patchwork-os 1.2.0-beta.3.canary.889 → 1.2.0-beta.3.canary.890

package/dist/drivers/claude/subprocess.d.ts

@@ -6,6 +6,40 @@ import type { ProviderDriver, ProviderTaskInput, ProviderTaskResult } from "../t
  * trusted blindly: a malformed object is ignored rather than half-applied.
  */
 export declare function containmentFromInput(input: Pick<ProviderTaskInput, "containment" | "providerOptions">): AgentContainment | undefined;
+/**
+ * Settings sources a contained run loads: only the operator's own USER
+ * settings. Project and local settings live in the workspace, so a repository
+ * can ship them. Their hooks run shell commands, and observed against the real
+ * CLI, a project PreToolUse hook ran inside a contained `-p` run despite
+ * `--settings` carrying `hooks: {}`. Their allow rules can also re-enable
+ * tools. User settings stay, because API-key auth (`apiKeyHelper`)
+ * lives there.
+ */
+export declare const CONTAINED_SETTING_SOURCES = "user";
+/**
+ * The permission argv for a CONTAINED `claude -p` run. This is the single
+ * implementation shared by the subprocess driver and the local-run path
+ * (`defaultClaudeCodeFn`), so the two cannot drift apart.
+ *
+ * Every contained run:
+ * - runs in dontAsk mode, even with an empty allowlist, so an unlisted tool
+ *   is refused;
+ * - takes its allowlist from the containment;
+ * - denies the union of the caller's own denies and the containment's. A deny
+ *   is never dropped.
+ *
+ * A STRICT (governed) run additionally:
+ * - loads only user settings;
+ * - restricts the built-in tool SET to the allowlist with `--tools`.
+ *
+ * `--tools` matters because dontAsk only refuses what would otherwise ask.
+ * Tools that need no permission, and tools a loaded allow rule pre-approves,
+ * run anyway unless they do not exist (observed against the real CLI).
+ *
+ * A compat `sandbox: true` opt-in (not strict) gets exactly the flags it
+ * always had.
+ */
+export declare function containedPermissionArgs(containment: Pick<AgentContainment, "allowedTools" | "deniedTools" | "strict">, extraDenied?: unknown): string[];
 /** Provider credentials the Claude CLI authenticates with. */
 export declare const CLAUDE_PROVIDER_ENV_KEYS: readonly string[];
 /**

package/dist/drivers/claude/subprocess.js

@@ -8,7 +8,7 @@ import { truncateToBytes, truncateUtf8Bytes } from "../outputCap.js";
 import { toProviderTaskOutcome } from "../types.js";
 import { allowlistEnv, passEnvFromProviderOptions, sanitizeEnv, } from "./envSanitizer.js";
 import { parseStreamLine, splitLines } from "./streamParser.js";
-import { createSubprocessSettings } from "./subprocessSettings.js";
+import { createSubprocessSettings, readWorkspaceDenies, } from "./subprocessSettings.js";
 const OUTPUT_CAP = 50 * 1024; // 50KB
 /**
  * Write a single-server MCP config to a 0600 temp file, return the path.
@@ -80,8 +80,67 @@ export function containmentFromInput(input) {
         envAllowlist: o.envAllowlist === true,
         mcpAccess: o.mcpAccess === true,
         widenings: strs(o.widenings),
+        ...(o.strict === true && { strict: true }),
     };
 }
+/** Drop values a child's flag parser could misread (non-strings, `-…`). */
+function argvSafeList(list) {
+    return (Array.isArray(list) ? list : []).filter((t) => typeof t === "string" && t.length > 0 && !t.startsWith("-"));
+}
+/**
+ * Settings sources a contained run loads: only the operator's own USER
+ * settings. Project and local settings live in the workspace, so a repository
+ * can ship them. Their hooks run shell commands, and observed against the real
+ * CLI, a project PreToolUse hook ran inside a contained `-p` run despite
+ * `--settings` carrying `hooks: {}`. Their allow rules can also re-enable
+ * tools. User settings stay, because API-key auth (`apiKeyHelper`)
+ * lives there.
+ */
+export const CONTAINED_SETTING_SOURCES = "user";
+/**
+ * The permission argv for a CONTAINED `claude -p` run. This is the single
+ * implementation shared by the subprocess driver and the local-run path
+ * (`defaultClaudeCodeFn`), so the two cannot drift apart.
+ *
+ * Every contained run:
+ * - runs in dontAsk mode, even with an empty allowlist, so an unlisted tool
+ *   is refused;
+ * - takes its allowlist from the containment;
+ * - denies the union of the caller's own denies and the containment's. A deny
+ *   is never dropped.
+ *
+ * A STRICT (governed) run additionally:
+ * - loads only user settings;
+ * - restricts the built-in tool SET to the allowlist with `--tools`.
+ *
+ * `--tools` matters because dontAsk only refuses what would otherwise ask.
