atabey-shared 0.0.37 → 0.1.0-beta.0

package/dist/pii.js

@@ -17,15 +17,36 @@
  * - Date of birth / full address patterns
  * - Custom names (configurable)
  */
-// Sensitive patterns to detect and mask
-// IMPORTANT: More specific patterns MUST come before generic ones
+/** Turkish TC Kimlik No checksum (reduces over-masking of arbitrary 11-digit numbers). */
+function isValidTckn(value) {
+    if (!/^[1-9]\d{10}$/.test(value))
+        return false;
+    const d = value.split("").map(Number);
+    const odd = d[0] + d[2] + d[4] + d[6] + d[8];
+    const even = d[1] + d[3] + d[5] + d[7];
+    const tenth = (((odd * 7) - even) % 10 + 10) % 10;
+    if (tenth !== d[9])
+        return false;
+    const sumFirst10 = d.slice(0, 10).reduce((a, b) => a + b, 0);
+    return sumFirst10 % 10 === d[10];
+}
+function isValidIpv4(value) {
+    return value.split(".").every((o) => {
+        const n = Number(o);
+        return Number.isInteger(n) && n >= 0 && n <= 255;
+    });
+}
+/** Only treat a colon-group as IPv6 when it has a hex letter or a `::` (not a time). */
+function looksLikeIpv6(value) {
+    return value.includes("::") || /[a-fA-F]/.test(value);
+}
 const SENSITIVE_PATTERNS = [
     // JWT tokens (complete JWT format) - must be before Bearer
     { pattern: /eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g, replacement: "***-JWT-REDACTED-***" },
-    // Bearer tokens in Authorization headers
-    { pattern: /Bearer\s+[a-zA-Z0-9._-]+/g, replacement: "Bearer ***-REDACTED-***" },
+    // Bearer tokens in Authorization headers (case-insensitive; includes base64url chars)
+    { pattern: /Bearer\s+[A-Za-z0-9._~+/=-]+/gi, replacement: "Bearer ***-REDACTED-***" },
     // Basic auth in Authorization headers
-    { pattern: /Basic\s+[a-zA-Z0-9=+/]+/g, replacement: "Basic ***-REDACTED-***" },
+    { pattern: /Basic\s+[a-zA-Z0-9=+/]+/gi, replacement: "Basic ***-REDACTED-***" },
     // API keys (common formats) - must be before generic patterns
     // Note: ghp_ tokens can contain digits that look like phone numbers, so we mask the entire prefix + suffix
     { pattern: /\b(sk-[a-zA-Z0-9]{20,}|pk-[a-zA-Z0-9]{20,}|xai-[a-zA-Z0-9]{20,}|AIza[0-9A-Za-z_-]{35}|ghp_[a-zA-Z0-9]{36,}|gho_[a-zA-Z0-9]{36,}|ghu_[a-zA-Z0-9]{36,}|ghb_[a-zA-Z0-9]{36,}|github_pat_[a-zA-Z0-9]{36,}|sk-[a-zA-Z0-9_-]{32,}|sk-[a-zA-Z0-9]{48,}|whsec_[a-zA-Z0-9]{16,})\b/g, replacement: "***-REDACTED-***" },
@@ -35,8 +56,8 @@ const SENSITIVE_PATTERNS = [
     { pattern: /\b(0[1-9]|[12][0-9]|3[01])[/.-](0[1-9]|1[0-2])[/.-](19[0-9]{2}|20[0-9]{2})\b/g, replacement: "**/**/****" },
     // IBAN (international bank account) - strictly matches ISO country codes and length >= 15
     { pattern: /\b(?:TR|DE|FR|GB|IT|ES|NL|CH|AT|BE|PL|SE|NO|DK|FI|PT|GR|IE|CZ|RO|HU|BG|HR|LT|SI|LV|EE|CY|LU|MT|SK|US|CA)\d{2}[A-Z0-9]{11,30}\b/g, replacement: "****-IBAN-REDACTED-****" },
-    // TC Kimlik (11 digits starting with 1-9, isolated word boundary) - must be before phone
-    { pattern: /\b[1-9][0-9]{10}\b/g, replacement: "***********" },
+    // TC Kimlik (11 digits) — validated with the official checksum to avoid masking arbitrary IDs
+    { pattern: /\b[1-9]\d{10}\b/g, replacement: "***********", validate: isValidTckn },
     // Email
     { pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, replacement: "***@***" },
     // Phone (Turkish: +90 5xx xxx xx xx, 05xx xxx xx xx, or formatted 5xx xxx xx xx)
@@ -45,22 +66,24 @@ const SENSITIVE_PATTERNS = [
     // Phone (international with leading + or delimited format e.g. +1 (555) 123-4567, +44 20 7946 0950)
     // Delimiters or leading '+' are strictly required so that raw Unix timestamps / IDs are not falsely masked.
     { pattern: /\b(?:\+\d{1,3}[\s.-]?)?(?:\(\d{2,4}\)[\s.-]?|\d{2,4}[\s.-])\d{3,4}[\s.-]\d{2,4}(?:[\s.-]\d{2,4})?\b/g, replacement: "***-***-****" },
-    // IP addresses (IPv4)
-    { pattern: /\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b/g, replacement: "***.***.***.***" },
-    // IP addresses (IPv6 - simplified)
+    // IP addresses (IPv4) — validated octets only
+    { pattern: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g, replacement: "***.***.***.***", validate: isValidIpv4 },
+    // IP addresses (IPv6 - full form)
     { pattern: /\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b/g, replacement: "****:****:****:****" },
-    // IPv6 compressed
-    { pattern: /\b(?:[0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}\b/g, replacement: "****:****:****" },
+    // IPv6 compressed — requires `::` or a hex letter so clock times (10:30:45) are not masked
+    { pattern: /\b(?:[0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}\b/g, replacement: "****:****:****", validate: looksLikeIpv6 },
     // Credit card (Delimited 16 digits or major card issuer BIN prefixes: Visa 4, MC 51-55/22-27, Discover 6011/65)
     // Prevents false-positive masking of 13-digit Unix timestamps (e.g. 1713000000000)
     { pattern: /\b\d{4}[ -]\d{4}[ -]\d{4}[ -]\d{4}\b/g, replacement: "****-****-****-****" },
