@zhin.js/agent 1.1.36 → 1.1.38

package/lib/security/network-policy.d.ts

@@ -51,4 +51,3 @@ export declare function validateNetworkCommandUrl(command: string): {
     safe: boolean;
     reason?: string;
 };
-//# sourceMappingURL=network-policy.d.ts.map

package/lib/security/network-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"network-policy.js","sourceRoot":"","sources":["../../src/security/network-policy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,mEAAmE;AAEnE,yCAAyC;AACzC,MAAM,CAAC,MAAM,wBAAwB,GAA0B;IAC7D,WAAW;IACX,WAAW;IACX,SAAS;IACT,aAAa;IACb,UAAU;IACV,UAAU;IACV,YAAY;IACZ,WAAW;IACX,UAAU;IACV,eAAe;IACf,WAAW;IACX,iBAAiB;IACjB,WAAW;IACX,WAAW;IACX,YAAY;CACb,CAAC;AAEF,uEAAuE;AAEvE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,kCAAkC;AAClC,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO;IACL,YAAY;IACZ,CAAC,KAAK,WAAW;QACjB,CAAC,KAAK,WAAW;QACjB,CAAC,KAAK,KAAK;QACX,CAAC,KAAK,SAAS;QACf,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpB,sBAAsB;QACtB,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QACxB,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,2CAA2C;QAC3C,CAAC,KAAK,iBAAiB;QACvB,CAAC,KAAK,0BAA0B;QAChC,CAAC,KAAK,qBAAqB;QAC3B,iCAAiC;QACjC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACjB,gEAAgE,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,gCAAgC;QAChC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC;eACT,CAAC,KAAK,EAAE;eACR,CAAC,KAAK,GAAG;eACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAE,IAAI,EAAE,IAAI,CAAE,IAAI,GAAG,CAAC;eACpC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;eACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAE,IAAI,EAAE,IAAI,CAAE,IAAI,EAAE,CAAC;eACnC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;eACtB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;eACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;eACrC,CAAE,IAAI,GAAG,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,MAAM,GAAG,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM;YAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;eAChC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;eAC7B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,MAAM,GAAG,gBAAgB,CAAC;IAEnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,qEAAqE;AAErE,gCAAgC;AAChC,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,OAAiB;IACrE,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AAExE,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAEpD,uBAAuB;AACvB,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,oEAAoE;AAEpE,oCAAoC;AACpC,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAcD,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,MAA8B;IAE9B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,MAAM,CAAC,QAAQ,eAAe,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACrG,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,MAAM,MAAM,CAAC,QAAQ,kBAAkB,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SACnF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,MAA2B;IAE3B,kBAAkB;IAClB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,wBAAwB,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC;gBACrE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,qBAAqB,GAAG,8BAA8B;iBAC/D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,mBAAmB;YACnB,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1F,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,4DAA4D;iBACrE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACvC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC1D,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,MAAM,QAAQ,gBAAgB,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;qBAC1E,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,mEAAmE;AAEnE;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,SAAS;IACT,IAAI,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,+CAA+C;SACxD,CAAC;IACJ,CAAC;IAED,UAAU;IACV,MAAM,GAAG,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YACvC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,UAAU,QAAQ,6BAA6B;iBACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"network-policy.js","sourceRoot":"","sources":["../../src/security/network-policy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,mEAAmE;AAEnE,yCAAyC;AACzC,MAAM,CAAC,MAAM,wBAAwB,GAA0B;IAC7D,WAAW;IACX,WAAW;IACX,SAAS;IACT,aAAa;IACb,UAAU;IACV,UAAU;IACV,YAAY;IACZ,WAAW;IACX,UAAU;IACV,eAAe;IACf,WAAW;IACX,iBAAiB;IACjB,WAAW;IACX,WAAW;IACX,YAAY;CACb,CAAC;AAEF,uEAAuE;AAEvE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,kCAAkC;AAClC,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO;IACL,YAAY;IACZ,CAAC,KAAK,WAAW;QACjB,CAAC,KAAK,WAAW;QACjB,CAAC,KAAK,KAAK;QACX,CAAC,KAAK,SAAS;QACf,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpB,sBAAsB;QACtB,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QACxB,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,2CAA2C;QAC3C,CAAC,KAAK,iBAAiB;QACvB,CAAC,KAAK,0BAA0B;QAChC,CAAC,KAAK,qBAAqB;QAC3B,iCAAiC;QACjC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACjB,gEAAgE,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,gCAAgC;QAChC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC;eACT,CAAC,KAAK,EAAE;eACR,CAAC,KAAK,GAAG;eACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAE,IAAI,EAAE,IAAI,CAAE,IAAI,GAAG,CAAC;eACpC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;eACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAE,IAAI,EAAE,IAAI,CAAE,IAAI,EAAE,CAAC;eACnC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;eACtB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;eACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;eACrC,CAAE,IAAI,GAAG,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,MAAM,GAAG,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM;YAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;eAChC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;eAC7B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,MAAM,GAAG,gBAAgB,CAAC;IAEnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,qEAAqE;AAErE,gCAAgC;AAChC,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,OAAiB;IACrE,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AAExE,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAEpD,uBAAuB;AACvB,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,oEAAoE;AAEpE,oCAAoC;AACpC,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAcD,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,MAA8B;IAE9B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,MAAM,CAAC,QAAQ,eAAe,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACrG,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,MAAM,MAAM,CAAC,QAAQ,kBAAkB,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SACnF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,MAA2B;IAE3B,kBAAkB;IAClB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,wBAAwB,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC;gBACrE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,qBAAqB,GAAG,8BAA8B;iBAC/D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,mBAAmB;YACnB,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1F,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,4DAA4D;iBACrE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACvC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC1D,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,MAAM,QAAQ,gBAAgB,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;qBAC1E,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,mEAAmE;AAEnE;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,SAAS;IACT,IAAI,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,+CAA+C;SACxD,CAAC;IACJ,CAAC;IAED,UAAU;IACV,MAAM,GAAG,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YACvC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,UAAU,QAAQ,6BAA6B;iBACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC","sourcesContent":["/**\n * 统一网络安全策略 — SSRF 防护、域名白名单、网络命令检测\n *\n * 合并了原散落在 web-fetch-tool.ts / sandbox.ts / exec-policy.ts 中的\n * 网络安全检查逻辑，作为单一事实来源。\n */\n\n// ── 网络命令模式 ──────────────────────────────────────────────────────\n\n/** 网络命令模式（当 enableNetwork: false 时阻断） */\nexport const NETWORK_COMMAND_PATTERNS: ReadonlyArray<RegExp> = [\n  /\\bcurl\\s+/,\n  /\\bwget\\s+/,\n  /\\bnc\\s+/,\n  /\\bnetcat\\s+/,\n  /\\bssh\\s+/,\n  /\\bscp\\s+/,\n  /\\brsync\\s+/,\n  /\\bping\\s+/,\n  /\\bdig\\s+/,\n  /\\bnslookup\\s+/,\n  /\\bhost\\s+/,\n  /\\btraceroute\\s+/,\n  /\\bnmap\\s+/,\n  /\\bhttp\\s+/,\n  /\\bhttps\\s+/,\n];\n\n// ── SSRF 防护 ─────────────────────────────────────────────────────────\n\nimport { isIP } from 'node:net';\n\n/** SSRF 防护：检查主机名是否属于内网/私有/危险地址 */\nexport function isBlockedSsrfHostname(hostname: string): boolean {\n  const h = hostname.toLowerCase().replace(/^\\[|\\]$/g, '');\n  if (isIP(h)) return isBlockedIpAddress(h);\n  return (\n    // Localhost\n    h === 'localhost' ||\n    h === '127.0.0.1' ||\n    h === '::1' ||\n    h === '0.0.0.0' ||\n    h.endsWith('.local') ||\n    // IPv4 private ranges\n    h.startsWith('10.') ||\n    h.startsWith('192.168.') ||\n    /^172\\.(1[6-9]|2\\d|3[01])\\./.test(h) ||\n    // Cloud metadata endpoints (AWS/GCP/Azure)\n    h === '169.254.169.254' ||\n    h === 'metadata.google.internal' ||\n    h === 'metadata.google.com' ||\n    // IPv6 private/link-local ranges\n    /^(?:fc|fd)[0-9a-f]{2}:/i.test(h) ||\n    /^fe80:/i.test(h) ||\n    /^::ffff:(?:127\\.|10\\.|192\\.168\\.|172\\.(?:1[6-9]|2\\d|3[01])\\.)/i.test(h) ||\n    // System-level domain blocklist\n    h.endsWith('.onion') ||\n    h.endsWith('.internal') ||\n    h.endsWith('.localhost')\n  );\n}\n\nexport function isBlockedIpAddress(address: string): boolean {\n  const normalized = address.toLowerCase().replace(/^\\[|\\]$/g, '');\n  if (isIP(normalized) === 4) {\n    const octets = normalized.split('.').map(Number);\n    const [a, b] = octets;\n    return a === 0\n      || a === 10\n      || a === 127\n      || (a === 100 && b! >= 64 && b! <= 127)\n      || (a === 169 && b === 254)\n      || (a === 172 && b! >= 16 && b! <= 31)\n      || (a === 192 && b === 0)\n      || (a === 192 && b === 168)\n      || (a === 198 && (b === 18 || b === 19))\n      || a! >= 224;\n  }\n  if (isIP(normalized) === 6) {\n    if (normalized === '::' || normalized === '::1') return true;\n    const mapped = /^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/i.exec(normalized)?.[1];\n    if (mapped) return isBlockedIpAddress(mapped);\n    return /^(?:fc|fd)/i.test(normalized)\n      || /^fe[89ab]/i.test(normalized)\n      || /^ff/i.test(normalized);\n  }\n  return true;\n}\n\nexport class NetworkAccessDeniedError extends Error {\n  readonly policy = 'network-access';\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'NetworkAccessDeniedError';\n  }\n}\n\n// ── 域名匹配 ──────────────────────────────────────────────────────────\n\n/** 检查主机名是否匹配域名列表（精确匹配或子域名匹配） */\nexport function hostnameMatchesList(hostname: string, domains: string[]): boolean {\n  const h = hostname.toLowerCase();\n  return domains.some(domain => {\n    const d = domain.toLowerCase().replace(/^\\./, '');\n    return h === d || h.endsWith('.' + d);\n  });\n}\n\n// ── URL 提取 ───────────────────────────────────────────────────────────\n\nconst URL_PATTERN = /https?:\\/\\/[^\\s'\"`&|;)}\\]]+/gi;\n\n/** 从命令中提取所有 URL（小写） */\nexport function extractUrlsFromCommand(command: string): string[] {\n  return (command.match(URL_PATTERN) || []).map(u => u.toLowerCase());\n}\n\n/** 从命令中提取第一个 URL（原始大小写） */\nexport function extractFirstUrlFromCommand(command: string): string | undefined {\n  const match = command.match(/https?:\\/\\/[^\\s'\"`&|;)}\\]]+/i);\n  return match ? match[0] : undefined;\n}\n\n// ── 数据外泄检测 ───────────────────────────────────────────────────────\n\n/** 检测 curl 数据外泄模式（curl -d @file） */\nexport function isDataExfiltrationAttempt(command: string): boolean {\n  const lower = command.toLowerCase();\n  return /\\bcurl\\b/.test(lower) && /-d\\s+@|--data-binary\\s+@/.test(lower);\n}\n\n// ── 网络命令访问控制 ───────────────────────────────────────────────────\n\nexport interface NetworkPolicyConfig {\n  enableNetwork?: boolean;\n  allowedDomains?: string[];\n}\n\nexport interface UrlNetworkPolicyConfig {\n  httpsOnly?: boolean;\n  allowedDomains: string[];\n}\n\nexport function checkUrlNetworkAccess(\n  url: string,\n  config: UrlNetworkPolicyConfig,\n): { allowed: boolean; reason?: string } {\n  let parsed: URL;\n  try {\n    parsed = new URL(url);\n  } catch {\n    return { allowed: false, reason: '网络请求必须提供可校验的绝对 URL' };\n  }\n  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n    return { allowed: false, reason: `网络策略仅支持 HTTP/HTTPS 请求，拒绝 ${parsed.protocol}` };\n  }\n  if (config.httpsOnly && parsed.protocol !== 'https:') {\n    return { allowed: false, reason: `当前网络策略仅允许 HTTPS 请求，拒绝 ${parsed.protocol}` };\n  }\n  if (isBlockedSsrfHostname(parsed.hostname)) {\n    return { allowed: false, reason: `URL 目标 ${parsed.hostname} 属于内网/私有/危险地址` };\n  }\n  if (config.allowedDomains.length > 0 && !hostnameMatchesList(parsed.hostname, config.allowedDomains)) {\n    return {\n      allowed: false,\n      reason: `域名 ${parsed.hostname} 不在网络允许列表中（允许: ${config.allowedDomains.join(', ')}）`,\n    };\n  }\n  return { allowed: true };\n}\n\n/**\n * 检查网络命令访问权限（sandbox 层）\n * - enableNetwork: false → 阻断所有网络命令\n * - enableNetwork: true + allowedDomains → 仅允许指定域名\n */\nexport function checkNetworkCommandAccess(\n  command: string,\n  config: NetworkPolicyConfig,\n): { allowed: boolean; reason?: string } {\n  // 网络未启用时，阻断所有网络命令\n  if (!config.enableNetwork) {\n    for (const pattern of NETWORK_COMMAND_PATTERNS) {\n      if (pattern.test(command)) {\n        const cmd = command.match(pattern)?.[0]?.trim() || 'network command';\n        return {\n          allowed: false,\n          reason: `沙箱网络未启用，禁止执行网络命令: ${cmd}（配置 enableNetwork: true 以允许）`,\n        };\n      }\n    }\n    return { allowed: true };\n  }\n\n  // 网络已启用但有域名白名单时，校验 URL\n  if (config.allowedDomains && config.allowedDomains.length > 0) {\n    const urls = extractUrlsFromCommand(command);\n    if (urls.length === 0) {\n      // 网络命令必须包含可校验的 URL\n      const hasNetworkCommand = NETWORK_COMMAND_PATTERNS.some(pattern => pattern.test(command));\n      if (hasNetworkCommand) {\n        return {\n          allowed: false,\n          reason: `启用 allowedDomains 时，网络命令必须包含可校验的 URL（如 http://example.com）`,\n        };\n      }\n      return { allowed: true };\n    }\n\n    for (const url of urls) {\n      try {\n        const hostname = new URL(url).hostname;\n        if (!hostnameMatchesList(hostname, config.allowedDomains)) {\n          return {\n            allowed: false,\n            reason: `域名 ${hostname} 不在允许列表中（允许: ${config.allowedDomains.join(', ')}）`,\n          };\n        }\n      } catch {\n        // URL 解析失败，放行（可能是相对路径或其他格式）\n      }\n    }\n  }\n\n  return { allowed: true };\n}\n\n// ── exec-policy 层网络命令 URL 校验 ────────────────────────────────────\n\n/**\n * 校验 exec-policy 允许的网络命令（curl/wget）的 URL 安全性\n * - 阻断数据外泄模式（curl -d @file）\n * - 阻断 SSRF 目标（内网/元数据端点）\n */\nexport function validateNetworkCommandUrl(command: string): { safe: boolean; reason?: string } {\n  // 数据外泄检测\n  if (isDataExfiltrationAttempt(command)) {\n    return {\n      safe: false,\n      reason: '检测到潜在数据外泄模式（curl -d @file）。如需上传文件，请使用具体的文件路径。',\n    };\n  }\n\n  // SSRF 检测\n  const url = extractFirstUrlFromCommand(command);\n  if (url) {\n    try {\n      const hostname = new URL(url).hostname;\n      if (isBlockedSsrfHostname(hostname)) {\n        return {\n          safe: false,\n          reason: `URL 目标 ${hostname} 属于内网/私有/危险地址，已被 SSRF 防护拦截。`,\n        };\n      }\n    } catch {\n      // URL 解析失败，不拦截\n    }\n  }\n\n  return { safe: true };\n}\n"]}

