audit-tools 0.28.0

package/dist/shared/tokens.js

@@ -0,0 +1,54 @@
+// Canonical token-budget arithmetic shared by both orchestrators.
+//
+// Before Phase 0 each package carried its own copy of a per-line token
+// estimator (auditor `reviewPackets.ts`, remediator `plan.ts`). This module is
+// the single source of truth for:
+//   - the byte- and line-based token estimators,
+//   - the default budgets and safety margin used when sizing work blocks.
+//
+// Model context/output windows are NOT hardcoded here — they are discovered at
+// the dispatch-time capability handshake (see quota/limits.ts
+// `discovered_capability`). When nothing is discovered, sizing falls to the
+// conservative floor below, never to a guessed per-model window.
+// Conservative default budgets when no window is configured or discovered. This
+// matches the quota subsystem's conservative floor (quota/limits.ts
+// `defaultLimits`): a headless run that cannot discover its window sizes small
+// and honest rather than assuming a large model's context.
+export const DEFAULT_CONTEXT_TOKENS = 32_000;
+export const DEFAULT_OUTPUT_TOKENS = 4_096;
+// Fraction of the usable window (context − reserved output) a single work block
+// or review packet is allowed to occupy. Leaves headroom for the host prompt.
+export const BLOCK_SAFETY_MARGIN = 0.7;
+// Heuristic byte→token ratio for source code and English prose. Roughly four
+// bytes per token; deliberately coarse — callers size budgets, not bills.
+export const BYTES_PER_TOKEN = 4;
+// Legacy line-based estimate. Retained for callers that size by line count
+// before Phase 2 switches them to byte-based sizing.
+export const ESTIMATED_TOKENS_PER_LINE = 4;
+// Prompt/item overhead constants shared by both orchestrators. These replace
+// per-package local copies (ESTIMATED_BLOCK_BASE_TOKENS / ESTIMATED_PACKET_PROMPT_TOKENS
+// and ESTIMATED_FINDING_OVERHEAD_TOKENS) so the two orchestrators cannot drift apart.
+export const ESTIMATED_PROMPT_OVERHEAD_TOKENS = 900;
+export const ESTIMATED_ITEM_OVERHEAD_TOKENS = 600;
+/**
+ * Estimate tokens from a raw byte count. Non-finite or non-positive inputs
+ * estimate to zero so missing `size_bytes` never inflates a budget.
+ */
+export function estimateTokensFromBytes(bytes) {
+    if (!Number.isFinite(bytes) || bytes <= 0)
+        return 0;
+    return Math.ceil(bytes / BYTES_PER_TOKEN);
+}
+/**
+ * Usable context budget for a single work block: (context − reserved output)
+ * scaled by the safety margin. Callers pass the discovered/configured window;
+ * absent that, sizing falls to the conservative floor (never a guessed
+ * per-model window).
+ */
+export function resolveContextBudget(input) {
+    const contextTokens = input.contextTokens ?? DEFAULT_CONTEXT_TOKENS;
+    const outputTokens = input.reservedOutputTokens ?? DEFAULT_OUTPUT_TOKENS;
+    const margin = input.safetyMargin ?? BLOCK_SAFETY_MARGIN;
+    return Math.floor((contextTokens - outputTokens) * margin);
+}
+//# sourceMappingURL=tokens.js.map

package/dist/shared/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/shared/tokens.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,uEAAuE;AACvE,+EAA+E;AAC/E,kCAAkC;AAClC,iDAAiD;AACjD,0EAA0E;AAC1E,EAAE;AACF,+EAA+E;AAC/E,8DAA8D;AAC9D,4EAA4E;AAC5E,iEAAiE;AAEjE,gFAAgF;AAChF,oEAAoE;AACpE,+EAA+E;AAC/E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAC7C,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,gFAAgF;AAChF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC,6EAA6E;AAC7E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC,2EAA2E;AAC3E,qDAAqD;AACrD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C,6EAA6E;AAC7E,yFAAyF;AACzF,sFAAsF;AACtF,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AACpD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,sBAAsB,CAAC;IACpE,MAAM,YAAY,GAAG,KAAK,CAAC,oBAAoB,IAAI,qBAAqB,CAAC;IACzE,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,IAAI,mBAAmB,CAAC;IACzD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,GAAG,YAAY,CAAC,GAAG,MAAM,CAAC,CAAC;AAC7D,CAAC"}

package/dist/shared/tooling/allowlistedExec.d.ts

@@ -0,0 +1,45 @@
+/** Default per-anchor wall-clock budget; a slower command is killed and inconclusive. */
+export declare const ALLOWLISTED_EXEC_TIMEOUT_MS = 60000;
+/** Read-only git subcommands an anchor may run (no checkout/reset/clean/push/…). */
+export declare const GIT_READONLY_SUBCOMMANDS: ReadonlySet<string>;
+/**
+ * The set of executables the runner will auto-run, for callers that want to
+ * display the allowlist. Derived from the per-executable policies plus git.
