@zhin.js/agent 1.1.31 → 1.1.33

package/lib/security/file-role-policy.d.ts

@@ -61,9 +61,11 @@ export declare function checkFilePermission(role: FileRole, operation: FileOpera
  *
  * 危险判定规则:
  *  - delete 操作始终视为危险
- *  - read/create/update 对敏感路径视为危险（与 file-policy.checkFileAccess 对齐）
+ *  - 机密路径（.env、密钥、.ssh 等）的任何操作视为危险（与 file-policy.checkFileAccess 对齐）
+ *  - 受保护项目文件（package.json、锁文件、.git/ 等）的写入视为危险；
+ *    读取仅对非 owner 角色视为危险
  */
-export declare function isDangerousFileOperation(operation: FileOperation, filePath: string): boolean;
+export declare function isDangerousFileOperation(operation: FileOperation, filePath: string, role?: FileRole): boolean;
 /**
  * 统一处理文件角色权限门控：拒绝或需 Owner/二次确认时返回工具结果字符串，否则 null。
  */

package/lib/security/file-role-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-role-policy.d.ts","sourceRoot":"","sources":["../../src/security/file-role-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAKhD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;AAElD;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,cAAc;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,4BAA4B;IAC5B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,WAAW;IACX,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY;IACZ,SAAS,EAAE,aAAa,CAAC;CAC1B;AA6DD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,aAAa,EACxB,QAAQ,CAAC,EAAE,MAAM,GAChB,oBAAoB,CAuDtB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI5F;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,oBAAoB,EAChC,QAAQ,EAAE,MAAM,GACf,MAAM,GAAG,IAAI,CAKf;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,GAAG,QAAQ,CAOlF;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAOtG;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAiB/E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,MAAM,GACd,oBAAoB,GAAG;IAAE,aAAa,EAAE,aAAa,GAAG,IAAI,CAAA;CAAE,CAchE;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAanH;AAED;;;GAGG;AACH,wBAAgB,qCAAqC,IAAI,MAAM,CAS9D"}
+{"version":3,"file":"file-role-policy.d.ts","sourceRoot":"","sources":["../../src/security/file-role-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAKhD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;AAElD;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,cAAc;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,4BAA4B;IAC5B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,WAAW;IACX,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY;IACZ,SAAS,EAAE,aAAa,CAAC;CAC1B;AAoED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,aAAa,EACxB,QAAQ,CAAC,EAAE,MAAM,GAChB,oBAAoB,CAuDtB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAM7G;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,oBAAoB,EAChC,QAAQ,EAAE,MAAM,GACf,MAAM,GAAG,IAAI,CAKf;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,GAAG,QAAQ,CAOlF;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAOtG;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAiB/E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,MAAM,GACd,oBAAoB,GAAG;IAAE,aAAa,EAAE,aAAa,GAAG,IAAI,CAAA;CAAE,CAchE;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAanH;AAED;;;GAGG;AACH,wBAAgB,qCAAqC,IAAI,MAAM,CAS9D"}

package/lib/security/file-role-policy.js

@@ -30,10 +30,10 @@ const FILE_PERMISSION_MATRIX = {
 };
 // ── 敏感/危险文件路径判定 ──────────────────────────────────────────
 /**
- * 危险文件路径模式 — 覆盖系统配置、密钥、数据库等关键位置。
- * 对 owner 仍允许操作但需二次确认；对 admin 需 Owner 确认；对 user 直接拒绝。
+ * 机密路径模式 — 系统账户文件、凭据与密钥。任何操作（包括读取）都视为危险：
+ * 对 owner 需二次确认；对 admin 需 Owner 确认；对 user 直接拒绝。
  */
-const DANGEROUS_PATH_PATTERNS = [
+const SECRET_PATH_PATTERNS = [
     /\/etc\/passwd/i,
     /\/etc\/shadow/i,
     /\/etc\/hosts/i,
@@ -45,13 +45,19 @@ const DANGEROUS_PATH_PATTERNS = [
     /\.kube\//i,
     /\.config\/gcloud\//i,
     /\.docker\//i,
+    /\.pem$/i,
+    /\.key$/i,
+];
+/**
+ * 受保护的项目文件 — 改动会影响构建或仓库状态，但内容本身不含机密。
+ * 写入始终视为危险；owner 读取直接放行，其余角色读取仍按危险处理。
+ */
+const PROTECTED_PROJECT_PATH_PATTERNS = [
     /\.git\//i,
     /\/package\.json$/i,
     /\/pnpm-lock\.yaml$/i,
     /\/yarn\.lock$/i,
     /\/tsconfig\.json$/i,
-    /\.pem$/i,
-    /\.key$/i,
 ];
 /**
  * 危险删除命令关键词 — 使用 bash 执行文件删除时匹配。
@@ -97,7 +103,7 @@ export function checkFilePermission(role, operation, filePath) {
             operation,
         };
     }
-    const isDangerous = operation === 'delete' || (filePath ? isDangerousFileOperation(operation, filePath) : false);
+    const isDangerous = operation === 'delete' || (filePath ? isDangerousFileOperation(operation, filePath, role) : false);
     if (isDangerous) {
         if (role === 'user') {
             return {
@@ -139,14 +145,20 @@ export function checkFilePermission(role, operation, filePath) {
  *
  * 危险判定规则:
  *  - delete 操作始终视为危险
- *  - read/create/update 对敏感路径视为危险（与 file-policy.checkFileAccess 对齐）
+ *  - 机密路径（.env、密钥、.ssh 等）的任何操作视为危险（与 file-policy.checkFileAccess 对齐）
+ *  - 受保护项目文件（package.json、锁文件、.git/ 等）的写入视为危险；
+ *    读取仅对非 owner 角色视为危险
  */
-export function isDangerousFileOperation(operation, filePath) {
+export function isDangerousFileOperation(operation, filePath, role) {
     if (operation === 'delete')
         return true;
     if (!checkFileAccess(filePath).allowed)
         return true;
-    return DANGEROUS_PATH_PATTERNS.some(p => p.test(filePath));
+    if (SECRET_PATH_PATTERNS.some(p => p.test(filePath)))
+        return true;
+    if (operation === 'read' && role === 'owner')
+        return false;
+    return PROTECTED_PROJECT_PATH_PATTERNS.some(p => p.test(filePath));
 }
 /**
  * 统一处理文件角色权限门控：拒绝或需 Owner/二次确认时返回工具结果字符串，否则 null。

