@zgsm/costrict-cli 0.0.1

package/dist/src/config/policy-engine.integration.test.js

@@ -0,0 +1,291 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect } from 'vitest';
+import { ApprovalMode, PolicyDecision, PolicyEngine, } from '@google/gemini-cli-core';
+import { createPolicyEngineConfig } from './policy.js';
+describe('Policy Engine Integration Tests', () => {
+    describe('Policy configuration produces valid PolicyEngine config', () => {
+        it('should create a working PolicyEngine from basic settings', async () => {
+            const settings = {
+                tools: {
+                    allowed: ['run_shell_command'],
+                    exclude: ['write_file'],
+                },
+            };
+            const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+            const engine = new PolicyEngine(config);
+            // Allowed tool should be allowed
+            expect((await engine.check({ name: 'run_shell_command' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+            // Excluded tool should be denied
+            expect((await engine.check({ name: 'write_file' }, undefined)).decision).toBe(PolicyDecision.DENY);
+            // Other write tools should ask user
+            expect((await engine.check({ name: 'replace' }, undefined)).decision).toBe(PolicyDecision.ASK_USER);
+            // Unknown tools should use default
+            expect((await engine.check({ name: 'unknown_tool' }, undefined)).decision).toBe(PolicyDecision.ASK_USER);
+        });
+        it('should handle MCP server wildcard patterns correctly', async () => {
+            const settings = {
+                mcp: {
+                    allowed: ['allowed-server'],
+                    excluded: ['blocked-server'],
+                },
+                mcpServers: {
+                    'trusted-server': {
+                        command: 'node',
+                        args: ['server.js'],
+                        trust: true,
+                    },
+                },
+            };
+            const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+            const engine = new PolicyEngine(config);
+            // Tools from allowed server should be allowed
+            // Tools from allowed server should be allowed
+            expect((await engine.check({ name: 'allowed-server__tool1' }, undefined))
+                .decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'allowed-server__another_tool' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+            // Tools from trusted server should be allowed
+            expect((await engine.check({ name: 'trusted-server__tool1' }, undefined))
+                .decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'trusted-server__special_tool' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+            // Tools from blocked server should be denied
+            expect((await engine.check({ name: 'blocked-server__tool1' }, undefined))
+                .decision).toBe(PolicyDecision.DENY);
+            expect((await engine.check({ name: 'blocked-server__any_tool' }, undefined))
+                .decision).toBe(PolicyDecision.DENY);
+            // Tools from unknown servers should use default
+            expect((await engine.check({ name: 'unknown-server__tool' }, undefined))
+                .decision).toBe(PolicyDecision.ASK_USER);
+        });
+        it('should correctly prioritize specific tool excludes over MCP server wildcards', async () => {
+            const settings = {
+                mcp: {
+                    allowed: ['my-server'],
+                },
+                tools: {
+                    exclude: ['my-server__dangerous-tool'],
+                },
+            };
+            const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+            const engine = new PolicyEngine(config);
+            // MCP server allowed (priority 2.1) provides general allow for server
+            // MCP server allowed (priority 2.1) provides general allow for server
+            expect((await engine.check({ name: 'my-server__safe-tool' }, undefined))
+                .decision).toBe(PolicyDecision.ALLOW);
+            // But specific tool exclude (priority 2.4) wins over server allow
+            expect((await engine.check({ name: 'my-server__dangerous-tool' }, undefined))
+                .decision).toBe(PolicyDecision.DENY);
+        });
+        it('should handle complex mixed configurations', async () => {
+            const settings = {
+                tools: {
+                    autoAccept: true, // Allows read-only tools
+                    allowed: ['custom-tool', 'my-server__special-tool'],
+                    exclude: ['glob', 'dangerous-tool'],
+                },
+                mcp: {
+                    allowed: ['allowed-server'],
+                    excluded: ['blocked-server'],
+                },
+                mcpServers: {
+                    'trusted-server': {
+                        command: 'node',
+                        args: ['server.js'],
+                        trust: true,
+                    },
+                },
+            };
+            const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+            const engine = new PolicyEngine(config);
+            // Read-only tools should be allowed (autoAccept)
+            expect((await engine.check({ name: 'read_file' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'list_directory' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+            // But glob is explicitly excluded, so it should be denied
+            expect((await engine.check({ name: 'glob' }, undefined)).decision).toBe(PolicyDecision.DENY);
