frely-cli 0.11.2 → 0.12.2

package/dist/runtime/protected-paths.js

@@ -1,9 +1,7 @@
 import { homedir } from "node:os";
 import { join, sep } from "node:path";
 import { realpathSync } from "node:fs";
-import { SENSITIVE_PATH_GROUPS, sensitiveReadPaths } from "./sandbox.js";
-/** Shell start-up files: a remote file tool must not plant commands that run at the owner's next login. */
-const SHELL_STARTUP_FILES = [".zshrc", ".zshenv", ".zprofile", ".zlogin", ".bashrc", ".bash_profile", ".bash_login", ".profile", ".config/fish/config.fish"].map((name) => `~/${name}`);
+import { protectedWriteDenials, SENSITIVE_PATH_GROUPS, sensitiveReadPaths } from "./sandbox.js";
 function expand(path) {
     return path.startsWith("~/") ? join(homedir(), path.slice(2)) : path;
 }
@@ -43,7 +41,10 @@ function under(path, base) {
  */
 export function pathProtection(grants = []) {
     const readRoots = sensitiveReadPaths(grants).flatMap(variants);
-    const writeRoots = [...Object.values(SENSITIVE_PATH_GROUPS).flat(), ...sensitiveReadPaths(), ...SHELL_STARTUP_FILES].flatMap(variants);
+    // Same protected list as the command sandbox. A `path:` grant (extra writable directory for commands) does not lift it for file
+    // tools: they check readability before writing, and `path:` must not open reads. Reading a credential store (the `ssh` group)
+    // never allows writing it. sensitiveReadPaths(all groups) leaves just the never-openable paths.
+    const writeRoots = [...protectedWriteDenials([]), ...sensitiveReadPaths(Object.keys(SENSITIVE_PATH_GROUPS))].flatMap(variants);
     return {
         readBlocked: (path) => readRoots.some((root) => under(path, root)),
         writeBlocked: (path) => writeRoots.some((root) => under(path, root)),

package/dist/runtime/protected-paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"protected-paths.js","sourceRoot":"","sources":["../../src/runtime/protected-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEzE,2GAA2G;AAC3G,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAExL,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,qGAAqG;AACrG,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,IAAI,IAAI;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,IAAY;IACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;IAC3F,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAClF,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAA4B,EAAE;IAC3D,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,kBAAkB,EAAE,EAAE,GAAG,mBAAmB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvI,OAAO;QACL,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;KACrE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"protected-paths.js","sourceRoot":"","sources":["../../src/runtime/protected-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEhG,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,qGAAqG;AACrG,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,IAAI,IAAI;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,IAAY;IACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;IAC3F,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAClF,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAA4B,EAAE;IAC3D,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,gIAAgI;IAChI,8HAA8H;IAC9H,gGAAgG;IAChG,MAAM,UAAU,GAAG,CAAC,GAAG,qBAAqB,CAAC,EAAE,CAAC,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/H,OAAO;QACL,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;KACrE,CAAC;AACJ,CAAC"}

package/dist/runtime/sandbox.d.ts

@@ -32,15 +32,51 @@ import { type SandboxRuntimeConfig } from "@anthropic-ai/sandbox-runtime";
  * (relay `request_permission`). The group names are the relay's catalog; the paths stay on the device.
  */
 export declare const SENSITIVE_PATH_GROUPS: Readonly<Record<string, readonly string[]>>;
+/**
+ * Build-tool cache directories a remote client may be allowed to write after the owner approves them on the web.
+ * Caches only: nothing here holds credentials or start-up scripts.
+ */
+export declare const WRITABLE_PATH_GROUPS: Readonly<Record<string, readonly string[]>>;
+/**
+ * Grant name for a command that must make raw outbound connections (ssh to a host, database clients, nc). The command then runs
+ * without the sandbox at all, because the sandbox can only route HTTP(S) and SOCKS traffic. Opened only by the owner, for a limited time.
+ */
+export declare const UNSANDBOXED_GROUP = "unsandboxed";
+/**
+ * Protected paths: credential stores, shell start-up files and launch agents (the latter would let a command outlive the call).
+ * They are always denied for writing, even inside a granted parent such as `path:~/`. Only a grant naming one of them exactly
+ * (`path:~/.ssh`) lifts the denial for that path; a parent or a sub-path does not.
+ */
+export declare const PROTECTED_PATHS: readonly string[];
+/** The expanded path of a `path:` grant name, or undefined when it is not allowed. */
+export declare function customWritePath(name: string): string | undefined;
+/** Paths a sandboxed command may never write: every protected path except those named exactly by an approved grant, plus Frely's own credentials. */
+export declare function protectedWriteDenials(allowedGroups: readonly string[]): string[];
+/** Whether `name` is a grant name this CLI understands. */
+export declare function isKnownGrantName(name: string): boolean;
 /** Request `_meta` key the relay sets on a tools/call with the approved group names; the relay overwrites anything a client sent. */
 export declare const PATH_GRANTS_META_KEY = "frely/pathGrants";
-/** Approved group names from a tools/call `_meta`; unknown names are dropped. */
+/** Approved grant names from a tools/call `_meta`: credential groups to read, cache groups or `path:` directories to write, or `unsandboxed`. Unknown names are dropped. */
 export declare function pathGrantsFromMeta(meta: unknown): string[];
 export declare function sensitiveReadPaths(allowedGroups?: readonly string[]): string[];
 export declare function isSandboxDisabled(): boolean;
 export declare function isSandboxStrict(): boolean;
 /** Best-effort report of the sandbox backend for device capability frames (plan §4.3). */
 export declare function detectSandboxBackend(): "srt" | "off" | "none";
+/** Extra directories commands may write under, from the approved cache groups and custom `path:` grants. */
+export declare function writablePaths(allowedGroups: readonly string[]): string[];
+/**
+ * Defines ssh, scp and sftp in front of a command so they reach the network through the sandbox's SOCKS or HTTP proxy.
+ * srt already exports that wiring as GIT_SSH_COMMAND for git; plain ssh makes a direct connection, which the sandbox refuses.
+ * Covers the command text itself; a script that starts ssh on its own should use `$GIT_SSH_COMMAND`.
+ */
+export declare const SSH_PROXY_PREFIX: string;
+/**
+ * On macOS srt points GIT_SSH_COMMAND at `nc -X 5` (SOCKS5), which cannot send the sandbox proxy's credentials, so git over ssh fails
+ * whenever the proxy requires authentication. When HTTP_PROXY carries credentials, this swaps in `frely ssh-proxy`, an HTTP CONNECT
+ * relay that reads them from the environment. Other platforms keep srt's own setting (Linux uses socat with proxyauth).
+ */
+export declare function sshProxyPrefix(platform?: string, helper?: readonly string[]): string;
 export declare function buildSandboxConfig(workspaceRoot: string, allowedGroups?: readonly string[]): SandboxRuntimeConfig;
 /**
  * Wrap a shell command with sandbox restrictions before it is spawned with
@@ -50,5 +86,10 @@ export declare function buildSandboxConfig(workspaceRoot: string, allowedGroups?
  * instead of silently running the command unsandboxed.
  */
 export declare function sandboxCommand(command: string, workspaceRoot: string, allowedGroups?: readonly string[]): Promise<string>;
+/**
+ * Hint for a failed sandboxed command whose stderr looks like a sandbox denial, so the caller asks the owner for approval
+ * (request_permission) instead of giving up on a bare "Operation not permitted".
+ */
+export declare function sandboxDenialHint(stderr: string): string | undefined;
 /** Exposed for tests: resets the module-level init state and the underlying manager. */
 export declare function resetSandboxForTests(): Promise<void>;