package/lib/security/file-role-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-role-policy.js","sourceRoot":"","sources":["../../src/security/file-role-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAgCnD,iEAAiE;AAEjE,MAAM,sBAAsB,GAAqD;IAC/E,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;IAC/D,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;IAChE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;CAClE,CAAC;AAEF,4DAA4D;AAE5D;;;GAGG;AACH,MAAM,uBAAuB,GAAa;IACxC,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,UAAU;IACV,YAAY;IACZ,UAAU;IACV,WAAW;IACX,qBAAqB;IACrB,aAAa;IACb,UAAU;IACV,mBAAmB;IACnB,qBAAqB;IACrB,gBAAgB;IAChB,oBAAoB;IACpB,SAAS;IACT,SAAS;CACV,CAAC;AAEF;;GAEG;AACH,MAAM,yBAAyB,GAAa;IAC1C,UAAU;IACV,YAAY;IACZ,aAAa;IACb,eAAe;IACf,YAAY;IACZ,eAAe;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,wBAAwB,GAAa;IACzC,UAAU;IACV,WAAW;IACX,aAAa;IACb,YAAY;CACb,CAAC;AAEF,+DAA+D;AAE/D;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAc,EACd,SAAwB,EACxB,QAAiB;IAEjB,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;IAExD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM;YAC5B,CAAC,CAAC,6BAA6B,SAAS,OAAO;YAC/C,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,KAAK,QAAQ;gBAC1C,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,QAAQ,IAAI,SAAS,SAAS,MAAM,CAAC;QAC3C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM;YACN,IAAI;YACJ,SAAS;SACV,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEjH,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,QAAQ;oBACd,CAAC,CAAC,wBAAwB,QAAQ,IAAI;oBACtC,CAAC,CAAC,sBAAsB,SAAS,MAAM;gBACzC,IAAI;gBACJ,SAAS;aACV,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,iBAAiB,EAAE,IAAI;gBACvB,MAAM,EAAE,QAAQ;oBACd,CAAC,CAAC,SAAS,QAAQ,OAAO,SAAS,YAAY;oBAC/C,CAAC,CAAC,IAAI,SAAS,YAAY;gBAC7B,IAAI;gBACJ,SAAS;aACV,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,sBAAsB,EAAE,IAAI;gBAC5B,MAAM,EAAE,QAAQ;oBACd,CAAC,CAAC,YAAY,QAAQ,OAAO,SAAS,iBAAiB;oBACvD,CAAC,CAAC,SAAS,SAAS,iBAAiB;gBACvC,IAAI;gBACJ,SAAS;aACV,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAwB,EAAE,QAAgB;IACjF,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAgC,EAChC,QAAgB;IAEhB,MAAM,GAAG,GAAG,2BAA2B,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC;IACpC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAA0C;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAgD;IAC1F,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC;QAC9B,KAAK,SAAS,CAAC,CAAC,OAAO,OAAO,CAAC;QAC/B,KAAK,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC;QAC5B,KAAK,SAAS,CAAC,CAAC,OAAO,MAAM,CAAC,CAAE,cAAc;IAChD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE9C,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1E,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpO,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEzE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE5G,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACrM,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAElD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAc,EACd,OAAe;IAEf,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAElD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI;YACJ,SAAS,EAAE,MAAM;YACjB,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAA4B,EAAE,QAAgB,EAAE,MAAe;IACzG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,MAAM,CAAC,SAAS,cAAc,CAAC;QAC/E,OAAO,sBAAsB,IAAI,8CAA8C,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,MAAM,CAAC,SAAS,SAAS,CAAC;QAC1E,OAAO,sBAAsB,IAAI,sCAAsC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qCAAqC;IACnD,OAAO;QACL,+FAA+F;QAC/F,4GAA4G;QAC5G,wHAAwH;QACxH,gHAAgH;QAChH,mIAAmI;QACnI,+LAA+L;KAChM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"file-role-policy.js","sourceRoot":"","sources":["../../src/security/file-role-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAgCnD,iEAAiE;AAEjE,MAAM,sBAAsB,GAAqD;IAC/E,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;IAC/D,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;IAChE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;CAClE,CAAC;AAEF,4DAA4D;AAE5D;;;GAGG;AACH,MAAM,oBAAoB,GAAa;IACrC,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,UAAU;IACV,YAAY;IACZ,UAAU;IACV,WAAW;IACX,qBAAqB;IACrB,aAAa;IACb,SAAS;IACT,SAAS;CACV,CAAC;AAEF;;;GAGG;AACH,MAAM,+BAA+B,GAAa;IAChD,UAAU;IACV,mBAAmB;IACnB,qBAAqB;IACrB,gBAAgB;IAChB,oBAAoB;CACrB,CAAC;AAEF;;GAEG;AACH,MAAM,yBAAyB,GAAa;IAC1C,UAAU;IACV,YAAY;IACZ,aAAa;IACb,eAAe;IACf,YAAY;IACZ,eAAe;CAChB,CAAC;AAEF;;GAEG;AACH,MAAM,wBAAwB,GAAa;IACzC,UAAU;IACV,WAAW;IACX,aAAa;IACb,YAAY;CACb,CAAC;AAEF,+DAA+D;AAE/D;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAc,EACd,SAAwB,EACxB,QAAiB;IAEjB,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;IAExD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM;YAC5B,CAAC,CAAC,6BAA6B,SAAS,OAAO;YAC/C,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,KAAK,QAAQ;gBAC1C,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,QAAQ,IAAI,SAAS,SAAS,MAAM,CAAC;QAC3C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM;YACN,IAAI;YACJ,SAAS;SACV,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEvH,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,QAAQ;oBACd,CAAC,CAAC,wBAAwB,QAAQ,IAAI;oBACtC,CAAC,CAAC,sBAAsB,SAAS,MAAM;gBACzC,IAAI;gBACJ,SAAS;aACV,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,iBAAiB,EAAE,IAAI;gBACvB,MAAM,EAAE,QAAQ;oBACd,CAAC,CAAC,SAAS,QAAQ,OAAO,SAAS,YAAY;oBAC/C,CAAC,CAAC,IAAI,SAAS,YAAY;gBAC7B,IAAI;gBACJ,SAAS;aACV,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,sBAAsB,EAAE,IAAI;gBAC5B,MAAM,EAAE,QAAQ;oBACd,CAAC,CAAC,YAAY,QAAQ,OAAO,SAAS,iBAAiB;oBACvD,CAAC,CAAC,SAAS,SAAS,iBAAiB;gBACvC,IAAI;gBACJ,SAAS;aACV,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAwB,EAAE,QAAgB,EAAE,IAAe;IAClG,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,SAAS,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAgC,EAChC,QAAgB;IAEhB,MAAM,GAAG,GAAG,2BAA2B,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC;IACpC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAA0C;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAgD;IAC1F,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC;QAC9B,KAAK,SAAS,CAAC,CAAC,OAAO,OAAO,CAAC;QAC/B,KAAK,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC;QAC5B,KAAK,SAAS,CAAC,CAAC,OAAO,MAAM,CAAC,CAAE,cAAc;IAChD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE9C,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1E,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpO,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEzE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE5G,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACrM,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAElD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAc,EACd,OAAe;IAEf,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAElD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI;YACJ,SAAS,EAAE,MAAM;YACjB,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAA4B,EAAE,QAAgB,EAAE,MAAe;IACzG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,MAAM,CAAC,SAAS,cAAc,CAAC;QAC/E,OAAO,sBAAsB,IAAI,8CAA8C,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,MAAM,CAAC,SAAS,SAAS,CAAC;QAC1E,OAAO,sBAAsB,IAAI,sCAAsC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qCAAqC;IACnD,OAAO;QACL,+FAA+F;QAC/F,4GAA4G;QAC5G,wHAAwH;QACxH,gHAAgH;QAChH,mIAAmI;QACnI,+LAA+L;KAChM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/lib/security/network-authority.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Turn network authority shared by tool offering, policy denial and prompt
+ * guidance. A Turn without `policy.network.enabled` can never reach the
+ * network, so its network tools are withheld instead of offered and denied,
+ * and the model is told the one real way to enable it rather than guessing.
+ */
+/** Native tools whose only purpose is network access. */
+export declare const NETWORK_TOOL_NAMES: ReadonlySet<string>;
+/** Denial reason for network access on a Turn without network authority. */
+export declare const NETWORK_DISABLED_REASON: string;
+/** Prompt note added when network tools were withheld from a Turn. */
+export declare const NETWORK_DISABLED_PROMPT_NOTE: string;
+type NetworkPolicyView = Readonly<{
+    network?: Readonly<{
+        enabled?: boolean;
+    }>;
+}>;
+export declare function turnPolicyAllowsNetwork(policy: NetworkPolicyView | undefined): boolean;
+/** Drops network tools from a tool or catalog list when the Turn policy cannot reach the network. */
+export declare function withoutForbiddenNetwork<T extends {
+    readonly name: string;
+}>(policy: NetworkPolicyView | undefined, tools: readonly T[]): T[];
+export {};
+//# sourceMappingURL=network-authority.d.ts.map