+ * Tools that need no permission, and tools a loaded allow rule pre-approves,
+ * run anyway unless they do not exist (observed against the real CLI).
+ *
+ * A compat `sandbox: true` opt-in (not strict) gets exactly the flags it
+ * always had.
+ */
+export function containedPermissionArgs(containment, extraDenied = []) {
+    const allowed = argvSafeList(containment.allowedTools);
+    const denied = Array.from(new Set([
+        ...argvSafeList(extraDenied),
+        ...argvSafeList(containment.deniedTools),
+    ]));
+    const strict = containment.strict === true;
+    // Built-in names only: `Edit(src/**)` → `Edit`; bridge MCP tools are not
+    // part of the built-in set.
+    const toolSet = Array.from(new Set(allowed
+        .map((t) => t.split("(")[0] ?? t)
+        .filter((t) => t.length > 0 && !t.startsWith("mcp__"))));
+    return [
+        ...(strict ? ["--setting-sources", CONTAINED_SETTING_SOURCES] : []),
+        ...(strict ? ["--tools", toolSet.join(",")] : []),
+        "--permission-mode",
+        "dontAsk",
+        ...(allowed.length > 0 ? ["--allowed-tools", ...allowed] : []),
+        ...(denied.length > 0 ? ["--disallowed-tools", ...denied] : []),
+    ];
+}
 /** Provider credentials the Claude CLI authenticates with. */
 export const CLAUDE_PROVIDER_ENV_KEYS = Object.freeze([
     "ANTHROPIC_API_KEY",
@@ -124,11 +183,11 @@ export class SubprocessDriver {
         // Best-effort initial write; per-run write in run() is the enforcement gate.
         this.settings.write();
     }
-    settingsFor(deniedTools) {
-        const key = [...deniedTools].sort().join("\u0000");
+    settingsFor(deniedTools, strict) {
+        const key = `${strict ? "strict" : "plain"}\u0001${[...deniedTools].sort().join("\u0000")}`;
         let s = this.containedSettings.get(key);
         if (!s) {
-            s = createSubprocessSettings(this.log, deniedTools);
+            s = createSubprocessSettings(this.log, deniedTools, { strict });
             this.containedSettings.set(key, s);
         }
         return s;
@@ -150,8 +209,12 @@ export class SubprocessDriver {
         // `resolveAgentContainment`). Absent ⇒ legacy providerOptions keys below.
         const containment = containmentFromInput(input);
         const contained = containment?.enforced === true;
+        // A strict run applies the workspace's own deny rules itself, because it
+        // does not load the workspace's settings sources.
+        const strict = contained && containment?.strict === true;
+        const workspaceDenies = strict ? readWorkspaceDenies(input.workspace) : [];
         const settings = contained
-            ? this.settingsFor(containment?.deniedTools ?? [])
+            ? this.settingsFor([...(containment?.deniedTools ?? []), ...workspaceDenies], strict)
             : this.settings;
         if (!settings.write()) {
             throw new Error("[SubprocessDriver] Failed to write settings file — cannot spawn claude -p without deny list");
@@ -228,7 +291,14 @@ export class SubprocessDriver {
         }
         if (maxBudgetUsd !== undefined)
             args.push("--max-budget-usd", String(maxBudgetUsd));
-        if (sandboxActive) {
+        if (contained && containment) {
+            // Governed containment: one implementation for every contained spawn.
+            args.push(...containedPermissionArgs(containment, [
+                ...argvSafeList(opts.disallowedTools),
+                ...workspaceDenies,
+            ]));
+        }
+        else if (sandboxActive) {
             // Sandbox: enforce the allowlist. --dangerously-skip-permissions VOIDS
             // --allowed-tools (per CC docs), so they are mutually exclusive — drop
             // skip-permissions and run in dontAsk mode (no interactive prompt, but
@@ -244,8 +314,9 @@ export class SubprocessDriver {
             args.push("--dangerously-skip-permissions");
         }
         // Deny rules apply in ANY mode — even under --dangerously-skip-permissions.
-        // --disallowed-tools is variadic: one flag, all (filtered) values.
-        if (disallowedTools.length > 0) {
+        // --disallowed-tools is variadic: one flag, all (filtered) values. (A
+        // contained run already carries the union via containedPermissionArgs.)
