deploy workflow.",
   },
   {
@@ -122,23 +127,21 @@ const destructivePatterns = [
 ];
 
 function deny(reason) {
+  activation?.recordActivation(repositoryRoot, event, "denied");
   writeSync(
     1,
     JSON.stringify({
       hookSpecificOutput: {
         hookEventName: "PreToolUse",
         permissionDecision: "deny",
-        permissionDecisionReason: "ZAIP safety policy: " + reason,
+        permissionDecisionReason: "ZAIP safety policy: " + reason + " [tool=" + String(event?.tool_name ?? "unknown").slice(0, 80) + "; session=" + String(event?.session_id ?? "missing").slice(0, 80) + "; turn=" + String(event?.turn_id ?? "missing").slice(0, 80) + "]",
       },
     }) + "\n",
   );
   process.exit(0);
 }
 
-function isWithinRepository(path) {
-  const candidate = relative(repositoryRoot, resolve(path));
-  return candidate === "" || (!candidate.startsWith("..") && !isAbsolute(candidate));
-}
+const isWithinRepository = path => inside(path, repositoryRoot);
 
 function repositoryPath(path) {
   return relative(repositoryRoot, resolve(path)).replaceAll("\\", "/");
@@ -170,56 +173,52 @@ function explicitPathCandidates(command) {
   }
   return [...candidates].map(unquote).filter(Boolean);
 }
-function validateExplicitFilesystemReferences(command, cwd) {
-  if (homeReferencePattern.test(command)) {
+function validateExplicitFilesystemReferences(command, cwd, reviewedPaths = []) {
+  const checked = reviewedPaths.reduce((text, path) => text.replaceAll(path, "REVIEWED_RELEASE_PATH"), command);
+  if (homeReferencePattern.test(checked)) {
     deny("Direct user-profile path references are blocked; use repository-scoped paths.");
   }
-  if (credentialReferencePattern.test(command) || sensitiveEnvironmentPattern.test(command)) {
+  if (credentialReferencePattern.test(checked) || sensitiveEnvironmentPattern.test(checked)) {
     deny("Direct credential and secret access is blocked.");
   }
-  if (/\b(?:Get-ChildItem|gci|dir)\s+Env:|\b(?:printenv|set)\s*$/i.test(command) || /GetEnvironmentVariables\s*\(/i.test(command)) {
+  if (/\b(?:Get-ChildItem|gci|dir)\s+Env:|\b(?:printenv|set)\s*$/i.test(checked) || /GetEnvironmentVariables\s*\(/i.test(checked)) {
     deny("Bulk environment enumeration is blocked.");
   }
-  if (/(?:^|[\s"'=(,]|-[A-Za-z][A-Za-z0-9_-]*:)(?:(?:\\\\){1,2}|\/\/)[^\\/\s"']+[\\/]/.test(command)) {
+  if (/(?:^|[\s"'=(,]|-[A-Za-z][A-Za-z0-9_-]*:)(?:(?:\\\\){1,2}|\/\/)[^\\/\s"']+[\\/]/.test(checked)) {
     deny("UNC and network filesystem paths are blocked.");
   }
-  const osPathCommand = command.replace(/^(node\s+\.agents[\\/]runtime[\\/]bin[\\/]zaip\.mjs\s+subagent\s+capture-terminal\b[^;&|\x60\r\n]*?)--agent-id\s+\/root\/[a-z][a-z0-9_]*_zaip_agent(?:_[a-z0-9]+)?(?=\s|$)(?=[^;&|\x60\r\n]*$)/, "$1--agent-id zaip-agent");
+  const osPathCommand = checked.replace(/^(node\s+\.agents[\\/]runtime[\\/]bin[\\/]zaip\.mjs\s+subagent\s+capture-terminal\b[^;&|\x60\r\n]*?)--agent-id\s+\/root\/[a-z][a-z0-9_]*_zaip_agent(?:_[a-z0-9]+)?(?=\s|$)(?=[^;&|\x60\r\n]*$)/, "$1--agent-id zaip-agent");
   if (/(?:^|[\s"'=])\/(?:etc|home|Users|root|var|opt|private|mnt|proc|sys|dev|tmp)(?:[\/\s"']|$)/i.test(osPathCommand)) {
     deny("Explicit operating-system paths outside the repository are blocked.");
   }
-  for (const candidate of explicitPathCandidates(command)) {
+  if (process.platform === "win32" && /(?:^|[\s"'=(,])\\(?!\\)[^\s\\/"'<>|;]+(?:\\[^\s"'<>|;]+|\.[A-Za-z0-9]{1,10})/.test(checked)) {
+    deny("Drive-rooted filesystem paths outside the repository are blocked.");
+  }
+  for (const candidate of explicitPathCandidates(checked)) {
     if (process.platform !== "win32" && /^[A-Za-z]:[\\/]/.test(candidate)) deny("Explicit filesystem path escapes the repository boundary.");
     const absolute = resolve(cwd, candidate);
     if (!isWithinRepository(absolute)) {
-      deny("Explicit filesystem path escapes the repository boundary.");
+      deny("Explicit filesystem path escapes the repository boundary. Validated workspace: " + repositoryRoot + "; tool: " + event.tool_name + "; workdir override: " + (typeof event.tool_input?.workdir === "string"));
     }
   }
 }
-
-function validateInlineExecution(command) {
-  const inlinePatterns = [
-    /\b(?:node|deno)\s+(?:-e|--eval)\b/i,
-    /\b(?:python(?:3)?|ruby|perl|php)\s+(?:-c|-e)\b/i,
-    /\bdeno\s+eval\b/i,
-    /\b(?:powershell|pwsh)(?:\.exe)?\b[\s\S]*\s-(?:Command|EncodedCommand|enc)\b/i,
-    /\bcmd(?:\.exe)?\s+\/c\b/i,
-    /\|\s*(?:node|deno|python(?:3)?|ruby|perl|php|powershell|pwsh|cmd)\b/i,
-    /\b(?:Invoke-Expression|iex)\b/i,
-  ];
-  if (inlinePatterns.some((pattern) => pattern.test(command))) {
-    deny("Inline or piped interpreter execution is blocked; use a reviewed repository script.");
-  }
-}
-
 async function validateGitPublication(command) {
+  if (/(?:^|[;&|\r\n])\s*(?:(?:&\s*)?(?:['"]git(?:\.exe)?['"]|\(\s*['"]git(?:\.exe)?['"]\s*\))|(?:env|command)\s+git(?:\.exe)?\b)/i.test(command) ||
+      /&\s*\(\s*Get-Command\s+git(?:\.exe)?\b/i.test(command) ||
+      /(?:^|[\s;&|])&\s*\$[A-Za-z_]/i.test(command) || /\b(?:Set-Alias|New-Alias)\b[^\r\n;]*\bgit\b/i.test(command)) {
+    deny("Indirect Git execution is blocked; use a single literal command.");
+  }
+  if (/\(\s*git(?:\.exe)?\b/i.test(command)) {
+    deny("Nested Git execution is blocked; use a single literal command.");
+  }
   const tokens = tokenizeLiteralCommand(command);
   if (tokens === null) {
-    if (/(?:^|[;&|]\s*)git(?:\.exe)?\b/i.test(command)) {
+    if (/(?:^|[;&|\r\n(])\s*git(?:\.exe)?\b/i.test(command)) {
       deny("Git commands must be a single literal command; separate commands before requesting execution.");
     }
     return;
   }
-  const invocation = gitInvocation(tokens);
+  const invocation = gitInvocation(tokens, deny);
   if (invocation === null) return;
   const { subcommand, arguments: arguments_ } = invocation;
   if (subcommand === "commit" && arguments_.some((value) => /^(?:--amend|--no-verify|-n)/i.test(value))) {
@@ -333,39 +332,6 @@ function isSafeBranchName(branch) {
   return typeof branch === "string" && branch.length <= 255 && /^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(branch) && !branch.includes("..") && !branch.includes("//") && !branch.includes("@{") && !branch.endsWith(".") && !branch.endsWith("/") && !branch.split("/").some((segment) => segment.startsWith(".") || segment.endsWith(".lock"));
 }
 
