@zaip-ai/cli 6.3.0 → 7.6.0

package/dist/services/codex-pre-tool-hook-template.js

@@ -25,44 +25,16 @@ function isGitPath(path) {
   return scoped.split("/").includes(".git");
 }
 
-function unquote(value) {
-  return value.trim().replace(/^["']|["']$/g, "");
-}
-
-function explicitPathCandidates(command) {
-  const withoutUrls = command.replace(/https?:\/\/[^\s"'\x60]+/gi, "");
-  const candidates = new Set();
-  for (const match of withoutUrls.matchAll(/["']([A-Za-z]:[\\/][^"']+)["']/g)) {
-    candidates.add(match[1]);
-  }
-  for (const match of withoutUrls.matchAll(/(?:^|[\s=(:,])([A-Za-z]:[\\/][^\s"'\x60;|&),]+)/g)) {
-    candidates.add(match[1]);
-  }
-  for (const match of withoutUrls.matchAll(/["']([^"']*\.\.[\\/][^"']*)["']/g)) {
-    candidates.add(match[1]);
-  }
-  for (const match of withoutUrls.matchAll(/(?:^|[\s=(:,])(\.\.[\\/][^\s"'\x60;|&),]+)/g)) {
-    candidates.add(match[1]);
-  }
-  return [...candidates].map(unquote).filter(Boolean);
-}
-async function assertCanonicalLiteralPath(path, cwd = repositoryRoot) {
-  if (path.split(/[\\/]/).includes("..")) deny("Filesystem traversal is blocked.");
-  for (let cursor = resolve(cwd, path);; cursor = dirname(cursor)) {
-    try {
-      const info = await lstat(cursor);
-      if (info.isSymbolicLink() || (await realpath(cursor)).toLowerCase() !== cursor.toLowerCase())
-        deny("Filesystem links and aliases are blocked.");
-    } catch (error) { if (error?.code !== "ENOENT") deny("Filesystem path could not be safely verified."); }
-    if (dirname(cursor) === cursor) break;
-  }
-}
+const assertCanonicalLiteralPath = (path, cwd = repositoryRoot) => assertCanonicalFilesystemPath(path, cwd, deny);
 async function validateExplicitFilesystemReferences(command, cwd, reviewedPaths = []) {
   const checked = reviewedPaths.reduce((text, path) => text.replaceAll(path, "REVIEWED_RELEASE_PATH"), command);
   if (homeReferencePattern.test(checked)) {
     deny("Direct user-profile path references are blocked; use repository-scoped paths.");
   }
-  if (credentialReferencePattern.test(checked.replace(/[;|&()]/g, " ")) || sensitiveEnvironmentPattern.test(checked)) {
+  // Search expressions are data; only a verified names-only dotenv listing exempts credential operands.
+  const credentialOperands = withoutLiteralSearchPatterns(checked);
+  const dotenvListing = await reviewedDotenvFileListing(command, cwd, repositoryRoot);
+  if (dotenvListing === false || (dotenvListing !== true && credentialReferencePattern.test(credentialOperands.replace(/[;|&()]/g, " "))) || sensitiveEnvironmentPattern.test(checked)) {
     deny("Direct credential and secret access is blocked.");
   }
   if (/\b(?:Get-ChildItem|gci|dir|Get-Item|gi)(?:\s+-(?:LiteralPath|Path))?\s+(?:Env|Variable|Function|Alias):|\b(?:printenv|set)\s*$/i.test(checked) || /GetEnvironmentVariables\s*\(/i.test(checked)) {
@@ -74,8 +46,8 @@ async function validateExplicitFilesystemReferences(command, cwd, reviewedPaths
   const isSubagentCapture = /^node\s+\.agents[\\/]runtime[\\/]bin[\\/]zaip\.mjs\s+subagent\s+capture(?:-terminal)?(?=\s)[^;&|\x60\r\n]*$/.test(checked);
   const osPathCommand = isSubagentCapture
     ? checked.replace(/(^|\s)--(?:agent-id|parent-agent-id)\s+\/root(?:\/[a-z][a-z0-9_]*_zaip_agent(?:_[a-z0-9]+)?)+(?=\s|$)/g, "$1--native-agent-id zaip-agent")
-    : checked; if (/[\r\n]/.test(checked)) deny("Multiline shell commands are blocked.");
-  for (const match of osPathCommand.matchAll(/(["'])(\/(?:etc|home|Users|root|var|opt|private|mnt|proc|sys|dev|tmp)(?:\/[^\r\n]*?)?)\1|(?:^|[\s=(,]|-[A-Za-z][A-Za-z0-9_-]*:)(\/(?:etc|home|Users|root|var|opt|private|mnt|proc|sys|dev|tmp)(?:\/[^\s"'\x60;,)|&]*)?)/gi)) {
+    : withoutLiteralSearchPatterns(checked); if (/[\r\n]/.test(checked)) deny("Multiline shell commands are blocked.");
+  for (const match of osPathCommand.matchAll(/(["'])(\/[^\r\n]*?)\1|(?:^|[\s=(,]|-[A-Za-z][A-Za-z0-9_-]*:)(\/[^\s"'\x60;,)|&]*)/g)) {
     const path = match[2] ?? match[3], before = osPathCommand[match.index - 1] ?? "", after = osPathCommand[match.index + match[0].length] ?? "", jsonPath = /(?:^|\s)'\{"path":$/.test(osPathCommand.slice(0, match.index)) && /^}'(?:\s|$)/.test(osPathCommand.slice(match.index + match[0].length));
     if (principalFullAccess) { await assertCanonicalLiteralPath(path); continue; }
     if (jsonPath) { if (path.includes("\\") || !isWithinRepository(resolve(path))) deny("Explicit filesystem path escapes the repository boundary."); continue; }
@@ -96,85 +68,11 @@ async function validateExplicitFilesystemReferences(command, cwd, reviewedPaths
     }
   }
 }
-async function validateGitPublication(command) {