+        if (!contained && disallowedTools.length > 0) {
             args.push("--disallowed-tools", ...disallowedTools);
         }
         for (const f of input.contextFiles ?? []) {

package/dist/drivers/claude/subprocess.js.map

@@ -1 +1 @@
-{"version":3,"file":"subprocess.js","sourceRoot":"","sources":["../../../src/drivers/claude/subprocess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAMrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO;AAErC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,kBAAkB,CAAC,GAAuC;IAIjE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACnC,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAChC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,MAAM,GAAG;QACb,UAAU,EAAE;YACV,SAAS,EAAE;gBACT,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,aAAa,CAAC,mBAAmB,CAAC;gBAC3C,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;aACjD;SACF;KACF,CAAC;IACF,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAiE;IAEjE,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC;IAClE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,CAAC,GAAG,CAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAY,EAAE,CACpC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;QAClC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;QAChC,YAAY,EAAE,CAAC,CAAC,YAAY,KAAK,IAAI;QACrC,SAAS,EAAE,CAAC,CAAC,SAAS,KAAK,IAAI;QAC/B,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACvE,mBAAmB;IACnB,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI;SACR,OAAO,CAAC,4BAA4B,EAAE,oBAAoB,CAAC;SAC3D,OAAO,CAAC,gCAAgC,EAAE,mBAAmB,CAAC;SAC9D,OAAO,CAAC,qCAAqC,EAAE,kBAAkB,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,gBAAgB;IAUR;IACA;IACA;IACA;IAZV,IAAI,GAAG,YAAY,CAAC;IACZ,QAAQ,CAA8C;IACvE,6DAA6D;IAC5C,iBAAiB,GAAG,IAAI,GAAG,EAGzC,CAAC;IAEJ,YACmB,MAAc,EACd,SAAiB,EACjB,GAA0B,EAC1B,SAEJ;QALI,WAAM,GAAN,MAAM,CAAQ;QACd,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAuB;QAC1B,cAAS,GAAT,SAAS,CAEb;QAEb,IAAI,CAAC,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC9C,6EAA6E;QAC7E,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAEO,WAAW,CACjB,WAA8B;QAE9B,MAAM,GAAG,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YACpD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAwB;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;QACpC,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAExE,qEAAqE;QACrE,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,eAAe,GAAG,aAAa,CACnC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CACtC,CAAC;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,WAAW,EAAE,QAAQ,KAAK,IAAI,CAAC;QACjD,MAAM,QAAQ,GAAG,SAAS;YACxB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,IAAI,EAAE,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,eAAe;QACf,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,0EAA0E;QAC1E,MAAM,SAAS,GAAG,WAAW;YAC3B,CAAC,CAAC,WAAW,CAAC,SAAS;YACvB,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;QAC5B,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvD,6EAA6E;QAC7E,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAY,EAAE,CAC3C,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CACrD,CAAC,CAAC,EAAe,EAAE,CACjB,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAC9D,CAAC;QACJ,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;QACtC,MAAM,YAAY,GAAG,SAAS;YAC5B,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC;YACrC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,yEAAyE;QACzE,kDAAkD;QAClD,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAChC,IAAI,GAAG,CAAC;YACN,GAAG,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC;YACjC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CACH,CAAC;QACF,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,MAAM,aAAa,GAAG,SAAS,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAExE,MAAM,IAAI,GAAG;YACX,IAAI;YACJ,KAAK,CAAC,MAAM;YACZ,uEAAuE;YACvE,8DAA8D;YAC9D,oEAAoE;YACpE,sEAAsE;YACtE,qBAAqB;YACrB,YAAY;YACZ,QAAQ,CAAC,IAAI;YACb,iBAAiB;YACjB,aAAa;YACb,WAAW;YACX,4BAA4B;YAC5B,0BAA0B;SAC3B,CAAC;QAEF,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CACN,4IAA4I,CAC7I,CAAC;QACJ,CAAC;QACD,IAAI,SAA6B,CAAC;QAClC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,YAAY,KAAK,SAAS;YAC5B,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACtD,IAAI,aAAa,EAAE,CAAC;YAClB,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,iEAAiE;YACjE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;YAC1C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,YAAY,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC9C,CAAC;QACD,4EAA4E;QAC5E,mEAAmE;QACnE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,eAAe,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,iDAAiD;QACjD,MAAM,GAAG,GAAG,WAAW,EAAE,YAAY;YACnC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE;gBACxB,YAAY,EAAE,wBAAwB;gBACtC,OAAO,EAAE,0BAA0B,CAAC,IAAI,CAAC;aAC1C,CAAC;YACJ,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC,GAAG,CACN,gCAAgC,eAAe,4BAA4B,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,yBAAyB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAClQ,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE;YACzC,GAAG,EAAE,KAAK,CAAC,SAAS;YACpB,GAAG;YACH,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,gFAAgF;YAChF,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