package/lib/security/network-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-authority.d.ts","sourceRoot":"","sources":["../../src/security/network-authority.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAwC,CAAC;AAE5F,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,QAE4D,CAAC;AAEjG,sEAAsE;AACtE,eAAO,MAAM,4BAA4B,QAK7B,CAAC;AAEb,KAAK,iBAAiB,GAAG,QAAQ,CAAC;IAAE,OAAO,CAAC,EAAE,QAAQ,CAAC;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAAC;AAEjF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GAAG,OAAO,CAEtF;AAED,qGAAqG;AACrG,wBAAgB,uBAAuB,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACzE,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,KAAK,EAAE,SAAS,CAAC,EAAE,GAClB,CAAC,EAAE,CAIL"}

package/lib/security/network-authority.js

@@ -0,0 +1,28 @@
+/**
+ * Turn network authority shared by tool offering, policy denial and prompt
+ * guidance. A Turn without `policy.network.enabled` can never reach the
+ * network, so its network tools are withheld instead of offered and denied,
+ * and the model is told the one real way to enable it rather than guessing.
+ */
+/** Native tools whose only purpose is network access. */
+export const NETWORK_TOOL_NAMES = new Set(['web_fetch', 'web_search']);
+/** Denial reason for network access on a Turn without network authority. */
+export const NETWORK_DISABLED_REASON = 'Turn has no network authority：本回合未开启出网。主人可在 zhin.config.yml 中设置 '
+    + '`ai.agent.network.enabled: true`（可用 `ai.agent.network.allowedDomains` 限定域名），重启后生效；聊天里无法开启。';
+/** Prompt note added when network tools were withheld from a Turn. */
+export const NETWORK_DISABLED_PROMPT_NOTE = [
+    '## Network',
+    '本回合未开启出网，web_fetch / web_search 等联网工具不可用，不要声称可以联网查询。',
+    '如果用户问怎么开启：主人在 zhin.config.yml 中设置 `ai.agent.network.enabled: true`'
+        + '（可选 `ai.agent.network.allowedDomains` 限定域名），重启后生效；聊天里无法开启。不要编造其他开关、平台或配置位置。',
+].join('\n');
+export function turnPolicyAllowsNetwork(policy) {
+    return policy?.network?.enabled === true;
+}
+/** Drops network tools from a tool or catalog list when the Turn policy cannot reach the network. */
+export function withoutForbiddenNetwork(policy, tools) {
+    return turnPolicyAllowsNetwork(policy)
+        ? [...tools]
+        : tools.filter(tool => !NETWORK_TOOL_NAMES.has(tool.name));
+}
+//# sourceMappingURL=network-authority.js.map

