botmux 3.4.3 → 3.5.2

package/dist/adapters/cli/fs-policy.js

@@ -0,0 +1,539 @@
+/**
+ * Unified file-sandbox policy (FsPolicy) — the single source of truth for BOTH
+ * platform sandbox engines.
+ *
+ * Model (three-tier whitelist, per product decision 2026-07-16, design doc
+ * "botmux 文件沙盒重构方案"): every path gets one of three access levels —
+ * readWrite / readOnly / deny — and EVERYTHING NOT COVERED BY A RULE IS
+ * INACCESSIBLE (deny-by-default). Nested black/white lists are supported: the
+ * DEEPEST matching rule wins (longest-prefix), so `readOnly ~/Library` +
+ * `deny ~/Library/Keychains` and `deny bots/` + `readWrite bots/<self>` both
+ * work. This replaces the previous "read-everything + enumerated blocklist"
+ * model whose failure mode was silent secret exposure; here a missing baseline
+ * entry fails loud (CLI error), never silent.
+ *
+ * Architecture: this module is PURE (no fs / no spawn — fully unit-testable).
+ *   buildFsPolicy(ctx)      merges baseline preset + botmux-internal + adapter
+ *                           + user rules into one ordered rule list
+ *   compileToSeatbelt(...)  → macOS sandbox-exec profile text
+ *   compileToBwrap(...)     → Linux bwrap argv prefix
+ * Both engines resolve conflicts by "last emitted wins" (Seatbelt last-match /
+ * bwrap mount order), so emitting rules sorted shallow→deep yields
+ * longest-prefix-wins on BOTH platforms by construction — cross-platform
+ * parity needs no hand-synced rule lists.
+ *
+ * The worker resolves every impure input up front (realpath, existence
+ * filtering, sibling-free by design) and passes canonical absolute paths.
+ */
+/** Normalize: require absolute, strip trailing slashes, reject `..` segments.
+ *  Returns null for anything unusable (silently-dropped relative paths are a
+ *  fail-open trap — callers log dropped entries). */
+export function normalizeFsPath(p) {
+    if (!p || typeof p !== 'string')
+        return null;
+    const t = p.replace(/\/+$/, '') || '/';
+    if (!t.startsWith('/'))
+        return null;
+    if (t.split('/').includes('..'))
+        return null;
+    return t;
+}
+/** Path depth for emission ordering ('/' = 0, '/a' = 1, '/a/b' = 2 …). */
+function pathDepth(p) {
+    if (p === '/')
+        return 0;
+    return p.split('/').length - 1;
+}
+/** Is `p` equal to or an ancestor of `child`? (both normalized) */
+export function coversPath(p, child) {
+    if (p === child)
+        return true;
+    const prefix = p === '/' ? '/' : `${p}/`;
+    return child.startsWith(prefix);
+}
+const SOURCE_RANK = {
+    baseline: 0,
+    adapter: 1,
+    internal: 2,
+    user: 3,
+    mandatory: 4,
+};
+const RESTRICTIVENESS = { readWrite: 0, readOnly: 1, deny: 2 };
+/**
+ * Merge candidate rules into the final ordered list:
+ *  - normalize paths, drop unusable entries
+ *  - dedupe same-path conflicts: higher source rank wins (user > internal >
+ *    adapter > baseline); tie → the MORE RESTRICTIVE access wins (deny >
+ *    readOnly > readWrite) so a duplicated entry can never widen access
+ *  - sort shallow→deep (stable within a depth) — the emission order both
+ *    compilers rely on for longest-prefix-wins
+ */
+export function mergeFsRules(candidates) {
+    const byPath = new Map();
+    for (const c of candidates) {
+        const path = normalizeFsPath(c.path);
+        if (!path)
+            continue;
+        const rule = { path, access: c.access, source: c.source };
+        const prev = byPath.get(path);
+        if (!prev) {
+            byPath.set(path, rule);
+            continue;
+        }
+        const rankNew = SOURCE_RANK[rule.source], rankOld = SOURCE_RANK[prev.source];
+        if (rankNew > rankOld) {
+            byPath.set(path, rule);
+            continue;
+        }
+        if (rankNew === rankOld && RESTRICTIVENESS[rule.access] > RESTRICTIVENESS[prev.access]) {
+            byPath.set(path, rule);
+        }
+    }
+    return [...byPath.values()].sort((a, b) => pathDepth(a.path) - pathDepth(b.path) || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+}
+/**
+ * The effective access for `path` under `rules`: the DEEPEST rule whose path
+ * covers it; no match → 'none' (inaccessible). This one function IS the policy
+ * semantics — the dashboard path tester and the unit tests both call it, and
+ * both compilers are tested to agree with it.
+ */
+export function accessForPath(rules, path) {
+    const p = normalizeFsPath(path);
+    if (!p)
+        return { access: 'none' };
+    let best;
+    for (const r of rules) {
+        if (!coversPath(r.path, p))
+            continue;
+        if (!best || pathDepth(r.path) > pathDepth(best.path))
+            best = r;
+    }
+    return best ? { access: best.access, rule: best } : { access: 'none' };
+}
+// ───────────────────────────── baseline presets ──────────────────────────────
+/** Home-relative entries shared by both platforms. Existence-filtered by the
+ *  worker before compiling (a missing path has nothing to protect or expose). */
+function commonHomeBaseline(h) {
+    const ro = (p) => ({ path: p, access: 'readOnly', source: 'baseline' });
+    const rw = (p) => ({ path: p, access: 'readWrite', source: 'baseline' });
+    const deny = (p) => ({ path: p, access: 'deny', source: 'baseline' });
+    return [
+        // Shell/env init read by non-interactive subshells (the Bash tool sources
+        // .zshenv — botmux's lark-cli identity mapping lives there) + git identity.
