npm - @zaip-ai/cli - Versions diffs - 4.7.0 → 4.9.0 - Mend

@zaip-ai/cli 4.7.0 → 4.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (127) hide show

package/dist/services/adapters.d.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 import { type PublicAgentCatalog } from "./agent-adapters.js";
 export { isManagedAdapter } from "./managed-adapter.js";
-export declare const ADAPTERS_VERSION = "4.7.0";
+export declare const ADAPTERS_VERSION = "4.9.0";
 export interface AdapterFile {
     path: string;
     content: string;

package/dist/services/adapters.js CHANGED Viewed

@@ -11,7 +11,7 @@ export { isManagedAdapter } from "./managed-adapter.js";
 import { CODEX_GITHUB_DEPLOY_RULES, CODEX_SECURITY_RULES } from "./codex-rules.js";
 import { codexWindowsHookCommand } from "./codex-windows-hook-command.js";
 import { applyTransactionalChanges, assertSafeDestination } from "./transactional-files.js";
-export const ADAPTERS_VERSION = "4.7.0";
+export const ADAPTERS_VERSION = "4.9.0";
 const ROOT_GUIDANCE = `# ZAIP-AIOS
 Read \`.agents/config/project.yaml\` first. Apply ZAIP only for literal boolean \`zaip.enabled: true\`, except framework maintenance or \`zaip enable\`. \`AGENTS.md\` is a bootstrap; canonical guidance lives in \`.agents/\`.

package/dist/services/codex-hook-activation.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"codex-hook-activation.d.ts","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,YACjC,YAAY,EACZ,eAAe,EACf,cAAc,EACd,MAAM,CACE,CAAC;AACX,eAAO,MAAM,qBAAqB,YAChC,oBAAoB,EACpB,oCAAoC,EACpC,wCAAwC,EACxC,6CAA6C,EAC7C,0CAA0C,EAC1C,8CAA8C,EAC9C,uCAAuC,CAC/B,CAAC;AAGX,eAAO,MAAM,qBAAqB,~~QA8CjC~~,CAAC"}
1	+ {"version":3,"file":"codex-hook-activation.d.ts","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,YACjC,YAAY,EACZ,eAAe,EACf,cAAc,EACd,MAAM,CACE,CAAC;AACX,eAAO,MAAM,qBAAqB,YAChC,oBAAoB,EACpB,oCAAoC,EACpC,wCAAwC,EACxC,6CAA6C,EAC7C,0CAA0C,EAC1C,8CAA8C,EAC9C,uCAAuC,CAC/B,CAAC;AAGX,eAAO,MAAM,qBAAqB,QA0DjC,CAAC"}

package/dist/services/codex-hook-activation.js CHANGED Viewed

@@ -60,5 +60,17 @@ export function recordActivation(root, event, outcome = "observed") {
     renameSync(temporary, path);
   } catch { /* Diagnostics must not break a tool or turn. Missing evidence stays unknown. */ }
 }
+export async function isZaipDisabled(repositoryRoot, boundedCanonicalText) {
+  try {
+    const source = (await boundedCanonicalText(resolve(repositoryRoot, ".agents/config/project.yaml"), 65536))
+      .replace(/\r\n/g, "\n");
+    const zaipKeys = [...source.matchAll(/^(?:zaip|"zaip"|'zaip')\s*:/gm)];
+    const block = /^zaip:\n((?:[ \t][^\n]*(?:\n|$)|\n)*)/m.exec(source)?.[1];
+    if (zaipKeys.length !== 1 || block === undefined) return false;
+    return /^  enabled: false\n*$/.test(block);
+  } catch {
+    return false;
+  }
+}
 `;
 //# sourceMappingURL=codex-hook-activation.js.map

package/dist/services/codex-hook-activation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"codex-hook-activation.js","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,YAAY;IACZ,eAAe;IACf,cAAc;IACd,MAAM;CACE,CAAC;AACX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,oBAAoB;IACpB,oCAAoC;IACpC,wCAAwC;IACxC,6CAA6C;IAC7C,0CAA0C;IAC1C,8CAA8C;IAC9C,uCAAuC;CAC/B,CAAC;AAEX,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAA;;;gBAG/B,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;iBACpC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CtD~~,CAAC"}
1	+ {"version":3,"file":"codex-hook-activation.js","sourceRoot":"","sources":["../../src/services/codex-hook-activation.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,YAAY;IACZ,eAAe;IACf,cAAc;IACd,MAAM;CACE,CAAC;AACX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,oBAAoB;IACpB,oCAAoC;IACpC,wCAAwC;IACxC,6CAA6C;IAC7C,0CAA0C;IAC1C,8CAA8C;IAC9C,uCAAuC;CAC/B,CAAC;AAEX,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAA;;;gBAG/B,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;iBACpC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsDtD,CAAC"}

package/dist/services/codex-pre-tool-hook-template.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"codex-pre-tool-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,mBAAmB,~~QAqpB~~/B,CAAC"}
1	+ {"version":3,"file":"codex-pre-tool-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,mBAAmB,QAiuB/B,CAAC"}