package/lib/security/outbound-leak-guard.d.ts

@@ -58,4 +58,3 @@ export declare class OutboundLeakInspector {
  * delegates to the real port unchanged.
  */
 export declare function guardReplyPort(port: ReplyPort, inspector: OutboundLeakInspector, onFindings?: (findings: readonly LeakFinding[]) => void): ReplyPort;
-//# sourceMappingURL=outbound-leak-guard.d.ts.map

package/lib/security/outbound-leak-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"outbound-leak-guard.js","sourceRoot":"","sources":["../../src/security/outbound-leak-guard.ts"],"names":[],"mappings":"AAkCA,MAAM,KAAK,GAAuC,MAAM,CAAC,MAAM,CAAC;IAC9D,aAAa,EAAE,cAAc;IAC7B,MAAM,EAAE,UAAU;IAClB,oBAAoB,EAAE,eAAe;CACtC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,yEAAyE;AACzE,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,MAAM,eAAe,GAAsB;IACzC,6EAA6E;IAC7E,oCAAoC;IACpC,qDAAqD;IACrD,gCAAgC;IAChC,uBAAuB;IACvB,4BAA4B;IAC5B,0CAA0C;CAC3C,CAAC;AAEF,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAExD,MAAM,eAAe,GAAG,2DAA2D,CAAC;AAEpF,MAAM,eAAe,GAAG,kDAAkD,CAAC;AAE3E,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5E,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;SACtH,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAe,CAAC,CAAC;AACzC,CAAC;AASD,uFAAuF;AACvF,MAAM,OAAO,qBAAqB;IACvB,YAAY,CAAoB;IAChC,aAAa,CAAoB;IACjC,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,YAAY,UAAwC,EAAE;QACpD,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;QAC5E,IAAI,CAAC,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,yBAAyB,EAAE,CAAC,CAAC;aACnF,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;aACnD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,gFAAgF;IAChF,yBAAyB,CAAC,IAAY;QACpC,6GAA6G;QAC7G,MAAM,KAAK,GAAG,IAAI;aACf,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;aAChF,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;YAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,IAAc,EAAE,KAA4C,EAAE,EAAE;YAC5E,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,KAAK,GAAG,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7D,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;YACzB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,IAAI,GAAG,OAAO,CAAC;YACnB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa;gBAAE,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACzG,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;gBACtC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;oBAChC,KAAK,IAAI,CAAC,CAAC;oBACX,OAAO,KAAK,CAAC,MAAM,CAAC;gBACtB,CAAC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,sBAAsB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACrH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,yDAAyD;IACzD,aAAa,CAAC,MAAqC;QACjD,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,qEAAqE;gBACrE,wDAAwD;gBACxD,MAAM,YAAY,GAAG,CAAC,KAAc,EAAW,EAAE;oBAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;wBACvC,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;wBACtC,OAAO,UAAU,CAAC,IAAI,CAAC;oBACzB,CAAC;oBACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;wBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;oBACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACvC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnG,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC;gBACF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAChD,GAAG,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAwB;iBACpE,CAAC,CAAC,CAAC;gBACJ,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC;YAClC,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,OAAO,CAAC;YAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IAED,8DAA8D;IAC9D,gBAAgB,CAAC,KAAwC;QACvD,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC;QAC9B,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAe,EACf,SAAgC,EAChC,UAAuD;IAEvD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,MAAqC;YAC9C,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,UAAU,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAwB,EAAE,SAAiB;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAwB,EAAE,WAAmB;IAC/E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACzF,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc,EAAE,WAAmB,EAAE,KAAa;IACtF,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"outbound-leak-guard.js","sourceRoot":"","sources":["../../src/security/outbound-leak-guard.ts"],"names":[],"mappings":"AAkCA,MAAM,KAAK,GAAuC,MAAM,CAAC,MAAM,CAAC;IAC9D,aAAa,EAAE,cAAc;IAC7B,MAAM,EAAE,UAAU;IAClB,oBAAoB,EAAE,eAAe;CACtC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,yEAAyE;AACzE,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,MAAM,eAAe,GAAsB;IACzC,6EAA6E;IAC7E,oCAAoC;IACpC,qDAAqD;IACrD,gCAAgC;IAChC,uBAAuB;IACvB,4BAA4B;IAC5B,0CAA0C;CAC3C,CAAC;AAEF,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAExD,MAAM,eAAe,GAAG,2DAA2D,CAAC;AAEpF,MAAM,eAAe,GAAG,kDAAkD,CAAC;AAE3E,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5E,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;SACtH,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAe,CAAC,CAAC;AACzC,CAAC;AASD,uFAAuF;AACvF,MAAM,OAAO,qBAAqB;IACvB,YAAY,CAAoB;IAChC,aAAa,CAAoB;IACjC,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,YAAY,UAAwC,EAAE;QACpD,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;QAC5E,IAAI,CAAC,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,yBAAyB,EAAE,CAAC,CAAC;aACnF,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;aACnD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,gFAAgF;IAChF,yBAAyB,CAAC,IAAY;QACpC,6GAA6G;QAC7G,MAAM,KAAK,GAAG,IAAI;aACf,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;aAChF,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;YAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,IAAc,EAAE,KAA4C,EAAE,EAAE;YAC5E,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,KAAK,GAAG,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7D,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;YACzB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,IAAI,GAAG,OAAO,CAAC;YACnB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa;gBAAE,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACzG,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;gBACtC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;oBAChC,KAAK,IAAI,CAAC,CAAC;oBACX,OAAO,KAAK,CAAC,MAAM,CAAC;gBACtB,CAAC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,sBAAsB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACrH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,yDAAyD;IACzD,aAAa,CAAC,MAAqC;QACjD,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,qEAAqE;gBACrE,wDAAwD;gBACxD,MAAM,YAAY,GAAG,CAAC,KAAc,EAAW,EAAE;oBAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;wBACvC,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;wBACtC,OAAO,UAAU,CAAC,IAAI,CAAC;oBACzB,CAAC;oBACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;wBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;oBACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACvC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnG,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC;gBACF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAChD,GAAG,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAwB;iBACpE,CAAC,CAAC,CAAC;gBACJ,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC;YAClC,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,OAAO,CAAC;YAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IAED,8DAA8D;IAC9D,gBAAgB,CAAC,KAAwC;QACvD,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC;QAC9B,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAe,EACf,SAAgC,EAChC,UAAuD;IAEvD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,MAAqC;YAC9C,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,UAAU,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAwB,EAAE,SAAiB;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAwB,EAAE,WAAmB;IAC/E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACzF,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc,EAAE,WAAmB,EAAE,KAAa;IACtF,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC","sourcesContent":["import type { AgentOutputElement } from '../outbound/agent-output.js';\n/**\n * Outbound leak check (#727, M3.4).\n *\n * Runs on everything the agent sends — final replies, progress updates and\n * the text arguments of outbound tools — as a step in the existing send\n * chain: the guarded ReplyPort masks findings and then hands the message to\n * the real port, so delivery, rendering and before.sendMessage middleware\n * stay exactly as they were.\n *\n * Three kinds of leak are masked:\n * - system_prompt:        verbatim lines from the persona, bootstrap context\n *                         or prompt sections the model was given;\n * - secret:               credential-shaped strings and the values of\n *                         secret-looking environment variables;\n * - other_session_memory: lines read from another session's memory files\n *                         during this turn.\n */\n\nimport type { DeliveryOutcome, ReplyPort } from '../turn/turn-ingress.js';\n\nexport type LeakKind = 'system_prompt' | 'secret' | 'other_session_memory';\n\nexport interface LeakFinding {\n  readonly kind: LeakKind;\n  /** How many occurrences were masked. */\n  readonly count: number;\n}\n\nexport interface LeakInspection {\n  readonly text: string;\n  readonly findings: readonly LeakFinding[];\n}\n\nconst MASKS: Readonly<Record<LeakKind, string>> = Object.freeze({\n  system_prompt: '[已隐藏：系统提示内容]',\n  secret: '[已隐藏：密钥]',\n  other_session_memory: '[已隐藏：其他会话的记忆]',\n});\n\n/** Prompt lines shorter than this are too generic to count as a leak. */\nconst MIN_PROMPT_LINE = 24;\n/** Memory lines shorter than this are too generic to count as a leak. */\nconst MIN_MEMORY_LINE = 12;\n/** Environment values shorter than this are not treated as secrets. */\nconst MIN_SECRET_VALUE = 12;\n\nconst SECRET_PATTERNS: readonly RegExp[] = [\n  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,\n  /\\b(?:sk|pk|rk)-[A-Za-z0-9_-]{16,}/g,\n  /\\b(?:ghp|gho|ghs|ghu|github_pat)_[A-Za-z0-9_]{20,}/g,\n  /\\bxox[abpr]-[A-Za-z0-9-]{10,}/g,\n  /\\bAKIA[0-9A-Z]{16}\\b/g,\n  /\\bAIza[0-9A-Za-z_-]{35}\\b/g,\n  /\\b(?:bearer)\\s+[A-Za-z0-9._~+/=-]{20,}/gi,\n];\n\nconst LINE_NUMBER_PREFIX = /^\\s*\\d+\\s*(?:→|\\||:|\\t)\\s?/;\n\nconst MARKDOWN_PREFIX = /^\\s*(?:[-*+]\\s+(?:\\[[ xX]\\]\\s+)?|#{1,6}\\s+|>\\s+|\\d+\\.\\s+)/;\n\nconst SECRET_ENV_NAME = /(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL)/i;\n\n/** Values of secret-looking environment variables, for exact-match masking. */\nexport function collectEnvironmentSecrets(env: NodeJS.ProcessEnv = process.env): string[] {\n  return Object.entries(env)\n    .filter(([name, value]) => SECRET_ENV_NAME.test(name) && typeof value === 'string' && value.length >= MIN_SECRET_VALUE)\n    .map(([, value]) => value as string);\n}\n\nexport interface OutboundLeakInspectorOptions {\n  /** Persona, bootstrap context and prompt sections the model saw this turn. */\n  readonly promptTexts?: readonly string[];\n  /** Exact secret values (defaults to secret-looking environment variables). */\n  readonly secretValues?: readonly string[];\n}\n\n/** Per-turn inspector; other-session memory lines are added as the turn reads them. */\nexport class OutboundLeakInspector {\n  readonly #promptLines: readonly string[];\n  readonly #secretValues: readonly string[];\n  readonly #memoryLines = new Set<string>();\n\n  constructor(options: OutboundLeakInspectorOptions = {}) {\n    this.#promptLines = uniqueLines(options.promptTexts ?? [], MIN_PROMPT_LINE);\n    this.#secretValues = [...new Set(options.secretValues ?? collectEnvironmentSecrets())]\n      .filter((value) => value.length >= MIN_SECRET_VALUE)\n      .sort((left, right) => right.length - left.length);\n  }\n\n  /** Marks text read from another session's memory as private to that session. */\n  protectOtherSessionMemory(text: string): void {\n    // File tools prefix lines with numbers (\"12 | \") and notes use list markers; the model echoes the text only.\n    const plain = text\n      .split(/\\r?\\n/)\n      .map((line) => line.replace(LINE_NUMBER_PREFIX, '').replace(MARKDOWN_PREFIX, ''))\n      .join('\\n');\n    for (const line of uniqueLines([plain], MIN_MEMORY_LINE)) this.#memoryLines.add(line);\n  }\n\n  inspect(text: string): LeakInspection {\n    const findings: LeakFinding[] = [];\n    let result = text;\n    const mask = (kind: LeakKind, apply: (current: string) => [string, number]) => {\n      const [next, count] = apply(result);\n      if (count > 0) findings.push(Object.freeze({ kind, count }));\n      result = next;\n    };\n    mask('secret', (current) => {\n      let count = 0;\n      let next = current;\n      for (const value of this.#secretValues) [next, count] = replaceLiteral(next, value, MASKS.secret, count);\n      for (const pattern of SECRET_PATTERNS) {\n        next = next.replace(pattern, () => {\n          count += 1;\n          return MASKS.secret;\n        });\n      }\n      return [next, count];\n    });\n    mask('system_prompt', (current) => replaceLines(current, this.#promptLines, MASKS.system_prompt));\n    mask('other_session_memory', (current) => replaceLines(current, [...this.#memoryLines], MASKS.other_session_memory));\n    return Object.freeze({ text: result, findings: Object.freeze(findings) });\n  }\n\n  /** Inspects the text elements of an outbound message. */\n  inspectOutput(output: readonly AgentOutputElement[]): Readonly<{ output: readonly AgentOutputElement[]; findings: readonly LeakFinding[] }> {\n    const findings: LeakFinding[] = [];\n    const next = output.map((element) => {\n      if (element.type === 'message') {\n        // Inspect nested strings too: share titles/URLs and media references\n        // are model-controlled content just like text segments.\n        const inspectValue = (value: unknown): unknown => {\n          if (typeof value === 'string') {\n            const inspection = this.inspect(value);\n            findings.push(...inspection.findings);\n            return inspection.text;\n          }\n          if (Array.isArray(value)) return value.map(inspectValue);\n          if (value && typeof value === 'object') {\n            return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, inspectValue(item)]));\n          }\n          return value;\n        };\n        const segments = element.segments.map(segment => ({\n          ...segment, data: inspectValue(segment.data) as typeof segment.data,\n        }));\n        return { ...element, segments };\n      }\n      if (element.type !== 'text') return element;\n      const inspection = this.inspect(element.content);\n      if (inspection.findings.length === 0) return element;\n      findings.push(...inspection.findings);\n      return { ...element, content: inspection.text };\n    });\n    return Object.freeze({ output: findings.length > 0 ? Object.freeze(next) : output, findings: Object.freeze(findings) });\n  }\n\n  /** Inspects the string arguments of an outbound tool call. */\n  inspectArguments(input: Readonly<Record<string, unknown>>): Readonly<{ input: Readonly<Record<string, unknown>>; findings: readonly LeakFinding[] }> {\n    const findings: LeakFinding[] = [];\n    const next: Record<string, unknown> = {};\n    for (const [key, value] of Object.entries(input)) {\n      if (typeof value !== 'string') {\n        next[key] = value;\n        continue;\n      }\n      const inspection = this.inspect(value);\n      findings.push(...inspection.findings);\n      next[key] = inspection.text;\n    }\n    return Object.freeze({ input: findings.length > 0 ? Object.freeze(next) : input, findings: Object.freeze(findings) });\n  }\n}\n\n/**\n * Send-chain step for the turn's ReplyPort: masks leaks, reports them, then\n * delegates to the real port unchanged.\n */\nexport function guardReplyPort(\n  port: ReplyPort,\n  inspector: OutboundLeakInspector,\n  onFindings?: (findings: readonly LeakFinding[]) => void,\n): ReplyPort {\n  return Object.freeze({\n    async send(output: readonly AgentOutputElement[]): Promise<DeliveryOutcome> {\n      const inspected = inspector.inspectOutput(output);\n      if (inspected.findings.length > 0) onFindings?.(inspected.findings);\n      return port.send(inspected.output);\n    },\n  });\n}\n\nfunction uniqueLines(texts: readonly string[], minLength: number): string[] {\n  const lines = new Set<string>();\n  for (const text of texts) {\n    for (const raw of text.split(/\\r?\\n/)) {\n      const line = raw.trim();\n      if (line.length >= minLength) lines.add(line);\n    }\n  }\n  return [...lines].sort((left, right) => right.length - left.length);\n}\n\nfunction replaceLines(text: string, lines: readonly string[], replacement: string): [string, number] {\n  let count = 0;\n  let next = text;\n  for (const line of lines) [next, count] = replaceLiteral(next, line, replacement, count);\n  return [next, count];\n}\n\nfunction replaceLiteral(text: string, needle: string, replacement: string, count: number): [string, number] {\n  if (!needle || !text.includes(needle)) return [text, count];\n  const parts = text.split(needle);\n  return [parts.join(replacement), count + parts.length - 1];\n}\n"]}