+            // Replace should ask user (normal write tool behavior)
+            expect((await engine.check({ name: 'replace' }, undefined)).decision).toBe(PolicyDecision.ASK_USER);
+            // Explicitly allowed tools
+            expect((await engine.check({ name: 'custom-tool' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'my-server__special-tool' }, undefined))
+                .decision).toBe(PolicyDecision.ALLOW);
+            // MCP server tools
+            expect((await engine.check({ name: 'allowed-server__tool' }, undefined))
+                .decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'trusted-server__tool' }, undefined))
+                .decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'blocked-server__tool' }, undefined))
+                .decision).toBe(PolicyDecision.DENY);
+            // Write tools should ask by default
+            expect((await engine.check({ name: 'write_file' }, undefined)).decision).toBe(PolicyDecision.ASK_USER);
+        });
+        it('should handle YOLO mode correctly', async () => {
+            const settings = {
+                tools: {
+                    exclude: ['dangerous-tool'], // Even in YOLO, excludes should be respected
+                },
+            };
+            const config = await createPolicyEngineConfig(settings, ApprovalMode.YOLO);
+            const engine = new PolicyEngine(config);
+            // Most tools should be allowed in YOLO mode
+            expect((await engine.check({ name: 'run_shell_command' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'write_file' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'unknown_tool' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+            // But explicitly excluded tools should still be denied
+            expect((await engine.check({ name: 'dangerous-tool' }, undefined)).decision).toBe(PolicyDecision.DENY);
+        });
+        it('should handle AUTO_EDIT mode correctly', async () => {
+            const settings = {};
+            const config = await createPolicyEngineConfig(settings, ApprovalMode.AUTO_EDIT);
+            const engine = new PolicyEngine(config);
+            // Edit tools should be allowed in AUTO_EDIT mode
+            expect((await engine.check({ name: 'replace' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'write_file' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+            // Other tools should follow normal rules
+            expect((await engine.check({ name: 'run_shell_command' }, undefined)).decision).toBe(PolicyDecision.ASK_USER);
+        });
+        it('should verify priority ordering works correctly in practice', async () => {
+            const settings = {
+                tools: {
+                    autoAccept: true, // Priority 50
+                    allowed: ['specific-tool'], // Priority 100
+                    exclude: ['blocked-tool'], // Priority 200
+                },
+                mcp: {
+                    allowed: ['mcp-server'], // Priority 85
+                    excluded: ['blocked-server'], // Priority 195
+                },
+                mcpServers: {
+                    'trusted-server': {
+                        command: 'node',
+                        args: ['server.js'],
+                        trust: true, // Priority 90
+                    },
+                },
+            };
+            const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+            const engine = new PolicyEngine(config);
+            // Test that priorities are applied correctly
+            const rules = config.rules || [];
+            // Find rules and verify their priorities
+            const blockedToolRule = rules.find((r) => r.toolName === 'blocked-tool');
+            expect(blockedToolRule?.priority).toBe(2.4); // Command line exclude
+            const blockedServerRule = rules.find((r) => r.toolName === 'blocked-server__*');
+            expect(blockedServerRule?.priority).toBe(2.9); // MCP server exclude
+            const specificToolRule = rules.find((r) => r.toolName === 'specific-tool');
+            expect(specificToolRule?.priority).toBe(2.3); // Command line allow
+            const trustedServerRule = rules.find((r) => r.toolName === 'trusted-server__*');
+            expect(trustedServerRule?.priority).toBe(2.2); // MCP trusted server
+            const mcpServerRule = rules.find((r) => r.toolName === 'mcp-server__*');
+            expect(mcpServerRule?.priority).toBe(2.1); // MCP allowed server
+            const readOnlyToolRule = rules.find((r) => r.toolName === 'glob');
+            // Priority 50 in default tier → 1.05
+            expect(readOnlyToolRule?.priority).toBeCloseTo(1.05, 5);
+            // Verify the engine applies these priorities correctly
+            expect((await engine.check({ name: 'blocked-tool' }, undefined)).decision).toBe(PolicyDecision.DENY);
+            expect((await engine.check({ name: 'blocked-server__any' }, undefined))
+                .decision).toBe(PolicyDecision.DENY);
+            expect((await engine.check({ name: 'specific-tool' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'trusted-server__any' }, undefined))
+                .decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'mcp-server__any' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+            expect((await engine.check({ name: 'glob' }, undefined)).decision).toBe(PolicyDecision.ALLOW);
+        });
+        it('should handle edge case: MCP server with both trust and exclusion', async () => {
+            const settings = {
+                mcpServers: {
+                    'conflicted-server': {