,2EAA2E;QAC3E,uEAAuE;QACvE,qEAAqE;QACrE,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,qEAAqE;YACrE,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtD,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,gBAAoC,CAAC;QACzC,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,oEAAoE;QACpE,wDAAwD;QACxD,4EAA4E;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,IAAI,WAES,CAAC;QACd,IAAI,aAAiC,CAAC;QACtC,IAAI,cAAkC,CAAC;QACvC,IAAI,gBAAoC,CAAC;QACzC,MAAM,cAAc,GAAG,GAAwC,EAAE;YAC/D,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,WAAW,EAAE,YAAY,CAAC;YACtC,MAAM,IAAI,GAAG,WAAW,EAAE,aAAa,CAAC;YACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxD,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;gBACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,IAAI,OAAO,aAAa,KAAK,QAAQ;gBAAE,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC;YACpE,IAAI,OAAO,cAAc,KAAK,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC;YACvE,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;gBACzC,IAAI,CAAC,UAAU,GAAG,gBAAgB,CAAC;YACrC,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC3B,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,CAAC,CAAC;QAEF,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,GAAG,SAAS,CAAC;YAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;oBAAE,SAAS;gBAEjC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBAC1B,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC;oBAC3B,IAAI,eAAe,GAAG,UAAU,EAAE,CAAC;wBACjC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,CACrC,MAAM,CAAC,IAAI,EACX,UAAU,GAAG,eAAe,CAC7B,CAAC;wBACF,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;4BACd,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;4BACtB,eAAe,IAAI,KAAK,CAAC;wBAC3B,CAAC;oBACH,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;gBAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBAC/B,IAAI,gBAAgB,KAAK,SAAS;wBAAE,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAClE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpB,WAAW,IAAI,IAAI,CAAC;wBACpB,IAAI,eAAe,GAAG,UAAU,EAAE,CAAC;4BACjC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,CACrC,IAAI,EACJ,UAAU,GAAG,eAAe,CAC7B,CAAC;4BACF,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gCACd,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;gCACtB,eAAe,IAAI,KAAK,CAAC;4BAC3B,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACnC,cAAc,GAAG,IAAI,CAAC;oBACtB,aAAa,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;oBACxC,UAAU,GAAG,IAAI,IAAI,WAAW,CAAC;oBACjC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC;oBAC1B,aAAa,GAAG,KAAK,CAAC,cAAc,CAAC;oBACrC,cAAc,GAAG,KAAK,CAAC,SAAS,CAAC;oBACjC,gBAAgB,GAAG,KAAK,CAAC,WAAW,CAAC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,uEAAuE;YACvE,sEAAsE;YACtE,mEAAmE;YACnE,2BAA2B;YAC3B,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC;gBAChB,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;oBACnD,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,CAAC,CAAS,EAAsB,EAAE,CACrD,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,MAAM,WAAW,GAAG,GAAuB,EAAE,CAC3C,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAExE,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,MAAM,aAAa,GAAG,KAAK,CAAC,gBAAgB;YAC1C,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,gBAAgB,KAAK,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;oBACtD,eAAe,GAAG,IAAI,CAAC;oBACvB,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC;YAC5B,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,aAAa;gBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC/C,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO;oBACL,IAAI,EAAE,iBAAiB,CAAC,UAAU,EAAE,UAAU,CAAC;oBAC/C,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC/B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC9B,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC;oBAChC,SAAS,EAAE,WAAW,EAAE;oBACxB,YAAY,EAAE,cAAc,EAAE;iBAC/B,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GACX,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;gBACnD,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;YACvB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;oBACL,IAAI,EAAE,iBAAiB,CAAC,WAAW,EAAE,UAAU,CAAC;oBAChD,QAAQ,EAAE,CAAC,CAAC;oBACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC9B,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC;oBAChC,UAAU,EAAE,IAAI;oBAChB,SAAS,EAAE,WAAW,EAAE;iBACzB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,aAAa;YAAE,YAAY,CAAC,aAAa,CAAC,CAAC;QAE/C,mEAAmE;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC1B,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC;gBAC3B,IAAI,eAAe,GAAG,UAAU,EAAE,CAAC;oBACjC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,CACrC,MAAM,CAAC,IAAI,EACX,UAAU,GAAG,eAAe,CAC7B,CAAC;oBACF,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;wBACd,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;wBACtB,eAAe,IAAI,KAAK,CAAC;oBAC3B,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;gBAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBAC/B,IAAI,gBAAgB,KAAK,SAAS;wBAAE,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAClE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpB,WAAW,IAAI,IAAI,CAAC;wBACpB,IAAI,eAAe,GAAG,UAAU,EAAE,CAAC;4BACjC