     { pattern: /\b4\d{3}[ -]?\d{4}[ -]?\d{4}[ -]?\d{4}\b/g, replacement: "****-****-****-****" },
     { pattern: /\b(?:5[1-5]\d{2}|222[1-9]|22[3-9]\d|2[3-6]\d{2}|27[01]\d|2720)[ -]?\d{4}[ -]?\d{4}[ -]?\d{4}\b/g, replacement: "****-****-****-****" },
     { pattern: /\b(?:6011|65\d{2})[ -]?\d{4}[ -]?\d{4}[ -]?\d{4}\b/g, replacement: "****-****-****-****" },
-    // AMEX (15 digits, starts with 34/37)
-    { pattern: /\b3[47][0-9\s-]{13,14}\b/g, replacement: "****-****-***" },
-    // Password fields in JSON
+    // AMEX (15 digits, starts with 34/37) — no whitespace/newlines, exact length
+    { pattern: /\b3[47]\d{2}[ -]?\d{6}[ -]?\d{5}\b/g, replacement: "****-****-***" },
+    // Password fields in JSON (double-quoted)
     { pattern: /"(password|passwd|secret|api_key|apiKey|apikey|auth_token|refresh_token|access_token)"\s*:\s*"[^"]+"/gi, replacement: "\"$1\": \"***-REDACTED-***\"" },
+    // Password fields in JSON (single-quoted)
+    { pattern: /'(password|passwd|secret|api_key|apiKey|apikey|auth_token|refresh_token|access_token)'\s*:\s*'[^']*'/gi, replacement: "'$1': '***-REDACTED-***'" },
     // Turkish address patterns (contextual: only when accompanied by street/neighborhood identifiers)
     { pattern: /(?:(?:sokak|cadde|mahalle|bulvar|apt|daire|blok)[^,\n]*\b(?:no|kapı no|daire no|numara)[:\s]*\d+)/gi, replacement: "no: ****" },
 ];
@@ -87,8 +110,13 @@ export function maskText(text) {
     if (!text || typeof text !== "string")
         return text;
     let masked = text;
-    for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
-        masked = masked.replace(pattern, replacement);
+    for (const { pattern, replacement, validate } of SENSITIVE_PATTERNS) {
+        if (validate) {
+            masked = masked.replace(pattern, (match) => (validate(match) ? replacement : match));
+        }
+        else {
+            masked = masked.replace(pattern, replacement);
+        }
     }
     return masked;
 }
@@ -100,9 +128,11 @@ export function maskText(text) {
  */
 export function maskObject(obj, depth = 0, strictMode = false) {
     if (depth > 10)
-        return obj; // Prevent infinite recursion
+        return strictMode ? "***-REDACTED-***" : obj; // Prevent infinite recursion
     if (obj === null || obj === undefined)
         return obj;
+    if (typeof Buffer !== "undefined" && Buffer.isBuffer(obj))
+        return `<Buffer ${obj.length} bytes>`;
     if (typeof obj === "string")
         return maskText(obj);
     if (typeof obj !== "object")
@@ -112,8 +142,10 @@ export function maskObject(obj, depth = 0, strictMode = false) {
     }
     const result = {};
     for (const [key, value] of Object.entries(obj)) {
-        // Check if the key itself is a sensitive field
-        if (SENSITIVE_FIELDS.includes(key)) {
+        // Sensitive by exact name, or (strict mode) by name heuristic.
+        const isSensitive = SENSITIVE_FIELDS.includes(key) ||
+            (strictMode && /(pass|secret|token|key|credential|auth)/i.test(key));
+        if (isSensitive) {
             result[key] = typeof value === "string" ? "***-REDACTED-***" : maskObject(value, depth + 1, strictMode);
         }
         else if (typeof value === "string") {
@@ -133,12 +165,15 @@ export function maskObject(obj, depth = 0, strictMode = false) {
  * Useful for warning before sending data to external APIs.
  */
 export function containsPII(text) {
-    for (const { pattern } of SENSITIVE_PATTERNS) {
-        pattern.lastIndex = 0; // Reset RegExp state before test
-        const hasMatch = pattern.test(text);
-        pattern.lastIndex = 0; // Reset RegExp state after test
-        if (hasMatch)
-            return true;
+    for (const { pattern, validate } of SENSITIVE_PATTERNS) {
+        const re = new RegExp(pattern.source, pattern.flags);
+        let m;
+        while ((m = re.exec(text)) !== null) {
+            if (!validate || validate(m[0]))
+                return true;
+            if (m.index === re.lastIndex)
+                re.lastIndex++; // avoid zero-length loops
+        }
     }
     return false;
 }
@@ -217,4 +252,25 @@ export function maskToolArgs(args) {
     const masked = maskObject(args, 0, true);
     return masked;
 }
+/**
+ * Paths where PII masking of tool *results* is intentionally skipped to avoid
+ * corrupting technical content (tests, docs, examples, fixtures). Real
+ * production secrets are still caught by the secret-leak guard.
+ */
+const PII_BYPASS_PATH_PATTERNS = [
+    /(^|\/)tests?\//i,
+    /(^|\/)__tests__\//i,
+    /\.(test|spec)\.[cm]?[jt]sx?$/i,
+    /\.mdx?$/i,
+    /(^|\/)docs?\//i,
+    /\.env\.example$/i,
+    /\.example$/i,
+    /(^|\/)fixtures?\//i,
+];
+export function shouldBypassPiiMaskingForPath(filePath) {
+    if (!filePath)
+        return false;
+    const normalized = filePath.replace(/\\/g, "/");
+    return PII_BYPASS_PATH_PATTERNS.some((re) => re.test(normalized));
+}
 //# sourceMappingURL=pii.js.map