-function gitInvocation(tokens) {
-  if (tokens === null || !/^(?:git|git\.exe)$/i.test(tokens[0] ?? "")) return null;
-  let index = 1;
-  while (index < tokens.length && tokens[index].startsWith("-")) {
-    const rawOption = tokens[index];
-    const option = rawOption.toLowerCase();
-    if (option === "--version" || option === "--help") return null;
-    if (option === "--no-pager" || option === "--literal-pathspecs") {
-      index += 1;
-      continue;
-    }
-    if (
-      rawOption === "-c" ||
-      rawOption.startsWith("-c") ||
-      option.startsWith("--config") ||
-      option === "--git-dir" ||
-      option === "--work-tree" ||
-      option === "--namespace"
-    ) {
-      deny("Git global configuration and repository-routing overrides are blocked.");
-    }
-    if (rawOption === "-C" || rawOption.startsWith("-C")) {
-      const directory = rawOption === "-C" ? tokens[index + 1] : rawOption.slice(2);
-      if (directory !== ".") deny("Git working-directory overrides outside the repository root are blocked.");
-      index += rawOption === "-C" ? 2 : 1;
-      continue;
-    }
-    deny("Unknown Git global option is blocked.");
-  }
-  const subcommand = tokens[index]?.toLowerCase();
-  return subcommand === undefined ? null : { subcommand, arguments: tokens.slice(index + 1) };
-}
-
 function validateExplicitNetwork(command) {
   if (/(?:^|[;&|]\s*)\b(?:ssh|scp|sftp|rsync|ftp|telnet|nc|ncat)\b/i.test(command)) {
     deny("Direct remote-shell and file-transfer clients are blocked.");
@@ -617,7 +583,7 @@ async function validateShellDeletion(command, cwd) {
   for (const target of targets) await validateDeletionPath(target, cwd);
 }
 