+        ro(`${h}/.zshenv`), ro(`${h}/.zprofile`), ro(`${h}/.zshrc`),
+        ro(`${h}/.profile`), ro(`${h}/.bashrc`), ro(`${h}/.bash_profile`),
+        ro(`${h}/.gitconfig`), ro(`${h}/.config/git`), ro(`${h}/.gitignore_global`), ro(`${h}/.gitattributes`),
+        // Language toolchains / version managers / package caches commonly under
+        // $HOME (read+exec so python/perl/ruby/rust/go/node/java built or managed
+        // there just work — the deny-by-default read posture would otherwise hide a
+        // pyenv python or a cargo-built binary). READ-ONLY: the agent runs them, it
+        // doesn't need to mutate the toolchain. Credential files that live INSIDE a
+        // few of these (crates.io / rubygems / maven tokens) are re-denied DEEPER
+        // below so longest-prefix keeps them secret.
+        ro(`${h}/.fnm`), ro(`${h}/.nvm`), ro(`${h}/.volta`), ro(`${h}/.npm-global`),
+        ro(`${h}/.nodenv`), ro(`${h}/.yarn`), ro(`${h}/.pnpm`), ro(`${h}/.bun`), ro(`${h}/.deno`),
+        ro(`${h}/.pyenv`), ro(`${h}/Library/Python`), ro(`${h}/.local/lib`), ro(`${h}/.pipx`),
+        ro(`${h}/.rbenv`), ro(`${h}/.rvm`), ro(`${h}/.gem`), ro(`${h}/perl5`), ro(`${h}/.cpanm`), ro(`${h}/.cpan`),
+        ro(`${h}/.cargo`), ro(`${h}/.rustup`),
+        ro(`${h}/go`), ro(`${h}/.gvm`), ro(`${h}/.goenv`),
+        ro(`${h}/.sdkman`), ro(`${h}/.jenv`), ro(`${h}/.m2`), ro(`${h}/.gradle`),
+        ro(`${h}/.asdf`), ro(`${h}/.mise`), ro(`${h}/.plenv`),
+        ro(`${h}/.opam`), ro(`${h}/.ghcup`), ro(`${h}/.stack`), ro(`${h}/.nimble`), ro(`${h}/.pub-cache`),
+        ro(`${h}/.local/share`), ro(`${h}/.local/bin`),
+        // Toolchain credential files sitting inside the read-allowed dirs above —
+        // re-denied deeper (registry/publish tokens, maven server passwords).
+        deny(`${h}/.cargo/credentials`), deny(`${h}/.cargo/credentials.toml`),
+        deny(`${h}/.gem/credentials`),
+        deny(`${h}/.m2/settings.xml`), deny(`${h}/.m2/settings-security.xml`),
+        deny(`${h}/.gradle/gradle.properties`),
+        // Scratch/caches every CLI + spawned tool needs.
+        rw(`${h}/.cache`), rw(`${h}/.npm`), rw(`${h}/.local/state`),
+        // The daemon-written botmux wrapper (head of PATH) + skill plugin dir.
+        ro(`${h}/.botmux/bin`), ro(`${h}/.botmux/claude-plugin`),
+        // Crown jewels — most are already unreachable via deny-by-default; these
+        // explicit denies guard the ones that could fall under an allowed tree
+        // (workingDir = $HOME, a broad user readOnly, …). Defence-in-depth.
+        deny(`${h}/.ssh`), deny(`${h}/.aws`), deny(`${h}/.azure`), deny(`${h}/.gnupg`),
+        deny(`${h}/.netrc`), deny(`${h}/.config/gh`), deny(`${h}/.config/glab-cli`),
+        deny(`${h}/.config/gcloud`), deny(`${h}/.config/op`), deny(`${h}/.config/1Password`),
+        deny(`${h}/.1password`), deny(`${h}/.password-store`), deny(`${h}/.git-credentials`),
+        deny(`${h}/.npmrc`), deny(`${h}/.pypirc`), deny(`${h}/.docker/config.json`), deny(`${h}/.kube`),
+        deny(`${h}/.lark-cli`),
+    ];
+}
+function darwinBaseline(h) {
+    const ro = (p) => ({ path: p, access: 'readOnly', source: 'baseline' });
+    const rw = (p) => ({ path: p, access: 'readWrite', source: 'baseline' });
+    const deny = (p) => ({ path: p, access: 'deny', source: 'baseline' });
+    return [
+        ...commonHomeBaseline(h),
+        // System: dyld/frameworks/toolchain — broad readOnly + surgical deny holes.
+        ro('/System'), ro('/usr'), ro('/bin'), ro('/sbin'), ro('/Library'), ro('/opt'),
+        ro('/private/etc'),
+        ro('/private/var/select'), // /var/select/sh
+        ro('/private/var/db/timezone'),
+        ro('/private/var/run'), // resolv.conf
+        deny('/Library/Keychains'),
+        // Scratch: macOS per-user TMPDIR root + tmp family + devices.
+        rw('/dev'), rw('/private/tmp'), rw('/private/var/tmp'), rw('/private/var/folders'),
+        // ~/Library: CLIs need broad read (fonts/prefs/frameworks caches) and write
+        // into Caches + Application Support — with the secret stores denied DEEPER
+        // (longest-prefix beats the rw grant).
+        ro(`${h}/Library`),
+        rw(`${h}/Library/Caches`),
+        rw(`${h}/Library/Application Support`),
+        rw(`${h}/Library/Logs`),
+        deny(`${h}/Library/Keychains`),
+        // lark-cli's key store holds EVERY bot's app-secret ciphertext + master key
+        // (the known pre-refactor leak — see design doc §2.4). Deny the dir; the
+        // bot's OWN send path uses send-cred.json in BOT_HOME, not this store.
