autoremediator 0.21.2 → 0.22.0

package/dist/api/prove/sandbox.js

@@ -0,0 +1,269 @@
+/**
+ * Runs a script that came from a model as untrusted code.
+ *
+ * What is enforced, and by what:
+ *  - Node's permission model (`--permission`): no network (net, dns, http, udp), no child
+ *    processes, no worker threads, no native addons, no filesystem writes, and reads only inside
+ *    the one directory the script lives in. Self-tested by `verifySandbox`, never assumed.
+ *  - An empty environment: no variable of the parent is passed on, so no token or secret is there
+ *    to read.
+ *  - A preload that refuses `process.kill` for any pid but the process's own. The permission model
+ *    does not cover signals, and without this a script could kill the caller or, with `-1`, every
+ *    process of the user.
+ *  - A wall-clock timeout, an output cap and a heap cap. The process runs in its own process group,
+ *    and the group is killed when it times out, floods its output or ends.
+ *
+ * What is NOT enforced: CPU time (only wall-clock), memory outside the V8 heap (large buffers),
+ * and anything an exploit of Node itself would allow. Node documents the permission model as a
+ * guard against mistakes and misbehaving code, not as a boundary against a determined attacker.
+ * Where those limits matter, run the whole tool in a container.
+ */
+import { spawn } from "node:child_process";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/**
+ * Variables macOS adds to every process whatever it is started with. It holds the user id and a
+ * text encoding, nothing secret; it is allowed in the self-test and never passed on by us.
+ */
+export const PLATFORM_INJECTED_ENV = new Set(["__CF_USER_TEXT_ENCODING"]);
+/** The only environment a sandboxed script sees. */
+export const SANDBOX_ENV = {
+    NODE_ENV: "test",
+    TZ: "UTC",
+    LANG: "C.UTF-8",
+};
+const PRELOAD_NAME = ".proof-sandbox-preload.cjs";
+const PRELOAD = `"use strict";
+const self = process.pid;
+const refuse = () => {
+  const error = new Error("signalling other processes is not permitted in the proof sandbox");
+  error.code = "ERR_ACCESS_DENIED";
+  throw error;
+};
+const guarded = (original) =>
+  function (pid, signal) {
+    if (pid !== self) refuse();
+    return original.call(process, pid, signal);
+  };
+const lock = (name, value) =>
+  Object.defineProperty(process, name, { value, writable: false, configurable: false });
+lock("kill", guarded(process.kill));
+if (typeof process._kill === "function") lock("_kill", guarded(process._kill));
+`;
+export class SandboxUnavailableError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "SandboxUnavailableError";
+    }
+}
+/** Run `script` under the permission model. Resolves with what happened; rejects only if it cannot start. */
+export function runSandboxed(options) {
+    if (process.platform === "win32") {
+        return Promise.reject(new SandboxUnavailableError("The proof sandbox needs process groups and is not available on Windows."));
+    }
+    const { script, timeoutMs, maxOutputBytes, maxHeapMb = 256 } = options;
+    const dir = realpathSync(options.dir);
+    writeFileSync(join(dir, PRELOAD_NAME), PRELOAD, "utf8");
+    return new Promise((resolve, reject) => {
+        const started = Date.now();
+        const child = spawn(process.execPath, [
+            "--permission",
+            `--allow-fs-read=${dir}`,
+            `--max-old-space-size=${maxHeapMb}`,
+            "--require",
+            join(dir, PRELOAD_NAME),
+            join(dir, script),
+        ], {
+            cwd: dir,
+            env: { ...SANDBOX_ENV },
+            stdio: ["ignore", "pipe", "pipe"],
+            detached: true,
+        });
+        const stdout = [];
+        const stderr = [];
+        let total = 0;
+        let timedOut = false;
+        let outputLimitExceeded = false;
+        const killGroup = () => {
+            if (child.pid === undefined)
+                return;
+            try {
+                process.kill(-child.pid, "SIGKILL");
+            }
+            catch {
+                // The group is already gone.