-  const tokens = tokenizeLiteralCommand(command);
-  if (tokens !== null) {
-    const launcher = tokens[0]?.toLowerCase();
-    if (((launcher === "env" || launcher === "command") && /^git(?:\.exe)?$/i.test(tokens[1] ?? "")) ||
-        (/^(?:Set-Alias|New-Alias)$/i.test(launcher ?? "") && tokens.slice(1).some(token => /^git(?:\.exe)?$/i.test(token))))
-      deny("Indirect Git execution is blocked; use a single literal command.");
-  } else if (/(?:^|[;&|\r\n])\s*(?:(?:&\s*)?(?:['"]git(?:\.exe)?['"]|\(\s*['"]git(?:\.exe)?['"]\s*\))|(?:env|command)\s+git(?:\.exe)?\b)/i.test(command) ||
-      /&\s*\(\s*Get-Command\s+git(?:\.exe)?\b/i.test(command) ||
-      /(?:^|[\s;&|])&\s*\$[A-Za-z_]/i.test(command) || /\b(?:Set-Alias|New-Alias)\b[^\r\n;]*\bgit\b/i.test(command)) {
-    deny("Indirect Git execution is blocked; use a single literal command.");
-  }
-  if (tokens === null && /\(\s*git(?:\.exe)?\b/i.test(command)) {
-    deny("Nested Git execution is blocked; use a single literal command.");
-  }
-  if (tokens === null) {
-    if (/(?:^|[;&|\r\n(])\s*git(?:\.exe)?\b/i.test(command)) {
-      deny("Git commands must be a single literal command; separate commands before requesting execution.");
-    }
-    return;
-  }
-  const invocation = gitInvocation(tokens, deny);
-  if (invocation === null) return;
-  const { subcommand, arguments: arguments_ } = invocation;
-  if (subcommand === "commit" && arguments_.some((value) => /^(?:--amend|--no-verify|-n)/i.test(value))) {
-    deny("Commit history rewrites and hook bypasses are blocked.");
-  }
-  if (subcommand === "push" && arguments_.some((value) => /^(?:--force(?:-with-lease|-if-includes)?|-f|--mirror|--delete|--all)$/i.test(value))) {
-    deny("Force, mirror, bulk, and deletion pushes are blocked.");
-  }
-  if (["clean", "reset", "restore", "checkout"].includes(subcommand)) {
-    deny("Destructive Git state changes are blocked.");
-  }
-  if (["branch", "tag"].includes(subcommand) && arguments_.some((value) => /^-d/i.test(value))) {
-    deny("Destructive Git state changes are blocked.");
-  }
-  if (subcommand === "fetch" && arguments_.some((value) => /^--(?:all|prune|prune-tags)$/i.test(value))) {
-    deny("Bulk or pruning fetches are outside the bounded deploy flow.");
-  }
-  if (subcommand === "add") {
-    const broad = arguments_.some((value) => /^(?:-A|--all|-u|\.)$/i.test(value));
-    const force = arguments_.some((value) => /^(?:--force|-f)$/i.test(value));
-    if (broad) deny("Broad Git staging is blocked; authorized deploy commits require explicit pathspecs.");
-    if (force) deny("Force-adding or explicitly staging credential-like files is blocked.");
-  }
-  if (
-    subcommand === "remote" &&
-    ["add", "set-url", "remove", "rename"].includes(arguments_[0]?.toLowerCase())
-  ) {
-    deny("Remote, SSH, and credential configuration changes are blocked.");
-  }
-  if (
-    subcommand === "config" &&
-    arguments_.some((value) => /(?:sshcommand|credential|url\.)/i.test(value))
-  ) {
-    deny("Remote, SSH, and credential configuration changes are blocked.");
-  }
-  if (subcommand !== "push") return;
-  const deployment = await configuredDeploymentBranches(repositoryRoot, deny);
-  const requested = arguments_[1]?.match(/^HEAD:refs\/heads\/(.+)$/)?.[1];
-  if (arguments_.length !== 2 || arguments_[0] !== "origin" || !requested || !deployment.applicationBranches.includes(requested)) {
-    deny(
-      "Automated application publication is restricted to configured deploy.frontend.branch or deploy.backend.branch (" + deployment.applicationBranches.join(", ") +
-        "); database migrations are beta-only and use the migration request workflow. " +
-        "deploy.production_branch " + deployment.productionBranch + " requires human promotion.",
-    );
-  }
-  const scopes = Object.entries(deployment.scopeBranches).filter(([, branch]) => branch === requested).map(([scope]) => scope);
-  if (scopes.length === 0) deny("A Git push must resolve to a configured application scope.");
-  try {
-    await execute(process.execPath, [resolve(repositoryRoot, ".agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs"), "--repository", repositoryRoot, "--scope", scopes[0], "--resolve-branch", "--branch", requested], { cwd: repositoryRoot, encoding: "utf8", windowsHide: true });
-  } catch (error) {
-    deny("Application publication content preflight failed: " + (error?.stderr?.trim() || error?.message || "unknown failure"));
-  }
-}
-
-
+import { createGitPublication } from "./zaip-git-publication.mjs";
+const { reviewedGitPublisherInvocation, validateGitPublication } = createGitPublication({ tokenizeLiteralCommand, gitInvocation, deny });
 