package/lib/security/network-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-authority.js","sourceRoot":"","sources":["../../src/security/network-authority.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AAE5F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAClC,kEAAkE;MAChE,4FAA4F,CAAC;AAEjG,sEAAsE;AACtE,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,YAAY;IACZ,sDAAsD;IACtD,oEAAoE;UAChE,6EAA6E;CAClF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAIb,MAAM,UAAU,uBAAuB,CAAC,MAAqC;IAC3E,OAAO,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;AAC3C,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,uBAAuB,CACrC,MAAqC,EACrC,KAAmB;IAEnB,OAAO,uBAAuB,CAAC,MAAM,CAAC;QACpC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;QACZ,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/lib/security/outbound-leak-guard.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Outbound leak check (#727, M3.4).
+ *
+ * Runs on everything the agent sends — final replies, progress updates and
+ * the text arguments of outbound tools — as a step in the existing send
+ * chain: the guarded ReplyPort masks findings and then hands the message to
+ * the real port, so delivery, rendering and before.sendMessage middleware
+ * stay exactly as they were.
+ *
+ * Three kinds of leak are masked:
+ * - system_prompt:        verbatim lines from the persona, bootstrap context
+ *                         or prompt sections the model was given;
+ * - secret:               credential-shaped strings and the values of
+ *                         secret-looking environment variables;
+ * - other_session_memory: lines read from another session's memory files
+ *                         during this turn.
+ */
+import type { OutputElement } from '@zhin.js/ai';
+import type { ReplyPort } from '../turn/turn-ingress.js';
+export type LeakKind = 'system_prompt' | 'secret' | 'other_session_memory';
+export interface LeakFinding {
+    readonly kind: LeakKind;
+    /** How many occurrences were masked. */
+    readonly count: number;
+}
+export interface LeakInspection {
+    readonly text: string;
+    readonly findings: readonly LeakFinding[];
+}
+/** Values of secret-looking environment variables, for exact-match masking. */
+export declare function collectEnvironmentSecrets(env?: NodeJS.ProcessEnv): string[];
+export interface OutboundLeakInspectorOptions {
+    /** Persona, bootstrap context and prompt sections the model saw this turn. */
+    readonly promptTexts?: readonly string[];
+    /** Exact secret values (defaults to secret-looking environment variables). */
+    readonly secretValues?: readonly string[];
+}
+/** Per-turn inspector; other-session memory lines are added as the turn reads them. */
+export declare class OutboundLeakInspector {
+    #private;
+    constructor(options?: OutboundLeakInspectorOptions);
+    /** Marks text read from another session's memory as private to that session. */
+    protectOtherSessionMemory(text: string): void;
+    inspect(text: string): LeakInspection;
+    /** Inspects the text elements of an outbound message. */
+    inspectOutput(output: readonly OutputElement[]): Readonly<{
+        output: readonly OutputElement[];
+        findings: readonly LeakFinding[];
+    }>;
+    /** Inspects the string arguments of an outbound tool call. */
+    inspectArguments(input: Readonly<Record<string, unknown>>): Readonly<{
+        input: Readonly<Record<string, unknown>>;
+        findings: readonly LeakFinding[];
+    }>;
+}
+/**
+ * Send-chain step for the turn's ReplyPort: masks leaks, reports them, then
+ * delegates to the real port unchanged.
+ */
+export declare function guardReplyPort(port: ReplyPort, inspector: OutboundLeakInspector, onFindings?: (findings: readonly LeakFinding[]) => void): ReplyPort;
+//# sourceMappingURL=outbound-leak-guard.d.ts.map

package/lib/security/outbound-leak-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-leak-guard.d.ts","sourceRoot":"","sources":["../../src/security/outbound-leak-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAE1E,MAAM,MAAM,QAAQ,GAAG,eAAe,GAAG,QAAQ,GAAG,sBAAsB,CAAC;AAE3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;CAC3C;AA+BD,+EAA+E;AAC/E,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,CAIxF;AAED,MAAM,WAAW,4BAA4B;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,uFAAuF;AACvF,qBAAa,qBAAqB;;gBAKpB,OAAO,GAAE,4BAAiC;IAOtD,gFAAgF;IAChF,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAS7C,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc;IAyBrC,yDAAyD;IACzD,aAAa,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,QAAQ,CAAC;QAAE,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;QAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAA;KAAE,CAAC;IAYjI,8DAA8D;IAC9D,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC;QAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAA;KAAE,CAAC;CAcrJ;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,qBAAqB,EAChC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,KAAK,IAAI,GACtD,SAAS,CAQX"}

