agent-bober 0.17.1 → 0.19.0

package/dist/orchestrator/security-scanners.d.ts

@@ -0,0 +1,126 @@
+import type { EvalStrategy } from "../config/schema.js";
+import type { SecurityFinding } from "./security-audit-types.js";
+/**
+ * Deterministic scanner pre-filter (arch-20260712 ADR-4).
+ *
+ * Runs each `config.security.scanners` command under the shared audit
+ * AbortSignal, parses known scanner output (slither, semgrep) into
+ * SecurityFinding[] priors, and degrades unknown scanners to a bounded
+ * raw-text excerpt finding. Every scanner is isolated: a missing binary,
+ * nonzero exit, or thrown error yields `[]` for that scanner only — the
+ * pre-filter itself NEVER rejects (runSecurityAudit's Promise.race time-box
+ * must be able to trust that this always settles).
+ */
+/** The minimal result shape runScannerPreFilter needs from a child process. */
+export interface ScannerRunResult {
+    exitCode: number | undefined;
+    stdout: string;
+    failed: boolean;
+}
+/**
+ * Runs one scanner command and resolves with its outcome. NEVER expected to
+ * reject in production (the default implementation uses execa's `reject:
+ * false`); the caller wraps every invocation in try/catch anyway as a
+ * defensive backstop (mirrors src/fleet/runner.ts's "reject:false plus
+ * try/catch" belt-and-suspenders pattern).
+ */
+export type ScannerRunner = (cmd: string, args: string[], opts: {
+    cwd: string;
+    signal: AbortSignal;
+}) => Promise<ScannerRunResult>;
+/**
+ * Parse slither `--json` output into SecurityFinding[].
+ *
+ * Real shape: `{ success, error, results: { detectors: [...] } }`. Each
+ * detector: `{ check, impact, confidence, description, elements: [{ type,
+ * name, source_mapping: { filename_relative, filename_absolute, lines[],
+ * starting_column } }] }`.
+ *
+ * SecurityFinding has no top-level severity field (ReviewFinding locks
+ * description + evidence[]) — the impact bucket is encoded as a `[High]`
+ * style prefix on `description`, and `source: "slither"` marks provenance.
+ *
+ * Defensive narrowing at every level (Pattern A / medline-source.ts style):
+ * any structural mismatch returns `[]` rather than throwing. Accepts a raw
+ * (non-object) value too — e.g. a truncated JSON string passed directly —
+ * so callers never need to guard before calling this.
+ */
+export declare function parseSlitherOutput(json: unknown): SecurityFinding[];
+/**
+ * Parse semgrep `--json` output into SecurityFinding[].
+ *
+ * Real shape: `{ results: [...], errors: [], paths: {...} }`. Each result:
+ * `{ check_id, path, start: { line, col }, end: {...}, extra: { severity,
+ * message, lines } }`.
+ *
+ * Same severity-in-description convention as the slither parser
+ * (`[ERROR]`/`[WARNING]`/`[INFO]` prefix + `source: "semgrep"`); same
+ * defensive narrowing (malformed input → `[]`, never throws).
+ */
+export declare function parseSemgrepOutput(json: unknown): SecurityFinding[];
+/**
+ * Parse `npm audit --json` output into SecurityFinding[].
+ *
+ * v7+ shape: `{ vulnerabilities: { <pkgName>: { name, severity, via: [...],
+ * range, nodes: [...], fixAvailable } }, metadata: {...} }`. `via` entries
+ * mix plain advisory-source strings and objects `{ title, url, severity }`
+ * in the same array — real npm output does this.
+ *
+ * v6 fallback shape: `{ advisories: { <id>: { module_name, severity, title,
+ * url } } }`. Both shapes are supported (whichever key is a well-formed
+ * object wins); neither present, or malformed -> [].
+ *
+ * All findings map to `vulnClass: "supply-chain"` (sc-7-2). Defensive
+ * narrowing at every level (Pattern A) — never throws.
+ */
+export declare function parseNpmAuditOutput(json: unknown): SecurityFinding[];
+/**
+ * Parse `osv-scanner --format json` output into SecurityFinding[].
+ *
+ * Real shape: `{ results: [ { source: { path, type }, packages: [ {
+ * package: { name, ecosystem, version }, vulnerabilities: [ { id, summary,
+ * severity } ] } ] } ] }`. Every finding maps to `vulnClass: "supply-chain"`
+ * (sc-7-2). Defensive narrowing at every level (Pattern A) — never throws.
+ */
+export declare function parseOsvOutput(json: unknown): SecurityFinding[];
+/**
+ * Parse `gitleaks --report-format json` output into SecurityFinding[]. Its
+ * report is a TOP-LEVEL ARRAY (unlike npm-audit/osv-scanner's object root)
+ * of `{ Description, File, StartLine, EndLine, RuleID, Secret, Match,
+ * Commit }`.
