daycare-cli 0.0.1

package/dist/plugins/shell/tool.js

@@ -0,0 +1,398 @@
+import { Type } from "@sinclair/typebox";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { resolveWorkspacePath } from "../../engine/permissions.js";
+import { sandboxAllowedDomainsResolve } from "../../sandbox/sandboxAllowedDomainsResolve.js";
+import { sandboxAllowedDomainsValidate } from "../../sandbox/sandboxAllowedDomainsValidate.js";
+import { sandboxCanRead } from "../../sandbox/sandboxCanRead.js";
+import { sandboxCanWrite } from "../../sandbox/sandboxCanWrite.js";
+import { runInSandbox } from "../../sandbox/runtime.js";
+import { sandboxFilesystemPolicyBuild } from "../../sandbox/sandboxFilesystemPolicyBuild.js";
+import { envNormalize } from "../../util/envNormalize.js";
+import { permissionTagsApply } from "../../engine/permissions/permissionTagsApply.js";
+import { permissionTagsNormalize } from "../../engine/permissions/permissionTagsNormalize.js";
+import { permissionTagsValidate } from "../../engine/permissions/permissionTagsValidate.js";
+import { isWithinSecure, openSecure } from "../../engine/permissions/pathResolveSecure.js";
+const MAX_READ_BYTES = 200_000;
+const MAX_EXEC_BUFFER = 1_000_000;
+const DEFAULT_EXEC_TIMEOUT = 30_000;
+const editItemSchema = Type.Object({
+    search: Type.String({ minLength: 1 }),
+    replace: Type.String(),
+    replaceAll: Type.Optional(Type.Boolean())
+}, { additionalProperties: false });
+const readSchema = Type.Object({
+    path: Type.String({ minLength: 1 })
+}, { additionalProperties: false });
+const writeSchema = Type.Object({
+    path: Type.String({ minLength: 1 }),
+    content: Type.String(),
+    append: Type.Optional(Type.Boolean())
+}, { additionalProperties: false });
+const editSchema = Type.Object({
+    path: Type.String({ minLength: 1 }),
+    edits: Type.Array(editItemSchema, { minItems: 1 })
+}, { additionalProperties: false });
+const envSchema = Type.Record(Type.String({ minLength: 1 }), Type.Union([Type.String(), Type.Number(), Type.Boolean()]));
+const execSchema = Type.Object({
+    command: Type.String({ minLength: 1 }),
+    cwd: Type.Optional(Type.String({ minLength: 1 })),
+    timeoutMs: Type.Optional(Type.Number({ minimum: 100, maximum: 300_000 })),
+    env: Type.Optional(envSchema),
+    home: Type.Optional(Type.String({ minLength: 1 })),
+    permissions: Type.Optional(Type.Array(Type.String({ minLength: 1 }), { minItems: 1 })),
+    packageManagers: Type.Optional(Type.Array(Type.Union([
+        Type.Literal("dart"),
+        Type.Literal("dotnet"),
+        Type.Literal("go"),
+        Type.Literal("java"),
+        Type.Literal("node"),
+        Type.Literal("php"),
+        Type.Literal("python"),
+        Type.Literal("ruby"),
+        Type.Literal("rust")
+    ]), { minItems: 1 })),
+    allowedDomains: Type.Optional(Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }))
+}, { additionalProperties: false });
+export function buildWorkspaceReadTool() {
+    return {
+        tool: {
+            name: "read",
+            description: "Read a UTF-8 text file by absolute path. If read directories are configured, the path must be within the allowed read set; otherwise any absolute path is allowed. Large files are truncated.",
+            parameters: readSchema
+        },
+        execute: async (args, toolContext, toolCall) => {
+            const payload = args;
+            const workingDir = toolContext.permissions.workingDir;
+            if (!workingDir) {
+                throw new Error("Workspace is not configured.");
+            }
+            ensureAbsolutePath(payload.path);
+            const resolved = await resolveReadPathSecure(toolContext.permissions, payload.path);
+            return handleReadSecure(resolved, workingDir, toolCall);
+        }
+    };
+}
+export function buildWorkspaceWriteTool() {
+    return {
+        tool: {
+            name: "write",
+            description: "Write UTF-8 text to a file within the agent workspace or an allowed write directory. Creates parent directories as needed. If append is true, appends to the file. Paths must be absolute and within the allowed write set.",
+            parameters: writeSchema
+        },
+        execute: async (args, toolContext, toolCall) => {
+            const payload = args;
+            const workingDir = toolContext.permissions.workingDir;
+            if (!workingDir) {