 function validateExplicitNetwork(command) {
+  if (isPublicCloudDocsRead(command)) return;
   if (/(?:^|[;&|]\s*)\b(?:ssh|scp|sftp|rsync|ftp|telnet|nc|ncat)\b/i.test(command)) {
     deny("Direct remote-shell and file-transfer clients are blocked.");
   }
@@ -285,7 +183,7 @@ async function validatePatch(command) {
     const rawPath = (match[1] ?? match[2]).trim().replace(/^["']|["']$/g, "");
     if (principalFullAccess) await assertCanonicalLiteralPath(rawPath);
   }
-  const paths = patchPaths(command);
+  const paths = patchPaths(command, repositoryRoot);
   const lifecycleRecordTouched = paths.some((path) =>
     /^\.agents[\\/]records[\\/](?:prds|specs|tasks)[\\/]/i.test(path));
   if (lifecycleRecordTouched && /^\+\s*status\s*:/m.test(command)) {
@@ -298,34 +196,38 @@ async function validatePatch(command) {
     if (principalFullAccess) await assertCanonicalLiteralPath(absolute);
     else if (!await nativeAuthority?.isSafePatchPath(absolute, repositoryRoot)) deny("Patch path traverses a link or could not be safely verified.");
     if (repositoryPath(absolute) === "") deny("Patching the repository root is blocked.");
+    if (protectedDurableStatePath(repositoryPath(absolute))) deny("Durable operational state is managed only by canonical runtime protocols.");
     if (protectedTaskWorkspacePath(repositoryPath(absolute))) deny("Task workspace claims are managed only by the canonical CLI.");
     if (isGitPath(absolute)) {
       deny("Direct edits to protected Git control files are blocked.");
     }
   }
 }
-const protectedTaskWorkspacePath = path => /^\.local\/task-workspaces(?:\/|$)/i.test(path);
+const protectedTaskWorkspacePath = path => /^\.agents\/private\/state\/task-workspaces(?:\/|$)/i.test(path);
+// ZAIP_DURABLE_STATE_LAYOUT_V1: canonical placement never grants direct product writes.
+const protectedDurableStatePath = path => /^(?:\.agents\/(?:state|private)|\.local\/recovery\/post-publication)(?:\/|$)/i.test(path);
+const protectedPublicationBindingPath = path => /^\.agents\/private\/state\/codex-hook-publication(?:\/|$)/i.test(path);
 const lifecycleExemptPathPattern = /^\.local\/(?!(?:codex-hook-|codex-telemetry-spool\/|runs\/|task-workspaces(?:\/|$)))/;
-function patchPaths(command) {
-  return [...command.matchAll(/^\*\*\* (?:Add|Update|Delete) File:\s*(.+)$|^\*\*\* Move to:\s*(.+)$/gm)].map(
-    (match) => repositoryPath(resolve(repositoryRoot, (match[1] ?? match[2]).trim().replace(/^["']|["']$/g, ""))),
-  );
-}
-
 async function requiresOrchestratorRun(event, command) {
   if (event.tool_name === "apply_patch") {
-    const paths = patchPaths(command);
+    const paths = patchPaths(command, repositoryRoot);
+    if (paths.some(protectedPublicationBindingPath)) deny("Publication bindings are emitted only by the verified native publication protocol.");
+    if (paths.some(protectedDurableStatePath)) deny("Durable operational state is managed only by canonical runtime protocols.");
     return paths.length === 0 || paths.some((path) => !lifecycleExemptPathPattern.test(path));
   }
   if (event.tool_name === "Edit" || event.tool_name === "Write") {
     if (principalFullAccess) await assertCanonicalLiteralPath(command, event.cwd ?? repositoryRoot);
     else if (!await nativeAuthority?.isSafePatchPath(resolve(event.cwd ?? repositoryRoot, command), repositoryRoot)) deny("File write path traverses a link or could not be safely verified.");
     const path = repositoryPath(resolve(event.cwd ?? repositoryRoot, command));
+    if (protectedPublicationBindingPath(path)) deny("Publication bindings are emitted only by the verified native publication protocol.");
+    if (protectedDurableStatePath(path)) deny("Durable operational state is managed only by canonical runtime protocols.");
     if (protectedTaskWorkspacePath(path)) deny("Task workspace claims are managed only by the canonical CLI.");
     return !lifecycleExemptPathPattern.test(path);
   }
   // Only single literal writes claim exemptions; compound commands remain gated.
   const tokens = tokenizeLiteralCommand(command);
+  if ((shellSyntax(command).redirection || (tokens && /^(?:Set-Content|Add-Content|Out-File|New-Item|Copy-Item|Move-Item|Remove-Item|Rename-Item|sc|ac|ni|cp|mv|mi|ri|rm)$/i.test(tokens[0] ?? ""))) && /codex-hook-publication/i.test(command)) deny("Publication bindings are emitted only by the verified native publication protocol.");
+  if ((shellSyntax(command).redirection || (tokens && /^(?:Set-Content|Add-Content|Out-File|New-Item|Copy-Item|Move-Item|Remove-Item|Rename-Item|sc|ac|ni|cp|mv|mi|ri|rm)$/i.test(tokens[0] ?? ""))) && /(?:\.agents[\\/](?:state|private)(?:[\\/]|\b)|\.local[\\/]recovery[\\/]post-publication(?=[\\/'"\s]|$))/i.test(command)) deny("Durable operational state is managed only by canonical runtime protocols.");
   // The public CLI validates the immutable post-publication receipt, observed
   // invocation, completed maintenance Gui and exact target before any write.
   // Its first call necessarily follows the maintenance root's terminal Stop.
@@ -334,7 +236,7 @@ async function requiresOrchestratorRun(event, command) {
       /^\.agents[\\/]runtime[\\/]bin[\\/]zaip\.mjs$/.test(tokens[1] ?? "") &&
       tokens[2] === "task" && tokens[3] === "resume-post-publication" &&
       /^TASK-[A-Z0-9-]+$/.test(tokens[4] ?? "") && tokens[5] === "--receipt" &&
-      /^\.local[\\/]recovery[\\/]post-publication[\\/][a-f0-9]{64}\.json$/.test(tokens[6] ?? "") &&
+      /^(?:\.agents[\\/]private[\\/]state|\.local)[\\/]recovery[\\/]post-publication[\\/][a-f0-9]{64}\.json$/.test(tokens[6] ?? "") &&
       (tokens.length === 7 || (tokens.length === 8 && tokens[7] === "--json"))) return false;
   if (tokens && tokens[2] === "task" && tokens[3] === "resume-post-publication") return true;
   if (tokens && /^(?:Set-Content|Add-Content|Out-File|New-Item|Copy-Item|Move-Item|Remove-Item|Rename-Item|sc|ac|ni|cp|mv|mi|ri|rm|git(?:\.exe)?)$/i.test(tokens[0] ?? "") &&
@@ -364,7 +266,7 @@ async function requiresOrchestratorRun(event, command) {
       tokens[2] === "validation" && ["execute", "batch"].includes(tokens[3]) &&
       !Object.values(shellSyntax(command)).some(Boolean)) {
     let optIn;
-    try { optIn = JSON.parse(await readFile(resolve(repositoryRoot, ".local/validation-runtime.json"), "utf8")); }
+    try { optIn = JSON.parse(await readFile(resolve(repositoryRoot, ".agents/private/state/validation-runtime.json"), "utf8")); }
     catch { optIn = null; }
     const reviewed = await (nativeAuthority?.reviewedValidationRuntimePaths?.(command, tokenizeLiteralCommand, repositoryRoot) ?? []);
     if (typeof optIn?.executable === "string" &&
@@ -386,6 +288,7 @@ const toolInput = event?.tool_input;
 const candidateWorkdir = typeof toolInput?.workdir === "string" && isAbsolute(toolInput.workdir) ? toolInput.workdir : event.cwd;
 try { repositoryRoot = await selectHookRepositoryRoot(installedRoot, candidateWorkdir); }
 catch { repositoryRoot = installedRoot; }
+captureCliTurn.assertMaintenancePrincipal(event, repositoryRoot, deny);
 if (typeof activation?.hookPolicies !== "function") {
   let projectConfig;
   try {
@@ -404,17 +307,15 @@ if (typeof activation?.hookPolicies !== "function") {
 }
 const hookPolicy = await activation.hookPolicies(repositoryRoot, (path, maximumBytes) => readBoundedCanonicalText(path, maximumBytes, repositoryRoot));
 activation?.recordPolicyDiagnostic?.(repositoryRoot, hookPolicy);
-if (hookPolicy.tracking) activation?.recordHookObservation?.(repositoryRoot, event, hookPolicy.governance);
-if (!hookPolicy.governance) {
-  if (hookPolicy.diagnostic && !["config_missing", "policy_missing"].includes(hookPolicy.diagnostic))
-    deny("ZAIP project policy is invalid or unavailable; restore the canonical activation and project configuration.");
-  writeSync(1, "{}\n");
-  process.exit(0);
-}
+let repositorySetupMutation = false;
+try { repositorySetupMutation = await enforceRepositoryProfile({ installedRoot, repositoryRoot, event, tokenizeLiteralCommand, shellSyntax, patchPaths, isLiteralReadSequence, deny }); }
+catch (error) { deny("Repository profile: " + error.message); }
+await captureCliTurn.handleMaintenance({ repositoryRoot, event, toolInput, hookPolicy, readBoundedCanonicalText, activation, rewriteCliInput, writeSync, deny });
 const configuredPolicy = await configuredPermissionProfile(repositoryRoot);
 const principal = [event.agent_id, event.agent_type, event.agent_path, event.parent_agent_id].every(value => value === undefined) && event.permission_mode !== "plan";
 principalFullAccess = principal && configuredPolicy.filesystem;
 principalFullNetwork = principal && configuredPolicy.network;
+const observedEventCwd = event.cwd;
 try { const scope = await selectHookExecutionWorkspace(installedRoot, event, principalFullAccess); repositoryRoot = scope.repositoryRoot; event = { ...event, cwd: scope.cwd }; }
 catch (error) { deny(error.message); }
 if (credentialReferencePattern.test(event.cwd)) deny("Direct credential and secret access is blocked.");
@@ -422,9 +323,13 @@ if (!principalFullAccess && !isWithinRepository(event.cwd)) {
   deny("Tool execution outside the ZAIP-AIOS repository is blocked.");
 }
 