+                        command: 'node',
+                        args: ['server.js'],
+                        trust: true, // Priority 90 - ALLOW
+                    },
+                },
+                mcp: {
+                    excluded: ['conflicted-server'], // Priority 195 - DENY
+                },
+            };
+            const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+            const engine = new PolicyEngine(config);
+            // Exclusion (195) should win over trust (90)
+            expect((await engine.check({ name: 'conflicted-server__tool' }, undefined))
+                .decision).toBe(PolicyDecision.DENY);
+        });
+        it('should handle edge case: specific tool allowed but server excluded', async () => {
+            const settings = {
+                mcp: {
+                    excluded: ['my-server'], // Priority 195 - DENY
+                },
+                tools: {
+                    allowed: ['my-server__special-tool'], // Priority 100 - ALLOW
+                },
+            };
+            const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+            const engine = new PolicyEngine(config);
+            // Server exclusion (195) wins over specific tool allow (100)
+            // This might be counterintuitive but follows the priority system
+            expect((await engine.check({ name: 'my-server__special-tool' }, undefined))
+                .decision).toBe(PolicyDecision.DENY);
+            expect((await engine.check({ name: 'my-server__other-tool' }, undefined))
+                .decision).toBe(PolicyDecision.DENY);
+        });
+        it('should verify non-interactive mode transformation', async () => {
+            const settings = {};
+            const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+            // Enable non-interactive mode
+            const engineConfig = { ...config, nonInteractive: true };
+            const engine = new PolicyEngine(engineConfig);
+            // ASK_USER should become DENY in non-interactive mode
+            expect((await engine.check({ name: 'unknown_tool' }, undefined)).decision).toBe(PolicyDecision.DENY);
+            expect((await engine.check({ name: 'run_shell_command' }, undefined)).decision).toBe(PolicyDecision.DENY);
+        });
+        it('should handle empty settings gracefully', async () => {
+            const settings = {};
+            const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+            const engine = new PolicyEngine(config);
+            // Should have default rules for write tools
+            expect((await engine.check({ name: 'write_file' }, undefined)).decision).toBe(PolicyDecision.ASK_USER);
+            expect((await engine.check({ name: 'replace' }, undefined)).decision).toBe(PolicyDecision.ASK_USER);
+            // Unknown tools should use default
+            expect((await engine.check({ name: 'unknown' }, undefined)).decision).toBe(PolicyDecision.ASK_USER);
+        });
+        it('should verify rules are created with correct priorities', async () => {
+            const settings = {
+                tools: {
+                    autoAccept: true,
+                    allowed: ['tool1', 'tool2'],
+                    exclude: ['tool3'],
+                },
+                mcp: {
+                    allowed: ['server1'],
+                    excluded: ['server2'],
+                },
+            };
+            const config = await createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+            const rules = config.rules || [];
+            // Verify each rule has the expected priority
+            const tool3Rule = rules.find((r) => r.toolName === 'tool3');
+            expect(tool3Rule?.priority).toBe(2.4); // Excluded tools (user tier)
+            const server2Rule = rules.find((r) => r.toolName === 'server2__*');
+            expect(server2Rule?.priority).toBe(2.9); // Excluded servers (user tier)
+            const tool1Rule = rules.find((r) => r.toolName === 'tool1');
+            expect(tool1Rule?.priority).toBe(2.3); // Allowed tools (user tier)
+            const server1Rule = rules.find((r) => r.toolName === 'server1__*');
+            expect(server1Rule?.priority).toBe(2.1); // Allowed servers (user tier)
+            const globRule = rules.find((r) => r.toolName === 'glob');
+            // Priority 50 in default tier → 1.05
+            expect(globRule?.priority).toBeCloseTo(1.05, 5); // Auto-accept read-only
+            // The PolicyEngine will sort these by priority when it's created
+            const engine = new PolicyEngine(config);
+            const sortedRules = engine.getRules();
+            // Verify the engine sorted them correctly
+            for (let i = 1; i < sortedRules.length; i++) {
+                const prevPriority = sortedRules[i - 1].priority ?? 0;
+                const currPriority = sortedRules[i].priority ?? 0;
+                expect(prevPriority).toBeGreaterThanOrEqual(currPriority);
+            }
+        });
+    });
+});
+//# sourceMappingURL=policy-engine.integration.test.js.map