package/dist/services/codex-pre-tool-hook-template.js CHANGED Viewed

@@ -13,7 +13,7 @@ const installedRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..
 let repositoryRoot = installedRoot;
 const deletionCommandPattern = /\b(?:Remove-Item|ri|rm|rmdir|rd|del|erase)\b/i;
 const allowedExplicitNetworkHosts = new Set([
-  "127.0.0.1", "api.github.com", "github.com", "localhost", "objects.githubusercontent.com", "::1",
+  "127.0.0.1", "api.github.com", "github.com", "localhost", "objects.githubusercontent.com", "releases.hashicorp.com", "::1",
 ]);
 const networkClientPattern = /\b(?:curl|wget|Invoke-WebRequest|Invoke-RestMethod|iwr|irm)\b/i;
 const cloudRunnerScript = ".agents/tools/cloud-runner.mjs";
@@ -206,15 +206,20 @@ function validateExplicitFilesystemReferences(command, cwd, reviewedPaths = [])
   }
 }
 async function validateGitPublication(command) {
-  if (/(?:^|[;&|\r\n])\s*(?:(?:&\s*)?(?:['"]git(?:\.exe)?['"]|\(\s*['"]git(?:\.exe)?['"]\s*\))|(?:env|command)\s+git(?:\.exe)?\b)/i.test(command) ||
+  const tokens = tokenizeLiteralCommand(command);
+  if (tokens !== null) {
+    const launcher = tokens[0]?.toLowerCase();
+    if (((launcher === "env" || launcher === "command") && /^git(?:\.exe)?$/i.test(tokens[1] ?? "")) ||
+        (/^(?:Set-Alias|New-Alias)$/i.test(launcher ?? "") && tokens.slice(1).some(token => /^git(?:\.exe)?$/i.test(token))))
+      deny("Indirect Git execution is blocked; use a single literal command.");
+  } else if (/(?:^|[;&|\r\n])\s*(?:(?:&\s*)?(?:['"]git(?:\.exe)?['"]|\(\s*['"]git(?:\.exe)?['"]\s*\))|(?:env|command)\s+git(?:\.exe)?\b)/i.test(command) ||
       /&\s*\(\s*Get-Command\s+git(?:\.exe)?\b/i.test(command) ||
       /(?:^|[\s;&|])&\s*\$[A-Za-z_]/i.test(command) || /\b(?:Set-Alias|New-Alias)\b[^\r\n;]*\bgit\b/i.test(command)) {
     deny("Indirect Git execution is blocked; use a single literal command.");
   }
-  if (/\(\s*git(?:\.exe)?\b/i.test(command)) {
+  if (tokens === null && /\(\s*git(?:\.exe)?\b/i.test(command)) {
     deny("Nested Git execution is blocked; use a single literal command.");
   }
-  const tokens = tokenizeLiteralCommand(command);
   if (tokens === null) {
     if (/(?:^|[;&|\r\n(])\s*git(?:\.exe)?\b/i.test(command)) {
       deny("Git commands must be a single literal command; separate commands before requesting execution.");
@@ -276,6 +281,33 @@ async function validateGitPublication(command) {
   }
 }
+function validateHashicorpRead(command) {
+  const tokens = tokenizeLiteralCommand(command);
+  if (!tokens || !/^(?:curl(?:\.exe)?|Invoke-WebRequest|Invoke-RestMethod|iwr|irm)$/i.test(tokens[0]))
+    deny("HashiCorp releases require a literal supported read command.");
+  let urlCount = 0;
+  for (let i = 1; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (/^https:\/\//i.test(token)) {
+      const url = new URL(token);
+      if (url.hostname !== "releases.hashicorp.com" || url.username || url.password || url.port)
+        deny("HashiCorp reads require one exact HTTPS destination.");
+      urlCount++; continue;
+    }
+    if (["-I", "--head", "-s", "-S", "-sS", "--silent", "--show-error", "--fail", "-q", "--disable"].includes(token)) continue;
+    const namedMethod = /^(?:--request|--method|-Method)(?:=(.*))?$/i.exec(token);
+    const curlMethod = /^-X(.*)$/.exec(token);
+    if (namedMethod || curlMethod) {
+      const value = namedMethod ? (namedMethod[1] ?? tokens[++i]) : (curlMethod[1] || tokens[++i]);
+      if (!/^(?:GET|HEAD)$/i.test(value ?? "")) deny("HashiCorp releases permit only GET or HEAD requests.");
+      continue;
+    }
+    if (/^(?:-Uri|--url)$/i.test(token) && /^https:\/\//i.test(tokens[i + 1] ?? "")) continue;
+    deny("Unsupported option in the bounded HashiCorp read command.");
+  }
+  if (urlCount !== 1) deny("HashiCorp reads require exactly one HTTPS URL.");
+}
 function validateExplicitNetwork(command) {
   if (/(?:^|[;&|]\s*)\b(?:ssh|scp|sftp|rsync|ftp|telnet|nc|ncat)\b/i.test(command)) {
     deny("Direct remote-shell and file-transfer clients are blocked.");
@@ -289,15 +321,21 @@ function validateExplicitNetwork(command) {
     deny("Network clients require an explicit allowlisted URL.");
   }
   for (const match of urls) {
-    let host;
+    let target;
     try {
-      host = new URL("https://" + match[1]).hostname.toLowerCase();
+      target = new URL(match[0]);
     } catch {
       deny("Malformed network target was rejected.");
     }
+    const host = target.hostname.toLowerCase();
     if (!allowedExplicitNetworkHosts.has(host)) {
       deny("Explicit network target is outside the ZAIP allowlist.");
     }
+    if (host === "releases.hashicorp.com") {
+      if (target.protocol !== "https:" || target.username || target.password)
+        deny("HashiCorp releases require an exact HTTPS read target.");
+      validateHashicorpRead(command);
+    }
   }
 }
@@ -406,9 +444,35 @@ function terraformTargetMatches(contract, options, operation) {
 }
 function validateDirectCloudProviderMutation(command) {
-  if (command.includes(cloudRunnerScript)) return;
+  const tokens = tokenizeLiteralCommand(command);
+  if (/^(?:node|node\.exe)$/i.test(tokens?.[0] ?? "") && tokens?.[1] === cloudRunnerScript) return;
   if (/\bterraform(?:\.exe)?\s+(?:apply|destroy|import)\b/i.test(command)) deny("Direct Terraform mutation is blocked; use the contract-bound cloud runner.");
-  if (/\b(?:wrangler|cloudflare|hostinger)(?:\.exe)?\b/i.test(command)) deny("Direct Cloudflare or Hostinger commands are blocked; use the contract-bound cloud runner.");
+  const provider = /^(?:wrangler|cloudflare|hostinger)(?:\.exe|\.cmd|\.js|\.mjs)?$/i;
+  const wrapperProvider = /^(?:wrangler|cloudflare|hostinger)(?:\.exe|\.cmd|\.js|\.mjs|@[A-Za-z0-9][A-Za-z0-9._-]*)?$/i;
+  const base = (token) => token?.split(/[\\/]/).at(-1) ?? "";
+  if (tokens === null) {
+    // Complex shell syntax stays fail-closed; literal arguments are inspected as tokens below.
+    if (/\b(?:wrangler|cloudflare|hostinger)(?:\.exe)?\b/i.test(command)) deny("Direct Cloudflare or Hostinger commands are blocked; use the contract-bound cloud runner.");
+    return;
+  }
+  let index = 0;
+  const launcher = base(tokens[0]);
+  if (/^(?:npx|pnpm|npm|yarn|bunx)(?:\.cmd|\.exe)?$/i.test(launcher)) {
+    // Package-manager options can move the executable. Inspect exact provider
+    // tokens across this recognized wrapper; paths and document names remain inert.
+    if (tokens.slice(1).some((token) => wrapperProvider.test(token))) deny("Direct Cloudflare or Hostinger commands are blocked; use the contract-bound cloud runner.");
+    index = 1;
+    if (/^npx(?:\.cmd|\.exe)?$/i.test(launcher) && /^(?:--yes|-y)$/.test(tokens[index] ?? "")) index += 1;
+    if (/^pnpm(?:\.cmd|\.exe)?$/i.test(launcher) && /^(?:--filter|--dir)$/.test(tokens[index] ?? "") && tokens[index + 1]) index += 2;
+    if (/^(?:exec|dlx)$/.test(tokens[index] ?? "")) index += 1;
+    if (tokens[index] === "--") index += 1;
+    if (/^(?:exec|dlx)$/.test(tokens[index] ?? "")) index += 1;
+  } else if (/^(?:node|node\.exe)$/i.test(launcher)) index = 1;
+  else if (/^(?:powershell|pwsh|cmd|bash|sh)(?:\.exe)?$/i.test(launcher)) {
+    if (/\b(?:wrangler|cloudflare|hostinger)(?:\.exe)?\b/i.test(command)) deny("Direct Cloudflare or Hostinger commands are blocked; use the contract-bound cloud runner.");
+    return;
+  }
+  if (provider.test(base(tokens[index]))) deny("Direct Cloudflare or Hostinger commands are blocked; use the contract-bound cloud runner.");
 }
 async function validateCloudRunner(command) {
@@ -590,6 +654,18 @@ async function requiresOrchestratorRun(event, command) {
       if (lifecycleExemptPathPattern.test(path)) return false;
     }
   }
+  // The external Node is only a literal canonical validation command when the
+  // native authority has verified this workspace's exact opt-in executable.
+  if (tokens && isAbsolute(tokens[0]) &&
+      /^\.agents[\\/]runtime[\\/]bin[\\/]zaip\.mjs$/.test(tokens[1] ?? "") &&
+      tokens[2] === "validation" && ["execute", "batch"].includes(tokens[3]) &&
+      !Object.values(shellSyntax(command)).some(Boolean)) {
+    let optIn;
+    try { optIn = JSON.parse(await readFile(resolve(repositoryRoot, ".local/validation-runtime.json"), "utf8")); }
+    catch { optIn = null; }
+    const reviewed = await (nativeAuthority?.reviewedValidationRuntimePaths?.(command, tokenizeLiteralCommand, repositoryRoot) ?? []);
+    if (optIn?.executable === tokens[0] && reviewed.length === 1 && reviewed[0] === tokens[0]) return false;
+  }
   return requiresShellMutationRun(command, tokens, event.cwd ?? repositoryRoot, repositoryRoot);
 }
@@ -627,7 +703,7 @@ if (typeof commandFromCmd === "string" && typeof commandFromCommand === "string"
 const command = typeof commandFromCmd === "string" ? commandFromCmd : commandFromCommand;
 if (typeof command !== "string") deny("A matched tool call without a command was rejected.");
-if (await requiresOrchestratorRun(event, command)) {
+if (await requiresOrchestratorRun(event, command) && !(await activation?.isZaipDisabled?.(repositoryRoot, boundedCanonicalText))) {
   const directRun = await nativeAuthority?.hasCurrentTaskOrchestratorRun(event, installedRoot, boundedCanonicalText);
   const primaryRead = (path, maximumBytes) => boundedCanonicalText(path, maximumBytes, installedRoot);
   const delegated = directRun ? false : await nativeAuthority?.hasNativeDelegatedPatch(event, repositoryRoot, primaryRead, installedRoot);
@@ -644,7 +720,7 @@ if (event.tool_name === "apply_patch") await validatePatch(command);
 else {
   const reviewedPaths = [
     ...await reviewedReleasePaths(command, event.cwd, repositoryRoot, credentialReferencePattern, deny),
-    ...await reviewedContextReadPaths(command, credentialReferencePattern), ...await (nativeAuthority?.reviewedValidationRuntimePaths?.(command, tokenizeLiteralCommand) ?? []),
+    ...await reviewedContextReadPaths(command, credentialReferencePattern, installedRoot), ...await (nativeAuthority?.reviewedValidationRuntimePaths?.(command, tokenizeLiteralCommand, repositoryRoot) ?? []),
   ];
   validateExplicitFilesystemReferences(command, event.cwd, reviewedPaths);
   validateInlineExecution(command, deny);

package/dist/services/codex-pre-tool-hook-template.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2c3C,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0M5B,CAAC"}
1	+ {"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2gB3C,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsN5B,CAAC"}