package/dist/pii.js.map

@@ -1 +1 @@
-{"version":3,"file":"pii.js","sourceRoot":"","sources":["../src/pii.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,wCAAwC;AACxC,kEAAkE;AAClE,MAAM,kBAAkB,GAAG;IACvB,2DAA2D;IAC3D,EAAE,OAAO,EAAE,uDAAuD,EAAE,WAAW,EAAE,sBAAsB,EAAE;IAEzG,yCAAyC;IACzC,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAChF,sCAAsC;IACtC,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,wBAAwB,EAAE;IAE9E,8DAA8D;IAC9D,2GAA2G;IAC3G,EAAE,OAAO,EAAE,4QAA4Q,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAE1T,8EAA8E;IAC9E,EAAE,OAAO,EAAE,2DAA2D,EAAE,WAAW,EAAE,aAAa,EAAE;IAEpG,wDAAwD;IACxD,EAAE,OAAO,EAAE,+EAA+E,EAAE,WAAW,EAAE,YAAY,EAAE;IAEvH,0FAA0F;IAC1F,EAAE,OAAO,EAAE,iIAAiI,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAEtL,yFAAyF;IACzF,EAAE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,aAAa,EAAE;IAE9D,QAAQ;IACR,EAAE,OAAO,EAAE,iDAAiD,EAAE,WAAW,EAAE,SAAS,EAAE;IAEtF,iFAAiF;IACjF,EAAE,OAAO,EAAE,2EAA2E,EAAE,WAAW,EAAE,cAAc,EAAE;IACrH,EAAE,OAAO,EAAE,8CAA8C,EAAE,WAAW,EAAE,cAAc,EAAE;IAExF,oGAAoG;IACpG,4GAA4G;IAC5G,EAAE,OAAO,EAAE,sGAAsG,EAAE,WAAW,EAAE,cAAc,EAAE;IAEhJ,sBAAsB;IACtB,EAAE,OAAO,EAAE,oCAAoC,EAAE,WAAW,EAAE,iBAAiB,EAAE;IACjF,mCAAmC;IACnC,EAAE,OAAO,EAAE,+CAA+C,EAAE,WAAW,EAAE,qBAAqB,EAAE;IAChG,kBAAkB;IAClB,EAAE,OAAO,EAAE,iDAAiD,EAAE,WAAW,EAAE,gBAAgB,EAAE;IAE7F,gHAAgH;IAChH,mFAAmF;IACnF,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,qBAAqB,EAAE;IACxF,EAAE,OAAO,EAAE,2CAA2C,EAAE,WAAW,EAAE,qBAAqB,EAAE;IAC5F,EAAE,OAAO,EAAE,iGAAiG,EAAE,WAAW,EAAE,qBAAqB,EAAE;IAClJ,EAAE,OAAO,EAAE,qDAAqD,EAAE,WAAW,EAAE,qBAAqB,EAAE;IACtG,sCAAsC;IACtC,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,eAAe,EAAE;IAEtE,0BAA0B;IAC1B,EAAE,OAAO,EAAE,wGAAwG,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAElK,kGAAkG;IAClG,EAAE,OAAO,EAAE,qGAAqG,EAAE,WAAW,EAAE,UAAU,EAAE;CAC9I,CAAC;AAEF,wFAAwF;AACxF,MAAM,gBAAgB,GAAG;IACrB,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;IAC7D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY;IAClG,eAAe,EAAE,eAAe,EAAE,QAAQ;IAC1C,OAAO,EAAE,QAAQ,EAAE,OAAO;IAC1B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW;IAC5G,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;IACjF,KAAK,EAAE,gBAAgB,EAAE,iBAAiB;IAC1C,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY;IACnG,WAAW,EAAE,YAAY,EAAE,IAAI;IAC/B,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY;IAChE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc;IAC7C,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB;IAC5E,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY;CAC/D,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACjC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,kBAAkB,EAAE,CAAC;QACxD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,KAAK,GAAG,CAAC,EAAE,UAAU,GAAG,KAAK;IAClE,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,CAAC,6BAA6B;IACzD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAExC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QACxE,+CAA+C;QAC/C,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QAC5G,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACJ,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACpC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,kBAAkB,EAAE,CAAC;QAC3C,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,iCAAiC;QACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,gCAAgC;QACvD,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAE,KAAK,GAAG,CAAC;IACvD,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE1C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,WAAW,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxC,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,mBAAmB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC3D,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAOD;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IAE3B,6CAA6C;IAC7C,IACI,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC;QAClE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC;QACxC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO;MACzD,CAAC;QACC,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,wDAAwD;IACxD,IACI,gDAAgD,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3D,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC;QAClE,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9C,8EAA8E,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3F,CAAC;QACC,OAAO,cAAc,CAAC;IAC1B,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAA0D;IACrF,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAE9C,OAAO;QACH,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClC,GAAG,KAAK;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI;SAClE,CAAC,CAAC;KACN,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAA6B;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAA4B,CAAC;IACpE,OAAO,MAAM,CAAC;AAClB,CAAC"}
+{"version":3,"file":"pii.js","sourceRoot":"","sources":["../src/pii.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAWH,0FAA0F;AAC1F,SAAS,WAAW,CAAC,KAAa;IAC9B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;IAClD,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,UAAU,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IACrD,CAAC,CAAC,CAAC;AACP,CAAC;AAED,wFAAwF;AACxF,SAAS,aAAa,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,kBAAkB,GAAuB;IAC3C,2DAA2D;IAC3D,EAAE,OAAO,EAAE,uDAAuD,EAAE,WAAW,EAAE,sBAAsB,EAAE;IAEzG,sFAAsF;IACtF,EAAE,OAAO,EAAE,gCAAgC,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACrF,sCAAsC;IACtC,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,wBAAwB,EAAE;IAE/E,8DAA8D;IAC9D,2GAA2G;IAC3G,EAAE,OAAO,EAAE,4QAA4Q,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAE1T,8EAA8E;IAC9E,EAAE,OAAO,EAAE,2DAA2D,EAAE,WAAW,EAAE,aAAa,EAAE;IAEpG,wDAAwD;IACxD,EAAE,OAAO,EAAE,+EAA+E,EAAE,WAAW,EAAE,YAAY,EAAE;IAEvH,0FAA0F;IAC1F,EAAE,OAAO,EAAE,iIAAiI,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAEtL,8FAA8F;IAC9F,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE;IAElF,QAAQ;IACR,EAAE,OAAO,EAAE,iDAAiD,EAAE,WAAW,EAAE,SAAS,EAAE;IAEtF,iFAAiF;IACjF,EAAE,OAAO,EAAE,2EAA2E,EAAE,WAAW,EAAE,cAAc,EAAE;IACrH,EAAE,OAAO,EAAE,8CAA8C,EAAE,WAAW,EAAE,cAAc,EAAE;IAExF,oGAAoG;IACpG,4GAA4G;IAC5G,EAAE,OAAO,EAAE,sGAAsG,EAAE,WAAW,EAAE,cAAc,EAAE;IAEhJ,8CAA8C;IAC9C,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,iBAAiB,EAAE,QAAQ,EAAE,WAAW,EAAE;IAClG,kCAAkC;IAClC,EAAE,OAAO,EAAE,+CAA+C,EAAE,WAAW,EAAE,qBAAqB,EAAE;IAChG,2FAA2F;IAC3F,EAAE,OAAO,EAAE,iDAAiD,EAAE,WAAW,EAAE,gBAAgB,EAAE,QAAQ,EAAE,aAAa,EAAE;IAEtH,gHAAgH;IAChH,mFAAmF;IACnF,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,qBAAqB,EAAE;IACxF,EAAE,OAAO,EAAE,2CAA2C,EAAE,WAAW,EAAE,qBAAqB,EAAE;IAC5F,EAAE,OAAO,EAAE,iGAAiG,EAAE,WAAW,EAAE,qBAAqB,EAAE;IAClJ,EAAE,OAAO,EAAE,qDAAqD,EAAE,WAAW,EAAE,qBAAqB,EAAE;IACtG,6EAA6E;IAC7E,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,eAAe,EAAE;IAEhF,0CAA0C;IAC1C,EAAE,OAAO,EAAE,wGAAwG,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAClK,0CAA0C;IAC1C,EAAE,OAAO,EAAE,wGAAwG,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAE9J,kGAAkG;IAClG,EAAE,OAAO,EAAE,qGAAqG,EAAE,WAAW,EAAE,UAAU,EAAE;CAC9I,CAAC;AAEF,wFAAwF;AACxF,MAAM,gBAAgB,GAAG;IACrB,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;IAC7D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY;IAClG,eAAe,EAAE,eAAe,EAAE,QAAQ;IAC1C,OAAO,EAAE,QAAQ,EAAE,OAAO;IAC1B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW;IAC5G,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;IACjF,KAAK,EAAE,gBAAgB,EAAE,iBAAiB;IAC1C,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY;IACnG,WAAW,EAAE,YAAY,EAAE,IAAI;IAC/B,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY;IAChE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc;IAC7C,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB;IAC5E,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY;CAC/D,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACjC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,kBAAkB,EAAE,CAAC;QAClE,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACJ,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,KAAK,GAAG,CAAC,EAAE,UAAU,GAAG,KAAK;IAClE,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,6BAA6B;IAC3F,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClD,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,GAAG,CAAC,MAAM,SAAS,CAAC;IACjG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAExC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QACxE,+DAA+D;QAC/D,MAAM,WAAW,GACb,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC9B,CAAC,UAAU,IAAI,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,WAAW,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QAC5G,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACJ,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACpC,KAAK,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,kBAAkB,EAAE,CAAC;QACrD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7C,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,SAAS;gBAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,0BAA0B;QAC5E,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAE,KAAK,GAAG,CAAC;IACvD,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE1C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,WAAW,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxC,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,mBAAmB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC3D,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAOD;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IAE3B,6CAA6C;IAC7C,IACI,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC;QAClE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC;QACxC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO;MACzD,CAAC;QACC,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,wDAAwD;IACxD,IACI,gDAAgD,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3D,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC;QAClE,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9C,8EAA8E,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3F,CAAC;QACC,OAAO,cAAc,CAAC;IAC1B,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAA0D;IACrF,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAE9C,OAAO;QACH,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClC,GAAG,KAAK;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI;SAClE,CAAC,CAAC;KACN,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAA6B;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAA4B,CAAC;IACpE,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,wBAAwB,GAAa;IACvC,iBAAiB;IACjB,oBAAoB;IACpB,+BAA+B;IAC/B,UAAU;IACV,gBAAgB;IAChB,kBAAkB;IAClB,aAAa;IACb,oBAAoB;CACvB,CAAC;AAEF,MAAM,UAAU,6BAA6B,CAAC,QAAiB;IAC3D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/policy-gate.js