+ */
+export declare const ANCHOR_ALLOWLIST: ReadonlySet<string>;
+/** Bare executable name: strip any directory and a Windows .cmd/.bat/.exe suffix. */
+export declare function executableBaseName(token: string): string;
+/**
+ * The single authority for what the tool will auto-run on the model's behalf:
+ * `command[0]` must be an allowlisted inspection-only executable, AND every
+ * argument must satisfy that executable's default-deny argument policy (git:
+ * read-only subcommand + no write/reconfigure option). Anything else → false.
+ *
+ * CRIT ARC-a06a3945: argument validation is the point — an allowed executable
+ * carrying a code-exec/file-write flag (`rg --pre`, `ast-grep --rewrite`,
+ * `git log -o file`, …) is REFUSED, not run.
+ */
+export declare function isAllowedAnchorCommand(command: string[]): boolean;
+/** Outcome of actually running an allowlisted command (injectable for tests). */
+export interface AllowlistedExecOutcome {
+    exit_code: number | null;
+    timed_out: boolean;
+    spawn_error?: string;
+    /** Full combined stdout+stderr (bounded), used to evaluate output matches. */
+    output: string;
+}
+export type AllowlistedExecRunner = (command: string[], cwd: string, timeoutMs: number) => Promise<AllowlistedExecOutcome>;
+/**
+ * Spawn an allowlisted read-only command argv-only (never a shell), capturing
+ * combined stdout+stderr (bounded). Strips the host-signalling env
+ * (`stripClaudeCodeEnv`), resolves the platform-correct argv via the shared
+ * `resolveExecArgv`, and kills a command that exceeds `timeoutMs`
+ * (SIGTERM→SIGKILL). The single runner both orchestrators use for the grounding
+ * anchor pass.
+ *
+ * NOTE: this does NOT re-check the allowlist — callers MUST gate the command
+ * through {@link isAllowedAnchorCommand} first. It is named/scoped so a future
+ * caller cannot reasonably read it as a general-purpose runner.
+ */
+export declare const runAllowlistedReadOnlyCommand: AllowlistedExecRunner;
+//# sourceMappingURL=allowlistedExec.d.ts.map

package/dist/shared/tooling/allowlistedExec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlistedExec.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/allowlistedExec.ts"],"names":[],"mappings":"AA8BA,yFAAyF;AACzF,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAgJlD,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAUvD,CAAC;AAkBH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAG/C,CAAC;AAEH,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQxD;AA8DD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CASjE;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,EAAE,qBAwCxC,CAAC"}

package/dist/shared/tooling/allowlistedExec.js

@@ -0,0 +1,340 @@
+/**
+ * Allowlisted read-only command runner + a DEFAULT-DENY per-executable flag
+ * allowlist — single source for both orchestrators (drift-plan E2; CRIT
+ * ARC-a06a3945).
+ *
+ * The auditor's executable-anchor pass (S7 tier-2) runs *model-authored* commands
+ * at ingest to confirm/refute behavior claims. That is a trust surface: the tool
+ * spawns whatever the model wrote. The earlier guard checked only `command[0]`
+ * (the executable) against an allowlist and waved every argument through, so
+ * `rg --pre <cmd>` (preprocessor exec), `rg --search-zip`, `ast-grep --rewrite`
+ * (file write), a non-read-only `git` option, etc. slipped past — arbitrary
+ * code-exec / file-writes at ingest.
+ *
+ * This module replaces that denylist posture with a **default-deny allowlist of
+ * arguments**: each allowed executable declares the exact set of flags it may
+ * carry; ANY flag not on that set refuses the whole command. New dangerous flags
+ * are therefore refused by construction (they are simply absent from the set),
+ * not by remembering to denylist them. Positionals (search patterns / file
+ * paths) are allowed — they name what to inspect, not code to run — with one
+ * exception: `git`, whose first positional must be a read-only subcommand.