+        deny(`${h}/Library/Application Support/lark-cli`),
+    ];
+}
+function linuxBaseline(h) {
+    const ro = (p) => ({ path: p, access: 'readOnly', source: 'baseline' });
+    const rw = (p) => ({ path: p, access: 'readWrite', source: 'baseline' });
+    return [
+        ...commonHomeBaseline(h),
+        // Toolchain + config. /bin,/lib*… on usrmerge distros are symlinks — the
+        // bwrap compiler replicates them (see CompileBwrapOpts.symlinks); on
+        // non-usrmerge hosts the worker passes them as existing dirs instead.
+        ro('/usr'), ro('/etc'), ro('/opt'),
+        // /run is a fresh tmpfs (compiler primitive); fnm/nvm farms under /run are
+        // re-exposed via ctx.execPaths. /tmp,/dev/shm,/var/tmp fresh tmpfs; /dev,
+        // /proc via bwrap primitives — all emitted by the compiler, not rules.
+        rw(`${h}/.cache`), rw(`${h}/.npm`),
+    ];
+}
+// ───────────────────────────── policy assembly ───────────────────────────────
+/**
+ * Build the unified FsPolicy: baseline preset (platform) + adapter-declared
+ * paths + botmux-internal injections + user sandboxPaths (highest precedence).
+ * Pure — the worker canonicalizes and existence-filters all ctx paths first.
+ */
+export function buildFsPolicy(ctx) {
+    const candidates = [];
+    const push = (paths, access, source) => {
+        for (const p of paths ?? [])
+            candidates.push({ path: p, access, source });
+    };
+    candidates.push(...(ctx.platform === 'darwin' ? darwinBaseline(ctx.homeDir) : linuxBaseline(ctx.homeDir)));
+    // Adapter-declared surfaces.
+    push(ctx.execPaths, 'readOnly', 'adapter');
+    push(ctx.authPaths, 'readWrite', 'adapter');
+    if (!ctx.redirectedCliData)
+        push(ctx.cliDataPaths, 'readWrite', 'adapter');
+    // botmux internals.
+    push([ctx.workingDir, ctx.botHome], 'readWrite', 'internal');
+    push(ctx.outbox ? [ctx.outbox] : [], 'readWrite', 'internal');
+    push(ctx.extraWritePaths, 'readWrite', 'internal');
+    push(ctx.readonlyRoots, 'readOnly', 'internal');
+    // Own routing metadata (`botmux send` reply routing) — read-only.
+    push([`${ctx.sessionDataDir}/sessions-${ctx.currentAppId}.json`], 'readOnly', 'internal');
+    // Own upload bucket — readWRITE: `botmux quoted` / downloadResources writes the
+    // downloaded attachment under attachments/<self>/<messageId>/… (not just reads
+    // pre-uploaded files). The worker mkdirs it pre-spawn so it survives the
+    // existence-filter and gets bound rw. Siblings' buckets stay uncovered.
+    push([`${ctx.sessionDataDir}/attachments/${ctx.currentAppId}`], 'readWrite', 'internal');
+    // Own per-bot lark-cli config (agent-facing lark-cli identity).
+    push([`${ctx.homeDir}/.lark-cli-bots/${ctx.currentAppId}`], 'readWrite', 'internal');
+    // ── botmux CLI runtime surface (deny-by-default ALLOW-LIST) ──
+    // The agent runs `botmux …` and claude fires SessionStart / AskUserQuestion
+    // hooks that exec `node <install>/dist/cli.js …`. They need the install dir +
+    // a SMALL set of ~/.botmux files. We do NOT expose ~/.botmux wholesale: it
+    // holds live credentials (config.json's voice accessKey/secretKey/apiKey, .env,
+    // data/webhook-master.key + webhook-secrets.json) and other bots' private
+    // content (data/schedules.json prompts+routing, sibling sessions/identities/
+    // send-creds, connectors/federations/…). A readOnly umbrella + deny-list is
+    // the fragile "expose-then-blocklist" pattern this refactor exists to kill —
+    // and it fails OPEN for files created after spawn. So allow-list ONLY what the
+    // CLI/hooks genuinely read; everything else (incl. future files + all creds)
+    // stays denied by construction. (Verified against codex review 2026-07-16.)
+    const bh = ctx.botmuxHome, sd = ctx.sessionDataDir, app = ctx.currentAppId;
+    push(ctx.botmuxInstallRoot ? [ctx.botmuxInstallRoot] : [], 'readOnly', 'internal');
+    push([
+        `${bh}/.data-dir`, // resolves DATA_DIR location
+        `${bh}/.dashboard-port`, // dashboard port (owner term-link; harmless port int)
+        `${bh}/bin`, // the daemon-written `botmux` wrapper (head of PATH)
+        `${bh}/claude-plugin`, // skill/plugin dir (claude --plugin-dir); no secrets
+        `${bh}/lark-scopes.json`, // static scope catalog
+        `${sd}/dashboard-daemons`, // per-bot {ipcPort, resolvedAllowedUsers} — hook IPC discovery (operational, not secret)
+        `${sd}/bots-info.json`, // bot display names / avatars for <available_bots> + recipient rendering
+        `${sd}/bot-openids-${app}.json`, // OWN routing cross-ref (sibling ones stay denied)
+        // own sessions-<self>.json + attachments/<self> already pushed above (readOnly)
+    ], 'readOnly', 'internal');
+    // turn-sends: the CLI APPENDS its OWN dedup marker to
+    // `turn-sends/<sessionId>.jsonl` (write, not read). Grant the SINGLE file, not
+    // the whole directory: a directory-wide readWrite let session A rewrite
+    // session B's `<B>.jsonl` marker (corrupting B's send-dedup → dropped/duplicate
+    // replies). The exact-file grant confines each session to its own marker. The
+    // worker PRE-CREATES this file before spawn so it survives the existence
+    // filter and bwrap can bind it (bwrap cannot bind a nonexistent source).