@@ -14,15 +14,25 @@ export const MUTATING_TOOLS = new Set([
     "patch_file",
     "batch_surgical_edit",
     "run_shell_command",
-    "compress_files",
-    "decompress_files",
+    "run_tests",
+    "check_lint",
+    "analyze_code_quality",
+    "check_architecture_compliance",
     "delete_knowledge",
     "update_project_memory",
     "store_knowledge",
     "update_contract_hash",
+    // Control-plane / security-relevant operations
+    "http_proxy_request",
+    "orchestrate_loop",
+    "submit_plan",
+    "approve_operation",
+    "register_agent",
+    "acquire_lock",
+    "release_lock",
 ]);
 /** Path-like arg keys commonly used by tools. */
-const PATH_KEYS = ["path", "file", "filePath", "target", "output", "source", "archive"];
+const PATH_KEYS = ["path", "file", "filePath", "target", "output", "source", "archive", "filename"];
 /** Relative path segments that must never be written by agents by default. */
 const PROTECTED_PATH_PATTERNS = [
     /(^|\/)\.env(\.|$)/i,
@@ -35,6 +45,20 @@ const PROTECTED_PATH_PATTERNS = [
     /(^|\/)\.aws\/credentials$/i,
     /(^|\/)\.npmrc$/i,
     /(^|\/)\.netrc$/i,
+    // Git/container/kube config and hooks — rewriting these yields code execution.
+    /(^|\/)\.git\/config$/i,
+    /(^|\/)\.git\/hooks(\/|$)/i,
+    /(^|\/)\.docker\/config\.json$/i,
+    /(^|\/)\.kube\/config$/i,
+    /(^|\/)\.gitconfig$/i,
+    // Private keys / certs
+    /\.pem$/i,
+    /\.key$/i,
+    /\.crt$/i,
+    /(^|\/)\.bashrc$/i,
+    /(^|\/)\.zshrc$/i,
+    /(^|\/)\.profile$/i,
+    /(^|\/)\.bash_profile$/i,
 ];
 function allow(code = "ALLOW", reason = "Allowed") {
     return { effect: "allow", code, reason };