-function validatePatch(command) {
+async function validatePatch(command) {
   const headers = [...command.matchAll(/^\*\*\* (Add|Update|Delete) File:\s*(.+)$|^\*\*\* Move to:\s*(.+)$/gm)];
   const lifecycleRecordTouched = headers.some((match) => {
     const candidate = (match[2] ?? match[3]).trim().replace(/^["']|["']$/g, "");
@@ -630,28 +596,27 @@ function validatePatch(command) {
     const candidate = (match[2] ?? match[3]).trim().replace(/^["']|["']$/g, "");
     const absolute = resolve(repositoryRoot, candidate);
     if (!isWithinRepository(absolute)) deny("Patch path escapes the repository boundary.");
+    if (!await nativeAuthority?.isSafePatchPath(absolute, repositoryRoot)) deny("Patch path traverses a link or could not be safely verified.");
     if (repositoryPath(absolute) === "") deny("Patching the repository root is blocked.");
     if (isGitPath(absolute)) {
       deny("Direct edits to protected Git control files are blocked.");
     }
   }
 }
-
-const lifecycleExemptPathPattern = /^(?:\.agents\/records|\.local)\//;
-const shellMutationPattern = /\b(?:Set-Content|Add-Content|Out-File|New-Item|Copy-Item|Move-Item|Remove-Item|git\s+apply|npm\s+version|pnpm\s+version)\b/i;
-
+const lifecycleExemptPathPattern = /^\.local\/(?!(?:codex-hook-|codex-telemetry-spool\/|runs\/))/;
 function patchPaths(command) {
   return [...command.matchAll(/^\*\*\* (?:Add|Update|Delete) File:\s*(.+)$|^\*\*\* Move to:\s*(.+)$/gm)].map(
     (match) => repositoryPath(resolve(repositoryRoot, (match[1] ?? match[2]).trim().replace(/^["']|["']$/g, ""))),
   );
 }
 
-function requiresOrchestratorRun(event, command) {
+async function requiresOrchestratorRun(event, command) {
   if (event.tool_name === "apply_patch") {
     const paths = patchPaths(command);
     return paths.length === 0 || paths.some((path) => !lifecycleExemptPathPattern.test(path));
   }
   if (event.tool_name === "Edit" || event.tool_name === "Write") {
+    if (!await nativeAuthority?.isSafePatchPath(resolve(event.cwd ?? repositoryRoot, command), repositoryRoot)) deny("File write path traverses a link or could not be safely verified.");
     return !lifecycleExemptPathPattern.test(repositoryPath(resolve(event.cwd ?? repositoryRoot, command)));
   }
   // Only single literal writes claim exemptions; compound commands remain gated.
@@ -666,17 +631,19 @@ function requiresOrchestratorRun(event, command) {
     }
     if (valid && options.has("-literalpath") && options.has("-value")) {
       const path = repositoryPath(resolve(event.cwd ?? repositoryRoot, options.get("-literalpath")));
+      if (!await nativeAuthority?.isSafePatchPath(resolve(repositoryRoot, path), repositoryRoot)) deny("Shell write path traverses a link or could not be safely verified.");
       if (lifecycleExemptPathPattern.test(path)) return false;
     }
   }
-  return shellMutationPattern.test(command);
+  return requiresShellMutationRun(command, tokens, event.cwd ?? repositoryRoot, repositoryRoot);
 }
 
 async function boundedCanonicalText(path, maximumBytes) {
   const info = await lstat(path);
   if (!info.isFile() || info.isSymbolicLink() || info.size > maximumBytes) throw new Error("Unsafe Run lookup file");
   const physical = await realpath(path);
-  if (!isWithinRepository(physical) || physical.toLowerCase() !== resolve(path).toLowerCase()) throw new Error("Run lookup must not follow links");
+  const identity = value => process.platform === "win32" ? value.toLowerCase() : value;
+  if (!isWithinRepository(physical) || identity(physical) !== identity(resolve(path))) throw new Error("Run lookup must not follow links");
   return readFile(path, "utf8");
 }
 
@@ -691,7 +658,7 @@ async function hasCurrentTaskOrchestratorRun(event) {
     const digest = createHash("sha256").update(JSON.stringify(["codex", threadId, turnId, null, null])).digest("hex");
     const correlation = JSON.parse(await boundedCanonicalText(resolve(repositoryRoot, ".local/codex-telemetry-spool/v1/correlations", digest + ".json"), 65536));
     const id = correlation.run_id;
-    const dated = typeof id === "string" ? /^RUN-(\d{4})-(\d{2})-(\d{2})-[A-Z0-9-]+-[A-Z0-9]{4}$/.exec(id) : null;
+    const dated = typeof id === "string" ? /^RUN-(\d{4})-(\d{2})-(\d{2})-[A-Z0-9-]+-[A-Z0-9]{2,16}$/.exec(id) : null;
     if (!dated || correlation.schema_version !== 1 || correlation.thread_id !== threadId || correlation.turn_id !== turnId || correlation.agent_path !== null) return false;
     const candidates = [
       ".agents/records/runs/" + dated[1] + "/" + dated[2] + "/" + id + ".jsonl",
@@ -731,13 +698,13 @@ try {
   deny("Malformed hook input was rejected.");
 }
 
-try { repositoryRoot = await selectHookRepositoryRoot(installedRoot, event.cwd); }
+const toolInput = event?.tool_input;
+try { const scope = await selectHookExecutionWorkspace(installedRoot, event); repositoryRoot = scope.repositoryRoot; event = { ...event, cwd: scope.cwd }; }
 catch (error) { deny(error.message); }
 if (!isWithinRepository(event.cwd)) {
   deny("Tool execution outside the ZAIP-AIOS repository is blocked.");
 }
 