package/lib/security/outbound-leak-guard.js

@@ -0,0 +1,145 @@
+const MASKS = Object.freeze({
+    system_prompt: '[已隐藏：系统提示内容]',
+    secret: '[已隐藏：密钥]',
+    other_session_memory: '[已隐藏：其他会话的记忆]',
+});
+/** Prompt lines shorter than this are too generic to count as a leak. */
+const MIN_PROMPT_LINE = 24;
+/** Memory lines shorter than this are too generic to count as a leak. */
+const MIN_MEMORY_LINE = 12;
+/** Environment values shorter than this are not treated as secrets. */
+const MIN_SECRET_VALUE = 12;
+const SECRET_PATTERNS = [
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    /\b(?:sk|pk|rk)-[A-Za-z0-9_-]{16,}/g,
+    /\b(?:ghp|gho|ghs|ghu|github_pat)_[A-Za-z0-9_]{20,}/g,
+    /\bxox[abpr]-[A-Za-z0-9-]{10,}/g,
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /\bAIza[0-9A-Za-z_-]{35}\b/g,
+    /\b(?:bearer)\s+[A-Za-z0-9._~+/=-]{20,}/gi,
+];
+const LINE_NUMBER_PREFIX = /^\s*\d+\s*(?:→|\||:|\t)\s?/;
+const MARKDOWN_PREFIX = /^\s*(?:[-*+]\s+(?:\[[ xX]\]\s+)?|#{1,6}\s+|>\s+|\d+\.\s+)/;
+const SECRET_ENV_NAME = /(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL)/i;
+/** Values of secret-looking environment variables, for exact-match masking. */
+export function collectEnvironmentSecrets(env = process.env) {
+    return Object.entries(env)
+        .filter(([name, value]) => SECRET_ENV_NAME.test(name) && typeof value === 'string' && value.length >= MIN_SECRET_VALUE)
+        .map(([, value]) => value);
+}
+/** Per-turn inspector; other-session memory lines are added as the turn reads them. */
+export class OutboundLeakInspector {
+    #promptLines;
+    #secretValues;
+    #memoryLines = new Set();
+    constructor(options = {}) {
+        this.#promptLines = uniqueLines(options.promptTexts ?? [], MIN_PROMPT_LINE);
+        this.#secretValues = [...new Set(options.secretValues ?? collectEnvironmentSecrets())]
+            .filter((value) => value.length >= MIN_SECRET_VALUE)
+            .sort((left, right) => right.length - left.length);
+    }
+    /** Marks text read from another session's memory as private to that session. */
+    protectOtherSessionMemory(text) {
+        // File tools prefix lines with numbers ("12 | ") and notes use list markers; the model echoes the text only.
+        const plain = text
+            .split(/\r?\n/)
+            .map((line) => line.replace(LINE_NUMBER_PREFIX, '').replace(MARKDOWN_PREFIX, ''))
+            .join('\n');
+        for (const line of uniqueLines([plain], MIN_MEMORY_LINE))
+            this.#memoryLines.add(line);
+    }
+    inspect(text) {
+        const findings = [];
+        let result = text;
+        const mask = (kind, apply) => {
+            const [next, count] = apply(result);
+            if (count > 0)
+                findings.push(Object.freeze({ kind, count }));
+            result = next;
+        };
+        mask('secret', (current) => {
+            let count = 0;
+            let next = current;
+            for (const value of this.#secretValues)
+                [next, count] = replaceLiteral(next, value, MASKS.secret, count);
+            for (const pattern of SECRET_PATTERNS) {
+                next = next.replace(pattern, () => {
+                    count += 1;
+                    return MASKS.secret;
+                });
+            }
+            return [next, count];
+        });
+        mask('system_prompt', (current) => replaceLines(current, this.#promptLines, MASKS.system_prompt));
+        mask('other_session_memory', (current) => replaceLines(current, [...this.#memoryLines], MASKS.other_session_memory));
+        return Object.freeze({ text: result, findings: Object.freeze(findings) });
+    }
+    /** Inspects the text elements of an outbound message. */
+    inspectOutput(output) {
+        const findings = [];
+        const next = output.map((element) => {
+            if (element.type !== 'text')
+                return element;
+            const inspection = this.inspect(element.content);
+            if (inspection.findings.length === 0)
+                return element;
+            findings.push(...inspection.findings);
+            return { ...element, content: inspection.text };
+        });
+        return Object.freeze({ output: findings.length > 0 ? Object.freeze(next) : output, findings: Object.freeze(findings) });
+    }
+    /** Inspects the string arguments of an outbound tool call. */
+    inspectArguments(input) {
+        const findings = [];
+        const next = {};
+        for (const [key, value] of Object.entries(input)) {
+            if (typeof value !== 'string') {
+                next[key] = value;
+                continue;
+            }
+            const inspection = this.inspect(value);
+            findings.push(...inspection.findings);
+            next[key] = inspection.text;
+        }
+        return Object.freeze({ input: findings.length > 0 ? Object.freeze(next) : input, findings: Object.freeze(findings) });
+    }
+}
+/**
+ * Send-chain step for the turn's ReplyPort: masks leaks, reports them, then
+ * delegates to the real port unchanged.
+ */
+export function guardReplyPort(port, inspector, onFindings) {
+    return Object.freeze({
+        async send(output) {
+            const inspected = inspector.inspectOutput(output);
+            if (inspected.findings.length > 0)
+                onFindings?.(inspected.findings);
+            return port.send(inspected.output);
+        },
+    });
+}
+function uniqueLines(texts, minLength) {
+    const lines = new Set();
+    for (const text of texts) {
+        for (const raw of text.split(/\r?\n/)) {
+            const line = raw.trim();
+            if (line.length >= minLength)
+                lines.add(line);
+        }
+    }
+    return [...lines].sort((left, right) => right.length - left.length);
+}
+function replaceLines(text, lines, replacement) {
+    let count = 0;
+    let next = text;
+    for (const line of lines)
+        [next, count] = replaceLiteral(next, line, replacement, count);
+    return [next, count];
+}
+function replaceLiteral(text, needle, replacement, count) {
+    if (!needle || !text.includes(needle))
+        return [text, count];
+    const parts = text.split(needle);
+    return [parts.join(replacement), count + parts.length - 1];
+}
+//# sourceMappingURL=outbound-leak-guard.js.map

package/lib/security/outbound-leak-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-leak-guard.js","sourceRoot":"","sources":["../../src/security/outbound-leak-guard.ts"],"names":[],"mappings":"AAiCA,MAAM,KAAK,GAAuC,MAAM,CAAC,MAAM,CAAC;IAC9D,aAAa,EAAE,cAAc;IAC7B,MAAM,EAAE,UAAU;IAClB,oBAAoB,EAAE,eAAe;CACtC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,yEAAyE;AACzE,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,MAAM,eAAe,GAAsB;IACzC,6EAA6E;IAC7E,oCAAoC;IACpC,qDAAqD;IACrD,gCAAgC;IAChC,uBAAuB;IACvB,4BAA4B;IAC5B,0CAA0C;CAC3C,CAAC;AAEF,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAExD,MAAM,eAAe,GAAG,2DAA2D,CAAC;AAEpF,MAAM,eAAe,GAAG,kDAAkD,CAAC;AAE3E,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5E,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;SACtH,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAe,CAAC,CAAC;AACzC,CAAC;AASD,uFAAuF;AACvF,MAAM,OAAO,qBAAqB;IACvB,YAAY,CAAoB;IAChC,aAAa,CAAoB;IACjC,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,YAAY,UAAwC,EAAE;QACpD,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;QAC5E,IAAI,CAAC,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,yBAAyB,EAAE,CAAC,CAAC;aACnF,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;aACnD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,gFAAgF;IAChF,yBAAyB,CAAC,IAAY;QACpC,6GAA6G;QAC7G,MAAM,KAAK,GAAG,IAAI;aACf,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;aAChF,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;YAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,IAAc,EAAE,KAA4C,EAAE,EAAE;YAC5E,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,KAAK,GAAG,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7D,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;YACzB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,IAAI,GAAG,OAAO,CAAC;YACnB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa;gBAAE,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACzG,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;gBACtC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;oBAChC,KAAK,IAAI,CAAC,CAAC;oBACX,OAAO,KAAK,CAAC,MAAM,CAAC;gBACtB,CAAC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,sBAAsB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACrH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,yDAAyD;IACzD,aAAa,CAAC,MAAgC;QAC5C,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,OAAO,CAAC;YAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IAED,8DAA8D;IAC9D,gBAAgB,CAAC,KAAwC;QACvD,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC;QAC9B,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAe,EACf,SAAgC,EAChC,UAAuD;IAEvD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,MAAgC;YACzC,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,UAAU,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAwB,EAAE,SAAiB;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAwB,EAAE,WAAmB;IAC/E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACzF,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc,EAAE,WAAmB,EAAE,KAAa;IACtF,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/lib/security/policy-facade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy-facade.d.ts","sourceRoot":"","sources":["../../src/security/policy-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAQ1D,OAAO,EAKL,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAM/F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAK3D,MAAM,WAAW,eAAe;IAC9B,wFAAwF;IACxF,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,sBAAsB;IACtB,MAAM,CAAC,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnC,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,iBAAiB,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,kFAAkF;IAClF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB;IAChB,SAAS,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;CACjD;AAED,MAAM,MAAM,sBAAsB,GAC9B,QAAQ,CAAC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,GACzE,QAAQ,CAAC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9D,QAAQ,CAAC;IAAE,MAAM,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,CAAC;AAExH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED,gFAAgF;AAChF,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAgHrG;AAiHD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;IACzC,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,CAAC,qBAAqB,CAAC,GAAG,kBAAkB,CAAC;CAChG;AAyND;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAWxE;AAID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,SAAK,GAAG,MAAM,GAAG,IAAI,CA4BhG"}
+{"version":3,"file":"policy-facade.d.ts","sourceRoot":"","sources":["../../src/security/policy-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAc1D,OAAO,EAKL,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAM/F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAK3D,MAAM,WAAW,eAAe;IAC9B,wFAAwF;IACxF,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,sBAAsB;IACtB,MAAM,CAAC,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnC,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,iBAAiB,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,kFAAkF;IAClF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB;IAChB,SAAS,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;CACjD;AAED,MAAM,MAAM,sBAAsB,GAC9B,QAAQ,CAAC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,GACzE,QAAQ,CAAC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9D,QAAQ,CAAC;IAAE,MAAM,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,CAAC;AAExH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED,gFAAgF;AAChF,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAwHrG;AAiHD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;IACzC,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,CAAC,qBAAqB,CAAC,GAAG,kBAAkB,CAAC;CAChG;AAyND;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAWxE;AAID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,SAAK,GAAG,MAAM,GAAG,IAAI,CA4BhG"}