-const { validateCloudRunner, validateDirectCloudProviderMutation } = createCloudValidators({
+const { validateCloudRunner, validateDirectCloudProviderMutation, isPublicCloudDocsRead } = createCloudValidators({
   tokenizeLiteralCommand, deny, repositoryRoot, isWithinRepository, cloudRunnerScript, cloudContractPath, cloudOperationProviders,
 });
+const { githubSetupInvocation, issueGithubSetupReceipt } = createGithubSetupValidators({
+  event, repositoryRoot, principal, tokenizeLiteralCommand, shellSyntax, deny,
+  assertCanonicalLiteralPath, readBoundedCanonicalText, inside,
+});
 
 const commandFromCmd = toolInput?.cmd;
 const commandFromCommand = toolInput?.command;
@@ -434,28 +339,38 @@ if (typeof commandFromCmd === "string" && typeof commandFromCommand === "string"
 const command = typeof commandFromCmd === "string" ? commandFromCmd : commandFromCommand;
 if (typeof command !== "string") deny("A matched tool call without a command was rejected.");
 
-if (await requiresOrchestratorRun(event, command)) {
+const githubSetup = await githubSetupInvocation(command);
+const gitPublisher = reviewedGitPublisherInvocation(command);
+if (gitPublisher) {
+  if (!principal) deny("Publication authority requires an observed principal invocation, not delegated or plan-mode execution.");
+  await assertCanonicalLiteralPath(gitPublisher.script, event.cwd);
+  for (const [flag, value] of gitPublisher.values) if (flag.endsWith("-file") &&
+      (gitPublisher.script !== "scripts/local-release-deploy.mjs" || ["--request-file", "--plan-file"].includes(flag))) await assertCanonicalLiteralPath(value, event.cwd);
+}
+if (!githubSetup && !gitPublisher && (repositorySetupMutation || await requiresOrchestratorRun(event, command) || nativeAuthority?.isMacroTaskCausalReservationAttempt(command))) {
   const directRun = await nativeAuthority?.hasCurrentTaskOrchestratorRun(event, installedRoot, boundedCanonicalText);
   const primaryRead = (path, maximumBytes) => boundedCanonicalText(path, maximumBytes, installedRoot);
-  const delegated = directRun ? false : await nativeAuthority?.hasNativeDelegatedPatch(event, repositoryRoot, primaryRead, installedRoot);
-  if (!directRun && !delegated)
+  const relayRun = directRun ? false : await nativeAuthority?.hasMacroTaskCausalReservation(event, command, tokenizeLiteralCommand, repositoryRoot, primaryRead, installedRoot, { selectHookRepositoryRoot, read: boundedCanonicalText, observedEventCwd });
+  const delegated = directRun || relayRun ? false : await nativeAuthority?.hasNativeDelegatedPatch(event, repositoryRoot, primaryRead, installedRoot);
+  if (!directRun && !relayRun && !delegated)
     deny("Persistent mutation requires the exact active Task Run and its verified thread/turn correlation. Capture or reconcile this turn before retrying; no global Task fallback is allowed.");
-  const recordOnlyPaths = event.tool_name === "apply_patch" ? patchPaths(command) : [];
+  const recordOnlyPaths = event.tool_name === "apply_patch" ? patchPaths(command, repositoryRoot) : [];
   const recordOnlyPatch = recordOnlyPaths.length > 0 && recordOnlyPaths.every(path =>
     /^(?:\.agents\/(?:records\/|data\/runs\/)|\.local\/)/.test(path));
-  if (!recordOnlyPatch && !(await nativeAuthority?.hasClaimedTaskWriter(event, repositoryRoot, primaryRead, directRun || null, installedRoot)))
+  if (!recordOnlyPatch && !(await nativeAuthority?.hasClaimedTaskWriter(event, repositoryRoot, primaryRead, directRun || relayRun || null, installedRoot)))
     deny("Product mutation requires the exact active Task writer claim; run task workspace before editing.");
 }
 
 if (event.tool_name === "apply_patch") await validatePatch(command);
 else {
   const reviewedPaths = [
+    ...await reviewedLegacyWorkspacePaths(command, event.cwd, repositoryRoot, credentialReferencePattern),
     ...await reviewedReleasePaths(command, event.cwd, repositoryRoot, credentialReferencePattern, deny),
     ...await reviewedContextReadPaths(command, credentialReferencePattern, installedRoot), ...await (nativeAuthority?.reviewedValidationRuntimePaths?.(command, tokenizeLiteralCommand, repositoryRoot) ?? []),
   ];
   await validateExplicitFilesystemReferences(command, event.cwd, reviewedPaths);
   const policyCommand = await executionPolicyCommand(command, event.cwd, repositoryRoot, execute);
-  validateInlineExecution(policyCommand, deny);
+  validateInlineExecution(policyCommand, deny, toolInput?.shell);
   if (!isLiteralReadSequence(policyCommand) && !await isCurrentRepositoryRead(policyCommand, repositoryRoot, execute)) {
   await validateGitPublication(policyCommand);
   await validateCloudRunner(policyCommand);
@@ -464,7 +379,7 @@ else {
   await validateShellDeletion(policyCommand, event.cwd);
   checkDestructivePatterns(policyCommand, destructivePatterns, deny);
   }
-  try { const updated = await captureCliTurn(repositoryRoot, event, command); if (updated) writeSync(1, JSON.stringify(rewriteCliInput(toolInput, updated, commandFromCmd)) + "\n"); }
+  try { const updated = githubSetup?.apply ? await issueGithubSetupReceipt(githubSetup, command) : await captureCliTurn(repositoryRoot, event, command, null, gitPublisher?.localCatalog === true); if (updated) writeSync(1, JSON.stringify(rewriteCliInput(toolInput, updated, commandFromCmd)) + "\n"); }
   catch (error) { deny(error.message); }
 }
 activation?.recordActivation(repositoryRoot, event, "allowed");