+ *
+ * SAFETY of the runner: commands run only via `runAllowlistedReadOnlyCommand`,
+ * which spawns argv-only (never a shell), under a timeout, with the
+ * host-signalling env stripped (`stripClaudeCodeEnv`), platform-resolved via the
+ * shared `resolveExecArgv`, and SIGTERM→SIGKILL on timeout. The caller still
+ * gates each command through `isAllowedAnchorCommand` before running it.
+ */
+import { spawn } from "node:child_process";
+import { resolveExecArgv, stripClaudeCodeEnv } from "./exec.js";
+/** Default per-anchor wall-clock budget; a slower command is killed and inconclusive. */
+export const ALLOWLISTED_EXEC_TIMEOUT_MS = 60_000;
+/** Grace before a timed-out child is escalated from SIGTERM to SIGKILL. */
+const SIGKILL_GRACE_MS = 2_000;
+/** Cap on captured combined output so a runaway command cannot exhaust memory. */
+const MAX_CAPTURED_OUTPUT = 256 * 1024;
+/**
+ * The inspection-only executables a model-authored anchor may invoke, each with
+ * the explicit set of flags it may carry. Every listed flag is read-only: it
+ * cannot write a file, execute a sub-process/preprocessor, or decompress
+ * arbitrary input. Deliberately ABSENT (so default-deny refuses them):
+ *   - ripgrep:  --pre / --pre-glob (run a preprocessor), --search-zip / -z
+ *               (decompress), --hostname-bin, -o is fine (only-matching) but
+ *               --files-from style file reads are omitted out of caution.
+ *   - ast-grep: --rewrite / -r, --update-all / -U, --interactive / -i (edit),
+ *               --json's safe so it stays; `run`/`scan` subcommands are positional.
+ *   - grep:     --output is not a real grep flag; -f (pattern file) omitted.
+ *   - madge:    --image / -i, --dot, --svg (write output files).
+ *   - git:      handled separately — only read-only subcommands, and
+ *               --output/-o (writes a file) is refused.
+ */
+const ARG_POLICIES = new Map([
+    [
+        "grep",
+        {
+            // Read-only search/format switches only.
+            flags: new Set([
+                "-r", "-R", "--recursive", "-n", "--line-number", "-i",
+                "--ignore-case", "-l", "--files-with-matches", "-L",
+                "--files-without-match", "-c", "--count", "-o", "--only-matching",
+                "-e", "--regexp", "-E", "--extended-regexp", "-F", "--fixed-strings",
+                "-w", "--word-regexp", "-x", "--line-regexp", "-v", "--invert-match",
+                "-H", "--with-filename", "-h", "--no-filename", "-s", "--no-messages",
+                "--include", "--exclude", "--exclude-dir", "-A", "--after-context",
+                "-B", "--before-context", "-C", "--context", "--color", "--colour",
+                "-a", "--text", "-I",
+            ]),
+            allowPositionals: true,
+        },
+    ],
+    [
+        "rg",
+        {
+            flags: new Set([
+                "-i", "--ignore-case", "-S", "--smart-case", "-s", "--case-sensitive",
+                "-n", "--line-number", "-N", "--no-line-number", "-l",
+                "--files-with-matches", "--files-without-match", "-c", "--count",
+                "--count-matches", "-o", "--only-matching", "-w", "--word-regexp",
+                "-x", "--line-regexp", "-v", "--invert-match", "-F", "--fixed-strings",
+                "-e", "--regexp", "-A", "--after-context", "-B", "--before-context",
+                "-C", "--context", "-g", "--glob", "-t", "--type", "-T", "--type-not",
+                "--hidden", "--no-ignore", "--color", "--colors", "-H", "--with-filename",
+                "--no-filename", "--no-heading", "--heading", "-U", "--multiline",
+                "--multiline-dotall", "-P", "--pcre2", "--json", "--vimgrep", "-0",
+                "--null", "-m", "--max-count", "--max-depth", "--maxdepth",
+            ]),
+            allowPositionals: true,
+        },
+    ],
+    [
+        "ripgrep",
+        {
+            // alias spelling of rg — same read-only switch set.