+                throw new Error("Workspace is not configured.");
+            }
+            ensureAbsolutePath(payload.path);
+            const resolved = await resolveWritePathSecure(toolContext.permissions, payload.path);
+            return handleWriteSecure(resolved, payload.content, payload.append ?? false, workingDir, toolCall);
+        }
+    };
+}
+export function buildWorkspaceEditTool() {
+    return {
+        tool: {
+            name: "edit",
+            description: "Apply one or more find/replace edits to a file in the agent workspace or an allowed write directory. Edits are applied sequentially and must match at least once. Paths must be absolute and within the allowed write set.",
+            parameters: editSchema
+        },
+        execute: async (args, toolContext, toolCall) => {
+            const payload = args;
+            const workingDir = toolContext.permissions.workingDir;
+            if (!workingDir) {
+                throw new Error("Workspace is not configured.");
+            }
+            ensureAbsolutePath(payload.path);
+            const resolved = await resolveWritePathSecure(toolContext.permissions, payload.path);
+            return handleEditSecure(resolved, payload.edits, workingDir, toolCall);
+        }
+    };
+}
+export function buildExecTool() {
+    return {
+        tool: {
+            name: "exec",
+            description: "Execute a shell command inside the agent workspace (or a subdirectory). The cwd, if provided, must be an absolute path that resolves inside the workspace. By default exec runs with no network and no write grants. Reads are always allowed (except protected deny-list paths). Use explicit permission tags to re-enable caller-held network or writable path access; @read tags are ignored. Writes are sandboxed to the allowed write directories. Optional home (absolute path within allowed write directories) remaps HOME and related env vars for sandboxed execution. Optional packageManagers language presets auto-allow ecosystem hosts (dart/dotnet/go/java/node/php/python/ruby/rust). Optional allowedDomains enables outbound access to specific domains (supports subdomain wildcards like *.example.com, no global wildcard). Returns stdout/stderr and failure details.",
+            parameters: execSchema
+        },
+        execute: async (args, toolContext, toolCall) => {
+            const payload = args;
+            const workingDir = toolContext.permissions.workingDir;
+            if (!workingDir) {
+                throw new Error("Workspace is not configured.");
+            }
+            const permissions = await resolveExecPermissions(toolContext.permissions, payload.permissions);
+            if (payload.cwd) {
+                ensureAbsolutePath(payload.cwd);
+            }
+            if (payload.home) {
+                ensureAbsolutePath(payload.home);
+            }
+            const cwd = payload.cwd
+                ? resolveWorkspacePath(workingDir, payload.cwd)
+                : workingDir;
+            const home = payload.home
+                ? await resolveWritePathSecure(permissions, payload.home)
+                : undefined;
+            const allowedDomains = sandboxAllowedDomainsResolve(payload.allowedDomains, payload.packageManagers);
+            const domainIssues = sandboxAllowedDomainsValidate(allowedDomains, permissions.network);
+            if (domainIssues.length > 0) {
+                throw new Error(domainIssues.join(" "));
+            }
+            const envOverrides = envNormalize(payload.env);
+            const env = envOverrides ? { ...process.env, ...envOverrides } : process.env;
+            const timeout = payload.timeoutMs ?? DEFAULT_EXEC_TIMEOUT;
+            const sandboxConfig = buildSandboxConfig(permissions, allowedDomains);
+            try {
+                const result = await runInSandbox(payload.command, sandboxConfig, {
+                    cwd,
+                    env,
+                    home,
+                    timeoutMs: timeout,
+                    maxBufferBytes: MAX_EXEC_BUFFER
+                });
+                const stdout = toText(result.stdout);
+                const stderr = toText(result.stderr);
+                const text = formatExecOutput(stdout, stderr, false);
+                const toolMessage = buildToolMessage(toolCall, text, false, {
+                    cwd: path.relative(workingDir, cwd) || "."