package/dist/services/codex-pre-tool-hook-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA,GAAG,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8M1E,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsQ5B,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA,GAAG,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwG1E,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuR5B,CAAC"}

package/dist/services/codex-pre-tool-hook-template.test.js

@@ -1,5 +1,5 @@
 import { spawnSync } from "node:child_process";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, expect, it } from "vitest";
@@ -14,7 +14,7 @@ afterEach(async () => {
     await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })));
 });
 it("portable hook restricts HashiCorp release reads to the exact HTTPS host and GET or HEAD", async () => {
-    const root = await mkdtemp(join(tmpdir(), "zaip-cli-hashicorp-read-"));
+    const root = await realpath(await mkdtemp(join(tmpdir(), "zaip-cli-hashicorp-read-")));
     roots.push(root);
     await enableZaip(root);
     const { hooks } = await installPreToolHook(root);
@@ -47,7 +47,7 @@ it("portable hook restricts HashiCorp release reads to the exact HTTPS host and
     }
 });
 it("portable hook releases Task authority only for literal ZAIP disable", async () => {
-    const root = await mkdtemp(join(tmpdir(), "zaip-cli-disabled-hook-"));
+    const root = await realpath(await mkdtemp(join(tmpdir(), "zaip-cli-disabled-hook-")));
     roots.push(root);
     const { hooks } = await installPreToolHook(root);
     const config = join(root, ".agents", "config", "project.yaml");
@@ -77,8 +77,8 @@ it("portable hook releases Task authority only for literal ZAIP disable", async
         expect(JSON.parse(result.stdout).hookSpecificOutput?.permissionDecision).toBe("deny");
     }
 });
-it("permits only literal reviewed release commands with controlled external paths", async () => {
-    const root = await mkdtemp(join(tmpdir(), "zaip-cli-release-hook-"));
+it("permits reviewed release preparation and rejects publication without exact authority", async () => {
+    const root = await realpath(await mkdtemp(join(tmpdir(), "zaip-cli-release-hook-")));
     roots.push(root);
     await enableZaip(root);
     const { hookPath } = await installPreToolHook(root);
@@ -103,11 +103,17 @@ it("permits only literal reviewed release commands with controlled external path
         encoding: "utf8",
         input: JSON.stringify({ cwd: root, tool_name: "exec_command", tool_input: { cmd } }),
     });
-    for (const command of [prepare, verify, deploy]) {
+    for (const command of [prepare, verify]) {
         const result = invoke(command);
         expect(result.status).toBe(0);
         expect(result.stdout, command).toBe("");
     }
+    const unboundPublication = invoke(deploy);
+    expect(unboundPublication.status).toBe(0);
+    expect(JSON.parse(unboundPublication.stdout).hookSpecificOutput).toMatchObject({
+        permissionDecision: "deny",
+        permissionDecisionReason: expect.stringContaining("Framework publication requires exact source Run, candidate and main destination."),
+    });
     const nested = spawnSync(process.execPath, [hookPath], {
         cwd: root,
         encoding: "utf8",
@@ -150,7 +156,7 @@ it("permits only literal reviewed release commands with controlled external path
     }
 });
 it("uses tool_input.cmd, rejects conflicting commands, and keeps read-only git formatting", async () => {
-    const root = await mkdtemp(join(tmpdir(), "zaip-cli-pre-tool-"));
+    const root = await realpath(await mkdtemp(join(tmpdir(), "zaip-cli-pre-tool-")));
     roots.push(root);
     await enableZaip(root);
     const { hookPath } = await installPreToolHook(root);