package/lib/security/owner-approval-contracts.d.ts

@@ -3,4 +3,3 @@ export interface OwnerApprovalAddress {
     readonly endpoint: string;
     readonly ownerId: string;
 }
-//# sourceMappingURL=owner-approval-contracts.d.ts.map

package/lib/security/owner-approval-contracts.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-approval-contracts.js","sourceRoot":"","sources":["../../src/security/owner-approval-contracts.ts"],"names":[],"mappings":""}
+{"version":3,"file":"owner-approval-contracts.js","sourceRoot":"","sources":["../../src/security/owner-approval-contracts.ts"],"names":[],"mappings":"","sourcesContent":["export interface OwnerApprovalAddress {\n  readonly platform: string;\n  readonly endpoint: string;\n  readonly ownerId: string;\n}\n"]}

package/lib/security/owner-approval-runtime.d.ts

@@ -36,4 +36,3 @@ export declare function ownerApprovalAddressFromMessage(message: Message): Owner
 export declare function resolveToolRequesterRole(message: Message): ToolRequesterRole;
 export declare const ICQQ_SENSITIVE_SUBCOMMAND_REGEXES: readonly RegExp[];
 export declare function isIcqqSensitiveSubcommand(fullSubCommand: string): boolean;
-//# sourceMappingURL=owner-approval-runtime.d.ts.map

package/lib/security/owner-approval-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-approval-runtime.js","sourceRoot":"","sources":["../../src/security/owner-approval-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAgB,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAI/D,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAe,CAAC;AACzD,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAY/C,MAAM,OAAO,oBAAoB;IACtB,MAAM,CAAqB;IAEpC,YAAY,YAAqB;QAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACzE,IAAI,CAAC,MAAM,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,GAAG,CAAC,OAA6B,EAAE,QAAgB;QACjD,OAAO,QAAQ,KAAK,yBAAyB,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC;IACnG,CAAC;IAED,aAAa,CAAC,OAA6B,EAAE,KAAc;QACzD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,WAAW,CAAC,OAA6B,EAAE,OAAe;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,cAAc,CAAC,OAA6B,EAAE,MAAc;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,iBAAiB,CAAC,OAA6B,EAAE,WAAmB;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,KAAK,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,CAAC,OAA6B;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,0BAA0B,CAAC;QACpC,CAAC;QACD,OAAO;YACL,cAAc,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;YAC5C,YAAY,KAAK,CAAC,MAAM,IAAI;YAC5B,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;SACvE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,aAAa,CAAC,OAAoC,EAAE,OAAe;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YACrF,OAAO,wDAAwD,CAAC;QAClE,CAAC;QAED,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAClC,OAAO,oDAAoD,CAAC;QAC9D,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC1E,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9D,OAAO,MAAM,CAAC,EAAE;gBACd,CAAC,CAAC,cAAc,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,wCAAwC;gBAC7E,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEtE,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC;gBAAE,OAAO,sBAAsB,CAAC;YACjF,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACnC,OAAO,+CAA+C,CAAC;QACzD,CAAC;QAED,OAAO,eAAe,UAAU,EAAE,EAAE,CAAC;IACvC,CAAC;CACF;AAED,MAAM,UAAU,+BAA+B,CAAC,OAAgB;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvF,MAAM,OAAO,GAAG,MAAM,CACnB,OAAoD,CAAC,KAAK,EAAE,cAAc,IAAI,EAAE,CAClF,CAAC,IAAI,EAAE,CAAC;IACT,OAAO,QAAQ,IAAI,QAAQ,IAAI,OAAO;QACpC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAChD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpD,IAAI,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAsB;IAClE,4CAA4C;IAC5C,oFAAoF;IACpF,2CAA2C;IAC3C,sCAAsC;IACtC,wCAAwC;CACzC,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,cAAsB;IAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;WAChC,iCAAiC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAoC;IAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,kBAAkB;QAClB,oDAAoD;QACpD,qDAAqD;QACrD,0CAA0C;QAC1C,wDAAwD;QACxD,gDAAgD;KACjD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAEjD,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,eAAe,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,aAAa,GAAG,eAAe,CAAC;IACpC,OAAO,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAE,CAAC;QAAE,aAAa,IAAI,CAAC,CAAC;IAC3F,IAAI,aAAa,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,aAAa,GAAG,eAAe,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,CAAE,CAAC;QACtC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"owner-approval-runtime.js","sourceRoot":"","sources":["../../src/security/owner-approval-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAgB,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAI/D,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAe,CAAC;AACzD,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAY/C,MAAM,OAAO,oBAAoB;IACtB,MAAM,CAAqB;IAEpC,YAAY,YAAqB;QAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACzE,IAAI,CAAC,MAAM,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,GAAG,CAAC,OAA6B,EAAE,QAAgB;QACjD,OAAO,QAAQ,KAAK,yBAAyB,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC;IACnG,CAAC;IAED,aAAa,CAAC,OAA6B,EAAE,KAAc;QACzD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,WAAW,CAAC,OAA6B,EAAE,OAAe;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,cAAc,CAAC,OAA6B,EAAE,MAAc;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,iBAAiB,CAAC,OAA6B,EAAE,WAAmB;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,KAAK,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,CAAC,OAA6B;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,0BAA0B,CAAC;QACpC,CAAC;QACD,OAAO;YACL,cAAc,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;YAC5C,YAAY,KAAK,CAAC,MAAM,IAAI;YAC5B,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;SACvE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,aAAa,CAAC,OAAoC,EAAE,OAAe;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YACrF,OAAO,wDAAwD,CAAC;QAClE,CAAC;QAED,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAClC,OAAO,oDAAoD,CAAC;QAC9D,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC1E,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9D,OAAO,MAAM,CAAC,EAAE;gBACd,CAAC,CAAC,cAAc,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,wCAAwC;gBAC7E,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEtE,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC;gBAAE,OAAO,sBAAsB,CAAC;YACjF,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACnC,OAAO,+CAA+C,CAAC;QACzD,CAAC;QAED,OAAO,eAAe,UAAU,EAAE,EAAE,CAAC;IACvC,CAAC;CACF;AAED,MAAM,UAAU,+BAA+B,CAAC,OAAgB;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvF,MAAM,OAAO,GAAG,MAAM,CACnB,OAAoD,CAAC,KAAK,EAAE,cAAc,IAAI,EAAE,CAClF,CAAC,IAAI,EAAE,CAAC;IACT,OAAO,QAAQ,IAAI,QAAQ,IAAI,OAAO;QACpC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAChD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpD,IAAI,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAsB;IAClE,4CAA4C;IAC5C,oFAAoF;IACpF,2CAA2C;IAC3C,sCAAsC;IACtC,wCAAwC;CACzC,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,cAAsB;IAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;WAChC,iCAAiC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAoC;IAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,kBAAkB;QAClB,oDAAoD;QACpD,qDAAqD;QACrD,0CAA0C;QAC1C,wDAAwD;QACxD,gDAAgD;KACjD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAEjD,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,eAAe,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,aAAa,GAAG,eAAe,CAAC;IACpC,OAAO,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAE,CAAC;QAAE,aAAa,IAAI,CAAC,CAAC;IAC3F,IAAI,aAAa,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,aAAa,GAAG,eAAe,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,CAAE,CAAC;QACtC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import * as path from 'node:path';\nimport { hasSenderRole, senderRolesFromMessage, type Message } from '@zhin.js/core';\nimport { workspaceRoot } from '../discovery/utils.js';\nimport type { OwnerApprovalAddress } from './owner-approval-contracts.js';\nimport { OwnerApprovalStore } from './owner-approval-store.js';\n\nexport type { OwnerApprovalAddress } from './owner-approval-contracts.js';\n\nexport const OWNER_APPROVE_ALWAYS_TOOL = 'bash' as const;\nconst STORE_FILE = 'owner-approve-always.json';\n\nexport type ToolRequesterRole = 'master' | 'trusted' | 'other' | 'unknown';\n\nexport interface OwnerApprovalCommandContext {\n  readonly platform: string;\n  readonly endpoint: string;\n  readonly ownerId?: string;\n  readonly subjectId: string;\n  readonly scope: 'private' | 'group' | 'channel';\n}\n\nexport class OwnerApprovalRuntime {\n  readonly #store: OwnerApprovalStore;\n\n  constructor(workspaceDir?: string) {\n    const root = workspaceDir ? path.resolve(workspaceDir) : workspaceRoot();\n    this.#store = new OwnerApprovalStore(path.join(root, 'data', STORE_FILE));\n  }\n\n  has(address: OwnerApprovalAddress, toolName: string): boolean {\n    return toolName === OWNER_APPROVE_ALWAYS_TOOL && this.#store.entry(address)?.bashAlways === true;\n  }\n\n  setBashAlways(address: OwnerApprovalAddress, value: boolean): void {\n    this.#store.setBashAlways(address, value);\n  }\n\n  addBashRule(address: OwnerApprovalAddress, pattern: string) {\n    return this.#store.addBashRule(address, pattern);\n  }\n\n  removeBashRule(address: OwnerApprovalAddress, ruleId: string) {\n    return this.#store.removeBashRule(address, ruleId);\n  }\n\n  matchesBashBypass(address: OwnerApprovalAddress, commandLine: string): boolean {\n    const entry = this.#store.entry(address);\n    if (!entry) return false;\n    if (entry.bashAlways) return true;\n    const line = commandLine.trim();\n    if (!line) return false;\n    return entry.bashRules.some((rule) => new RegExp(rule.pattern).test(line));\n  }\n\n  format(address: OwnerApprovalAddress): string {\n    const entry = this.#store.entry(address);\n    const rules = entry?.bashRules ?? [];\n    if (!entry || (!entry.bashAlways && rules.length === 0)) {\n      return 'bash 永久放行: 否\\n自定义正则放行: 无';\n    }\n    return [\n      `bash 永久放行: ${entry.bashAlways ? '是' : '否'}`,\n      `自定义正则放行 (${rules.length}):`,\n      ...rules.map((rule) => `  • [${rule.id.slice(0, 8)}] ${rule.pattern}`),\n    ].join('\\n');\n  }\n\n  handleCommand(context: OwnerApprovalCommandContext, rawText: string): string | null {\n    const text = rawText.trim();\n    if (!/^\\/approve(?:\\s|$)/iu.test(text)) return null;\n    const address = ownerCommandAddress(context);\n    if (context.scope !== 'private' || !address || context.subjectId !== address.ownerId) {\n      return '⚠️ 仅 Endpoint Owner 可在私聊中使用此指令。需在插件配置中设置 master/owner。';\n    }\n\n    if (/^\\/approve\\s+always\\s+bash\\s*$/iu.test(text)) {\n      this.setBashAlways(address, true);\n      return '✅ 已对 bash 永久放行 Owner 硬确认（本 Bot）。后续 bash 需确认时将不再弹窗。';\n    }\n\n    const revokeRule = text.match(/^\\/approve\\s+revoke\\s+rule\\s+(\\S+)\\s*$/iu);\n    if (revokeRule) {\n      const result = this.removeBashRule(address, revokeRule[1]!);\n      return result.ok ? '✅ 已删除该放行规则。' : `⚠️ ${result.error}`;\n    }\n\n    const ruleArgument = matchApproveRuleArgument(text);\n    if (ruleArgument !== null) {\n      const result = this.addBashRule(address, ruleArgument.trim());\n      return result.ok\n        ? `✅ 已添加规则 id=${result.id.slice(0, 8)}… ，匹配子命令时将不再要求 Owner 确认（仍受危险命令黑名单等约束）。`\n        : `⚠️ ${result.error}`;\n    }\n\n    if (/^\\/approve\\s+list\\s*$/iu.test(text)) return this.format(address);\n\n    if (/^\\/approve\\s+revoke\\s*$/iu.test(text)) {\n      if (!this.has(address, OWNER_APPROVE_ALWAYS_TOOL)) return '⚠️ 当前未对 bash 设置永久放行。';\n      this.setBashAlways(address, false);\n      return '✅ 已撤销 bash 永久放行（正则规则仍保留，可用 /approve list 查看）。';\n    }\n\n    return `⚠️ 无法解析指令。\\n${usageLines()}`;\n  }\n}\n\nexport function ownerApprovalAddressFromMessage(message: Message): OwnerApprovalAddress | undefined {\n  const platform = String(message.clientAdapter ?? message.conversation.endpoint.adapter).trim();\n  const endpoint = String(message.endpointId ?? message.conversation.endpoint.id).trim();\n  const ownerId = String(\n    (message as { extra?: { endpointMaster?: unknown } }).extra?.endpointMaster ?? '',\n  ).trim();\n  return platform && endpoint && ownerId\n    ? Object.freeze({ platform, endpoint, ownerId })\n    : undefined;\n}\n\nexport function resolveToolRequesterRole(message: Message): ToolRequesterRole {\n  const roles = senderRolesFromMessage(message);\n  if (hasSenderRole(roles, 'master')) return 'master';\n  if (hasSenderRole(roles, 'trusted')) return 'trusted';\n  if (!message.sender?.id) return 'unknown';\n  const address = ownerApprovalAddressFromMessage(message);\n  return address && String(message.sender.id) === address.ownerId ? 'master' : 'other';\n}\n\nexport const ICQQ_SENSITIVE_SUBCOMMAND_REGEXES: readonly RegExp[] = [\n  /\\bicqq\\s+friend\\s+(?:delete|block|move)\\b/i,\n  /\\bicqq\\s+group\\s+(?:kick|mute|set|admin|announce|transfer|quit|dissolve|invite)\\b/i,\n  /\\bicqq\\s+(?:request|wallet|pay|recall)\\b/i,\n  /\\bicqq\\s+file\\s+(?:upload|delete)\\b/i,\n  /\\bicqq\\s+gfs\\b.*\\b(?:rm|delete|del)\\b/i,\n];\n\nexport function isIcqqSensitiveSubcommand(fullSubCommand: string): boolean {\n  const line = fullSubCommand.trim();\n  return /^\\s*icqq(?:\\s|$)/i.test(line)\n    && ICQQ_SENSITIVE_SUBCOMMAND_REGEXES.some((pattern) => pattern.test(line));\n}\n\nfunction ownerCommandAddress(context: OwnerApprovalCommandContext): OwnerApprovalAddress | undefined {\n  if (!context.platform || !context.endpoint || !context.ownerId) return undefined;\n  return Object.freeze({\n    platform: context.platform,\n    endpoint: context.endpoint,\n    ownerId: context.ownerId,\n  });\n}\n\nfunction usageLines(): string {\n  return [\n    '用法（bash / icqq）：',\n    '  /approve always bash     — 永久跳过 bash 的 Owner 硬确认',\n    '  /approve rule <正则>   — 为敏感 icqq 命令增加放行规则（匹配整段子命令）',\n    '  /approve list           — 列出永久放行与规则 id',\n    '  /approve revoke rule <id> — 删除一条规则（id 可用 list 前 8 位）',\n    '  /approve revoke         — 撤销 bash 永久放行（不删规则）',\n  ].join('\\n');\n}\n\nconst LINE_TERMINATOR_RE = /[\\n\\r\\u2028\\u2029]/u;\n\nfunction matchApproveRuleArgument(text: string): string | null {\n  const head = /^\\/approve\\s+rule/iu.exec(text);\n  if (!head) return null;\n  const whitespaceStart = head[0].length;\n  let whitespaceEnd = whitespaceStart;\n  while (whitespaceEnd < text.length && /\\s/u.test(text[whitespaceEnd]!)) whitespaceEnd += 1;\n  if (whitespaceEnd === whitespaceStart) return null;\n  const rest = text.slice(whitespaceEnd);\n  if (LINE_TERMINATOR_RE.test(rest)) return null;\n  if (rest.length > 0) return rest;\n  if (whitespaceEnd - whitespaceStart >= 2) {\n    const last = text[whitespaceEnd - 1]!;\n    if (!LINE_TERMINATOR_RE.test(last)) return last;\n  }\n  return null;\n}\n"]}