+                });
+                return { toolMessage, files: [] };
+            }
+            catch (error) {
+                const execError = error;
+                const stdout = toText(execError.stdout);
+                const stderr = toText(execError.stderr);
+                const text = formatExecOutput(stdout, stderr, true);
+                const toolMessage = buildToolMessage(toolCall, text, true, {
+                    cwd: path.relative(workingDir, cwd) || ".",
+                    exitCode: execError.code ?? null,
+                    signal: execError.signal ?? null
+                });
+                return { toolMessage, files: [] };
+            }
+        }
+    };
+}
+/**
+ * Secure read handler that uses lstat + openSecure to prevent TOCTOU attacks.
+ * The path has already been securely resolved (symlinks followed, containment verified).
+ */
+async function handleReadSecure(resolvedPath, workingDir, toolCall) {
+    // Use lstat to check file type without following symlinks
+    const stats = await fs.lstat(resolvedPath);
+    if (stats.isSymbolicLink()) {
+        throw new Error("Cannot read symbolic link directly.");
+    }
+    if (!stats.isFile()) {
+        throw new Error("Path is not a file.");
+    }
+    let content = "";
+    let truncated = false;
+    // Use openSecure to prevent TOCTOU race between stat and read
+    const handle = await openSecure(resolvedPath, "r");
+    try {
+        const handleStats = await handle.stat();
+        if (handleStats.size > MAX_READ_BYTES) {
+            const buffer = Buffer.alloc(MAX_READ_BYTES);
+            await handle.read(buffer, 0, MAX_READ_BYTES, 0);
+            content = buffer.toString("utf8");
+            truncated = true;
+        }
+        else {
+            content = await handle.readFile("utf8");
+        }
+    }
+    finally {
+        await handle.close();
+    }
+    const displayPath = formatDisplayPath(workingDir, resolvedPath);
+    const suffix = truncated
+        ? `\n[truncated to ${MAX_READ_BYTES} bytes from ${stats.size}]`
+        : "";
+    const text = `File: ${displayPath}\n${content}${suffix}`;
+    const toolMessage = buildToolMessage(toolCall, text, false, {
+        action: "read",
+        path: displayPath,
+        bytes: stats.size,
+        truncated
+    });
+    return { toolMessage, files: [] };
+}
+/**
+ * Secure write handler that prevents TOCTOU attacks.
+ * The path has already been securely resolved (symlinks followed, containment verified).
+ */
+async function handleWriteSecure(resolvedPath, content, append, workingDir, toolCall) {
+    await fs.mkdir(path.dirname(resolvedPath), { recursive: true });
+    // Check if target is a symlink before writing
+    try {
+        const stats = await fs.lstat(resolvedPath);
+        if (stats.isSymbolicLink()) {
+            throw new Error("Cannot write to symbolic link.");
+        }
+    }
+    catch (error) {
+        // File doesn't exist yet - OK for write operations
+        if (error.code !== "ENOENT") {
+            throw error;
+        }
+    }
+    // Use atomic file operations via file handle
+    const flags = append ? "a" : "w";
+    const handle = await fs.open(resolvedPath, flags);
+    try {
+        await handle.writeFile(content, "utf8");
+    }
+    finally {
+        await handle.close();
+    }
+    const bytes = Buffer.byteLength(content, "utf8");
+    const displayPath = formatDisplayPath(workingDir, resolvedPath);
+    const text = `${append ? "Appended" : "Wrote"} ${bytes} bytes to ${displayPath}.`;
+    const toolMessage = buildToolMessage(toolCall, text, false, {
+        action: "write",
+        path: displayPath,
+        bytes,
+        append
+    });
+    return { toolMessage, files: [] };
+}
+/**
+ * Secure edit handler that prevents TOCTOU attacks.
+ * Uses file handle to ensure atomic read-modify-write operations.