package/dist/src/config/policy-engine.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-engine.integration.test.js","sourceRoot":"","sources":["../../../src/config/policy-engine.integration.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,cAAc,EACd,YAAY,GACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAGvD,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACvE,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YACxE,MAAM,QAAQ,GAAa;gBACzB,KAAK,EAAE;oBACL,OAAO,EAAE,CAAC,mBAAmB,CAAC;oBAC9B,OAAO,EAAE,CAAC,YAAY,CAAC;iBACxB;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,QAAQ,EACR,YAAY,CAAC,OAAO,CACrB,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YAExC,iCAAiC;YACjC,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACxE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAE7B,iCAAiC;YACjC,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACjE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAE5B,oCAAoC;YACpC,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAC9D,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAEhC,mCAAmC;YACnC,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACnE,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,QAAQ,GAAa;gBACzB,GAAG,EAAE;oBACH,OAAO,EAAE,CAAC,gBAAgB,CAAC;oBAC3B,QAAQ,EAAE,CAAC,gBAAgB,CAAC;iBAC7B;gBACD,UAAU,EAAE;oBACV,gBAAgB,EAAE;wBAChB,OAAO,EAAE,MAAM;wBACf,IAAI,EAAE,CAAC,WAAW,CAAC;wBACnB,KAAK,EAAE,IAAI;qBACZ;iBACF;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,QAAQ,EACR,YAAY,CAAC,OAAO,CACrB,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YAExC,8CAA8C;YAC9C,8CAA8C;YAC9C,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,SAAS,CAAC,CAAC;iBAC/D,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CACJ,CACE,MAAM,MAAM,CAAC,KAAK,CAChB,EAAE,IAAI,EAAE,8BAA8B,EAAE,EACxC,SAAS,CACV,CACF,CAAC,QAAQ,CACX,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAE7B,8CAA8C;YAC9C,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,SAAS,CAAC,CAAC;iBAC/D,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CACJ,CACE,MAAM,MAAM,CAAC,KAAK,CAChB,EAAE,IAAI,EAAE,8BAA8B,EAAE,EACxC,SAAS,CACV,CACF,CAAC,QAAQ,CACX,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAE7B,6CAA6C;YAC7C,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,SAAS,CAAC,CAAC;iBAC/D,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,SAAS,CAAC,CAAC;iBAClE,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAE5B,gDAAgD;YAChD,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,SAAS,CAAC,CAAC;iBAC9D,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;YAC5F,MAAM,QAAQ,GAAa;gBACzB,GAAG,EAAE;oBACH,OAAO,EAAE,CAAC,WAAW,CAAC;iBACvB;gBACD,KAAK,EAAE;oBACL,OAAO,EAAE,CAAC,2BAA2B,CAAC;iBACvC;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,QAAQ,EACR,YAAY,CAAC,OAAO,CACrB,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YAExC,sEAAsE;YACtE,sEAAsE;YACtE,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,SAAS,CAAC,CAAC;iBAC9D,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7B,kEAAkE;YAClE,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE,SAAS,CAAC,CAAC;iBACnE,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,QAAQ,GAAa;gBACzB,KAAK,EAAE;oBACL,UAAU,EAAE,IAAI,EAAE,yBAAyB;oBAC3C,OAAO,EAAE,CAAC,aAAa,EAAE,yBAAyB,CAAC;oBACnD,OAAO,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC;iBACpC;gBACD,GAAG,EAAE;oBACH,OAAO,EAAE,CAAC,gBAAgB,CAAC;oBAC3B,QAAQ,EAAE,CAAC,gBAAgB,CAAC;iBAC7B;gBACD,UAAU,EAAE;oBACV,gBAAgB,EAAE;wBAChB,OAAO,EAAE,MAAM;wBACf,IAAI,EAAE,CAAC,WAAW,CAAC;wBACnB,KAAK,EAAE,IAAI;qBACZ;iBACF;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,QAAQ,EACR,YAAY,CAAC,OAAO,CACrB,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YAExC,iDAAiD;YACjD,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAChE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACrE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAE7B,0DAA0D;YAC1D,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CACrE,cAAc,CAAC,IAAI,CACpB,CAAC;YAEF,uDAAuD;YACvD,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAC9D,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAEhC,2BAA2B;YAC3B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAClE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,EAAE,SAAS,CAAC,CAAC;iBACjE,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAE7B,mBAAmB;YACnB,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,SAAS,CAAC,CAAC;iBAC9D,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,SAAS,CAAC,CAAC;iBAC9D,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,SAAS,CAAC,CAAC;iBAC9D,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAE5B,oCAAoC;YACpC,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACjE,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,QAAQ,GAAa;gBACzB,KAAK,EAAE;oBACL,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,6CAA6C;iBAC3E;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,QAAQ,EACR,YAAY,CAAC,IAAI,CAClB,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YAExC,4CAA4C;YAC5C,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACxE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACjE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACnE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAE7B,uDAAuD;YACvD,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACrE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAE9B,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,QAAQ,EACR,YAAY,CAAC,SAAS,CACvB,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YAExC,iDAAiD;YACjD,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAC9D,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACjE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAE7B,yCAAyC;YACzC,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACxE,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;YAC3E,MAAM,QAAQ,GAAa;gBACzB,KAAK,EAAE;oBACL,UAAU,EAAE,IAAI,EAAE,cAAc;oBAChC,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE,eAAe;oBAC3C,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe;iBAC3C;gBACD,GAAG,EAAE;oBACH,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,cAAc;oBACvC,QAAQ,EAAE,CAAC,gBAAgB,CAAC,EAAE,eAAe;iBAC9C;gBACD,UAAU,EAAE;oBACV,gBAAgB,EAAE;wBAChB,OAAO,EAAE,MAAM;wBACf,IAAI,EAAE,CAAC,WAAW,CAAC;wBACnB,KAAK,EAAE,IAAI,EAAE,cAAc;qBAC5B;iBACF;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,QAAQ,EACR,YAAY,CAAC,OAAO,