-const toolInput = event?.tool_input;
 const commandFromCmd = toolInput?.cmd;
 const commandFromCommand = toolInput?.command;
 if (typeof commandFromCmd === "string" && typeof commandFromCommand === "string" && commandFromCmd !== commandFromCommand) {
@@ -746,24 +713,30 @@ if (typeof commandFromCmd === "string" && typeof commandFromCommand === "string"
 const command = typeof commandFromCmd === "string" ? commandFromCmd : commandFromCommand;
 if (typeof command !== "string") deny("A matched tool call without a command was rejected.");
 
-if (requiresOrchestratorRun(event, command) && !(await hasCurrentTaskOrchestratorRun(event))) {
+if (await requiresOrchestratorRun(event, command) && !(await hasCurrentTaskOrchestratorRun(event)) &&
+    !(await nativeAuthority?.hasNativeDelegatedPatch(event, repositoryRoot, boundedCanonicalText))) {
   deny("Persistent mutation requires the exact active Task Run and its verified thread/turn correlation. Capture or reconcile this turn before retrying; no global Task fallback is allowed.");
 }
 
-if (event.tool_name === "apply_patch") validatePatch(command);
+if (event.tool_name === "apply_patch") await validatePatch(command);
 else {
-  validateExplicitFilesystemReferences(command, event.cwd);
-  validateInlineExecution(command);
+  const reviewedPaths = [
+    ...await reviewedReleasePaths(command, event.cwd, repositoryRoot, credentialReferencePattern, deny),
+    ...await reviewedContextReadPaths(command, credentialReferencePattern), ...await (nativeAuthority?.reviewedValidationRuntimePaths?.(command, tokenizeLiteralCommand) ?? []),
+  ];
+  validateExplicitFilesystemReferences(command, event.cwd, reviewedPaths);
+  validateInlineExecution(command, deny);
+  if (!isLiteralReadSequence(command)) {
   await validateGitPublication(command);
   await validateCloudRunner(command);
   validateDirectCloudProviderMutation(command);
   validateExplicitNetwork(command);
   await validateShellDeletion(command, event.cwd);
-  for (const entry of destructivePatterns) {
-    if (entry.pattern.test(command)) deny(entry.reason);
+  checkDestructivePatterns(command, destructivePatterns, deny);
   }
   try { const updated = await captureCliTurn(repositoryRoot, event, command); if (updated) writeSync(1, JSON.stringify(rewriteCliInput(toolInput, updated, commandFromCmd)) + "\n"); }
   catch (error) { deny(error.message); }
 }
+activation?.recordActivation(repositoryRoot, event, "allowed");
 `;
 //# sourceMappingURL=codex-pre-tool-hook-template.js.map

package/dist/services/codex-pre-tool-hook-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+vB5C,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAouB5C,CAAC"}

