agy-worker-mcp 0.3.1

package/dist/gate/gate.js

@@ -0,0 +1,488 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { appendJsonLine, chmodDbFiles, jobPaths } from '../contract/paths.js';
+import { GATE_DENIAL_MARKER } from '../contract/types.js';
+import { evaluateCommandPolicy, firstMatch, firstMatchForDenial, parseRulesLenient, requiredRuleFor } from '../policy/rules.js';
+import { seatbeltCommandLine } from '../policy/seatbelt.js';
+import { ALLOWED_DEV_READS, assignmentReadPaths, extractCommandContainment, isAgentsPath, isContainedForKind } from '../policy/containment.js';
+import { isCredentialPath } from '../policy/hard-deny.js';
+import { classifyToolCall } from '../policy/tools.js';
+import { bindConversation } from './bind.js';
+import { openStore } from '../store/db.js';
+import { updateJob } from '../store/jobs.js';
+/**
+ * The PreToolUse hook. Spawned fresh for every single tool call, so it must stay
+ * cheap — no warm caches, no heavy imports, no network.
+ *
+ * ⚠⚠ The one absolute rule of this file: **something with a `decision` field must
+ * reach stdout on every path.** `{}` and empty output are denials (§9). A crash,
+ * a JSON parse failure, a locked database, a missing job — all of them must still
+ * print a `decision`. This is the only code in the package that can affect
+ * anything outside our own jobs; getting it wrong breaks the user's interactive
+ * agy sessions machine-wide.
+ *
+ * That decision is not always `ask` any more (0.2.0, I1/I3). A *bound* job's gate never answers
+ * `ask` — every tool call is either allowed or denied, and any failure once we
+ * know a call is ours becomes `deny`, not a silent pass-through. `ask` survives
+ * only for the two cases where we genuinely cannot tell whose call this is: a
+ * payload we could not parse at all, and a `conversationId` that binds to none
+ * of our jobs (someone's own interactive agy session, which this package must
+ * never touch). Failing `ask` there is still correct because agy itself fails
+ * closed on anything else a hook can produce — a non-zero exit or output that
+ * does not parse as JSON is a *denial*, not a pass-through (measured against
+ * 1.1.23, §9) — so `ask` in print mode is the one output that reliably reaches
+ * agy's own built-in engine and, for a job we cannot identify, that engine's
+ * ordinary confirmation-under-`--dangerously-skip-permissions` behaviour is
+ * exactly what the user asked for by running their own session (M3-C:
+ * with no `overwrite.BypassSandbox`, the model's own value wins).
+ */
+/** The safe pass-through. Delegates to agy's built-in engine. Never `{}`. */
+export const PASSTHROUGH = { decision: 'ask' };
+/**
+ * `<guidance sentence> [agy-worker-denial:{"required_rule":...}]` — agy passes
+ * `reason` to the model verbatim (measured, §10), so the human sentence goes
+ * first and the machine payload our own `events/detect.ts` parses trails it.
+ */
+function composeDenialReason(guidance, onDenial, payload) {
+    const abortNote = onDenial === 'abort'
+        ? ' This job is configured with on_denial: "abort" and will be terminated immediately due to this denial.'
+        : '';
+    return `${guidance}${abortNote} [${GATE_DENIAL_MARKER}${JSON.stringify(payload)}]`;
+}
+/**
+ * Pure decision function — no I/O, so it is exhaustively testable.
+ *
+ * Order is fixed (see docs/permissions.md) and each step matters:
+ *
+ * 1. `bound === null` → `ask`, return immediately. Not our job (§1.3 step 1).
+ * 2. `unsupported` (unclassifiable tool, or a subagent tool — M2) → `deny`,
+ *    `required_rule: null`.
+ * 3. `control` (`manage_task`) → `allow`, no overwrite.
+ * 4. containment (write outside `write_roots` or into `{workspace}/.agents`
+ *    — I6; read outside `read_roots`) → `deny`, ahead of every rule list.
+ * 5. deny list matches → `deny`.
+ * 6. allow list matches → `allow`; `run_command` additionally pins
+ *    `overwrite.Cwd` and sets `overwrite.BypassSandbox` from `policy.bypass_sandbox`
+ *    (I2) — every allow explicitly decides sandboxing, never leaves it to the
+ *    model (M3 variant C: an unset overwrite lets the model's own value win).
+ * 7. otherwise → `deny`, `required_rule` filled in. I1: a bound job's gate
+ *    never answers `ask` — `default_decision` is gone.
+ *
+ * A `deny` reason is an instruction channel, not an explanation: agy hands the
+ * string to the model verbatim (§10), so it should name the permitted alternative
+ * and carry a parsable `GATE_DENIAL_MARKER` payload for the broker.