package/dist/services/codex-pre-tool-hook-template.test.js CHANGED Viewed

@@ -3,6 +3,7 @@ import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, expect, it } from "vitest";
+import { CODEX_HOOK_ACTIVATION } from "./codex-hook-activation.js";
 import { CODEX_NATIVE_TOOL_AUTHORITY_HOOK } from "./codex-native-tool-authority-template.js";
 import { CODEX_PRE_TOOL_HOOK } from "./codex-pre-tool-hook-template.js";
 import { CODEX_PRE_TOOL_SUPPORT_HOOK } from "./codex-pre-tool-support-template.js";
@@ -10,6 +11,77 @@ const roots = [];
 afterEach(async () => {
     await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })));
 });
+it("portable hook restricts HashiCorp release reads to the exact HTTPS host and GET or HEAD", async () => {
+    const root = await mkdtemp(join(tmpdir(), "zaip-cli-hashicorp-read-"));
+    roots.push(root);
+    const hooks = join(root, ".codex", "hooks");
+    await mkdir(hooks, { recursive: true });
+    await writeFile(join(hooks, "zaip-pre-tool-use.mjs"), CODEX_PRE_TOOL_HOOK);
+    await writeFile(join(hooks, "zaip-pre-tool-support.mjs"), CODEX_PRE_TOOL_SUPPORT_HOOK);
+    await writeFile(join(hooks, "zaip-native-tool-authority.mjs"), CODEX_NATIVE_TOOL_AUTHORITY_HOOK);
+    const invoke = (cmd) => spawnSync(process.execPath, [join(hooks, "zaip-pre-tool-use.mjs")], {
+        cwd: root,
+        encoding: "utf8",
+        input: JSON.stringify({ cwd: root, tool_name: "exec_command", tool_input: { cmd } }),
+    });
+    for (const cmd of [
+        "curl https://releases.hashicorp.com/terraform/",
+        "curl --request HEAD https://releases.hashicorp.com/terraform/",
+    ]) {
+        const result = invoke(cmd);
+        expect(result.status).toBe(0);
+        expect(result.stdout).toBe("");
+    }
+    for (const cmd of [
+        "curl http://releases.hashicorp.com/terraform/",
+        "curl --request=POST https://releases.hashicorp.com/terraform/",
+        "curl --request='PATCH' https://releases.hashicorp.com/terraform/",
+        "curl -X DELETE https://releases.hashicorp.com/terraform/",
+        "Invoke-WebRequest -Method 'POST' -Uri https://releases.hashicorp.com/terraform/",
+        "curl -L https://releases.hashicorp.com/terraform/",
+        "curl https://releases.hashicorp.com.evil.test/terraform/",
+        "curl https://evil.test@releases.hashicorp.com/terraform/",
+    ]) {
+        const result = invoke(cmd);
+        expect(result.status).toBe(0);
+        expect(JSON.parse(result.stdout).hookSpecificOutput.permissionDecision).toBe("deny");
+    }
+});
+it("portable hook releases Task authority only for literal ZAIP disable", async () => {
+    const root = await mkdtemp(join(tmpdir(), "zaip-cli-disabled-hook-"));
+    roots.push(root);
+    const hooks = join(root, ".codex", "hooks");
+    await mkdir(hooks, { recursive: true });
+    await writeFile(join(hooks, "zaip-pre-tool-use.mjs"), CODEX_PRE_TOOL_HOOK);
+    await writeFile(join(hooks, "zaip-hook-activation.mjs"), CODEX_HOOK_ACTIVATION);
+    await writeFile(join(hooks, "zaip-pre-tool-support.mjs"), CODEX_PRE_TOOL_SUPPORT_HOOK);
+    await writeFile(join(hooks, "zaip-native-tool-authority.mjs"), CODEX_NATIVE_TOOL_AUTHORITY_HOOK);
+    const config = join(root, ".agents", "config", "project.yaml");
+    await mkdir(join(root, ".agents", "config"), { recursive: true });
+    const run = () => spawnSync(process.execPath, [join(hooks, "zaip-pre-tool-use.mjs")], {
+        cwd: root,
+        encoding: "utf8",
+        input: JSON.stringify({
+            cwd: root,
+            tool_name: "apply_patch",
+            tool_input: { command: "*** Begin Patch\n*** Add File: src/code.ts\n+ok\n*** End Patch" },
+        }),
+    });
+    await writeFile(config, "schema_version: 1\nzaip:\n  enabled: false\n");
+    expect(run().stdout).toBe("");
+    await writeFile(config, 'schema_version: 1\nzaip:\n  enabled: "false"\n');
+    expect(JSON.parse(run().stdout).hookSpecificOutput.permissionDecision).toBe("deny");
+    await writeFile(config, "schema_version: 1\nzaip:\n  enabled: false\n");
+    await rm(join(hooks, "zaip-hook-activation.mjs"));
+    for (const state of ["missing", "legacy"]) {
+        if (state === "legacy")
+            await writeFile(join(hooks, "zaip-hook-activation.mjs"), "export function recordActivation() {}\n");
+        const result = run();
+        expect(result.status).toBe(0);
+        expect(result.stderr).toBe("");
+        expect(JSON.parse(result.stdout).hookSpecificOutput.permissionDecision).toBe("deny");
+    }
+});
 it("permits only literal reviewed release commands with controlled external paths", async () => {
     const root = await mkdtemp(join(tmpdir(), "zaip-cli-release-hook-"));
     roots.push(root);