CACrB,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YAExC,6CAA6C;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;YAEjC,yCAAyC;YACzC,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,CAAC;YACzE,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,uBAAuB;YAEpE,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,mBAAmB,CAC1C,CAAC;YACF,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB;YAEpE,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,eAAe,CACtC,CAAC;YACF,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB;YAEnE,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,mBAAmB,CAC1C,CAAC;YACF,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB;YAEpE,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC;YACxE,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB;YAEhE,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;YAClE,qCAAqC;YACrC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAExD,uDAAuD;YACvD,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACnE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,EAAE,SAAS,CAAC,CAAC;iBAC7D,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACpE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,EAAE,SAAS,CAAC,CAAC;iBAC7D,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACtE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CACrE,cAAc,CAAC,KAAK,CACrB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;YACjF,MAAM,QAAQ,GAAa;gBACzB,UAAU,EAAE;oBACV,mBAAmB,EAAE;wBACnB,OAAO,EAAE,MAAM;wBACf,IAAI,EAAE,CAAC,WAAW,CAAC;wBACnB,KAAK,EAAE,IAAI,EAAE,sBAAsB;qBACpC;iBACF;gBACD,GAAG,EAAE;oBACH,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;iBACxD;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,QAAQ,EACR,YAAY,CAAC,OAAO,CACrB,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YAExC,6CAA6C;YAC7C,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,EAAE,SAAS,CAAC,CAAC;iBACjE,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;YAClF,MAAM,QAAQ,GAAa;gBACzB,GAAG,EAAE;oBACH,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,sBAAsB;iBAChD;gBACD,KAAK,EAAE;oBACL,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE,uBAAuB;iBAC9D;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,QAAQ,EACR,YAAY,CAAC,OAAO,CACrB,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YAExC,6DAA6D;YAC7D,iEAAiE;YACjE,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,EAAE,SAAS,CAAC,CAAC;iBACjE,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,SAAS,CAAC,CAAC;iBAC/D,QAAQ,CACZ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,QAAQ,GAAa,EAAE,CAAC;YAE9B,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,QAAQ,EACR,YAAY,CAAC,OAAO,CACrB,CAAC;YACF,8BAA8B;YAC9B,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;YAE9C,sDAAsD;YACtD,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACnE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACxE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAE9B,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,QAAQ,EACR,YAAY,CAAC,OAAO,CACrB,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YAExC,4CAA4C;YAC5C,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CACjE,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChC,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAC9D,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAEhC,mCAAmC;YACnC,MAAM,CACJ,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAC9D,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACvE,MAAM,QAAQ,GAAa;gBACzB,KAAK,EAAE;oBACL,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;oBAC3B,OAAO,EAAE,CAAC,OAAO,CAAC;iBACnB;gBACD,GAAG,EAAE;oBACH,OAAO,EAAE,CAAC,SAAS,CAAC;oBACpB,QAAQ,EAAE,CAAC,SAAS,CAAC;iBACtB;aACF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,QAAQ,EACR,YAAY,CAAC,OAAO,CACrB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;YAEjC,6CAA6C;YAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;YAC5D,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,6BAA6B;YAEpE,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC;YACnE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,+BAA+B;YAExE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;YAC5D,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,4BAA4B;YAEnE,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC;YACnE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,8BAA8B;YAEvE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;YAC1D,qCAAqC;YACrC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,wBAAwB;YAEzE,iEAAiE;YACjE,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAEtC,0CAA0C;YAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;gBACtD,MAAM,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;gBAClD,MAAM,CAAC,YAAY,CAAC,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/config/policy.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type PolicyEngineConfig, type ApprovalMode, type PolicyEngine, type MessageBus } from '@google/gemini-cli-core';
+import { type Settings } from './settings.js';
+export declare function createPolicyEngineConfig(settings: Settings, approvalMode: ApprovalMode): Promise<PolicyEngineConfig>;
+export declare function createPolicyUpdater(policyEngine: PolicyEngine, messageBus: MessageBus): void;

package/dist/src/config/policy.js

@@ -0,0 +1,21 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { createPolicyEngineConfig as createCorePolicyEngineConfig, createPolicyUpdater as createCorePolicyUpdater, } from '@google/gemini-cli-core';
+import {} from './settings.js';
+export async function createPolicyEngineConfig(settings, approvalMode) {
+    // Explicitly construct PolicySettings from Settings to ensure type safety
+    // and avoid accidental leakage of other settings properties.