+ */
+export function decide(input) {
+    const { payload, bound } = input;
+    if (!bound) {
+        return { decision: PASSTHROUGH, log: null, requestsAbort: false };
+    }
+    const { job, policy, conversationId } = bound;
+    const toolName = payload.toolCall?.name ?? 'unknown';
+    const args = payload.toolCall?.args ?? {};
+    const stepIdx = typeof payload.stepIdx === 'number' ? payload.stepIdx : null;
+    const toolClass = classifyToolCall(toolName, args, policy.workspace);
+    const command = toolClass.kind === 'subject' && toolClass.subject.verb === 'command' ? toolClass.subject.value : null;
+    const makeLog = (decision, policyStage, matchedRule, reason) => ({
+        ts: Date.now(),
+        job_id: job.job_id,
+        conversation_id: conversationId,
+        step_idx: stepIdx,
+        tool: toolName,
+        command,
+        decision,
+        policy: policyStage,
+        matched_rule: matchedRule,
+        reason,
+    });
+    /** Every `deny` in this function goes through here so the payload/log/reason stay in lockstep. */
+    const denyWith = (policyStage, requiredRule, guidance, options) => {
+        const denialPayload = {
+            job_id: job.job_id,
+            tool: toolName,
+            required_rule: requiredRule,
+            policy: policyStage,
+            on_denial: policy.on_denial,
+        };
+        const reason = composeDenialReason(guidance, policy.on_denial, denialPayload);
+        return {
+            decision: { decision: 'deny', reason },
+            log: makeLog('deny', policyStage, options?.matchedRule ?? null, reason),
+            requestsAbort: options?.requestsAbort ?? (policy.on_denial === 'abort'),
+        };
+    };
+    // Step 2 (§2.2): unclassifiable or subagent tool.
+    // 0.3.0 PR5: an unsupported tool call sets requestsAbort: false, EXCEPT when
+    // it is a subagent tool (M2). Subagents attempt to bypass policy by running
+    // under an unbound conversationId, so they must abort when on_denial === 'abort'.
+    // But a single call to an unclassified tool such as schedule is not a policy
+    // violation, and a flaky tool retry should not cost the whole job.
+    if (toolClass.kind === 'unsupported') {
+        const requestsAbort = toolClass.subagent && policy.on_denial === 'abort';
+        return denyWith('unsupported', null, toolClass.reason, { requestsAbort });
+    }
+    // Step 3: `manage_task` — conversation-scoped bookkeeping, not a rule subject.
+    if (toolClass.kind === 'control') {
+        return {
+            decision: { decision: 'allow' },
+            log: makeLog('allow', 'control', null, null),
+            requestsAbort: false,
+        };
+    }
+    // toolClass.kind === 'subject' from here.
+    const { subject } = toolClass;
+    const roots = { read: policy.read_roots, write: policy.write_roots };
+    // Step 4: containment & credential HARD_DENY, ahead of every rule list.
+    const commandLine = toolName === 'run_command' && typeof args.CommandLine === 'string' ? args.CommandLine : null;
+    if (toolName === 'run_command' && commandLine !== null) {
+        const analysis = extractCommandContainment(commandLine, policy.workspace);
+        // Item 1: Unexpanded shell expansions in path positions
+        if (analysis.unexpandedPath) {
+            return denyWith('containment', null, `unexpanded_path: Path argument (${analysis.unexpandedPath}) contains unexpanded shell expansions ($VAR, backticks, or non-leading ~) and cannot be verified. Expand the path to an absolute path or a workspace-relative path and retry (globs *, ?, and [ are evaluated against literal directories, so they may be used as-is).`);
+        }
+        // Item 3: Credential HARD_DENY for commands
+        for (const p of analysis.candidatePaths) {
+            if (isCredentialPath(p)) {
+                return denyWith('deny_list', null, `hard_deny: credential path protected: ${p}`, { matchedRule: 'hard_deny' });
+            }
+        }
+        // Item 4 & 5: Write containment (resolved against policy.workspace, never args.Cwd)
+        const allWrite = analysis.writePaths;
+        for (const w of allWrite) {
+            if (isAgentsPath(w, policy.workspace)) {
+                return denyWith('containment', null, `This action attempts to write inside ${policy.workspace}/.agents (${w}). This directory contains the gate's own hook configuration and is always write-protected against all modifications including shell redirection (I6). Use a different path.`);
+            }
+            if (!isContainedForKind(w, roots, 'write')) {
+                return denyWith('containment', null, `This action attempts to write outside the workspace (${w}). Writes are permitted only within the workspace. Retry with a path inside the workspace.`);
+            }
+        }
+        // Item 2: Read-side containment for shell commands
+        const allRead = [...new Set([...analysis.readPaths, ...assignmentReadPaths(commandLine)])];
+        for (const r of allRead) {
+            if (ALLOWED_DEV_READS.has(r))
+                continue;
+            if (!isContainedForKind(r, roots, 'read')) {
+                return denyWith('containment', null, `read_outside_workspace: This action attempts to read outside the workspace (${r}). Reads are permitted only within the workspace.`);
+            }
+        }
+    }
+    else {
+        for (const w of toolClass.write) {
+            if (isAgentsPath(w, policy.workspace)) {
+                return denyWith('containment', null, `This action attempts to write inside ${policy.workspace}/.agents (${w}). This directory contains the gate's own hook configuration and is always write-protected against all modifications including shell redirection (I6). Use a different path.`);
+            }
+            if (!isContainedForKind(w, roots, 'write')) {
+                return denyWith('containment', null, `This action attempts to write outside the workspace (${w}). Writes are permitted only within the workspace. Retry with a path inside the workspace.`);
+            }
+        }
+        for (const r of toolClass.read) {
+            if (!isContainedForKind(r, roots, 'read')) {
+                return denyWith('containment', null, `This action attempts to read outside the workspace (${r}). Reads are permitted only within the workspace.`);
+            }
+        }
+    }
+    // Step 5: deny list.