package/dist/services/codex-pre-tool-hook-template.test.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"codex-pre-tool-hook-template.test.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF,MAAM,KAAK,GAAa,EAAE,CAAC;AAC3B,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;IAC7F,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACrE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACxE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,SAAS,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC/C,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAC1D,2BAA2B,CAC5B,CAAC;IACF,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gCAAgC,CAAC,EAC/D,gCAAgC,CACjC,CAAC;IACF,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,+BAA+B,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAClG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,0BAA0B,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC7F,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAA0B,CAAC,EAC3D,wBAAwB,CACzB,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CACnB,OAAO,EAAE,EACT,QAAQ,EACR,oBAAoB,EACpB,WAAW,EACX,6BAA6B,CAC9B,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CACjB,OAAO,EAAE,EACT,QAAQ,EACR,cAAc,EACd,WAAW,EACX,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,IAAI,CACrB,OAAO,EAAE,EACT,QAAQ,EACR,cAAc,EACd,WAAW,EACX,eAAe,EACf,qBAAqB,CACtB,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;IACxC,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,kDAAkD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,gDAAgD,CAAC;IACrJ,MAAM,OAAO,GAAG,sDAAsD,IAAI,iBAAiB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,2DAA2D,CAAC;IACxL,MAAM,MAAM,GAAG,qDAAqD,IAAI,kBAAkB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3M,MAAM,MAAM,GAAG,yCAAyC,IAAI,+BAA+B,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,UAAU,CAAC,0EAA0E,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,wCAAwC,CAAC;IAC7X,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACtC,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;KACrF,CAAC,CAAC;IACL,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACrD,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YACzB,SAAS,EAAE,cAAc;YACzB,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;SAC5B,CAAC;KACH,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI;QACpB,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC;QACrC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC;QAC3C,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;QACtD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,OAAO,CACb,CAAC,CAAC,QAAQ,CAAC,EACX,CAAC,CACC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,6BAA6B,CAAC,CAC5F,CACF;QACD,OAAO,CAAC,OAAO,CACb,CAAC,CAAC,QAAQ,CAAC,EACX,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,OAAO,EAAE,6BAA6B,CAAC,CAAC,CAC3F;QACD,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,uBAAuB,CAAC;QACpD,GAAG,MAAM,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE;QACnC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,QAAQ,eAAe,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACxF,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CACZ,CAAC,CAAC,KAAK,CAAC,EACR,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAChF;QACD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7D,GAAG,MAAM,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE;QACvC,GAAG,MAAM,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE;QACxC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE;QAC3B,wCAAwC,CAAC,CAAC,OAAO,CAAC,EAAE;QACpD,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,uBAAuB,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;KACzE,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;IACrG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACxE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,SAAS,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC/C,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAC1D,2BAA2B,CAC5B,CAAC;IACF,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gCAAgC,CAAC,EAC/D,gCAAgC,CACjC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,UAAkC,EAAE,EAAE,CACpD,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACtC,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;KAC5E,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI;QAChB,+DAA+D;QAC/D,iEAAiE;QACjE,4DAA4D;QAC5D,2DAA2D;QAC3D,mDAAmD;QACnD,gDAAgD;QAChD,kDAAkD;QAClD,gDAAgD;QAChD,oDAAoD;QACpD,+CAA+C;QAC/C,sEAAsE;QACtE,uDAAuD;QACvD,+BAA+B;QAC/B,oCAAoC;QACpC,0EAA0E;QAC1E,kGAAkG;QAClG,yFAAyF;QACzF,qFAAqF;QACrF,sBAAsB;QACtB,8BAA8B;QAC9B,0BAA0B;QAC1B,4BAA4B;QAC5B,gCAAgC;QAChC,kCAAkC;QAClC,6BAA6B;QAC7B,+BAA+B;QAC/B,+BAA+B;QAC/B,iDAAiD;QACjD,yCAAyC;QACzC,2CAA2C;QAC3C,kCAAkC;QAClC,+BAA+B;QAC/B,yCAAyC;QACzC,gCAAgC;QAChC,oCAAoC;QACpC,oCAAoC;QACpC,4CAA4C;QAC5C,sDAAsD;QACtD,qCAAqC;QACrC,gDAAgD;QAChD,oDAAoD;QACpD,mCAAmC;QACnC,qCAAqC;QACrC,4DAA4D;QAC5D,kEAAkE;QAClE,oCAAoC;QACpC,+EAA+E;QAC/E,qBAAqB;QACrB,4BAA4B;QAC5B,sBAAsB;QACtB,sBAAsB;KACvB,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,4BAA4B;QAC5B,8BAA8B;QAC9B,iCAAiC;QACjC,0DAA0D;KAC3D,EAAE,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,OAAO,GACX,4OAA4O,CAAC;IAC/O,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI;QACjB,kCAAkC;QAClC,gCAAgC;QAChC,yCAAyC;KAC1C,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,uCAAuC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,8BAA8B;QAC9B,oDAAoD;QACpD,6DAA6D;QAC7D,OAAO,CAAC,OAAO,CAAC,uCAAuC,EAAE,QAAQ,CAAC;QAClE,OAAO,CAAC,OAAO,CACb,uCAAuC,EACvC,wCAAwC,CACzC;QACD,GAAG,OAAO,2BAA2B;KACtC,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC;QAC3B,GAAG,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG;KAC5E,CAAC,CAAC;IACH,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI;QAC1B;YACE,eAAe,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU;YACjE,kCAAkC;SACnC;QACD;YACE,qBAAqB,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU;YACvE,kCAAkC;SACnC;QACD;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU,EAAE,CAAC,GAAG;YAClG,kCAAkC;SACnC;QACD,CAAC,qCAAqC,EAAE,kCAAkC,CAAC;QAC3E;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,GAAG;YACtE,kCAAkC;SACnC;QACD;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG;YAC1E,kCAAkC;SACnC;QACD,CAAC,+BAA+B,GAAG,MAAM,EAAE,uCAAuC,CAAC;KAC3E,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzF,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,GAAG,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;IAChG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC3E,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,2BAA2B,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACvF,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,gCAAgC,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC,EAAE;QAClE,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,IAAI;QACjB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE;QAC7F,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,GAAG,EAAE,IAAI;YACT,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,gBAAgB;YAC7B,SAAS,EAAE,cAAc;YACzB,UAAU,EAAE,EAAE,GAAG,EAAE;SACpB,CAAC;KACH,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,MAAM,CACnB,2GAA2G,CAC5G,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC;IAC5D,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI;QAChB,qBAAqB;QACrB,qBAAqB;QACrB,iDAAiD;QACjD,8DAA8D;QAC9D,0BAA0B;QAC1B,2BAA2B;QAC3B,4BAA4B;QAC5B,qCAAqC;QACrC,iCAAiC;QACjC,yFAAyF;QACzF,8BAA8B;QAC9B,sFAAsF;QACtF,sDAAsD;QACtD,6BAA6B;QAC7B,+BAA+B;QAC/B,uCAAuC;QACvC,sBAAsB;QACtB,wEAAwE;QACxE,kCAAkC;KACnC,EAAE,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC;AACH,CAAC,CAAC,CAAC"}
1	+ {"version":3,"file":"codex-pre-tool-hook-template.test.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF,MAAM,KAAK,GAAa,EAAE,CAAC;AAC3B,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;IACvG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC3E,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,2BAA2B,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACvF,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,gCAAgC,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC,EAAE;QAClE,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;KACrF,CAAC,CAAC;IACL,KAAK,MAAM,GAAG,IAAI;QAChB,gDAAgD;QAChD,+DAA+D;KAChE,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,+CAA+C;QAC/C,+DAA+D;QAC/D,kEAAkE;QAClE,0DAA0D;QAC1D,iFAAiF;QACjF,mDAAmD;QACnD,0DAA0D;QAC1D,0DAA0D;KAC3D,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACnF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC3E,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChF,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,2BAA2B,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACvF,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,gCAAgC,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC/D,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,GAAG,EAAE,CACf,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC,EAAE;QAClE,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,GAAG,EAAE,IAAI;YACT,SAAS,EAAE,aAAa;YACxB,UAAU,EAAE,EAAE,OAAO,EAAE,gEAAgE,EAAE;SAC1F,CAAC;KACH,CAAC,CAAC;IACL,MAAM,SAAS,CAAC,MAAM,EAAE,8CAA8C,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,SAAS,CAAC,MAAM,EAAE,gDAAgD,CAAC,CAAC;IAC1E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpF,MAAM,SAAS,CAAC,MAAM,EAAE,8CAA8C,CAAC,CAAC;IACxE,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1C,IAAI,KAAK,KAAK,QAAQ;YACpB,MAAM,SAAS,CACb,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,EACvC,yCAAyC,CAC1C,CAAC;QACJ,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;IAC7F,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACrE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACxE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,SAAS,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC/C,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAC1D,2BAA2B,CAC5B,CAAC;IACF,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gCAAgC,CAAC,EAC/D,gCAAgC,CACjC,CAAC;IACF,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,+BAA+B,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAClG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,0BAA0B,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC7F,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAA0B,CAAC,EAC3D,wBAAwB,CACzB,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CACnB,OAAO,EAAE,EACT,QAAQ,EACR,oBAAoB,EACpB,WAAW,EACX,6BAA6B,CAC9B,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CACjB,OAAO,EAAE,EACT,QAAQ,EACR,cAAc,EACd,WAAW,EACX,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,IAAI,CACrB,OAAO,EAAE,EACT,QAAQ,EACR,cAAc,EACd,WAAW,EACX,eAAe,EACf,qBAAqB,CACtB,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;IACxC,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,kDAAkD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,gDAAgD,CAAC;IACrJ,MAAM,OAAO,GAAG,sDAAsD,IAAI,iBAAiB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,2DAA2D,CAAC;IACxL,MAAM,MAAM,GAAG,qDAAqD,IAAI,kBAAkB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3M,MAAM,MAAM,GAAG,yCAAyC,IAAI,+BAA+B,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,UAAU,CAAC,0EAA0E,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,wCAAwC,CAAC;IAC7X,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACtC,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;KACrF,CAAC,CAAC;IACL,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACrD,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YACzB,SAAS,EAAE,cAAc;YACzB,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;SAC5B,CAAC;KACH,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI;QACpB,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC;QACrC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC;QAC3C,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;QACtD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,OAAO,CACb,CAAC,CAAC,QAAQ,CAAC,EACX,CAAC,CACC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,6BAA6B,CAAC,CAC5F,CACF;QACD,OAAO,CAAC,OAAO,CACb,CAAC,CAAC,QAAQ,CAAC,EACX,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,OAAO,EAAE,6BAA6B,CAAC,CAAC,CAC3F;QACD,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,uBAAuB,CAAC;QACpD,GAAG,MAAM,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE;QACnC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,QAAQ,eAAe,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACxF,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CACZ,CAAC,CAAC,KAAK,CAAC,EACR,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAChF;QACD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7D,GAAG,MAAM,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE;QACvC,GAAG,MAAM,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE;QACxC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE;QAC3B,wCAAwC,CAAC,CAAC,OAAO,CAAC,EAAE;QACpD,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,uBAAuB,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;KACzE,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;IACrG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACxE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,SAAS,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC/C,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAC1D,2BAA2B,CAC5B,CAAC;IACF,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gCAAgC,CAAC,EAC/D,gCAAgC,CACjC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,UAAkC,EAAE,EAAE,CACpD,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACtC,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;KAC5E,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI;QAChB,+DAA+D;QAC/D,iEAAiE;QACjE,4DAA4D;QAC5D,2DAA2D;QAC3D,mDAAmD;QACnD,gDAAgD;QAChD,kDAAkD;QAClD,gDAAgD;QAChD,oDAAoD;QACpD,+CAA+C;QAC/C,sEAAsE;QACtE,uDAAuD;QACvD,+BAA+B;QAC/B,oCAAoC;QACpC,0EAA0E;QAC1E,kGAAkG;QAClG,yFAAyF;QACzF,qFAAqF;QACrF,sBAAsB;QACtB,8BAA8B;QAC9B,0BAA0B;QAC1B,4BAA4B;QAC5B,gCAAgC;QAChC,kCAAkC;QAClC,6BAA6B;QAC7B,+BAA+B;QAC/B,+BAA+B;QAC/B,iDAAiD;QACjD,yCAAyC;QACzC,2CAA2C;QAC3C,kCAAkC;QAClC,+BAA+B;QAC/B,yCAAyC;QACzC,gCAAgC;QAChC,oCAAoC;QACpC,oCAAoC;QACpC,4CAA4C;QAC5C,sDAAsD;QACtD,qCAAqC;QACrC,gDAAgD;QAChD,oDAAoD;QACpD,mCAAmC;QACnC,qCAAqC;QACrC,4DAA4D;QAC5D,kEAAkE;QAClE,oCAAoC;QACpC,+EAA+E;QAC/E,qBAAqB;QACrB,4BAA4B;QAC5B,sBAAsB;QACtB,sBAAsB;KACvB,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,4BAA4B;QAC5B,8BAA8B;QAC9B,iCAAiC;QACjC,0DAA0D;KAC3D,EAAE,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,OAAO,GACX,4OAA4O,CAAC;IAC/O,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI;QACjB,kCAAkC;QAClC,gCAAgC;QAChC,yCAAyC;KAC1C,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,uCAAuC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,8BAA8B;QAC9B,oDAAoD;QACpD,6DAA6D;QAC7D,OAAO,CAAC,OAAO,CAAC,uCAAuC,EAAE,QAAQ,CAAC;QAClE,OAAO,CAAC,OAAO,CACb,uCAAuC,EACvC,wCAAwC,CACzC;QACD,GAAG,OAAO,2BAA2B;KACtC,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC;QAC3B,GAAG,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG;KAC5E,CAAC,CAAC;IACH,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI;QAC1B;YACE,eAAe,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU;YACjE,kCAAkC;SACnC;QACD;YACE,qBAAqB,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU;YACvE,kCAAkC;SACnC;QACD;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU,EAAE,CAAC,GAAG;YAClG,kCAAkC;SACnC;QACD,CAAC,qCAAqC,EAAE,kCAAkC,CAAC;QAC3E;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,GAAG;YACtE,kCAAkC;SACnC;QACD;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG;YAC1E,kCAAkC;SACnC;QACD,CAAC,+BAA+B,GAAG,MAAM,EAAE,uCAAuC,CAAC;KAC3E,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzF,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,GAAG,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;IAChG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC3E,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,2BAA2B,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACvF,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,gCAAgC,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC,EAAE;QAClE,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,IAAI;QACjB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE;QAC7F,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,GAAG,EAAE,IAAI;YACT,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,gBAAgB;YAC7B,SAAS,EAAE,cAAc;YACzB,UAAU,EAAE,EAAE,GAAG,EAAE;SACpB,CAAC;KACH,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,MAAM,CACnB,2GAA2G,CAC5G,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC;IAC5D,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI;QAChB,qBAAqB;QACrB,qBAAqB;QACrB,iDAAiD;QACjD,8DAA8D;QAC9D,0BAA0B;QAC1B,2BAA2B;QAC3B,4BAA4B;QAC5B,qCAAqC;QACrC,iCAAiC;QACjC,yFAAyF;QACzF,8BAA8B;QAC9B,sFAAsF;QACtF,sDAAsD;QACtD,6BAA6B;QAC7B,+BAA+B;QAC/B,uCAAuC;QACvC,sBAAsB;QACtB,wEAAwE;QACxE,kCAAkC;KACnC,EAAE,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/services/codex-pre-tool-support-template.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"codex-pre-tool-support-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,2BAA2B,~~QA4YvC~~,CAAC"}
1	+ {"version":3,"file":"codex-pre-tool-support-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,2BAA2B,QA6ZvC,CAAC"}