package/lib/security/owner-approval-store.d.ts

@@ -31,4 +31,3 @@ export declare class OwnerApprovalStore {
 export declare class OwnerApprovalStoreFormatError extends Error {
     constructor(filePath: string, options?: unknown);
 }
-//# sourceMappingURL=owner-approval-store.d.ts.map

package/lib/security/owner-approval-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-approval-store.js","sourceRoot":"","sources":["../../src/security/owner-approval-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,MAAM,aAAa,GAAG,CAAU,CAAC;AAkBjC,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,KAAK,CAAC,OAA6B;QACjC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,aAAa,CAAC,OAA6B,EAAE,KAAc;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC;YACV,OAAO,EAAE,aAAa;YACtB,SAAS,EAAE;gBACT,GAAG,QAAQ,CAAC,SAAS;gBACrB,CAAC,GAAG,CAAC,EAAE;oBACL,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtC,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC;iBACnC;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CACT,OAA6B,EAC7B,OAAe;QAEf,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACjG,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC;YACV,OAAO,EAAE,aAAa;YACtB,SAAS,EAAE;gBACT,GAAG,QAAQ,CAAC,SAAS;gBACrB,CAAC,GAAG,CAAC,EAAE;oBACL,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;iBACpF;aACF;SACF,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC1B,CAAC;IAED,cAAc,CACZ,OAA6B,EAC7B,MAAc;QAEd,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC;YACV,OAAO,EAAE,aAAa;YACtB,SAAS,EAAE;gBACT,GAAG,QAAQ,CAAC,SAAS;gBACrB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE;aACrC;SACF,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,KAAK;QACH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,kBAAkB,CAAC,KAAK,CAAC;gBAAE,OAAO,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,MAAM,CAAC,QAA+B;QACpC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;QAC/E,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/E,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,QAAgB,EAAE,OAAiB;QAC7C,KAAK,CAAC,oCAAoC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,SAAS,UAAU,CAAC,OAA6B;IAC/C,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,SAAS,GAAsC,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,SAAS,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACtE,MAAM,IAAI,SAAS,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,SAAS,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACzE,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,KAAc;IACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,SAAS,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;WAChE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,SAAS,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CACnB,KAA8B,EAC9B,QAA2B,EAC3B,WAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;WACpD,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"owner-approval-store.js","sourceRoot":"","sources":["../../src/security/owner-approval-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,MAAM,aAAa,GAAG,CAAU,CAAC;AAkBjC,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,KAAK,CAAC,OAA6B;QACjC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,aAAa,CAAC,OAA6B,EAAE,KAAc;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC;YACV,OAAO,EAAE,aAAa;YACtB,SAAS,EAAE;gBACT,GAAG,QAAQ,CAAC,SAAS;gBACrB,CAAC,GAAG,CAAC,EAAE;oBACL,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtC,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC;iBACnC;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CACT,OAA6B,EAC7B,OAAe;QAEf,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACjG,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC;YACV,OAAO,EAAE,aAAa;YACtB,SAAS,EAAE;gBACT,GAAG,QAAQ,CAAC,SAAS;gBACrB,CAAC,GAAG,CAAC,EAAE;oBACL,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;iBACpF;aACF;SACF,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC1B,CAAC;IAED,cAAc,CACZ,OAA6B,EAC7B,MAAc;QAEd,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC;YACV,OAAO,EAAE,aAAa;YACtB,SAAS,EAAE;gBACT,GAAG,QAAQ,CAAC,SAAS;gBACrB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE;aACrC;SACF,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,KAAK;QACH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,kBAAkB,CAAC,KAAK,CAAC;gBAAE,OAAO,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,MAAM,CAAC,QAA+B;QACpC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;QAC/E,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/E,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,QAAgB,EAAE,OAAiB;QAC7C,KAAK,CAAC,oCAAoC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,SAAS,UAAU,CAAC,OAA6B;IAC/C,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,SAAS,GAAsC,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,SAAS,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACtE,MAAM,IAAI,SAAS,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,SAAS,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACzE,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,KAAc;IACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,SAAS,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;WAChE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,SAAS,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CACnB,KAA8B,EAC9B,QAA2B,EAC3B,WAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;WACpD,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC","sourcesContent":["import * as crypto from 'node:crypto';\nimport * as fs from 'node:fs';\nimport * as path from 'node:path';\nimport type { OwnerApprovalAddress } from './owner-approval-contracts.js';\n\nconst STORE_VERSION = 2 as const;\n\nexport interface BashRuleEntry {\n  readonly id: string;\n  readonly pattern: string;\n  readonly createdAt: number;\n}\n\nexport interface BashApprovalEntry {\n  readonly bashAlways?: boolean;\n  readonly bashRules: readonly BashRuleEntry[];\n}\n\ninterface OwnerApprovalDocument {\n  readonly version: typeof STORE_VERSION;\n  readonly endpoints: Readonly<Record<string, BashApprovalEntry>>;\n}\n\nexport class OwnerApprovalStore {\n  constructor(private readonly filePath: string) {}\n\n  entry(address: OwnerApprovalAddress): BashApprovalEntry | undefined {\n    return this.#read().endpoints[addressKey(address)];\n  }\n\n  setBashAlways(address: OwnerApprovalAddress, value: boolean): void {\n    const document = this.#read();\n    const key = addressKey(address);\n    const previous = document.endpoints[key] ?? { bashRules: [] };\n    this.#write({\n      version: STORE_VERSION,\n      endpoints: {\n        ...document.endpoints,\n        [key]: {\n          ...(value ? { bashAlways: true } : {}),\n          bashRules: [...previous.bashRules],\n        },\n      },\n    });\n  }\n\n  addBashRule(\n    address: OwnerApprovalAddress,\n    pattern: string,\n  ): { ok: true; id: string } | { ok: false; error: string } {\n    const trimmed = pattern.trim();\n    if (!trimmed) return { ok: false, error: '正则不能为空。' };\n    try {\n      new RegExp(trimmed);\n    } catch (error) {\n      return { ok: false, error: `无效正则: ${error instanceof Error ? error.message : String(error)}` };\n    }\n    const document = this.#read();\n    const key = addressKey(address);\n    const previous = document.endpoints[key] ?? { bashRules: [] };\n    const id = crypto.randomUUID();\n    this.#write({\n      version: STORE_VERSION,\n      endpoints: {\n        ...document.endpoints,\n        [key]: {\n          ...(previous.bashAlways ? { bashAlways: true } : {}),\n          bashRules: [...previous.bashRules, { id, pattern: trimmed, createdAt: Date.now() }],\n        },\n      },\n    });\n    return { ok: true, id };\n  }\n\n  removeBashRule(\n    address: OwnerApprovalAddress,\n    ruleId: string,\n  ): { ok: true } | { ok: false; error: string } {\n    const id = ruleId.trim();\n    if (!id) return { ok: false, error: '请提供规则 id。' };\n    const document = this.#read();\n    const key = addressKey(address);\n    const entry = document.endpoints[key];\n    if (!entry?.bashRules.length) return { ok: false, error: '当前无自定义规则。' };\n    const next = entry.bashRules.filter((rule) => rule.id !== id && !rule.id.startsWith(id));\n    if (next.length === entry.bashRules.length) {\n      return { ok: false, error: `未找到 id 前缀或全名为「${id}」的规则。` };\n    }\n    this.#write({\n      version: STORE_VERSION,\n      endpoints: {\n        ...document.endpoints,\n        [key]: { ...entry, bashRules: next },\n      },\n    });\n    return { ok: true };\n  }\n\n  #read(): OwnerApprovalDocument {\n    try {\n      const source = fs.readFileSync(this.filePath, 'utf-8');\n      return parseDocument(JSON.parse(source));\n    } catch (error) {\n      if (isMissingFileError(error)) return emptyDocument();\n      throw new OwnerApprovalStoreFormatError(this.filePath, error);\n    }\n  }\n\n  #write(document: OwnerApprovalDocument): void {\n    fs.mkdirSync(path.dirname(this.filePath), { recursive: true });\n    const temporary = `${this.filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;\n    fs.writeFileSync(temporary, `${JSON.stringify(document, null, 2)}\\n`, 'utf-8');\n    fs.renameSync(temporary, this.filePath);\n  }\n}\n\nexport class OwnerApprovalStoreFormatError extends Error {\n  constructor(filePath: string, options?: unknown) {\n    super(`Owner approval store is invalid: ${filePath}`, { cause: options });\n    this.name = 'OwnerApprovalStoreFormatError';\n  }\n}\n\nfunction addressKey(address: OwnerApprovalAddress): string {\n  return `${address.platform}|${address.endpoint}|${address.ownerId}`;\n}\n\nfunction emptyDocument(): OwnerApprovalDocument {\n  return { version: STORE_VERSION, endpoints: {} };\n}\n\nfunction parseDocument(input: unknown): OwnerApprovalDocument {\n  if (!isRecord(input) || !hasExactKeys(input, ['version', 'endpoints'])) {\n    throw new TypeError('Invalid Owner approval document');\n  }\n  if (input.version !== STORE_VERSION || !isRecord(input.endpoints)) {\n    throw new TypeError('Unsupported Owner approval document version');\n  }\n  const endpoints: Record<string, BashApprovalEntry> = {};\n  for (const [key, rawEntry] of Object.entries(input.endpoints)) {\n    if (!isRecord(rawEntry) || !hasExactKeys(rawEntry, ['bashRules'], ['bashAlways'])) {\n      throw new TypeError(`Invalid Owner approval entry: ${key}`);\n    }\n    if (rawEntry.bashAlways !== undefined && rawEntry.bashAlways !== true) {\n      throw new TypeError(`Invalid bashAlways value: ${key}`);\n    }\n    if (!Array.isArray(rawEntry.bashRules)) {\n      throw new TypeError(`Invalid bashRules value: ${key}`);\n    }\n    const bashRules = rawEntry.bashRules.map((rule) => parseRule(key, rule));\n    endpoints[key] = Object.freeze({\n      ...(rawEntry.bashAlways ? { bashAlways: true } : {}),\n      bashRules: Object.freeze(bashRules),\n    });\n  }\n  return Object.freeze({ version: STORE_VERSION, endpoints: Object.freeze(endpoints) });\n}\n\nfunction parseRule(endpoint: string, input: unknown): BashRuleEntry {\n  if (!isRecord(input) || !hasExactKeys(input, ['id', 'pattern', 'createdAt'])) {\n    throw new TypeError(`Invalid Owner approval rule: ${endpoint}`);\n  }\n  if (typeof input.id !== 'string' || typeof input.pattern !== 'string'\n    || typeof input.createdAt !== 'number' || !Number.isFinite(input.createdAt)) {\n    throw new TypeError(`Invalid Owner approval rule fields: ${endpoint}`);\n  }\n  new RegExp(input.pattern);\n  return Object.freeze({ id: input.id, pattern: input.pattern, createdAt: input.createdAt });\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction hasExactKeys(\n  value: Record<string, unknown>,\n  required: readonly string[],\n  optional: readonly string[] = [],\n): boolean {\n  const keys = Object.keys(value);\n  return required.every((key) => Object.hasOwn(value, key))\n    && keys.every((key) => required.includes(key) || optional.includes(key));\n}\n\nfunction isMissingFileError(error: unknown): boolean {\n  return error instanceof Error && 'code' in error && error.code === 'ENOENT';\n}\n"]}

package/lib/security/policy-facade.d.ts

@@ -103,4 +103,3 @@ export declare function runToolPolicies(input: ToolPolicyInput): ToolPolicyResul
  * 文案与各工具迁移前逐层手写的返回严格一致。
  */
 export declare function toolPolicyResultToMessage(result: ToolPolicyResult, toolName?: string): string | null;
-//# sourceMappingURL=policy-facade.d.ts.map

