circle-ir-ai 4.11.0 → 4.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +115 -0
- package/dist/llm/config.d.ts.map +1 -1
- package/dist/llm/config.js +12 -8
- package/dist/llm/config.js.map +1 -1
- package/dist/skills/code-threat-patterns.d.ts +35 -0
- package/dist/skills/code-threat-patterns.d.ts.map +1 -1
- package/dist/skills/code-threat-patterns.js +310 -16
- package/dist/skills/code-threat-patterns.js.map +1 -1
- package/dist/skills/precision.d.ts.map +1 -1
- package/dist/skills/precision.js +30 -2
- package/dist/skills/precision.js.map +1 -1
- package/dist/skills/skill-analyzer.d.ts.map +1 -1
- package/dist/skills/skill-analyzer.js +54 -11
- package/dist/skills/skill-analyzer.js.map +1 -1
- package/dist/skills/types.d.ts +7 -0
- package/dist/skills/types.d.ts.map +1 -1
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,121 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [4.12.0] - 2026-09-11
|
|
11
|
+
|
|
12
|
+
### Changed
|
|
13
|
+
|
|
14
|
+
- **circle-ir 4.9.10 → 4.9.13.** Picks up four upstream fixes that were published after the
|
|
15
|
+
4.9.10 tag: the CLI dedupe from cognium-dev#305, three precision fixes from #317, and the
|
|
16
|
+
cross-method alias fix from #318. Verified against the class that prompted the upgrade —
|
|
17
|
+
`RegExp.exec` no longer yields a `command_injection` sink, which is the fourth shape of
|
|
18
|
+
cognium-ai#419 (the other three were ours and are fixed below). Exactly one copy of
|
|
19
|
+
`circle-ir` resolves in the tree; full suite unchanged at 2,205 passing.
|
|
20
|
+
|
|
21
|
+
### Fixed
|
|
22
|
+
|
|
23
|
+
- **`enableLLM` also gates the SKILL.md natural-language extractor (cognium-ai#405 residual).**
|
|
24
|
+
The gate shipped covering instruction-safety and capability-mismatch, but
|
|
25
|
+
`NaturalLanguageExtractor.extractSemanticFacts()` is a **third** LLM caller and it runs during
|
|
26
|
+
artifact extraction, *before* either gate is consulted — so `--no-llm` still printed the
|
|
27
|
+
unreachable-endpoint warning. Found while validating this release. Skipping it is safe: the
|
|
28
|
+
extractor already degrades to an empty result when the LLM is unavailable, and the only
|
|
29
|
+
consumer of the SKILL.md IR is the capability-mismatch comparison, which `enableLLM: false`
|
|
30
|
+
switches off anyway.
|
|
31
|
+
|
|
32
|
+
### Added
|
|
33
|
+
|
|
34
|
+
- **`enableLLM` master switch for `analyzeSkillBundle` (cognium-ai#405).** `enableLLM: false`
|
|
35
|
+
means no phase may reach the network. `enableInstructionSafety: false` alone did not cover
|
|
36
|
+
it: the capability-mismatch comparison is a **second** LLM caller in the same pipeline and
|
|
37
|
+
was ungated, so a run with instruction-safety off still attempted a connection and printed
|
|
38
|
+
the unreachable-endpoint warning. Defaults to `true`, so existing callers are unaffected.
|
|
39
|
+
|
|
40
|
+
### Fixed
|
|
41
|
+
|
|
42
|
+
- **Skills engine precision — the five deterministic classes from the SR skillharness review
|
|
43
|
+
(cognium-ai#416, #417, #418, #420, #427).**
|
|
44
|
+
- **#416** `codebase_exfiltration` fired on `vercel-deploy-claimable`'s `deploy.sh`, which tars the
|
|
45
|
+
project and POSTs it to `api.vercel.com` with the operator's own token — the product, not
|
|
46
|
+
exfiltration. `isDeclaredDeployUpload` now suppresses it when **both** hold: every absolute host
|
|
47
|
+
in the file is a known deploy/publish endpoint, and the skill declares that intent in its own
|
|
48
|
+
SKILL.md. Either condition alone would be exploitable, so both are required; an archive that also
|
|
49
|
+
reaches any other host still fires.