package/dist/services/codex-pre-tool-support-template.js CHANGED Viewed

@@ -294,7 +294,7 @@ export async function reviewedReleasePaths(command, cwd, repositoryRoot, credent
 }
 /** Narrow read capability, never a general external-path or executable allowlist. */
-export async function reviewedContextReadPaths(command, credentialPattern) {
+export async function reviewedContextReadPaths(command, credentialPattern, repositoryRoot) {
   const tokens = tokenizeLiteralCommand(command);
   if (!tokens || tokens.length < 2 || credentialPattern.test(command)) return [];
   const executable = tokens[0].toLowerCase();
@@ -305,10 +305,27 @@ export async function reviewedContextReadPaths(command, credentialPattern) {
   // -f means a pattern file in ripgrep, not fixed strings: do not permit it.
   if (tokens.slice(1).some(token => token.startsWith("-") && (!flags.has(token.toLowerCase()) || token === "-f"))) return [];
   const roots = ["memories", "skills", "plugins/cache"].map(part => resolve(homedir(), ".codex", part));
+  // Project-owned policy records explicitly authorized files, never executable
+  // commands or a blanket permission for the user's home/attachments directory.
+  let authorizedFiles = [];
+  if (repositoryRoot) {
+    const policyPath = resolve(repositoryRoot, ".agents/config/external-read-policy.json");
+    try {
+      const info = await lstat(policyPath);
+      if (!info.isFile() || info.isSymbolicLink() || info.size > 65536 ||
+          pathIdentity(await realpath(policyPath)) !== pathIdentity(policyPath)) return [];
+      const policy = JSON.parse(await readFile(policyPath, "utf8"));
+      if (policy?.schema_version !== 1 || !Array.isArray(policy.files) || policy.files.length > 128 ||
+          Object.keys(policy).sort().join(",") !== "files,schema_version" ||
+          policy.files.some(path => typeof path !== "string" || !isAbsolute(path))) return [];
+      authorizedFiles = policy.files.map(pathIdentity);
+    } catch (error) { if (error.code !== "ENOENT") return []; }
+  }
   const paths = tokens.slice(1).filter(value => isAbsolute(value));
   if (!paths.length) return [];
   for (const path of paths) {
-    if (!roots.some(root => inside(path, root)) || !/\.(?:md|txt|json|yaml|yml|toml)$/i.test(path)) return [];
+    if ((!roots.some(root => inside(path, root)) && !authorizedFiles.includes(pathIdentity(path))) ||
+        !/\.(?:md|txt|json|yaml|yml|toml)$/i.test(path)) return [];
     try {
       const info = await lstat(path);
       if (!info.isFile() || info.isSymbolicLink() || pathIdentity(await realpath(path)) !== pathIdentity(path)) return [];

package/dist/services/codex-pre-tool-support-template.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"codex-pre-tool-support-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4YpD,CAAC"}
1	+ {"version":3,"file":"codex-pre-tool-support-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-support-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6ZpD,CAAC"}