package/lib/security/policy-facade.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-facade.js","sourceRoot":"","sources":["../../src/security/policy-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,GAG5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,EACnB,4BAA4B,EAC5B,WAAW,EACX,aAAa,GAGd,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC9G,OAAO,EAAE,wBAAwB,EAA0B,MAAM,6BAA6B,CAAC;AAC/F,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAgElE,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA0B;IAClE,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,8FAA8F;IAC9F,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,wBAAwB;SACjC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,eAAe,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAChD,KAAK,CAAC,IAAI,CAAC,IAAI,EACf,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAC/C,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC;QACtC,MAAM,IAAI,GAAG,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,mBAAmB,CACpC,2BAA2B,CAAC,aAAa,CAAC,EAC1C,aAAa,EACb,IAAI,CACL,CAAC;QACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;QACnG,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,KAAK,WAAW,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YACrF,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,gCAAgC,aAAa,iBAAiB;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAC/C,MAAM,EACN,eAAe,EACf,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAC/C,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,eAAe,GAAG,YAAY,CAAC,KAAK,CAAC;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBACpC,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAChF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,OAAO,MAAM,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,qBAAqB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,SAAS;qBACpF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACvB,OAAO,MAAM,CAAC,MAAM,CAAC;4BACnB,MAAM,EAAE,mBAAmB;4BAC3B,MAAM,EAAE,aAAa;4BACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,iCAAiC;4BACxD,KAAK,EAAE,eAAe;yBACvB,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,MAAM,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,sBAAsB;qBAC9C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,qBAAqB;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,qBAAqB;iBAC/C,CAAC,CAAC;YACL,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,MAAM,aAAa,GAAG,mBAAmB,CACvC,2BAA2B,CAAC,aAAa,CAAC,EAC1C,MAAM,EACN,IAAI,CACL,CAAC;gBACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,aAAa,EAAE,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC/F,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;YAChC,CAAC;YACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;YAChG,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;YACjG,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;gBACrI,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,kBAAkB;oBAC1B,MAAM,EAAE,sCAAsC,UAAU,CAAC,aAAa,iBAAiB;iBACxF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,2BAA2B,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YAChE,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAoB;IACvD,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,QAAQ,KAAK,MAAM;WACrB,QAAQ,KAAK,WAAW;WACxB,QAAQ,KAAK,YAAY;WACzB,wBAAwB,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAA0B;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;QAC1C,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzF,CAAC,CAAC,OAAO;YACP,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC;YACjC,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,gBAAgB,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,mDAAmD;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE;YAC1C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,uBAAuB;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CACjC,UAAgC,EAChC,MAAc,EACd,KAAwC;IAExC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,QAAQ,UAAU,CAAC,SAAS,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,iBAAiB,IAAI,UAAU,CAAC,sBAAsB,EAAE,CAAC;QACtE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,QAAQ,UAAU,CAAC,SAAS,oBAAoB;YAC7E,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IAChD,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM;WACzE,QAAQ,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAiB;IACjD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CACrB,KAAwC,EACxC,GAAG,KAAwB;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AACtG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhF,0DAA0D;AAC1D,SAAS,oBAAoB,CAAC,KAAsB;IAClD,IAAI,KAAK,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC,aAAa,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gDAAgD;AAChD,SAAS,aAAa,CAAC,KAAsB;IAC3C,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAwB;IACrD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC;KACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,0BAA0B,CAAC,KAAsB;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC;IACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,aAAa,GAAsB,cAAc,CAAC;IACtD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;QACpE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAW,EAAE;gBACtD,SAAS,EAAE,KAAK,CAAC,aAAc,CAAC,SAAS;gBACzC,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAc,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;aACjE,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7E,CAAC;KACF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,uDAAuD;YACvD,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW;oBAC5B,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,qBAAqB,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAwB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACvG,CAAC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC1E,CAAC;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW;oBAC5B,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,qBAAqB,CAC1B,wBAAwB,CAAC,KAAK,CAAC,QAAoD,EAAE,KAAK,CAAC,WAAW,CAAC,CACxG,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CACrC,4BAA4B,CAAC,KAAK,CAAC,OAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CACpF;KACF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,SAAS;QAC7D,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAsB,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;YAC9E,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,2BAA2B,CAAC,aAAa,CAAC;wBAChD,SAAS;qBACqB;iBACjC,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjG,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,aAAa,GACjB,KAAK,CAAC,WAAW;gBACf,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC7C,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,IAAI,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YACvF,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC3C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,qBAAqB,CACnB,4BAA4B,CAC1B,KAAK,CAAC,QAAwB,EAC9B,KAAK,CAAC,QAAS,EACf,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,CACnB,CACF;KACJ;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;QACvG,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAS,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACpE,iCAAiC;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,aAAa,KAAK,CAAC,QAAS,EAAE;gBAChC,CAAC,CAAC,YAAY,KAAK,CAAC,QAAS,gBAAgB,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,MAAO,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,aAAa,IAAI,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAChH,CAAC;KACF;CACF,CAAC,CAAC;AAEH,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,kBAAkB,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,sDAAsD;AAEtD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAwB,EAAE,QAAQ,GAAG,EAAE;IAC/E,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC9D,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,wBAAwB,CAAC;QAC9B,KAAK,sBAAsB;YACzB,4DAA4D;YAC5D,OAAO,2BAA2B,CAAC,MAAM,CAAC,OAA+B,EAAE,QAAQ,CAAC,CAAC;QACvF,KAAK,mBAAmB;YACtB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,qBAAqB;YACxB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,kBAAkB;YACrB,OAAO,sBAAsB,MAAM,CAAC,MAAO,0CAA0C,CAAC;QACxF,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,sBAAsB,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE;gBAC5D,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;QAC9C,OAAO,CAAC,CAAC,CAAC;YACR,oFAAoF;YACpF,MAAM,QAAQ,GAA0B;gBACtC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;aAC/B,CAAC;YACF,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"policy-facade.js","sourceRoot":"","sources":["../../src/security/policy-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,2BAA2B,GAG5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,EACnB,4BAA4B,EAC5B,WAAW,EACX,aAAa,GAGd,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC9G,OAAO,EAAE,wBAAwB,EAA0B,MAAM,6BAA6B,CAAC;AAC/F,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAgElE,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA0B;IAClE,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,8FAA8F;IAC9F,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,wBAAwB;SACjC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,eAAe,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAChD,KAAK,CAAC,IAAI,CAAC,IAAI,EACf,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAC/C,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC;QACtC,MAAM,IAAI,GAAG,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,mBAAmB,CACpC,2BAA2B,CAAC,aAAa,CAAC,EAC1C,aAAa,EACb,IAAI,CACL,CAAC;QACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC;QACnG,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,KAAK,WAAW,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YACrF,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,gCAAgC,aAAa,iBAAiB;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAC/C,MAAM,EACN,eAAe,EACf,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAC/C,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,eAAe,GAAG,YAAY,CAAC,KAAK,CAAC;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBACpC,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAChF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,OAAO,MAAM,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,qBAAqB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,SAAS;qBACpF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACvB,OAAO,MAAM,CAAC,MAAM,CAAC;4BACnB,MAAM,EAAE,mBAAmB;4BAC3B,MAAM,EAAE,aAAa;4BACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,iCAAiC;4BACxD,KAAK,EAAE,eAAe;yBACvB,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,MAAM,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,aAAa;wBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,sBAAsB;qBAC9C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,qBAAqB;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,qBAAqB;iBAC/C,CAAC,CAAC;YACL,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,MAAM,aAAa,GAAG,mBAAmB,CACvC,2BAA2B,CAAC,aAAa,CAAC,EAC1C,MAAM,EACN,IAAI,CACL,CAAC;gBACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,aAAa,EAAE,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC/F,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;YAChC,CAAC;YACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;YAChG,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;YACjG,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;gBACrI,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,kBAAkB;oBAC1B,MAAM,EAAE,sCAAsC,UAAU,CAAC,aAAa,iBAAiB;iBACxF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,2BAA2B,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE;YAChE,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAoB;IACvD,IAAI,IAAI,CAAC,gBAAgB,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,QAAQ,KAAK,MAAM;WACrB,QAAQ,KAAK,WAAW;WACxB,QAAQ,KAAK,YAAY;WACzB,wBAAwB,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAA0B;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;QAC1C,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzF,CAAC,CAAC,OAAO;YACP,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC;YACjC,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,gBAAgB,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,mDAAmD;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE;YAC1C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,uBAAuB;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CACjC,UAAgC,EAChC,MAAc,EACd,KAAwC;IAExC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,QAAQ,UAAU,CAAC,SAAS,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,iBAAiB,IAAI,UAAU,CAAC,sBAAsB,EAAE,CAAC;QACtE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,QAAQ,UAAU,CAAC,SAAS,oBAAoB;YAC7E,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IAChD,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM;WACzE,QAAQ,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAiB;IACjD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CACrB,KAAwC,EACxC,GAAG,KAAwB;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AACtG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhF,0DAA0D;AAC1D,SAAS,oBAAoB,CAAC,KAAsB;IAClD,IAAI,KAAK,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC,aAAa,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,QAAQ,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gDAAgD;AAChD,SAAS,aAAa,CAAC,KAAsB;IAC3C,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAwB;IACrD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC;KACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,0BAA0B,CAAC,KAAsB;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC;IACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,aAAa,GAAsB,cAAc,CAAC;IACtD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;QACpE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAW,EAAE;gBACtD,SAAS,EAAE,KAAK,CAAC,aAAc,CAAC,SAAS;gBACzC,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAc,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;aACjE,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7E,CAAC;KACF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,uDAAuD;YACvD,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW;oBAC5B,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,qBAAqB,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAwB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACvG,CAAC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC1E,CAAC;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW;oBAC5B,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,qBAAqB,CAC1B,wBAAwB,CAAC,KAAK,CAAC,QAAoD,EAAE,KAAK,CAAC,WAAW,CAAC,CACxG,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CACrC,4BAA4B,CAAC,KAAK,CAAC,OAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CACpF;KACF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,SAAS;QAC7D,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAsB,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;YAC9E,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE;wBACP,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,2BAA2B,CAAC,aAAa,CAAC;wBAChD,SAAS;qBACqB;iBACjC,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjG,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACvE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,aAAa,GACjB,KAAK,CAAC,WAAW;gBACf,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC7C,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,IAAI,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,kBAAkB,EAChB,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,sBAAsB,KAAK,IAAI,CAAC;oBACzG,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,UAAU;aACpB,CAAC;QACJ,CAAC;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YACvF,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC3C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,qBAAqB,CACnB,4BAA4B,CAC1B,KAAK,CAAC,QAAwB,EAC9B,KAAK,CAAC,QAAS,EACf,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,CACnB,CACF;KACJ;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;QACvG,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAS,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACpE,iCAAiC;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,aAAa,KAAK,CAAC,QAAS,EAAE;gBAChC,CAAC,CAAC,YAAY,KAAK,CAAC,QAAS,gBAAgB,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QACxC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACnE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,MAAO,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,aAAa,IAAI,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAChH,CAAC;KACF;CACF,CAAC,CAAC;AAEH,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/C,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,kBAAkB,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,sDAAsD;AAEtD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAwB,EAAE,QAAQ,GAAG,EAAE;IAC/E,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC9D,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,wBAAwB,CAAC;QAC9B,KAAK,sBAAsB;YACzB,4DAA4D;YAC5D,OAAO,2BAA2B,CAAC,MAAM,CAAC,OAA+B,EAAE,QAAQ,CAAC,CAAC;QACvF,KAAK,mBAAmB;YACtB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,qBAAqB;YACxB,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK,kBAAkB;YACrB,OAAO,sBAAsB,MAAM,CAAC,MAAO,0CAA0C,CAAC;QACxF,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,kBAAkB;gBAC9B,CAAC,CAAC,sBAAsB,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE;gBAC5D,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;QAC9C,OAAO,CAAC,CAAC,CAAC;YACR,oFAAoF;YACpF,MAAM,QAAQ,GAA0B;gBACtC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;aAC/B,CAAC;YACF,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * 统一工具安全策略门面（policy facade）\n *\n * 本模块把各策略层声明为一张按 priority 排序的策略表，`runToolPolicies` 依序执行，\n * 第一个终结决策（deny 或需 Owner 确认）即短路返回，`decisions` 记录已执行层。\n *\n * 层顺序：\n *   role-gate → bash-command-safety → dangerous-tool-approval → bash-sensitive-read\n *   → file-permission-matrix（文件写类 + 显式 read）→ bash-file-permission\n *   → memory-write-path（写类且有 filePath）→ sensitive-path（有 filePath）\n *   → blocked-device-path（写类且有 filePath；read_file 经 devicePathGuard 显式启用）\n *   → workspace-access（写类且有 filePath）\n *   → exec-policy（有 command 且给 config）\n *\n * memory-write-path / blocked-device-path / workspace-access 仅对写操作生效；\n * read 类工具由文件权限矩阵和显式 devicePathGuard 约束。\n */\n\nimport { NETWORK_DISABLED_REASON, NETWORK_TOOL_NAMES } from './network-authority.js';\nimport type { Message } from '@zhin.js/core';\nimport type { ZhinAgentConfig } from '../config/index.js';\nimport { checkMemoryWritePath } from '../memory-layers.js';\nimport {\n  TRUST_LEVEL_POLICY,\n  TRUST_RESTRICTION_REASON,\n  isToolAboveTrust,\n  resolveTurnTrustLevel,\n} from './trust-level.js';\nimport {\n  checkFileAccess,\n  checkBashCommandSafety,\n  extractBashReadPaths,\n  isBlockedDevicePath,\n} from './file-policy.js';\nimport {\n  checkBashFilePermission,\n  checkFilePermission,\n  formatFilePermissionMessage,\n  toolRequesterRoleToFileRole,\n  type FileOperation,\n  type FilePermissionResult,\n} from './file-role-policy.js';\nimport {\n  checkBashSensitiveReadAccess,\n  checkDangerousToolAccess,\n  checkFileToolAccess,\n  checkSensitiveFilePathAccess,\n  toDenyError,\n  toOwnerSignal,\n  type DangerousToolDecision,\n  type FileToolName,\n} from './dangerous-tool-policy.js';\nimport { checkExecPolicyWithOptions, checkTurnExecPolicy, checkUnattendedExecPreset } from './exec-policy.js';\nimport { resolveToolRequesterRole, type ToolRequesterRole } from './owner-approval-runtime.js';\nimport {\n  checkUrlNetworkAccess,\n  extractUrlsFromCommand,\n  NETWORK_COMMAND_PATTERNS,\n} from './network-policy.js';\nimport type { ToolNetworkPolicy } from './network-policy-context.js';\nimport type { ToolDescriptor } from '@zhin.js/tool';\nimport type { TurnIngress } from '../turn/turn-ingress.js';\nimport { authorizeTurnFileInput } from './turn-file-authority.js';\n\n// ── 输入 / 输出类型 ─────────────────────────────────────────────────\n\nexport interface ToolPolicyInput {\n  /** 工具名：'read_file'|'edit_file'|'write_file'|'glob'|'list_dir'|'bash'|'web_fetch'|... */\n  toolName: string;\n  /** 目标路径（文件类工具；已按工具既有行为 expandHome 后传入） */\n  filePath?: string;\n  /**\n   * 未 expandHome 的原始路径，仅供 file-permission-matrix 层使用\n   * （旧实现中权限矩阵在 expandHome 之前执行，为保持等价单独透传）。\n   */\n  rawFilePath?: string;\n  /** Workspace root used to resolve and authorize relative file paths. */\n  workspaceDir?: string;\n  /** 覆盖从 toolName 推导的文件操作类型（edit_file→update，write_file→create） */\n  fileOperation?: FileOperation;\n  /** bash 命令（exec-policy 与 bash 三层用） */\n  command?: string;\n  /** 读类工具显式启用 blocked-device-path 层。 */\n  devicePathGuard?: boolean;\n  commMessage?: Message;\n  /** exec policy 用配置 */\n  config?: Required<ZhinAgentConfig>;\n  /** URL-bearing unattended tool invocation. */\n  networkUrl?: string;\n  /** Optional generic network constraint supplied by an execution harness. */\n  networkPolicy?: ToolNetworkPolicy;\n}\n\nexport interface ToolPolicyDecision {\n  allowed: boolean;\n  reason?: string;\n  /** 需 Owner/二次确认（gate）；allowed=true 时同样终结执行 */\n  needsOwnerApproval?: boolean;\n  role?: ToolRequesterRole;\n  /** 各层原始结果（FilePermissionResult / DangerousToolDecision / ExecPolicyResult ...） */\n  payload?: unknown;\n}\n\nexport interface ToolPolicyLayerRecord {\n  policy: string;\n  decision: ToolPolicyDecision;\n}\n\nexport interface ToolPolicyResult extends ToolPolicyDecision {\n  /** 产生终结决策的策略名（全部通过时无） */\n  deniedBy?: string;\n  /** 已执行层的决策记录 */\n  decisions: ReadonlyArray<ToolPolicyLayerRecord>;\n}\n\nexport type TurnToolPolicyDecision =\n  | Readonly<{ status: 'allowed'; input: Readonly<Record<string, unknown>> }>\n  | Readonly<{ status: 'denied'; policy: string; reason: string }>\n  | Readonly<{ status: 'approval_required'; policy: string; reason: string; input: Readonly<Record<string, unknown>> }>;\n\nexport interface TurnToolPolicyInput {\n  readonly turn: TurnIngress;\n  readonly tool: ToolDescriptor;\n  readonly input: Readonly<Record<string, unknown>>;\n}\n\n/** Generic, execution-domain-neutral policy facade for canonical Turn tools. */\nexport async function runTurnToolPolicies(input: TurnToolPolicyInput): Promise<TurnToolPolicyDecision> {\n  const requesterRole = resolveTurnRequesterRole(input.turn);\n  // Defense in depth for #726: also covers tools that reach a turn later (e.g. deferred loads).\n  if (isToolAboveTrust(input.tool, resolveTurnTrustLevel(input.turn))) {\n    return Object.freeze({\n      status: 'denied',\n      policy: TRUST_LEVEL_POLICY,\n      reason: TRUST_RESTRICTION_REASON,\n    });\n  }\n  const networkDecision = checkTurnNetworkPolicy(input);\n  if (networkDecision) return networkDecision;\n  const fileOperation = resolveTurnFileOperation(input.tool.name);\n  let authorizedInput = input.input;\n  if (fileOperation) {\n    const fileAuthority = await authorizeTurnFileInput(\n      input.tool.name,\n      input.input,\n      input.turn.policy.filesystem?.workspaceRoot,\n      input.turn.policy.filesystem?.workingDirectory,\n    );\n    if (!fileAuthority.allowed) {\n      return Object.freeze({ status: 'denied', policy: 'workspace-access', reason: fileAuthority.reason });\n    }\n    authorizedInput = fileAuthority.input;\n    const path = stringArgument(authorizedInput, 'path', 'file_path', 'filePath');\n    const permission = checkFilePermission(\n      toolRequesterRoleToFileRole(requesterRole),\n      fileOperation,\n      path,\n    );\n    const decision = turnFilePermissionDecision(permission, 'file-permission-matrix', authorizedInput);\n    if (decision) return decision;\n    if (input.turn.policy.filesystem?.access === 'read-only' && fileOperation !== 'read') {\n      return Object.freeze({\n        status: 'denied',\n        policy: 'workspace-access',\n        reason: `Turn workspace is read-only; ${fileOperation} is not allowed`,\n      });\n    }\n  }\n  if (input.tool.name === 'bash') {\n    const cwdAuthority = await authorizeTurnFileInput(\n      'bash',\n      authorizedInput,\n      input.turn.policy.filesystem?.workspaceRoot,\n      input.turn.policy.filesystem?.workingDirectory,\n    );\n    if (!cwdAuthority.allowed) {\n      return Object.freeze({ status: 'denied', policy: 'workspace-access', reason: cwdAuthority.reason });\n    }\n    authorizedInput = cwdAuthority.input;\n    const command = stringArgument(authorizedInput, 'command');\n    if (command) {\n      if (input.turn.policy.shell?.preset) {\n        const exec = checkUnattendedExecPreset(command, input.turn.policy.shell.preset);\n        if (!exec.allowed) {\n          return Object.freeze({\n            status: 'denied',\n            policy: 'exec-policy',\n            reason: exec.reason ?? `command denied by ${input.turn.policy.shell.preset} preset`,\n          });\n        }\n      }\n      if (input.turn.policy.shell?.security) {\n        const exec = checkTurnExecPolicy(command, input.turn.policy.shell);\n        if (!exec.allowed) {\n          if (exec.needsApproval) {\n            return Object.freeze({\n              status: 'approval_required',\n              policy: 'exec-policy',\n              reason: exec.reason ?? 'shell command requires approval',\n              input: authorizedInput,\n            });\n          }\n          return Object.freeze({\n            status: 'denied',\n            policy: 'exec-policy',\n            reason: exec.reason ?? 'shell command denied',\n          });\n        }\n      }\n      const safety = checkBashCommandSafety(command);\n      if (!safety.safe) {\n        return Object.freeze({\n          status: 'denied',\n          policy: 'bash-command-safety',\n          reason: safety.reason ?? 'unsafe Bash command',\n        });\n      }\n      for (const path of extractBashReadPaths(command)) {\n        const sensitiveRead = checkFilePermission(\n          toolRequesterRoleToFileRole(requesterRole),\n          'read',\n          path,\n        );\n        const decision = turnFilePermissionDecision(sensitiveRead, 'bash-sensitive-read', input.input);\n        if (decision) return decision;\n      }\n      const permission = checkBashFilePermission(toolRequesterRoleToFileRole(requesterRole), command);\n      const decision = turnFilePermissionDecision(permission, 'bash-file-permission', authorizedInput);\n      if (decision) return decision;\n      if (input.turn.policy.filesystem?.access === 'read-only' && permission.fileOperation !== null && permission.fileOperation !== 'read') {\n        return Object.freeze({\n          status: 'denied',\n          policy: 'workspace-access',\n          reason: `Turn workspace is read-only; shell ${permission.fileOperation} is not allowed`,\n        });\n      }\n    }\n  }\n  if (requiresDeclarativeApproval(input.tool)) {\n    return Object.freeze({\n      status: 'approval_required',\n      policy: 'approval',\n      reason: `tool approval policy is ${input.tool.requiresApproval}`,\n      input: authorizedInput,\n    });\n  }\n  return Object.freeze({ status: 'allowed', input: authorizedInput });\n}\n\nfunction requiresDeclarativeApproval(tool: ToolDescriptor): boolean {\n  if (tool.requiresApproval === 'never') return false;\n  if (tool.requiresApproval === 'always' || tool.requiresApproval === 'once') return true;\n  return !hasCanonicalRiskPolicy(tool.name);\n}\n\n/**\n * Canonical tools reach this point only after their concrete network, file, or\n * shell operation passed the dedicated policy layers above. Unknown plugin\n * tools remain fail-closed under the default `on-risk` declaration.\n */\nfunction hasCanonicalRiskPolicy(toolName: string): boolean {\n  return toolName === 'bash'\n    || toolName === 'web_fetch'\n    || toolName === 'web_search'\n    || resolveTurnFileOperation(toolName) !== undefined;\n}\n\nfunction checkTurnNetworkPolicy(input: TurnToolPolicyInput): TurnToolPolicyDecision | undefined {\n  const command = input.tool.name === 'bash' ? stringArgument(input.input, 'command') : undefined;\n  const isNetworkCommand = Boolean(command && NETWORK_COMMAND_PATTERNS.some((pattern) => pattern.test(command)));\n  const isNetworkTool = NETWORK_TOOL_NAMES.has(input.tool.name);\n  if (!isNetworkCommand && !isNetworkTool) return undefined;\n\n  const policy = input.turn.policy.network;\n  if (!policy?.enabled) {\n    return Object.freeze({\n      status: 'denied',\n      policy: 'network-access',\n      reason: NETWORK_DISABLED_REASON,\n    });\n  }\n\n  const urls = input.tool.name === 'web_fetch'\n    ? [stringArgument(input.input, 'url')].filter((value): value is string => Boolean(value))\n    : command\n      ? extractUrlsFromCommand(command)\n      : [];\n  if ((input.tool.name === 'web_fetch' || isNetworkCommand) && urls.length === 0) {\n    return Object.freeze({\n      status: 'denied',\n      policy: 'network-access',\n      reason: 'Network access requires a verifiable absolute URL',\n    });\n  }\n  for (const url of urls) {\n    const decision = checkUrlNetworkAccess(url, {\n      httpsOnly: policy.httpsOnly,\n      allowedDomains: [...(policy.allowedDomains ?? [])],\n    });\n    if (!decision.allowed) {\n      return Object.freeze({\n        status: 'denied',\n        policy: 'network-access',\n        reason: decision.reason ?? 'Network target denied',\n      });\n    }\n  }\n  return undefined;\n}\n\nfunction turnFilePermissionDecision(\n  permission: FilePermissionResult,\n  policy: string,\n  input: Readonly<Record<string, unknown>>,\n): TurnToolPolicyDecision | undefined {\n  if (!permission.allowed) {\n    return Object.freeze({\n      status: 'denied',\n      policy,\n      reason: permission.reason ?? `file ${permission.operation} denied`,\n    });\n  }\n  if (permission.needsConfirmation || permission.needsOwnerConfirmation) {\n    return Object.freeze({\n      status: 'approval_required',\n      policy,\n      reason: permission.reason ?? `file ${permission.operation} requires approval`,\n      input,\n    });\n  }\n  return undefined;\n}\n\nfunction resolveTurnFileOperation(toolName: string): FileOperation | undefined {\n  if (toolName === 'write_file') return 'create';\n  if (toolName === 'edit_file') return 'update';\n  if (toolName === 'read_file' || toolName === 'list_dir' || toolName === 'glob'\n    || toolName === 'grep') return 'read';\n  return undefined;\n}\n\nfunction resolveTurnRequesterRole(turn: TurnIngress): ToolRequesterRole {\n  if (turn.principal.roles.includes('master')) return 'master';\n  if (turn.principal.roles.includes('trusted')) return 'trusted';\n  return 'other';\n}\n\nfunction stringArgument(\n  input: Readonly<Record<string, unknown>>,\n  ...names: readonly string[]\n): string | undefined {\n  for (const name of names) {\n    const value = input[name];\n    if (typeof value === 'string' && value.trim()) return value;\n  }\n  return undefined;\n}\n\n// ── 声明式策略表 ────────────────────────────────────────────────────\n\nexport interface ToolPolicyLayer {\n  name: string;\n  priority: number;\n  applies(input: ToolPolicyInput): boolean;\n  check(input: ToolPolicyInput, prior: ReadonlyArray<ToolPolicyLayerRecord>): ToolPolicyDecision;\n}\n\nconst FILE_TOOL_NAMES = new Set(['read_file', 'list_dir', 'glob', 'grep', 'write_file', 'edit_file']);\nconst DANGEROUS_TOOL_NAMES = new Set(['write_file', 'edit_file', 'web_fetch']);\nconst WRITE_OPERATIONS = new Set<FileOperation>(['create', 'update', 'delete']);\n\n/** 解析文件操作类型：显式 fileOperation 优先，其次按 toolName 推导（仅写类工具） */\nfunction resolveFileOperation(input: ToolPolicyInput): FileOperation | undefined {\n  if (input.fileOperation) return input.fileOperation;\n  if (input.toolName === 'edit_file') return 'update';\n  if (input.toolName === 'write_file') return 'create';\n  return undefined;\n}\n\n/** 是否为文件写类调用（memory/device/workspace 层的生效条件） */\nfunction isWriteAccess(input: ToolPolicyInput): boolean {\n  const op = resolveFileOperation(input);\n  return Boolean(input.filePath) && op !== undefined && WRITE_OPERATIONS.has(op);\n}\n\nfunction fromDangerousDecision(d: DangerousToolDecision): ToolPolicyDecision {\n  return {\n    allowed: d.allowed,\n    reason: d.reason,\n    needsOwnerApproval: d.needsOwnerApproval,\n    role: d.role,\n    payload: d,\n  };\n}\n\n/** 是否为 checkMemoryWritePath 已放行的记忆写路径（session 任意；global/platform 仅 master） */\nfunction isPermittedMemoryToolWrite(input: ToolPolicyInput): boolean {\n  const filePath = input.rawFilePath ?? input.filePath;\n  if (!filePath || !isWriteAccess(input)) return false;\n  const decision = checkMemoryWritePath(filePath, input.commMessage, input.workspaceDir);\n  return decision.scope !== 'none' && decision.allowed;\n}\n\nfunction sortByPriority(layers: ToolPolicyLayer[]): ToolPolicyLayer[] {\n  return layers.sort((a, b) => a.priority - b.priority);\n}\n\nconst TOOL_POLICIES: ToolPolicyLayer[] = sortByPriority([\n  {\n    name: 'network-access',\n    priority: 5,\n    applies: (input) => Boolean(input.networkPolicy && input.networkUrl),\n    check: (input) => {\n      const result = checkUrlNetworkAccess(input.networkUrl!, {\n        httpsOnly: input.networkPolicy!.httpsOnly,\n        allowedDomains: [...(input.networkPolicy!.allowedDomains ?? [])],\n      });\n      return { allowed: result.allowed, reason: result.reason, payload: result };\n    },\n  },\n  {\n    name: 'role-gate',\n    priority: 10,\n    applies: (input) => FILE_TOOL_NAMES.has(input.toolName),\n    check: (input) => {\n      // 与 checkMemoryWritePath 对齐：会话记忆写对任意角色放行（避免矩阵/危险工具层先拒）\n      if (isPermittedMemoryToolWrite(input)) {\n        const role = input.commMessage\n          ? resolveToolRequesterRole(input.commMessage)\n          : 'unknown';\n        return { allowed: true, role };\n      }\n      return fromDangerousDecision(checkFileToolAccess(input.toolName as FileToolName, input.commMessage));\n    },\n  },\n  {\n    name: 'bash-command-safety',\n    priority: 15,\n    applies: (input) => input.toolName === 'bash' && Boolean(input.command),\n    check: (input) => {\n      const safety = checkBashCommandSafety(input.command!);\n      return { allowed: safety.safe, reason: safety.reason, payload: safety };\n    },\n  },\n  {\n    name: 'dangerous-tool-approval',\n    priority: 20,\n    applies: (input) => DANGEROUS_TOOL_NAMES.has(input.toolName),\n    check: (input) => {\n      if (isPermittedMemoryToolWrite(input)) {\n        const role = input.commMessage\n          ? resolveToolRequesterRole(input.commMessage)\n          : 'unknown';\n        return { allowed: true, role };\n      }\n      return fromDangerousDecision(\n        checkDangerousToolAccess(input.toolName as 'write_file' | 'edit_file' | 'web_fetch', input.commMessage),\n      );\n    },\n  },\n  {\n    name: 'bash-sensitive-read',\n    priority: 25,\n    applies: (input) => input.toolName === 'bash' && Boolean(input.command),\n    check: (input) => fromDangerousDecision(\n      checkBashSensitiveReadAccess(input.command!, input.commMessage, input.workspaceDir),\n    ),\n  },\n  {\n    name: 'file-permission-matrix',\n    priority: 30,\n    applies: (input) => resolveFileOperation(input) !== undefined,\n    check: (input, prior) => {\n      const operation = resolveFileOperation(input)!;\n      const roleGate = prior.find((r) => r.policy === 'role-gate');\n      const requesterRole: ToolRequesterRole = roleGate?.decision.role ?? 'unknown';\n      if (isPermittedMemoryToolWrite(input)) {\n        return {\n          allowed: true,\n          role: requesterRole,\n          payload: {\n            allowed: true,\n            role: toolRequesterRoleToFileRole(requesterRole),\n            operation,\n          } satisfies FilePermissionResult,\n        };\n      }\n      const fileRole = toolRequesterRoleToFileRole(requesterRole);\n      const permResult = checkFilePermission(fileRole, operation, input.rawFilePath ?? input.filePath);\n      return {\n        allowed: permResult.allowed,\n        reason: permResult.reason,\n        needsOwnerApproval:\n          permResult.allowed && (permResult.needsConfirmation === true || permResult.needsOwnerConfirmation === true)\n            ? true\n            : undefined,\n        role: requesterRole,\n        payload: permResult,\n      };\n    },\n  },\n  {\n    name: 'bash-file-permission',\n    priority: 35,\n    applies: (input) => input.toolName === 'bash' && Boolean(input.command),\n    check: (input) => {\n      const requesterRole: ToolRequesterRole =\n        input.commMessage\n          ? resolveToolRequesterRole(input.commMessage)\n          : 'unknown';\n      const role = toolRequesterRoleToFileRole(requesterRole);\n      const permResult = checkBashFilePermission(role, input.command!);\n      return {\n        allowed: permResult.allowed,\n        reason: permResult.reason,\n        needsOwnerApproval:\n          permResult.allowed && (permResult.needsConfirmation === true || permResult.needsOwnerConfirmation === true)\n            ? true\n            : undefined,\n        role: requesterRole,\n        payload: permResult,\n      };\n    },\n  },\n  {\n    name: 'memory-write-path',\n    priority: 40,\n    applies: (input) => isWriteAccess(input),\n    check: (input) => {\n      const d = checkMemoryWritePath(input.filePath!, input.commMessage, input.workspaceDir);\n      return { allowed: d.allowed, reason: d.reason, payload: d };\n    },\n  },\n  {\n    name: 'sensitive-path',\n    priority: 50,\n    applies: (input) => Boolean(input.filePath),\n    check: (input) =>\n      fromDangerousDecision(\n        checkSensitiveFilePathAccess(\n          input.toolName as FileToolName,\n          input.filePath!,\n          input.commMessage,\n          input.workspaceDir,\n        ),\n      ),\n  },\n  {\n    name: 'blocked-device-path',\n    priority: 60,\n    applies: (input) => Boolean(input.filePath) && (isWriteAccess(input) || input.devicePathGuard === true),\n    check: (input) => {\n      if (!isBlockedDevicePath(input.filePath!)) return { allowed: true };\n      // 写类措辞与 read_file 读类措辞分别对齐各自旧链文案\n      const reason = isWriteAccess(input)\n        ? `禁止访问设备路径: ${input.filePath!}`\n        : `禁止读取设备文件 ${input.filePath!}（会导致进程挂起或注入攻击）`;\n      return { allowed: false, reason };\n    },\n  },\n  {\n    name: 'workspace-access',\n    priority: 70,\n    applies: (input) => isWriteAccess(input),\n    check: (input) => {\n      const d = checkFileAccess(input.filePath!);\n      return { allowed: d.allowed, reason: d.reason, payload: d };\n    },\n  },\n  {\n    name: 'exec-policy',\n    priority: 80,\n    applies: (input) => Boolean(input.command) && Boolean(input.config),\n    check: (input) => {\n      const r = checkExecPolicyWithOptions(input.config!, input.command!);\n      return { allowed: r.allowed, reason: r.reason, needsOwnerApproval: r.needsApproval || undefined, payload: r };\n    },\n  },\n]);\n\n// ── 执行入口 ────────────────────────────────────────────────────────\n\n/**\n * 依 priority 顺序执行适用的策略层；\n * 第一个 `!allowed` 或 `needsOwnerApproval` 的决策即短路返回（deny 优先）。\n */\nexport function runToolPolicies(input: ToolPolicyInput): ToolPolicyResult {\n  const decisions: ToolPolicyLayerRecord[] = [];\n  for (const layer of TOOL_POLICIES) {\n    if (!layer.applies(input)) continue;\n    const decision = layer.check(input, decisions);\n    decisions.push({ policy: layer.name, decision });\n    if (!decision.allowed || decision.needsOwnerApproval) {\n      return { ...decision, deniedBy: layer.name, decisions };\n    }\n  }\n  return { allowed: true, decisions };\n}\n\n// ── 结果映射（复刻各工具既有对外文案） ──────────────────────────────\n\n/**\n * 把门面结果映射为工具应返回的字符串；全部通过时返回 null（工具继续执行）。\n * 文案与各工具迁移前逐层手写的返回严格一致。\n */\nexport function toolPolicyResultToMessage(result: ToolPolicyResult, toolName = ''): string | null {\n  if (result.allowed && !result.needsOwnerApproval) return null;\n  switch (result.deniedBy) {\n    case 'file-permission-matrix':\n    case 'bash-file-permission':\n      // 覆盖拒绝与 needsConfirmation/needsOwnerConfirmation 两种 gate 文案\n      return formatFilePermissionMessage(result.payload as FilePermissionResult, toolName);\n    case 'memory-write-path':\n      return `Error: ${result.reason}`;\n    case 'blocked-device-path':\n      return `Error: ${result.reason}`;\n    case 'workspace-access':\n      return `ZHIN_NEEDS_OWNER:\\n${result.reason!}\\n\\n（文件访问策略拒绝；仅 Owner 确认后在受控环境可重试或调整策略。）`;\n    case 'exec-policy':\n      return result.needsOwnerApproval\n        ? `ZHIN_NEEDS_OWNER:\\n${result.reason ?? '该命令需要 Owner 确认。'}`\n        : `Error: ${result.reason ?? '该命令已被拒绝。'}`;\n    default: {\n      // role-gate / dangerous-tool-approval / sensitive-path：统一走 DangerousToolDecision 文案\n      const decision: DangerousToolDecision = {\n        allowed: result.allowed,\n        reason: result.reason,\n        needsOwnerApproval: result.needsOwnerApproval,\n        role: result.role ?? 'unknown',\n      };\n      return result.needsOwnerApproval ? toOwnerSignal(decision) : toDenyError(decision);\n    }\n  }\n}\n"]}