package/dist/services/codex-pre-tool-hook-template.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-hook-template.test.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AAEnF,MAAM,KAAK,GAAa,EAAE,CAAC;AAC3B,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,SAAS,CACb,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAC5B,uDAAuD,CACxD,CAAC;AACJ,CAAC;AACD,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;IACvG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC,EAAE;QAClE,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;KACrF,CAAC,CAAC;IACL,KAAK,MAAM,GAAG,IAAI;QAChB,gDAAgD;QAChD,+DAA+D;KAChE,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,+CAA+C;QAC/C,+DAA+D;QAC/D,kEAAkE;QAClE,0DAA0D;QAC1D,iFAAiF;QACjF,mDAAmD;QACnD,0DAA0D;QAC1D,0DAA0D;KAC3D,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACnF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC/D,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,GAAG,EAAE,CACf,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC,EAAE;QAClE,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,GAAG,EAAE,IAAI;YACT,SAAS,EAAE,aAAa;YACxB,UAAU,EAAE,EAAE,OAAO,EAAE,gEAAgE,EAAE;SAC1F,CAAC;KACH,CAAC,CAAC;IACL,MAAM,SAAS,CAAC,MAAM,EAAE,8CAA8C,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,SAAS,CAAC,MAAM,EAAE,gDAAgD,CAAC,CAAC;IAC1E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpF,MAAM,SAAS,CAAC,MAAM,EAAE,8CAA8C,CAAC,CAAC;IACxE,MAAM,SAAS,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAC;IACvE,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1C,IAAI,KAAK,KAAK,QAAQ;YACpB,MAAM,SAAS,CACb,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,EACvC,yCAAyC,CAC1C,CAAC;QACJ,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;IAC7F,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACrE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,+BAA+B,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAClG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,0BAA0B,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC7F,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAA0B,CAAC,EAC3D,wBAAwB,CACzB,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CACnB,OAAO,EAAE,EACT,QAAQ,EACR,oBAAoB,EACpB,WAAW,EACX,6BAA6B,CAC9B,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CACjB,OAAO,EAAE,EACT,QAAQ,EACR,cAAc,EACd,WAAW,EACX,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,IAAI,CACrB,OAAO,EAAE,EACT,QAAQ,EACR,cAAc,EACd,WAAW,EACX,eAAe,EACf,qBAAqB,CACtB,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;IACxC,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,kDAAkD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,gDAAgD,CAAC;IACrJ,MAAM,OAAO,GAAG,sDAAsD,IAAI,iBAAiB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,2DAA2D,CAAC;IACxL,MAAM,MAAM,GAAG,qDAAqD,IAAI,kBAAkB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3M,MAAM,MAAM,GAAG,yCAAyC,IAAI,+BAA+B,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,UAAU,CAAC,0EAA0E,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,wCAAwC,CAAC;IAC7X,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACtC,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;KACrF,CAAC,CAAC;IACL,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACrD,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YACzB,SAAS,EAAE,cAAc;YACzB,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;SAC5B,CAAC;KACH,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI;QACpB,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC;QACrC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC;QAC3C,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;QACtD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,OAAO,CACb,CAAC,CAAC,QAAQ,CAAC,EACX,CAAC,CACC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,6BAA6B,CAAC,CAC5F,CACF;QACD,OAAO,CAAC,OAAO,CACb,CAAC,CAAC,QAAQ,CAAC,EACX,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,OAAO,EAAE,6BAA6B,CAAC,CAAC,CAC3F;QACD,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,uBAAuB,CAAC;QACpD,GAAG,MAAM,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE;QACnC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,QAAQ,eAAe,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACxF,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CACZ,CAAC,CAAC,KAAK,CAAC,EACR,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAChF;QACD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7D,GAAG,MAAM,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE;QACvC,GAAG,MAAM,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE;QACxC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE;QAC3B,wCAAwC,CAAC,CAAC,OAAO,CAAC,EAAE;QACpD,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,uBAAuB,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;KACzE,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;IACrG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,UAAkC,EAAE,EAAE,CACpD,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACtC,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;KAC5E,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI;QAChB,+DAA+D;QAC/D,iEAAiE;QACjE,4DAA4D;QAC5D,2DAA2D;QAC3D,mDAAmD;QACnD,gDAAgD;QAChD,kDAAkD;QAClD,gDAAgD;QAChD,oDAAoD;QACpD,+CAA+C;QAC/C,sEAAsE;QACtE,uDAAuD;QACvD,+BAA+B;QAC/B,oCAAoC;QACpC,0EAA0E;QAC1E,kGAAkG;QAClG,yFAAyF;QACzF,qFAAqF;QACrF,sBAAsB;QACtB,8BAA8B;QAC9B,0BAA0B;QAC1B,4BAA4B;QAC5B,gCAAgC;QAChC,kCAAkC;QAClC,6BAA6B;QAC7B,+BAA+B;QAC/B,+BAA+B;QAC/B,iDAAiD;QACjD,yCAAyC;QACzC,2CAA2C;QAC3C,kCAAkC;QAClC,+BAA+B;QAC/B,yCAAyC;QACzC,gCAAgC;QAChC,oCAAoC;QACpC,oCAAoC;QACpC,4CAA4C;QAC5C,sDAAsD;QACtD,qCAAqC;QACrC,gDAAgD;QAChD,oDAAoD;QACpD,mCAAmC;QACnC,qCAAqC;QACrC,4DAA4D;QAC5D,kEAAkE;QAClE,oCAAoC;QACpC,+EAA+E;QAC/E,qBAAqB;QACrB,4BAA4B;QAC5B,sBAAsB;QACtB,sBAAsB;KACvB,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,4BAA4B;QAC5B,8BAA8B;QAC9B,iCAAiC;QACjC,0DAA0D;KAC3D,EAAE,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,OAAO,GACX,4OAA4O,CAAC;IAC/O,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI;QACjB,kCAAkC;QAClC,gCAAgC;QAChC,yCAAyC;KAC1C,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,uCAAuC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,8BAA8B;QAC9B,oDAAoD;QACpD,6DAA6D;QAC7D,OAAO,CAAC,OAAO,CAAC,uCAAuC,EAAE,QAAQ,CAAC;QAClE,OAAO,CAAC,OAAO,CACb,uCAAuC,EACvC,wCAAwC,CACzC;QACD,GAAG,OAAO,2BAA2B;KACtC,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC;QAC3B,GAAG,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG;KAC5E,CAAC,CAAC;IACH,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI;QAC1B;YACE,eAAe,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU;YACjE,kCAAkC;SACnC;QACD;YACE,qBAAqB,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU;YACvE,kCAAkC;SACnC;QACD;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU,EAAE,CAAC,GAAG;YAClG,kCAAkC;SACnC;QACD,CAAC,qCAAqC,EAAE,kCAAkC,CAAC;QAC3E;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,GAAG;YACtE,kCAAkC;SACnC;QACD;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG;YAC1E,kCAAkC;SACnC;QACD,CAAC,+BAA+B,GAAG,MAAM,EAAE,uCAAuC,CAAC;KAC3E,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,CAAC;QAC/B,GAAG,EAAE,wIAAwI;KAC9I,CAAC,CAAC;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,MAAM,CAAC;QAC1B,GAAG,EAAE,6NAA6N;KACnO,CAAC,CAAC;IACH,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,mBAAmB,GAAG,MAAM,CAAC;QACjC,GAAG,EAAE,qEAAqE;KAC3E,CAAC,CAAC;IACH,MAAM,CACJ,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,wBAAwB,CACnF,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;IACrD,MAAM,CACJ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,8CAA8C,EAAE,CAAC,CAAC,MAAM,CAAC;SAC/E,kBAAkB,CAAC,kBAAkB,CACzC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACf,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzF,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,GAAG,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC"}