+    const policySettings = {
+        mcp: settings.mcp,
+        tools: settings.tools,
+        mcpServers: settings.mcpServers,
+    };
+    return createCorePolicyEngineConfig(policySettings, approvalMode);
+}
+export function createPolicyUpdater(policyEngine, messageBus) {
+    return createCorePolicyUpdater(policyEngine, messageBus);
+}
+//# sourceMappingURL=policy.js.map

package/dist/src/config/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/config/policy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAML,wBAAwB,IAAI,4BAA4B,EACxD,mBAAmB,IAAI,uBAAuB,GAC/C,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAiB,MAAM,eAAe,CAAC;AAE9C,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAkB,EAClB,YAA0B;IAE1B,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,cAAc,GAAmB;QACrC,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;IAEF,OAAO,4BAA4B,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,YAA0B,EAC1B,UAAsB;IAEtB,OAAO,uBAAuB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC"}

package/dist/src/config/sandboxConfig.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type SandboxConfig } from '@google/gemini-cli-core';
+import type { Settings } from './settings.js';
+interface SandboxCliArgs {
+    sandbox?: boolean | string | null;
+}
+export declare function loadSandboxConfig(settings: Settings, argv: SandboxCliArgs): Promise<SandboxConfig | undefined>;
+export {};

package/dist/src/config/sandboxConfig.js

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { getPackageJson, FatalSandboxError, } from '@google/gemini-cli-core';
+import commandExists from 'command-exists';
+import * as os from 'node:os';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const VALID_SANDBOX_COMMANDS = [
+    'docker',
+    'podman',
+    'sandbox-exec',
+];
+function isSandboxCommand(value) {
+    return VALID_SANDBOX_COMMANDS.includes(value);
+}
+function getSandboxCommand(sandbox) {
+    // If the SANDBOX env var is set, we're already inside the sandbox.
+    if (process.env['SANDBOX']) {
+        return '';
+    }
+    // note environment variable takes precedence over argument (from command line or settings)
+    const environmentConfiguredSandbox = process.env['GEMINI_SANDBOX']?.toLowerCase().trim() ?? '';
+    sandbox =
+        environmentConfiguredSandbox?.length > 0
+            ? environmentConfiguredSandbox
+            : sandbox;
+    if (sandbox === '1' || sandbox === 'true')
+        sandbox = true;
+    else if (sandbox === '0' || sandbox === 'false' || !sandbox)
+        sandbox = false;
+    if (sandbox === false) {
+        return '';
+    }
+    if (typeof sandbox === 'string' && sandbox) {
+        if (!isSandboxCommand(sandbox)) {
+            throw new FatalSandboxError(`Invalid sandbox command '${sandbox}'. Must be one of ${VALID_SANDBOX_COMMANDS.join(', ')}`);
+        }
+        // confirm that specified command exists
+        if (commandExists.sync(sandbox)) {
+            return sandbox;
+        }
+        throw new FatalSandboxError(`Missing sandbox command '${sandbox}' (from GEMINI_SANDBOX)`);
+    }
+    // look for seatbelt, docker, or podman, in that order
+    // for container-based sandboxing, require sandbox to be enabled explicitly
+    if (os.platform() === 'darwin' && commandExists.sync('sandbox-exec')) {
+        return 'sandbox-exec';
+    }
+    else if (commandExists.sync('docker') && sandbox === true) {
+        return 'docker';
+    }
+    else if (commandExists.sync('podman') && sandbox === true) {
+        return 'podman';
+    }
+    // throw an error if user requested sandbox but no command was found
+    if (sandbox === true) {
+        throw new FatalSandboxError('GEMINI_SANDBOX is true but failed to determine command for sandbox; ' +
+            'install docker or podman or specify command in GEMINI_SANDBOX');
+    }
+    return '';
+}
+export async function loadSandboxConfig(settings, argv) {
+    const sandboxOption = argv.sandbox ?? settings.tools?.sandbox;
+    const command = getSandboxCommand(sandboxOption);
+    const packageJson = await getPackageJson(__dirname);
+    const image = process.env['GEMINI_SANDBOX_IMAGE'] ?? packageJson?.config?.sandboxImageUri;
+    return command && image ? { command, image } : undefined;
+}
+//# sourceMappingURL=sandboxConfig.js.map

package/dist/src/config/sandboxConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxConfig.js","sourceRoot":"","sources":["../../../src/config/sandboxConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,cAAc,EAEd,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,aAAa,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAO3C,MAAM,sBAAsB,GAA4C;IACtE,QAAQ;IACR,QAAQ;IACR,cAAc;CACf,CAAC;AAEF,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAQ,sBAA4C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAiC;IAEjC,mEAAmE;IACnE,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,2FAA2F;IAC3F,MAAM,4BAA4B,GAChC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,OAAO;QACL,4BAA4B,EAAE,MAAM,GAAG,CAAC;YACtC,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