package/dist/runtime/sandbox.js

@@ -1,5 +1,8 @@
-import { tmpdir } from "node:os";
+import { realpathSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { isAbsolute, join, normalize, parse, sep } from "node:path";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
+import { cliLaunchArguments } from "../cli-launch.js";
 /**
  * OS-level sandboxing for `run_command` / `start_process`.
  *
@@ -42,16 +45,86 @@ export const SENSITIVE_PATH_GROUPS = {
     "git-credentials": ["~/.git-credentials", "~/.netrc"],
     "npm-tokens": ["~/.npmrc", "~/.pypirc", "~/.cargo/credentials.toml"],
 };
+/**
+ * Build-tool cache directories a remote client may be allowed to write after the owner approves them on the web.
+ * Caches only: nothing here holds credentials or start-up scripts.
+ */
+export const WRITABLE_PATH_GROUPS = {
+    "pub-cache": ["~/.pub-cache"],
+    gradle: ["~/.gradle"],
+    "npm-cache": ["~/.npm"],
+    "bun-cache": ["~/.bun"],
+    "cargo-cache": ["~/.cargo/registry", "~/.cargo/git"],
+    cocoapods: ["~/.cocoapods", "~/Library/Caches/CocoaPods"],
+    "user-cache": ["~/.cache", "~/Library/Caches"],
+};
+/**
+ * Grant name for a command that must make raw outbound connections (ssh to a host, database clients, nc). The command then runs
+ * without the sandbox at all, because the sandbox can only route HTTP(S) and SOCKS traffic. Opened only by the owner, for a limited time.
+ */
+export const UNSANDBOXED_GROUP = "unsandboxed";
+/** Owner-chosen writable directory, sent as `path:<absolute or ~/ path>`. */
+const CUSTOM_PATH_PREFIX = "path:";
+/**
+ * Protected paths: credential stores, shell start-up files and launch agents (the latter would let a command outlive the call).
+ * They are always denied for writing, even inside a granted parent such as `path:~/`. Only a grant naming one of them exactly
+ * (`path:~/.ssh`) lifts the denial for that path; a parent or a sub-path does not.
+ */
+export const PROTECTED_PATHS = [
+    "~/.ssh", "~/.gnupg", "~/.aws", "~/.kube", "~/.docker", "~/.config/gcloud", "~/.config/gh",
+    "~/.zshrc", "~/.zshenv", "~/.zprofile", "~/.zlogin", "~/.bashrc", "~/.bash_profile", "~/.bash_login", "~/.profile", "~/.config/fish",
+    "~/Library/LaunchAgents", "/Library/LaunchAgents", "/Library/LaunchDaemons", "~/.git-credentials", "~/.netrc", "~/.npmrc", "~/.pypirc",
+    "~/.cargo/credentials.toml", "~/Library/Application Support/gcloud",
+];
+/** Frely's own device credentials: never writable by a grant, not even an exact one. */
+const NEVER_WRITABLE_PATHS = ["~/.config/frely"];
+/** Longest path after `path:`. Keep equal to the relay's `PATH_GRANT_CUSTOM_PATH_MAX` (device-relay path-grants.ts) so both ends accept the same paths. */
+const CUSTOM_PATH_MAX = 150;
+const expandHome = (path) => path === "~" ? homedir() : path.startsWith("~/") ? join(homedir(), path.slice(2)) : path;
+const expanded = (path) => normalize(expandHome(path));
+const within = (path, base) => path === base || path.startsWith(base.endsWith(sep) ? base : base + sep);
+/** The expanded path of a `path:` grant name, or undefined when it is not allowed. */
+export function customWritePath(name) {
+    if (!name.startsWith(CUSTOM_PATH_PREFIX) || name.includes("\0"))
+        return undefined;
+    const raw = name.slice(CUSTOM_PATH_PREFIX.length);
+    if (raw.length > CUSTOM_PATH_MAX || !(raw.startsWith("~/") || isAbsolute(raw)) || raw.split("/").includes(".."))
+        return undefined;
+    const normalized = expanded(raw);
+    const { root } = parse(normalized);
+    const isRoot = normalized === root;
+    const path = isRoot ? root : normalized.replace(/[\\/]+$/u, "");
+    // Any absolute directory, but never the filesystem root or the system drive root. The root of another Windows drive (`D:\`) is allowed.
+    if (path === "")
+        return undefined;
+    if (isRoot && (!/^[A-Za-z]:[\\/]$/u.test(root) || root.toLowerCase() === `${process.env.SystemDrive ?? "C:"}\\`.toLowerCase()))
+        return undefined;
+    if (NEVER_WRITABLE_PATHS.some((never) => within(path, expanded(never))))
+        return undefined;
+    // Inside a protected path only that path itself can be named; the grant must spell it out in full.
+    if (PROTECTED_PATHS.some((protectedPath) => path !== expanded(protectedPath) && within(path, expanded(protectedPath))))
+        return undefined;
+    return path;
+}
+/** Paths a sandboxed command may never write: every protected path except those named exactly by an approved grant, plus Frely's own credentials. */
+export function protectedWriteDenials(allowedGroups) {
+    const granted = new Set(allowedGroups.flatMap((name) => customWritePath(name) ?? []));
+    return [...PROTECTED_PATHS.filter((protectedPath) => !granted.has(expanded(protectedPath))), ...NEVER_WRITABLE_PATHS];
+}
+/** Whether `name` is a grant name this CLI understands. */
+export function isKnownGrantName(name) {
+    return Object.hasOwn(SENSITIVE_PATH_GROUPS, name) || Object.hasOwn(WRITABLE_PATH_GROUPS, name) || name === UNSANDBOXED_GROUP || customWritePath(name) !== undefined;
+}
 /** Never openable by a grant. Frely's own device credentials and local MCP list (which can hold headers and env values): a remote client running commands must not read them back. */
 const ALWAYS_DENIED_READ_PATHS = ["~/.docker/config.json", "~/.config/frely"];
 /** Request `_meta` key the relay sets on a tools/call with the approved group names; the relay overwrites anything a client sent. */
 export const PATH_GRANTS_META_KEY = "frely/pathGrants";
-/** Approved group names from a tools/call `_meta`; unknown names are dropped. */
+/** Approved grant names from a tools/call `_meta`: credential groups to read, cache groups or `path:` directories to write, or `unsandboxed`. Unknown names are dropped. */