+ *
+ * The raw `Secret` field is a live credential — it is NEVER echoed into a
+ * finding; `Match` (or a redacted placeholder) is used for the evidence
+ * snippet instead. Every finding maps to `vulnClass: "secret-handling"`
+ * (sc-7-2). Defensive narrowing at every level (Pattern A) — never throws.
+ */
+export declare function parseGitleaksOutput(json: unknown): SecurityFinding[];
+/**
+ * Whether a configured scanner requires network access to run (hits a
+ * remote registry or vulnerability database). Used by the supply-chain axis
+ * (sprint 7, security-auditor-agent.ts) to gate network-capable scanner
+ * kinds behind `config.security.egress.onlineResearch` — `gitleaks` is a
+ * purely local secret scan and is NOT gated.
+ */
+export declare function isNetworkScanner(scanner: EvalStrategy): boolean;
+export interface ScannerPreFilterInput {
+    scanners: EvalStrategy[];
+    projectRoot: string;
+    signal: AbortSignal;
+    /** Injected runner — default wraps execa. Tests inject a fake for CI-offline coverage. */
+    runner?: ScannerRunner;
+}
+/**
+ * Run every configured scanner and return the combined SecurityFinding
+ * priors. `scanners: []` is a pure no-op — no runner is invoked and zero
+ * child processes are spawned (ADR-4, sc-5-4).
+ *
+ * Per-scanner isolation: each scanner is wrapped in its own try/catch and
+ * contributes `[]` on any failure (missing binary, nonzero exit, thrown
+ * error) without affecting the others (sc-5-2). The whole function NEVER
+ * rejects — even when the shared AbortSignal fires mid-scan, the killed
+ * scanner simply contributes `[]` while already-finished scanners' findings
+ * are preserved (sc-5-3).
+ */
+export declare function runScannerPreFilter(input: ScannerPreFilterInput): Promise<SecurityFinding[]>;
+//# sourceMappingURL=security-scanners.d.ts.map

package/dist/orchestrator/security-scanners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-scanners.d.ts","sourceRoot":"","sources":["../../src/orchestrator/security-scanners.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAa,MAAM,2BAA2B,CAAC;AAI5E;;;;;;;;;;GAUG;AAIH,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,KACvC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAuF/B;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,eAAe,EAAE,CAyDnE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,eAAe,EAAE,CAoCnE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,eAAe,EAAE,CAgEpE;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,eAAe,EAAE,CA0C/D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,eAAe,EAAE,CA0BpE;AAqGD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAG/D;AAID,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;IACpB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAUlG"}

package/dist/orchestrator/security-scanners.js

@@ -0,0 +1,501 @@
+import { execa } from "execa";
+import { ALL_VULN_CLASSES } from "./stack-knowledge.js";
+import { logger } from "../utils/logger.js";
+// bober: 10 MB cap on captured stdout — a pathological scanner (infinite
+// output loop, huge repo dump) cannot exhaust memory or blow the prompt.
+const MAX_SCANNER_BUFFER = 1024 * 1024 * 10;
+/**
+ * Default runner: wraps execa. `cancelSignal` ties the child's lifetime to
+ * the shared audit AbortSignal; `killSignal: "SIGKILL"` makes both a normal
+ * `.kill()` and a cancelSignal-triggered termination send SIGKILL directly
+ * (no SIGTERM grace period) so an aborted scan cannot linger (sc-5-3).
+ * `reject: false` means a missing binary (ENOENT) or nonzero exit resolves
+ * normally instead of throwing (sc-5-2).
+ */
+const defaultRunner = async (cmd, args, opts) => {
+    const result = await execa(cmd, args, {
+        cwd: opts.cwd,
+        cancelSignal: opts.signal,
+        killSignal: "SIGKILL",
+        reject: false,
+        all: true,
+        maxBuffer: MAX_SCANNER_BUFFER,
+        env: { ...process.env, FORCE_COLOR: "0" },
+    });
+    return {
+        exitCode: result.exitCode,
+        stdout: result.all ?? result.stdout ?? "",
+        failed: result.failed,
+    };
+};
+// ── vulnClass heuristic (shared by both parsers) ─────────────────────
+function isVulnClass(value) {
+    return ALL_VULN_CLASSES.includes(value);
+}
+/**
+ * Heuristically infer a VulnClass from a scanner check/rule id, by matching
+ * well-known keyword tokens. Returns undefined (never a guess) when nothing
+ * matches — per generatorNotes[1], forcing a wrong class is worse than
+ * leaving vulnClass unset. e.g. slither's "reentrancy-eth" has no clean
+ * VulnClass home and correctly stays undefined; "tx-origin" cleanly maps to
+ * authn-authz (tx.origin-based authorization is exactly that bug class).