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,CACrC,IAAI,EACJ,UAAU,GAAG,eAAe,CAC7B,CAAC;4BACF,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gCACd,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;gCACtB,eAAe,IAAI,KAAK,CAAC;4BAC3B,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACnC,cAAc,GAAG,IAAI,CAAC;oBACtB,aAAa,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;oBACxC,UAAU,GAAG,IAAI,IAAI,WAAW,CAAC;oBACjC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC;oBAC1B,aAAa,GAAG,KAAK,CAAC,cAAc,CAAC;oBACrC,cAAc,GAAG,KAAK,CAAC,SAAS,CAAC;oBACjC,gBAAgB,GAAG,KAAK,CAAC,WAAW,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QAED,MAAM,iBAAiB,GAAG,cAAc;YACtC,CAAC,CAAC,aAAa;gBACb,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,QAAQ,CAAC;QACb,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;QAE5D,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO;gBACL,IAAI,EAAE,iBAAiB,CAAC,WAAW,EAAE,UAAU,CAAC;gBAChD,QAAQ,EAAE,CAAC,CAAC;gBACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC;gBAChC,UAAU,EAAE,IAAI;gBAChB,eAAe,EAAE,IAAI;aACtB,CAAC;QACJ,CAAC;QAED,IAAI,iBAAiB,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO;YACL,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC;YAC9C,QAAQ,EAAE,iBAAiB;YAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC9B,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC;YAChC,SAAS,EAAE,WAAW,EAAE;YACxB,YAAY,EAAE,cAAc,EAAE;SAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAwB;QACvC,OAAO,qBAAqB,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;CACF"}
+{"version":3,"file":"subprocess.js","sourceRoot":"","sources":["../../../src/drivers/claude/subprocess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAMrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EACL,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO;AAErC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,kBAAkB,CAAC,GAAuC;IAIjE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACnC,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAChC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,MAAM,GAAG;QACb,UAAU,EAAE;YACV,SAAS,EAAE;gBACT,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,aAAa,CAAC,mBAAmB,CAAC;gBAC3C,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;aACjD;SACF;KACF,CAAC;IACF,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAiE;IAEjE,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC;IAClE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,CAAC,GAAG,CAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAY,EAAE,CACpC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;QAClC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;QAChC,YAAY,EAAE,CAAC,CAAC,YAAY,KAAK,IAAI;QACrC,SAAS,EAAE,CAAC,CAAC,SAAS,KAAK,IAAI;QAC/B,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY,CAAC,IAAa;IACjC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,EAAe,EAAE,CACjB,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAGC,EACD,cAAuB,EAAE;IAEzB,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CACvB,IAAI,GAAG,CAAC;QACN,GAAG,YAAY,CAAC,WAAW,CAAC;QAC5B,GAAG,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC;KACzC,CAAC,CACH,CAAC;IACF,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC;IAC3C,yEAAyE;IACzE,4BAA4B;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACxB,IAAI,GAAG,CACL,OAAO;SACJ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CACzD,CACF,CAAC;IACF,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,mBAAmB;QACnB,SAAS;QACT,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACvE,mBAAmB;IACnB,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI;SACR,OAAO,CAAC,4BAA4B,EAAE,oBAAoB,CAAC;SAC3D,OAAO,CAAC,gCAAgC,EAAE,mBAAmB,CAAC;SAC9D,OAAO,CAAC,qCAAqC,EAAE,kBAAkB,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,gBAAgB;IAUR;IACA;IACA;IACA;IAZV,IAAI,GAAG,YAAY,CAAC;IACZ,QAAQ,CAA8C;IACvE,6DAA6D;IAC5C,iBAAiB,GAAG,IAAI,GAAG,EAGzC,CAAC;IAEJ,YACmB,MAAc,EACd,SAAiB,EACjB,GAA0B,EAC1B,SAEJ;QALI,WAAM,GAAN,MAAM,CAAQ;QACd,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAuB;QAC1B,cAAS,GAAT,SAAS,CAEb;QAEb,IAAI,CAAC,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC9C,6EAA6E;QAC7E,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAEO,WAAW,CACjB,WAA8B,EAC9B,MAAe;QAEf,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5F,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAwB;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;QACpC,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAExE,qEAAqE;QACrE,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,eAAe,GAAG,aAAa,CACnC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CACtC,CAAC;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,WAAW,EAAE,QAAQ,KAAK,IAAI,CAAC;QACjD,yEAAyE;QACzE,kDAAkD;QAClD,MAAM,MAAM,GAAG,SAAS,IAAI,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;QACzD,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,SAAS;YACxB,CAAC,CAAC,IAAI,CAAC,WAAW,CACd,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,eAAe,CAAC,EACzD,MAAM,CACP;YACH,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,eAAe;QACf,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,0EAA0E;QAC1E,MAAM,SAAS,GAAG,WAAW;YAC3B,CAAC,CAAC,WAAW,CAAC,SAAS;YACvB,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;QAC5B,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvD,6EAA6E;QAC7E,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAY,EAAE,CAC3C,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CACrD,CAAC,CAAC,EAAe,EAAE,CACjB,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAC9D,CAAC;QACJ,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;QACtC,MAAM,YAAY,GAAG,SAAS;YAC5B,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC;YACrC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,yEAAyE;QACzE,kDAAkD;QAClD,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAChC,IAAI,GAAG,CAAC;YACN,GAAG,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC;YACjC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CACH,CAAC;QACF,qEAAqE;QACrE,qEAAqE;QACrE,wEAAwE;QACxE,MAAM,aAAa,GAAG,SAAS,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAExE,MAAM,IAAI,GAAG;YACX,IAAI;YACJ,KAAK,CAAC,MAAM;YACZ,uEAAuE;YACvE,8DAA8D;YAC9D,oEAAoE;YACpE,sEAAsE;YACtE,qBAAqB;YACrB,YAAY;YACZ,QAAQ,CAAC,IAAI;YACb,iBAAiB;YACjB,aAAa;YACb,WAAW;YACX,4BAA4B;YAC5B,0BAA0B;SAC3B,CAAC;QAEF,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CACN,4IAA4I,CAC7I,CAAC;QACJ,CAAC;QACD,IAAI,SAA6B,CAAC;QAClC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,YAAY,KAAK,SAAS;YAC5B,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACtD,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YAC7B,sEAAsE;YACtE,IAAI,CAAC,IAAI,CACP,GAAG,uBAAuB,CAAC,WAAW,EAAE;gBACtC,GAAG,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC;gBACrC,GAAG,eAAe;aACnB,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,IAAI,aAAa,EAAE,CAAC;YACzB,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,iEAAiE;YACjE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;YAC1C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,YAAY,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC9C,CAAC;QACD,4EAA4E;QAC5E,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,eAAe,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,iDAAiD;QACjD,MAAM,GAAG,GAAG,WAAW,EAAE,YAAY;YACnC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE;gBACxB,YAAY,EAAE,wBAAwB;gBACtC,OAAO,EAAE,0BAA0B,CAAC,IAAI,CAAC;aAC1C,CAAC;YACJ,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC,GAAG,CACN,gCAAgC,eAAe,4BAA4B,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,yBAAyB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAClQ,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE;YACzC,GAAG,EAAE,KAAK,CAAC,SAAS;YACpB,GAAG;YACH,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,gFAAgF;YAChF,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,2EAA2E;QAC3E,uEAAuE;QACvE,qEAAqE;QACrE,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,qEAAqE;YACrE,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtD,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,gBAAoC,CAAC;QACzC,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,oEAAoE;QACpE,wDAAwD;QACxD,4EAA4E;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,IAAI,WAES,CAAC;QACd,IAAI,aAAiC,CAAC;QACtC,IAAI,cAAkC,CAAC;QACvC,IAAI,gBAAoC,CAAC;QACzC,MAAM,cAAc,GAAG,GAAwC,EAAE;YAC/D,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,WAAW,EAAE,YAAY,CAAC;YACtC,MAAM,IAAI,GAAG,WAAW,EAAE,aAAa,CAAC;YACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxD,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;gBACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,IAAI,OAAO,aAAa,KAAK,QAAQ;gBAAE,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC;YACpE,IAAI,OAAO,cAAc,KAAK,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC;YACvE,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;gBACzC,IAAI,CAAC,UAAU,GAAG,gBAAgB,CAAC;YACrC,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC3B,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,CAAC,CAAC;QAEF,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,GAAG,SAAS,CAAC;YAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;oBAAE,SAAS;gBAEjC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBAC1B,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC;oBAC3B,IAAI,eAAe,GAAG,UAAU,EAAE,CAAC;wBACjC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,CACrC,MAAM,CAAC,IAAI,EACX,UAAU,GAAG,eAAe,CAC7B,CAAC;wBACF,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;4BACd,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;4BACtB,eAAe,IAAI,KAAK,CAAC;wBAC3B,CAAC;oBACH,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;gBAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBAC/B,IAAI,gBAAgB,KAAK,SAAS;wBAAE,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAClE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpB,WAAW,IAAI,IAAI,CAAC;wBACpB,IAAI,eAAe,GAAG,UAAU,EAAE,CAAC;4BACjC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,CACrC,IAAI,EACJ,UAAU,GAAG,eAAe,CAC7B,CAAC;4BACF,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gCACd,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;gCACtB,eAAe,IAAI,KAAK,CAAC;4BAC3B,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACnC,cAAc,GAAG,IAAI,CAAC;oBACtB,aAAa,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;oBACxC,UAAU,GAAG,IAAI,IAAI,WAAW,CAAC;oBACjC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC;oBAC1B,aAAa,GAAG,KAAK,CAAC,cAAc,CAAC;oBACrC,cAAc,GAAG,KAAK,CAAC,SAAS,CAAC;oBACjC,gBAAgB,GAAG,KAAK,CAAC,WAAW,CAAC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