+{"version":3,"file":"codex-pre-tool-hook-template.test.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-hook-template.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AAEnF,MAAM,KAAK,GAAa,EAAE,CAAC;AAC3B,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,SAAS,CACb,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAC5B,uDAAuD,CACxD,CAAC;AACJ,CAAC;AACD,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;IACvG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC,CAAC;IACvF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC,EAAE;QAClE,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;KACrF,CAAC,CAAC;IACL,KAAK,MAAM,GAAG,IAAI;QAChB,gDAAgD;QAChD,+DAA+D;KAChE,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,+CAA+C;QAC/C,+DAA+D;QAC/D,kEAAkE;QAClE,0DAA0D;QAC1D,iFAAiF;QACjF,mDAAmD;QACnD,0DAA0D;QAC1D,0DAA0D;KAC3D,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACnF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC;IACtF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC/D,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,GAAG,EAAE,CACf,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC,EAAE;QAClE,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,GAAG,EAAE,IAAI;YACT,SAAS,EAAE,aAAa;YACxB,UAAU,EAAE,EAAE,OAAO,EAAE,gEAAgE,EAAE;SAC1F,CAAC;KACH,CAAC,CAAC;IACL,MAAM,SAAS,CAAC,MAAM,EAAE,8CAA8C,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,SAAS,CAAC,MAAM,EAAE,gDAAgD,CAAC,CAAC;IAC1E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpF,MAAM,SAAS,CAAC,MAAM,EAAE,8CAA8C,CAAC,CAAC;IACxE,MAAM,SAAS,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAC;IACvE,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1C,IAAI,KAAK,KAAK,QAAQ;YACpB,MAAM,SAAS,CACb,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,EACvC,yCAAyC,CAC1C,CAAC;QACJ,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;IACpG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,+BAA+B,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAClG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,0BAA0B,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC7F,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAA0B,CAAC,EAC3D,wBAAwB,CACzB,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CACnB,OAAO,EAAE,EACT,QAAQ,EACR,oBAAoB,EACpB,WAAW,EACX,6BAA6B,CAC9B,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CACjB,OAAO,EAAE,EACT,QAAQ,EACR,cAAc,EACd,WAAW,EACX,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,IAAI,CACrB,OAAO,EAAE,EACT,QAAQ,EACR,cAAc,EACd,WAAW,EACX,eAAe,EACf,qBAAqB,CACtB,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;IACxC,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,kDAAkD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,gDAAgD,CAAC;IACrJ,MAAM,OAAO,GAAG,sDAAsD,IAAI,iBAAiB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,2DAA2D,CAAC;IACxL,MAAM,MAAM,GAAG,qDAAqD,IAAI,kBAAkB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3M,MAAM,MAAM,GAAG,yCAAyC,IAAI,+BAA+B,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,UAAU,CAAC,0EAA0E,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,wCAAwC,CAAC;IAC7X,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACtC,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;KACrF,CAAC,CAAC;IACL,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC,aAAa,CAAC;QAC7E,kBAAkB,EAAE,MAAM;QAC1B,wBAAwB,EAAE,MAAM,CAAC,gBAAgB,CAC/C,kFAAkF,CACnF;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACrD,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YACzB,SAAS,EAAE,cAAc;YACzB,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;SAC5B,CAAC;KACH,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI;QACpB,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC;QACrC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC;QAC3C,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;QACtD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,OAAO,CACb,CAAC,CAAC,QAAQ,CAAC,EACX,CAAC,CACC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,6BAA6B,CAAC,CAC5F,CACF;QACD,OAAO,CAAC,OAAO,CACb,CAAC,CAAC,QAAQ,CAAC,EACX,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,OAAO,EAAE,6BAA6B,CAAC,CAAC,CAC3F;QACD,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,uBAAuB,CAAC;QACpD,GAAG,MAAM,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE;QACnC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,QAAQ,eAAe,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACxF,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CACZ,CAAC,CAAC,KAAK,CAAC,EACR,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAChF;QACD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7D,GAAG,MAAM,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE;QACvC,GAAG,MAAM,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE;QACxC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE;QAC3B,wCAAwC,CAAC,CAAC,OAAO,CAAC,EAAE;QACpD,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,uBAAuB,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;KACzE,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;IACrG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACjF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,UAAkC,EAAE,EAAE,CACpD,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;QACtC,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;KAC5E,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI;QAChB,+DAA+D;QAC/D,iEAAiE;QACjE,4DAA4D;QAC5D,2DAA2D;QAC3D,mDAAmD;QACnD,gDAAgD;QAChD,kDAAkD;QAClD,gDAAgD;QAChD,oDAAoD;QACpD,+CAA+C;QAC/C,sEAAsE;QACtE,uDAAuD;QACvD,+BAA+B;QAC/B,oCAAoC;QACpC,0EAA0E;QAC1E,kGAAkG;QAClG,yFAAyF;QACzF,qFAAqF;QACrF,sBAAsB;QACtB,8BAA8B;QAC9B,0BAA0B;QAC1B,4BAA4B;QAC5B,gCAAgC;QAChC,kCAAkC;QAClC,6BAA6B;QAC7B,+BAA+B;QAC/B,+BAA+B;QAC/B,iDAAiD;QACjD,yCAAyC;QACzC,2CAA2C;QAC3C,kCAAkC;QAClC,+BAA+B;QAC/B,yCAAyC;QACzC,gCAAgC;QAChC,oCAAoC;QACpC,oCAAoC;QACpC,4CAA4C;QAC5C,sDAAsD;QACtD,qCAAqC;QACrC,gDAAgD;QAChD,oDAAoD;QACpD,mCAAmC;QACnC,qCAAqC;QACrC,4DAA4D;QAC5D,kEAAkE;QAClE,oCAAoC;QACpC,+EAA+E;QAC/E,qBAAqB;QACrB,4BAA4B;QAC5B,sBAAsB;QACtB,sBAAsB;KACvB,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,4BAA4B;QAC5B,8BAA8B;QAC9B,iCAAiC;QACjC,0DAA0D;KAC3D,EAAE,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,OAAO,GACX,4OAA4O,CAAC;IAC/O,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI;QACjB,kCAAkC;QAClC,gCAAgC;QAChC,yCAAyC;KAC1C,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,uCAAuC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,8BAA8B;QAC9B,oDAAoD;QACpD,6DAA6D;QAC7D,OAAO,CAAC,OAAO,CAAC,uCAAuC,EAAE,QAAQ,CAAC;QAClE,OAAO,CAAC,OAAO,CACb,uCAAuC,EACvC,wCAAwC,CACzC;QACD,GAAG,OAAO,2BAA2B;KACtC,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC;QAC3B,GAAG,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG;KAC5E,CAAC,CAAC;IACH,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI;QAC1B;YACE,eAAe,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU;YACjE,kCAAkC;SACnC;QACD;YACE,qBAAqB,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU;YACvE,kCAAkC;SACnC;QACD;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,GAAG,KAAK,SAAS,KAAK,QAAQ,KAAK,UAAU,EAAE,CAAC,GAAG;YAClG,kCAAkC;SACnC;QACD,CAAC,qCAAqC,EAAE,kCAAkC,CAAC;QAC3E;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,GAAG;YACtE,kCAAkC;SACnC;QACD;YACE,gBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC,GAAG;YAC1E,kCAAkC;SACnC;QACD,CAAC,+BAA+B,GAAG,MAAM,EAAE,uCAAuC,CAAC;KAC3E,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,CAAC;QAC/B,GAAG,EAAE,wIAAwI;KAC9I,CAAC,CAAC;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,MAAM,CAAC;QAC1B,GAAG,EAAE,6NAA6N;KACnO,CAAC,CAAC;IACH,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,mBAAmB,GAAG,MAAM,CAAC;QACjC,GAAG,EAAE,qEAAqE;KAC3E,CAAC,CAAC;IACH,MAAM,CACJ,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,wBAAwB,CACnF,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;IACrD,MAAM,CACJ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,8CAA8C,EAAE,CAAC,CAAC,MAAM,CAAC;SAC/E,kBAAkB,CAAC,kBAAkB,CACzC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACf,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzF,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,GAAG,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC"}