package/dist/services/codex-subagent-hook-template.d.ts CHANGED Viewed

@@ -1,2 +1,2 @@
-export declare const CODEX_SUBAGENT_LIFECYCLE_HOOK = "import { existsSync, realpathSync } from \"node:fs\";\nimport { promises as fs } from \"node:fs\";\nimport { execFileSync, spawn } from \"node:child_process\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst hookPath = fileURLToPath(import.meta.url);\nconst activation = await import(\"./zaip-hook-activation.mjs\").catch(() => null);\nconst installedRoot = resolve(dirname(hookPath), \"..\", \"..\");\nlet repositoryRoot = installedRoot;\nlet diagnosticPath = resolve(\n  repositoryRoot,\n  \".local\",\n  \"hooks\",\n  \"subagent-lifecycle.ndjson\",\n);\nlet pendingRoot = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-pending\");\n\nfunction inside(path, root) {\n  const scoped = relative(root, resolve(path));\n  return scoped === \"\" || (!scoped.startsWith(\"..\") && !isAbsolute(scoped));\n}\nfunction selectRoot(cwd) {\n  if (typeof cwd !== \"string\") return false;\n  try {\n    if (realpathSync(cwd).toLowerCase() !== resolve(cwd).toLowerCase()) return false;\n    let nestedGit = false;\n    if (inside(cwd, installedRoot)) {\n      for (let cursor = resolve(cwd); cursor.toLowerCase() !== installedRoot.toLowerCase(); cursor = dirname(cursor)) {\n        if (existsSync(resolve(cursor, \".git\"))) { nestedGit = true; break; }\n      }\n    }\n    if (!inside(cwd, installedRoot) || nestedGit) {\n      const git = (root, ...args) => execFileSync(\"git\", [\"-C\", root, ...args], {\n        encoding: \"utf8\", windowsHide: true, timeout: 5000,\n      }).trim();\n      if (realpathSync(git(installedRoot, \"rev-parse\", \"--show-toplevel\")).toLowerCase() !== installedRoot.toLowerCase()) return false;\n      const registered = git(installedRoot, \"worktree\", \"list\", \"--porcelain\", \"-z\")\n        .split(\"\\0\").filter(line => line.startsWith(\"worktree \")).map(line => resolve(line.slice(9)).toLowerCase());\n      const candidate = realpathSync(git(cwd, \"rev-parse\", \"--show-toplevel\"));\n      if (!registered.includes(candidate.toLowerCase()) || !inside(cwd, candidate)) return false;\n      const common = root => realpathSync(git(root, \"rev-parse\", \"--path-format=absolute\", \"--git-common-dir\")).toLowerCase();\n      if (common(installedRoot) !== common(candidate)) return false;\n      repositoryRoot = candidate;\n    }\n    diagnosticPath = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-lifecycle.ndjson\");\n    pendingRoot = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-pending\");\n    return true;\n  } catch { return false; }\n}\n\nif (process.argv[2] === \"--capture-runner\") {\n  if (!selectRoot(process.cwd())) process.exit(0);\n  await runCaptureRunner(process.argv[3]);\n  process.exit(0);\n}\nif (process.argv[2] === \"--replay-pending\") {\n  if (!selectRoot(process.cwd())) process.exit(0);\n  const files = await fs.readdir(pendingRoot).catch(() => []);\n  let replayed = 0;\n  for (const file of files.filter((name) => /^[a-f0-9]{64}\\.json$/.test(name)).slice(0, 256)) {\n    const path = resolve(pendingRoot, file);\n    const receipt = await fs.readFile(path, \"utf8\").then(JSON.parse).catch(() => null);\n    if (receipt?.state === \"pending\" && Array.isArray(receipt.capture_arguments)) { await runCaptureRunner(path, true); if (++replayed >= 3) break; }\n  }\n  process.exit(0);\n}\n\nlet raw = \"\";\nfor await (const chunk of process.stdin) raw += chunk;\n\ntry {\n  const event = JSON.parse(raw);\n  const cwd = text(event.cwd);\n  if (cwd === null || !selectRoot(cwd)) process.exit(0);\n  const eventName = text(event.hook_event_name);\n  activation?.recordActivation(repositoryRoot, event);\n  const lifecycleEvent =\n    eventName === \"SubagentStart\" ? \"start\" : eventName === \"SubagentStop\" ? \"stop\" : null;\n  const session = text(event.session_id);\n  const turn = text(event.turn_id);\n  const agentId = text(event.agent_id);\n  const agentType = text(event.agent_type);\n  const model = text(event.model);\n  const reasoningEffort = reasoningEffortValue(\n    event.model_reasoning_effort ?? event.reasoning_effort,\n  );\n  const parentAgentId = text(event.parent_agent_id ?? event.parent_id);\n  const parentRunId = text(event.parent_run_id ?? event.root_run_id);\n  const status = terminalStatus(event.status);\n  const required = [lifecycleEvent, session, turn, agentId, agentType];\n  if (lifecycleEvent === null) {\n    await diagnostic(\"ignored_unrecognized_event\", { eventName });\n    process.exit(0);\n  }\n  const terminalFallback =\n    lifecycleEvent === \"stop\" &&\n    status !== null &&\n    agentId !== null &&\n    parentAgentId !== null &&\n    parentRunId !== null &&\n    (session === null || turn === null);\n  if (\n    (!terminalFallback && required.some((value) => value === null)) ||\n    (lifecycleEvent === \"start\" && model === null) ||\n    (lifecycleEvent === \"stop\" && status === null)\n  ) {\n    await fs.mkdir(pendingRoot, { recursive: true });\n    const identity = JSON.stringify({ eventName, session, turn, agentId, agentType, parentAgentId, parentRunId });\n    const pending = resolve(pendingRoot, createHash(\"sha256\").update(identity).digest(\"hex\") + \".json\");\n    await atomicSave(pending, { schema_version: 1, state: \"pending\", last_error: \"incomplete_host_metadata\", identity: JSON.parse(identity), recovery: \"Capture observed native metadata manually; never infer completed status.\" });\n    await diagnostic(\"ignored_incomplete_event\", {\n      eventName,\n      session,\n      turn,\n      agentId,\n      agentType,\n      missing_model: lifecycleEvent === \"start\" && model === null,\n    });\n    process.exit(0);\n  }\n  const candidates = [\n    resolve(repositoryRoot, \".agents\", \"runtime\", \"bin\", \"zaip.mjs\"),\n    resolve(repositoryRoot, \"packages\", \"cli\", \"dist\", \"index.js\"),\n  ];\n  const cli = candidates.find(existsSync);\n  if (cli === undefined) {\n    await diagnostic(\"cli_not_found\", { eventName, candidates });\n    process.exit(0);\n  }\n  const captureArguments = terminalFallback\n    ? [\n        \"subagent\",\n        \"capture-terminal\",\n        \"--parent-agent-id\",\n        parentAgentId,\n        \"--parent-run-id\",\n        parentRunId,\n        \"--agent-id\",\n        agentId,\n        \"--agent-type\",\n        agentType,\n        \"--status\",\n        status,\n        \"--json\",\n      ]\n    : [\n    \"subagent\",\n    \"capture\",\n    \"--event\",\n    lifecycleEvent,\n    \"--session\",\n    session,\n    \"--turn\",\n    turn,\n    \"--agent-id\",\n    agentId,\n    \"--agent-type\",\n    agentType,\n    ...(model === null ? [] : [\"--model\", model]),\n    ...(reasoningEffort === null ? [] : [\"--reasoning-effort\", reasoningEffort]),\n    ...(parentAgentId === null ? [] : [\"--parent-agent-id\", parentAgentId]),\n    ...(lifecycleEvent !== \"stop\" || status === null ? [] : [\"--status\", status]),\n    \"--json\",\n  ];\n  const pending = await persistPending(cli, captureArguments);\n  const receipt = await fs.readFile(pending, \"utf8\").then(JSON.parse);\n  if (receipt.state !== \"acknowledged\") {\n  const runner = spawn(\n    process.execPath,\n    [hookPath, \"--capture-runner\", pending],\n    {\n      cwd: repositoryRoot,\n      detached: true,\n      windowsHide: true,\n      stdio: \"ignore\",\n    },\n  );\n  runner.once(\"error\", (error) =>\n    diagnostic(\"runner_spawn_failed\", { eventName, error: error.message }),\n  );\n  runner.unref();\n  }\n  if (lifecycleEvent === \"start\") {\n    process.stdout.write(JSON.stringify({\n      hookSpecificOutput: {\n        hookEventName: \"SubagentStart\",\n        additionalContext:\n          \"ZAIP Codex delegation policy: a Sub-Run is only a native collaboration subagent. Do not use create_thread or fork_thread as a Sub-Run, fallback, retry, or delegation proof; those create independent chats and require an explicit user request. If native delegation is unavailable, report the limitation rather than create an independent chat. A catalog name, task_name, title, or prompt is not native ancestry. Before retrying the same bounded dispatch, await or reuse its pending native child; capture only ancestry observed from native host spawn/terminal results or SubagentStart/SubagentStop events, and work only as a cataloged zaip-agent-NOME identity. Delegation is recursive; do not use default, worker, explorer, or ad-hoc agent types.\",\n      },\n    }));\n  } else {\n    // Codex expects one JSON object on stdout for SubagentStop as well.\n    process.stdout.write(JSON.stringify({}));\n  }\n} catch (error) {\n  await diagnostic(\"hook_exception\", {\n    error: error instanceof Error ? error.message : String(error),\n  });\n}\n\nasync function atomicSave(path, value) {\n  const temporary = path + \".tmp-\" + randomUUID();\n  await fs.writeFile(temporary, JSON.stringify(value), { flag: \"wx\", mode: 0o600 });\n  for (let retry = 0; ; retry++) {\n    try { await fs.rename(temporary, path); break; }\n    catch (error) { if (![\"EPERM\", \"EACCES\", \"EBUSY\"].includes(error.code) || retry >= 5) throw error; await new Promise(done => setTimeout(done, 20 * (retry + 1))); }\n  }\n}\n\nasync function runCaptureRunner(receiptPath, replay = false) {\n  if (typeof receiptPath !== \"string\" || dirname(resolve(receiptPath)) !== pendingRoot) return;\n  const lockPath = receiptPath + \".lock\";\n  let lease;\n  try {\n    lease = await fs.open(lockPath, \"wx\");\n    await lease.writeFile(JSON.stringify({ pid: process.pid }));\n  } catch (error) {\n    if (error.code !== \"EEXIST\") return;\n    const owner = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n    if (!Number.isSafeInteger(owner?.pid) || owner.pid <= 0) return;\n    try { process.kill(owner.pid, 0); return; } catch (failure) { if (failure.code !== \"ESRCH\") return; }\n    // Serialize stale lock recovery so two recovering workers cannot remove a new lease.\n    let recovery;\n    try { recovery = await fs.open(lockPath + \".recover\", \"wx\"); } catch { return; }\n    try {\n      const current = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n      if (current?.pid !== owner.pid) return;\n      await fs.unlink(lockPath);\n      lease = await fs.open(lockPath, \"wx\");\n      await lease.writeFile(JSON.stringify({ pid: process.pid }));\n    } finally { await recovery.close(); await fs.unlink(lockPath + \".recover\").catch(() => {}); }\n    if (!lease) return;\n  }\n  try {\n    const receipt = await fs.readFile(receiptPath, \"utf8\").then(JSON.parse);\n    if (receipt.schema_version !== 1 || receipt.state === \"acknowledged\" || (!replay && receipt.attempts >= 3)) return;\n    const cli = receipt.cli, args = receipt.capture_arguments;\n    const allowedCli = [resolve(repositoryRoot, \".agents/runtime/bin/zaip.mjs\"), resolve(repositoryRoot, \"packages/cli/dist/index.js\")];\n    if (!allowedCli.includes(cli) || !Array.isArray(args) || !args.every(x => typeof x === \"string\") || args[0] !== \"subagent\" || ![\"capture\", \"capture-terminal\"].includes(args[1])) return;\n    const digest = createHash(\"sha256\").update(JSON.stringify({ cli, arguments: args })).digest(\"hex\");\n    if (resolve(pendingRoot, digest + \".json\") !