+    const denyHit = firstMatchForDenial(parseRulesLenient(policy.deny), subject);
+    if (denyHit) {
+        return denyWith('deny_list', null, `This action (${denyHit.raw}) is denied by this job's policy. Do not attempt to bypass this constraint with another tool; report this restriction directly in your final response.`);
+    }
+    // Step 6 & 7 for command:
+    if (subject.verb === 'command') {
+        const cmdEval = evaluateCommandPolicy(subject.value, parseRulesLenient(policy.allow), parseRulesLenient(policy.deny));
+        if (cmdEval.allowed) {
+            const overwrite = commandOverwrite(policy, subject.value);
+            return {
+                decision: { decision: 'allow', overwrite },
+                log: makeLog('allow', 'profile_allowlist', cmdEval.matchedRule, null),
+                requestsAbort: false,
+            };
+        }
+        if (cmdEval.stage === 'deny_list') {
+            const guidance = cmdEval.reason === 'env_assignment_denied'
+                ? 'env_assignment_denied'
+                : `This action is denied by this job's policy. Do not attempt to bypass this constraint with another tool; report this restriction directly in your final response.`;
+            return denyWith('deny_list', null, guidance);
+        }
+        // stage === 'default'
+        if (policy.command_policy === 'denylist') {
+            const overwrite = commandOverwrite(policy, subject.value);
+            return {
+                decision: { decision: 'allow', overwrite },
+                log: makeLog('allow', 'denylist_default', null, null),
+                requestsAbort: false,
+            };
+        }
+        return denyWith('default', cmdEval.requiredRule, `This action is not in the allowlist for profile "${policy.profile}". If it remains necessary, stop execution and report in your final response that the following rule is required: ${cmdEval.requiredRule}`);
+    }
+    // Step 6: allow list (for non-command subjects).
+    const allowHit = firstMatch(parseRulesLenient(policy.allow), subject);
+    if (allowHit) {
+        return {
+            decision: { decision: 'allow' },
+            log: makeLog('allow', 'profile_allowlist', allowHit.raw, null),
+            requestsAbort: false,
+        };
+    }
+    // Step 7: nothing matched. I1 — a bound job's gate never answers `ask`;
+    // `default_decision` is gone, so this is always `deny`.
+    const requiredRule = requiredRuleFor(subject);
+    return denyWith('default', requiredRule, `This action is not in the allowlist for profile "${policy.profile}". If it remains necessary, stop execution and report in your final response that the following rule is required: ${requiredRule}`);
+}
+/**
+ * The `overwrite` every allowed `run_command` carries. `Cwd` is pinned to the
+ * workspace and `BypassSandbox` is always explicit (I2, M3 variant C). Under
+ * `sandbox: 'seatbelt'` the command itself is rewritten to run inside our own
+ * write-only profile (M9: `overwrite.CommandLine` is honoured by agy; the
+ * model and the event stream still see the original) with agy's sandbox off.
+ */
+export function commandOverwrite(policy, commandLine) {
+    if (policy.sandbox === 'seatbelt') {
+        return {
+            Cwd: policy.workspace,
+            BypassSandbox: true,
+            CommandLine: seatbeltCommandLine(commandLine, policy.seatbelt_write_roots),
+        };
+    }
+    return { Cwd: policy.workspace, BypassSandbox: policy.bypass_sandbox };
+}
+/**
+ * Count the number of 'deny' decisions in a gate-log.jsonl content string.