package/dist/services/codex-pre-tool-hook-template.test.js

@@ -1,6 +1,6 @@
 import { spawnSync } from "node:child_process";
 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, expect, it } from "vitest";
 import { CODEX_PRE_TOOL_HOOK } from "./codex-pre-tool-hook-template.js";
@@ -9,6 +9,80 @@ const roots = [];
 afterEach(async () => {
     await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })));
 });
+it("permits only literal reviewed release commands with controlled external paths", async () => {
+    const root = await mkdtemp(join(tmpdir(), "zaip-cli-release-hook-"));
+    roots.push(root);
+    const hookPath = join(root, ".codex", "hooks", "zaip-pre-tool-use.mjs");
+    await mkdir(join(root, ".codex", "hooks"), { recursive: true });
+    await writeFile(hookPath, CODEX_PRE_TOOL_HOOK);
+    await writeFile(join(root, ".codex", "hooks", "zaip-pre-tool-support.mjs"), CODEX_PRE_TOOL_SUPPORT_HOOK);
+    await mkdir(join(root, "scripts"), { recursive: true });
+    await writeFile(join(root, "scripts", "local-release-preparation.mjs"), "export default null;\n");
+    await writeFile(join(root, "scripts", "local-release-deploy.mjs"), "export default null;\n");
+    await mkdir(join(root, "nested", "scripts"), { recursive: true });
+    await writeFile(join(root, "nested", "scripts", "local-release-deploy.mjs"), "export default null;\n");
+    const artifact = join(homedir(), ".codex", "release-candidates", "zaip-aios", "v4.3-full-aaaaaaaa-20260927");
+    const receipt = join(artifact, "local-release-receipt.json");
+    const tarball = join(artifact, "cli.tgz");
+    const policy = join(homedir(), ".codex", "release-keys", "zaip-aios", "maintainer-v4", "policy-v4.3-full.json");
+    const trust = join(homedir(), ".codex", "release-keys", "zaip-aios", "maintainer-v4", "trust");
+    const privateKey = join(homedir(), ".codex", "release-keys", "zaip-aios", "maintainer-v4", "release-private.pem");
+    const q = (path) => `"${path}"`;
+    const base = `--repository ${q(root)} --expected-repository zaip-ai/zaip-aios --sha ${"a".repeat(40)} --channel latest --version 4.3 --profile full`;
+    const prepare = `node scripts/local-release-preparation.mjs prepare ${base} --output-dir ${q(artifact)} --policy ${q(policy)} --key-id maintainer-v4 --expires-at 2026-09-28T00:00:00Z`;
+    const verify = `node scripts/local-release-preparation.mjs verify ${base} --tree-sha256 ${"b".repeat(64)} --receipt ${q(receipt)} --tarball ${q(tarball)} --policy ${q(policy)} --trust-store ${q(trust)}`;
+    const deploy = `node scripts/local-release-deploy.mjs ${base} --branch main --output-dir ${q(artifact)} --policy ${q(policy)} --trust-store ${q(trust)} --private-key ${q(privateKey)} --key-id maintainer-v4 --expires-at 2026-09-28T00:00:00Z --notes-file ${q(join(artifact, "notes.md"))} --inventory-file ${q(join(artifact, "inventory.json"))} --initial --dry-run --offline-dry-run`;
+    const invoke = (cmd) => spawnSync(process.execPath, [hookPath], {
+        cwd: root,
+        encoding: "utf8",
+        input: JSON.stringify({ cwd: root, tool_name: "exec_command", tool_input: { cmd } }),
+    });
+    for (const command of [prepare, verify, deploy]) {
+        const result = invoke(command);
+        expect(result.status).toBe(0);
+        expect(result.stdout, command).toBe("");
+    }
+    const nested = spawnSync(process.execPath, [hookPath], {
+        cwd: root,
+        encoding: "utf8",
+        input: JSON.stringify({
+            cwd: join(root, "nested"),
+            tool_name: "exec_command",
+            tool_input: { cmd: deploy },
+        }),
+    });
+    expect(JSON.parse(nested.stdout).hookSpecificOutput.permissionDecision).toBe("deny");
+    for (const command of [
+        verify.replace(" verify ", " pilot "),
+        prepare.replace(" prepare ", " bootstrap "),
+        prepare.replace("--profile full", "--profile full-v2"),
+        prepare.replace(q(policy), q(join(artifact, "policy-v4.3-full.json"))),
+        prepare.replace(q(policy), q(join(root, "policy.json"))),
+        prepare.replace(q(artifact), q(join(homedir(), ".codex", "release-candidates", "zaip-aios", "v4.3-full-bbbbbbbb-20260927"))),
+        prepare.replace(q(artifact), q(join(homedir(), ".codex", "release-candidates", "other", "v4.3-full-aaaaaaaa-20260927"))),
+        verify.replace("--receipt", "--unknown x --receipt"),
+        `${verify} --receipt ${q(receipt)}`,