|
|
50
|
+
- **#417** `trigger_hijack` read the documentation checkbox `- [ ] [Create todos for all tasks]` as
|
|
51
|
+
an auto-attach claim. `for all tasks` now needs a skill-activation subject within 40 characters
|
|
52
|
+
(the #352-pass-2 rule), and fenced blocks and `- [ ]` task-list items are excluded — an example
|
|
53
|
+
being shown is not a declaration.
|
|
54
|
+
- **#418** `broken_reference` fired on a page-template link inside a fenced block. New `fenceMask`
|
|
55
|
+
drops reference positions inside ``` / ~~~ fences.
|
|
56
|
+
- **#420 (a false negative)** a backticked sibling directory such as `` `../using-superpowers/references/` ``
|
|
57
|
+
escaped the bundle root but was invisible: the extension test and the `rootPath` requirement both
|
|
58
|
+
hid it, so `obra/executing-plans` returned zero findings. An escaping path is now a reference on
|
|
59
|
+
the strength of the string alone — whether it exists on disk is irrelevant to whether it escapes.
|
|
60
|
+
- **#427 (structural)** 616 of the 2,265 Milestone-1 CRITICAL/HIGH rows name no file at all: they
|
|
61
|
+
are matchers over SKILL.md prose. skillsregistry#85 already established that an instruction read
|
|
62
|
+
must never flip the verdict alone; these matchers are deterministic, so they lack #85's
|
|
63
|
+
reproducibility problem but share its epistemic one — a prose read is a claim about what a skill
|
|
64
|
+
*says*, a taint finding is a claim about what its code *does*. The four behaviour-claim detectors
|
|
65
|
+
(`trigger_hijack`, `invisible_characters`, `multimodal_payload`, `financial_access`) no longer flip
|
|
66
|
+
the verdict to VULNERABLE without a code-backed finding corroborating. They still surface and still
|
|
67
|
+
penalise `trust_score`. Scoped to claims: an encoded payload or hidden instruction in SKILL.md is an
|
|
68
|
+
artifact present in the text and keeps flipping. Kill switch `SKILL_PROSE_VERDICT_GUARD=0`.
|
|
69
|
+
- **Skills engine — a sink is not a finding (cognium-ai#419).** `extractFindingsFromIR`
|
|
70
|
+
emitted one `vulnerability` per entry in circle-ir's sink **inventory**, with no
|
|
71
|
+
source→sink flow required, so we published sinks that circle-ir itself did not consider
|
|
72
|
+
findings. That is why the SkillsRegistry harness saw `code_injection` on
|
|
73
|
+
`setTimeout(connect, 250)` — a function reference — and `xss` on a static `cssText`
|
|
74
|
+
literal, while the SAST team measured circle-ir silent on the same fixtures at the exact
|
|
75
|
+
version tested. Reproduced here with the LLM off, so it is not an enrichment artefact.
|
|
76
|
+
The emission now goes through circle-ir's own `generateFindings(sources, sinks, dfg, …)`,
|
|
77
|
+
which applies the source→sink compatibility check the cross-product skipped — the same
|
|
78
|
+
unification CLAUDE.md records as the open design gap on the mastra `runReport` path. A
|
|
79
|
+
real request-param → `exec()` flow still reports; the code-threat detectors are a separate
|
|
80
|
+
path and are unaffected, so a hardcoded malicious command with no tainted source still
|
|
81
|
+
fires there. A join failure falls back to the sink list rather than silently dropping
|
|
82
|
+
findings. Kill switch `SKILL_SINK_FLOW_GUARD=0`.
|
|
83
|
+
|
|
84
|
+
### Fixed
|
|
85
|
+
|
|
86
|
+
- **Skills engine precision — `credential_exfiltration` no longer fires on co-presence
|
|
87
|
+
(cognium-ai#412).** The CWE-522 detector asserted exfiltration whenever a credential path
|
|
88
|
+
appeared anywhere in a file that also contained an egress token anywhere else. It was 208 of
|
|
89
|
+
the 2,265 Milestone-1 CRITICAL/HIGH rows; SR resolved 40 of them to source at HEAD and not one
|
|
90
|
+
was exfiltration. Four gates now apply, in the order that clears the most: the path must be in
|
|
91
|
+
real code (not a comment, not a JSON-schema `description`, not prose); it must not be a guard's
|
|
92
|
+
own denylist entry; it must not be the skill's own token store under its own config directory;
|
|
93
|
+
and the read must reach an egress call, by position or through the identifier it was assigned
|
|
94
|
+
to. `danduh/mcp-security`, the single certified true positive in the cohort, still fires.