package/dist/policy-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-gate.js","sourceRoot":"","sources":["../src/policy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4BH,kEAAkE;AAClE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAClC,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,qBAAqB;IACrB,mBAAmB;IACnB,gBAAgB;IAChB,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,iBAAiB;IACjB,sBAAsB;CACzB,CAAC,CAAC;AAEH,iDAAiD;AACjD,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAEjG,8EAA8E;AAC9E,MAAM,uBAAuB,GAAa;IACtC,oBAAoB;IACpB,sBAAsB;IACtB,oBAAoB;IACpB,sBAAsB;IACtB,gBAAgB;IAChB,oBAAoB;IACpB,2BAA2B;IAC3B,4BAA4B;IAC5B,iBAAiB;IACjB,iBAAiB;CACpB,CAAC;AAEF,SAAS,KAAK,CAAC,OAAmB,OAAO,EAAE,MAAM,GAAG,SAAS;IACzD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,IAAI,CAAC,IAAgB,EAAE,MAAc;IAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,IAA6B;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,sBAAsB;IACtB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAA0B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3F,KAAK,CAAC,IAAI,CAAE,IAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC1C,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,CAAC;QAAE,OAAO,aAAa,CAAC;IAC7B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA0B;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAE9B,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE5C,8DAA8D;IAC9D,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,IAAI,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;QACzE,CAAC;QACD,iCAAiC;QACjC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;QAC1E,CAAC;QACD,4BAA4B;QAC5B,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO,IAAI,CACP,qBAAqB,EACrB,8BAA8B,CAAC,6CAA6C,CAC/E,CAAC;YACN,CAAC;QACL,CAAC;QACD,8FAA8F;QAC9F,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,0FAA0F;YAC1F,IACI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBACpB,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBACpB,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBACpB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;gBACrB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACnB,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EACzB,CAAC;gBACC,OAAO,IAAI,CACP,sBAAsB,EACtB,iCAAiC,CAAC,GAAG,CACxC,CAAC;YACN,CAAC;QACL,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACzC,KAAK,MAAM,EAAE,IAAI,uBAAuB,EAAE,CAAC;gBACvC,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBACtB,OAAO,IAAI,CACP,qBAAqB,EACrB,2CAA2C,CAAC,4DAA4D,CAC3G,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,0FAA0F;IAC1F,IAAI,UAAU,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,IAAI,CACP,qBAAqB,EACrB,SAAS,KAAK,+CAA+C,IAAI,IAAI,CACxE,CAAC;IACN,CAAC;IAED,kEAAkE;IAClE,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CACP,qBAAqB,EACrB,kEAAkE,CACrE,CAAC;QACN,CAAC;IACL,CAAC;IAED,OAAO,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,QAAwB;IAC9C,OAAO,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAwB;IACvD,OAAO,iBAAiB,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;AAChE,CAAC"}
+{"version":3,"file":"policy-gate.js","sourceRoot":"","sources":["../src/policy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4BH,kEAAkE;AAClE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAClC,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,qBAAqB;IACrB,mBAAmB;IACnB,WAAW;IACX,YAAY;IACZ,sBAAsB;IACtB,+BAA+B;IAC/B,kBAAkB;IAClB,uBAAuB;IACvB,iBAAiB;IACjB,sBAAsB;IACtB,+CAA+C;IAC/C,oBAAoB;IACpB,kBAAkB;IAClB,aAAa;IACb,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,cAAc;CACjB,CAAC,CAAC;AAEH,iDAAiD;AACjD,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AAE7G,8EAA8E;AAC9E,MAAM,uBAAuB,GAAa;IACtC,oBAAoB;IACpB,sBAAsB;IACtB,oBAAoB;IACpB,sBAAsB;IACtB,gBAAgB;IAChB,oBAAoB;IACpB,2BAA2B;IAC3B,4BAA4B;IAC5B,iBAAiB;IACjB,iBAAiB;IACjB,+EAA+E;IAC/E,uBAAuB;IACvB,2BAA2B;IAC3B,gCAAgC;IAChC,wBAAwB;IACxB,qBAAqB;IACrB,uBAAuB;IACvB,SAAS;IACT,SAAS;IACT,SAAS;IACT,kBAAkB;IAClB,iBAAiB;IACjB,mBAAmB;IACnB,wBAAwB;CAC3B,CAAC;AAEF,SAAS,KAAK,CAAC,OAAmB,OAAO,EAAE,MAAM,GAAG,SAAS;IACzD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,IAAI,CAAC,IAAgB,EAAE,MAAc;IAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,IAA6B;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,sBAAsB;IACtB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAA0B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3F,KAAK,CAAC,IAAI,CAAE,IAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC1C,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,CAAC;QAAE,OAAO,aAAa,CAAC;IAC7B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA0B;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAE9B,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE5C,8DAA8D;IAC9D,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,IAAI,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;QACzE,CAAC;QACD,iCAAiC;QACjC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;QAC1E,CAAC;QACD,4BAA4B;QAC5B,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO,IAAI,CACP,qBAAqB,EACrB,8BAA8B,CAAC,6CAA6C,CAC/E,CAAC;YACN,CAAC;QACL,CAAC;QACD,8FAA8F;QAC9F,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,0FAA0F;YAC1F,IACI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBACpB,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBACpB,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBACpB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;gBACrB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACnB,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EACzB,CAAC;gBACC,OAAO,IAAI,CACP,sBAAsB,EACtB,iCAAiC,CAAC,GAAG,CACxC,CAAC;YACN,CAAC;QACL,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACzC,KAAK,MAAM,EAAE,IAAI,uBAAuB,EAAE,CAAC;gBACvC,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBACtB,OAAO,IAAI,CACP,qBAAqB,EACrB,2CAA2C,CAAC,4DAA4D,CAC3G,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,0FAA0F;IAC1F,IAAI,UAAU,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,IAAI,CACP,qBAAqB,EACrB,SAAS,KAAK,+CAA+C,IAAI,IAAI,CACxE,CAAC;IACN,CAAC;IAED,kEAAkE;IAClE,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CACP,qBAAqB,EACrB,kEAAkE,CACrE,CAAC;QACN,CAAC;IACL,CAAC;IAED,OAAO,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,QAAwB;IAC9C,OAAO,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAwB;IACvD,OAAO,iBAAiB,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;AAChE,CAAC"}

package/dist/retention.d.ts

@@ -32,10 +32,15 @@ export declare class DataRetention {
    */
     static eraseTraceData(traceId: string): number;
     /**
-   * [KVKK Art. 11] Erases all data.
+   * [KVKK Art. 11] Erases all data across every store (full right-to-erasure).
    * Only works with the confirmation code.
    */
     static eraseAllData(confirmationCode: string): number;
+    /**
+     * Recompute the agent-log chain anchor after a legitimate deletion so that
+     * verification does not mistake retention/erasure for tampering.
+     */
+    private static refreshLogAnchor;
     /**
    * Get retention statistics.
    */

package/dist/retention.js

@@ -13,6 +13,7 @@
 import { Audit } from "./audit.js";
 import { logger } from "./logger.js";
 import { databaseHolder } from "./database.js";
+import { clearChainAnchor, writeChainAnchor } from "./audit-chain.js";
 /**
  * Data retention categories and default durations (days)
  */
@@ -78,10 +79,10 @@ export class DataRetention {
    */
     static eraseTraceData(traceId) {
         let total = 0;
+        const db = databaseHolder.getDB();
         // Audit logs
         total += Audit.deleteByFilter({ traceId });
         // Messages
-        const db = databaseHolder.getDB();
         const msgResult = db.prepare("DELETE FROM messages WHERE trace_id = ?").run(traceId);
         total += msgResult.changes;
         // Tasks
@@ -90,11 +91,17 @@ export class DataRetention {
         // Logs
         const logResult = db.prepare("DELETE FROM logs WHERE trace_id = ?").run(traceId);
         total += logResult.changes;
+        if (logResult.changes > 0)
+            this.refreshLogAnchor();
+        // Costs (may carry trace_id / usage data)
+        total += db.prepare("DELETE FROM costs WHERE trace_id = ?").run(traceId).changes;
+        // Approvals (args + passcode)
+        total += db.prepare("DELETE FROM approvals WHERE trace_id = ?").run(traceId).changes;
         logger.info(`[RETENTION] Trace ${traceId} erased: ${total} records deleted (KVKK Article 7)`);
         return total;
     }
     /**
-   * [KVKK Art. 11] Erases all data.
+   * [KVKK Art. 11] Erases all data across every store (full right-to-erasure).
    * Only works with the confirmation code.
    */
     static eraseAllData(confirmationCode) {
@@ -104,14 +111,52 @@ export class DataRetention {
         let total = 0;
         const db = databaseHolder.getDB();
         total += Audit.clearAll(confirmationCode);
-        total += db.prepare("DELETE FROM messages").run().changes;
-        total += db.prepare("DELETE FROM tasks").run().changes;
-        total += db.prepare("DELETE FROM logs").run().changes;
-        total += db.prepare("DELETE FROM agents").run().changes;
-        total += db.prepare("DELETE FROM metadata").run().changes;
+        // Every table that can hold user/agent/personal data.
+        for (const table of [
+            "messages",
+            "tasks",
+            "logs",
+            "agents",
+            "metadata",
+            "costs",
+            "knowledge",
+            "users",
+            "loop_cooldowns",
+            "approvals",
+            "discipline",
+            "distributed_locks",
+        ]) {
+            try {
+                total += db.prepare(`DELETE FROM ${table}`).run().changes;
+            }
+            catch {
+                // Table may not exist in this schema version — skip.
+            }
+        }
+        // Both hash-chain anchors are now empty.
+        clearChainAnchor("agent-log");
+        clearChainAnchor("structured");
         logger.warn(`[RETENTION] ALL DATA ERASED: ${total} records (KVKK Article 7 - Right to Erasure)`);
         return total;
     }
+    /**
+     * Recompute the agent-log chain anchor after a legitimate deletion so that
+     * verification does not mistake retention/erasure for tampering.
+     */
+    static refreshLogAnchor() {
+        try {
+            const db = databaseHolder.getDB();
+            const row = db.prepare("SELECT hash FROM logs WHERE hash IS NOT NULL ORDER BY id DESC LIMIT 1").get();
+            const count = db.prepare("SELECT COUNT(*) AS c FROM logs WHERE hash IS NOT NULL").get().c;
+            if (row?.hash && count > 0)
+                writeChainAnchor("agent-log", row.hash, count);
+            else
+                clearChainAnchor("agent-log");
+        }
+        catch {
+            /* ignore */
+        }
+    }
     /**
    * Get retention statistics.
    */
@@ -151,7 +196,7 @@ export class DataRetention {
         const db = databaseHolder.getDB();
         const result = db.prepare(`
       DELETE FROM messages
-      WHERE timestamp < datetime('now', '-30 days')
+      WHERE strftime('%Y-%m-%d %H:%M:%S', timestamp) < datetime('now', '-30 days')
     `).run();
         return result.changes;
     }
@@ -163,8 +208,10 @@ export class DataRetention {
         const db = databaseHolder.getDB();
         const result = db.prepare(`
       DELETE FROM logs
-      WHERE timestamp < datetime('now', '-30 days')
+      WHERE strftime('%Y-%m-%d %H:%M:%S', timestamp) < datetime('now', '-30 days')
     `).run();
+        if (result.changes > 0)
+            this.refreshLogAnchor();
         return result.changes;
     }
 }