,uEAAuE;YACvE,sEAAsE;YACtE,mEAAmE;YACnE,2BAA2B;YAC3B,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC;gBAChB,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;oBACnD,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,CAAC,CAAS,EAAsB,EAAE,CACrD,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,MAAM,WAAW,GAAG,GAAuB,EAAE,CAC3C,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAExE,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,MAAM,aAAa,GAAG,KAAK,CAAC,gBAAgB;YAC1C,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,gBAAgB,KAAK,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;oBACtD,eAAe,GAAG,IAAI,CAAC;oBACvB,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC;YAC5B,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,aAAa;gBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC/C,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO;oBACL,IAAI,EAAE,iBAAiB,CAAC,UAAU,EAAE,UAAU,CAAC;oBAC/C,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC/B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC9B,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC;oBAChC,SAAS,EAAE,WAAW,EAAE;oBACxB,YAAY,EAAE,cAAc,EAAE;iBAC/B,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GACX,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;gBACnD,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;YACvB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;oBACL,IAAI,EAAE,iBAAiB,CAAC,WAAW,EAAE,UAAU,CAAC;oBAChD,QAAQ,EAAE,CAAC,CAAC;oBACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC9B,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC;oBAChC,UAAU,EAAE,IAAI;oBAChB,SAAS,EAAE,WAAW,EAAE;iBACzB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,aAAa;YAAE,YAAY,CAAC,aAAa,CAAC,CAAC;QAE/C,mEAAmE;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC1B,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC;gBAC3B,IAAI,eAAe,GAAG,UAAU,EAAE,CAAC;oBACjC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,CACrC,MAAM,CAAC,IAAI,EACX,UAAU,GAAG,eAAe,CAC7B,CAAC;oBACF,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;wBACd,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;wBACtB,eAAe,IAAI,KAAK,CAAC;oBAC3B,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;gBAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBAC/B,IAAI,gBAAgB,KAAK,SAAS;wBAAE,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAClE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpB,WAAW,IAAI,IAAI,CAAC;wBACpB,IAAI,eAAe,GAAG,UAAU,EAAE,CAAC;4BACjC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,CACrC,IAAI,EACJ,UAAU,GAAG,eAAe,CAC7B,CAAC;4BACF,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gCACd,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;gCACtB,eAAe,IAAI,KAAK,CAAC;4BAC3B,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACnC,cAAc,GAAG,IAAI,CAAC;oBACtB,aAAa,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;oBACxC,UAAU,GAAG,IAAI,IAAI,WAAW,CAAC;oBACjC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC;oBAC1B,aAAa,GAAG,KAAK,CAAC,cAAc,CAAC;oBACrC,cAAc,GAAG,KAAK,CAAC,SAAS,CAAC;oBACjC,gBAAgB,GAAG,KAAK,CAAC,WAAW,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QAED,MAAM,iBAAiB,GAAG,cAAc;YACtC,CAAC,CAAC,aAAa;gBACb,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,QAAQ,CAAC;QACb,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;QAE5D,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO;gBACL,IAAI,EAAE,iBAAiB,CAAC,WAAW,EAAE,UAAU,CAAC;gBAChD,QAAQ,EAAE,CAAC,CAAC;gBACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC;gBAChC,UAAU,EAAE,IAAI;gBAChB,eAAe,EAAE,IAAI;aACtB,CAAC;QACJ,CAAC;QAED,IAAI,iBAAiB,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO;YACL,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC;YAC9C,QAAQ,EAAE,iBAAiB;YAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC9B,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC;YAChC,SAAS,EAAE,WAAW,EAAE;YACxB,YAAY,EAAE,cAAc,EAAE;SAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAwB;QACvC,OAAO,qBAAqB,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;CACF"}

package/dist/drivers/claude/subprocessSettings.d.ts

@@ -1,12 +1,24 @@
 /**
- * Write a minimal subprocess settings file that suppresses hooks and denies
- * destructive operations. Uses --settings instead of --bare to preserve OAuth
- * auth flows (--bare sets CLAUDE_CODE_SIMPLE=1 which skips OAuth).
+ * The DENY rules a workspace's own Claude settings declare
+ * (`.claude/settings.json` and `.claude/settings.local.json` under `dir`).
+ * A strict contained run does not load those sources, because their hooks and
+ * allow rules could widen it. Their denies only narrow, though, so the
+ * bridge reads them and applies them itself. Fail-soft: a missing or
+ * malformed file contributes nothing.
+ */
+export declare function readWorkspaceDenies(dir: string | undefined): string[];
+/**
+ * Write a minimal subprocess settings file that denies destructive
+ * operations. A strict contained run's file also disables all hooks. Uses
+ * --settings instead of --bare to preserve OAuth auth flows (--bare sets
+ * CLAUDE_CODE_SIMPLE=1 which skips OAuth).
  *
  * The file path is keyed on the deny set: a contained run and an uncontained
  * run in the same bridge process must never share (and race on) one file.