+ *
+ * bober: substring/keyword matching, not a per-scanner mapping table — good
+ * enough to ground the advisory priors; if this proves noisy, replace with
+ * an explicit per-check-id map keyed by scanner name.
+ */
+function inferVulnClass(checkId) {
+    const id = checkId.toLowerCase();
+    const candidate = /sql-?injection|sqli|command-injection|code-injection|\binjection\b/.test(id)
+        ? "injection"
+        : /\bxss\b|cross-site-scripting/.test(id)
+            ? "xss"
+            : /path-traversal|directory-traversal/.test(id)
+                ? "path-traversal"
+                : /hardcoded|secret|credential|api-key/.test(id)
+                    ? "secret-handling"
+                    : /tx-origin|access-control|\bauth\b|authn|authz|authentication|authorization|privilege/.test(id)
+                        ? "authn-authz"
+                        : /unvalidated|input-validation|missing-validation|sanitiz/.test(id)
+                            ? "input-validation"
+                            : /\brace\b|toctou|time-of-check/.test(id)
+                                ? "race-condition"
+                                : /\bssrf\b|server-side-request/.test(id)
+                                    ? "ssrf"
+                                    : /weak-random|insecure-random|predictable-random/.test(id)
+                                        ? "insecure-randomness"
+                                        : /\bmd5\b|\bsha1\b|weak-crypto|weak-hash|weak-cipher/.test(id)
+                                            ? "crypto-weakness"
+                                            : /deserial|unmarshal|pickle/.test(id)
+                                                ? "deserialization"
+                                                : /\bidor\b|\bbola\b|broken-object-level/.test(id)
+                                                    ? "idor-bola"
+                                                    : /\bdos\b|denial-of-service|resource-exhaustion/.test(id)
+                                                        ? "denial-of-service"
+                                                        : undefined;
+    return candidate !== undefined && isVulnClass(candidate) ? candidate : undefined;
+}
+// ── Pure parsers (unknown → SecurityFinding[]; never throw) ──────────
+/**
+ * Parse slither `--json` output into SecurityFinding[].
+ *
+ * Real shape: `{ success, error, results: { detectors: [...] } }`. Each
+ * detector: `{ check, impact, confidence, description, elements: [{ type,
+ * name, source_mapping: { filename_relative, filename_absolute, lines[],
+ * starting_column } }] }`.
+ *
+ * SecurityFinding has no top-level severity field (ReviewFinding locks
+ * description + evidence[]) — the impact bucket is encoded as a `[High]`
+ * style prefix on `description`, and `source: "slither"` marks provenance.
+ *
+ * Defensive narrowing at every level (Pattern A / medline-source.ts style):
+ * any structural mismatch returns `[]` rather than throwing. Accepts a raw
+ * (non-object) value too — e.g. a truncated JSON string passed directly —
+ * so callers never need to guard before calling this.
+ */
+export function parseSlitherOutput(json) {
+    if (!json || typeof json !== "object" || Array.isArray(json))
+        return [];
+    const root = json;
+    const results = root.results;
+    if (!results || typeof results !== "object" || Array.isArray(results))
+        return [];
+    const detectors = results.detectors;
+    if (!Array.isArray(detectors))
+        return [];
+    const findings = [];
+    for (const detector of detectors) {
+        if (!detector || typeof detector !== "object")
+            continue;
+        const d = detector;
+        const check = typeof d.check === "string" ? d.check : "unknown-check";
+        const impact = typeof d.impact === "string" ? d.impact : "Informational";
+        const description = typeof d.description === "string" ? d.description.trim() : check;
+        const elements = Array.isArray(d.elements) ? d.elements : [];
+        const evidence = [];
+        for (const el of elements) {
+            if (!el || typeof el !== "object")
+                continue;
+            const e = el;
+            const sourceMapping = e.source_mapping;
+            if (!sourceMapping || typeof sourceMapping !== "object")
+                continue;
+            const sm = sourceMapping;
+            const path = typeof sm.filename_relative === "string"
+                ? sm.filename_relative
+                : typeof sm.filename_absolute === "string"
+                    ? sm.filename_absolute
+                    : "unknown";
+            const lines = Array.isArray(sm.lines) ? sm.lines : [];
+            const line = typeof lines[0] === "number" ? lines[0] : 0;
+            const elName = typeof e.name === "string" ? e.name : "";
+            const elType = typeof e.type === "string" ? e.type : "";
+            const snippet = [elType, elName].filter(Boolean).join(" ") || check;
+            evidence.push({ path, line, snippet });
+        }
+        findings.push({
+            description: `[${impact}] ${check}: ${description}`,
+            evidence,
+            source: "slither",
+            ...(inferVulnClass(check) !== undefined ? { vulnClass: inferVulnClass(check) } : {}),
+        });
+    }
+    return findings;
+}
+/**
+ * Parse semgrep `--json` output into SecurityFinding[].