+ */
+async function handleEditSecure(resolvedPath, edits, workingDir, toolCall) {
+    // Check if target is a symlink
+    const stats = await fs.lstat(resolvedPath);
+    if (stats.isSymbolicLink()) {
+        throw new Error("Cannot edit symbolic link.");
+    }
+    // Open with r+ for read-modify-write atomicity
+    const handle = await fs.open(resolvedPath, "r+");
+    try {
+        const original = await handle.readFile("utf8");
+        let updated = original;
+        const counts = [];
+        for (const edit of edits) {
+            const { next, count } = applyEdit(updated, edit);
+            if (count === 0) {
+                const preview = edit.search.length > 80 ? `${edit.search.slice(0, 77)}...` : edit.search;
+                throw new Error(`Edit not applied: "${preview}" not found.`);
+            }
+            counts.push(count);
+            updated = next;
+        }
+        // Truncate and write from beginning
+        await handle.truncate(0);
+        await handle.write(updated, 0, "utf8");
+        const displayPath = formatDisplayPath(workingDir, resolvedPath);
+        const summary = counts
+            .map((count, index) => `edit ${index + 1}: ${count} replacement${count === 1 ? "" : "s"}`)
+            .join(", ");
+        const text = `Updated ${displayPath} (${summary}).`;
+        const toolMessage = buildToolMessage(toolCall, text, false, {
+            action: "edit",
+            path: displayPath,
+            edits: counts
+        });
+        return { toolMessage, files: [] };
+    }
+    finally {
+        await handle.close();
+    }
+}
+function applyEdit(input, edit) {
+    if (edit.replaceAll) {
+        const parts = input.split(edit.search);
+        const count = parts.length - 1;
+        return {
+            next: parts.join(edit.replace),
+            count
+        };
+    }
+    const index = input.indexOf(edit.search);
+    if (index === -1) {
+        return { next: input, count: 0 };
+    }
+    const next = input.slice(0, index) + edit.replace + input.slice(index + edit.search.length);
+    return { next, count: 1 };
+}
+function buildToolMessage(toolCall, text, isError, details) {
+    return {
+        role: "toolResult",
+        toolCallId: toolCall.id,
+        toolName: toolCall.name,
+        content: [{ type: "text", text }],
+        details,
+        isError,
+        timestamp: Date.now()
+    };
+}
+function toText(value) {
+    if (!value) {
+        return "";
+    }
+    return typeof value === "string" ? value : value.toString("utf8");
+}
+function formatExecOutput(stdout, stderr, failed) {
+    const parts = [];
+    if (stdout.trim().length > 0) {
+        parts.push(`stdout:\n${stdout.trimEnd()}`);
+    }
+    if (stderr.trim().length > 0) {
+        parts.push(`stderr:\n${stderr.trimEnd()}`);
+    }
+    if (parts.length === 0) {
+        return failed ? "Command failed with no output." : "Command completed with no output.";
+    }
+    return parts.join("\n\n");
+}
+function ensureAbsolutePath(target) {
+    if (!path.isAbsolute(target)) {
+        throw new Error("Path must be absolute.");
+    }
+}
+async function resolveWritePathSecure(permissions, target) {
+    return sandboxCanWrite(permissions, target);
+}
+async function resolveReadPathSecure(permissions, target) {
+    return sandboxCanRead(permissions, target);
+}
+function formatDisplayPath(workingDir, target) {
+    if (isWithinSecure(workingDir, target)) {
+        return path.relative(workingDir, target) || ".";
+    }
+    return target;
+}
+function buildSandboxConfig(permissions, allowedDomains) {
+    const filesystem = sandboxFilesystemPolicyBuild({ permissions });
+    return {
+        filesystem,
+        network: {
+            allowedDomains,
+            deniedDomains: []
+        }
+    };
+}
+async function resolveExecPermissions(currentPermissions, requestedTags) {
+    const execPermissions = {
+        workingDir: currentPermissions.workingDir,
+        writeDirs: [],
+        readDirs: [],
+        network: false
+    };
+    if (!requestedTags || requestedTags.length === 0) {
+        return execPermissions;
+    }
+    const permissionTags = permissionTagsNormalize(requestedTags);
+    const nonReadTags = permissionTags.filter((tag) => !tag.startsWith("@read:"));
+    await permissionTagsValidate(currentPermissions, nonReadTags);
+    permissionTagsApply(execPermissions, nonReadTags);
+    execPermissions.readDirs = [];
+    return execPermissions;
+}
+//# sourceMappingURL=tool.js.map