+ * Tolerates empty strings, trailing newlines, and malformed lines.
+ */
+export function countDeniesInGateLog(text) {
+    if (!text)
+        return 0;
+    let count = 0;
+    const lines = text.split('\n');
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (parsed && typeof parsed === 'object' && parsed.decision === 'deny') {
+                count++;
+            }
+        }
+        catch {
+            // ignore malformed lines
+        }
+    }
+    return count;
+}
+/** Read stdin to EOF. Returns null on any failure — the caller then passes through. */
+export function readStdin() {
+    try {
+        return readFileSync(0, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/** Tolerant payload parse. Null when the shape is unusable; never throws. */
+export function parsePayload(raw) {
+    if (!raw || !raw.trim())
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== 'object')
+            return null;
+        const p = parsed;
+        if (typeof p.conversationId !== 'string' || p.conversationId.length === 0)
+            return null;
+        const toolCallRaw = p.toolCall;
+        if (!toolCallRaw || typeof toolCallRaw !== 'object')
+            return null;
+        const toolCall = toolCallRaw;
+        if (typeof toolCall.name !== 'string' || toolCall.name.length === 0)
+            return null;
+        const args = toolCall.args && typeof toolCall.args === 'object'
+            ? toolCall.args
+            : undefined;
+        return {
+            conversationId: p.conversationId,
+            stepIdx: typeof p.stepIdx === 'number' ? p.stepIdx : undefined,
+            modelName: typeof p.modelName === 'string' ? p.modelName : undefined,
+            toolCall: { name: toolCall.name, args },
+            workspacePaths: Array.isArray(p.workspacePaths)
+                ? (p.workspacePaths.filter((x) => typeof x === 'string'))
+                : undefined,
+            transcriptPath: typeof p.transcriptPath === 'string' ? p.transcriptPath : undefined,
+            artifactDirectoryPath: typeof p.artifactDirectoryPath === 'string' ? p.artifactDirectoryPath : undefined,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** Write the decision to stdout as one line. The only place that writes stdout. */
+/**
+ * Captured before {@link guardStdout} neuters the public one, so this stays the
+ * only path to the real file descriptor.
+ */
+const realStdoutWrite = process.stdout.write.bind(process.stdout);
+let emitted = false;
+/**
+ * Make stdout write-once and pollution-proof.
+ *
+ * Measured against agy 1.1.23: a hook that exits 0 but whose stdout does not
+ * parse is a DENIAL, not a passthrough —
+ *   failed to unmarshal result from hook ... via protojson: not json at all
+ * and this process always exits 0 (see `src/gate.ts`), so the
+ * `|| printf '{"decision":"ask"}'` fallback in `hooks.json` — which only fires
+ * on a non-zero exit — cannot cover it. One stray `console.log` from anywhere
+ * in the import graph would therefore deny every tool call in the workspace,
+ * including the user's own interactive agy sessions.
+ *
+ * So: everything except {@link emit} is swallowed, and only the first decision
+ * is written.
+ */
+export function guardStdout() {
+    process.stdout.write = ((_chunk, encoding, cb) => {
+        const done = typeof encoding === 'function' ? encoding : cb;
+        if (typeof done === 'function')
+            done();
+        return true;
+    });
+}
+export function emit(decision) {
+    if (emitted)
+        return;
+    emitted = true;
+    realStdoutWrite(JSON.stringify(decision));
+}
+/** Test seam: `emitted` is module state and every test needs a clean one. */
+export function resetEmitForTests() {
+    emitted = false;
+}
+/** Append to `gate-log.jsonl`. Every verdict is recorded, allows included (§1.8). */
+export function logDecision(jobDir, entry) {
+    appendJsonLine(join(jobDir, 'gate-log.jsonl'), entry);
+}
+/** `deny` reason used when the store cannot even be opened (§2.3). No job to log against. */
+const STATE_UNAVAILABLE = { decision: 'deny', reason: 'agy-worker gate: state unavailable' };
+/** `deny` reason for any failure once we are past "open the store" (§2.3). */
+const INTERNAL_ERROR = { decision: 'deny', reason: 'agy-worker gate: internal error' };
+/**
+ * `dist/gate.js` entry point.
+ *
+ * Always resolves 0 — a non-zero exit from a hook is not a documented signal,
+ * and we must not find out what agy does with one. Emits exactly once: the
+ * decision is computed and everything that can fail (DB access, binding,
+ * logging, the `on_denial: 'abort'` mark) is contained in a try/catch that
+ * runs *before* `emit`, and everything after `emit` is itself wrapped so a
+ * failure there can never produce a second line on stdout.