+        verify.replace(q(tarball), q(`${artifact}\\..\\cli.tgz`)),
+        verify.replace(q(receipt), q(join(tmpdir(), "unrelated", "local-release-receipt.json"))),
+        verify.replace(q(trust), q(join(root, "trust"))),
+        verify.replace(q(trust), q(join(homedir(), ".codex", "release-keys", "zaip-aios", "other-key", "trust"))),
+        verify.replace(q(tarball), q(join(artifact, "cli^evil.tgz"))),
+        `${verify} ; Get-Content ${q(receipt)}`,
+        `${verify} && Get-Content ${q(receipt)}`,
+        `Get-Content ${q(receipt)}`,
+        `node scripts/unrelated.mjs --receipt ${q(receipt)}`,
+        deploy.replace("--initial", "--from v4.2 --initial"),
+        deploy.replace(q(privateKey), q(join(homedir(), ".ssh", "id_rsa"))),
+        deploy.replace(q(privateKey), q(join(artifact, "release-private.pem"))),
+        deploy.replace(q(privateKey), q(join(root, "key.txt"))),
+        deploy.replace(q(join(artifact, "notes.md")), q(join(artifact, ".env"))),
+    ]) {
+        const result = invoke(command);
+        expect(result.status).toBe(0);
+        expect(result.stdout, command).not.toBe("");
+        expect(JSON.parse(result.stdout).hookSpecificOutput.permissionDecision).toBe("deny");
+    }
+});
 it("uses tool_input.cmd, rejects conflicting commands, and keeps read-only git formatting", async () => {
     const root = await mkdtemp(join(tmpdir(), "zaip-cli-pre-tool-"));
     roots.push(root);
@@ -24,6 +98,79 @@ it("uses tool_input.cmd, rejects conflicting commands, and keeps read-only git f
     const allowed = invoke({ cmd: "git log -1 --format='%H %s'" });
     expect(allowed.status).toBe(0);
     expect(allowed.stdout).toBe("");
+    for (const cmd of [
+        "Write-Output safe\ngit push origin HEAD:refs/heads/unapproved",
+        "Write-Output safe\r\ngit push origin HEAD:refs/heads/unapproved",
+        "Write-Output $(git push origin HEAD:refs/heads/unapproved)",
+        "Write-Output (git push origin HEAD:refs/heads/unapproved)",
+        "echo `git push origin HEAD:refs/heads/unapproved`",
+        "& 'git' push origin HEAD:refs/heads/unapproved",
+        "& ('git') push origin HEAD:refs/heads/unapproved",
+        "env git push origin HEAD:refs/heads/unapproved",
+        "command git push origin HEAD:refs/heads/unapproved",
+        "& $git push origin HEAD:refs/heads/unapproved",
+        "gh api repos/zaip-ai/zaip-aios/git/refs -f ref=refs/heads/unapproved",
+        "gh api repos/zaip-ai/zaip-aios/git/refs --method=POST",
+        "gh -R other/repo pr merge 123",
+        "gh -R other/repo release create v1",
+        "Start-Process git -ArgumentList 'push origin HEAD:refs/heads/unapproved'",
+        "Start-Process -FilePath (Get-Command git) -ArgumentList 'push origin HEAD:refs/heads/unapproved'",
+        "saps -FilePath (Get-Command git) -ArgumentList 'push origin HEAD:refs/heads/unapproved'",
+        "Start-Process -FilePath $git -ArgumentList 'push origin HEAD:refs/heads/unapproved'",
+        "echo code > src/a.ts",
+        "Write-Output code > src/a.ts",
+        "echo code | tee src/a.ts",
+        "sed -i s/old/new/ src/a.ts",
+        "sed -i.bak s/old/new/ src/a.ts",
+        "sed '-i.bak' s/old/new/ src/a.ts",
+        "sed -Ei s/old/new/ src/a.ts",
+        'sed "-Ei" s/old/new/ src/a.ts',
+        "sed -e s/old/new/ -i src/a.ts",
+        "sed --expression=s/old/new/ --in-place src/a.ts",
+        "sed --in-place=.bak s/old/new/ src/a.ts",
+        "sed '--in-place=.bak' s/old/new/ src/a.ts",
+        "sed -e 'w src/a.ts' src/input.ts",
+        "sed 'w src/a.ts' src/input.ts",
+        "sed 's/old/new/w src/a.ts' src/input.ts",
+        "sed -f script.sed src/input.ts",
+        "sed --file=script.sed src/input.ts",
+        "sed --file script.sed src/input.ts",
+        "sed -e 's/x/y/wsrc/output.ts' src/input.ts",
+        "bash -c 'git push origin HEAD:refs/heads/unapproved'",
+        "bash -xc 'printf x > src/output.ts'",
+        "bash --noprofile -c 'printf x > src/output.ts'",
+        "sh -c 'git push origin HEAD:refs/heads/unapproved'",
+        "sh -ec 'printf x > src/output.ts'",
+        "sh -e -c 'printf x > src/output.ts'",
+        "& (Get-Command git) push origin HEAD:refs/heads/unapproved",
+        "& (Get-Command -Name git) push origin HEAD:refs/heads/unapproved",
+        "& (Get-Command 'git') reset --hard",
+        "Write-Output safe; & (Get-Command git) push origin HEAD:refs/heads/unapproved",