package/lib/security/policy-narrowing.d.ts

@@ -9,4 +9,3 @@ export interface SubagentPolicyNarrowing {
  * the parent cannot actually run is dropped, and narrowing only removes power.
  */
 export declare function deriveSubagentPolicy(parent: Readonly<TurnPolicyContext>, narrowing?: SubagentPolicyNarrowing): Readonly<TurnPolicyContext>;
-//# sourceMappingURL=policy-narrowing.d.ts.map

package/lib/security/policy-narrowing.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-narrowing.js","sourceRoot":"","sources":["../../src/security/policy-narrowing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAQ9E;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAmC,EACnC,YAAqC,EAAE;IAEvC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU;QAClC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YACd,GAAG,MAAM,CAAC,UAAU;YACpB,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS;WACvC,CAAC,SAAS,CAAC,QAAQ;WACnB,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QACnD,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC;gBACA,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;oBACrB,GAAG,MAAM,CAAC,OAAO;oBACjB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;wBAC/B,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE;wBACvE,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;aACH;YACD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"policy-narrowing.js","sourceRoot":"","sources":["../../src/security/policy-narrowing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAQ9E;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAmC,EACnC,YAAqC,EAAE;IAEvC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU;QAClC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YACd,GAAG,MAAM,CAAC,UAAU;YACpB,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS;WACvC,CAAC,SAAS,CAAC,QAAQ;WACnB,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QACnD,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC;gBACA,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;oBACrB,GAAG,MAAM,CAAC,OAAO;oBACjB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;wBAC/B,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE;wBACvE,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;aACH;YACD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Policy narrowing shared by sub-agent turns (#718) and trust tiers (#726).\n * Every function here only removes authority from a policy; none can add it.\n */\nimport { turnPolicyAllowsShell } from '../plugin-runtime/native-bash-tool.js';\nimport type { TurnPolicyContext } from '../turn/turn-ingress.js';\n\nexport interface SubagentPolicyNarrowing {\n  /** Read-only delegation: no shell, read-only filesystem. */\n  readonly readOnly?: boolean;\n}\n\n/**\n * Policy for a sub-agent turn. It is derived only from the parent policy, so it\n * can never be wider: every authority the parent lacks stays absent, a shell\n * the parent cannot actually run is dropped, and narrowing only removes power.\n */\nexport function deriveSubagentPolicy(\n  parent: Readonly<TurnPolicyContext>,\n  narrowing: SubagentPolicyNarrowing = {},\n): Readonly<TurnPolicyContext> {\n  const filesystem = parent.filesystem\n    ? Object.freeze({\n      ...parent.filesystem,\n      ...(narrowing.readOnly ? { access: 'read-only' as const } : {}),\n    })\n    : undefined;\n  const keepShell = parent.shell !== undefined\n    && !narrowing.readOnly\n    && turnPolicyAllowsShell(parent);\n  return Object.freeze({\n    permissions: Object.freeze([...parent.permissions]),\n    unattended: parent.unattended,\n    ...(parent.network\n      ? {\n        network: Object.freeze({\n          ...parent.network,\n          ...(parent.network.allowedDomains\n            ? { allowedDomains: Object.freeze([...parent.network.allowedDomains]) }\n            : {}),\n        }),\n      }\n      : {}),\n    ...(filesystem ? { filesystem } : {}),\n    ...(keepShell ? { shell: Object.freeze({ ...parent.shell }) } : {}),\n  });\n}\n"]}

package/lib/security/provenance.d.ts

@@ -62,4 +62,3 @@ export declare class TurnProvenance {
 export declare function formatProvenanceReason(kind: HighRiskActionKind, chain: string): string;
 export declare const PROVENANCE_UNATTENDED_REASON = "\u8BFB\u53D6\u5916\u90E8\u5185\u5BB9\u4E4B\u540E\u7684\u9AD8\u5371\u52A8\u4F5C\uFF08\u6267\u884C\u547D\u4EE4\u3001\u5411\u5176\u4ED6\u4F1A\u8BDD\u53D1\u6D88\u606F\u3001\u4FEE\u6539\u914D\u7F6E\u3001\u5B9A\u65F6\u4EFB\u52A1\uFF09\u9700\u8981\u4EBA\u5DE5\u786E\u8BA4\uFF0C\u65E0\u4EBA\u503C\u5B88\u7684\u56DE\u5408\u65E0\u6CD5\u786E\u8BA4\uFF0C\u5DF2\u62D2\u7EDD\u3002";
 export {};
-//# sourceMappingURL=provenance.d.ts.map

package/lib/security/provenance.js.map

@@ -1 +1 @@
-{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../src/security/provenance.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAgBtD,MAAM,CAAC,MAAM,uBAAuB,GAA2B,MAAM,CAAC,MAAM,CAAC;IAC3E,eAAe,EAAE,kBAAkB;IACnC,aAAa,EAAE,QAAQ;IACvB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAsB;CAC3D,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CAAC,GAAqC;IACzE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,eAAe,EAAE,GAAG,EAAE,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB;QAC5E,aAAa,EAAE,GAAG,EAAE,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;QAC9D,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC,CAAC;KACxE,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAIjE;;;GAGG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1F,MAAM,SAAS,GAAG,uDAAuD,CAAC;AAC1E,MAAM,WAAW,GAAG,gHAAgH,CAAC;AACrI,MAAM,aAAa,GAAG,qGAAqG,CAAC;AAE5H,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,IAAc;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACnE,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACjD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uBAAuB,CAAC,IAAc,EAAE,QAAgC;IACtF,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,mGAAmG;IACnG,OAAO,IAAI,CAAC;AACd,CAAC;AASD,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B,MAAM,YAAY,GAAkD,MAAM,CAAC,MAAM,CAAC;IAChF,KAAK,EAAE,IAAI;IACX,cAAc,EAAE,MAAM;IACtB,YAAY,EAAE,KAAK;CACpB,CAAC,CAAC;AAEH,MAAM,aAAa,GAAiD,MAAM,CAAC,MAAM,CAAC;IAChF,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,OAAO,cAAc;IAChB,QAAQ,GAAuB,EAAE,CAAC;IAE3C,MAAM,CAAC,MAAwB;QAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC;YAAE,OAAO;QAC1E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,4FAA4F;IAC5F,aAAa,CAAC,SAA8B,EAAE,QAAgB;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACnD,OAAO;YACL,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK;YAC/B,GAAG,KAAK;YACR,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,QAAQ,QAAQ,EAAE;SACnB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,IAAwB,EAAE,KAAa;IAC5E,OAAO;QACL,KAAK,aAAa,CAAC,IAAI,CAAC,0BAA0B;QAClD,OAAO,KAAK,EAAE;KACf,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GACvC,+DAA+D,CAAC;AAElE,SAAS,cAAc,CAAC,MAAwB;IAC9C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,aAAa,CAAC,CAAC,OAAO,MAAM,MAAM,CAAC,QAAQ,MAAM,CAAC;QACvD,KAAK,iBAAiB,CAAC,CAAC,OAAO,aAAa,CAAC;QAC7C,KAAK,sBAAsB,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC7C,KAAK,kBAAkB,CAAC,CAAC,OAAO,YAAY,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAAwB;IACzC,OAAO,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;AACjF,CAAC"}
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../src/security/provenance.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAgBtD,MAAM,CAAC,MAAM,uBAAuB,GAA2B,MAAM,CAAC,MAAM,CAAC;IAC3E,eAAe,EAAE,kBAAkB;IACnC,aAAa,EAAE,QAAQ;IACvB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAsB;CAC3D,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CAAC,GAAqC;IACzE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,eAAe,EAAE,GAAG,EAAE,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB;QAC5E,aAAa,EAAE,GAAG,EAAE,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;QAC9D,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC,CAAC;KACxE,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAIjE;;;GAGG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;AAE1F,MAAM,SAAS,GAAG,uDAAuD,CAAC;AAC1E,MAAM,WAAW,GAAG,gHAAgH,CAAC;AACrI,MAAM,aAAa,GAAG,qGAAqG,CAAC;AAE5H,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,IAAc;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACnE,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACjD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uBAAuB,CAAC,IAAc,EAAE,QAAgC;IACtF,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,mGAAmG;IACnG,OAAO,IAAI,CAAC;AACd,CAAC;AASD,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B,MAAM,YAAY,GAAkD,MAAM,CAAC,MAAM,CAAC;IAChF,KAAK,EAAE,IAAI;IACX,cAAc,EAAE,MAAM;IACtB,YAAY,EAAE,KAAK;CACpB,CAAC,CAAC;AAEH,MAAM,aAAa,GAAiD,MAAM,CAAC,MAAM,CAAC;IAChF,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,OAAO,cAAc;IAChB,QAAQ,GAAuB,EAAE,CAAC;IAE3C,MAAM,CAAC,MAAwB;QAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC;YAAE,OAAO;QAC1E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,4FAA4F;IAC5F,aAAa,CAAC,SAA8B,EAAE,QAAgB;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACnD,OAAO;YACL,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK;YAC/B,GAAG,KAAK;YACR,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,QAAQ,QAAQ,EAAE;SACnB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,IAAwB,EAAE,KAAa;IAC5E,OAAO;QACL,KAAK,aAAa,CAAC,IAAI,CAAC,0BAA0B;QAClD,OAAO,KAAK,EAAE;KACf,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GACvC,+DAA+D,CAAC;AAElE,SAAS,cAAc,CAAC,MAAwB;IAC9C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,aAAa,CAAC,CAAC,OAAO,MAAM,MAAM,CAAC,QAAQ,MAAM,CAAC;QACvD,KAAK,iBAAiB,CAAC,CAAC,OAAO,aAAa,CAAC;QAC7C,KAAK,sBAAsB,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC7C,KAAK,kBAAkB,CAAC,CAAC,OAAO,YAAY,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAAwB;IACzC,OAAO,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;AACjF,CAAC","sourcesContent":["/**\n * Provenance chain and high-risk action confirmation (#727, M3.3).\n *\n * A turn becomes \"tainted\" as soon as content from a lower-trust source\n * (tool results, web pages, files, sub-agent reports, background\n * conversation events) reaches the model. From then on a model-chosen\n * high-risk action — running a shell command, messaging another\n * conversation, changing configuration or scheduling a task — may have been\n * steered by that content, so it is always routed through the ApprovalPort,\n * even when the configured policy would allow it outright. The approval card\n * shows the chain of sources that led to the call.\n *\n * Unattended turns have no ApprovalPort, so such calls are denied there.\n */\nimport type { InitiatorTrustLevel } from './trust-level.js';\nimport { isOutboundToolName } from './trust-level.js';\n\nexport type HighRiskActionKind = 'shell' | 'outbound' | 'config' | 'schedule';\n\nexport interface InjectionGuardSettings {\n  /**\n   * `external_content` (default): once lower-trust content entered the turn,\n   * high-risk actions require approval. `off`: no provenance confirmation.\n   */\n  readonly confirmHighRisk: 'external_content' | 'off';\n  /** `redact` (default): mask system-prompt, secret and other-session memory leaks in replies. `off`: no check. */\n  readonly outboundCheck: 'redact' | 'off';\n  /** Tools whose results are trusted (e.g. a first-party lookup); their output does not taint the turn. */\n  readonly trustedOutputTools: readonly string[];\n}\n\nexport const DEFAULT_INJECTION_GUARD: InjectionGuardSettings = Object.freeze({\n  confirmHighRisk: 'external_content',\n  outboundCheck: 'redact',\n  trustedOutputTools: Object.freeze([]) as readonly string[],\n});\n\nexport function resolveInjectionGuard(raw?: Partial<InjectionGuardSettings>): InjectionGuardSettings {\n  return Object.freeze({\n    confirmHighRisk: raw?.confirmHighRisk === 'off' ? 'off' : 'external_content',\n    outboundCheck: raw?.outboundCheck === 'off' ? 'off' : 'redact',\n    trustedOutputTools: Object.freeze([...(raw?.trustedOutputTools ?? [])]),\n  });\n}\n\n/** Policy name reported when a call is gated or denied because of its provenance. */\nexport const PROVENANCE_POLICY = 'external-content-confirmation';\n\ntype ToolView = Readonly<{ name: string; tags?: readonly string[] }>;\n\n/**\n * Harness tools whose output is produced by zhin itself (catalog lookups,\n * skill loading) rather than by an outside source.\n */\nconst HARNESS_OUTPUT_TOOLS = new Set(['discover', 'load_tool', 'load_skill', 'ask_user']);\n\nconst READ_VERB = /^(?:get|read|list|show|view|query|search|find|check)_/;\nconst CONFIG_NAME = /(?:^|_)(?:config|configs|configuration|setting|settings|plugin_install|install_plugin|uninstall_plugin)(?:_|$)/;\nconst SCHEDULE_NAME = /(?:^|_)(?:schedule|schedules|cron|crons|reminder|reminders|remind|timer|timers|alarm|alarms)(?:_|$)/;\n\n/** The high-risk category of a tool call, or undefined for ordinary tools. */\nexport function classifyHighRiskAction(tool: ToolView): HighRiskActionKind | undefined {\n  const tags = tool.tags ?? [];\n  if (tool.name === 'bash' || tags.includes('shell')) return 'shell';\n  if (tags.includes('outbound') || isOutboundToolName(tool.name)) return 'outbound';\n  if (tags.includes('config')) return 'config';\n  if (tags.includes('schedule')) return 'schedule';\n  if (READ_VERB.test(tool.name)) return undefined;\n  if (CONFIG_NAME.test(tool.name)) return 'config';\n  if (SCHEDULE_NAME.test(tool.name)) return 'schedule';\n  return undefined;\n}\n\n/** Whether a completed call of `tool` brought lower-trust content into the turn. */\nexport function isExternalContentSource(tool: ToolView, settings: InjectionGuardSettings): boolean {\n  if (HARNESS_OUTPUT_TOOLS.has(tool.name)) return false;\n  if (settings.trustedOutputTools.includes(tool.name)) return false;\n  if (tool.tags?.includes('trusted_output')) return false;\n  // Conservative: every other result (built-in, plugin, MCP, sub-agent report) is data from outside.\n  return true;\n}\n\nexport type ProvenanceSource =\n  | Readonly<{ kind: 'tool_result'; toolName: string }>\n  | Readonly<{ kind: 'subagent_report' }>\n  | Readonly<{ kind: 'conversation_context' }>\n  /** A perception-model description of user media (`ai.multimodal.perception`). */\n  | Readonly<{ kind: 'media_perception' }>;\n\nconst MAX_CHAIN_SOURCES = 5;\n\nconst LEVEL_LABELS: Readonly<Record<InitiatorTrustLevel, string>> = Object.freeze({\n  owner: '主人',\n  trusted_member: '信任成员',\n  group_member: '群成员',\n});\n\nconst ACTION_LABELS: Readonly<Record<HighRiskActionKind, string>> = Object.freeze({\n  shell: '执行命令',\n  outbound: '向其他会话发消息',\n  config: '修改配置',\n  schedule: '创建或修改定时任务',\n});\n\n/** Records which lower-trust sources reached the model during one turn. */\nexport class TurnProvenance {\n  readonly #sources: ProvenanceSource[] = [];\n\n  record(source: ProvenanceSource): void {\n    const key = sourceKey(source);\n    if (this.#sources.some((existing) => sourceKey(existing) === key)) return;\n    this.#sources.push(Object.freeze({ ...source }));\n  }\n\n  get tainted(): boolean {\n    return this.#sources.length > 0;\n  }\n\n  get sources(): readonly ProvenanceSource[] {\n    return Object.freeze([...this.#sources]);\n  }\n\n  /** Human-readable chain for approval cards, e.g. `主人的消息 → 工具 web_fetch 的结果 → 本次调用 bash`. */\n  describeChain(initiator: InitiatorTrustLevel, toolName: string): string {\n    const shown = this.#sources.slice(0, MAX_CHAIN_SOURCES).map(describeSource);\n    const hidden = this.#sources.length - shown.length;\n    return [\n      `${LEVEL_LABELS[initiator]}的消息`,\n      ...shown,\n      ...(hidden > 0 ? [`另外 ${hidden} 个来源`] : []),\n      `本次调用 ${toolName}`,\n    ].join(' → ');\n  }\n}\n\n/** Approval question shown when a tainted turn attempts a high-risk action. */\nexport function formatProvenanceReason(kind: HighRiskActionKind, chain: string): string {\n  return [\n    `这次${ACTION_LABELS[kind]}发生在读取外部内容之后，外部内容可能夹带了指令。`,\n    `来源链：${chain}`,\n  ].join('\\n');\n}\n\nexport const PROVENANCE_UNATTENDED_REASON =\n  '读取外部内容之后的高危动作（执行命令、向其他会话发消息、修改配置、定时任务）需要人工确认，无人值守的回合无法确认，已拒绝。';\n\nfunction describeSource(source: ProvenanceSource): string {\n  switch (source.kind) {\n    case 'tool_result': return `工具 ${source.toolName} 的结果`;\n    case 'subagent_report': return '子 agent 的报告';\n    case 'conversation_context': return '群聊背景消息';\n    case 'media_perception': return '图片/媒体的自动描述';\n  }\n}\n\nfunction sourceKey(source: ProvenanceSource): string {\n  return source.kind === 'tool_result' ? `tool:${source.toolName}` : source.kind;\n}\n"]}