+            flags: new Set([
+                "-i", "--ignore-case", "-S", "--smart-case", "-s", "--case-sensitive",
+                "-n", "--line-number", "-N", "--no-line-number", "-l",
+                "--files-with-matches", "--files-without-match", "-c", "--count",
+                "--count-matches", "-o", "--only-matching", "-w", "--word-regexp",
+                "-x", "--line-regexp", "-v", "--invert-match", "-F", "--fixed-strings",
+                "-e", "--regexp", "-A", "--after-context", "-B", "--before-context",
+                "-C", "--context", "-g", "--glob", "-t", "--type", "-T", "--type-not",
+                "--hidden", "--no-ignore", "--color", "--colors", "-H", "--with-filename",
+                "--no-filename", "--no-heading", "--heading", "-U", "--multiline",
+                "--multiline-dotall", "-P", "--pcre2", "--json", "--vimgrep", "-0",
+                "--null", "-m", "--max-count", "--max-depth", "--maxdepth",
+            ]),
+            allowPositionals: true,
+        },
+    ],
+    [
+        "findstr",
+        {
+            // Windows search tool: all switches are `/x`; no flag refuses, positionals
+            // (pattern + path) allowed. /s recursive, /i ignore-case, etc. are read-only.
+            flags: new Set(),
+            allowPositionals: true,
+            windowsSlashFlags: true,
+        },
+    ],
+    [
+        "madge",
+        {
+            // Read-only dependency analysis: circular detection, orphans, JSON. The
+            // image/dot/svg output-writing flags are absent → refused.
+            flags: new Set([
+                "--circular", "-c", "--orphans", "--leaves", "--summary", "-s",
+                "--json", "--warning", "--no-color", "--extensions", "--exclude",
+                "--include-npm", "--depends", "--ts-config", "--webpack-config",
+            ]),
+            allowPositionals: true,
+        },
+    ],
+    [
+        "ast-grep",
+        {
+            // Structural search only. --rewrite/-r/--update-all/-U/--interactive/-i
+            // (all of which edit files) are absent → refused. `run`/`scan` are positional.
+            flags: new Set([
+                "-p", "--pattern", "-l", "--lang", "--language", "--json", "--globs",
+                "-A", "--after", "-B", "--before", "-C", "--context", "--heading",
+                "--color", "--no-color", "-h", "--help",
+            ]),
+            allowPositionals: true,
+        },
+    ],
+    [
+        "sg",
+        {
+            // alias spelling of ast-grep — same read-only flag set.
+            flags: new Set([
+                "-p", "--pattern", "-l", "--lang", "--language", "--json", "--globs",
+                "-A", "--after", "-B", "--before", "-C", "--context", "--heading",
+                "--color", "--no-color", "-h", "--help",
+            ]),
+            allowPositionals: true,
+        },
+    ],
+]);
+/** Read-only git subcommands an anchor may run (no checkout/reset/clean/push/…). */
+export const GIT_READONLY_SUBCOMMANDS = new Set([
+    "grep",
+    "log",
+    "diff",
+    "show",
+    "ls-files",
+    "cat-file",
+    "blame",
+    "rev-parse",
+    "status",
+]);
+/**
+ * git flags that write a file or otherwise escape read-only inspection, refused
+ * even on a read-only subcommand. `-o`/`--output` write to a file; `-c`,
+ * `--exec-path`, `--config-env` reconfigure git arbitrarily (incl. running
+ * pagers/externals). Anything in this set, anywhere in the argv, refuses.
+ */
+const GIT_REFUSED_OPTIONS = new Set([
+    "-o",
+    "--output",
+    "-c",
+    "--exec-path",
+    "--config-env",
+    "--upload-pack",
+    "--receive-pack",
+]);
+/**
+ * The set of executables the runner will auto-run, for callers that want to
+ * display the allowlist. Derived from the per-executable policies plus git.