+ *
+ * Real shape: `{ results: [...], errors: [], paths: {...} }`. Each result:
+ * `{ check_id, path, start: { line, col }, end: {...}, extra: { severity,
+ * message, lines } }`.
+ *
+ * Same severity-in-description convention as the slither parser
+ * (`[ERROR]`/`[WARNING]`/`[INFO]` prefix + `source: "semgrep"`); same
+ * defensive narrowing (malformed input → `[]`, never throws).
+ */
+export function parseSemgrepOutput(json) {
+    if (!json || typeof json !== "object" || Array.isArray(json))
+        return [];
+    const root = json;
+    const results = root.results;
+    if (!Array.isArray(results))
+        return [];
+    const findings = [];
+    for (const r of results) {
+        if (!r || typeof r !== "object")
+            continue;
+        const item = r;
+        const checkId = typeof item.check_id === "string" ? item.check_id : "unknown-rule";
+        const path = typeof item.path === "string" ? item.path : "unknown";
+        const start = item.start;
+        const line = start && typeof start === "object" && typeof start.line === "number"
+            ? start.line
+            : 0;
+        const extra = item.extra && typeof item.extra === "object" ? item.extra : {};
+        const severity = typeof extra.severity === "string" ? extra.severity : "INFO";
+        const message = typeof extra.message === "string" ? extra.message.trim() : checkId;
+        const snippet = typeof extra.lines === "string" ? extra.lines : "";
+        findings.push({
+            description: `[${severity}] ${checkId}: ${message}`,
+            evidence: [{ path, line, snippet }],
+            source: "semgrep",
+            ...(inferVulnClass(checkId) !== undefined ? { vulnClass: inferVulnClass(checkId) } : {}),
+        });
+    }
+    return findings;
+}
+/**
+ * Parse `npm audit --json` output into SecurityFinding[].
+ *
+ * v7+ shape: `{ vulnerabilities: { <pkgName>: { name, severity, via: [...],
+ * range, nodes: [...], fixAvailable } }, metadata: {...} }`. `via` entries
+ * mix plain advisory-source strings and objects `{ title, url, severity }`
+ * in the same array — real npm output does this.
+ *
+ * v6 fallback shape: `{ advisories: { <id>: { module_name, severity, title,
+ * url } } }`. Both shapes are supported (whichever key is a well-formed
+ * object wins); neither present, or malformed -> [].
+ *
+ * All findings map to `vulnClass: "supply-chain"` (sc-7-2). Defensive
+ * narrowing at every level (Pattern A) — never throws.
+ */
+export function parseNpmAuditOutput(json) {
+    if (!json || typeof json !== "object" || Array.isArray(json))
+        return [];
+    const root = json;
+    const vulnerabilities = root.vulnerabilities;
+    if (vulnerabilities && typeof vulnerabilities === "object" && !Array.isArray(vulnerabilities)) {
+        const findings = [];
+        for (const [pkgName, raw] of Object.entries(vulnerabilities)) {
+            if (!raw || typeof raw !== "object")
+                continue;
+            const v = raw;
+            const name = typeof v.name === "string" ? v.name : pkgName;
+            const severity = typeof v.severity === "string" ? v.severity : "unknown";
+            const range = typeof v.range === "string" ? v.range : "";
+            const via = Array.isArray(v.via) ? v.via : [];
+            const titles = via
+                .map((entry) => {
+                if (typeof entry === "string")
+                    return entry;
+                if (entry && typeof entry === "object" && typeof entry.title === "string") {
+                    return entry.title;
+                }
+                return undefined;
+            })
+                .filter((t) => typeof t === "string");
+            const summary = titles.length > 0 ? titles.join("; ") : `vulnerable range ${range || "unknown"}`;
+            const nodes = Array.isArray(v.nodes)
+                ? v.nodes.filter((n) => typeof n === "string")
+                : [];
+            const path = nodes[0] ?? "package.json";
+            findings.push({
+                description: `[${severity}] ${name}: ${summary}`,
+                evidence: [{ path, line: 0, snippet: range || name }],
+                source: "npm-audit",
+                vulnClass: "supply-chain",
+            });
+        }
+        return findings;
+    }
+    const advisories = root.advisories;
+    if (advisories && typeof advisories === "object" && !Array.isArray(advisories)) {
+        const findings = [];
+        for (const raw of Object.values(advisories)) {
+            if (!raw || typeof raw !== "object")
+                continue;
+            const a = raw;
+            const name = typeof a.module_name === "string" ? a.module_name : "unknown-package";
+            const severity = typeof a.severity === "string" ? a.severity : "unknown";
+            const title = typeof a.title === "string" ? a.title : "vulnerability";
+            findings.push({
+                description: `[${severity}] ${name}: ${title}`,
+                evidence: [{ path: "package.json", line: 0, snippet: name }],
+                source: "npm-audit",
+                vulnClass: "supply-chain",
+            });
+        }
+        return findings;
+    }
+    return [];
+}
+/**
+ * Parse `osv-scanner --format json` output into SecurityFinding[].