+ *
+ * Failure paths (not all of them are
+ * `ask` any more, since I1 only protects a *bound* job's decision, not the
+ * gate process's own health):
+ *   - unparsable payload → `ask` (we cannot even tell whose call this is —
+ *     handled above, before this function's own try/catch begins).
+ *   - the store cannot be opened at all → `deny`, `state unavailable`. A
+ *     broken `AGY_WORKER_HOME`/project dir means we cannot tell bound from
+ *     unbound either, but unlike a parse failure this is *our* infrastructure
+ *     breaking, not a payload shape we cannot read — failing open here would
+ *     mean every tool call in every workspace runs unguarded the moment our
+ *     own state directory has a problem.
+ *   - `bindConversation` resolves and the conversation is not one of ours →
+ *     `ask` (unchanged; `decide()` returns `PASSTHROUGH` for `bound === null`
+ *     without throwing, so this falls out of the ordinary call below).
+ *   - the store opened and anything after that throws → `deny`, `internal
+ *     error`. By this point we hold a real, open connection; failing closed
+ *     is strictly safer than guessing `ask` and letting agy's own engine (or
+ *     the model, per M3-C) decide unsupervised.
+ */
+export async function main() {
+    const raw = readStdin();
+    const payload = parsePayload(raw);
+    if (!payload) {
+        emit(PASSTHROUGH);
+        return 0;
+    }
+    let outcome = { decision: INTERNAL_ERROR, log: null, requestsAbort: false };
+    let jobDir = null;
+    let store;
+    try {
+        store = openStore({ readOnly: true });
+        chmodDbFiles(store.paths.db);
+    }
+    catch {
+        emit(STATE_UNAVAILABLE);
+        return 0;
+    }
+    try {
+        try {
+            const bound = bindConversation(store, payload.conversationId);
+            outcome = decide({ payload, bound });
+            if (bound) {
+                jobDir = jobPaths(store.paths, bound.job.job_id).dir;
+                let reachedMaxDenials = false;
+                if (outcome.log?.decision === 'deny' &&
+                    typeof bound.policy.max_denials === 'number' &&
+                    bound.job.lifecycle !== 'canceling' &&
+                    bound.job.lifecycle !== 'finished') {
+                    const gateLogFile = jobPaths(store.paths, bound.job.job_id).gateLog;
+                    let existingDenies = 0;
+                    try {
+                        if (existsSync(gateLogFile)) {
+                            existingDenies = countDeniesInGateLog(readFileSync(gateLogFile, 'utf8'));
+                        }
+                    }
+                    catch {
+                        // Best effort; tolerate missing or unreadable gate-log.
+                    }
+                    reachedMaxDenials = existingDenies + 1 >= bound.policy.max_denials;
+                }
+                const shouldAbort = (outcome.requestsAbort || reachedMaxDenials) &&
+                    bound.job.lifecycle !== 'canceling' &&
+                    bound.job.lifecycle !== 'finished';
+                if (shouldAbort) {
+                    const abortReason = outcome.requestsAbort
+                        ? 'on_denial'
+                        : 'max_denials';
+                    if (outcome.log) {
+                        outcome.log.abort_reason = abortReason;
+                    }
+                    // The store above is now genuinely read-only (finding 19), so this
+                    // one write opens its own short-lived read-write connection rather
+                    // than widening the hot path everyone else pays for.
+                    try {
+                        const writeStore = openStore({ readOnly: false });
+                        chmodDbFiles(writeStore.paths.db);
+                        try {
+                            // Mark only — the actual killpg is handled by the broker's
+                            // reconcile loop, not by the gate.
+                            updateJob(writeStore, bound.job.job_id, { lifecycle: 'canceling' });
+                        }
+                        finally {
+                            writeStore.close();
+                        }
+                    }
+                    catch {
+                        // Best effort; the deadline / next reconcile still catches it.
+                    }
+                }
+            }
+        }
+        finally {
+            store.close();
+        }
+    }
+    catch {
+        // Past this point we had a real store connection open — fail closed
+        // rather than passing through (§2.3's "bound, later exception" row).
+        outcome = { decision: INTERNAL_ERROR, log: null, requestsAbort: false };
+        jobDir = null;
+    }
+    emit(outcome.decision);
+    if (jobDir && outcome.log) {
+        try {
+            logDecision(jobDir, outcome.log);
+        }
+        catch {
+            // Logging is best-effort; the decision already reached stdout.