+ */
+export const ANCHOR_ALLOWLIST = new Set([
+    ...ARG_POLICIES.keys(),
+    "git",
+]);
+/** Bare executable name: strip any directory and a Windows .cmd/.bat/.exe suffix. */
+export function executableBaseName(token) {
+    return token
+        .trim()
+        .replace(/\\/g, "/")
+        .split("/")
+        .pop()
+        .replace(/\.(cmd|bat|exe)$/i, "")
+        .toLowerCase();
+}
+/** A token is a flag when it begins with `-` (POSIX) or, for findstr, `/`. */
+function isFlagToken(token, windowsSlashFlags) {
+    if (token.startsWith("-"))
+        return true;
+    if (windowsSlashFlags && token.startsWith("/"))
+        return true;
+    return false;
+}
+/**
+ * The flag name of a token, dropping any `=value`. A clustered short flag with
+ * an attached value (e.g. ripgrep `-tjs`) is intentionally NOT decomposed: under
+ * default-deny it simply won't match the allow set and the command is refused
+ * (skipped, falling back to tier-1) rather than parsed heuristically — the
+ * canonical separated form (`-t js`) is allowed, so this loses no real coverage
+ * while keeping the matcher unambiguous.
+ */
+function flagName(token) {
+    const eq = token.indexOf("=");
+    return eq === -1 ? token : token.slice(0, eq);
+}
+/**
+ * Validate a non-git command against its per-executable argument policy. Every
+ * flag must be on the policy's allow set (default-deny); positionals are allowed
+ * unless the policy forbids them. Returns true only when EVERY token is allowed.
+ */
+function isAllowedNonGitCommand(base, args, policy) {
+    const windowsSlash = policy.windowsSlashFlags === true;
+    for (const arg of args) {
+        if (typeof arg !== "string")
+            return false;
+        if (isFlagToken(arg, windowsSlash)) {
+            // A Windows `/x` switch on findstr is always read-only — accept the family
+            // without enumerating every switch.
+            if (windowsSlash && arg.startsWith("/"))
+                continue;
+            if (!policy.flags.has(flagName(arg)))
+                return false;
+        }
+        else if (!policy.allowPositionals) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Validate a git command: the first positional must be a read-only subcommand,
+ * and no token (before OR after the subcommand) may be a write/reconfigure
+ * option from {@link GIT_REFUSED_OPTIONS}. A `-c key=val` style reconfiguration
+ * before the subcommand is refused, as is an `--output=file` on `git log`.
+ */
+function isAllowedGitCommand(args) {
+    let subcommand;
+    for (const arg of args) {
+        if (typeof arg !== "string")
+            return false;
+        if (GIT_REFUSED_OPTIONS.has(flagName(arg)))
+            return false;
+        if (subcommand === undefined && !arg.startsWith("-")) {
+            subcommand = arg.trim().toLowerCase();
+        }
+    }
+    if (subcommand === undefined)
+        return false;
+    return GIT_READONLY_SUBCOMMANDS.has(subcommand);
+}
+/**
+ * The single authority for what the tool will auto-run on the model's behalf:
+ * `command[0]` must be an allowlisted inspection-only executable, AND every
+ * argument must satisfy that executable's default-deny argument policy (git:
+ * read-only subcommand + no write/reconfigure option). Anything else → false.
+ *
+ * CRIT ARC-a06a3945: argument validation is the point — an allowed executable
+ * carrying a code-exec/file-write flag (`rg --pre`, `ast-grep --rewrite`,
+ * `git log -o file`, …) is REFUSED, not run.
+ */
+export function isAllowedAnchorCommand(command) {
+    const exe = command[0];
+    if (typeof exe !== "string" || exe.trim() === "")
+        return false;
+    const base = executableBaseName(exe);
+    const args = command.slice(1);
+    if (base === "git")
+        return isAllowedGitCommand(args);
+    const policy = ARG_POLICIES.get(base);
+    if (!policy)
+        return false;
+    return isAllowedNonGitCommand(base, args, policy);
+}
+/**
+ * Spawn an allowlisted read-only command argv-only (never a shell), capturing
+ * combined stdout+stderr (bounded). Strips the host-signalling env
+ * (`stripClaudeCodeEnv`), resolves the platform-correct argv via the shared
+ * `resolveExecArgv`, and kills a command that exceeds `timeoutMs`
+ * (SIGTERM→SIGKILL). The single runner both orchestrators use for the grounding
+ * anchor pass.
+ *
+ * NOTE: this does NOT re-check the allowlist — callers MUST gate the command
+ * through {@link isAllowedAnchorCommand} first. It is named/scoped so a future
+ * caller cannot reasonably read it as a general-purpose runner.