|
|
95
|
+
- **Skills engine precision — the inverted-detection class, generalised (cognium-ai#414).** #370
|
|
96
|
+
gated quoted literals inside denylist arrays for two detectors. SR then scanned all 1,649
|
|
97
|
+
findings naming a concrete file for three high-specificity families — recursive delete (11),
|
|
98
|
+
cryptominer pool (3), wallet seed phrase (5) — and every one of the 19 was inverted: a
|
|
99
|
+
scanner's own rule catalogue, a jail's denylist, a defensive comment, or a test asserting
|
|
100
|
+
rejection. `inDefensiveContext()` now covers rule catalogues and message tables, comments
|
|
101
|
+
including trailing ones, defensive vocabulary and assertions nearby, and applies to every
|
|
102
|
+
code-threat detector except `hardcoded_secret`. Suppression turns on whether the match is
|
|
103
|
+
*inert* — present only inside a literal on a line whose code half calls nothing that runs or
|
|
104
|
+
sends — never on the filename, so a genuine `exec("rm -rf /")` still fires from
|
|
105
|
+
`src/security/policy.ts`.
|
|
106
|
+
|
|
107
|
+
## [4.11.1] - 2026-09-09
|
|
108
|
+
|
|
109
|
+
Patch: the thinking-model timeout allowance introduced in 4.11.0 was global, so a
|
|
110
|
+
`meta/muse-glimmer-30b` discovery + `openai/gpt-4o-mini` verify split made the verify
|
|
111
|
+
phase wait 360 s for a model that answers in seconds. Reported from the field on 4.11.0
|
|
112
|
+
(13 h for 52 of 120 CWE-Bench-Java projects, 30 timed out). No feature change; an
|
|
113
|
+
all-non-thinking configuration is byte-identical to 4.10.1.
|
|
114
|
+
|
|
115
|
+
### Fixed — the thinking-model timeout allowance is per phase, not global
|
|
116
|
+
|
|
117
|
+
- 4.11.0 raised the default per-call timeout to 360 s when *any* phase model was a thinking model, so the
|
|
118
|
+
common split `meta/muse-glimmer-30b` discovery + `openai/gpt-4o-mini` verify made the **verify** phase wait
|
|
119
|
+
6 minutes for a model that answers in seconds. Reported from the field on 4.11.0: 13 h for 52 of 120
|
|
120
|
+
CWE-Bench-Java projects with 30 timed out, against a 12 % skip rate on 4.10.1.
|
|
121
|
+
- The allowance is now keyed on each phase's own model. `LLM_TIMEOUT_MS` and the per-phase
|
|
122
|
+
`LLM_TIMEOUT_MS_*` overrides still win, in that order. Completion budgets were already per phase and are
|
|
123
|
+
unchanged; an all-non-thinking configuration is byte-identical to 4.10.1.