package/dist/retention.js.map

@@ -1 +1 @@
-{"version":3,"file":"retention.js","sourceRoot":"","sources":["../src/retention.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACtD,WAAW,EAAE,EAAE,EAAK,4BAA4B;IAChD,SAAS,EAAE,EAAE,EAAO,mCAAmC;IACvD,QAAQ,EAAE,GAAG,EAAO,6BAA6B;IACjD,QAAQ,EAAE,GAAG,EAAO,wBAAwB;IAC5C,UAAU,EAAE,GAAG,EAAK,8BAA8B;CACrD,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,aAAa;IACd,MAAM,CAAC,eAAe,GAA0C,IAAI,CAAC;IAE7E;;;;;KAKC;IACD,MAAM,CAAC,UAAU,CAAC,UAAU,GAAG,OAAO;QACtC,sBAAsB;QAClB,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,4BAA4B;QAC5B,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC;QAExE,MAAM,CAAC,IAAI,CACP,0CAA0C;YAChD,qBAAqB,UAAU,GAAG,KAAK,OAAO;YAC9C,aAAa,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvF,CAAC;IACN,CAAC;IAED;;;KAGC;IACD,MAAM,CAAC,UAAU;QACb,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAElD,IAAI,CAAC;YACD,sBAAsB;YACtB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;YAEpC,+CAA+C;YAC/C,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAE1C,oBAAoB;YACpB,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAElC,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC7D,MAAM,CAAC,IAAI,CACP,gCAAgC;oBAC1C,GAAG,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,QAAQ,cAAc,MAAM,CAAC,IAAI,OAAO,CAClE,CAAC;YACN,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,+BAAgC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;KAMC;IACD,MAAM,CAAC,cAAc,CAAC,OAAe;QACjC,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,aAAa;QACb,KAAK,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAE3C,WAAW;QACX,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrF,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC;QAE3B,QAAQ;QACR,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnF,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC;QAE5B,OAAO;QACP,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjF,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC;QAE3B,MAAM,CAAC,IAAI,CAAC,qBAAqB,OAAO,YAAY,KAAK,mCAAmC,CAAC,CAAC;QAC9F,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;KAGC;IACD,MAAM,CAAC,YAAY,CAAC,gBAAwB;QACxC,IAAI,gBAAgB,KAAK,uBAAuB,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAElC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC1C,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;QAC1D,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;QACvD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;QACtD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;QACxD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;QAE1D,MAAM,CAAC,IAAI,CAAC,gCAAgC,KAAK,8CAA8C,CAAC,CAAC;QACjG,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;KAEC;IACD,MAAM,CAAC,QAAQ;QAOX,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAElC,MAAM,YAAY,GACpB,EAAE,CAAC,OAAO,CAAC;;;;OAIV,CAAC,CAAC,GAAG,EACH,CAAC,KAAK,CAAC;QAER,MAAM,YAAY,GAAI,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,CAAC;QAC7G,MAAM,QAAQ,GAAI,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,CAAC;QACrG,MAAM,SAAS,GAAI,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,CAAC;QAEvG,OAAO;YACH,YAAY;YACZ,YAAY;YACZ,QAAQ;YACR,SAAS;YACT,QAAQ,EAAE,EAAE,GAAG,kBAAkB,EAAE;SACtC,CAAC;IACN,CAAC;IAED;;KAEC;IACD,MAAM,CAAC,QAAQ;QACX,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,CAAC;IACL,CAAC;IAED;;;KAGC;IACO,MAAM,CAAC,gBAAgB;QAC3B,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;;;KAG7B,CAAC,CAAC,GAAG,EAAE,CAAC;QACL,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;;KAGC;IACO,MAAM,CAAC,YAAY;QACvB,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;;;KAG7B,CAAC,CAAC,GAAG,EAAE,CAAC;QACL,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC"}
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../src/retention.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACtD,WAAW,EAAE,EAAE,EAAK,4BAA4B;IAChD,SAAS,EAAE,EAAE,EAAO,mCAAmC;IACvD,QAAQ,EAAE,GAAG,EAAO,6BAA6B;IACjD,QAAQ,EAAE,GAAG,EAAO,wBAAwB;IAC5C,UAAU,EAAE,GAAG,EAAK,8BAA8B;CACrD,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,aAAa;IACd,MAAM,CAAC,eAAe,GAA0C,IAAI,CAAC;IAE7E;;;;;KAKC;IACD,MAAM,CAAC,UAAU,CAAC,UAAU,GAAG,OAAO;QACtC,sBAAsB;QAClB,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,4BAA4B;QAC5B,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC;QAExE,MAAM,CAAC,IAAI,CACP,0CAA0C;YAChD,qBAAqB,UAAU,GAAG,KAAK,OAAO;YAC9C,aAAa,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvF,CAAC;IACN,CAAC;IAED;;;KAGC;IACD,MAAM,CAAC,UAAU;QACb,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAElD,IAAI,CAAC;YACD,sBAAsB;YACtB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;YAEpC,+CAA+C;YAC/C,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAE1C,oBAAoB;YACpB,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAElC,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC7D,MAAM,CAAC,IAAI,CACP,gCAAgC;oBAC1C,GAAG,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,QAAQ,cAAc,MAAM,CAAC,IAAI,OAAO,CAClE,CAAC;YACN,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,+BAAgC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;KAMC;IACD,MAAM,CAAC,cAAc,CAAC,OAAe;QACjC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAElC,aAAa;QACb,KAAK,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAE3C,WAAW;QACX,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrF,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC;QAE3B,QAAQ;QACR,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnF,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC;QAE5B,OAAO;QACP,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjF,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC;QAC3B,IAAI,SAAS,CAAC,OAAO,GAAG,CAAC;YAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAEnD,0CAA0C;QAC1C,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;QAEjF,8BAA8B;QAC9B,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;QAErF,MAAM,CAAC,IAAI,CAAC,qBAAqB,OAAO,YAAY,KAAK,mCAAmC,CAAC,CAAC;QAC9F,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;KAGC;IACD,MAAM,CAAC,YAAY,CAAC,gBAAwB;QACxC,IAAI,gBAAgB,KAAK,uBAAuB,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAElC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC1C,sDAAsD;QACtD,KAAK,MAAM,KAAK,IAAI;YAChB,UAAU;YACV,OAAO;YACP,MAAM;YACN,QAAQ;YACR,UAAU;YACV,OAAO;YACP,WAAW;YACX,OAAO;YACP,gBAAgB;YAChB,WAAW;YACX,YAAY;YACZ,mBAAmB;SACtB,EAAE,CAAC;YACA,IAAI,CAAC;gBACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACL,qDAAqD;YACzD,CAAC;QACL,CAAC;QAED,yCAAyC;QACzC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC9B,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAE/B,MAAM,CAAC,IAAI,CAAC,gCAAgC,KAAK,8CAA8C,CAAC,CAAC;QACjG,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,gBAAgB;QAC3B,IAAI,CAAC;YACD,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,uEAAuE,CAAC,CAAC,GAAG,EAAkC,CAAC;YACtI,MAAM,KAAK,GAAI,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC;YAC7G,IAAI,GAAG,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC;gBAAE,gBAAgB,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;;gBACtE,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACL,YAAY;QAChB,CAAC;IACL,CAAC;IAED;;KAEC;IACD,MAAM,CAAC,QAAQ;QAOX,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAElC,MAAM,YAAY,GACpB,EAAE,CAAC,OAAO,CAAC;;;;OAIV,CAAC,CAAC,GAAG,EACH,CAAC,KAAK,CAAC;QAER,MAAM,YAAY,GAAI,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,CAAC;QAC7G,MAAM,QAAQ,GAAI,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,CAAC;QACrG,MAAM,SAAS,GAAI,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,CAAC;QAEvG,OAAO;YACH,YAAY;YACZ,YAAY;YACZ,QAAQ;YACR,SAAS;YACT,QAAQ,EAAE,EAAE,GAAG,kBAAkB,EAAE;SACtC,CAAC;IACN,CAAC;IAED;;KAEC;IACD,MAAM,CAAC,QAAQ;QACX,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,CAAC;IACL,CAAC;IAED;;;KAGC;IACO,MAAM,CAAC,gBAAgB;QAC3B,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;;;KAG7B,CAAC,CAAC,GAAG,EAAE,CAAC;QACL,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;;KAGC;IACO,MAAM,CAAC,YAAY;QACvB,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;;;KAG7B,CAAC,CAAC,GAAG,EAAE,CAAC;QACL,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC;YAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC"}