+ *
+ * Real shape: `{ results: [ { source: { path, type }, packages: [ {
+ * package: { name, ecosystem, version }, vulnerabilities: [ { id, summary,
+ * severity } ] } ] } ] }`. Every finding maps to `vulnClass: "supply-chain"`
+ * (sc-7-2). Defensive narrowing at every level (Pattern A) — never throws.
+ */
+export function parseOsvOutput(json) {
+    if (!json || typeof json !== "object" || Array.isArray(json))
+        return [];
+    const root = json;
+    const results = root.results;
+    if (!Array.isArray(results))
+        return [];
+    const findings = [];
+    for (const result of results) {
+        if (!result || typeof result !== "object")
+            continue;
+        const r = result;
+        const source = r.source && typeof r.source === "object" ? r.source : {};
+        const path = typeof source.path === "string" ? source.path : "unknown";
+        const packages = Array.isArray(r.packages) ? r.packages : [];
+        for (const pkg of packages) {
+            if (!pkg || typeof pkg !== "object")
+                continue;
+            const p = pkg;
+            const pkgInfo = p.package && typeof p.package === "object" ? p.package : {};
+            const pkgName = typeof pkgInfo.name === "string" ? pkgInfo.name : "unknown-package";
+            const vulns = Array.isArray(p.vulnerabilities) ? p.vulnerabilities : [];
+            for (const vuln of vulns) {
+                if (!vuln || typeof vuln !== "object")
+                    continue;
+                const vv = vuln;
+                const id = typeof vv.id === "string" ? vv.id : "unknown-id";
+                const summary = typeof vv.summary === "string" ? vv.summary : "no summary";
+                findings.push({
+                    description: `[${id}] ${pkgName}: ${summary}`,
+                    evidence: [{ path, line: 0, snippet: pkgName }],
+                    source: "osv-scanner",
+                    vulnClass: "supply-chain",
+                });
+            }
+        }
+    }
+    return findings;
+}
+/**
+ * Parse `gitleaks --report-format json` output into SecurityFinding[]. Its
+ * report is a TOP-LEVEL ARRAY (unlike npm-audit/osv-scanner's object root)
+ * of `{ Description, File, StartLine, EndLine, RuleID, Secret, Match,
+ * Commit }`.
+ *
+ * The raw `Secret` field is a live credential — it is NEVER echoed into a
+ * finding; `Match` (or a redacted placeholder) is used for the evidence
+ * snippet instead. Every finding maps to `vulnClass: "secret-handling"`
+ * (sc-7-2). Defensive narrowing at every level (Pattern A) — never throws.
+ */
+export function parseGitleaksOutput(json) {
+    if (!Array.isArray(json))
+        return [];
+    const findings = [];
+    for (const item of json) {
+        if (!item || typeof item !== "object")
+            continue;
+        const g = item;
+        const description = typeof g.Description === "string" ? g.Description : "Secret detected";
+        const ruleId = typeof g.RuleID === "string" ? g.RuleID : "unknown-rule";
+        const path = typeof g.File === "string" ? g.File : "unknown";
+        const line = typeof g.StartLine === "number" ? g.StartLine : 0;
+        // Never the raw `Secret` — `Match` is the closest thing to a redacted
+        // excerpt gitleaks provides; fall back to a placeholder if absent.
+        const snippet = typeof g.Match === "string" ? g.Match : "(redacted)";
+        findings.push({
+            description: `[${ruleId}] ${description}`,
+            evidence: [{ path, line, snippet }],
+            source: "gitleaks",
+            vulnClass: "secret-handling",
+        });
+    }
+    return findings;
+}
+/**
+ * Fallback for unrecognized scanners: a single finding carrying a bounded
+ * excerpt of the raw stdout, so an unmapped tool still contributes SOME
+ * ground truth to the auditor prompt instead of being silently dropped.
+ * Truncated to ~2000 chars (generatorNotes[2]) to keep the prompt bounded.
+ * Returns `[]` for blank output — no point manufacturing an empty finding.
+ */
+function rawTextFallback(name, output) {
+    const trimmed = output.trim();
+    if (!trimmed)
+        return [];
+    const excerpt = trimmed.length > 2000 ? `${trimmed.slice(0, 2000)}…` : trimmed;
+    return [
+        {
+            description: `Raw output from scanner "${name}" (no dedicated parser; showing excerpt)`,
+            evidence: [{ path: "unknown", line: 0, snippet: excerpt }],
+            source: name,
+        },
+    ];
+}
+/**
+ * Name/command-based parser selection (sc-5-4, widened sc-7-2): a
+ * "slither"/"semgrep"/"npm audit"/"npm-audit"/"osv-scanner"/"gitleaks"
+ * substring anywhere in the strategy's type/label/command selects the
+ * matching parser; anything else falls back to raw-text excerpting. The
+ * longer "osv-scanner" literal is checked before the bare "osv" substring
+ * so a command like `osv-scanner --format json` matches unambiguously.