 export function pathGrantsFromMeta(meta) {
     const value = meta && typeof meta === "object" ? meta[PATH_GRANTS_META_KEY] : undefined;
     if (!Array.isArray(value))
         return [];
-    return [...new Set(value.filter((name) => typeof name === "string" && Object.hasOwn(SENSITIVE_PATH_GROUPS, name)))];
+    return [...new Set(value.filter((name) => typeof name === "string" && isKnownGrantName(name)))];
 }
 export function sensitiveReadPaths(allowedGroups = []) {
     const allowed = new Set(allowedGroups);
@@ -83,6 +156,42 @@ export function detectSandboxBackend() {
         return "none";
     }
 }
+/** Extra directories commands may write under, from the approved cache groups and custom `path:` grants. */
+export function writablePaths(allowedGroups) {
+    return allowedGroups.flatMap((name) => Object.hasOwn(WRITABLE_PATH_GROUPS, name) ? [...WRITABLE_PATH_GROUPS[name]] : customWritePath(name) ?? []);
+}
+/**
+ * Defines ssh, scp and sftp in front of a command so they reach the network through the sandbox's SOCKS or HTTP proxy.
+ * srt already exports that wiring as GIT_SSH_COMMAND for git; plain ssh makes a direct connection, which the sandbox refuses.
+ * Covers the command text itself; a script that starts ssh on its own should use `$GIT_SSH_COMMAND`.
+ */
+export const SSH_PROXY_PREFIX = [
+    'if [ -n "$GIT_SSH_COMMAND" ]; then __frely_ssh_opts=${GIT_SSH_COMMAND#ssh };',
+    ...["ssh", "scp", "sftp"].map((tool) => `${tool}() { eval "command ${tool} $__frely_ssh_opts \\"\\$@\\""; };`),
+    "fi\n",
+].join(" ");
+/** Single-quotes a word for sh unless it is made of characters that never need quoting. */
+const shellQuote = (value) => /^[\w./:@%+=,-]+$/u.test(value) ? value : `'${value.replace(/'/gu, `'\\''`)}'`;
+/**
+ * On macOS srt points GIT_SSH_COMMAND at `nc -X 5` (SOCKS5), which cannot send the sandbox proxy's credentials, so git over ssh fails
+ * whenever the proxy requires authentication. When HTTP_PROXY carries credentials, this swaps in `frely ssh-proxy`, an HTTP CONNECT
+ * relay that reads them from the environment. Other platforms keep srt's own setting (Linux uses socat with proxyauth).
+ */
+export function sshProxyPrefix(platform = process.platform, helper = cliLaunchArguments(helperEntry(), ["ssh-proxy"])) {
+    if (platform !== "darwin")
+        return SSH_PROXY_PREFIX;
+    const proxyCommand = `${helper.map(shellQuote).join(" ")} %h %p`;
+    const gitSshCommand = `ssh -o ControlMaster=no -o ControlPath=none -o ${shellQuote(`ProxyCommand=${proxyCommand}`)}`;
+    return `case "$HTTP_PROXY" in *@*) if [ -n "$GIT_SSH_COMMAND" ]; then GIT_SSH_COMMAND=${shellQuote(gitSshCommand)}; export GIT_SSH_COMMAND; fi;; esac\n${SSH_PROXY_PREFIX}`;
+}
+function helperEntry() {
+    try {
+        return realpathSync(process.argv[1] ?? "");
+    }
+    catch {
+        return process.argv[1] ?? "";
+    }
+}
 export function buildSandboxConfig(workspaceRoot, allowedGroups = []) {
     return {
         network: {
@@ -96,8 +205,8 @@ export function buildSandboxConfig(workspaceRoot, allowedGroups = []) {
         },
         filesystem: {
             denyRead: sensitiveReadPaths(allowedGroups),
-            allowWrite: [workspaceRoot, tmpdir()],
-            denyWrite: [],
+            allowWrite: [workspaceRoot, tmpdir(), ...writablePaths(allowedGroups)],
+            denyWrite: protectedWriteDenials(allowedGroups),
         },
     };
 }
@@ -141,6 +250,9 @@ async function ensureInitialized(workspaceRoot) {
 export async function sandboxCommand(command, workspaceRoot, allowedGroups = []) {
     if (isSandboxDisabled())
         return command;
+    // The owner opened raw outbound connections for this call, which the sandbox cannot offer without losing its other limits.
+    if (allowedGroups.includes(UNSANDBOXED_GROUP))
+        return command;
     const ready = await ensureInitialized(workspaceRoot);
     if (!ready) {
         if (isSandboxStrict())
@@ -149,7 +261,7 @@ export async function sandboxCommand(command, workspaceRoot, allowedGroups = [])
     }
     try {
         // initialize() fixed allowWrite to the first workspace that ran a command; give every call its own workspace.
-        return await SandboxManager.wrapWithSandbox(command, undefined, { filesystem: buildSandboxConfig(workspaceRoot, allowedGroups).filesystem });
+        return await SandboxManager.wrapWithSandbox(sshProxyPrefix() + command, undefined, { filesystem: buildSandboxConfig(workspaceRoot, allowedGroups).filesystem });
     }
     catch (error) {
         if (isSandboxStrict())
@@ -158,6 +270,16 @@ export async function sandboxCommand(command, workspaceRoot, allowedGroups = [])
         return command;
     }
 }
+/**
+ * Hint for a failed sandboxed command whose stderr looks like a sandbox denial, so the caller asks the owner for approval
+ * (request_permission) instead of giving up on a bare "Operation not permitted".
+ */
+export function sandboxDenialHint(stderr) {
+    if (!/operation not permitted|permission denied|read-only file system|sandbox/iu.test(stderr))
+        return undefined;
+    return "This command may have been blocked by the Frely command sandbox (writes only to the workspace and temp directory; credential folders unreadable; only HTTP(S) and ssh reach the network). "
+        + "Call request_permission with the reason and the exact command (a credential group, cache directories, a specific path, or unsandboxed); the owner approves it on the web with a passkey or authenticator code. Then run the same command again.";
+}
 /** Exposed for tests: resets the module-level init state and the underlying manager. */
 export async function resetSandboxForTests() {
     initialized = undefined;