package/dist/plugins/shell/tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool.js","sourceRoot":"","sources":["../../../sources/plugins/shell/tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAC9F,OAAO,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AAC5F,OAAO,EACL,cAAc,EACd,UAAU,EACX,MAAM,+CAA+C,CAAC;AAEvD,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,eAAe,GAAG,SAAS,CAAC;AAClC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAChC;IACE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACrC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;CAC1C,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAEF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAC5B;IACE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;CACpC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAEF,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAC7B;IACE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACnC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;IACtB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;CACtC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAEF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAC5B;IACE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACnC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;CACnD,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAOF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAC3B,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAC7B,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAC3D,CAAC;AAEF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAC5B;IACE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACtC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACjD,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACzE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACtF,eAAe,EAAE,IAAI,CAAC,QAAQ,CAC5B,IAAI,CAAC,KAAK,CACR,IAAI,CAAC,KAAK,CAAC;QACT,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;KACrB,CAAC,EACF,EAAE,QAAQ,EAAE,CAAC,EAAE,CAChB,CACF;IACD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAC3B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAC3D;CACF,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAIF,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,WAAW,EACT,+LAA+L;YACjM,UAAU,EAAE,UAAU;SACvB;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,IAAgB,CAAC;YACjC,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC;YACtD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YACD,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACpF,OAAO,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,IAAI,EAAE;YACJ,IAAI,EAAE,OAAO;YACb,WAAW,EACT,6NAA6N;YAC/N,UAAU,EAAE,WAAW;SACxB;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,IAAiB,CAAC;YAClC,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC;YACtD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YACD,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACrF,OAAO,iBAAiB,CACtB,QAAQ,EACR,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,MAAM,IAAI,KAAK,EACvB,UAAU,EACV,QAAQ,CACT,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,WAAW,EACT,4NAA4N;YAC9N,UAAU,EAAE,UAAU;SACvB;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,IAAgB,CAAC;YACjC,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC;YACtD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YACD,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACrF,OAAO,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,WAAW,EACT,81BAA81B;YACh2B,UAAU,EAAE,UAAU;SACvB;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,IAAgB,CAAC;YACjC,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC;YACtD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC9C,WAAW,CAAC,WAAW,EACvB,OAAO,CAAC,WAAW,CACpB,CAAC;YACF,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG;gBACrB,CAAC,CAAC,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC;gBAC/C,CAAC,CAAC,UAAU,CAAC;YACf,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI;gBACvB,CAAC,CAAC,MAAM,sBAAsB,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC;gBACzD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,cAAc,GAAG,4BAA4B,CACjD,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,eAAe,CACxB,CAAC;YACF,MAAM,YAAY,GAAG,6BAA6B,CAChD,cAAc,EACd,WAAW,CAAC,OAAO,CACpB,CAAC;YACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,oBAAoB,CAAC;YAC1D,MAAM,aAAa,GAAG,kBAAkB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YAEtE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE;oBAChE,GAAG;oBACH,GAAG;oBACH,IAAI;oBACJ,SAAS,EAAE,OAAO;oBAClB,cAAc,EAAE,eAAe;iBAChC,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACrC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAErC,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;gBACrD,MAAM,WAAW,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;oBAC1D,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,GAAG;iBAC3C,CAAC,CAAC;gBACH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACpC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,SAAS,GAAG,KAKjB,CAAC;gBACF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE;oBACzD,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,GAAG;oBAC1C,QAAQ,EAAE,SAAS,CAAC,IAAI,IAAI,IAAI;oBAChC,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI;iBACjC,CAAC,CAAC;gBACH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAC7B,YAAoB,EACpB,UAAkB,EAClB,QAAsC;IAEtC,0DAA0D;IAC1D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,8DAA8D;IAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,WAAW,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAC5C,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;YAChD,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAClC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,WAAW,GAAG,iBAAiB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,SAAS;QACtB,CAAC,CAAC,mBAAmB,cAAc,eAAe,KAAK,CAAC,IAAI,GAAG;QAC/D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,IAAI,GAAG,SAAS,WAAW,KAAK,OAAO,GAAG,MAAM,EAAE,CAAC;IAEzD,MAAM,WAAW,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,SAAS;KACV,CAAC,CAAC;IAEH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAC9B,YAAoB,EACpB,OAAe,EACf,MAAe,EACf,UAAkB,EAClB,QAAsC;IAEtC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhE,8CAA8C;IAC9C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mDAAmD;QACnD,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,iBAAiB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,aAAa,WAAW,GAAG,CAAC;IAClF,MAAM,WAAW,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;QAC1D,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,WAAW;QACjB,KAAK;QACL,MAAM;KACP,CAAC,CAAC;IACH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAC7B,YAAoB,EACpB,KAAiB,EACjB,UAAkB,EAClB,QAAsC;IAEtC,+BAA+B;IAC/B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,OAAO,GAAG,QAAQ,CAAC;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;gBACzF,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,cAAc,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAED,oCAAoC;QACpC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAEvC,MAAM,WAAW,GAAG,iBAAiB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM;aACnB,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,KAAK,GAAG,CAAC,KAAK,KAAK,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;aACzF,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,GAAG,WAAW,WAAW,KAAK,OAAO,IAAI,CAAC;QACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,IAAc;IAC9C,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAC9B,KAAK;SACN,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,IAAI,GACR,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAsC,EACtC,IAAY,EACZ,OAAgB,EAChB,OAAiC;IAEjC,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,OAAO;QACP,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAkC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,MAAc,EAAE,MAAe;IACvE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,mCAAmC,CAAC;IACzF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,WAA+B,EAC/B,MAAc;IAEd,OAAO,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,WAA+B,EAC/B,MAAc;IAEd,OAAO,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB,EAAE,MAAc;IAC3D,IAAI,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,WAA+B,EAAE,cAAwB;IACnF,MAAM,UAAU,GAAG,4BAA4B,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACjE,OAAO;QACL,UAAU;QACV,OAAO,EAAE;YACP,cAAc;YACd,aAAa,EAAE,EAAE;SAClB;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,kBAAsC,EACtC,aAAmC;IAEnC,MAAM,eAAe,GAAuB;QAC1C,UAAU,EAAE,kBAAkB,CAAC,UAAU;QACzC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK;KACf,CAAC;IACF,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,MAAM,cAAc,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,MAAM,sBAAsB,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;IAC9D,mBAAmB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IAClD,eAAe,CAAC,QAAQ,GAAG,EAAE,CAAC;IAC9B,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/plugins/shell/tool.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tool.spec.d.ts.map

package/dist/plugins/shell/tool.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool.spec.d.ts","sourceRoot":"","sources":["../../../sources/plugins/shell/tool.spec.ts"],"names":[],"mappings":""}

package/dist/plugins/shell/tool.spec.js

@@ -0,0 +1,234 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { buildExecTool, buildWorkspaceReadTool } from "./tool.js";
+import { Agent } from "../../engine/agents/agent.js";
+import { AgentInbox } from "../../engine/agents/ops/agentInbox.js";
+import { agentDescriptorBuild } from "../../engine/agents/ops/agentDescriptorBuild.js";
+import { createId } from "@paralleldrive/cuid2";
+const execToolCall = { id: "tool-call-1", name: "exec" };
+const readToolCall = { id: "tool-call-2", name: "read" };
+describe("read tool allowed paths", () => {
+    let workingDir;
+    let outsideDir;
+    let outsideFile;
+    beforeEach(async () => {
+        workingDir = await fs.mkdtemp(path.join(os.tmpdir(), "read-tool-workspace-"));
+        outsideDir = await fs.mkdtemp(path.join(os.tmpdir(), "read-tool-outside-"));
+        outsideFile = path.join(outsideDir, "outside.txt");
+        await fs.writeFile(outsideFile, "outside-content", "utf8");
+    });