|
|
124
|
+
|
|
10
125
|
## [4.11.0] - 2026-09-08
|
|
11
126
|
|
|
12
127
|
Rolls up the 2026-09-03 → 09-08 work: skill code-threat precision passes 2 and 3
|
package/dist/llm/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/llm/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AAGH,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IAEf,MAAM,EAAE;QACN,UAAU,EAAE,WAAW,CAAC;QACxB,YAAY,EAAE,WAAW,CAAC;QAC1B,mBAAmB,EAAE,WAAW,CAAC;KAClC,CAAC;IAGF,UAAU,EAAE;QACV,wBAAwB,EAAE,OAAO,CAAC;QAClC,qBAAqB,EAAE,OAAO,CAAC;QAC/B,wBAAwB,EAAE,OAAO,CAAC;QAClC,oBAAoB,EAAE,MAAM,CAAC;QAC7B,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC;IAGF,YAAY,EAAE;QACZ,mBAAmB,EAAE,OAAO,CAAC;QAC7B,qBAAqB,EAAE,OAAO,CAAC;KAChC,CAAC;CACH;AAkCD,wBAAgB,mBAAmB,IAAI,SAAS,
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/llm/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AAGH,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IAEf,MAAM,EAAE;QACN,UAAU,EAAE,WAAW,CAAC;QACxB,YAAY,EAAE,WAAW,CAAC;QAC1B,mBAAmB,EAAE,WAAW,CAAC;KAClC,CAAC;IAGF,UAAU,EAAE;QACV,wBAAwB,EAAE,OAAO,CAAC;QAClC,qBAAqB,EAAE,OAAO,CAAC;QAC/B,wBAAwB,EAAE,OAAO,CAAC;QAClC,oBAAoB,EAAE,MAAM,CAAC;QAC7B,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC;IAGF,YAAY,EAAE;QACZ,mBAAmB,EAAE,OAAO,CAAC;QAC7B,qBAAqB,EAAE,OAAO,CAAC;KAChC,CAAC;CACH;AAkCD,wBAAgB,mBAAmB,IAAI,SAAS,CAiH/C;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAiC,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE3D;AAGD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOtD;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,CAAC;AAQxE;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,CAM7E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EAClD,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAYD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,GAAE,SAAiC,GAAG,MAAM,CAM1F;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,GAAE,SAAiC,GAAG,MAAM,CAE9F;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,GAAE,SAAiC,GAAG,MAAM,CAE3F;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,GAAE,SAAiC,GAAG,MAAM,CAE9F;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAazD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CA0BzE"}
|
package/dist/llm/config.js
CHANGED
|
@@ -92,20 +92,24 @@ export function getDefaultLLMConfig() {
|
|
|
92
92
|
'cognium/gpt-oss-120b';
|
|
93
93
|
const verificationModel = process.env.LLM_VERIFICATION_MODEL || enrichmentModel;
|
|
94
94
|
const componentModel = process.env.LLM_COMPONENT_MODEL || enrichmentModel;
|
|
95
|
-
// Thinking models spend part of the completion budget on reasoning, so a
|
|
96
|
-
//
|
|
97
|
-
// unless LLM_TIMEOUT_MS (or a per-phase override) is set explicitly.
|
|
98
|
-
const anyThinkingModel = [enrichmentModel, verificationModel, componentModel].some(isThinkingModel);
|
|
95
|
+
// Thinking models spend part of the completion budget on reasoning, so a larger
|
|
96
|
+
// budget also means longer calls — but only for the phases that actually use one.
|
|
99
97
|
function parseTimeout(raw) {
|
|
100
98
|
if (!raw)
|
|
101
99
|
return null;
|
|
102
100
|
const n = parseInt(raw, 10);
|
|
103
101
|
return Number.isFinite(n) && n > 0 ? n : null;
|
|
104
102
|
}
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
103
|
+
// The thinking-model allowance is PER PHASE, keyed on that phase's own model.
|
|
104
|
+
// It was global at first (2026-09-08): one thinking model anywhere raised the
|
|
105
|
+
// ceiling for every phase, so a `gemma3/glimmer discovery + gpt-4o-mini verify`
|
|
106
|
+
// split made the *verify* phase wait 360 s for a model that answers in seconds —
|
|
107
|
+
// reported from the field on 4.11.0 (13 h for 52 of 120 projects, 30 timed out).