package/dist/runtime/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/runtime/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,cAAc,EAA6B,MAAM,+BAA+B,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgD;IAChF,GAAG,EAAE,CAAC,QAAQ,CAAC;IACf,GAAG,EAAE,CAAC,QAAQ,CAAC;IACf,MAAM,EAAE,CAAC,kBAAkB,EAAE,sCAAsC,CAAC;IACpE,IAAI,EAAE,CAAC,SAAS,CAAC;IACjB,EAAE,EAAE,CAAC,cAAc,CAAC;IACpB,KAAK,EAAE,CAAC,UAAU,CAAC;IACnB,iBAAiB,EAAE,CAAC,oBAAoB,EAAE,UAAU,CAAC;IACrD,YAAY,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,2BAA2B,CAAC;CACrE,CAAC;AAEF,sLAAsL;AACtL,MAAM,wBAAwB,GAAG,CAAC,uBAAuB,EAAE,iBAAiB,CAAC,CAAC;AAE9E,qIAAqI;AACrI,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtI,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,gBAAmC,EAAE;IACtE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,OAAO;QACL,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;QAC7G,GAAG,wBAAwB;KAC5B,CAAC;AACJ,CAAC;AAED,IAAI,WAAyC,CAAC;AAC9C,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,OAAO,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5E,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,IAAI,CAAC;AAC7D,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,oBAAoB;IAClC,IAAI,iBAAiB,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE;YAAE,OAAO,MAAM,CAAC;QACzD,OAAO,cAAc,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,aAAqB,EAAE,gBAAmC,EAAE;IAC7F,OAAO;QACL,OAAO,EAAE;YACP,gEAAgE;YAChE,kEAAkE;YAClE,mEAAmE;YACnE,qEAAqE;YACrE,uCAAuC;YACvC,cAAc,EAAE,CAAC,GAAG,CAAC;YACrB,aAAa,EAAE,EAAE;SAClB;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,kBAAkB,CAAC,aAAa,CAAC;YAC3C,UAAU,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,EAAE;SACd;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,IAAI,MAAM;QAAE,OAAO;IACnB,MAAM,GAAG,IAAI,CAAC;IACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IACpD,WAAW,KAAK,CAAC,KAAK,IAAI,EAAE;QAC1B,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC1C,QAAQ,CAAC,oJAAoJ,CAAC,CAAC;YAC/J,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,YAAY,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC;QACxD,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,wCAAwC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;YAC1L,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,QAAQ;YAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,UAAU,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,kCAAkC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,yGAAyG,CAAC,CAAC;YAC5M,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,aAAqB,EAAE,gBAAmC,EAAE;IAChH,IAAI,iBAAiB,EAAE;QAAE,OAAO,OAAO,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,eAAe,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iHAAiH,CAAC,CAAC;QAC1J,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACH,8GAA8G;QAC9G,OAAO,MAAM,cAAc,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,kBAAkB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/I,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,EAAE;YAAE,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACvF,QAAQ,CAAC,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACjL,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,WAAW,GAAG,SAAS,CAAC;IACxB,MAAM,GAAG,KAAK,CAAC;IACf,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/runtime/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,cAAc,EAA6B,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAgD;IAChF,GAAG,EAAE,CAAC,QAAQ,CAAC;IACf,GAAG,EAAE,CAAC,QAAQ,CAAC;IACf,MAAM,EAAE,CAAC,kBAAkB,EAAE,sCAAsC,CAAC;IACpE,IAAI,EAAE,CAAC,SAAS,CAAC;IACjB,EAAE,EAAE,CAAC,cAAc,CAAC;IACpB,KAAK,EAAE,CAAC,UAAU,CAAC;IACnB,iBAAiB,EAAE,CAAC,oBAAoB,EAAE,UAAU,CAAC;IACrD,YAAY,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,2BAA2B,CAAC;CACrE,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAgD;IAC/E,WAAW,EAAE,CAAC,cAAc,CAAC;IAC7B,MAAM,EAAE,CAAC,WAAW,CAAC;IACrB,WAAW,EAAE,CAAC,QAAQ,CAAC;IACvB,WAAW,EAAE,CAAC,QAAQ,CAAC;IACvB,aAAa,EAAE,CAAC,mBAAmB,EAAE,cAAc,CAAC;IACpD,SAAS,EAAE,CAAC,cAAc,EAAE,4BAA4B,CAAC;IACzD,YAAY,EAAE,CAAC,UAAU,EAAE,kBAAkB,CAAC;CAC/C,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,EAAE,cAAc;IAC1F,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB;IACpI,wBAAwB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW;IACtI,2BAA2B,EAAE,sCAAsC;CACpE,CAAC;AACF,wFAAwF;AACxF,MAAM,oBAAoB,GAAsB,CAAC,iBAAiB,CAAC,CAAC;AACpE,2JAA2J;AAC3J,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtI,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACvE,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAEjI,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAClF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,GAAG,CAAC,MAAM,GAAG,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAClI,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,UAAU,KAAK,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAChE,wIAAwI;IACxI,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACjJ,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,mGAAmG;IACnG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzI,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qJAAqJ;AACrJ,MAAM,UAAU,qBAAqB,CAAC,aAAgC;IACpE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,oBAAoB,CAAC,CAAC;AACxH,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,iBAAiB,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AACtK,CAAC;AAED,sLAAsL;AACtL,MAAM,wBAAwB,GAAG,CAAC,uBAAuB,EAAE,iBAAiB,CAAC,CAAC;AAE9E,qIAAqI;AACrI,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,4KAA4K;AAC5K,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,gBAAmC,EAAE;IACtE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,OAAO;QACL,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;QAC7G,GAAG,wBAAwB;KAC5B,CAAC;AACJ,CAAC;AAED,IAAI,WAAyC,CAAC;AAC9C,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,OAAO,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5E,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,IAAI,CAAC;AAC7D,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,oBAAoB;IAClC,IAAI,iBAAiB,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE;YAAE,OAAO,MAAM,CAAC;QACzD,OAAO,cAAc,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,aAAa,CAAC,aAAgC;IAC5D,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACrJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,8EAA8E;IAC9E,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,sBAAsB,IAAI,oCAAoC,CAAC;IAC9G,MAAM;CACP,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,2FAA2F;AAC3F,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC;AAE7H;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB,OAAO,CAAC,QAAQ,EAAE,SAA4B,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;IAC9I,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IACnD,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjE,MAAM,aAAa,GAAG,kDAAkD,UAAU,CAAC,gBAAgB,YAAY,EAAE,CAAC,EAAE,CAAC;IACrH,OAAO,iFAAiF,UAAU,CAAC,aAAa,CAAC,wCAAwC,gBAAgB,EAAE,CAAC;AAC9K,CAAC;AAED,SAAS,WAAW;IAClB,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,aAAqB,EAAE,gBAAmC,EAAE;IAC7F,OAAO;QACL,OAAO,EAAE;YACP,gEAAgE;YAChE,kEAAkE;YAClE,mEAAmE;YACnE,qEAAqE;YACrE,uCAAuC;YACvC,cAAc,EAAE,CAAC,GAAG,CAAC;YACrB,aAAa,EAAE,EAAE;SAClB;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,kBAAkB,CAAC,aAAa,CAAC;YAC3C,UAAU,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;YACtE,SAAS,EAAE,qBAAqB,CAAC,aAAa,CAAC;SAChD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,IAAI,MAAM;QAAE,OAAO;IACnB,MAAM,GAAG,IAAI,CAAC;IACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IACpD,WAAW,KAAK,CAAC,KAAK,IAAI,EAAE;QAC1B,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC1C,QAAQ,CAAC,oJAAoJ,CAAC,CAAC;YAC/J,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,YAAY,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC;QACxD,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,wCAAwC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;YAC1L,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,QAAQ;YAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,UAAU,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,kCAAkC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,yGAAyG,CAAC,CAAC;YAC5M,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,aAAqB,EAAE,gBAAmC,EAAE;IAChH,IAAI,iBAAiB,EAAE;QAAE,OAAO,OAAO,CAAC;IACxC,2HAA2H;IAC3H,IAAI,aAAa,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,eAAe,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iHAAiH,CAAC,CAAC;QAC1J,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACH,8GAA8G;QAC9G,OAAO,MAAM,cAAc,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,kBAAkB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAClK,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,EAAE;YAAE,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACvF,QAAQ,CAAC,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACjL,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,IAAI,CAAC,2EAA2E,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAChH,OAAO,4LAA4L;UAC/L,iPAAiP,CAAC;AACxP,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,WAAW,GAAG,SAAS,CAAC;IACxB,MAAM,GAAG,KAAK,CAAC;IACf,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AACtD,CAAC"}