+            }
+        };
+        const collect = (sink) => (chunk) => {
+            if (outputLimitExceeded)
+                return;
+            const room = maxOutputBytes - total;
+            if (chunk.length > room) {
+                if (room > 0)
+                    sink.push(chunk.subarray(0, room));
+                total = maxOutputBytes;
+                outputLimitExceeded = true;
+                killGroup();
+                return;
+            }
+            sink.push(chunk);
+            total += chunk.length;
+        };
+        child.stdout.on("data", collect(stdout));
+        child.stderr.on("data", collect(stderr));
+        const timer = setTimeout(() => {
+            timedOut = true;
+            killGroup();
+        }, timeoutMs);
+        child.once("error", (error) => {
+            clearTimeout(timer);
+            killGroup();
+            reject(new SandboxUnavailableError("Could not start the sandboxed process.", { cause: error }));
+        });
+        child.once("close", (exitCode, signal) => {
+            clearTimeout(timer);
+            killGroup();
+            resolve({
+                exitCode,
+                signal,
+                timedOut,
+                outputLimitExceeded,
+                durationMs: Date.now() - started,
+                stdout: Buffer.concat(stdout).toString("utf8"),
+                stderr: Buffer.concat(stderr).toString("utf8"),
+            });
+        });
+    });
+}
+export const NOT_LIMITED = [
+    "CPU time (only the wall-clock timeout bounds it)",
+    "memory outside the V8 heap, such as large buffers",
+    "a flaw in Node.js itself (the permission model is a guard against misbehaving code, not a boundary against a determined attacker)",
+];
+const PROBE = `"use strict";
+const fs = require("node:fs");
+const path = require("node:path");
+const out = {};
+const attempt = async (name, fn) => {
+  try {
+    await fn();
+    out[name] = "allowed";
+  } catch (error) {
+    const code = error && (error.code || (error.cause && error.cause.code));
+    out[name] = code === "ERR_ACCESS_DENIED" ? "denied" : "failed: " + (code || (error && error.message));
+  }
+};
+(async () => {
+  const [outsideFile, serverPort] = process.argv.slice(2);
+  await attempt("read-outside-dir", () => fs.readFileSync(outsideFile, "utf8"));
+  await attempt("read-system-file", () => fs.readFileSync("/etc/hosts", "utf8"));
+  await attempt("list-parent-dir", () => fs.readdirSync(path.dirname(__dirname)));
+  await attempt("write-inside-dir", () => fs.writeFileSync(path.join(__dirname, "w.txt"), "x"));
+  await attempt("write-outside-dir", () => fs.writeFileSync(outsideFile + ".w", "x"));
+  await attempt("network-connect", () => new Promise((resolve, reject) => {
+    const socket = require("node:net").connect(Number(serverPort), "127.0.0.1");
+    socket.on("connect", () => { socket.destroy(); resolve(); });
+    socket.on("error", reject);
+  }));
+  await attempt("network-fetch", () => fetch("http://127.0.0.1:" + serverPort + "/"));
+  await attempt("dns-lookup", () => require("node:dns").promises.lookup("example.com"));
+  await attempt("child-process", () => require("node:child_process").execSync("echo x"));
+  await attempt("worker-thread", () => new (require("node:worker_threads").Worker)("1", { eval: true }));
+  await attempt("signal-other-process", () => process.kill(process.ppid, 0));
+  await attempt("signal-all-processes", () => process.kill(-1, 0));
+  out.envNames = Object.keys(process.env).sort();
+  console.log(JSON.stringify(out));
+})();
+`;
+const REQUIRED_DENIED = [
+    "read-outside-dir",
+    "read-system-file",
+    "list-parent-dir",
+    "write-inside-dir",
+    "write-outside-dir",
+    "network-connect",
+    "network-fetch",
+    "dns-lookup",
+    "child-process",
+    "worker-thread",
+    "signal-other-process",
+    "signal-all-processes",
+];
+async function probeOnce() {
+    const root = realpathSync(mkdtempSync(join(tmpdir(), "autoremediator-sandbox-probe-")));
+    const inside = join(root, "inside");
+    mkdirSync(inside);
+    const outsideFile = join(root, "outside.txt");
+    writeFileSync(outsideFile, "secret", "utf8");
+    writeFileSync(join(inside, "probe.cjs"), PROBE, "utf8");
+    // A real listener: if the sandbox lets the probe connect, the server sees it.