package/dist/sandbox-fs.d.ts

@@ -20,7 +20,7 @@ export interface SandboxFsWriteResult {
  */
 export declare function assertSafeRelativePath(userPath: string, projectRoot?: string): string;
 /**
- * Write file content under project root using the active sandbox runtime.
+ * Write file content under project root using the active local sandbox runtime.
  */
 export declare function writeFileInSandbox(projectRoot: string, userPath: string, content: string, options?: {
     ownerId?: string;

package/dist/sandbox-fs.js

@@ -8,8 +8,9 @@
  */
 import fs from "fs";
 import path from "path";
+import crypto from "crypto";
 import { AtomicFileLock } from "./file-lock.js";
-import { resolveSandboxRuntimeConfig, runInSandbox, SandboxRequiredError, } from "./sandbox-runtime.js";
+import { resolveSandboxRuntimeConfig, SandboxRequiredError, } from "./sandbox-runtime.js";
 /**
  * Normalize user path to a project-relative POSIX path.
  * Absolute paths are accepted only if they resolve inside projectRoot.
@@ -59,10 +60,6 @@ export function assertSafeRelativePath(userPath, projectRoot) {
     }
     return parts.join("/");
 }
-function shellSingleQuote(s) {
-    // Safe for sh single-quoted strings
-    return `'${s.replace(/'/g, `'\\''`)}'`;
-}
 function createLock(projectRoot) {
     return new AtomicFileLock({
         projectRoot,
@@ -77,7 +74,7 @@ function hostWriteAtomic(absolutePath, content) {
         fs.mkdirSync(dir, { recursive: true });
     }
     // Write exact bytes (callers decide trailing newline — patch/replace need fidelity)
-    const tempPath = `${absolutePath}.${Math.random().toString(36).slice(2, 9)}.tmp`;
+    const tempPath = `${absolutePath}.${crypto.randomBytes(6).toString("hex")}.tmp`;
     try {
         fs.writeFileSync(tempPath, content, "utf8");
         fs.renameSync(tempPath, absolutePath);
@@ -92,57 +89,53 @@ function hostWriteAtomic(absolutePath, content) {
     }
 }
 /**
- * Write file content under project root using the active sandbox runtime.
+ * Reject writes whose real (symlink-resolved) path escapes the project root.
+ * Lexical checks alone are defeated by a symlink inside the project that
+ * points at e.g. ~/.ssh/authorized_keys.
+ */
+function assertRealPathInsideRoot(absolutePath, root) {
+    const realRoot = fs.existsSync(root) ? fs.realpathSync(root) : root;
+    let probe = absolutePath;
+    while (probe !== path.dirname(probe)) {
+        if (fs.existsSync(probe)) {
+            const real = fs.realpathSync(probe) + absolutePath.slice(probe.length);
+            if (real !== realRoot && !real.startsWith(realRoot + path.sep)) {
+                throw new Error(`[SANDBOX_FS] Symlink escape denied: "${absolutePath}"`);
+            }
+            return;
+        }
+        probe = path.dirname(probe);
+    }
+}
+/**
+ * Write file content under project root using the active local sandbox runtime.
  */
 export async function writeFileInSandbox(projectRoot, userPath, content, options) {
     const root = path.resolve(projectRoot);
     const relativePath = assertSafeRelativePath(userPath, root);
     const absolutePath = path.resolve(root, relativePath);
-    // Belt-and-suspenders: stay inside root
     if (!absolutePath.startsWith(root + path.sep) && absolutePath !== root) {
         throw new Error(`[SANDBOX_FS] Resolved path escapes project root: "${userPath}"`);
     }
+    assertRealPathInsideRoot(absolutePath, root);
     const cfg = resolveSandboxRuntimeConfig(root, options?.timeoutMs);
     if (cfg.required && cfg.effectiveMode === "none") {
-        throw new SandboxRequiredError("[SANDBOX_REQUIRED] File write blocked: no sandbox isolation available. " +
-            "Set ATABEY_SANDBOX_RUNTIME=container (Podman/Docker) or uid, or disable ATABEY_SANDBOX_REQUIRED.");
+        throw new SandboxRequiredError("[SANDBOX_REQUIRED] File write blocked: no OS sandbox isolation available. " +
+            "Set ATABEY_SANDBOX_RUNTIME=seatbelt or uid, or disable ATABEY_SANDBOX_REQUIRED.");
     }
     const owner = options?.ownerId || process.env.ATABEY_ACTIVE_AGENT || "mcp-writer";
     const lock = createLock(root);
-    const posixRel = relativePath.split(path.sep).join("/");
     return lock.withLock(relativePath, owner, async () => {
-        if (cfg.effectiveMode === "container" && cfg.engine !== "none") {
-            const dir = path.posix.dirname(posixRel);
-            const script = dir === "."
-                ? `cat > ${shellSingleQuote(posixRel)}`
-                : `mkdir -p ${shellSingleQuote(dir)} && cat > ${shellSingleQuote(posixRel)}`;
-            const result = await runInSandbox({
-                command: "sh",
-                args: ["-c", script],
-                projectRoot: root,
-                timeoutMs: options?.timeoutMs ?? cfg.timeoutMs,
-                stdin: content,
-            });
-            if (result.code !== 0) {
-                throw new Error(`[SANDBOX_FS] Container write failed (code ${result.code}): ${result.stderr || result.stdout}`.trim());
-            }
-            return {
-                absolutePath,
-                relativePath,
-                runtime: "container",
-                isolationLabel: result.isolationLabel,
-                bytes: Buffer.byteLength(content, "utf8"),
-            };
-        }
-        // uid | none — host write confined to project root
         hostWriteAtomic(absolutePath, content);
         return {
             absolutePath,
             relativePath,
             runtime: cfg.effectiveMode,
-            isolationLabel: cfg.effectiveMode === "uid"
-                ? "uid host write (project-bound)"
-                : "host write (project-bound)",
+            isolationLabel: cfg.effectiveMode === "seatbelt"
+                ? "seatbelt host write (project-bound)"
+                : cfg.effectiveMode === "uid"
+                    ? "uid host write (project-bound)"
+                    : "host write (project-bound)",
             bytes: Buffer.byteLength(content, "utf8"),
         };
     });