package/dist/runtime/ssh-proxy.d.ts

@@ -0,0 +1,20 @@
+import type { Readable, Writable } from "node:stream";
+export interface ProxyEndpoint {
+    host: string;
+    port: number;
+    authorization?: string;
+}
+/** The host, port and Basic credentials of an `http://[user:password@]host:port` proxy URL, as the sandbox exports it in HTTP_PROXY. */
+export declare function parseProxyUrl(value: string): ProxyEndpoint;
+/**
+ * Opens an HTTP CONNECT tunnel to `target` through the proxy and relays `input`/`output` over it, like `nc -X connect` but with
+ * proxy authentication. It is what ssh runs as ProxyCommand inside the macOS sandbox, where the stock `nc` can only speak SOCKS5
+ * without credentials. Nothing from the proxy reply header reaches `output`; the credentials are never printed.
+ */
+export declare function sshProxyConnect(options: {
+    proxyUrl: string;
+    host: string;
+    port: number;
+    input: Readable;
+    output: Writable;
+}): Promise<void>;

package/dist/runtime/ssh-proxy.js

@@ -0,0 +1,86 @@
+import { connect } from "node:net";
+/** The longest proxy reply header accepted before the tunnel is refused. */
+const MAX_HEADER_BYTES = 16 * 1024;
+const HANDSHAKE_TIMEOUT_MS = 30_000;
+/** The host, port and Basic credentials of an `http://[user:password@]host:port` proxy URL, as the sandbox exports it in HTTP_PROXY. */
+export function parseProxyUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("HTTP_PROXY is not a valid proxy URL.");
+    }
+    if (url.protocol !== "http:")
+        throw new Error("HTTP_PROXY must be an http:// proxy URL.");
+    const port = Number(url.port || 80);
+    if (!url.hostname || !Number.isInteger(port) || port < 1 || port > 65535)
+        throw new Error("HTTP_PROXY has no usable host or port.");
+    const host = url.hostname.startsWith("[") ? url.hostname.slice(1, -1) : url.hostname;
+    if (!url.username && !url.password)
+        return { host, port };
+    const credentials = `${decodeURIComponent(url.username)}:${decodeURIComponent(url.password)}`;
+    return { host, port, authorization: `Basic ${Buffer.from(credentials).toString("base64")}` };
+}
+/**
+ * Opens an HTTP CONNECT tunnel to `target` through the proxy and relays `input`/`output` over it, like `nc -X connect` but with
+ * proxy authentication. It is what ssh runs as ProxyCommand inside the macOS sandbox, where the stock `nc` can only speak SOCKS5
+ * without credentials. Nothing from the proxy reply header reaches `output`; the credentials are never printed.
+ */
+export function sshProxyConnect(options) {
+    const proxy = parseProxyUrl(options.proxyUrl);
+    const authority = `${options.host.includes(":") ? `[${options.host}]` : options.host}:${options.port}`;
+    return new Promise((resolve, reject) => {
+        const socket = connect({ host: proxy.host, port: proxy.port });
+        let header = Buffer.alloc(0);
+        let tunnelled = false;
+        let settled = false;
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            socket.destroy();
+            if (error)
+                reject(error);
+            else
+                resolve();
+        };
+        const timer = setTimeout(() => finish(new Error("The proxy did not answer the CONNECT request in time.")), HANDSHAKE_TIMEOUT_MS);
+        socket.once("connect", () => {
+            socket.write(`CONNECT ${authority} HTTP/1.1\r\nHost: ${authority}\r\n${proxy.authorization ? `Proxy-Authorization: ${proxy.authorization}\r\n` : ""}\r\n`);
+        });
+        socket.on("data", (chunk) => {
+            if (tunnelled) {
+                options.output.write(chunk);
+                return;
+            }
+            header = Buffer.concat([header, chunk]);
+            const end = header.indexOf("\r\n\r\n");
+            if (end === -1) {
+                if (header.length > MAX_HEADER_BYTES)
+                    finish(new Error("The proxy reply is too large."));
+                return;
+            }
+            const status = /^HTTP\/1\.[01] (\d{3})/u.exec(header.subarray(0, end).toString("latin1"));
+            if (!status || !status[1].startsWith("2")) {
+                finish(new Error(status ? `The proxy refused the tunnel (HTTP ${status[1]}).` : "The proxy sent an invalid reply."));
+                return;
+            }
+            tunnelled = true;
+            clearTimeout(timer);
+            const rest = header.subarray(end + 4);
+            if (rest.length > 0)
+                options.output.write(rest);
+            options.input.on("data", (data) => socket.write(data));
+            options.input.once("end", () => socket.end());
+        });
+        socket.once("end", () => { if (!tunnelled)
+            finish(new Error("The proxy closed the connection before answering."));
+        else
+            finish(); });
+        socket.once("error", (error) => finish(new Error(`Cannot reach the proxy: ${error.message}`)));
+        options.output.once("error", () => finish());
+    });
+}
+//# sourceMappingURL=ssh-proxy.js.map

package/dist/runtime/ssh-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-proxy.js","sourceRoot":"","sources":["../../src/runtime/ssh-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAGnC,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAIpC,wIAAwI;AACxI,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAAC,CAAC;IAChG,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACpI,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACrF,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,WAAW,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC9F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;AAC/F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAA4F;IAC1H,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IACvG,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gBAAM,OAAO,EAAE,CAAC;QAC3C,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACjI,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAC1B,MAAM,CAAC,KAAK,CAAC,WAAW,SAAS,sBAAsB,SAAS,OAAO,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,wBAAwB,KAAK,CAAC,aAAa,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7J,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,SAAS,EAAE,CAAC;gBAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACvD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACvC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,IAAI,MAAM,CAAC,MAAM,GAAG,gBAAgB;oBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;gBACzF,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,sCAAsC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC;gBACrH,OAAO;YACT,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;YACjB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACtC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,CAAC;;YAAM,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/F,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/workspace.js