|
|
108
|
+
const explicitUniversal = parseTimeout(process.env.LLM_TIMEOUT_MS);
|
|
109
|
+
const phaseTimeout = (envVar, model) => parseTimeout(envVar) ?? explicitUniversal ?? (isThinkingModel(model) ? 360000 : 180000);
|
|
110
|
+
const discoveryTimeoutMs = phaseTimeout(process.env.LLM_TIMEOUT_MS_DISCOVERY, enrichmentModel);
|
|
111
|
+
const verificationTimeoutMs = phaseTimeout(process.env.LLM_TIMEOUT_MS_VERIFICATION, verificationModel);
|
|
112
|
+
const componentTimeoutMs = phaseTimeout(process.env.LLM_TIMEOUT_MS_COMPONENT, componentModel);
|
|
109
113
|
return {
|
|
110
114
|
baseUrl,
|
|
111
115
|
apiKey: process.env.LLM_API_KEY || defaultApiKey,
|
package/dist/llm/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/llm/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,8EAA8E;AAC9E,mEAAmE;AACnE,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAuC1C;;;;;;;;;;;;;;GAcG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IACtD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,0BAA0B,CAAC;IACvE,uEAAuE;IACvE,8DAA8D;IAC9D,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAExD,sEAAsE;IACtE,qEAAqE;IACrE,oDAAoD;IACpD,EAAE;IACF,iEAAiE;IACjE,kEAAkE;IAClE,+DAA+D;IAC/D,8BAA8B;IAC9B,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,8DAA8D;IAC9D,EAAE;IACF,0EAA0E;IAC1E,sEAAsE;IACtE,sEAAsE;IACtE,0EAA0E;IAC1E,oEAAoE;IACpE,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,gEAAgE;IAChE,EAAE;IACF,uEAAuE;IACvE,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,yBAAyB;IACzB,8CAA8C;IAC9C,mDAAmD;IACnD,gEAAgE;IAChE,mEAAmE;IACnE,gCAAgC;IAChC,MAAM,eAAe,GACnB,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAChC,sBAAsB,CAAC;IACzB,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,eAAe,CAAC;IAChF,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,eAAe,CAAC;IAC1E,
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/llm/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,8EAA8E;AAC9E,mEAAmE;AACnE,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAuC1C;;;;;;;;;;;;;;GAcG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IACtD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,0BAA0B,CAAC;IACvE,uEAAuE;IACvE,8DAA8D;IAC9D,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAExD,sEAAsE;IACtE,qEAAqE;IACrE,oDAAoD;IACpD,EAAE;IACF,iEAAiE;IACjE,kEAAkE;IAClE,+DAA+D;IAC/D,8BAA8B;IAC9B,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,8DAA8D;IAC9D,EAAE;IACF,0EAA0E;IAC1E,sEAAsE;IACtE,sEAAsE;IACtE,0EAA0E;IAC1E,oEAAoE;IACpE,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,gEAAgE;IAChE,EAAE;IACF,uEAAuE;IACvE,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,yBAAyB;IACzB,8CAA8C;IAC9C,mDAAmD;IACnD,gEAAgE;IAChE,mEAAmE;IACnE,gCAAgC;IAChC,MAAM,eAAe,GACnB,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAChC,sBAAsB,CAAC;IACzB,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,eAAe,CAAC;IAChF,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,eAAe,CAAC;IAC1E,gFAAgF;IAChF,kFAAkF;IAElF,SAAS,YAAY,CAAC,GAAuB;QAC3C,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,CAAC,MAA0B,EAAE,KAAa,EAAU,EAAE,CACzE,YAAY,CAAC,MAAM,CAAC,IAAI,iBAAiB,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1F,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAC;IAC/F,MAAM,qBAAqB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,CAAC;IACvG,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAC;IAG9F,OAAO;QACL,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,aAAa;QAEhD,MAAM,EAAE;YACN,mEAAmE;YACnE,UAAU,EAAE;gBACV,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,GAAG;gBAChB,SAAS,EAAE,gBAAgB,CAAC,eAAe,EAAE,WAAW,CAAC;gBACzD,OAAO,EAAE,kBAAkB;gBAC3B,OAAO,EAAE,CAAC,EAAO,kDAAkD;aACpE;YAED,0FAA0F;YAC1F,YAAY,EAAE;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,WAAW,EAAE,GAAG;gBAChB,SAAS,EAAE,gBAAgB,CAAC,iBAAiB,EAAE,cAAc,CAAC;gBAC9D,OAAO,EAAE,qBAAqB;gBAC9B,OAAO,EAAE,CAAC;aACX;YAED,8DAA8D;YAC9D,mBAAmB,EAAE;gBACnB,KAAK,EAAE,cAAc;gBACrB,WAAW,EAAE,GAAG;gBAChB,SAAS,EAAE,gBAAgB,CAAC,cAAc,EAAE,WAAW,CAAC;gBACxD,OAAO,EAAE,kBAAkB;gBAC3B,OAAO,EAAE,CAAC,EAAQ,8DAA8D;aACjF;SACF;QAED,UAAU,EAAE;YACV,wBAAwB,EAAE,IAAI;YAC9B,qBAAqB,EAAE,IAAI;YAC3B,wBAAwB,