== resolve(receiptPath)) return;\n    const value = flag => args[args.indexOf(flag) + 1];\n    const stop = args[1] === \"capture-terminal\" || value(\"--event\") === \"stop\";\n    if (stop && ![\"completed\", \"failed\", \"cancelled\"].includes(value(\"--status\"))) return;\n    for (let retry = 0; retry < 3; retry++) {\n      receipt.attempts = (receipt.attempts ?? 0) + 1;\n      receipt.updated_at = new Date().toISOString();\n      await atomicSave(receiptPath, receipt);\n      const outcome = await capture(cli, args);\n      let result;\n      try { result = JSON.parse(outcome.stdout); } catch { result = null; }\n      const runId = result?.run?.run_id ?? result?.run?.id;\n      const status = result?.status ?? result?.run?.status;\n      if (outcome.code === 0 && result?.captured === true && typeof runId === \"string\" && runId.startsWith(\"RUN-\") && (!stop || status === value(\"--status\"))) {\n        receipt.state = \"acknowledged\";\n        receipt.run_id = runId;\n        receipt.acknowledged_at = new Date().toISOString();\n        delete receipt.last_error;\n        await atomicSave(receiptPath, receipt);\n        return;\n      }\n      receipt.last_error = outcome.error ?? (outcome.code === 0 ? \"capture_not_confirmed\" : \"capture_exit_nonzero\");\n      await atomicSave(receiptPath, receipt);\n      if (retry < 2) await new Promise(done => setTimeout(done, 250 * (retry + 1)));\n    }\n    await persistDiagnostic(\"capture_pending\", { receipt: receiptPath, attempts: receipt.attempts, error: receipt.last_error });\n  } catch (error) {\n    await persistDiagnostic(\"runner_exception\", { error: error instanceof Error ? error.message : String(error) });\n  } finally {\n    await lease?.close();\n    await fs.unlink(lockPath).catch(() => {});\n  }\n}\n\nasync function capture(cli, args) {\n  const child = spawn(process.execPath, [cli, ...args], { cwd: repositoryRoot, windowsHide: true, stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n  let stdout = \"\", overflow = false;\n  child.stdout.on(\"data\", chunk => { stdout += String(chunk); if (stdout.length > 262144) { overflow = true; stdout = \"\"; child.kill(); } });\n  child.stderr.resume();\n  return await new Promise(done => {\n    let settled = false;\n    const finish = result => { if (settled) return; settled = true; clearTimeout(timer); done({ ...result, stdout: overflow ? \"\" : stdout }); };\n    const timer = setTimeout(() => { child.kill(); finish({ error: \"capture_timeout\" }); }, 15000);\n    child.once(\"error\", () => finish({ error: \"capture_spawn_failed\" }));\n    child.once(\"close\", code => finish({ code }));\n  });\n}\n\nasync function persistPending(cli, captureArguments) {\n  const identity = JSON.stringify({ cli, arguments: captureArguments });\n  const digest = createHash(\"sha256\").update(identity).digest(\"hex\");\n  const path = resolve(pendingRoot, digest + \".json\");\n  await fs.mkdir(pendingRoot, { recursive: true });\n  const receipt = { schema_version: 1, state: \"pending\", cli, capture_arguments: captureArguments, attempts: 0, created_at: new Date().toISOString() };\n  // Publish a complete immutable initial receipt without overwriting another worker's acknowledgement.\n  const temporary = path + \".tmp-\" + randomUUID();\n  await fs.writeFile(temporary, JSON.stringify(receipt), { flag: \"wx\", mode: 0o600 });\n  try { await fs.link(temporary, path); } catch (error) { if (error.code !== \"EEXIST\") throw error; }\n  finally { await fs.unlink(temporary); }\n  return path;\n}\n\nasync function persistDiagnostic(code, detail) {\n  const line = `${JSON.stringify({\n    source: \"zaip-subagent-lifecycle-runner\",\n    code,\n    occurred_at: new Date().toISOString(),\n    detail,\n  })}\\n`;\n  await fs.mkdir(dirname(diagnosticPath), { recursive: true });\n  const size = await fs.stat(diagnosticPath).then((entry) => entry.size).catch(() => 0);\n  if (size + Buffer.byteLength(line) > 262_144) {\n    await fs.writeFile(diagnosticPath, \"\", \"utf8\");\n  }\n  await fs.appendFile(diagnosticPath, line, \"utf8\");\n}\n\nasync function diagnostic(code, detail) {\n  await persistDiagnostic(code, detail);\n  process.stderr.write(\n    `${JSON.stringify({ source: \"zaip-subagent-lifecycle\", code, detail })}\\n`,\n  );\n}\n\nfunction text(value) {\n  if (typeof value !== \"string\") return null;\n  const normalized = value.trim();\n  return normalized.length > 0 && normalized.length <= 200 ? normalized : null;\n}\n\nfunction reasoningEffortValue(value) {\n  const normalized = text(value);\n  return [\"low\", \"medium\", \"high\", \"xhigh\"].includes(normalized) ? normalized : null;\n}\n\nfunction terminalStatus(value) {\n  const normalized = text(value);\n  return [\"completed\", \"failed\", \"cancelled\"].includes(normalized) ? normalized : null;\n}\n";
+export declare const CODEX_SUBAGENT_LIFECYCLE_HOOK = "import { existsSync, realpathSync } from \"node:fs\";\nimport { promises as fs } from \"node:fs\";\nimport { execFileSync, spawn } from \"node:child_process\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst hookPath = fileURLToPath(import.meta.url);\nconst activation = await import(\"./zaip-hook-activation.mjs\").catch(() => null);\nconst installedRoot = resolve(dirname(hookPath), \"..\", \"..\");\nlet repositoryRoot = installedRoot;\nlet diagnosticPath = resolve(\n  repositoryRoot,\n  \".local\",\n  \"hooks\",\n  \"subagent-lifecycle.ndjson\",\n);\nlet pendingRoot = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-pending\");\n\nfunction inside(path, root) {\n  const scoped = relative(root, resolve(path));\n  return scoped === \"\" || (!scoped.startsWith(\"..\") && !isAbsolute(scoped));\n}\nfunction selectRoot(cwd) {\n  if (typeof cwd !== \"string\") return false;\n  try {\n    if (realpathSync(cwd).toLowerCase() !== resolve(cwd).toLowerCase()) return false;\n    let nestedGit = false;\n    if (inside(cwd, installedRoot)) {\n      for (let cursor = resolve(cwd); cursor.toLowerCase() !== installedRoot.toLowerCase(); cursor = dirname(cursor)) {\n        if (existsSync(resolve(cursor, \".git\"))) { nestedGit = true; break; }\n      }\n    }\n    if (!inside(cwd, installedRoot) || nestedGit) {\n      const git = (root, ...args) => execFileSync(\"git\", [\"-C\", root, ...args], {\n        encoding: \"utf8\", windowsHide: true, timeout: 5000,\n      }).trim();\n      if (realpathSync(git(installedRoot, \"rev-parse\", \"--show-toplevel\")).toLowerCase() !== installedRoot.toLowerCase()) return false;\n      const registered = git(installedRoot, \"worktree\", \"list\", \"--porcelain\", \"-z\")\n        .split(\"\\0\").filter(line => line.startsWith(\"worktree \")).map(line => resolve(line.slice(9)).toLowerCase());\n      const candidate = realpathSync(git(cwd, \"rev-parse\", \"--show-toplevel\"));\n      if (!registered.includes(candidate.toLowerCase()) || !inside(cwd, candidate)) return false;\n      const common = root => realpathSync(git(root, \"rev-parse\", \"--path-format=absolute\", \"--git-common-dir\")).toLowerCase();\n      if (common(installedRoot) !== common(candidate)) return false;\n      repositoryRoot = candidate;\n    }\n    diagnosticPath = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-lifecycle.ndjson\");\n    pendingRoot = resolve(repositoryRoot, \".local\", \"hooks\", \"subagent-pending\");\n    return true;\n  } catch { return false; }\n}\n\nif (process.argv[2] === \"--capture-runner\") {\n  if (!selectRoot(process.cwd())) process.exit(0);\n  await runCaptureRunner(process.argv[3]);\n  process.exit(0);\n}\nif (process.argv[2] === \"--replay-pending\") {\n  if (!selectRoot(process.cwd())) process.exit(0);\n  const files = (await fs.readdir(pendingRoot).catch(() => []))\n    .filter((name) => /^[a-f0-9]{64}\\.json$/.test(name)).sort();\n  const cursorPath = resolve(pendingRoot, \".replay-cursor\");\n  const cursor = await fs.readFile(cursorPath, \"utf8\").then(JSON.parse).catch(() => null);\n  const start = (files.indexOf(cursor?.last) + 1) % (files.length || 1);\n  const selected = [...files.slice(start), ...files.slice(0, start)].slice(0, 256);\n  let attempted = 0, deferred = 0, pending = 0;\n  let lastAttempted = null;\n  for (const file of selected) {\n    const path = resolve(pendingRoot, file);\n    const receipt = await fs.readFile(path, \"utf8\").then(JSON.parse).catch(() => null);\n    if (receipt?.state !== \"pending\" || !Array.isArray(receipt.capture_arguments)) continue;\n    if (attempted < 3) {\n      attempted++; lastAttempted = file;\n      if (await replayPendingReceipt(path) === \"deferred\") deferred++;\n    }\n    if ((await fs.readFile(path, \"utf8\").then(JSON.parse).catch(() => null))?.state === \"pending\") pending++;\n  }\n  if (selected.length) await atomicSave(cursorPath, { last: lastAttempted ?? selected.at(-1) });\n  process.stdout.write(JSON.stringify({ attempted, deferred, pending, uninspected: files.length - selected.length }));\n  process.exit(0);\n}\n\nlet raw = \"\";\nfor await (const chunk of process.stdin) raw += chunk;\n\ntry {\n  const event = JSON.parse(raw);\n  const cwd = text(event.cwd);\n  if (cwd === null || !selectRoot(cwd)) process.exit(0);\n  const eventName = text(event.hook_event_name);\n  activation?.recordActivation(repositoryRoot, event);\n  const lifecycleEvent =\n    eventName === \"SubagentStart\" ? \"start\" : eventName === \"SubagentStop\" ? \"stop\" : null;\n  const session = text(event.session_id);\n  const turn = text(event.turn_id);\n  const agentId = text(event.agent_id);\n  const agentType = text(event.agent_type);\n  const model = text(event.model);\n  const reasoningEffort = reasoningEffortValue(\n    event.model_reasoning_effort ?? event.reasoning_effort,\n  );\n  const parentAgentId = text(event.parent_agent_id ?? event.parent_id);\n  const parentRunId = text(event.parent_run_id ?? event.root_run_id);\n  const status = terminalStatus(event.status);\n  const required = [lifecycleEvent, session, turn, agentId, agentType];\n  if (lifecycleEvent === null) {\n    await diagnostic(\"ignored_unrecognized_event\", { eventName });\n    process.exit(0);\n  }\n  const terminalFallback =\n    lifecycleEvent === \"stop\" &&\n    status !== null &&\n    agentId !== null &&\n    parentAgentId !== null &&\n    parentRunId !== null &&\n    (session === null || turn === null);\n  if (\n    (!terminalFallback && required.some((value) => value === null)) ||\n    (lifecycleEvent === \"start\" && model === null) ||\n    (lifecycleEvent === \"stop\" && status === null)\n  ) {\n    await fs.mkdir(pendingRoot, { recursive: true });\n    const identity = JSON.stringify({ eventName, session, turn, agentId, agentType, parentAgentId, parentRunId });\n    const pending = resolve(pendingRoot, createHash(\"sha256\").update(identity).digest(\"hex\") + \".json\");\n    await atomicSave(pending, { schema_version: 1, state: \"pending\", last_error: \"incomplete_host_metadata\", identity: JSON.parse(identity), recovery: \"Capture observed native metadata manually; never infer completed status.