@@ -1,5 +1,5 @@
-import { runShellCommand } from "./process-tree.js";
-import { sandboxCommand } from "./sandbox.js";
+import { CommandFailedError, runShellCommand } from "./process-tree.js";
+import { sandboxCommand, sandboxDenialHint } from "./sandbox.js";
 import { pathProtection } from "./protected-paths.js";
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
@@ -232,8 +232,14 @@ export class Workspace {
             throw new Error("command is required.");
         const cwd = await this.existingPath(cwdInput || ".", "directory");
         const sandboxed = await sandboxCommand(command, this.root, pathGrants);
-        const { stdout, stderr } = await runShellCommand(sandboxed, cwd, safeEnv(), timeoutMs, MAX_OUTPUT_BYTES, signal);
-        return { stdout: truncate(stdout), stderr: truncate(stderr) };
+        try {
+            const { stdout, stderr } = await runShellCommand(sandboxed, cwd, safeEnv(), timeoutMs, MAX_OUTPUT_BYTES, signal);
+            return { stdout: truncate(stdout), stderr: truncate(stderr) };
+        }
+        catch (error) {
+            const hint = error instanceof CommandFailedError && sandboxed !== command ? sandboxDenialHint(error.stderr) : undefined;
+            throw hint && error instanceof CommandFailedError ? new CommandFailedError(error.exitCode, error.stdout, error.stderr, hint) : error;
+        }
     }
     async processCwd(cwdInput) {
         return this.existingPath(cwdInput || ".", "directory");

package/dist/runtime/workspace.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../src/runtime/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAuB,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGtE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,MAAM,iBAAiB,GAAG,mPAAmP,CAAC;AAE9Q,MAAM,OAAO,SAAS;IAGS;IAAuB;IAFnC,UAAU,CAAiB;IAE5C,YAA6B,IAAY,EAAW,SAA4B,EAAE;QAArD,SAAI,GAAJ,IAAI,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAwB;QAChF,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,kGAAkG;IAClG,UAAU,CAAC,MAAyB;QAClC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAa;QAC7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzG,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI;QACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAK,GAAG,GAAG;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;SACjH,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;YAC9C,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACzE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK;YACvB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;SACrC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,UAAkB;QAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9G,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7E,OAAO,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,KAAa,EAAE,OAA6F;QAC3I,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACzE,MAAM,OAAO,GAA2F,EAAE,CAAC;QAC3G,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc;gBAAE,OAAO,IAAI,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAAE,SAAS;gBAC1E,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;oBACvC,IAAI,EAAE,KAAK,GAAG,CAAC;oBACf,IAAI,EAAE,IAAI;oBACV,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;oBACrE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;iBAChE,CAAC,CAAC;gBACH,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU;oBAAE,OAAO,KAAK,CAAC;YACzD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACxE,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC7E,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,SAAiB,EAAE,OAAgB;QACpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,WAAW,GAAG,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,GAAG,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,SAAS,EAAE,CAAC;YACvH,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC;YAC5C,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,SAAkB;QAChE,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACjG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACxF,IAAI,QAAQ,EAAE,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACjF,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC5G,IAAI,QAAQ,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjG,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5C,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,KAAgB,EAAE,cAAuB;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,cAAc,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACjC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YAC1E,MAAM,IAAI,GAAG,KAAgC,CAAC;YAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,OAAO,GAAG,SAAS,IAAI,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBACzI,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC3F,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/D,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YACpC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACrF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,SAAkB;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,OAAe,EAAE,SAAkB;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC3E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACtF,IAAI,MAAM,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACrF,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,MAAM;YAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;IAC1F,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,QAAgB,EAAE,SAAiB,EAAE,MAAoB,EAAE,aAAgC,EAAE;QAC7H,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACvE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACjH,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAA2C;QAC/E,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAChE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;oBAAE,SAAS;gBACrE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC1E,IAAI,KAAK,CAAC,WAAW,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;qBACrC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;oBAAE,OAAO;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAA+B;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC9E,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACvF,IAAI,QAAQ,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC9F,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAa;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;gBAC5C,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;gBAC/B,MAAM;YACR,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACvE,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,WAAW,CAAC,KAAa;QAC/B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC3F,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,MAAc;QAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC3F,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAEO,cAAc,CAAC,IAAY;QACjC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5E,CAAC;IAEO,cAAc,CAAC,IAAY;QACjC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC7E,CAAC;CACF;AAED,MAAM,UAAU,OAAO;IACrB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAsB,CAAC;AACzI,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,eAAe,CAAC;AACnH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,EAAU;IAChD,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC/B,MAAM,IAAI,IAAI,CAAC;gBACf,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;;gBAAM,MAAM,IAAI,OAAO,CAAC;QAC3B,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM,IAAI,MAAM,CAAC;;YACrC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../src/runtime/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,cAAc,EAAuB,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGtE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,MAAM,iBAAiB,GAAG,mPAAmP,CAAC;AAE9Q,MAAM,OAAO,SAAS;IAGS;IAAuB;IAFnC,UAAU,CAAiB;IAE5C,YAA6B,IAAY,EAAW,SAA4B,EAAE;QAArD,SAAI,GAAJ,IAAI,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAwB;QAChF,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,kGAAkG;IAClG,UAAU,CAAC,MAAyB;QAClC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAa;QAC7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzG,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI;QACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAK,GAAG,GAAG;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;SACjH,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;YAC9C,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACzE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK;YACvB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;SACrC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,UAAkB;QAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9G,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7E,OAAO,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,KAAa,EAAE,OAA6F;QAC3I,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACzE,MAAM,OAAO,GAA2F,EAAE,CAAC;QAC3G,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc;gBAAE,OAAO,IAAI,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAAE,SAAS;gBAC1E,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;oBACvC,IAAI,EAAE,KAAK,GAAG,CAAC;oBACf,IAAI,EAAE,IAAI;oBACV,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;oBACrE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;iBAChE,CAAC,CAAC;gBACH,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU;oBAAE,OAAO,KAAK,CAAC;YACzD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACxE,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC7E,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,SAAiB,EAAE,OAAgB;QACpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,WAAW,GAAG,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,GAAG,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,SAAS,EAAE,CAAC;YACvH,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC;YAC5C,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,SAAkB;QAChE,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACjG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACxF,IAAI,QAAQ,EAAE,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACjF,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC5G,IAAI,QAAQ,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjG,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5C,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,KAAgB,EAAE,cAAuB;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,cAAc,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACjC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YAC1E,MAAM,IAAI,GAAG,KAAgC,CAAC;YAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,OAAO,GAAG,SAAS,IAAI,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBACzI,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC3F,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/D,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YACpC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACrF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,SAAkB;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,OAAe,EAAE,SAAkB;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC3E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACtF,IAAI,MAAM,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACrF,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,MAAM;YAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;IAC1F,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,QAAgB,EAAE,SAAiB,EAAE,MAAoB,EAAE,aAAgC,EAAE;QAC7H,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;YACjH,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,KAAK,YAAY,kBAAkB,IAAI,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxH,MAAM,IAAI,IAAI,KAAK,YAAY,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACvI,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAA2C;QAC/E,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAChE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;oBAAE,SAAS;gBACrE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC1E,IAAI,KAAK,CAAC,WAAW,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;qBACrC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;oBAAE,OAAO;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAA+B;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC9E,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACvF,IAAI,QAAQ,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC9F,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAa;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;gBAC5C,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;gBAC/B,MAAM;YACR,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACvE,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,WAAW,CAAC,KAAa;QAC/B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC3F,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,MAAc;QAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC3F,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAEO,cAAc,CAAC,IAAY;QACjC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5E,CAAC;IAEO,cAAc,CAAC,IAAY;QACjC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC7E,CAAC;CACF;AAED,MAAM,UAAU,OAAO;IACrB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAsB,CAAC;AACzI,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,eAAe,CAAC;AACnH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,EAAU;IAChD,OAAO,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC/B,MAAM,IAAI,IAAI,CAAC;gBACf,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;;gBAAM,MAAM,IAAI,OAAO,CAAC;QAC3B,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM,IAAI,MAAM,CAAC;;YACrC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC"}