+        "ac src/a.ts payload",
+        "ni src/a.ts -ItemType File",
+        "cp src/a.ts src/b.ts",
+        "mv src/a.ts src/b.ts",
+    ]) {
+        const result = invoke({ cmd });
+        expect(result.status).toBe(0);
+        expect(JSON.parse(result.stdout).hookSpecificOutput.permissionDecision).toBe("deny");
+    }
+    if (process.platform === "win32") {
+        const rooted = invoke({ cmd: "Get-Content \\Windows\\System32\\config\\SAM" });
+        expect(JSON.parse(rooted.stdout).hookSpecificOutput.permissionDecision).toBe("deny");
+        const single = invoke({ cmd: "Get-Content \\secret.txt" });
+        expect(JSON.parse(single.stdout).hookSpecificOutput.permissionDecision).toBe("deny");
+    }
+    for (const cmd of [
+        "Write-Output 'literal $()'",
+        "Write-Output 'literal `mark'",
+        "Write-Output 'git reset --hard'",
+        "Write-Output 'gh api repos/other/repo/git/refs -f ref=x'",
+    ]) {
+        const literal = invoke({ cmd });
+        expect(literal.status).toBe(0);
+        expect(literal.stdout).toBe("");
+    }
     const capture = "node .agents/runtime/bin/zaip.mjs subagent capture-terminal --parent-agent-id native-parent --parent-run-id RUN-EXAMPLE --agent-id /root/gui_quality_assurance_lead_zaip_agent --agent-type zaip-agent-finalizer --status completed --json";
     const captureResult = invoke({ cmd: capture });
     expect(captureResult.status).toBe(0);
@@ -92,4 +239,56 @@ it("uses tool_input.cmd, rejects conflicting commands, and keeps read-only git f
     const nestedDiskDenied = invoke({ cmd: "cmd /c " + "format" + " C:" });
     expect(JSON.parse(nestedDiskDenied.stdout).hookSpecificOutput.permissionDecision).toBe("deny");
 });
+it("allows explicit acceptance arguments before Task capture without allowing writes", async () => {
+    const root = await mkdtemp(join(tmpdir(), "zaip-cli-bootstrap-hook-"));
+    roots.push(root);
+    const hooks = join(root, ".codex", "hooks");
+    await mkdir(hooks, { recursive: true });
+    await writeFile(join(hooks, "zaip-pre-tool-use.mjs"), CODEX_PRE_TOOL_HOOK);
+    await writeFile(join(hooks, "zaip-pre-tool-support.mjs"), CODEX_PRE_TOOL_SUPPORT_HOOK);
+    const invoke = (cmd) => spawnSync(process.execPath, [join(hooks, "zaip-pre-tool-use.mjs")], {
+        cwd: root,
+        encoding: "utf8",
+        windowsHide: true,
+        env: { ...process.env, CODEX_THREAD_ID: "bootstrap-thread", CODEX_TURN_ID: "bootstrap-turn" },
+        input: JSON.stringify({
+            cwd: root,
+            session_id: "bootstrap-thread",
+            turn_id: "bootstrap-turn",
+            tool_use_id: "bootstrap-tool",
+            tool_name: "exec_command",
+            tool_input: { cmd },
+        }),
+    });
+    const result = invoke("node .agents/runtime/bin/zaip.mjs conversation start --intent new-work --acceptance AC-WORK-001-09 --json");
+    expect(result.status, result.stderr).toBe(0);
+    const output = JSON.parse(result.stdout).hookSpecificOutput;
+    expect(output.permissionDecision, result.stdout).toBe("allow");
+    expect(output.updatedInput.cmd).toContain("--codex-hook-id=");
+    for (const cmd of [
+        "ac src/a.ts payload",
+        "AC src/a.ts payload",
+        "(Set-Content -LiteralPath src/a.ts -Value code)",
+        "Write-Output (Set-Content -LiteralPath src/a.ts -Value code)",
+        "env cp src/a.ts src/b.ts",
+        "exec cp src/a.ts src/b.ts",
+        "FOO=1 cp src/a.ts src/b.ts",
+        "unknown-wrapper ac src/a.ts payload",
+        ".\\echo.cmd ac src/a.ts payload",
+        ".\\node.cmd .agents/runtime/bin/zaip.mjs conversation start --acceptance AC-WORK-001-09",
+        "echo.cmd ac src/a.ts payload",
+        "node.cmd .agents/runtime/bin/zaip.mjs conversation start --acceptance AC-WORK-001-09",
+        "node scripts/unknown.mjs --acceptance AC-WORK-001-09",
+        "command ac src/a.ts payload",
+        ".\\sed.exe -i s/a/b/ src/a.ts",
+        ".\\sed.exe -f script.sed src/input.ts",
+        "git apply patch.diff",
+        "node scripts/read.mjs --acceptance AC-WORK-001-09; ac src/a.ts payload",
+        "node scripts/read.mjs > src/a.ts",
+    ]) {
+        const blocked = invoke(cmd);
+        expect(blocked.status, blocked.stderr).toBe(0);
+        expect(JSON.parse(blocked.stdout).hookSpecificOutput.permissionDecision).toBe("deny");
+    }
+});
 //# sourceMappingURL=codex-pre-tool-hook-template.test.js.map