+    if (ctx.sessionId)
+        push([`${sd}/turn-sends/${ctx.sessionId}.jsonl`], 'readWrite', 'internal');
+    // schedules.json: `botmux schedule` is a READ-MODIFY-WRITE store shared by all
+    // bots (one file). It must be readWrite — a read-deny makes a sandboxed
+    // `botmux schedule` load an empty map and overwrite, wiping EVERY bot's tasks.
+    // This DOES expose other bots' task prompts+routing; accepted by the owner
+    // (王旭 2026-07-16) as the cost of the schedule feature — same call the old
+    // read-isolation made (schedules.json deliberately never denied).
+    push([`${sd}/schedules.json`], 'readWrite', 'internal');
+    // macOS lark-cli key store carve-out. The baseline DENIES the whole
+    // `~/Library/Application Support/lark-cli` dir (it holds EVERY bot's appsecret
+    // ciphertext + the master key — the pre-refactor cross-bot leak). But this bot
+    // needs its OWN appsecret + the master key to decrypt it and authenticate
+    // (verified: without these `lark-cli auth scopes` fails "keychain Get failed …
+    // operation not permitted"). Re-allow ONLY those two, read-only, at a DEEPER
+    // path than the deny so longest-prefix-wins. Siblings' `appsecret_*.enc` and
+    // user tokens stay denied → the master key alone can't decrypt what it can't
+    // read (verified: sibling ciphertext still DENIED). Linux keeps its keys in the
+    // per-bot `.lark-cli-bots/<self>` dir (already readWrite above), so this is
+    // darwin-only.
+    if (ctx.platform === 'darwin') {
+        const larkStore = `${ctx.homeDir}/Library/Application Support/lark-cli`;
+        push([`${larkStore}/master.key.file`, `${larkStore}/appsecret_${ctx.currentAppId}.enc`], 'readOnly', 'internal');
+    }
+    // User config — highest precedence.
+    push(ctx.userPaths?.readWrite, 'readWrite', 'user');
+    push(ctx.userPaths?.readOnly, 'readOnly', 'user');
+    push(ctx.userPaths?.deny, 'deny', 'user');
+    push(ctx.mandatoryDenyPaths, 'deny', 'mandatory');
+    push(ctx.mandatoryReadOnlyPaths, 'readOnly', 'mandatory');
+    return {
+        rules: mergeFsRules(candidates),
+        net: ctx.net !== false,
+        writeRegexes: [...(ctx.writeRegexes ?? [])],
+        denyRegexes: [...(ctx.mandatoryDenyRegexes ?? [])],
+        finalReadOnlyPaths: [...(ctx.mandatoryReadOnlyPaths ?? [])],
+    };
+}
+// ───────────────────────────── Seatbelt compiler ─────────────────────────────
+function escSb(p) {
+    return p.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+function escSbRegex(r) {
+    return r.replace(/"/g, '.'); // a `"` would terminate the #"…" literal
+}
+/** Every strict ancestor of every non-deny rule path. Under read-deny-default,
+ *  realpath()/stat of an intermediate dir fails and crashes CLIs that
+ *  canonicalize their config dir — so each ancestor needs file-read-metadata
+ *  (literal, NOT subpath: no listing/enumeration is granted). */
+export function ancestorsNeedingTraverse(rules) {
+    const out = new Set();
+    for (const r of rules) {
+        if (r.access === 'deny')
+            continue;
+        let p = r.path;
+        for (;;) {
+            const parent = p === '/' ? null : p.slice(0, p.lastIndexOf('/')) || '/';
+            if (!parent)
+                break;
+            out.add(parent);
+            if (parent === '/')
+                break;
+            p = parent;
+        }
+    }
+    return [...out].sort((a, b) => pathDepth(a) - pathDepth(b) || (a < b ? -1 : 1));
+}
+/** Apple's stock base profile — sets up the process-bootstrap file reads
+ *  (dyld shared cache, sysctl-backed system paths, mach services) that a raw
+ *  `(deny file-read* (subpath "/"))` would block, aborting the process before
+ *  main(). Empirically required: with a blanket read-deny even `/usr/bin/true`
+ *  SIGABRTs at dyld; importing this base fixes bootstrap WITHOUT opening the
+ *  disk (verified: /etc/hosts and $HOME stay denied under it). */
+const SEATBELT_BASE_PROFILE = '/System/Library/Sandbox/Profiles/bsd.sb';
+/**
+ * Compile the policy to a macOS Seatbelt profile. `(deny default)` + Apple's
+ * bsd.sb base makes it deny-by-default for BOTH files and other operations,
+ * then we re-allow the non-file operation classes the CLI needs (process/mach/
+ * ipc/sysctl/signal, network gated on policy.net) and the three file tiers
+ * emitted shallow→deep (Seatbelt applies the LAST matching rule → deepest rule
+ * wins, matching accessForPath()).
+ */
+export function compileToSeatbelt(policy) {
+    const lines = [
+        '(version 1)',
+        '(deny default)',
+        `(import "${SEATBELT_BASE_PROFILE}")`,
+        // Non-file operation classes. `(allow default)` used to grant these wholesale;
+        // under `(deny default)` we re-grant exactly what a CLI + its subprocesses need.