package/lib/security/policy-facade.js

@@ -15,7 +15,9 @@
  * memory-write-path / blocked-device-path / workspace-access 仅对写操作生效；
  * read 类工具由文件权限矩阵和显式 devicePathGuard 约束。
  */
+import { NETWORK_DISABLED_REASON, NETWORK_TOOL_NAMES } from './network-authority.js';
 import { checkMemoryWritePath } from '../memory-layers.js';
+import { TRUST_LEVEL_POLICY, TRUST_RESTRICTION_REASON, isToolAboveTrust, resolveTurnTrustLevel, } from './trust-level.js';
 import { checkFileAccess, checkBashCommandSafety, extractBashReadPaths, isBlockedDevicePath, } from './file-policy.js';
 import { checkBashFilePermission, checkFilePermission, formatFilePermissionMessage, toolRequesterRoleToFileRole, } from './file-role-policy.js';
 import { checkBashSensitiveReadAccess, checkDangerousToolAccess, checkFileToolAccess, checkSensitiveFilePathAccess, toDenyError, toOwnerSignal, } from './dangerous-tool-policy.js';
@@ -26,6 +28,14 @@ import { authorizeTurnFileInput } from './turn-file-authority.js';
 /** Generic, execution-domain-neutral policy facade for canonical Turn tools. */
 export async function runTurnToolPolicies(input) {
     const requesterRole = resolveTurnRequesterRole(input.turn);
+    // Defense in depth for #726: also covers tools that reach a turn later (e.g. deferred loads).
+    if (isToolAboveTrust(input.tool, resolveTurnTrustLevel(input.turn))) {
+        return Object.freeze({
+            status: 'denied',
+            policy: TRUST_LEVEL_POLICY,
+            reason: TRUST_RESTRICTION_REASON,
+        });
+    }
     const networkDecision = checkTurnNetworkPolicy(input);
     if (networkDecision)
         return networkDecision;
@@ -144,7 +154,7 @@ function hasCanonicalRiskPolicy(toolName) {
 function checkTurnNetworkPolicy(input) {
     const command = input.tool.name === 'bash' ? stringArgument(input.input, 'command') : undefined;
     const isNetworkCommand = Boolean(command && NETWORK_COMMAND_PATTERNS.some((pattern) => pattern.test(command)));
-    const isNetworkTool = input.tool.name === 'web_fetch' || input.tool.name === 'web_search';
+    const isNetworkTool = NETWORK_TOOL_NAMES.has(input.tool.name);
     if (!isNetworkCommand && !isNetworkTool)
         return undefined;
     const policy = input.turn.policy.network;
@@ -152,7 +162,7 @@ function checkTurnNetworkPolicy(input) {
         return Object.freeze({
             status: 'denied',
             policy: 'network-access',
-            reason: 'Turn has no network authority',
+            reason: NETWORK_DISABLED_REASON,
         });
     }
     const urls = input.tool.name === 'web_fetch'