+    let connections = 0;
+    const server = createServer((socket) => {
+        connections += 1;
+        socket.destroy();
+    });
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(0, "127.0.0.1", resolve);
+        });
+        const address = server.address();
+        const port = typeof address === "object" && address ? address.port : 0;
+        // The probe's own arguments go after the script, so it is run with the same flags as a trial.
+        const result = await runProbe(inside, [outsideFile, String(port)]);
+        let parsed;
+        try {
+            parsed = JSON.parse(result.stdout.trim().split("\n").at(-1) ?? "");
+        }
+        catch (cause) {
+            throw new SandboxUnavailableError(`The sandbox self-test did not run (exit ${String(result.exitCode)}). ${result.stderr.trim().split("\n")[0] ?? ""}`.trim(), { cause });
+        }
+        const notDenied = REQUIRED_DENIED.filter((name) => parsed[name] !== "denied");
+        const env = parsed["envNames"];
+        if (notDenied.length > 0 || connections > 0 || !Array.isArray(env)) {
+            throw new SandboxUnavailableError(`This Node.js (${process.version}) does not enforce the proof sandbox: ${[
+                ...notDenied.map((name) => `${name} was ${String(parsed[name])}`),
+                ...(connections > 0 ? ["a network connection was accepted"] : []),
+            ].join("; ") || "unexpected self-test output"}. Proof-of-fix generation needs Node.js 26 or newer with the permission model.`);
+        }
+        const unexpectedEnv = env.filter((name) => !(name in SANDBOX_ENV) && !PLATFORM_INJECTED_ENV.has(name));
+        if (unexpectedEnv.length > 0) {
+            throw new SandboxUnavailableError(`The sandbox leaked environment variables into the script: ${unexpectedEnv.join(", ")}`);
+        }
+        return {
+            node: process.version,
+            platform: `${process.platform}-${process.arch}`,
+            denied: REQUIRED_DENIED,
+            notLimited: NOT_LIMITED,
+        };
+    }
+    finally {
+        server.close();
+        rmSync(root, { recursive: true, force: true });
+    }
+}
+async function runProbe(dir, args) {
+    // `runSandboxed` runs `script` with no arguments; the probe needs two, so it gets them by file.
+    writeFileSync(join(dir, "run-probe.cjs"), `process.argv.push(...${JSON.stringify(args)});\nrequire("./probe.cjs");\n`, "utf8");
+    return runSandboxed({
+        dir,
+        script: "run-probe.cjs",
+        timeoutMs: 15_000,
+        maxOutputBytes: 64 * 1024,
+    });
+}
+let verified;
+/**
+ * Prove, on this machine and this Node.js, that the sandbox refuses what it claims to refuse, by
+ * trying each thing from inside it. Throws `SandboxUnavailableError` when it does not. Cached.