package/dist/sandbox-fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-fs.js","sourceRoot":"","sources":["../src/sandbox-fs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EACH,2BAA2B,EAC3B,YAAY,EACZ,oBAAoB,GAEvB,MAAM,sBAAsB,CAAC;AAU9B;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,WAAoB;IACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEtC,8CAA8C;IAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACxE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,+BAA+B;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG;YAAE,SAAS;QAClC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IAC/B,oCAAoC;IACpC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB;IACnC,OAAO,IAAI,cAAc,CAAC;QACtB,WAAW;QACX,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC;QACpD,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;QACpB,SAAS,EAAE,MAAM;KACpB,CAAC,CAAC;AACP,CAAC;AAED,SAAS,eAAe,CAAC,YAAoB,EAAE,OAAe;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,oFAAoF;IACpF,MAAM,QAAQ,GAAG,GAAG,YAAY,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;IACjF,IAAI,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,CAAC;YAAC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACpF,MAAM,GAAG,CAAC;IACd,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,WAAmB,EACnB,QAAgB,EAChB,OAAe,EACf,OAAkD;IAElD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtD,wCAAwC;IACxC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,oBAAoB,CAC1B,yEAAyE;YACzE,kGAAkG,CACrG,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,YAAY,CAAC;IAClF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAExD,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;QACjD,IAAI,GAAG,CAAC,aAAa,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,MAAM,GACR,GAAG,KAAK,GAAG;gBACP,CAAC,CAAC,SAAS,gBAAgB,CAAC,QAAQ,CAAC,EAAE;gBACvC,CAAC,CAAC,YAAY,gBAAgB,CAAC,GAAG,CAAC,aAAa,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAErF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAC9B,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;gBACpB,WAAW,EAAE,IAAI;gBACjB,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,GAAG,CAAC,SAAS;gBAC9C,KAAK,EAAE,OAAO;aACjB,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACX,6CAA6C,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CACxG,CAAC;YACN,CAAC;YAED,OAAO;gBACH,YAAY;gBACZ,YAAY;gBACZ,OAAO,EAAE,WAAW;gBACpB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;aAC5C,CAAC;QACN,CAAC;QAED,mDAAmD;QACnD,eAAe,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO;YACH,YAAY;YACZ,YAAY;YACZ,OAAO,EAAE,GAAG,CAAC,aAAa;YAC1B,cAAc,EACV,GAAG,CAAC,aAAa,KAAK,KAAK;gBACvB,CAAC,CAAC,gCAAgC;gBAClC,CAAC,CAAC,4BAA4B;YACtC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;SAC5C,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"sandbox-fs.js","sourceRoot":"","sources":["../src/sandbox-fs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EACH,2BAA2B,EAC3B,oBAAoB,GAEvB,MAAM,sBAAsB,CAAC;AAU9B;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,WAAoB;IACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEtC,8CAA8C;IAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACxE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,+BAA+B;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG;YAAE,SAAS;QAClC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB;IACnC,OAAO,IAAI,cAAc,CAAC;QACtB,WAAW;QACX,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC;QACpD,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;QACpB,SAAS,EAAE,MAAM;KACpB,CAAC,CAAC;AACP,CAAC;AAED,SAAS,eAAe,CAAC,YAAoB,EAAE,OAAe;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,oFAAoF;IACpF,MAAM,QAAQ,GAAG,GAAG,YAAY,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAChF,IAAI,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,CAAC;YAAC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACpF,MAAM,GAAG,CAAC;IACd,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,YAAoB,EAAE,IAAY;IAChE,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,IAAI,KAAK,GAAG,YAAY,CAAC;IACzB,OAAO,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvE,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,wCAAwC,YAAY,GAAG,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO;QACX,CAAC;QACD,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,WAAmB,EACnB,QAAgB,EAChB,OAAe,EACf,OAAkD;IAElD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,wBAAwB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAE7C,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,oBAAoB,CAC1B,4EAA4E;YAC5E,iFAAiF,CACpF,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,YAAY,CAAC;IAClF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAE9B,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;QACjD,eAAe,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO;YACH,YAAY;YACZ,YAAY;YACZ,OAAO,EAAE,GAAG,CAAC,aAAa;YAC1B,cAAc,EACV,GAAG,CAAC,aAAa,KAAK,UAAU;gBAC5B,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,KAAK;oBACzB,CAAC,CAAC,gCAAgC;oBAClC,CAAC,CAAC,4BAA4B;YAC1C,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;SAC5C,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC"}