package/lib/security/policy-facade.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-facade.js","sourceRoot":"","sources":["../../src/security/policy-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,GAG5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,EACnB,4BAA4B,EAC5B,WAAW,EACX,aAAa,GAGd,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC9G,OAAO,EAAE,wBAAwB,EAA0B,MAAM,6BAA6B,CAAC;AAC/F,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAgElE,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA0B;IAClE,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAChD,KAAK,CAAC,IAAI,CAAC,IAAI,EACf,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAC/C,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC;QACtC,MAAM,IAAI,GAAG,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,mBAAmB,CACpC,2BAA2B,CAAC,aAAa,CAAC,EAC1C,aAAa,EACb,IAAI,CACL,CAAC;QACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;QACnG,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,KAAK,WAAW,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YACrF,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,gCAAgC,aAAa,iBAAiB;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAC/C,MAAM,EACN,eAAe,EACf,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAC/C,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,eAAe,GAAG,YAAY,CAAC,KAAK,CAAC;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBACpC,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAChF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,OAAO,MAAM,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,qBAAqB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,SAAS;qBACpF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACvB,OAAO,MAAM,CAAC,MAAM,CAAC;4BACnB,MAAM,EAAE,mBAAmB;4BAC3B,MAAM,EAAE,aAAa;4BACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,iCAAiC;4BACxD,KAAK,EAAE,eAAe;yBACvB,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,MAAM,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,sBAAsB;qBAC9C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,qBAAqB;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,qBAAqB;iBAC/C,CAAC,CAAC;YACL,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,MAAM,aAAa,GAAG,mBAAmB,CACvC,2BAA2B,CAAC,aAAa,CAAC,EAC1C,MAAM,EACN,IAAI,CACL,CAAC;gBACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,aAAa,EAAE,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC/F,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;YAChC,CAAC;YACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;YAChG,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;YACjG,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;gBACrI,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,kBAAkB;oBAC1B,MAAM,EAAE,sCAAsC,UAAU,CAAC,aAAa,iBAAiB;iBACxF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,2BAA2B,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YAChE,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAoB;IACvD,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,QAAQ,KAAK,MAAM;WACrB,QAAQ,KAAK,WAAW;WACxB,QAAQ,KAAK,YAAY;WACzB,wBAAwB,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAA0B;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC;IAC1F,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,+BAA+B;SACxC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;QAC1C,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzF,CAAC,CAAC,OAAO;YACP,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC;YACjC,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,gBAAgB,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,mDAAmD;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE;YAC1C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,uBAAuB;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CACjC,UAAgC,EAChC,MAAc,EACd,KAAwC;IAExC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,QAAQ,UAAU,CAAC,SAAS,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,iBAAiB,IAAI,UAAU,CAAC,sBAAsB,EAAE,CAAC;QACtE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,QAAQ,UAAU,CAAC,SAAS,oBAAoB;YAC7E,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IAChD,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM;WACzE,QAAQ,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAiB;IACjD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CACrB,KAAwC,EACxC,GAAG,KAAwB;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AACtG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhF,0DAA0D;AAC1D,SAAS,oBAAoB,CAAC,KAAsB;IAClD,IAAI,KAAK,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC,aAAa,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gDAAgD;AAChD,SAAS,aAAa,CAAC,KAAsB;IAC3C,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAwB;IACrD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC;KACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,0BAA0B,CAAC,KAAsB;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC;IACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,aAAa,GAAsB,cAAc,CAAC;IACtD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;QACpE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAW,EAAE;gBACtD,SAAS,EAAE,KAAK,CAAC,aAAc,CAAC,SAAS;gBACzC,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAc,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;aACjE,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7E,CAAC;KACF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,uDAAuD;YACvD,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW;oBAC5B,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,qBAAqB,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAwB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACvG,CAAC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC1E,CAAC;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW;oBAC5B,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,qBAAqB,CAC1B,wBAAwB,CAAC,KAAK,CAAC,QAAoD,EAAE,KAAK,CAAC,WAAW,CAAC,CACxG,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CACrC,4BAA4B,CAAC,KAAK,CAAC,OAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CACpF;KACF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,SAAS;QAC7D,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAsB,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;YAC9E,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,2BAA2B,CAAC,aAAa,CAAC;wBAChD,SAAS;qBACqB;iBACjC,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjG,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,aAAa,GACjB,KAAK,CAAC,WAAW;gBACf,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC7C,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,IAAI,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YACvF,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC3C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,qBAAqB,CACnB,4BAA4B,CAC1B,KAAK,CAAC,QAAwB,EAC9B,KAAK,CAAC,QAAS,EACf,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,CACnB,CACF;KACJ;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;QACvG,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAS,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACpE,iCAAiC;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,aAAa,KAAK,CAAC,QAAS,EAAE;gBAChC,CAAC,CAAC,YAAY,KAAK,CAAC,QAAS,gBAAgB,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,MAAO,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,aAAa,IAAI,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAChH,CAAC;KACF;CACF,CAAC,CAAC;AAEH,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,kBAAkB,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,sDAAsD;AAEtD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAwB,EAAE,QAAQ,GAAG,EAAE;IAC/E,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC9D,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,wBAAwB,CAAC;QAC9B,KAAK,sBAAsB;YACzB,4DAA4D;YAC5D,OAAO,2BAA2B,CAAC,MAAM,CAAC,OAA+B,EAAE,QAAQ,CAAC,CAAC;QACvF,KAAK,mBAAmB;YACtB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,qBAAqB;YACxB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,kBAAkB;YACrB,OAAO,sBAAsB,MAAM,CAAC,MAAO,0CAA0C,CAAC;QACxF,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,sBAAsB,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE;gBAC5D,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;QAC9C,OAAO,CAAC,CAAC,CAAC;YACR,oFAAoF;YACpF,MAAM,QAAQ,GAA0B;gBACtC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;aAC/B,CAAC;YACF,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"policy-facade.js","sourceRoot":"","sources":["../../src/security/policy-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,GAG5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,EACnB,4BAA4B,EAC5B,WAAW,EACX,aAAa,GAGd,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC9G,OAAO,EAAE,wBAAwB,EAA0B,MAAM,6BAA6B,CAAC;AAC/F,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAgElE,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA0B;IAClE,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,8FAA8F;IAC9F,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,wBAAwB;SACjC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,eAAe,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAChD,KAAK,CAAC,IAAI,CAAC,IAAI,EACf,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAC/C,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC;QACtC,MAAM,IAAI,GAAG,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,mBAAmB,CACpC,2BAA2B,CAAC,aAAa,CAAC,EAC1C,aAAa,EACb,IAAI,CACL,CAAC;QACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;QACnG,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,KAAK,WAAW,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YACrF,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,gCAAgC,aAAa,iBAAiB;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAC/C,MAAM,EACN,eAAe,EACf,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAC/C,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,eAAe,GAAG,YAAY,CAAC,KAAK,CAAC;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBACpC,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAChF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,OAAO,MAAM,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,qBAAqB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,SAAS;qBACpF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACvB,OAAO,MAAM,CAAC,MAAM,CAAC;4BACnB,MAAM,EAAE,mBAAmB;4BAC3B,MAAM,EAAE,aAAa;4BACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,iCAAiC;4BACxD,KAAK,EAAE,eAAe;yBACvB,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,MAAM,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,sBAAsB;qBAC9C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,qBAAqB;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,qBAAqB;iBAC/C,CAAC,CAAC;YACL,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,MAAM,aAAa,GAAG,mBAAmB,CACvC,2BAA2B,CAAC,aAAa,CAAC,EAC1C,MAAM,EACN,IAAI,CACL,CAAC;gBACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,aAAa,EAAE,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC/F,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;YAChC,CAAC;YACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;YAChG,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;YACjG,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;gBACrI,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,kBAAkB;oBAC1B,MAAM,EAAE,sCAAsC,UAAU,CAAC,aAAa,iBAAiB;iBACxF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,2BAA2B,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YAChE,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAoB;IACvD,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,QAAQ,KAAK,MAAM;WACrB,QAAQ,KAAK,WAAW;WACxB,QAAQ,KAAK,YAAY;WACzB,wBAAwB,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAA0B;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;QAC1C,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzF,CAAC,CAAC,OAAO;YACP,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC;YACjC,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,gBAAgB,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,mDAAmD;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE;YAC1C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,uBAAuB;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CACjC,UAAgC,EAChC,MAAc,EACd,KAAwC;IAExC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,QAAQ,UAAU,CAAC,SAAS,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,iBAAiB,IAAI,UAAU,CAAC,sBAAsB,EAAE,CAAC;QACtE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,QAAQ,UAAU,CAAC,SAAS,oBAAoB;YAC7E,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IAChD,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM;WACzE,QAAQ,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAiB;IACjD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CACrB,KAAwC,EACxC,GAAG,KAAwB;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AACtG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhF,0DAA0D;AAC1D,SAAS,oBAAoB,CAAC,KAAsB;IAClD,IAAI,KAAK,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC,aAAa,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gDAAgD;AAChD,SAAS,aAAa,CAAC,KAAsB;IAC3C,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAwB;IACrD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC;KACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,0BAA0B,CAAC,KAAsB;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC;IACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,aAAa,GAAsB,cAAc,CAAC;IACtD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;QACpE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAW,EAAE;gBACtD,SAAS,EAAE,KAAK,CAAC,aAAc,CAAC,SAAS;gBACzC,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAc,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;aACjE,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7E,CAAC;KACF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,uDAAuD;YACvD,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW;oBAC5B,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,qBAAqB,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAwB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACvG,CAAC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC1E,CAAC;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW;oBAC5B,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,qBAAqB,CAC1B,wBAAwB,CAAC,KAAK,CAAC,QAAoD,EAAE,KAAK,CAAC,WAAW,CAAC,CACxG,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CACrC,4BAA4B,CAAC,KAAK,CAAC,OAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CACpF;KACF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,SAAS;QAC7D,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAsB,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;YAC9E,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,2BAA2B,CAAC,aAAa,CAAC;wBAChD,SAAS;qBACqB;iBACjC,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjG,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,aAAa,GACjB,KAAK,CAAC,WAAW;gBACf,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC7C,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,IAAI,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YACvF,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC3C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,qBAAqB,CACnB,4BAA4B,CAC1B,KAAK,CAAC,QAAwB,EAC9B,KAAK,CAAC,QAAS,EACf,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,CACnB,CACF;KACJ;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;QACvG,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAS,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACpE,iCAAiC;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,aAAa,KAAK,CAAC,QAAS,EAAE;gBAChC,CAAC,CAAC,YAAY,KAAK,CAAC,QAAS,gBAAgB,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,MAAO,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,aAAa,IAAI,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAChH,CAAC;KACF;CACF,CAAC,CAAC;AAEH,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,kBAAkB,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,sDAAsD;AAEtD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAwB,EAAE,QAAQ,GAAG,EAAE;IAC/E,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC9D,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,wBAAwB,CAAC;QAC9B,KAAK,sBAAsB;YACzB,4DAA4D;YAC5D,OAAO,2BAA2B,CAAC,MAAM,CAAC,OAA+B,EAAE,QAAQ,CAAC,CAAC;QACvF,KAAK,mBAAmB;YACtB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,qBAAqB;YACxB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,kBAAkB;YACrB,OAAO,sBAAsB,MAAM,CAAC,MAAO,0CAA0C,CAAC;QACxF,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,sBAAsB,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE;gBAC5D,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;QAC9C,OAAO,CAAC,CAAC,CAAC;YACR,oFAAoF;YACpF,MAAM,QAAQ,GAA0B;gBACtC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;aAC/B,CAAC;YACF,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}