+        }
+    }
+    return 0;
+}
+//# sourceMappingURL=gate.js.map

package/dist/gate/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/gate/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAUzD,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAC/H,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAA6B,yBAAyB,EAAE,YAAY,EAAE,kBAAkB,EAAyB,MAAM,0BAA0B,CAAA;AAChM,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,WAAW,GAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;AAgB5D;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,QAAgB,EAAE,QAAkB,EAAE,OAA0B;IAC3F,MAAM,SAAS,GACb,QAAQ,KAAK,OAAO;QAClB,CAAC,CAAC,wGAAwG;QAC1G,CAAC,CAAC,EAAE,CAAA;IACR,OAAO,GAAG,QAAQ,GAAG,SAAS,KAAK,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAA;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,MAAM,CAAC,KAAsB;IAC3C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAEhC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAA;IACnE,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,CAAA;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,CAAA;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAA;IACzC,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5E,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IACpE,MAAM,OAAO,GACX,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAEvG,MAAM,OAAO,GAAG,CACd,QAAkC,EAClC,WAA8B,EAC9B,WAA0B,EAC1B,MAAqB,EACP,EAAE,CAAC,CAAC;QAClB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,eAAe,EAAE,cAAc;QAC/B,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,QAAQ;QACR,MAAM,EAAE,WAAW;QACnB,YAAY,EAAE,WAAW;QACzB,MAAM;KACP,CAAC,CAAA;IAEF,kGAAkG;IAClG,MAAM,QAAQ,GAAG,CACf,WAA8B,EAC9B,YAA2B,EAC3B,QAAgB,EAChB,OAAkE,EACrD,EAAE;QACf,MAAM,aAAa,GAAsB;YACvC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,QAAQ;YACd,aAAa,EAAE,YAAY;YAC3B,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAA;QACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QAC7E,OAAO;YACL,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;YACtC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI,EAAE,MAAM,CAAC;YACvE,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC;SACxE,CAAA;IACH,CAAC,CAAA;IAED,kDAAkD;IAClD,6EAA6E;IAC7E,4EAA4E;IAC5E,kFAAkF;IAClF,6EAA6E;IAC7E,mEAAmE;IACnE,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAA;QACxE,OAAO,QAAQ,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED,+EAA+E;IAC/E,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC/B,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC;YAC5C,aAAa,EAAE,KAAK;SACrB,CAAA;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAA;IAC7B,MAAM,KAAK,GAAqB,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CAAA;IAEtF,wEAAwE;IACxE,MAAM,WAAW,GAAG,QAAQ,KAAK,aAAa,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAA;IAEhH,IAAI,QAAQ,KAAK,aAAa,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QAEzE,wDAAwD;QACxD,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO,QAAQ,CACb,aAAa,EACb,IAAI,EACJ,mCAAmC,QAAQ,CAAC,cAAc,yQAAyQ,CACpU,CAAA;QACH,CAAC;QAED,4CAA4C;QAC5C,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YACxC,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxB,OAAO,QAAQ,CACb,WAAW,EACX,IAAI,EACJ,yCAAyC,CAAC,EAAE,EAC5C,EAAE,WAAW,EAAE,WAAW,EAAE,CAC7B,CAAA;YACH,CAAC;QACH,CAAC;QAED,oFAAoF;QACpF,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAA;QACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtC,OAAO,QAAQ,CACb,aAAa,EACb,IAAI,EACJ,wCAAwC,MAAM,CAAC,SAAS,aAAa,CAAC,8KAA8K,CACrP,CAAA;YACH,CAAC;YACD,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC3C,OAAO,QAAQ,CACb,aAAa,EACb,IAAI,EACJ,wDAAwD,CAAC,4FAA4F,CACtJ,CAAA;YACH,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,SAAS,EAAE,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1F,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAQ;YACtC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC1C,OAAO,QAAQ,CACb,aAAa,EACb,IAAI,EACJ,+EAA+E,CAAC,mDAAmD,CACpI,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtC,OAAO,QAAQ,CACb,aAAa,EACb,IAAI,EACJ,wCAAwC,MAAM,CAAC,SAAS,aAAa,CAAC,8KAA8K,CACrP,CAAA;YACH,CAAC;YACD,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC3C,OAAO,QAAQ,CACb,aAAa,EACb,IAAI,EACJ,wDAAwD,CAAC,4FAA4F,CACtJ,CAAA;YACH,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC1C,OAAO,QAAQ,CACb,aAAa,EACb,IAAI,EACJ,uDAAuD,CAAC,mDAAmD,CAC5G,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,MAAM,OAAO,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;IAC5E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,QAAQ,CACb,WAAW,EACX,IAAI,EACJ,gBAAgB,OAAO,CAAC,GAAG,wJAAwJ,CACpL,CAAA;IACH,CAAC;IAED,0BAA0B;IAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,qBAAqB,CACnC,OAAO,CAAC,KAAK,EACb,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,EAC/B,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/B,CAAA;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YACzD,OAAO;gBACL,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE;gBAC1C,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC;gBACrE,aAAa,EAAE,KAAK;aACrB,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,QAAQ,GACZ,OAAO,CAAC,MAAM,KAAK,uBAAuB;gBACxC,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,kKAAkK,CAAA;YACxK,OAAO,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC9C,CAAC;QACD,sBAAsB;QACtB,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YACzD,OAAO;gBACL,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE;gBAC1C,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC;gBACrD,aAAa,EAAE,KAAK;aACrB,CAAA;QACH,CAAC;QACD,OAAO,QAAQ,CACb,SAAS,EACT,OAAO,CAAC,YAAY,EACpB,oDAAoD,MAAM,CAAC,OAAO,qHAAqH,OAAO,CAAC,YAAY,EAAE,CAC9M,CAAA;IACH,CAAC;IAED,iDAAiD;IACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;IACrE