package/dist/skill/cloud-item.d.ts

@@ -19,8 +19,10 @@ export interface CloudItemInstallResult {
     readonly files: number;
     readonly premium: "installed" | "pass_required" | "none";
     readonly hasScripts: boolean;
-    /** True for a Skill: it is reviewed by the user's agent through the guard Skill before first use. */
+    /** True for a Skill without a passing Frely scan: the user's agent reviews it through the guard Skill before first use. */
     readonly guarded: boolean;
+    /** True when Frely's automated scan passed for exactly this version, so the item is already marked reviewed. */
+    readonly scanned: boolean;
 }
 /**
  * Install a download-install Prompt or Skill: the free part always, the paid

package/dist/skill/cloud-item.js

@@ -71,9 +71,13 @@ export async function installCloudItem(input) {
     await writeItemFolder(target, manifest.id, files);
     if (manifest.kind === "skill")
         await installGuard(dirname(target));
+    // A passing scan is bound to this version's files on the server, so the local review is already done.
+    const scanned = manifest.kind === "skill" && manifest.scanned;
+    if (scanned)
+        await trustCloudItem(target);
     return Object.freeze({
         id: manifest.id, kind: manifest.kind, name: manifest.displayName, version: manifest.version,
-        path: target, files: files.length, premium, hasScripts: manifest.hasScripts, guarded: manifest.kind === "skill",
+        path: target, files: files.length, premium, hasScripts: manifest.hasScripts, guarded: manifest.kind === "skill" && !scanned, scanned,
     });
 }
 /** Puts the review instructions next to the installed Skills once; a copy the user edited is left alone. */
@@ -119,6 +123,8 @@ function parseContent(value, skillId) {
         || typeof manifest.displayName !== "string" || !Number.isSafeInteger(manifest.version) || !Array.isArray(value.files) || value.files.length > MAX_FILES) {
         throw new CloudItemError("item_invalid", "Frely returned an invalid item.");
     }
+    const scan = record(manifest.scan);
+    const scanned = scan?.verdict === "pass" && typeof manifest.manifestDigest === "string" && scan.manifestDigest === manifest.manifestDigest;
     let total = 0;
     const files = value.files.map((raw) => {
         const file = record(raw);
@@ -132,7 +138,7 @@ function parseContent(value, skillId) {
     return {
         manifest: {
             id: skillId, kind: manifest.kind, slug: manifest.slug, displayName: manifest.displayName, version: manifest.version,
-            hasScripts: manifest.hasScripts === true, premiumFileCount: typeof premium?.fileCount === "number" ? premium.fileCount : 0,
+            hasScripts: manifest.hasScripts === true, premiumFileCount: typeof premium?.fileCount === "number" ? premium.fileCount : 0, scanned,
         },
         files,
     };