package/lib/security/policy-narrowing.d.ts

@@ -0,0 +1,12 @@
+import type { TurnPolicyContext } from '../turn/turn-ingress.js';
+export interface SubagentPolicyNarrowing {
+    /** Read-only delegation: no shell, read-only filesystem. */
+    readonly readOnly?: boolean;
+}
+/**
+ * Policy for a sub-agent turn. It is derived only from the parent policy, so it
+ * can never be wider: every authority the parent lacks stays absent, a shell
+ * the parent cannot actually run is dropped, and narrowing only removes power.
+ */
+export declare function deriveSubagentPolicy(parent: Readonly<TurnPolicyContext>, narrowing?: SubagentPolicyNarrowing): Readonly<TurnPolicyContext>;
+//# sourceMappingURL=policy-narrowing.d.ts.map

package/lib/security/policy-narrowing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-narrowing.d.ts","sourceRoot":"","sources":["../../src/security/policy-narrowing.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,WAAW,uBAAuB;IACtC,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EACnC,SAAS,GAAE,uBAA4B,GACtC,QAAQ,CAAC,iBAAiB,CAAC,CA0B7B"}

package/lib/security/policy-narrowing.js

@@ -0,0 +1,38 @@
+/**
+ * Policy narrowing shared by sub-agent turns (#718) and trust tiers (#726).
+ * Every function here only removes authority from a policy; none can add it.
+ */
+import { turnPolicyAllowsShell } from '../plugin-runtime/native-bash-tool.js';
+/**
+ * Policy for a sub-agent turn. It is derived only from the parent policy, so it
+ * can never be wider: every authority the parent lacks stays absent, a shell
+ * the parent cannot actually run is dropped, and narrowing only removes power.
+ */
+export function deriveSubagentPolicy(parent, narrowing = {}) {
+    const filesystem = parent.filesystem
+        ? Object.freeze({
+            ...parent.filesystem,
+            ...(narrowing.readOnly ? { access: 'read-only' } : {}),
+        })
+        : undefined;
+    const keepShell = parent.shell !== undefined
+        && !narrowing.readOnly
+        && turnPolicyAllowsShell(parent);
+    return Object.freeze({
+        permissions: Object.freeze([...parent.permissions]),
+        unattended: parent.unattended,
+        ...(parent.network
+            ? {
+                network: Object.freeze({
+                    ...parent.network,
+                    ...(parent.network.allowedDomains
+                        ? { allowedDomains: Object.freeze([...parent.network.allowedDomains]) }
+                        : {}),
+                }),
+            }
+            : {}),
+        ...(filesystem ? { filesystem } : {}),
+        ...(keepShell ? { shell: Object.freeze({ ...parent.shell }) } : {}),
+    });
+}
+//# sourceMappingURL=policy-narrowing.js.map

package/lib/security/policy-narrowing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-narrowing.js","sourceRoot":"","sources":["../../src/security/policy-narrowing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAQ9E;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAmC,EACnC,YAAqC,EAAE;IAEvC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU;QAClC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YACd,GAAG,MAAM,CAAC,UAAU;YACpB,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS;WACvC,CAAC,SAAS,CAAC,QAAQ;WACnB,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QACnD,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC;gBACA,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;oBACrB,GAAG,MAAM,CAAC,OAAO;oBACjB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;wBAC/B,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE;wBACvE,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;aACH;YACD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC,CAAC;AACL,CAAC"}