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC/B,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;YAC9D,aAAa,EAAE,KAAK;SACrB,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,wDAAwD;IACxD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC7C,OAAO,QAAQ,CACb,SAAS,EACT,YAAY,EACZ,oDAAoD,MAAM,CAAC,OAAO,qHAAqH,YAAY,EAAE,CACtM,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAuB,EACvB,WAAmB;IAEnB,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,SAAS;YACrB,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,oBAAoB,CAAC;SAC3E,CAAA;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,cAAc,EAAE,CAAA;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAA;IACnB,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA2B,CAAA;YAC5D,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACvE,KAAK,EAAE,CAAA;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,GAAkB;IAC7C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAA;QACzC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QACtD,MAAM,CAAC,GAAG,MAAiC,CAAA;QAE3C,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAEtF,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAA;QAC9B,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAChE,MAAM,QAAQ,GAAG,WAAsC,CAAA;QACvD,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAEhF,MAAM,IAAI,GACR,QAAQ,CAAC,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAChD,CAAC,CAAE,QAAQ,CAAC,IAAgC;YAC5C,CAAC,CAAC,SAAS,CAAA;QAEf,OAAO;YACL,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAC9D,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACpE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE;YACvC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;gBAC7C,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;gBACtE,CAAC,CAAC,SAAS;YACb,cAAc,EAAE,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;YACnF,qBAAqB,EACnB,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS;SACpF,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF;;;GAGG;AACH,MAAM,eAAe,GAA+B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;AAE7F,IAAI,OAAO,GAAG,KAAK,CAAA;AAEnB;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CACtB,MAAe,EACf,QAAkB,EAClB,EAAY,EACH,EAAE;QACX,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;QAC3D,IAAI,OAAO,IAAI,KAAK,UAAU;YAAG,IAAmB,EAAE,CAAA;QACtD,OAAO,IAAI,CAAA;IACb,CAAC,CAAgC,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,QAAsB;IACzC,IAAI,OAAO;QAAE,OAAM;IACnB,OAAO,GAAG,IAAI,CAAA;IACd,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;AAC3C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,KAAK,CAAA;AACjB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,KAAmB;IAC7D,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAA;AACvD,CAAC;AAED,6FAA6F;AAC7F,MAAM,iBAAiB,GAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAA;AAC1G,8EAA8E;AAC9E,MAAM,cAAc,GAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAA;AAEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAA;IACvB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,WAAW,CAAC,CAAA;QACjB,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,OAAO,GAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAA;IACxF,IAAI,MAAM,GAAkB,IAAI,CAAA;IAEhC,IAAI,KAAmC,CAAA;IACvC,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QACrC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,iBAAiB,CAAC,CAAA;QACvB,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,CAAC;QACH,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;YAC7D,OAAO,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;YAEpC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAA;gBAEpD,IAAI,iBAAiB,GAAG,KAAK,CAAA;gBAC7B,IACE,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,MAAM;oBAChC,OAAO,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ;oBAC5C,KAAK,CAAC,GAAG,CAAC,SAAS,KAAK,WAAW;oBACnC,KAAK,CAAC,GAAG,CAAC,SAAS,KAAK,UAAU,EAClC,CAAC;oBACD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAA;oBACnE,IAAI,cAAc,GAAG,CAAC,CAAA;oBACtB,IAAI,CAAC;wBACH,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;4BAC5B,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;wBAC1E,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,wDAAwD;oBAC1D,CAAC;oBACD,iBAAiB,GAAG,cAAc,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,CAAA;gBACpE,CAAC;gBAED,MAAM,WAAW,GACf,CAAC,OAAO,CAAC,aAAa,IAAI,iBAAiB,CAAC;oBAC5C,KAAK,CAAC,GAAG,CAAC,SAAS,KAAK,WAAW;oBACnC,KAAK,CAAC,GAAG,CAAC,SAAS,KAAK,UAAU,CAAA;gBAEpC,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,WAAW,GAAgC,OAAO,CAAC,aAAa;wBACpE,CAAC,CAAC,WAAW;wBACb,CAAC,CAAC,aAAa,CAAA;oBACjB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,WAAW,CAAA;oBACxC,CAAC;oBACD,mEAAmE;oBACnE,mEAAmE;oBACnE,qDAAqD;oBACrD,IAAI,CAAC;wBACH,MAAM,UAAU,GAAG,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;wBACjD,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;wBACjC,IAAI,CAAC;4BACH,2DAA2D;4BAC3D,mCAAmC;4BACnC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAA;wBACrE,CAAC;gCAAS,CAAC;4BACT,UAAU,CAAC,KAAK,EAAE,CAAA;wBACpB,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,+DAA+D;oBACjE,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,KAAK,EAAE,CAAA;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAA;QACvE,MAAM,GAAG,IAAI,CAAA;IACf,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAEtB,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/gate/hooks-file.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Single owner of `<workspace>/.agents/hooks.json`'s lifecycle: `start.ts` writes
+ * our entry when a job spawns, `reconcile.ts` removes it once no live job on that
+ * `cwd` needs it any more. Kept in one module — with the key constant — so the two
+ * call sites can never drift on what "our entry" means.