+    afterEach(async () => {
+        await fs.rm(workingDir, { recursive: true, force: true });
+        await fs.rm(outsideDir, { recursive: true, force: true });
+    });
+    it("allows reading any absolute path when readDirs is empty", async () => {
+        const tool = buildWorkspaceReadTool();
+        const context = createContext(workingDir, false);
+        const result = await tool.execute({ path: outsideFile }, context, readToolCall);
+        const text = result.toolMessage.content
+            .filter((item) => item.type === "text")
+            .map((item) => item.text)
+            .join("\n");
+        expect(result.toolMessage.isError).toBe(false);
+        expect(text).toContain("outside-content");
+    });
+    it("allows reading outside workspace even when readDirs are configured", async () => {
+        const tool = buildWorkspaceReadTool();
+        const context = createContext(workingDir, false, [workingDir]);
+        const result = await tool.execute({ path: outsideFile }, context, readToolCall);
+        const text = result.toolMessage.content
+            .filter((item) => item.type === "text")
+            .map((item) => item.text)
+            .join("\n");
+        expect(result.toolMessage.isError).toBe(false);
+        expect(text).toContain("outside-content");
+    });
+    it("allows reading write-granted files when readDirs are restricted", async () => {
+        const tool = buildWorkspaceReadTool();
+        const context = createContext(workingDir, false, [workingDir], [outsideFile]);
+        const result = await tool.execute({ path: outsideFile }, context, readToolCall);
+        const text = result.toolMessage.content
+            .filter((item) => item.type === "text")
+            .map((item) => item.text)
+            .join("\n");
+        expect(result.toolMessage.isError).toBe(false);
+        expect(text).toContain("outside-content");
+    });
+});
+describe("exec tool allowedDomains", () => {
+    let workingDir;
+    beforeEach(async () => {
+        workingDir = await fs.mkdtemp(path.join(os.tmpdir(), "exec-tool-test-"));
+    });
+    afterEach(async () => {
+        await fs.rm(workingDir, { recursive: true, force: true });
+    });
+    it("throws when allowedDomains provided without network permission", async () => {
+        const tool = buildExecTool();
+        const context = createContext(workingDir, false);
+        await expect(tool.execute({ command: "echo ok", allowedDomains: ["example.com"] }, context, execToolCall)).rejects.toThrow("Network permission is required");
+    });
+    it("throws when packageManagers provided without network permission", async () => {
+        const tool = buildExecTool();
+        const context = createContext(workingDir, false);
+        await expect(tool.execute({ command: "echo ok", packageManagers: ["node"] }, context, execToolCall)).rejects.toThrow("Network permission is required");
+    });
+    it("throws when allowedDomains includes '*'", async () => {
+        const tool = buildExecTool();
+        const context = createContext(workingDir, true);
+        await expect(tool.execute({ command: "echo ok", allowedDomains: ["*"] }, context, execToolCall)).rejects.toThrow("Wildcard");
+    });
+    it("uses zero permissions by default when none are provided", async () => {
+        const tool = buildExecTool();
+        const context = createContext(workingDir, true);
+        await expect(tool.execute({ command: "echo ok", allowedDomains: ["example.com"] }, context, execToolCall)).rejects.toThrow("Network permission is required");
+    });
+    it("ignores @read tags in exec permissions", async () => {
+        const tool = buildExecTool();
+        const context = createContext(workingDir, false, [workingDir], []);
+        const result = await tool.execute({
+            command: "echo ok",
+            permissions: ["@read:/etc"]
+        }, context, execToolCall);
+        const text = result.toolMessage.content
+            .filter((item) => item.type === "text")
+            .map((item) => item.text)
+            .join("\n");
+        expect(result.toolMessage.isError).toBe(false);
+        expect(text).toContain("stdout:\nok");
+    });
+    it("allows reading outside workspace by default", async () => {
+        const tool = buildExecTool();
+        const context = createContext(workingDir, false);
+        const outsideDir = await fs.mkdtemp(path.join(os.tmpdir(), "exec-tool-outside-"));
+        const outsideFile = path.join(outsideDir, "outside.txt");
+        await fs.writeFile(outsideFile, "outside-content", "utf8");
+        try {
+            const result = await tool.execute({
+                command: `cat \"${outsideFile}\"`
+            }, context, execToolCall);
+            const text = result.toolMessage.content
+                .filter((item) => item.type === "text")
+                .map((item) => item.text)