EAAE,IAAI;YAC9B,oBAAoB,EAAE,CAAC;YACvB,mBAAmB,EAAE,GAAG;SACzB;QAED,YAAY,EAAE;YACZ,mBAAmB,EAAE,IAAI;YACzB,qBAAqB,EAAE,IAAI;SAC5B;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc,mBAAmB,EAAE,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAGD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,OAAO,CACL,oBAAoB,CAAC,CAAC,CAAC;QACvB,4EAA4E,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAC1B,CAAC;AACJ,CAAC;AAID,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,KAAqB;IACnE,OAAO,CACL,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACtE,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC5C,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CACrE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,QAAkD,EAClD,OAAoD;IAEpD,MAAM,IAAI,GAA4B,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC1D,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,SAAS,CAAC;QAC/C,gEAAgE;IAClE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAoB,mBAAmB,EAAE;IAChF,OAAO;QACL,QAAQ,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE;QAC1D,UAAU,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE;QAC9D,QAAQ,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE;KACpE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAoB,mBAAmB,EAAE;IACpF,OAAO,QAAQ,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAoB,mBAAmB,EAAE;IACjF,OAAO,UAAU,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAoB,mBAAmB,EAAE;IACpF,OAAO,QAAQ,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAiB;IACjD,mEAAmE;IACnE,iEAAiE;IACjE,+DAA+D;IAC/D,mEAAmE;IACnE,2BAA2B;IAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,kEAAkE;YAClE,qDAAqD;YACrD,2CAA2C,CAC5C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,SAA8B;IAC5D,MAAM,MAAM,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAEvC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,SAAS,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAC1D,IAAI,SAAS,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAEvD,IAAI,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7F,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACnG,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC;YAC1C,MAAM,CAAC,MAAM,CAAC,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACxH,CAAC;QAED,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YACzB,MAAM,CAAC,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;YAC3B,MAAM,CAAC,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
|
@@ -38,6 +38,34 @@ import type { SkillBundle, SkillFinding } from './types.js';
|
|
|
38
38
|
export declare function buildCommentMask(lines: string[], path?: string): boolean[];
|
|
39
39
|
/** Blank out string and regex literals so a token like `eval(` inside `'eval('` or `/\\beval\\s*\\(/` is not read as code. */
|
|
40
40
|
export declare function stripLiterals(line: string): string;
|
|
41
|
+
export declare function inDefensiveContext(lines: string[], mask: boolean[], i: number, _path?: string, match?: string, radius?: number): boolean;
|
|
42
|
+
/**
|
|
43
|
+
* A JSON-schema / tool-parameter `description` string (cognium-ai#412): the credential path is
|
|
44
|
+
* documentation of a parameter, not a read. `"key_file": { "description": "Path to SSH private key
|
|
45
|
+
* file (e.g. ~/.ssh/id_rsa)" }`.
|
|
46
|
+
*/
|
|
47
|
+
export declare function isSchemaDescription(line: string): boolean;
|
|
48
|
+
/**
|
|
49
|
+
* The path appears only inside a sentence — three or more words around it in one literal — so it is
|
|
50
|
+
* being *talked about*, not opened ("No credentials stored in Reqly"). Same rule `pathIsWritten`
|
|
51
|
+
* applies to memory files, lifted so the credential class can use it too (cognium-ai#412).
|
|
52
|
+
*/
|
|
53
|
+
export declare function isProseMention(line: string, pathRe: RegExp): boolean;
|
|
54
|
+
/**
|
|
55
|
+
* The skill's OWN credential store (cognium-ai#412): a path under the product's own config
|
|
56
|
+
* directory — `~/.config/<product>/credentials.json`, `~/.<product>/credentials.json`,
|
|
57
|
+
* `os.homedir()/.config/<product>/…`, or a path built from a CONFIG_DIR/APP_DIR identifier.