,OAAO,CAAC;IACd,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,GAAG,IAAI,CAAC;SACrD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,OAAO,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,KAAK,CAAC;IAE7E,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,iBAAiB,CACzB,4BAA4B,OAAO,qBAAqB,sBAAsB,CAAC,IAAI,CACjF,IAAI,CACL,EAAE,CACJ,CAAC;QACJ,CAAC;QACD,wCAAwC;QACxC,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,iBAAiB,CACzB,4BAA4B,OAAO,yBAAyB,CAC7D,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,2EAA2E;IAC3E,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACrE,OAAO,cAAc,CAAC;IACxB,CAAC;SAAM,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO,QAAQ,CAAC;IAClB,CAAC;SAAM,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,oEAAoE;IACpE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,iBAAiB,CACzB,sEAAsE;YACpE,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAkB,EAClB,IAAoB;IAEpB,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAC9D,MAAM,OAAO,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAEjD,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,WAAW,EAAE,MAAM,EAAE,eAAe,CAAC;IAE9E,OAAO,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC"}

package/dist/src/config/sandboxConfig.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/config/sandboxConfig.test.js

@@ -0,0 +1,178 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { getPackageJson } from '@google/gemini-cli-core';
+import commandExists from 'command-exists';
+import * as os from 'node:os';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { loadSandboxConfig } from './sandboxConfig.js';
+// Mock dependencies
+vi.mock('@google/gemini-cli-core', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        getPackageJson: vi.fn(),
+        FatalSandboxError: class extends Error {
+            constructor(message) {
+                super(message);
+                this.name = 'FatalSandboxError';
+            }
+        },
+    };
+});
+vi.mock('command-exists', () => ({
+    default: {
+        sync: vi.fn(),
+    },
+}));
+vi.mock('node:os', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        platform: vi.fn(),
+    };
+});
+const mockedGetPackageJson = vi.mocked(getPackageJson);
+const mockedCommandExistsSync = vi.mocked(commandExists.sync);
+const mockedOsPlatform = vi.mocked(os.platform);
+describe('loadSandboxConfig', () => {
+    const originalEnv = { ...process.env };
+    beforeEach(() => {
+        vi.resetAllMocks();
+        process.env = { ...originalEnv };
+        mockedGetPackageJson.mockResolvedValue({
+            config: { sandboxImageUri: 'default/image' },
+        });
+    });
+    afterEach(() => {
+        process.env = originalEnv;
+    });
+    it('should return undefined if sandbox is explicitly disabled via argv', async () => {
+        const config = await loadSandboxConfig({}, { sandbox: false });
+        expect(config).toBeUndefined();
+    });
+    it('should return undefined if sandbox is explicitly disabled via settings', async () => {
+        const config = await loadSandboxConfig({ tools: { sandbox: false } }, {});
+        expect(config).toBeUndefined();
+    });
+    it('should return undefined if sandbox is not configured', async () => {
+        const config = await loadSandboxConfig({}, {});
+        expect(config).toBeUndefined();
+    });
+    it('should return undefined if already inside a sandbox (SANDBOX env var is set)', async () => {
+        process.env['SANDBOX'] = '1';
+        const config = await loadSandboxConfig({}, { sandbox: true });
+        expect(config).toBeUndefined();
+    });
+    describe('with GEMINI_SANDBOX environment variable', () => {
+        it('should use docker if GEMINI_SANDBOX=docker and it exists', async () => {
+            process.env['GEMINI_SANDBOX'] = 'docker';
+            mockedCommandExistsSync.mockReturnValue(true);
+            const config = await loadSandboxConfig({}, {});
+            expect(config).toEqual({ command: 'docker', image: 'default/image' });
+            expect(mockedCommandExistsSync).toHaveBeenCalledWith('docker');
+        });
+        it('should throw if GEMINI_SANDBOX is an invalid command', async () => {
+            process.env['GEMINI_SANDBOX'] = 'invalid-command';
+            await expect(loadSandboxConfig({}, {})).rejects.toThrow("Invalid sandbox command 'invalid-command'. Must be one of docker, podman, sandbox-exec");
+        });
+        it('should throw if GEMINI_SANDBOX command does not exist', async () => {
+            process.env['GEMINI_SANDBOX'] = 'docker';
+            mockedCommandExistsSync.mockReturnValue(false);
+            await expect(loadSandboxConfig({}, {})).rejects.toThrow("Missing sandbox command 'docker' (from GEMINI_SANDBOX)");
+        });
+    });
+    describe('with sandbox: true', () => {
+        it('should use sandbox-exec on darwin if available', async () => {
+            mockedOsPlatform.mockReturnValue('darwin');
+            mockedCommandExistsSync.mockImplementation((cmd) => cmd === 'sandbox-exec');