+        '(allow process*)',
+        '(allow signal)',
+        '(allow mach*)',
+        '(allow ipc*)',
+        '(allow sysctl*)',
+        '(allow file-ioctl)',
+        ...(policy.net ? ['(allow network*)', '(allow system-socket)'] : []),
+    ];
+    for (const r of policy.rules) {
+        const p = escSb(r.path);
+        if (r.access === 'deny') {
+            lines.push(`(deny file-read* (subpath "${p}"))`);
+            lines.push(`(deny file-write* (subpath "${p}"))`);
+        }
+        else {
+            lines.push(`(allow file-read* (subpath "${p}"))`);
+            if (r.access === 'readWrite')
+                lines.push(`(allow file-write* (subpath "${p}"))`);
+            else
+                lines.push(`(deny file-write* (subpath "${p}"))`); // re-assert: deeper ro inside a rw tree must drop write
+        }
+    }
+    // Traversal metadata for ancestors of every allowed path — emitted AFTER the
+    // rules so a broad deny cannot clobber the narrow literal grants a nested
+    // allow needs (deny ~/x + readWrite ~/x/y: realpath must stat ~/x). Literal
+    // (not subpath): grants stat/readlink of the dir itself, never listing.
+    for (const p of ancestorsNeedingTraverse(policy.rules)) {
+        lines.push(`(allow file-read-metadata (literal "${escSb(p)}"))`);
+    }
+    for (const re of policy.writeRegexes) {
+        lines.push(`(allow file-write* (regex #"${escSbRegex(re)}"))`);
+    }
+    for (const re of policy.denyRegexes ?? []) {
+        lines.push(`(deny file-read* (regex #"${escSbRegex(re)}"))`);
+        lines.push(`(deny file-write* (regex #"${escSbRegex(re)}"))`);
+    }
+    for (const path of policy.finalReadOnlyPaths ?? []) {
+        lines.push(`(allow file-read* (subpath "${escSb(path)}"))`);
+        lines.push(`(deny file-write* (subpath "${escSb(path)}"))`);
+    }
+    return lines.join('\n') + '\n';
+}
+/**
+ * Compile the policy to a bwrap argv prefix. Deny-by-default is bwrap's
+ * natural shape: a fresh tmpfs root, then ONLY the rule paths are bound in
+ * (later mounts win → emitting shallow→deep gives deepest-rule-wins, matching
+ * accessForPath()). deny rules materialize as READ-ONLY, UNREADABLE empty
+ * masks (mode-000 empty-dir ro-bind for dirs, mode-000 empty-file ro-bind for
+ * files) and are emitted whenever they sit under an exposed tree — outside it
+ * they're unreachable already (deny-by-default), and bwrap would fail mounting
+ * onto a void path.
+ *
+ * Two properties this must preserve (both cost real blockers in review):
+ *  1. The mask is `--ro-bind` of an EMPTY source, NOT `--tmpfs`: a `--tmpfs
+ *     <deny>` mount is WRITABLE inside the sandbox, so it hid the real contents
+ *     but still let the CLI write into the denied path — not a real deny.
+ *  2. A deny path is masked EVEN WHEN IT DOES NOT EXIST YET. Skipping absent
+ *     denies left the path inside the read-write parent bind, so the sandbox
+ *     could `mkdir`+write it straight onto the host, and anything the host
+ *     created there mid-session became readable (a stat→exec TOCTOU). The
+ *     worker pre-creates the mountpoint on the host so the mask always binds.
+ */
+export function compileToBwrap(policy, opts) {
+    const a = [];
+    const emptyFiles = [];
+    const maskMounts = [];
+    a.push('--tmpfs', '/');
+    a.push('--proc', '/proc', '--dev', '/dev');
+    a.push('--tmpfs', '/tmp', '--tmpfs', '/run', '--tmpfs', '/var/tmp', '--tmpfs', '/dev/shm');
+    for (const s of opts.symlinks ?? [])
+        a.push('--symlink', s.target, s.path);
+    const exposed = []; // non-deny paths emitted so far (for deny reachability)
+    const remountRo = []; // deny tmpfs masks to re-seal read-only after nested binds
+    let emptyIdx = 0;
+    for (const r of policy.rules) {
+        if (r.access === 'deny') {
+            if (!exposed.some(e => coversPath(e, r.path)))
+                continue; // unreachable → already denied by default
+            // Does a DEEPER allow (white-in-black carve-out) live under this deny?
+            // e.g. readWrite /proj → deny /proj/x → readWrite /proj/x/self. If so the
+            // mask must be able to HOST a child submount — a mode-000 read-only bind
+            // can't (bwrap: "Can't mkdir …/self: Read-only file system"). Use a fresh
+            // `--tmpfs` mask (hides the real contents, accepts the nested bind) and
+            // re-seal it read-only with `--remount-ro` AFTER the nested binds are
+            // emitted. tmpfs writes are in-memory and NEVER touch the host; the mask
+            // is listable only for the carve-out's own path (inherent to white-in-black).
+            const hasNestedAllow = policy.rules.some(o => o.access !== 'deny' && o.path !== r.path && coversPath(r.path, o.path));
+            // A deny is REDUNDANT only when the NEAREST enclosing rule is ALSO a deny:
+            // then this path is already masked by that ancestor and emitting a deeper
+            // mask would (a) add nothing and (b) fail to mount onto the ancestor's
+            // mode-000 read-only mask. Redundancy MUST be judged by the deepest strict
+            // ancestor rule — NOT "any ancestor deny exists" — because an allow can
+            // re-expose the tree between the two denies (deny /outer → allow
+            // /outer/self → deny /outer/self/secret): there the nearest ancestor of
+            // `secret` is the `self` ALLOW, so `secret` is a real leaf deny that MUST
+            // be masked (skipping it leaks the secret). Find the deepest exposed strict
+            // ancestor and skip only when it denies.