|
|
58
|
+
* Reading and writing your own OAuth token file is what every OAuth client does; it is not
|
|
59
|
+
* exfiltration, whatever else the file happens to contain.
|
|
60
|
+
*/
|
|
61
|
+
export declare function isOwnCredentialStore(line: string): boolean;
|
|
62
|
+
/**
|
|
63
|
+
* The credential read reaches egress (cognium-ai#412). Co-presence in one file is not enough — the
|
|
64
|
+
* SR cohort is full of files that read their own config and, elsewhere, call the product's own API.
|
|
65
|
+
* Egress must be on the same line, within a short radius of the read, or reached through the
|
|
66
|
+
* identifier the read was assigned to.
|
|
67
|
+
*/
|
|
68
|
+
export declare function readReachesEgress(lines: string[], mask: boolean[], at: number, readOp: RegExp, radius?: number): boolean;
|
|
41
69
|
export declare function inDenylistContext(lines: string[], i: number, radius?: number): boolean;
|
|
42
70
|
/**
|
|
43
71
|
* skillsregistry#72 — decode the literals a runtime would decode, so the
|
|
@@ -57,6 +85,13 @@ export declare function decodeEncodedLiterals(content: string): {
|
|
|
57
85
|
* ordinary rendering (leading BOM, emoji ZWJ sequences). Exported for tests.
|
|
58
86
|
*/
|
|
59
87
|
export declare function covertInvisibleCodepoints(text: string): string[];
|
|
88
|
+
/**
|
|
89
|
+
* Lines inside a fenced markdown block (``` or ~~~), for SKILL.md prose detectors.
|
|
90
|
+
* A fenced block is an example being *shown* — a template, a sample header, a command
|
|
91
|
+
* transcript — not something the skill asserts about itself (cognium-ai#417 / #418).
|
|
92
|
+
*/
|
|
93
|
+
export declare function fenceMask(lines: string[]): boolean[];
|
|
94
|
+
export declare function isDeclaredDeployUpload(content: string, skillMd?: string): boolean;
|
|
60
95
|
/** The always-on / auto-attach claim in a text (SKILL.md or a listing description), or null. Shared with the marketplace scanner (SR-D2 / #260). */
|
|
61
96
|
export declare function alwaysOnClaim(text: string): string | null;
|
|
62
97
|
export declare const NARROW_CLAIM: RegExp;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"code-threat-patterns.d.ts","sourceRoot":"","sources":["../../src/skills/code-threat-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAMH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAoB,MAAM,YAAY,CAAC;AA4Q9E,+DAA+D;AAK/D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,SAAK,GAAG,OAAO,EAAE,CAkCtE;AAED,8HAA8H;AAC9H,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIlD;
|
|
1
|
+
{"version":3,"file":"code-threat-patterns.d.ts","sourceRoot":"","sources":["../../src/skills/code-threat-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAMH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAoB,MAAM,YAAY,CAAC;AA4Q9E,+DAA+D;AAK/D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,SAAK,GAAG,OAAO,EAAE,CAkCtE;AAED,8HAA8H;AAC9H,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIlD;AAyED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,EAAE,OAAO,EAAE,EACf,CAAC,EAAE,MAAM,EACT,KAAK,SAAK,EACV,KAAK,SAAK,EACV,MAAM,SAAI,GACT,OAAO,CA0BT;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAWpE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK1D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,OAAO,CAkBnH;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,OAAO,CAOjF;AAmHD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,YAAY,GAAG,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AASD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,eAAe,EAAE,CAAA;CAAE,CA8BvF;AA65BD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAqBhE;AA2HD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAYpD;AAoBD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAKjF;AAuBD,oJAAoJ;AACpJ,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMzD;AAkCD,eAAO,MAAM,YAAY,QAA2H,CAAC;AACrJ,eAAO,MAAM,UAAU,QAAiF,CAAC;AAyOzG;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAqBzD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAW7D;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,YAAY,GAAG,YAAY,CAYzE;AA2DD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY,EAAE,CA8ExE;AAiKD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY,EAAE,CA2D5E"}
|