+ */
+/** The one key this package ever writes into `hooks.json`. Never touch any other key. */
+export declare const GATE_HOOK_KEY = "agy-worker-gate";
+export declare function hooksFilePath(workspace: string): string;
+/**
+ * Write (merging, never clobbering unrelated keys) `<workspace>/.agents/hooks.json`
+ * so the PreToolUse gate loads for this workspace. `--add-dir` is what makes agy
+ * load it at all (see docs/permissions.md) — this is the piece that puts the
+ * file there in the first place, since nothing else in the package owns it.
+ *
+ * The command is just `node '<gatePath>'` — quoted (an unquoted absolute path
+ * breaks on any install path containing a space). There used to be a
+ * `|| printf '{"decision":"ask"}'` fallback here; it is gone. agy already fails closed on its own —
+ * empty/non-JSON stdout or a non-zero exit is a *denial*, not a pass-through
+ * (measured against 1.1.23, `src/gate/gate.ts`'s own header comment) — so the
+ * fallback never protected anything: its only effect was to convert that
+ * already-safe failure into `{"decision":"ask"}`, which in print mode reaches
+ * agy's built-in engine and lets a `run_command` call proceed with whatever
+ * `BypassSandbox` value the model itself asked for (M3-C) — the exact hole I2 exists to close.
+ * Losing the fallback also means `ensureGateHook` must only ever be called once
+ * `gatePath` is confirmed to exist (`agy_start`'s own `existsSync` check).
+ *
+ * Our key is written **first** in the object, ahead of every pre-existing key.
+ * Measured (M6): agy evaluates
+ * `hooks.json`'s PreToolUse groups in declaration order and a `deny` from an
+ * earlier group short-circuits the rest — a group installed ahead of ours that
+ * denies would mean our gate never runs at all for that call, and the runtime
+ * watchdog (`src/runner/gate-watchdog.ts`) would misread the resulting silence
+ * in `gate-log.jsonl` as "hooks never loaded". Writing ours first guarantees it
+ * runs on every tool call regardless of what else is declared in this file.
+ * (A hook group installed *outside* this file entirely — e.g. a user's global
+ * `~/.gemini/config/hooks.json` — that denies ahead of ours is the one case
+ * this cannot cover; the watchdog still reports it correctly if bluntly, as
+ * "gate never fired", which is safe — fail closed — just imprecise about why.
+ * Not handled here, by design.)
+ */
+export declare function ensureGateHook(workspace: string, gatePath: string): void;
+/**
+ * Remove only {@link GATE_HOOK_KEY} from `<workspace>/.agents/hooks.json`,
+ * preserving every other key untouched. Deletes the file when it held nothing
+ * else, and the `.agents` directory when that leaves it empty. A no-op when the
+ * file does not exist or never carried our key.
+ *
+ * Best effort by design: called from
+ * `reconcile`, which must never fail a tool call over hook-file housekeeping. A
+ * stale entry left behind by a failure here is harmless until the next
+ * `agy_start` on the same workspace, which overwrites it unconditionally.
+ */
+export declare function removeGateHook(workspace: string): void;
+//# sourceMappingURL=hooks-file.d.ts.map

package/dist/gate/hooks-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks-file.d.ts","sourceRoot":"","sources":["../../src/gate/hooks-file.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AAEH,yFAAyF;AACzF,eAAO,MAAM,aAAa,oBAAoB,CAAA;AAE9C,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEvD;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAexE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAyBtD"}