+ */
+export const runAllowlistedReadOnlyCommand = (command, cwd, timeoutMs) => new Promise((resolvePromise) => {
+    const [resolvedCommand, ...resolvedArgs] = resolveExecArgv(command);
+    const child = spawn(resolvedCommand, resolvedArgs, {
+        cwd,
+        env: stripClaudeCodeEnv(),
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+    });
+    let output = "";
+    const capture = (chunk) => {
+        if (output.length < MAX_CAPTURED_OUTPUT)
+            output += String(chunk);
+    };
+    child.stdout?.on("data", capture);
+    child.stderr?.on("data", capture);
+    let timedOut = false;
+    const timer = setTimeout(() => {
+        timedOut = true;
+        child.kill("SIGTERM");
+        const hardKill = setTimeout(() => child.kill("SIGKILL"), SIGKILL_GRACE_MS);
+        hardKill.unref?.();
+    }, timeoutMs);
+    timer.unref?.();
+    child.on("error", (error) => {
+        clearTimeout(timer);
+        resolvePromise({
+            exit_code: null,
+            timed_out: timedOut,
+            spawn_error: error.message,
+            output,
+        });
+    });
+    child.on("close", (code) => {
+        clearTimeout(timer);
+        resolvePromise({ exit_code: code, timed_out: timedOut, output });
+    });
+});
+//# sourceMappingURL=allowlistedExec.js.map

package/dist/shared/tooling/allowlistedExec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlistedExec.js","sourceRoot":"","sources":["../../../src/shared/tooling/allowlistedExec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEhE,yFAAyF;AACzF,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,kFAAkF;AAClF,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAC;AAevC;;;;;;;;;;;;;;GAcG;AACH,MAAM,YAAY,GAAmC,IAAI,GAAG,CAAoB;IAC9E;QACE,MAAM;QACN;YACE,yCAAyC;YACzC,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI;gBACtD,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI;gBACnD,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB;gBACjE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,iBAAiB;gBACpE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB;gBACpE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe;gBACrE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB;gBAClE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU;gBAClE,IAAI,EAAE,QAAQ,EAAE,IAAI;aACrB,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,IAAI;QACJ;YACE,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB;gBACrE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI;gBACrD,sBAAsB,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS;gBAChE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe;gBACjE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB;gBACtE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB;gBACnE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY;gBACrE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB;gBACzE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa;gBACjE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI;gBAClE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY;aAC3D,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,SAAS;QACT;YACE,oDAAoD;YACpD,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB;gBACrE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI;gBACrD,sBAAsB,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS;gBAChE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe;gBACjE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB;gBACtE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB;gBACnE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY;gBACrE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB;gBACzE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa;gBACjE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI;gBAClE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY;aAC3D,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,SAAS;QACT;YACE,2EAA2E;YAC3E,8EAA8E;YAC9E,KAAK,EAAE,IAAI,GAAG,EAAE;YAChB,gBAAgB,EAAE,IAAI;YACtB,iBAAiB,EAAE,IAAI;SACxB;KACF;IACD;QACE,OAAO;QACP;YACE,wEAAwE;YACxE,2DAA2D;YAC3D,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI;gBAC9D,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW;gBAChE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB;aAChE,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,UAAU;QACV;YACE,wEAAwE;YACxE,+EAA+E;YAC/E,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS;gBACpE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW;gBACjE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ;aACxC,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;IACD;QACE,IAAI;QACJ;YACE,wDAAwD;YACxD,KAAK,EAAE,IAAI,GAAG,CAAC;gBACb,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS;gBACpE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW;gBACjE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ;aACxC,CAAC;YACF,gBAAgB,EAAE,IAAI;SACvB;KACF;CACF,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IACnE,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,UAAU;IACV,UAAU;IACV,OAAO;IACP,WAAW;IACX,QAAQ;CACT,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IACvD,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,aAAa;IACb,cAAc;IACd,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,GAAG,YAAY,CAAC,IAAI,EAAE;IACtB,KAAK;CACN,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,KAAK;SACT,IAAI,EAAE;SACN,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,EAAG;SACN,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;SAChC,WAAW,EAAE,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW,CAAC,KAAa,EAAE,iBAA0B;IAC5D,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,iBAAiB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,IAAc,EAAE,MAAiB;IAC7E,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YACnC,2EAA2E;YAC3E,oCAAoC;YACpC,IAAI,YAAY,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QACrD,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAc;IACzC,IAAI,UAA8B,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiB;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,sBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAiBD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA0B,CAClE,OAAO,EACP,GAAG,EACH,SAAS,EACT,EAAE,CACF,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;IAC7B,MAAM,CAAC,eAAe,EAAE,GAAG,YAAY,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,EAAE,YAAY,EAAE;QACjD,GAAG;QACH,GAAG,EAAE,kBAAkB,EAAE;QACzB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE;QACjC,IAAI,MAAM,CAAC,MAAM,GAAG,mBAAmB;YAAE,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC3E,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IACrB,CAAC,EAAE,SAAS,CAAC,CAAC;IACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,cAAc,CAAC;YACb,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,QAAQ;YACnB,WAAW,EAAE,KAAK,CAAC,OAAO;YAC1B,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QACzB,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/shared/tooling/analyzerDeps.d.ts

@@ -0,0 +1,65 @@
+import { type RunTrackedResult } from "./exec.js";
+export type AnalyzerDepVia = "repo" | "cache" | "absent";
+export interface ResolvedAnalyzerDep {
+    via: AnalyzerDepVia;
+    /** Absolute path to the resolved package directory (when via != "absent"). */
+    path?: string;
+}
+export interface ResolveAnalyzerDepOptions {
+    /** Override the cache root; defaults to ~/.audit-tools/analyzer-cache. */
+    cacheRoot?: string;
+    /**
+     * Injectable logger for observability output. Defaults to `console.error`
+     * so existing behaviour is preserved when callers do not supply one.
+     * Inject a no-op or custom logger in tests/contexts that need to redirect or
+     * suppress output.
+     *
+     * Signature matches `console.error` so callers can pass it directly:
+     * `log: console.error`.
+     */
+    log?: (...args: unknown[]) => void;
+}
+/**
+ * Shared analyzer cache root. Defaults to ~/.audit-tools/analyzer-cache; the
+ * `AUDIT_TOOLS_ANALYZER_CACHE` environment variable overrides it so a run can be
+ * pinned to an isolated cache (e.g. tests that need dependency resolution to be
+ * deterministic regardless of what the host machine has previously cached).
+ */
+export declare function analyzerCacheRoot(): string;
+interface ParsedSpec {
+    name: string;
+    version?: string;
+}
+/** Parse "name", "name@version", or "@scope/name@version". */
+export declare function parseAnalyzerSpec(spec: string): ParsedSpec;
+/**
+ * Resolve an analyzer dependency: repo node_modules → version-keyed cache →
+ * absent. `pkg` may be a bare name or "name@version"; a version narrows the
+ * cache lookup, otherwise the newest cached version is chosen.
+ */
+export declare function resolveAnalyzerDep(pkg: string, repoRoot: string, options?: ResolveAnalyzerDepOptions): ResolvedAnalyzerDep;
+export interface InstallToCacheOptions {
+    cacheRoot?: string;
+    /** Injectable command runner; defaults to the shared runTracked. */
+    run?: (argv: string[], cwd: string) => RunTrackedResult;
+    /**
+     * Injectable logger for observability output. Defaults to `console.error`
+     * so existing behaviour is preserved when callers do not supply one.
+     * Inject a no-op or custom logger in tests/contexts that need to redirect or
+     * suppress output.
+     */
+    log?: (...args: unknown[]) => void;
+}
+export interface InstallToCacheResult {
+    ok: boolean;
+    path?: string;
+    error?: string;
+}
+/**
+ * Install `pkg@version` into the version-keyed shared cache and return the
+ * installed package directory. Requires an explicit version so the cache stays
+ * reproducible. Never writes into any audited project.
+ */
+export declare function installToCache(pkgAtVersion: string, options?: InstallToCacheOptions): InstallToCacheResult;
+export {};
+//# sourceMappingURL=analyzerDeps.d.ts.map

package/dist/shared/tooling/analyzerDeps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzerDeps.d.ts","sourceRoot":"","sources":["../../../src/shared/tooling/analyzerDeps.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAS9D,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,cAAc,CAAC;IACpB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAI1C;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAO1D;AAiDD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,yBAA8B,GACtC,mBAAmB,CAmBrB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,gBAAgB,CAAC;IACxD;;;;;OAKG;IACH,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CAwDtB"}