+            let nearestAncestor;
+            for (const o of policy.rules) {
+                if (o.path === r.path || !coversPath(o.path, r.path))
+                    continue; // strict ancestor only
+                if (o.access !== 'deny' && !exposed.includes(o.path))
+                    continue; // allow ancestor must be emitted to count
+                if (o.access === 'deny' && !exposed.some(e => coversPath(e, o.path)))
+                    continue; // deny ancestor must be reachable
+                if (!nearestAncestor || pathDepth(o.path) > pathDepth(nearestAncestor.path))
+                    nearestAncestor = o;
+            }
+            const shadowedByDeny = !hasNestedAllow && nearestAncestor?.access === 'deny';
+            if (shadowedByDeny)
+                continue;
+            if (hasNestedAllow) {
+                a.push('--tmpfs', r.path);
+                remountRo.push(r.path);
+                maskMounts.push({ path: r.path, kind: 'dir' });
+            }
+            else if (opts.filePaths?.has(r.path)) {
+                // FILE-shaped leaf deny: ro-bind a mode-000 empty placeholder file
+                // (unreadable + read-only).
+                const empty = `${opts.emptiesDir}/mask-${emptyIdx++}`;
+                emptyFiles.push({ path: empty, maskedPath: r.path });
+                a.push('--ro-bind', empty, r.path);
+                maskMounts.push({ path: r.path, kind: 'file' });
+            }
+            else {
+                // DIRECTORY-shaped leaf deny (existing dir OR not-yet-existing path):
+                // ro-bind the shared mode-000 empty dir → contents hidden, mount
+                // read-only, and the mask itself unreadable (a real deny, not a
+                // writable/listable tmpfs).
+                a.push('--ro-bind', opts.emptyDir, r.path);
+                maskMounts.push({ path: r.path, kind: 'dir' });
+            }
+            continue;
+        }
+        a.push(r.access === 'readWrite' ? '--bind' : '--ro-bind', r.path, r.path);
+        exposed.push(r.path);
+    }
+    // Re-seal white-in-black deny masks read-only AFTER their nested carve-out
+    // binds were emitted (a --remount-ro before the child bind would block the
+    // mkdir; after it, the child submount keeps its own writability while the
+    // tmpfs parent becomes unwritable).
+    for (const p of remountRo)
+        a.push('--remount-ro', p);
+    a.push('--unshare-user', '--unshare-pid', '--unshare-ipc', '--unshare-uts', '--unshare-cgroup-try');
+    if (!policy.net)
+        a.push('--unshare-net');
+    a.push('--die-with-parent', '--new-session', '--chdir', opts.chdir);
+    return { args: a, emptyFiles, maskMounts };
+}
+/**
+ * old→new field mapping (lossless: the old fields' expressiveness is a subset
+ * of the three-tier model). Used by the registry's load-time auto-migration,
+ * which writes the NEW fields while KEEPING the old ones in bots.json — a
+ * downgraded daemon reads the untouched old fields, so downgrade needs no
+ * reverse script (design doc §6.2). Returns null when nothing to migrate.
+ */
+export function migrateLegacySandboxFields(entry) {
+    if (entry.sandboxPaths !== undefined)
+        return null; // already on the new model
+    const hasLegacy = entry.readIsolation === true
+        || (entry.sandboxReadonlyPaths?.length ?? 0) > 0
+        || (entry.sandboxHidePaths?.length ?? 0) > 0
+        || (entry.readDenyExtraPaths?.length ?? 0) > 0;
+    const sandbox = entry.sandbox === true || entry.readIsolation === true;
+    if (!hasLegacy)
+        return null; // plain `sandbox: true` needs no path migration
+    const readOnly = [...(entry.sandboxReadonlyPaths ?? [])];
+    const deny = [...(entry.sandboxHidePaths ?? []), ...(entry.readDenyExtraPaths ?? [])];
+    const sandboxPaths = {};
+    if (readOnly.length)
+        sandboxPaths.readOnly = readOnly;
+    if (deny.length)
+        sandboxPaths.deny = [...new Set(deny)];
+    return {
+        sandbox,
+        ...(readOnly.length || deny.length ? { sandboxPaths } : {}),
+    };
+}
+//# sourceMappingURL=fs-policy.js.map

package/dist/adapters/cli/fs-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-policy.js","sourceRoot":"","sources":["../../../src/adapters/cli/fs-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAiFH;;qDAEqD;AACrD,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IACvC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,CAAS,EAAE,KAAa;IACjD,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,MAAM,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,WAAW,GAAiC;IAChD,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,SAAS,EAAE,CAAC;CACb,CAAC;AACF,MAAM,eAAe,GAA6B,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAEzF;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,UAA6B;IACxD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,IAAI,GAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAChD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7E,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvF,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxI,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAwB,EAAE,IAAY;IAClE,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAClC,IAAI,IAAwB,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAAE,SAAS;QACrC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACzE,CAAC;AAED,gFAAgF;AAEhF;iFACiF;AACjF,SAAS,kBAAkB,CAAC,CAAS;IACnC,MAAM,EAAE,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACtF,OAAO;QACL,0EAA0E;QAC1E,4EAA4E;QAC5E,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;QAC3D,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACjE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACtG,yEAAyE;QACzE,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,6CAA6C;QAC7C,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC;QAC3E,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzF,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrF,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1G,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC;QACrC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;QACjD,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC;QACxE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;QACrD,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;QACjG,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;QAC9C,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACrE,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACrE,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACtC,iDAAiD;QACjD,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3D,uEAAuE;QACvE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACxD,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC3E,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACpF,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACpF,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/F,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,EAAE,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACtF,OAAO;QACL,GAAG,kBAAkB,CAAC,CAAC,CAAC;QACxB,4EAA4E;QAC5E,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC;QAC9E,EAAE,CAAC,cAAc,CAAC;QAClB,EAAE,CAAC,qBAAqB,CAAC,EAAI,iBAAiB;QAC9C,EAAE,CAAC,0BAA0B,CAAC;QAC9B,EAAE,CAAC,kBAAkB,CAAC,EAAO,cAAc;QAC3C,IAAI,CAAC,oBAAoB,CAAC;QAC1B,8DAA8D;QAC9D,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC;QAClF,4EAA4E;QAC5E,2EAA2E;QAC3E,uCAAuC;QACvC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC;QAClB,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACzB,EAAE,CAAC,GAAG,CAAC,8BAA8B,CAAC;QACtC,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC9B,4EAA4E;QAC5E,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,CAAC,GAAG,CAAC,uCAAuC,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,MAAM,EAAE,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACzF,OAAO;QACL,GAAG,kBAAkB,CAAC,CAAC,CAAC;QACxB,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC;QAClC,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAoB;IAChD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,KAAoC,EAAE,MAAgB,EAAE,MAAoB,EAAE,EAAE;QAC5F,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC;IAEF,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAE3G,6BAA6B;IAC7B,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,iBAAiB;QAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAE3E,oBAAoB;IACpB,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAChD,kEAAkE;IAClE,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,cAAc,aAAa,GAAG,CAAC,YAAY,OAAO,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAC1F,gFAAgF;IAChF,+EAA+E;IAC/E,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,cAAc,gBAAgB,GAAG,CAAC,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IACzF,gEAAgE;IAChE,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,mBAAmB,GAAG,CAAC,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAErF,gEAAgE;IAChE,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,gFAAgF;IAChF,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,GAAG,CAAC,cAAc,EAAE,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC;IAC3E,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACnF,IAAI,CAAC;QACH,GAAG,EAAE,YAAY,EAAW,6BAA6B;QACzD,GAAG,EAAE,kBAAkB,EAAK,sDAAsD;QAClF,GAAG,EAAE,MAAM,EAAiB,qDAAqD;QACjF,GAAG,EAAE,gBAAgB,EAAO,qDAAqD;QACjF,GAAG,EAAE,mBAAmB,EAAI,uBAAuB;QACnD,GAAG,EAAE,oBAAoB,EAAG,yFAAyF;QACrH,GAAG,EAAE,iBAAiB,EAAM,yEAAyE;QACrG,GAAG,EAAE,gBAAgB,GAAG,OAAO,EAAG,mDAAmD;QACrF,gFAAgF;KACjF,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAC3B,sDAAsD;IACtD,+EAA+E;IAC/E,wEAAwE;IACxE,gFAAgF;IAChF,8EAA8E;IAC9E,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,GAAG,CAAC,SAAS;QAAE,IAAI,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,CAAC,SAAS,QAAQ,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC9F,+EAA+E;IAC/E,wEAAwE;IACxE,+EAA+E;IAC/E,2EAA2E;IAC3E,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,CAAC,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IACxD,oEAAoE;IACpE,+EAA+E;IAC/E,+EAA+E;IAC/E,0EAA0E;IAC1E,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,gFAAgF;IAChF,4EAA4E;IAC5E,eAAe;IACf,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,OAAO,uCAAuC,CAAC;QACxE,IAAI,CAAC,CAAC,GAAG,SAAS,kBAAkB,EAAE,GAAG,SAAS,cAAc,GAAG,CAAC,YAAY,MAAM,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACnH,CAAC;IAED,oCAAoC;IACpC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAE1D,OAAO;QACL,KAAK,EAAE,YAAY,CAAC,UAAU,CAAC;QAC/B,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,KAAK;QACtB,YAAY,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAC3C,WAAW,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QAClD,kBAAkB,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,KAAK,CAAC,CAAS;IACtB,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AACD,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,yCAAyC;AACxE,CAAC;AAED;;;iEAGiE;AACjE,MAAM,UAAU,wBAAwB,CAAC,KAAwB;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACf,SAAS,CAAC;YACR,MAAM,MAAM,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;YACxE,IAAI,CAAC,MAAM;gBAAE,MAAM;YACnB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChB,IAAI,MAAM,KAAK,GAAG;gBAAE,MAAM;YAC1B,CAAC,GAAG,MAAM,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;;;kEAKkE;AAClE,MAAM,qBAAqB,GAAG,yCAAyC,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAgB;IAChD,MAAM,KAAK,GAAG;QACZ,aAAa;QACb,gBAAgB;QAChB,YAAY,qBAAqB,IAAI;QACrC,+EAA+E;QAC/E,iFAAiF;QACjF,kBAAkB;QAClB,gBAAgB;QAChB,eAAe;QACf,cAAc;QACd,iBAAiB;QACjB,oBAAoB;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW;gBAAE,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC,CAAC;;gBAC5E,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC,CAAC,wDAAwD;QAClH,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,KAAK,MAAM,CAAC,IAAI,wBAAwB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,uCAAuC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,+BAA+B,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,6BAA6B,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,8BAA8B,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AA+CD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,MAAgB,EAAE,IAAsB;IACrE,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,MAAM,UAAU,GAA2C,EAAE,CAAC;IAC9D,MAAM,UAAU,GAA6C,EAAE,CAAC;IAChE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3F,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;QAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAE3E,MAAM,OAAO,GAAa,EAAE,CAAC,CAAC,wDAAwD;IACtF,MAAM,SAAS,GAAa,EAAE,CAAC,CAAC,2DAA2D;IAC3F,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS,CAAC,0CAA0C;YACnG,uEAAuE;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,yEAAyE;YACzE,8EAA8E;YAC9E,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1E,2EAA2E;YAC3E,0EAA0E;YAC1E,uEAAuE;YACvE,2EAA2E;YAC3E,wEAAwE;YACxE,iEAAiE;YACjE,wEAAwE;YACxE,0EAA0E;YAC1E,4EAA4E;YAC5E,yCAAyC;YACzC,IAAI,eAAmC,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS,CAAC,uBAAuB;gBACvF,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS,CAAC,0CAA0C;gBAC1G,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;oBAAE,SAAS,CAAC,kCAAkC;gBAClH,IAAI,CAAC,eAAe,