+ */
+function detectScannerKind(scanner) {
+    const haystack = [scanner.type, scanner.label, scanner.command]
+        .filter((v) => typeof v === "string")
+        .join(" ")
+        .toLowerCase();
+    if (haystack.includes("slither"))
+        return "slither";
+    if (haystack.includes("semgrep"))
+        return "semgrep";
+    if (haystack.includes("npm audit") || haystack.includes("npm-audit"))
+        return "npm-audit";
+    if (haystack.includes("osv-scanner") || haystack.includes("osv"))
+        return "osv-scanner";
+    if (haystack.includes("gitleaks"))
+        return "gitleaks";
+    return "unknown";
+}
+function parseScannerStdout(kind, label, stdout) {
+    if (kind === "unknown")
+        return rawTextFallback(label, stdout);
+    let json;
+    try {
+        json = JSON.parse(stdout);
+    }
+    catch {
+        // A scanner with a recognized kind that didn't emit valid JSON (e.g.
+        // --json flag omitted, or a banner printed before the payload) degrades
+        // to the raw-text fallback rather than silently dropping its output.
+        return rawTextFallback(label, stdout);
+    }
+    switch (kind) {
+        case "slither":
+            return parseSlitherOutput(json);
+        case "npm-audit":
+            return parseNpmAuditOutput(json);
+        case "osv-scanner":
+            return parseOsvOutput(json);
+        case "gitleaks":
+            return parseGitleaksOutput(json);
+        case "semgrep":
+        default:
+            return parseSemgrepOutput(json);
+    }
+}
+/**
+ * Exit-code convention for a given scanner kind (G9). Most scanners (the
+ * default semgrep invocation, and unknown kinds) exit 0 on a clean run and
+ * nonzero on an internal error — nonzero legitimately means "discard, don't
+ * trust the output" (`'zero-clean'`). `npm-audit`/`osv-scanner`/`gitleaks`
+ * invert this: their OWN convention is to exit nonzero precisely WHEN they
+ * find something (vulnerabilities/secrets present), so a nonzero exit with
+ * valid stdout must still be parsed (`'nonzero-means-findings'`). semgrep
+ * has an optional `--error` flag with the same nonzero-on-findings
+ * convention, but it stays `'zero-clean'` by default here — flipping it
+ * would break the existing sc-5-2 isolation test, which asserts a nonzero
+ * semgrep exit yields no findings.
+ */
+function scannerExitPolicy(kind) {
+    return kind === "npm-audit" || kind === "osv-scanner" || kind === "gitleaks"
+        ? "nonzero-means-findings"
+        : "zero-clean";
+}
+/**
+ * Whether a configured scanner requires network access to run (hits a
+ * remote registry or vulnerability database). Used by the supply-chain axis
+ * (sprint 7, security-auditor-agent.ts) to gate network-capable scanner
+ * kinds behind `config.security.egress.onlineResearch` — `gitleaks` is a
+ * purely local secret scan and is NOT gated.
+ */
+export function isNetworkScanner(scanner) {
+    const kind = detectScannerKind(scanner);
+    return kind === "npm-audit" || kind === "osv-scanner";
+}
+/**
+ * Run every configured scanner and return the combined SecurityFinding
+ * priors. `scanners: []` is a pure no-op — no runner is invoked and zero
+ * child processes are spawned (ADR-4, sc-5-4).
+ *
+ * Per-scanner isolation: each scanner is wrapped in its own try/catch and
+ * contributes `[]` on any failure (missing binary, nonzero exit, thrown
+ * error) without affecting the others (sc-5-2). The whole function NEVER
+ * rejects — even when the shared AbortSignal fires mid-scan, the killed
+ * scanner simply contributes `[]` while already-finished scanners' findings
+ * are preserved (sc-5-3).
+ */
+export async function runScannerPreFilter(input) {
+    const { scanners, projectRoot, signal, runner = defaultRunner } = input;
+    if (scanners.length === 0)
+        return [];
+    const perScanner = await Promise.all(scanners.map((scanner) => runOneScanner(scanner, projectRoot, signal, runner)));
+    return perScanner.flat();
+}
+async function runOneScanner(scanner, projectRoot, signal, runner) {
+    const label = scanner.label ?? scanner.type;
+    const command = scanner.command;
+    if (!command) {
+        logger.debug(`[security-scanners] scanner "${label}" has no command configured — skipping`);
+        return [];
+    }
+    const parts = command.split(/\s+/).filter(Boolean);
+    const cmd = parts[0];
+    const args = parts.slice(1);
+    const kind = detectScannerKind(scanner);
+    try {
+        const result = await runner(cmd, args, { cwd: projectRoot, signal });
+        // G9 fix: distinguish "the process could not even be spawned"
+        // (exitCode undefined -- ENOENT/spawn failure) from "the process ran
+        // and exited nonzero". Only the former is unconditionally discarded.