+                .join("\n");
+            expect(result.toolMessage.isError).toBe(false);
+            expect(text).toContain("outside-content");
+        }
+        finally {
+            await fs.rm(outsideDir, { recursive: true, force: true });
+        }
+    });
+    it("only allows exact domain unless wildcard subdomain is listed", async () => {
+        const tool = buildExecTool();
+        const context = createContext(workingDir, true);
+        const allowedResult = await tool.execute({
+            command: "curl -I -sS https://google.com",
+            allowedDomains: ["google.com"],
+            permissions: ["@network"],
+            timeoutMs: 30_000
+        }, context, execToolCall);
+        const allowedText = allowedResult.toolMessage.content
+            .filter((item) => item.type === "text")
+            .map((item) => item.text)
+            .join("\n");
+        expect(allowedResult.toolMessage.isError).toBe(false);
+        expect(allowedText).toContain("HTTP/");
+        const blockedResult = await tool.execute({
+            command: "curl -I -sS https://www.google.com",
+            allowedDomains: ["google.com"],
+            permissions: ["@network"],
+            timeoutMs: 30_000
+        }, context, execToolCall);
+        const blockedText = blockedResult.toolMessage.content
+            .filter((item) => item.type === "text")
+            .map((item) => item.text)
+            .join("\n");
+        expect(blockedResult.toolMessage.isError).toBe(true);
+        expect(blockedText).toContain("CONNECT tunnel failed");
+    });
+    it("maps HOME to provided home path", async () => {
+        const tool = buildExecTool();
+        const context = createContext(workingDir, false, [], [workingDir]);
+        const home = path.join(workingDir, ".daycare-home");
+        const result = await tool.execute({
+            command: "printf '%s' \"$HOME\"",
+            home,
+            permissions: [`@write:${workingDir}`]
+        }, context, execToolCall);
+        const text = result.toolMessage.content
+            .filter((item) => item.type === "text")
+            .map((item) => item.text)
+            .join("\n");
+        const expectedHome = await fs.realpath(home);
+        expect(result.toolMessage.isError).toBe(false);
+        expect(text).toContain(`stdout:\n${expectedHome}`);
+    });
+    it("rejects HOME path when not write-granted", async () => {
+        const tool = buildExecTool();
+        const context = createContext(workingDir, false);
+        const home = path.join(workingDir, ".daycare-home");
+        await expect(tool.execute({
+            command: "echo ok",
+            home
+        }, context, execToolCall)).rejects.toThrow("Path is outside the allowed directories.");
+    });
+    it("does not mutate tool context permissions", async () => {
+        const tool = buildExecTool();
+        const writeDir = await fs.mkdtemp(path.join(os.tmpdir(), "exec-tool-write-scope-"));
+        const context = createContext(workingDir, true, [workingDir], [workingDir, writeDir]);
+        const original = {
+            workingDir: context.permissions.workingDir,
+            writeDirs: [...context.permissions.writeDirs],
+            readDirs: [...context.permissions.readDirs],
+            network: context.permissions.network
+        };
+        try {
+            const result = await tool.execute({
+                command: "echo ok",
+                permissions: ["@network", `@write:${writeDir}`]
+            }, context, execToolCall);
+            expect(result.toolMessage.isError).toBe(false);
+            expect(context.permissions).toEqual(original);
+        }
+        finally {
+            await fs.rm(writeDir, { recursive: true, force: true });
+        }
+    });
+});
+function createContext(workingDir, network, readDirs = [], writeDirs = []) {
+    const agentId = createId();
+    const messageContext = {};
+    const descriptor = agentDescriptorBuild("system", messageContext, agentId);
+    const now = Date.now();
+    const state = {
+        context: { messages: [] },
+        permissions: {
+            workingDir,
+            writeDirs: writeDirs.map((entry) => path.resolve(entry)),
+            readDirs: readDirs.map((entry) => path.resolve(entry)),
+            network
+        },
+        tokens: null,
+        stats: {},
+        createdAt: now,
+        updatedAt: now,
+        state: "active"
+    };
+    const agent = Agent.restore(agentId, descriptor, state, new AgentInbox(agentId), {});
+    return {
+        connectorRegistry: null,
+        fileStore: null,
+        auth: null,
+        logger: console,
+        assistant: null,
+        permissions: state.permissions,
+        agent,
+        source: "test",
+        messageContext,
+        agentSystem: null,
+        heartbeats: null
+    };
+}
+//# sourceMappingURL=tool.spec.js.map