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC;oBAAE,eAAe,GAAG,CAAC,CAAC;YACnG,CAAC;YACD,MAAM,cAAc,GAAG,CAAC,cAAc,IAAI,eAAe,EAAE,MAAM,KAAK,MAAM,CAAC;YAC7E,IAAI,cAAc;gBAAE,SAAS;YAC7B,IAAI,cAAc,EAAE,CAAC;gBACnB,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACvB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,CAAC;iBAAM,IAAI,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,mEAAmE;gBACnE,4BAA4B;gBAC5B,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,UAAU,SAAS,QAAQ,EAAE,EAAE,CAAC;gBACtD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrD,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,sEAAsE;gBACtE,iEAAiE;gBACjE,gEAAgE;gBAChE,4BAA4B;gBAC5B,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC3C,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,CAAC;YACD,SAAS;QACX,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,oCAAoC;IACpC,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAErD,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,sBAAsB,CAAC,CAAC;IACpG,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AAC7C,CAAC;AAiBD;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAuD;IAChG,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,2BAA2B;IAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,KAAK,IAAI;WACzC,CAAC,KAAK,CAAC,oBAAoB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;WAC7C,CAAC,KAAK,CAAC,gBAAgB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;WACzC,CAAC,KAAK,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC;IACvE,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,gDAAgD;IAC7E,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,YAAY,GAA0C,EAAE,CAAC;IAC/D,IAAI,QAAQ,CAAC,MAAM;QAAE,YAAY,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM;QAAE,YAAY,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,OAAO;QACL,OAAO;QACP,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC"}

package/dist/adapters/cli/pi-initial-prompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pi-initial-prompt.d.ts","sourceRoot":"","sources":["../../../src/adapters/cli/pi-initial-prompt.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,gCAAgC,OAAO,CAAC;AASrD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE5E;AAED,wBAAgB,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzF;AASD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG;IACF,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC7B,CAAC;CACH,CAyBA"}
+{"version":3,"file":"pi-initial-prompt.d.ts","sourceRoot":"","sources":["../../../src/adapters/cli/pi-initial-prompt.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,gCAAgC,OAAO,CAAC;AASrD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAQ5E;AAED,wBAAgB,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEzF;AASD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG;IACF,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC7B,CAAC;CACH,CAyBA"}

package/dist/adapters/cli/pi-initial-prompt.js

@@ -10,7 +10,11 @@ function safeSessionFileStem(sessionId) {
     return sessionId.replace(/[^A-Za-z0-9._-]/g, '_').replace(/^\.+$/, '_');
 }
 export function piInitialPromptNeedsFile(prompt) {
-    return !!prompt && Buffer.byteLength(prompt, 'utf8') > PI_INITIAL_PROMPT_ARG_BYTE_LIMIT;
+    return !!prompt && (Buffer.byteLength(prompt, 'utf8') > PI_INITIAL_PROMPT_ARG_BYTE_LIMIT
+        // Herdr 0.7.5 rejects control characters in managed-agent argv. Its macOS
+        // integration can also bypass the PATH launcher, so even short routed
+        // Botmux prompts must use Pi's safe @file positional form.
+        || /[\x00-\x1f\x7f]/.test(prompt));
 }
 export function piInitialPromptRootDir(sessionDataDir) {
     return join(sessionDataDir, 'pi-initial-prompts');

package/dist/adapters/cli/pi-initial-prompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"pi-initial-prompt.js","sourceRoot":"","sources":["../../../src/adapters/cli/pi-initial-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,kCAAkC,CAAC;AAE1C,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAErD,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAClF,OAAO,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAA0B;IACjE,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gCAAgC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,cAAsB;IAC3D,OAAO,IAAI,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,cAAsB,EAAE,SAAiB;IAC1E,OAAO,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,cAAsB,EAAE,SAAiB;IAC/E,OAAO,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,SAAS,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;IACjE,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,OAAO,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAIzC;IAWC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;IACtH,CAAC;IAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzE,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,OAAO;QACL,gBAAgB,EAAE,IAAI,QAAQ,EAAE;QAChC,QAAQ;QACR,YAAY,EAAE,GAAG;QACjB,UAAU,EAAE,GAAG;QACf,aAAa,EAAE;YACb,OAAO,EAAE,yBAAyB;YAClC,cAAc,EAAE,CAAC,aAAa,EAAE,4BAA4B,EAAE,CAAC;YAC/D,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,EAAE,QAAQ,EAAE;SAChD;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"pi-initial-prompt.js","sourceRoot":"","sources":["../../../src/adapters/cli/pi-initial-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,kCAAkC,CAAC;AAE1C,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAErD,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAClF,OAAO,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAA0B;IACjE,OAAO,CAAC,CAAC,MAAM,IAAI,CACjB,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gCAAgC;QACpE,0EAA0E;QAC1E,sEAAsE;QACtE,2DAA2D;WACxD,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,cAAsB;IAC3D,OAAO,IAAI,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,cAAsB,EAAE,SAAiB;IAC1E,OAAO,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,cAAsB,EAAE,SAAiB;IAC/E,OAAO,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,SAAS,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;IACjE,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,OAAO,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAIzC;IAWC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;IACtH,CAAC;IAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzE,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,OAAO;QACL,gBAAgB,EAAE,IAAI,QAAQ,EAAE;QAChC,QAAQ;QACR,YAAY,EAAE,GAAG;QACjB,UAAU,EAAE,GAAG;QACf,aAAa,EAAE;YACb,OAAO,EAAE,yBAAyB;YAClC,cAAc,EAAE,CAAC,aAAa,EAAE,4BAA4B,EAAE,CAAC;YAC/D,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,EAAE,QAAQ,EAAE;SAChD;KACF,CAAC;AACJ,CAAC"}