package/dist/services/codex-pre-tool-hook-template.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.test.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF,MAAM,KAAK,GAAa,EAAE,CAAC;AAC3B,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;IACrG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACxE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,SAAS,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC/C,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAC1D,2BAA2B,CAC5B,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,UAAkC,EAAE,EAAE,CACpD,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACtC,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;KAC5E,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,OAAO,GACX,4OAA4O,CAAC;IAC/O,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI;QACjB,kCAAkC;QAClC,gCAAgC;QAChC,yCAAyC;KAC1C,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,uCAAuC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,8BAA8B;QAC9B,oDAAoD;QACpD,6DAA6D;QAC7D,OAAO,CAAC,OAAO,CAAC,uCAAuC,EAAE,QAAQ,CAAC;QAClE,OAAO,CAAC,OAAO,CACb,uCAAuC,EACvC,wCAAwC,CACzC;QACD,GAAG,OAAO,2BAA2B;KACtC,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC;QAC3B,GAAG,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG;KAC5E,CAAC,CAAC;IACH,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI;QAC1B;YACE,eAAe,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU;YACjE,kCAAkC;SACnC;QACD;YACE,qBAAqB,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU;YACvE,kCAAkC;SACnC;QACD;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU,EAAE,CAAC,GAAG;YAClG,kCAAkC;SACnC;QACD,CAAC,qCAAqC,EAAE,kCAAkC,CAAC;QAC3E;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,GAAG;YACtE,kCAAkC;SACnC;QACD;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG;YAC1E,kCAAkC;SACnC;QACD,CAAC,+BAA+B,GAAG,MAAM,EAAE,uCAAuC,CAAC;KAC3E,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzF,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,GAAG,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.test.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF,MAAM,KAAK,GAAa,EAAE,CAAC;AAC3B,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;IAC7F,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACrE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACxE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,SAAS,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC/C,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAC1D,2BAA2B,CAC5B,CAAC;IACF,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,+BAA+B,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAClG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,0BAA0B,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC7F,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAA0B,CAAC,EAC3D,wBAAwB,CACzB,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CACnB,OAAO,EAAE,EACT,QAAQ,EACR,oBAAoB,EACpB,WAAW,EACX,6BAA6B,CAC9B,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CACjB,OAAO,EAAE,EACT,QAAQ,EACR,cAAc,EACd,WAAW,EACX,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,IAAI,CACrB,OAAO,EAAE,EACT,QAAQ,EACR,cAAc,EACd,WAAW,EACX,eAAe,EACf,qBAAqB,CACtB,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;IACxC,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,kDAAkD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,gDAAgD,CAAC;IACrJ,MAAM,OAAO,GAAG,sDAAsD,IAAI,iBAAiB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,2DAA2D,CAAC;IACxL,MAAM,MAAM,GAAG,qDAAqD,IAAI,kBAAkB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3M,MAAM,MAAM,GAAG,yCAAyC,IAAI,+BAA+B,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,UAAU,CAAC,0EAA0E,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,wCAAwC,CAAC;IAC7X,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACtC,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;KACrF,CAAC,CAAC;IACL,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACrD,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YACzB,SAAS,EAAE,cAAc;YACzB,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;SAC5B,CAAC;KACH,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI;QACpB,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC;QACrC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC;QAC3C,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;QACtD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,OAAO,CACb,CAAC,CAAC,QAAQ,CAAC,EACX,CAAC,CACC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,6BAA6B,CAAC,CAC5F,CACF;QACD,OAAO,CAAC,OAAO,CACb,CAAC,CAAC,QAAQ,CAAC,EACX,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,OAAO,EAAE,6BAA6B,CAAC,CAAC,CAC3F;QACD,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,uBAAuB,CAAC;QACpD,GAAG,MAAM,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE;QACnC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,QAAQ,eAAe,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACxF,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CACZ,CAAC,CAAC,KAAK,CAAC,EACR,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAChF;QACD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7D,GAAG,MAAM,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE;QACvC,GAAG,MAAM,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE;QACxC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE;QAC3B,wCAAwC,CAAC,CAAC,OAAO,CAAC,EAAE;QACpD,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,uBAAuB,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;KACzE,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;IACrG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACxE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,SAAS,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC/C,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAC1D,2BAA2B,CAC5B,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,UAAkC,EAAE,EAAE,CACpD,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACtC,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;KAC5E,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI;QAChB,+DAA+D;QAC/D,iEAAiE;QACjE,4DAA4D;QAC5D,2DAA2D;QAC3D,mDAAmD;QACnD,gDAAgD;QAChD,kDAAkD;QAClD,gDAAgD;QAChD,oDAAoD;QACpD,+CAA+C;QAC/C,sEAAsE;QACtE,uDAAuD;QACvD,+BAA+B;QAC/B,oCAAoC;QACpC,0EAA0E;QAC1E,kGAAkG;QAClG,yFAAyF;QACzF,qFAAqF;QACrF,sBAAsB;QACtB,8BAA8B;QAC9B,0BAA0B;QAC1B,4BAA4B;QAC5B,gCAAgC;QAChC,kCAAkC;QAClC,6BAA6B;QAC7B,+BAA+B;QAC/B,+BAA+B;QAC/B,iDAAiD;QACjD,yCAAyC;QACzC,2CAA2C;QAC3C,kCAAkC;QAClC,+BAA+B;QAC/B,yCAAyC;QACzC,gCAAgC;QAChC,oCAAoC;QACpC,oCAAoC;QACpC,4CAA4C;QAC5C,sDAAsD;QACtD,qCAAqC;QACrC,gDAAgD;QAChD,oDAAoD;QACpD,mCAAmC;QACnC,qCAAqC;QACrC,4DAA4D;QAC5D,kEAAkE;QAClE,oCAAoC;QACpC,+EAA+E;QAC/E,qBAAqB;QACrB,4BAA4B;QAC5B,sBAAsB;QACtB,sBAAsB;KACvB,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,4BAA4B;QAC5B,8BAA8B;QAC9B,iCAAiC;QACjC,0DAA0D;KAC3D,EAAE,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,OAAO,GACX,4OAA4O,CAAC;IAC/O,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI;QACjB,kCAAkC;QAClC,gCAAgC;QAChC,yCAAyC;KAC1C,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,uCAAuC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,8BAA8B;QAC9B,oDAAoD;QACpD,6DAA6D;QAC7D,OAAO,CAAC,OAAO,CAAC,uCAAuC,EAAE,QAAQ,CAAC;QAClE,OAAO,CAAC,OAAO,CACb,uCAAuC,EACvC,wCAAwC,CACzC;QACD,GAAG,OAAO,2BAA2B;KACtC,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC;QAC3B,GAAG,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG;KAC5E,CAAC,CAAC;IACH,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI;QAC1B;YACE,eAAe,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU;YACjE,kCAAkC;SACnC;QACD;YACE,qBAAqB,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU;YACvE,kCAAkC;SACnC;QACD;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU,EAAE,CAAC,GAAG;YAClG,kCAAkC;SACnC;QACD,CAAC,qCAAqC,EAAE,kCAAkC,CAAC;QAC3E;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,GAAG;YACtE,kCAAkC;SACnC;QACD;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG;YAC1E,kCAAkC;SACnC;QACD,CAAC,+BAA+B,GAAG,MAAM,EAAE,uCAAuC,CAAC;KAC3E,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzF,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,GAAG,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;IAChG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC3E,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,2BAA2B,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC,EAAE;QAClE,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,IAAI;QACjB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE;QAC7F,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,GAAG,EAAE,IAAI;YACT,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,gBAAgB;YAC7B,SAAS,EAAE,cAAc;YACzB,UAAU,EAAE,EAAE,GAAG,EAAE;SACpB,CAAC;KACH,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,MAAM,CACnB,2GAA2G,CAC5G,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC;IAC5D,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI;QAChB,qBAAqB;QACrB,qBAAqB;QACrB,iDAAiD;QACjD,8DAA8D;QAC9D,0BAA0B;QAC1B,2BAA2B;QAC3B,4BAA4B;QAC5B,qCAAqC;QACrC,iCAAiC;QACjC,yFAAyF;QACzF,8BAA8B;QAC9B,sFAAsF;QACtF,sDAAsD;QACtD,6BAA6B;QAC7B,+BAA+B;QAC/B,uCAAuC;QACvC,sBAAsB;QACtB,wEAAwE;QACxE,kCAAkC;KACnC,EAAE,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/services/codex-pre-tool-support-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-support-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,2BAA2B,QA4GvC,CAAC"}
+{"version":3,"file":"codex-pre-tool-support-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,2BAA2B,QA+YvC,CAAC"}