package/lib/security/sandbox-docker.d.ts

@@ -25,4 +25,3 @@ export declare function isDockerAvailable(): boolean;
  * 在 Docker 容器中执行命令
  */
 export declare function executeInDocker(command: string, config?: Partial<DockerSandboxConfig>): Promise<SandboxResult>;
-//# sourceMappingURL=sandbox-docker.d.ts.map

package/lib/security/sandbox-docker.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-docker.js","sourceRoot":"","sources":["../../src/security/sandbox-docker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AAYpD,MAAM,qBAAqB,GAAwB;IACjD,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,KAAK;IACd,WAAW,EAAE,GAAG;IAChB,aAAa,EAAE,EAAE;IACjB,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC/B,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,KAAK;IACpB,WAAW,EAAE,gBAAgB;CAC9B,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE;YACzD,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,WAAW;QACX,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE;YAC3E,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAE5C,OAAO;QACP,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YAC9D,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC;YACtB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;YACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,KAAK,KAAK,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,SAAuC,EAAE;IAEzC,MAAM,MAAM,GAAwB,EAAE,GAAG,qBAAqB,EAAE,GAAG,MAAM,EAAE,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,SAAS;IACT,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,WAAY,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,UAAU,CAAC,KAAK,IAAI,cAAc;YAC1C,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,UAAU,CAAC,KAAK;SAC9B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;IACxC,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAErD,mBAAmB;IACnB,MAAM,UAAU,GAAa;QAC3B,KAAK;QACL,MAAM,EAA2B,YAAY;QAC7C,aAAa,EAAqB,SAAS;QAC3C,SAAS,EAAE,eAAe,EAAO,kBAAkB;QACnD,UAAU,EAAE,GAAG,MAAM,CAAC,WAAW,GAAG;QACpC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,GAAG,GAAG,EAAE;QACjD,cAAc,EAAE,IAAI,EAAa,QAAQ;QACzC,gBAAgB,EAAE,mBAAmB,EAAG,OAAO;QAC/C,YAAY,EAAE,KAAK,EAAc,oBAAoB;QACrD,WAAW,EAAE,YAAY;QACzB,IAAI,EAAE,GAAG,GAAG,eAAe,MAAM,CAAC,gBAAgB,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;KACzF,CAAC;IAEF,OAAO;IACP,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,SAAS;IACT,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,CAAC;gBACV,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ;IACR,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,WAAY,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAE1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE;YACtD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC1C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC1C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,WAAW;YACX,IAAI,CAAC;gBACH,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,qCAAqC,MAAM,CAAC,WAAW,IAAI,CAAC,EAAE;oBACvG,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,MAAM;iBACd,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;YAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,OAAO,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ;gBACpC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;gBACjD,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;gBACjD,QAAQ;gBACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,QAAQ;gBACR,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,EAAE,gBAAgB,KAAK,CAAC,OAAO,EAAE;gBACvC,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sandbox-docker.js","sourceRoot":"","sources":["../../src/security/sandbox-docker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AAYpD,MAAM,qBAAqB,GAAwB;IACjD,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,KAAK;IACd,WAAW,EAAE,GAAG;IAChB,aAAa,EAAE,EAAE;IACjB,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC/B,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,KAAK;IACpB,WAAW,EAAE,gBAAgB;CAC9B,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE;YACzD,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,WAAW;QACX,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE;YAC3E,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAE5C,OAAO;QACP,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YAC9D,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC;YACtB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;YACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,KAAK,KAAK,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,SAAuC,EAAE;IAEzC,MAAM,MAAM,GAAwB,EAAE,GAAG,qBAAqB,EAAE,GAAG,MAAM,EAAE,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,SAAS;IACT,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,WAAY,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,UAAU,CAAC,KAAK,IAAI,cAAc;YAC1C,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,UAAU,CAAC,KAAK;SAC9B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;IACxC,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAErD,mBAAmB;IACnB,MAAM,UAAU,GAAa;QAC3B,KAAK;QACL,MAAM,EAA2B,YAAY;QAC7C,aAAa,EAAqB,SAAS;QAC3C,SAAS,EAAE,eAAe,EAAO,kBAAkB;QACnD,UAAU,EAAE,GAAG,MAAM,CAAC,WAAW,GAAG;QACpC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,GAAG,GAAG,EAAE;QACjD,cAAc,EAAE,IAAI,EAAa,QAAQ;QACzC,gBAAgB,EAAE,mBAAmB,EAAG,OAAO;QAC/C,YAAY,EAAE,KAAK,EAAc,oBAAoB;QACrD,WAAW,EAAE,YAAY;QACzB,IAAI,EAAE,GAAG,GAAG,eAAe,MAAM,CAAC,gBAAgB,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;KACzF,CAAC;IAEF,OAAO;IACP,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,SAAS;IACT,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,CAAC;gBACV,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ;IACR,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,WAAY,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAE1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE;YACtD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC1C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC1C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,WAAW;YACX,IAAI,CAAC;gBACH,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,qCAAqC,MAAM,CAAC,WAAW,IAAI,CAAC,EAAE;oBACvG,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,MAAM;iBACd,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;YAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,OAAO,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ;gBACpC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;gBACjD,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;gBACjD,QAAQ;gBACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,QAAQ;gBACR,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,EAAE,gBAAgB,KAAK,CAAC,OAAO,EAAE;gBACvC,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Docker 沙箱 — 真实容器级隔离\n *\n * 使用 Docker 容器执行 bash 命令，提供：\n * - 文件系统隔离（只挂载工作目录）\n * - 网络隔离（默认无网络）\n * - 资源限制（内存、CPU）\n * - 进程隔离（独立 PID 命名空间）\n *\n * 降级策略：Docker 不可用时回退到软沙箱。\n */\n\nimport * as child_process from 'node:child_process';\nimport * as fs from 'node:fs';\nimport type { SandboxConfig, SandboxResult } from './sandbox.js';\n\n/** Docker 沙箱配置 */\nexport interface DockerSandboxConfig extends SandboxConfig {\n  /** Docker 镜像（默认 node:20-alpine） */\n  dockerImage?: string;\n  /** 是否启用网络（默认 false） */\n  enableNetwork?: boolean;\n}\n\nconst DEFAULT_DOCKER_CONFIG: DockerSandboxConfig = {\n  enabled: true,\n  timeout: 30000,\n  maxMemoryMB: 512,\n  maxCpuPercent: 50,\n  maxOutputSize: 10 * 1024 * 1024,\n  preserveHome: false,\n  preservePath: true,\n  enableNetwork: false,\n  dockerImage: 'node:20-alpine',\n};\n\n/**\n * 检测 Docker 是否可用\n */\nexport function isDockerAvailable(): boolean {\n  try {\n    const result = child_process.spawnSync('docker', ['info'], {\n      timeout: 5000,\n      stdio: 'pipe',\n    });\n    return result.status === 0;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * 确保 Docker 镜像存在（不存在则拉取）\n */\nfunction ensureImage(image: string): { ok: boolean; error?: string } {\n  try {\n    // 检查镜像是否存在\n    const check = child_process.spawnSync('docker', ['image', 'inspect', image], {\n      timeout: 5000,\n      stdio: 'pipe',\n    });\n    if (check.status === 0) return { ok: true };\n\n    // 拉取镜像\n    const pull = child_process.spawnSync('docker', ['pull', image], {\n      timeout: 120000,\n      stdio: 'pipe',\n    });\n    return pull.status === 0\n      ? { ok: true }\n      : { ok: false, error: `拉取镜像 ${image} 失败` };\n  } catch (e) {\n    return { ok: false, error: `Docker 操作失败: ${e}` };\n  }\n}\n\n/**\n * 在 Docker 容器中执行命令\n */\nexport async function executeInDocker(\n  command: string,\n  config: Partial<DockerSandboxConfig> = {},\n): Promise<SandboxResult> {\n  const merged: DockerSandboxConfig = { ...DEFAULT_DOCKER_CONFIG, ...config };\n  const startTime = Date.now();\n\n  // 确保镜像存在\n  const imageCheck = ensureImage(merged.dockerImage!);\n  if (!imageCheck.ok) {\n    return {\n      success: false,\n      stdout: '',\n      stderr: imageCheck.error || 'Docker 镜像不可用',\n      exitCode: 1,\n      duration: Date.now() - startTime,\n      timedOut: false,\n      blocked: true,\n      blockReason: imageCheck.error,\n    };\n  }\n\n  const timeout = merged.timeout || 30000;\n  const maxOutput = merged.maxOutputSize || 10 * 1024 * 1024;\n  const cwd = merged.workingDirectory || process.cwd();\n\n  // 构建 docker run 参数\n  const dockerArgs: string[] = [\n    'run',\n    '--rm',                          // 执行完自动删除容器\n    '--read-only',                    // 只读文件系统\n    '--tmpfs', '/tmp:size=64m',      // /tmp 可写，限制 64MB\n    '--memory', `${merged.maxMemoryMB}m`,\n    '--cpus', `${(merged.maxCpuPercent || 50) / 100}`,\n    '--pids-limit', '64',            // 进程数限制\n    '--security-opt', 'no-new-privileges',  // 禁止提权\n    '--cap-drop', 'ALL',             // 丢弃所有 capabilities\n    '--workdir', '/workspace',\n    '-v', `${cwd}:/workspace:${merged.filesystemAccess === 'workspace-write' ? 'rw' : 'ro'}`,\n  ];\n\n  // 网络隔离\n  if (!merged.enableNetwork) {\n    dockerArgs.push('--network', 'none');\n  }\n\n  // 环境变量清理\n  if (merged.allowedEnvVars) {\n    for (const varName of merged.allowedEnvVars) {\n      const value = process.env[varName];\n      if (value) {\n        dockerArgs.push('-e', `${varName}=${value}`);\n      }\n    }\n  }\n\n  // 镜像和命令\n  dockerArgs.push(merged.dockerImage!, 'sh', '-c', command);\n\n  return new Promise((resolve) => {\n    let timedOut = false;\n\n    const child = child_process.spawn('docker', dockerArgs, {\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n\n    const stdoutChunks: string[] = [];\n    let stdoutLen = 0;\n    const stderrChunks: string[] = [];\n    let stderrLen = 0;\n\n    child.stdout?.on('data', (data) => {\n      const chunk = data.toString();\n      if (stdoutLen + chunk.length <= maxOutput) {\n        stdoutChunks.push(chunk);\n        stdoutLen += chunk.length;\n      }\n    });\n\n    child.stderr?.on('data', (data) => {\n      const chunk = data.toString();\n      if (stderrLen + chunk.length <= maxOutput) {\n        stderrChunks.push(chunk);\n        stderrLen += chunk.length;\n      }\n    });\n\n    const timer = setTimeout(() => {\n      timedOut = true;\n      child.kill('SIGKILL');\n      // 尝试强制删除容器\n      try {\n        child_process.spawnSync('docker', ['kill', `$(docker ps -q --filter \"ancestor=${merged.dockerImage}\")`], {\n          timeout: 3000,\n          stdio: 'pipe',\n        });\n      } catch { /* ignore */ }\n    }, timeout);\n\n    child.on('close', (exitCode) => {\n      clearTimeout(timer);\n      resolve({\n        success: exitCode === 0 && !timedOut,\n        stdout: stdoutChunks.join('').slice(0, maxOutput),\n        stderr: stderrChunks.join('').slice(0, maxOutput),\n        exitCode,\n        duration: Date.now() - startTime,\n        timedOut,\n        blocked: false,\n      });\n    });\n\n    child.on('error', (error) => {\n      clearTimeout(timer);\n      resolve({\n        success: false,\n        stdout: stdoutChunks.join(''),\n        stderr: `Docker 执行错误: ${error.message}`,\n        exitCode: 1,\n        duration: Date.now() - startTime,\n        timedOut: false,\n        blocked: false,\n      });\n    });\n  });\n}\n"]}

package/lib/security/sandbox.d.ts

@@ -94,4 +94,3 @@ export declare class Sandbox {
      */
     getConfig(): SandboxConfig;
 }
-//# sourceMappingURL=sandbox.d.ts.map