+        const spawnFailed = result.exitCode === undefined;
+        if (spawnFailed) {
+            logger.debug(`[security-scanners] scanner "${label}" failed to spawn — no findings contributed`);
+            return [];
+        }
+        // Scanners whose OWN convention treats nonzero as "findings present"
+        // (npm-audit/osv-scanner/gitleaks — scannerExitPolicy) still have their
+        // stdout parsed on a nonzero-but-defined exit code; everything else
+        // (including semgrep's default 0-clean convention) is discarded on any
+        // nonzero/failed exit, exactly as before.
+        if (scannerExitPolicy(kind) === "zero-clean" && (result.exitCode !== 0 || result.failed)) {
+            logger.debug(`[security-scanners] scanner "${label}" exited ${result.exitCode} (failed=${result.failed}) — no findings contributed`);
+            return [];
+        }
+        return parseScannerStdout(kind, label, result.stdout);
+    }
+    catch (err) {
+        logger.debug(`[security-scanners] scanner "${label}" threw: ${err instanceof Error ? err.message : String(err)} — no findings contributed`);
+        return [];
+    }
+}
+//# sourceMappingURL=security-scanners.js.map

package/dist/orchestrator/security-scanners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-scanners.js","sourceRoot":"","sources":["../../src/orchestrator/security-scanners.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAI9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAoC5C,yEAAyE;AACzE,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,aAAa,GAAkB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IAC7D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QACpC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,YAAY,EAAE,IAAI,CAAC,MAAM;QACzB,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,KAAK;QACb,GAAG,EAAE,IAAI;QACT,SAAS,EAAE,kBAAkB;QAC7B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE;KAC1C,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC,CAAC;AAEF,wEAAwE;AAExE,SAAS,WAAW,CAAC,KAAa;IAChC,OAAQ,gBAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAEjC,MAAM,SAAS,GACb,oEAAoE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,oCAAoC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,qCAAqC,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9C,CAAC,CAAC,iBAAiB;oBACnB,CAAC,CAAC,sFAAsF,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/F,CAAC,CAAC,aAAa;wBACf,CAAC,CAAC,yDAAyD,CAAC,IAAI,CAAC,EAAE,CAAC;4BAClE,CAAC,CAAC,kBAAkB;4BACpB,CAAC,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE,CAAC;gCACxC,CAAC,CAAC,gBAAgB;gCAClB,CAAC,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC;oCACvC,CAAC,CAAC,MAAM;oCACR,CAAC,CAAC,gDAAgD,CAAC,IAAI,CAAC,EAAE,CAAC;wCACzD,CAAC,CAAC,qBAAqB;wCACvB,CAAC,CAAC,oDAAoD,CAAC,IAAI,CAAC,EAAE,CAAC;4CAC7D,CAAC,CAAC,iBAAiB;4CACnB,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC;gDACpC,CAAC,CAAC,iBAAiB;gDACnB,CAAC,CAAC,uCAAuC,CAAC,IAAI,CAAC,EAAE,CAAC;oDAChD,CAAC,CAAC,WAAW;oDACb,CAAC,CAAC,+CAA+C,CAAC,IAAI,CAAC,EAAE,CAAC;wDACxD,CAAC,CAAC,mBAAmB;wDACrB,CAAC,CAAC,SAAS,CAAC;IAExC,OAAO,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACnF,CAAC;AAED,wEAAwE;AAExE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAExE,MAAM,IAAI,GAAG,IAA+B,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjF,MAAM,SAAS,GAAI,OAAmC,CAAC,SAAS,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,SAAS;QACxD,MAAM,CAAC,GAAG,QAAmC,CAAC;QAE9C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC;QACtE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAErF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAgC,EAAE,CAAC;QAEjD,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;gBAAE,SAAS;YAC5C,MAAM,CAAC,GAAG,EAA6B,CAAC;YAExC,MAAM,aAAa,GAAG,CAAC,CAAC,cAAc,CAAC;YACvC,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ;gBAAE,SAAS;YAClE,MAAM,EAAE,GAAG,aAAwC,CAAC;YAEpD,MAAM,IAAI,GACR,OAAO,EAAE,CAAC,iBAAiB,KAAK,QAAQ;gBACtC,CAAC,CAAC,EAAE,CAAC,iBAAiB;gBACtB,CAAC,CAAC,OAAO,EAAE,CAAC,iBAAiB,KAAK,QAAQ;oBACxC,CAAC,CAAC,EAAE,CAAC,iBAAiB;oBACtB,CAAC,CAAC,SAAS,CAAC;YAElB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAEzD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;YAEpE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,IAAI,MAAM,KAAK,KAAK,KAAK,WAAW,EAAE;YACnD,QAAQ;YACR,MAAM,EAAE,SAAS;YACjB,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAExE,MAAM,IAAI,GAAG,IAA+B,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,IAAI,GAAG,CAA4B,CAAC;QAE1C,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC;QACnF,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAiC,CAAC,IAAI,KAAK,QAAQ;YAC/F,CAAC,CAAG,KAAiC,CAAC,IAAe;YACrD,CAAC,CAAC,CAAC,CAAC;QAER,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9E,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACnF,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,QAAQ,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,IAAI,QAAQ,KAAK,OAAO,KAAK,OAAO,EAAE;YACnD,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACnC,MAAM,EAAE,SAAS;YACjB,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,IAA+B,CAAC;IAE7C,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;IAC7C,IAAI,eAAe,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9F,