package/dist/services/codex-pre-tool-host-context-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-host-context-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-host-context-template.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,gCAAgC,QAyK5C,CAAC"}
+{"version":3,"file":"codex-pre-tool-host-context-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-host-context-template.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,gCAAgC,QA+L5C,CAAC"}

package/dist/services/codex-pre-tool-host-context-template.js

@@ -1,8 +1,30 @@
 import { CODEX_LITERAL_READ_SEQUENCE } from "./codex-literal-read-sequence-template.js";
+import { CODEX_NODE_OPTIONS_SUPPORT } from "./codex-node-options-template.js";
 export const CODEX_PRE_TOOL_HOST_CONTEXT_HOOK = String.raw `import { execFile } from "node:child_process";
 import { lstat, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, resolve, toNamespacedPath } from "node:path";
 import { promisify } from "node:util";
+export function explicitPathCandidates(command) {
+  const withoutUrls = command.replace(/https?:\/\/[^\s"'\x60]+/gi, "");
+  const candidates = new Set();
+  for (const match of withoutUrls.matchAll(/["']([A-Za-z]:[\\/][^"']+)["']/g)) {
+    candidates.add(match[1]);
+  }
+  for (const match of withoutUrls.matchAll(/(?:^|[\s=(:,])([A-Za-z]:[\\/][^\s"'\x60;|&),]+)/g)) {
+    candidates.add(match[1]);
+  }
+  for (const match of withoutUrls.matchAll(/["']([^"']*\.\.[\\/][^"']*)["']/g)) {
+    candidates.add(match[1]);
+  }
+  for (const match of withoutUrls.matchAll(/(?:^|[\s=(:,])(\.\.[\\/][^\s"'\x60;|&),]+)/g)) {
+    candidates.add(match[1]);
+  }
+  return [...candidates].map(unquote).filter(Boolean);
+}
+export function unquote(value) {
+  return value.trim().replace(/^["']|["']$/g, "");
+}
+
 const execute = promisify(execFile);
 const pathIdentity = value => process.platform === "win32" ? toNamespacedPath(resolve(value)).toLowerCase() : resolve(value);
 
@@ -168,5 +190,6 @@ async function selectHookExecutionWorkspace(installedRoot, event, allowExternal
 return { configuredPermissionProfile, selectHookRepositoryRoot, selectHookExecutionWorkspace };
 }
 ${CODEX_LITERAL_READ_SEQUENCE}
+${CODEX_NODE_OPTIONS_SUPPORT.replace("function validateNodeEntrypoint", "export function validateNodeEntrypoint")}
 `;
 //# sourceMappingURL=codex-pre-tool-host-context-template.js.map

package/dist/services/codex-pre-tool-host-context-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-host-context-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-host-context-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AAExF,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwKxD,2BAA2B;CAC5B,CAAC"}
+{"version":3,"file":"codex-pre-tool-host-context-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-host-context-template.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAE9E,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6LxD,2BAA2B;EAC3B,0BAA0B,CAAC,OAAO,CAAC,iCAAiC,EAAE,wCAAwC,CAAC;CAChH,CAAC"}

package/dist/services/codex-pre-tool-policy-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-policy-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-policy-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,QAsIxC,CAAC"}
+{"version":3,"file":"codex-pre-tool-policy-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-policy-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,QAwIxC,CAAC"}

package/dist/services/codex-pre-tool-policy-template.js

@@ -4,8 +4,10 @@ import { lstat, readFile, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
-import { captureCliTurn, createHookBudget, checkDestructivePatterns, configuredDeploymentBranches, configuredPermissionProfile, executionPolicyCommand, gitInvocation, inside, isCurrentRepositoryRead, isLiteralReadSequence, readBoundedCanonicalText, requiresShellMutationRun, reviewedContextReadPaths, reviewedReleasePaths, rewriteCliInput, selectHookExecutionWorkspace, selectHookRepositoryRoot, shellSyntax, tokenizeLiteralCommand, validateHashicorpRead, validateInlineExecution } from "./zaip-pre-tool-support.mjs";
+import { assertCanonicalFilesystemPath, captureCliTurn, createHookBudget, checkDestructivePatterns, configuredDeploymentBranches, configuredPermissionProfile, executionPolicyCommand, explicitPathCandidates, gitInvocation, inside, isCurrentRepositoryRead, isLiteralReadSequence, readBoundedCanonicalText, requiresShellMutationRun, reviewedContextReadPaths, reviewedDotenvFileListing, reviewedLegacyWorkspacePaths, reviewedReleasePaths, rewriteCliInput, selectHookExecutionWorkspace, selectHookRepositoryRoot, shellSyntax, tokenizeLiteralCommand, unquote, patchPaths, validateHashicorpRead, validateInlineExecution, withoutLiteralSearchPatterns } from "./zaip-pre-tool-support.mjs";
 import { createCloudValidators } from "./zaip-pre-tool-cloud.mjs";
+import { createGithubSetupValidators } from "./zaip-pre-tool-github-setup.mjs";
+import { enforceRepositoryProfile } from "./zaip-repository-profile.mjs";
 const { execute, parseEvent } = createHookBudget(promisify(execFile));
 const nativeAuthority = await import("./zaip-native-tool-authority.mjs").catch(() => null);
 const activation = await import("./zaip-hook-activation.mjs").catch(() => null);
@@ -71,8 +73,8 @@ const destructivePatterns = [
     reason: "Broad Git staging is blocked; authorized deploy commits require explicit pathspecs.",
   },
   {
-    pattern: /\bgit\s+(?:remote\s+(?:add|set-url|remove|rename)|config\b[\s\S]*(?:sshCommand|credential|url\.))/i,
-    reason: "Remote, SSH, and credential configuration changes are blocked.",
+    pattern: /\bgit\s+remote\s+(?:add|set-url|remove|rename)/i,
+    reason: "Direct remote, SSH, and credential changes are blocked; authorized onboarding uses zaip-skill-github-setup/scripts/setup.mjs.",
   },
   {
     pattern: /\bgh(?:\.exe)?\b[\s\S]*\s(?:--repo|-R)(?:=|\s|(?=[A-Za-z0-9]))/i,

package/dist/services/codex-pre-tool-policy-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-policy-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-policy-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsIrD,CAAC"}
+{"version":3,"file":"codex-pre-tool-policy-template.js","sourceRoot":"","sources":["../../src/services/codex-pre-tool-policy-template.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwIrD,CAAC"}

package/dist/services/codex-pre-tool-release-review-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pre-tool-release-review-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-release-review-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,QAgGzC,CAAC"}
+{"version":3,"file":"codex-pre-tool-release-review-template.d.ts","sourceRoot":"","sources":["../../src/services/codex-pre-tool-release-review-template.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,QA+PzC,CAAC"}