+ */
+export function verifySandbox() {
+    verified ??= probeOnce().catch((error) => {
+        verified = undefined;
+        throw error;
+    });
+    return verified;
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/api/prove/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../src/api/prove/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAE/F,oDAAoD;AACpD,MAAM,CAAC,MAAM,WAAW,GAAqC;IAC3D,QAAQ,EAAE,MAAM;IAChB,EAAE,EAAE,KAAK;IACT,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAElD,MAAM,OAAO,GAAG;;;;;;;;;;;;;;;;CAgBf,CAAC;AAwBF,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe,EAAE,OAAsB;QACjD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,6GAA6G;AAC7G,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,uBAAuB,CACzB,yEAAyE,CAC1E,CACF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC;IACvE,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAExD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,KAAK,CACjB,OAAO,CAAC,QAAQ,EAChB;YACE,cAAc;YACd,mBAAmB,GAAG,EAAE;YACxB,wBAAwB,SAAS,EAAE;YACnC,WAAW;YACX,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC;YACvB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;SAClB,EACD;YACE,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,EAAE,GAAG,WAAW,EAAE;YACvB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,QAAQ,EAAE,IAAI;SACf,CACF,CAAC;QAEF,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAEhC,MAAM,SAAS,GAAG,GAAS,EAAE;YAC3B,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;gBAAE,OAAO;YACpC,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,6BAA6B;YAC/B,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,CAAC,KAAa,EAAE,EAAE;YACpD,IAAI,mBAAmB;gBAAE,OAAO;YAChC,MAAM,IAAI,GAAG,cAAc,GAAG,KAAK,CAAC;YACpC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBACxB,IAAI,IAAI,GAAG,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACjD,KAAK,GAAG,cAAc,CAAC;gBACvB,mBAAmB,GAAG,IAAI,CAAC;gBAC3B,SAAS,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACxB,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAEzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS,EAAE,CAAC;QACd,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS,EAAE,CAAC;YACZ,MAAM,CACJ,IAAI,uBAAuB,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CACxF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YACvC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC;gBACN,QAAQ;gBACR,MAAM;gBACN,QAAQ;gBACR,mBAAmB;gBACnB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC/C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAYD,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,kDAAkD;IAClD,mDAAmD;IACnD,mIAAmI;CACpI,CAAC;AAEF,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCb,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,iBAAiB;IACjB,eAAe;IACf,YAAY;IACZ,eAAe;IACf,eAAe;IACf,sBAAsB;IACtB,sBAAsB;CACvB,CAAC;AAEF,KAAK,UAAU,SAAS;IACtB,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC9C,aAAa,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAExD,8EAA8E;IAC9E,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,WAAW,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvE,8FAA8F;QAC9F,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,2CAA2C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAC1H,EAAE,KAAK,EAAE,CACV,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,OAAO,CAAC,OAAO,yCAC9B;gBACE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,6BAClB,gFAAgF,CACjF,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAI,GAAgB,CAAC,MAAM,CAC5C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CACrE,CAAC;QACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,uBAAuB,CAC/B,6DAA6D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,OAAO;YACrB,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;YAC/C,MAAM,EAAE,eAAe;YACvB,UAAU,EAAE,WAAW;SACxB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,IAAc;IACjD,gGAAgG;IAChG,aAAa,CACX,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAC1B,wBAAwB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+BAA+B,EAC3E,MAAM,CACP,CAAC;IACF,OAAO,YAAY,CAAC;QAClB,GAAG;QACH,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,EAAE,GAAG,IAAI;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,IAAI,QAA4C,CAAC;AAEjD;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,QAAQ,KAAK,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAChD,QAAQ,GAAG,SAAS,CAAC;QACrB,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/api/prove/screen.d.ts

@@ -0,0 +1,17 @@
+export declare const MAX_SCRIPT_CHARS = 20000;
+/** Modules a reproduction may load, besides the package under test. */
+export declare const ALLOWED_BUILTINS: ReadonlySet<string>;
+export interface ScreenResult {
+    ok: boolean;
+    violations: string[];
+}
+/**
+ * Read a script's syntax tree and refuse what a reproduction has no business doing. Everything is an
+ * allowlist: only literal module names, only a few `process` members, no evaluation, no globals.
+ * A computed name or an indirect route is refused rather than analysed.