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAA0C,CAAC,EAAE,CAAC;YACxF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAS;YAC9C,MAAM,CAAC,GAAG,GAA8B,CAAC;YAEzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAEzD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,GAAG;iBACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACb,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBAC5C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAiC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACvG,OAAQ,KAAiC,CAAC,KAAe,CAAC;gBAC5D,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC;iBACD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,KAAK,IAAI,SAAS,EAAE,CAAC;YAEjG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;gBAClC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAC3D,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC;YAExC,QAAQ,CAAC,IAAI,CAAC;gBACZ,WAAW,EAAE,IAAI,QAAQ,KAAK,IAAI,KAAK,OAAO,EAAE;gBAChD,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;gBACrD,MAAM,EAAE,WAAW;gBACnB,SAAS,EAAE,cAAc;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/E,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,UAAqC,CAAC,EAAE,CAAC;YACvE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAS;YAC9C,MAAM,CAAC,GAAG,GAA8B,CAAC;YAEzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC;YAEtE,QAAQ,CAAC,IAAI,CAAC;gBACZ,WAAW,EAAE,IAAI,QAAQ,KAAK,IAAI,KAAK,KAAK,EAAE;gBAC9C,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC5D,MAAM,EAAE,WAAW;gBACnB,SAAS,EAAE,cAAc;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,IAA+B,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACpD,MAAM,CAAC,GAAG,MAAiC,CAAC;QAE5C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAS;YAC9C,MAAM,CAAC,GAAG,GAA8B,CAAC;YAEzC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,OAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzG,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAEpF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAChD,MAAM,EAAE,GAAG,IAA+B,CAAC;gBAE3C,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;gBAC5D,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;gBAE3E,QAAQ,CAAC,IAAI,CAAC;oBACZ,WAAW,EAAE,IAAI,EAAE,KAAK,OAAO,KAAK,OAAO,EAAE;oBAC7C,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;oBAC/C,MAAM,EAAE,aAAa;oBACrB,SAAS,EAAE,cAAc;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QAChD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAE1C,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;QACxE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;QAErE,QAAQ,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,IAAI,MAAM,KAAK,WAAW,EAAE;YACzC,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACnC,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,iBAAiB;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,MAAc;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;IAE/E,OAAO;QACL;YACE,WAAW,EAAE,4BAA4B,IAAI,0CAA0C;YACvF,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC1D,MAAM,EAAE,IAAI;SACb;KACF,CAAC;AACJ,CAAC;AAMD;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,OAAqB;IAC9C,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC;SAC5D,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;SACjD,IAAI,CAAC,GAAG,CAAC;SACT,WAAW,EAAE,CAAC;IAEjB,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IACzF,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IACvF,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAiB,EAAE,KAAa,EAAE,MAAc;IAC1E,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAE9D,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,wEAAwE;QACxE,qEAAqE;QACrE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,WAAW;YACd,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACnC,KAAK,aAAa;YAChB,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9B,KAAK,UAAU;YACb,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACnC,KAAK,SAAS,CAAC;QACf;YACE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAMD;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CAAC,IAAiB;IAC1C,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,UAAU;QAC1E,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,YAAY,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,aAAa,CAAC;AACxD,CAAC;AAYD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA4B;IACpE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC;IAExE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAC/E,CAAC;IAEF,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAqB,EACrB,WAAmB,EACnB,MAAmB,EACnB,MAAqB;IAErB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAEhC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,KAAK,wCAAwC,CAAC,CAAC;QAC5F,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAErE,8DAA8D;QAC9D,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC;QAClD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,gCAAgC,KAAK,6CAA6C,CAAC,CAAC;YACjG,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,0CAA0C;QAC1C,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzF,MAAM,CAAC,KAAK,CACV,gCAAgC,KAAK,YAAY,MAAM,CAAC,QAAQ,YAAY,MAAM,CAAC,MAAM,6BAA6B,CACvH,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,gCAAgC,KAAK,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAC9H,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}