\" });\n    await diagnostic(\"ignored_incomplete_event\", {\n      eventName,\n      session,\n      turn,\n      agentId,\n      agentType,\n      missing_model: lifecycleEvent === \"start\" && model === null,\n    });\n    process.exit(0);\n  }\n  const candidates = [\n    resolve(repositoryRoot, \".agents\", \"runtime\", \"bin\", \"zaip.mjs\"),\n    resolve(repositoryRoot, \"packages\", \"cli\", \"dist\", \"index.js\"),\n  ];\n  const cli = candidates.find(existsSync);\n  if (cli === undefined) {\n    await diagnostic(\"cli_not_found\", { eventName, candidates });\n    process.exit(0);\n  }\n  const captureArguments = terminalFallback\n    ? [\n        \"subagent\",\n        \"capture-terminal\",\n        \"--parent-agent-id\",\n        parentAgentId,\n        \"--parent-run-id\",\n        parentRunId,\n        \"--agent-id\",\n        agentId,\n        \"--agent-type\",\n        agentType,\n        \"--status\",\n        status,\n        \"--json\",\n      ]\n    : [\n    \"subagent\",\n    \"capture\",\n    \"--event\",\n    lifecycleEvent,\n    \"--session\",\n    session,\n    \"--turn\",\n    turn,\n    \"--agent-id\",\n    agentId,\n    \"--agent-type\",\n    agentType,\n    ...(model === null ? [] : [\"--model\", model]),\n    ...(reasoningEffort === null ? [] : [\"--reasoning-effort\", reasoningEffort]),\n    ...(parentAgentId === null ? [] : [\"--parent-agent-id\", parentAgentId]),\n    ...(lifecycleEvent !== \"stop\" || status === null ? [] : [\"--status\", status]),\n    \"--json\",\n  ];\n  const pending = await persistPending(cli, captureArguments);\n  const receipt = await fs.readFile(pending, \"utf8\").then(JSON.parse);\n  if (receipt.state !== \"acknowledged\") {\n  const runner = spawn(\n    process.execPath,\n    [hookPath, \"--capture-runner\", pending],\n    {\n      cwd: repositoryRoot,\n      detached: true,\n      windowsHide: true,\n      stdio: \"ignore\",\n    },\n  );\n  runner.once(\"error\", (error) =>\n    diagnostic(\"runner_spawn_failed\", { eventName, error: error.message }),\n  );\n  runner.unref();\n  }\n  if (lifecycleEvent === \"start\") {\n    process.stdout.write(JSON.stringify({\n      hookSpecificOutput: {\n        hookEventName: \"SubagentStart\",\n        additionalContext:\n          \"ZAIP Codex delegation policy: a Sub-Run is only a native collaboration subagent. Do not use create_thread or fork_thread as a Sub-Run, fallback, retry, or delegation proof; those create independent chats and require an explicit user request. If native delegation is unavailable, report the limitation rather than create an independent chat. A catalog name, task_name, title, or prompt is not native ancestry. Before retrying the same bounded dispatch, await or reuse its pending native child; capture only ancestry observed from native host spawn/terminal results or SubagentStart/SubagentStop events, and work only as a cataloged zaip-agent-NOME identity. Delegation is recursive; do not use default, worker, explorer, or ad-hoc agent types.\",\n      },\n    }));\n  } else {\n    // Codex expects one JSON object on stdout for SubagentStop as well.\n    process.stdout.write(JSON.stringify({}));\n  }\n} catch (error) {\n  await diagnostic(\"hook_exception\", {\n    error: error instanceof Error ? error.message : String(error),\n  });\n}\n\nasync function atomicSave(path, value) {\n  const temporary = path + \".tmp-\" + randomUUID();\n  const delays = [25, 50, 75, 100, 150, 225, 300, 400, 500];\n  try {\n    await fs.writeFile(temporary, JSON.stringify(value), { flag: \"wx\", mode: 0o600 });\n    for (let retry = 0; ; retry++) {\n      try { await fs.rename(temporary, path); return; }\n      catch (error) {\n        if (![\"EPERM\", \"EACCES\", \"EBUSY\"].includes(error.code) || retry >= delays.length) throw error;\n        await new Promise(done => setTimeout(done, delays[retry]));\n      }\n    }\n  } finally {\n    await fs.unlink(temporary).catch(() => {});\n  }\n}\n\nasync function replayPendingReceipt(path) {\n  const deadline = Date.now() + 2000;\n  for (;;) {\n    if (await runCaptureRunner(path, true) !== \"lease_busy\") return \"attempted\";\n    if (Date.now() >= deadline) {\n      await persistDiagnostic(\"replay_deferred_active_lease\", { receipt: path });\n      return \"deferred\";\n    }\n    await new Promise(done => setTimeout(done, 50));\n  }\n}\n\nasync function runCaptureRunner(receiptPath, replay = false) {\n  if (typeof receiptPath !== \"string\" || dirname(resolve(receiptPath)) !== pendingRoot) return;\n  const lockPath = receiptPath + \".lock\";\n  let lease;\n  try {\n    lease = await fs.open(lockPath, \"wx\");\n    await lease.writeFile(JSON.stringify({ pid: process.pid }));\n  } catch (error) {\n    if (error.code !== \"EEXIST\") return;\n    const owner = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n    if (!Number.isSafeInteger(owner?.pid) || owner.pid <= 0) return \"lease_busy\";\n    try { process.kill(owner.pid, 0); return \"lease_busy\"; } catch (failure) { if (failure.code !== \"ESRCH\") return \"lease_busy\"; }\n    // Serialize stale lock recovery so two recovering workers cannot remove a new lease.\n    let recovery;\n    try { recovery = await fs.open(lockPath + \".recover\", \"wx\"); } catch { return \"lease_busy\"; }\n    try {\n      const current = await fs.readFile(lockPath, \"utf8\").then(JSON.parse).catch(() => null);\n      if (current?.pid !== owner.pid) return \"lease_busy\";\n      await fs.unlink(lockPath);\n      lease = await fs.open(lockPath, \"wx\");\n      await lease.writeFile(JSON.stringify({ pid: process.pid }));\n    } finally { await recovery.close(); await fs.unlink(lockPath + \".recover\").catch(() => {}); }\n    if (!lease) return \"lease_busy\";\n  }\n  try {\n    const receipt = await fs.readFile(receiptPath, \"utf8\").then(JSON.parse);\n    if (receipt.schema_version !== 1 || receipt.state === \"acknowledged\" || (!replay && receipt.attempts >= 3)) return;\n    const cli = receipt.cli, args = receipt.capture_arguments;\n    const allowedCli = [resolve(repositoryRoot, \".agents/runtime/bin/zaip.mjs\"), resolve(repositoryRoot, \"packages/cli/dist/index.js\")];\n    if (!allowedCli.includes(cli) || !Array.isArray(args) || !args.every(x => typeof x === \"string\") || args[0] !== \"subagent\" || ![\"capture\", \"capture-terminal\"].includes(args[1])) return;\n    const digest = createHash(\"sha256\").update(JSON.stringify({ cli, arguments: args })).digest(\"hex\");\n    if (resolve(pendingRoot, digest + \".json\") !== resolve(receiptPath)) return;\n    const value = flag => args[args.indexOf(flag) + 1];\n    const stop = args[1] === \"capture-terminal\" || value(\"--event\") === \"stop\";\n    if (stop && ![\"completed\", \"failed\", \"cancelled\"].includes(value(\"--status\"))) return;\n    for (let retry = 0; retry < 3; retry++) {\n      receipt.attempts = (receipt.attempts ?? 0) + 1;\n      receipt.updated_at = new Date().toISOString();\n      await atomicSave(receiptPath, receipt);\n      const outcome = await capture(cli, args);\n      let result;\n      try { result = JSON.parse(outcome.stdout); } catch { result = null; }\n      const runId = result?.run?.run_id ?? result?.run?.id;\n      const status = result?.status ?? result?.run?.status;\n      if (outcome.code === 0 && result?.captured === true && typeof runId === \"string\" && runId.startsWith(\"RUN-\") && (!stop || status === value(\"--status\"))) {\n        receipt.state = \"acknowledged\";\n        receipt.run_id = runId;\n        receipt.acknowledged_at = new Date().toISOString();\n        delete receipt.last_error;\n        await atomicSave(receiptPath, receipt);\n        return;\n      }\n      receipt.last_error = outcome.error ?? (outcome.code === 0 ? \"capture_not_confirmed\" : \"capture_exit_nonzero\");\n      await atomicSave(receiptPath, receipt);\n      if (retry < 2) await new Promise(done => setTimeout(done, 250 * (retry + 1)));\n    }\n    await persistDiagnostic(\"capture_pending\", { receipt: receiptPath, attempts: receipt.attempts, error: receipt.last_error });\n  } catch (error) {\n    await persistDiagnostic(\"runner_exception\", { error: error instanceof Error ? error.message : String(error) });\n  } finally {\n    await lease?.close();\n    await fs.unlink(lockPath).catch(() => {});\n  }\n}\n\nasync function capture(cli, args) {\n  const child = spawn(process.execPath, [cli, ...args], { cwd: repositoryRoot, windowsHide: true, stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n  let stdout = \"\", overflow = false;\n  child.stdout.on(\"data\", chunk => { stdout += String(chunk); if (stdout.length > 262144) { overflow = true; stdout = \"\"; child.kill(); } });\n  child.stderr.resume();\n  return await new Promise(done => {\n    let settled = false;\n    const finish = result => { if (settled) return; settled = true; clearTimeout(timer); done({ ...result, stdout: overflow ? \"\" : stdout }); };\n    const timer = setTimeout(() => { child.kill(); finish({ error: \"capture_timeout\" }); }, 15000);\n    child.once(\"error\", () => finish({ error: \"capture_spawn_failed\" }));\n    child.once(\"close\", code => finish({ code }));\n  });\n}\n\nasync function persistPending(cli, captureArguments) {\n  const identity = JSON.stringify({ cli, arguments: captureArguments });\n  const digest = createHash(\"sha256\").update(identity).digest(\"hex\");\n  const path = resolve(pendingRoot, digest + \".json\");\n  await fs.mkdir(pendingRoot, { recursive: true });\n  const receipt = { schema_version: 1, state: \"pending\", cli, capture_arguments: captureArguments, attempts: 0, created_at: new Date().toISOString() };\n  // Publish a complete immutable initial receipt without overwriting another worker's acknowledgement.\n  const temporary = path + \".tmp-\" + randomUUID();\n  await fs.writeFile(temporary, JSON.stringify(receipt), { flag: \"wx\", mode: 0o600 });\n  try { await fs.link(temporary, path); } catch (error) { if (error.code !== \"EEXIST\") throw error; }\n  finally { await fs.unlink(temporary); }\n  return path;\n}\n\nasync function persistDiagnostic(code, detail) {\n  const line = `${JSON.stringify({\n    source: \"zaip-subagent-lifecycle-runner\",\n    code,\n    occurred_at: new Date().toISOString(),\n    detail,\n  })}\\n`;\n  await fs.mkdir(dirname(diagnosticPath), { recursive: true });\n  const size = await fs.stat(diagnosticPath).then((entry) => entry.size).catch(() => 0);\n  if (size + Buffer.byteLength(line) > 262_144) {\n    await fs.writeFile(diagnosticPath, \"\", \"utf8\");\n  }\n  await fs.appendFile(diagnosticPath, line, \"utf8\");\n}\n\nasync function diagnostic(code, detail) {\n  await persistDiagnostic(code, detail);\n  process.stderr.write(\n    `${JSON.stringify({ source: \"zaip-subagent-lifecycle\", code, detail })}\\n`,\n  );\n}\n\nfunction text(value) {\n  if (typeof value !== \"string\") return null;\n  const normalized = value.trim();\n  return normalized.length > 0 && normalized.length <= 200 ? normalized : null;\n}\n\nfunction reasoningEffortValue(value) {\n  const normalized = text(value);\n  return [\"low\", \"medium\", \"high\", \"xhigh\"].includes(normalized) ? normalized : null;\n}\n\nfunction terminalStatus(value) {\n  const normalized = text(value);\n  return [\"completed\", \"failed\", \"cancelled\"].includes(normalized) ? normalized : null;\n}\n";
 //# sourceMappingURL=codex-subagent-hook-template.d.ts.map

package/dist/services/codex-subagent-hook-template.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"codex-subagent-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,~~80fAqVzC~~,CAAC"}
1	+ {"version":3,"file":"codex-subagent-hook-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-subagent-hook-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,uxiBAsXzC,CAAC"}