+ */
+export declare function screenScript(script: string, context: {
+    packageName: string;
+    versions: readonly string[];
+}): ScreenResult;
+//# sourceMappingURL=screen.d.ts.map

package/dist/api/prove/screen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen.d.ts","sourceRoot":"","sources":["../../../src/api/prove/screen.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAEvC,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAe/C,CAAC;AAEH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAyLD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC5D,YAAY,CAqDd"}

package/dist/api/prove/screen.js

@@ -0,0 +1,256 @@
+/**
+ * A cheap read of a reproduction script before it runs, and the reason a kept script can be
+ * reviewed in seconds.
+ *
+ * This is a tripwire and a style rule, not a security boundary: it is bypassable by anyone who
+ * writes code to bypass it. The boundary is the sandbox (`sandbox.ts`) the script runs in. The
+ * screen exists because a kept script is committed to `patches/` and later run by the existing
+ * proof-of-fix check in the project, outside that sandbox, so a script that has no business
+ * touching the network, processes or the environment should be refused rather than kept.
+ *
+ * It also refuses the shortcuts a model takes when it is rewarded for "fails before, passes after":
+ * looking at the package version, and reading the package's own files, instead of calling its API.
+ */
+import { parseSync } from "oxc-parser";
+export const MAX_SCRIPT_CHARS = 20_000;
+/** Modules a reproduction may load, besides the package under test. */
+export const ALLOWED_BUILTINS = new Set([
+    "assert",
+    "assert/strict",
+    "buffer",
+    "crypto",
+    "events",
+    "fs",
+    "path",
+    "querystring",
+    "stream",
+    "string_decoder",
+    "timers",
+    "url",
+    "util",
+    "zlib",
+]);
+/** `process` members a reproduction may use: finishing, and writing its verdict. Nothing that reads the environment. */
+const ALLOWED_PROCESS_MEMBERS = new Set([
+    "exit",
+    "exitCode",
+    "stdout",
+    "stderr",
+    "nextTick",
+    "on",
+    "once",
+    "emitWarning",
+]);
+/** Identifiers that reach code evaluation, globals, the network or the module system. */
+const FORBIDDEN_IDENTIFIERS = {
+    eval: "evaluates code built from strings",
+    Function: "evaluates code built from strings",
+    globalThis: "reaches globals indirectly",
+    global: "reaches globals indirectly",
+    fetch: "uses the network",
+    XMLHttpRequest: "uses the network",
+    WebSocket: "uses the network",
+    EventSource: "uses the network",
+    Worker: "starts another thread",
+    module: "reaches the module system (module.*)",
+    exports: "reaches the module system (exports)",
+    __dirname: "looks at where it runs (the script must call the package, not its own location)",
+    __filename: "looks at where it runs (the script must call the package, not its own location)",
+    Reflect: "reaches objects indirectly",
+    Proxy: "wraps objects in ways that can hide behaviour",
+};
+/** Is `specifier` a module the script may load: a listed builtin, or the package under test? */
+function allowedSpecifier(specifier, packageName) {
+    const bare = specifier.startsWith("node:") ? specifier.slice(5) : specifier;
+    if (ALLOWED_BUILTINS.has(bare))
+        return true;
+    return specifier === packageName || specifier.startsWith(`${packageName}/`);
+}
+const isNode = (value) => typeof value === "object" && value !== null && typeof value.type === "string";
+/** The literal string a `require`/`import()` argument is, or undefined when it is computed. */
+function literalString(node) {
+    if (!isNode(node))
+        return undefined;
+    if (node.type === "Literal" && typeof node.value === "string")
+        return node.value;
+    if (node.type === "TemplateLiteral") {
+        const expressions = node.expressions;
+        const quasis = node.quasis;
+        if (expressions.length === 0 && quasis.length === 1)
+            return quasis[0]?.value?.cooked;
+    }
+    return undefined;
+}
+function visit(node, walk, parent) {
+    switch (node.type) {
+        case "Identifier": {
+            const name = node.name;
+            const why = FORBIDDEN_IDENTIFIERS[name];
+            if (why)
+                walk.violations.add(`${name}: ${why}`);
+            if (name === "require")
+                walk.violations.add("uses `require` other than by calling it with a literal module name");
+            if (name === "process")
+                walk.violations.add("uses `process` other than exit, exitCode, stdout, stderr or nextTick");
+            return;
+        }
+        case "MetaProperty": {
+            walk.violations.add("looks at where it runs (import.meta)");