+            const config = await loadSandboxConfig({}, { sandbox: true });
+            expect(config).toEqual({
+                command: 'sandbox-exec',
+                image: 'default/image',
+            });
+        });
+        it('should prefer sandbox-exec over docker on darwin', async () => {
+            mockedOsPlatform.mockReturnValue('darwin');
+            mockedCommandExistsSync.mockReturnValue(true); // all commands exist
+            const config = await loadSandboxConfig({}, { sandbox: true });
+            expect(config).toEqual({
+                command: 'sandbox-exec',
+                image: 'default/image',
+            });
+        });
+        it('should use docker if available and sandbox is true', async () => {
+            mockedOsPlatform.mockReturnValue('linux');
+            mockedCommandExistsSync.mockImplementation((cmd) => cmd === 'docker');
+            const config = await loadSandboxConfig({ tools: { sandbox: true } }, {});
+            expect(config).toEqual({ command: 'docker', image: 'default/image' });
+        });
+        it('should use podman if available and docker is not', async () => {
+            mockedOsPlatform.mockReturnValue('linux');
+            mockedCommandExistsSync.mockImplementation((cmd) => cmd === 'podman');
+            const config = await loadSandboxConfig({}, { sandbox: true });
+            expect(config).toEqual({ command: 'podman', image: 'default/image' });
+        });
+        it('should throw if sandbox: true but no command is found', async () => {
+            mockedOsPlatform.mockReturnValue('linux');
+            mockedCommandExistsSync.mockReturnValue(false);
+            await expect(loadSandboxConfig({}, { sandbox: true })).rejects.toThrow('GEMINI_SANDBOX is true but failed to determine command for sandbox; ' +
+                'install docker or podman or specify command in GEMINI_SANDBOX');
+        });
+    });
+    describe("with sandbox: 'command'", () => {
+        it('should use the specified command if it exists', async () => {
+            mockedCommandExistsSync.mockReturnValue(true);
+            const config = await loadSandboxConfig({}, { sandbox: 'podman' });
+            expect(config).toEqual({ command: 'podman', image: 'default/image' });
+            expect(mockedCommandExistsSync).toHaveBeenCalledWith('podman');
+        });
+        it('should throw if the specified command does not exist', async () => {
+            mockedCommandExistsSync.mockReturnValue(false);
+            await expect(loadSandboxConfig({}, { sandbox: 'podman' })).rejects.toThrow("Missing sandbox command 'podman' (from GEMINI_SANDBOX)");
+        });
+        it('should throw if the specified command is invalid', async () => {
+            await expect(loadSandboxConfig({}, { sandbox: 'invalid-command' })).rejects.toThrow("Invalid sandbox command 'invalid-command'. Must be one of docker, podman, sandbox-exec");
+        });
+    });
+    describe('image configuration', () => {
+        it('should use image from GEMINI_SANDBOX_IMAGE env var if set', async () => {
+            process.env['GEMINI_SANDBOX_IMAGE'] = 'env/image';
+            process.env['GEMINI_SANDBOX'] = 'docker';
+            mockedCommandExistsSync.mockReturnValue(true);
+            const config = await loadSandboxConfig({}, {});
+            expect(config).toEqual({ command: 'docker', image: 'env/image' });
+        });
+        it('should use image from package.json if env var is not set', async () => {
+            process.env['GEMINI_SANDBOX'] = 'docker';
+            mockedCommandExistsSync.mockReturnValue(true);
+            const config = await loadSandboxConfig({}, {});
+            expect(config).toEqual({ command: 'docker', image: 'default/image' });
+        });
+        it('should return undefined if command is found but no image is configured', async () => {
+            mockedGetPackageJson.mockResolvedValue({}); // no sandboxImageUri
+            process.env['GEMINI_SANDBOX'] = 'docker';
+            mockedCommandExistsSync.mockReturnValue(true);
+            const config = await loadSandboxConfig({}, {});
+            expect(config).toBeUndefined();
+        });
+    });
+    describe('truthy/falsy sandbox values', () => {
+        beforeEach(() => {
+            mockedOsPlatform.mockReturnValue('linux');
+            mockedCommandExistsSync.mockImplementation((cmd) => cmd === 'docker');
+        });
+        it.each([true, 'true', '1'])('should enable sandbox for value: %s', async (value) => {
+            const config = await loadSandboxConfig({}, { sandbox: value });
+            expect(config).toEqual({ command: 'docker', image: 'default/image' });
+        });
+        it.each([false, 'false', '0', undefined, null, ''])('should disable sandbox for value: %s', async (value) => {
+            // \`null\` is not a valid type for the arg, but good to test falsiness
+            const config = await loadSandboxConfig({}, { sandbox: value });
+            expect(config).toBeUndefined();
+        });
+    });
+});
+//# sourceMappingURL=sandboxConfig.test.js.map