+            return;
+        }
+        case "Literal": {
+            if (typeof node.value === "string") {
+                if (/\bpackage\.json\b/.test(node.value)) {
+                    walk.violations.add("reads the package manifest (the script must call the package, not look at its version)");
+                }
+                if (node.value === "version" || node.value === "versions") {
+                    walk.violations.add("reads a version (the script must call the package, not look at its version)");
+                }
+            }
+            return;
+        }
+        case "MemberExpression": {
+            const object = node.object;
+            const property = node.property;
+            const computed = node.computed === true;
+            if (!computed && isNode(property) && property.type === "Identifier") {
+                const name = property.name;
+                if (name === "version" || name === "versions") {
+                    walk.violations.add("reads a version (the script must call the package, not look at its version)");
+                }
+                if (name === "constructor")
+                    walk.violations.add("reaches the Function constructor through `.constructor`");
+            }
+            if (isNode(object) && object.type === "Identifier" && object.name === "process") {
+                if (computed ||
+                    !isNode(property) ||
+                    property.type !== "Identifier" ||
+                    !ALLOWED_PROCESS_MEMBERS.has(property.name)) {
+                    const used = !computed && isNode(property) && property.type === "Identifier"
+                        ? `process.${String(property.name)}`
+                        : "process[...]";
+                    walk.violations.add(`${used}: uses a process API the script has no need for (environment, signals, version, directory)`);
+                }
+                if (computed)
+                    visit(property, walk, node);
+                return;
+            }
+            visit(object, walk, node);
+            if (computed && isNode(property))
+                visit(property, walk, node);
+            return;
+        }
+        case "CallExpression": {
+            const callee = node.callee;
+            if (isNode(callee) && callee.type === "Identifier" && callee.name === "require") {
+                const args = node.arguments;
+                const specifier = literalString(args[0]);
+                if (specifier === undefined || args.length !== 1)
+                    walk.violations.add("loads a module by a computed name");
+                else
+                    walk.specifiers.push(specifier);
+                for (const arg of args)
+                    if (isNode(arg) && literalString(arg) === undefined)
+                        visit(arg, walk, node);
+                return;
+            }
+            break;
+        }
+        case "ImportExpression": {
+            const specifier = literalString(node.source);
+            if (specifier === undefined)
+                walk.violations.add("loads a module by a computed name");
+            else
+                walk.specifiers.push(specifier);
+            return;
+        }
+        case "ImportDeclaration":
+        case "ExportAllDeclaration":
+        case "ExportNamedDeclaration": {
+            const specifier = literalString(node.source);
+            if (specifier !== undefined)
+                walk.specifiers.push(specifier);
+            if (node.type === "ImportDeclaration")
+                return;
+            break;
+        }
+        case "Property":
+        case "MethodDefinition":
+        case "PropertyDefinition": {
+            // A plain key (`{ process: 1 }`, `a.process`) is a name, not a reference.
+            for (const [key, value] of Object.entries(node)) {
+                if (key === "key" && node.computed !== true)
+                    continue;
+                visitValue(value, walk, node);
+            }
+            return;
+        }
+        default: {
+            break;
+        }
+    }
+    for (const [key, value] of Object.entries(node)) {
+        if (key === "start" || key === "end" || key === "range" || key === "loc")
+            continue;
+        visitValue(value, walk, node);
+    }
+    void parent;
+}
+function visitValue(value, walk, parent) {
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            if (isNode(entry))
+                visit(entry, walk, parent);
+    }
+    else if (isNode(value)) {
+        visit(value, walk, parent);
+    }
+}
+/**
+ * Read a script's syntax tree and refuse what a reproduction has no business doing. Everything is an
+ * allowlist: only literal module names, only a few `process` members, no evaluation, no globals.
+ * A computed name or an indirect route is refused rather than analysed.
+ */
+export function screenScript(script, context) {
+    const violations = new Set();
+    if (script.trim() === "")
+        return { ok: false, violations: ["the script is empty"] };
+    if (script.length > MAX_SCRIPT_CHARS) {
+        violations.add(`the script is longer than ${MAX_SCRIPT_CHARS} characters`);
+    }
+    if (script.includes("\0"))
+        violations.add("the script contains a NUL byte");
+    if (violations.size > 0)
+        return { ok: false, violations: [...violations] };
+    let program;
+    try {
+        const result = parseSync("reproduction.mjs", script, { preserveParens: false });
+        if (result.errors.length > 0) {
+            return { ok: false, violations: ["the script does not parse as JavaScript"] };
+        }
+        program = result.program;
+    }
+    catch {
+        return { ok: false, violations: ["the script does not parse as JavaScript"] };
+    }
+    const walk = { specifiers: [], violations };
+    visit(program, walk);
+    for (const specifier of new Set(walk.specifiers)) {
+        if (/\bpackage\.json\b/.test(specifier)) {
+            violations.add("reads the package manifest (the script must call the package, not look at its version)");
+        }
+        if (!allowedSpecifier(specifier, context.packageName)) {
+            violations.add(`loads "${specifier}", which is not ${context.packageName} or one of: ${[...ALLOWED_BUILTINS].join(", ")}`);
+        }
+    }
+    if (!walk.specifiers.some((specifier) => specifier === context.packageName || specifier.startsWith(`${context.packageName}/`))) {
+        violations.add(`never loads ${context.packageName}; a reproduction must exercise the package through its public API`);
+    }
+    for (const version of context.versions) {
+        if (script.includes(version)) {
+            violations.add(`mentions the version ${version} (the script must behave differently because of the code, not because of a version it was told)`);
+        }
+    }
+    return { ok: violations.size === 0, violations: [...violations] };
+}
+//# sourceMappingURL=screen.js.map

package/dist/api/prove/screen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen.js","sourceRoot":"","sources":["../../../src/api/prove/screen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,QAAQ;IACR,eAAe;IACf,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,IAAI;IACJ,MAAM;IACN,aAAa;IACb,QAAQ;IACR,gBAAgB;IAChB,QAAQ;IACR,KAAK;IACL,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAOH,wHAAwH;AACxH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,MAAM;IACN,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,IAAI;IACJ,MAAM;IACN,aAAa;CACd,CAAC,CAAC;AAEH,yFAAyF;AACzF,MAAM,qBAAqB,GAAqC;IAC9D,IAAI,EAAE,mCAAmC;IACzC,QAAQ,EAAE,mCAAmC;IAC7C,UAAU,EAAE,4BAA4B;IACxC,MAAM,EAAE,4BAA4B;IACpC,KAAK,EAAE,kBAAkB;IACzB,cAAc,EAAE,kBAAkB;IAClC,SAAS,EAAE,kBAAkB;IAC7B,WAAW,EAAE,kBAAkB;IAC/B,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,sCAAsC;IAC9C,OAAO,EAAE,qCAAqC;IAC9C,SAAS,EAAE,iFAAiF;IAC5F,UAAU,EAAE,iFAAiF;IAC7F,OAAO,EAAE,4BAA4B;IACrC,KAAK,EAAE,+CAA+C;CACvD,CAAC;AAEF,gGAAgG;AAChG,SAAS,gBAAgB,CAAC,SAAiB,EAAE,WAAmB;IAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,CAAC;AAC9E,CAAC;AAGD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAiB,EAAE,CAC/C,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAQ,KAAc,CAAC,IAAI,KAAK,QAAQ,CAAC;AAE1F,+FAA+F;AAC/F,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACpC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACjF,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAwB,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgD,CAAC;QACrE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC;IACvF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD,SAAS,KAAK,CAAC,IAAU,EAAE,IAAU,EAAE,MAAa;IAClD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;YACjC,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,GAAG;gBAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;YAChD,IAAI,IAAI,KAAK,SAAS;gBACpB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;YAC5F,IAAI,IAAI,KAAK,SAAS;gBACpB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,KAAK,cAAc,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,KAAK,SAAS,EAAE,CAAC;YACf,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CACjB,wFAAwF,CACzF,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;oBAC1D,IAAI,CAAC,UAAU,CAAC,GAAG,CACjB,6EAA6E,CAC9E,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,kBAAkB,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;YACxC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAc,CAAC;gBACrC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CACjB,6EAA6E,CAC9E,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAI,KAAK,aAAa;oBACxB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChF,IACE,QAAQ;oBACR,CAAC,MAAM,CAAC,QAAQ,CAAC;oBACjB,QAAQ,CAAC,IAAI,KAAK,YAAY;oBAC9B,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAc,CAAC,EACrD,CAAC;oBACD,MAAM,IAAI,GACR,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY;wBAC7D,CAAC,CAAC,WAAW,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;wBACpC,CAAC,CAAC,cAAc,CAAC;oBACrB,IAAI,CAAC,UAAU,CAAC,GAAG,CACjB,GAAG,IAAI,4FAA4F,CACpG,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ;oBAAE,KAAK,CAAC,QAAgB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAc,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;gBAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,KAAK,gBAAgB,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAsB,CAAC;gBACzC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzC,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;;oBACtD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACrC,KAAK,MAAM,GAAG,IAAI,IAAI;oBACpB,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,SAAS;wBAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC9E,OAAO;YACT,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,kBAAkB,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,SAAS,KAAK,SAAS;gBAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;;gBACjF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,KAAK,mBAAmB,CAAC;QACzB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,wBAAwB,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,SAAS,KAAK,SAAS;gBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7D,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;gBAAE,OAAO;YAC9C,MAAM;QACR,CAAC;QACD,KAAK,UAAU,CAAC;QAChB,KAAK,kBAAkB,CAAC;QACxB,KAAK,oBAAoB,EAAE,CAAC;YAC1B,0EAA0E;YAC1E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,GAAG,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;oBAAE,SAAS;gBACtD,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC;YACD,OAAO;QACT,CAAC;QACD,SAAS,CAAC;YACR,MAAM;QACR,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK;YAAE,SAAS;QACnF,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IACD,KAAK,MAAM,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,IAAU,EAAE,MAAY;IAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,KAAK;YAAE,IAAI,MAAM,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;SAAM,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,OAA6D;IAE7D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAAC;IACpF,IAAI,MAAM,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACrC,UAAU,CAAC,GAAG,CAAC,6BAA6B,gBAAgB,aAAa,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,UAAU,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC5E,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;IAE3E,IAAI,OAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,kBAAkB,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,yCAAyC,CAAC,EAAE,CAAC;QAChF,CAAC;QACD,OAAO,GAAG,MAAM,CAAC,OAA0B,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,yCAAyC,CAAC,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,IAAI,GAAS,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;IAClD,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAErB,KAAK,MAAM,SAAS,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACjD,IAAI,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,UAAU,CAAC,GAAG,CACZ,wFAAwF,CACzF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACtD,UAAU,CAAC,GAAG,CACZ,UAAU,SAAS,mBAAmB,OAAO,CAAC,WAAW,eAAe,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3G,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CACnB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,KAAK,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,WAAW,GAAG,CAAC,CACvF,EACD,CAAC;QACD,UAAU,CAAC,GAAG,CACZ,eAAe,OAAO,CAAC,WAAW,mEAAmE,CACtG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,UAAU,CAAC,GAAG,CACZ,wBAAwB,OAAO,iGAAiG,CACjI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AACpE,CAAC"}