  */
-export declare function createSubprocessSettings(log: (msg: string) => void, extraDeny?: readonly string[]): {
+export declare function createSubprocessSettings(log: (msg: string) => void, extraDeny?: readonly string[], opts?: {
+    strict?: boolean;
+}): {
     path: string;
     write: () => boolean;
 };

package/dist/drivers/claude/subprocessSettings.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { writeFileSync } from "node:fs";
+import { readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 /** Deny list applied to all bridge-spawned subprocess tasks. */
@@ -46,28 +46,65 @@ const DENY_LIST = [
 ];
 /**
  * Build the settings content. `extraDeny` (Phase 0 step 6) is the
- * containment's denied tool list — under a governed profile that includes
- * bare `WebFetch` / `WebSearch` / `Bash`, written into `permissions.deny` as
- * well as passed via `--disallowed-tools`, so the denial holds even if a
- * future CLI version changes how the argv flag composes with the mode.
+ * containment's denied tool list. Under a governed profile it includes bare
+ * `WebFetch` / `WebSearch` / `Bash` and the write tools, plus the workspace's
+ * own deny rules. It is written into `permissions.deny` as well as passed via
+ * `--disallowed-tools`, so the denial holds even if a future CLI version
+ * changes how the argv flag composes with the mode.
  */
-function settingsContent(extraDeny) {
+function settingsContent(extraDeny, strict) {
     return JSON.stringify({
         hooks: {},
+        // `hooks: {}` alone does NOT stop hooks from other loaded sources
+        // (observed against the real CLI). A strict contained run turns every
+        // hook off, the operator's user hooks included.
+        ...(strict && { disableAllHooks: true }),
         permissions: { deny: Array.from(new Set([...DENY_LIST, ...extraDeny])) },
     });
 }
 /**
- * Write a minimal subprocess settings file that suppresses hooks and denies
- * destructive operations. Uses --settings instead of --bare to preserve OAuth
- * auth flows (--bare sets CLAUDE_CODE_SIMPLE=1 which skips OAuth).
+ * The DENY rules a workspace's own Claude settings declare
+ * (`.claude/settings.json` and `.claude/settings.local.json` under `dir`).
+ * A strict contained run does not load those sources, because their hooks and
+ * allow rules could widen it. Their denies only narrow, though, so the
+ * bridge reads them and applies them itself. Fail-soft: a missing or
+ * malformed file contributes nothing.
+ */
+export function readWorkspaceDenies(dir) {
+    if (!dir)
+        return [];
+    const out = new Set();
+    for (const name of ["settings.json", "settings.local.json"]) {
+        try {
+            const parsed = JSON.parse(readFileSync(join(dir, ".claude", name), "utf-8"));
+            const deny = parsed?.permissions?.deny;
+            if (!Array.isArray(deny))
+                continue;
+            for (const d of deny) {
+                if (typeof d === "string" && d.length > 0 && !d.startsWith("-")) {
+                    out.add(d);
+                }
+            }
+        }
+        catch {
+            // absent or unreadable: nothing to merge
+        }
+    }
+    return [...out];
+}
+/**
+ * Write a minimal subprocess settings file that denies destructive
+ * operations. A strict contained run's file also disables all hooks. Uses
+ * --settings instead of --bare to preserve OAuth auth flows (--bare sets
+ * CLAUDE_CODE_SIMPLE=1 which skips OAuth).
  *
  * The file path is keyed on the deny set: a contained run and an uncontained
  * run in the same bridge process must never share (and race on) one file.
  */
-export function createSubprocessSettings(log, extraDeny = []) {
-    const content = settingsContent(extraDeny);
-    const suffix = extraDeny.length === 0
+export function createSubprocessSettings(log, extraDeny = [], opts = {}) {
+    const strict = opts.strict === true;
+    const content = settingsContent(extraDeny, strict);
+    const suffix = extraDeny.length === 0 && !strict
         ? ""
         : `-${createHash("sha256").update(content).digest("hex").slice(0, 12)}`;
     const path = join(tmpdir(), `claude-ide-bridge-subprocess-settings-${process.pid}${suffix}.json`);

package/dist/drivers/claude/subprocessSettings.js.map

@@ -1 +1 @@
-{"version":3,"file":"subprocessSettings.js","sourceRoot":"","sources":["../../../src/drivers/claude/subprocessSettings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,gEAAgE;AAChE,MAAM,SAAS,GAAG;IAChB,uBAAuB;IACvB,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,6BAA6B;IAC7B,uBAAuB;IACvB,uBAAuB;IACvB,iBAAiB;IACjB,gBAAgB;IAChB,mBAAmB;IACnB,6BAA6B;IAC7B,yBAAyB;IACzB,qBAAqB;IACrB,8EAA8E;IAC9E,mDAAmD;IACnD,qBAAqB;IACrB,0BAA0B;IAC1B,2EAA2E;IAC3E,6EAA6E;IAC7E,mCAAmC;IACnC,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,uBAAuB;IACvB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,2BAA2B;IAC3B,cAAc;IACd,qEAAqE;IACrE,qEAAqE;IACrE,8EAA8E;IAC9E,cAAc;IACd,cAAc;IACd,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;CAChB,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,SAA4B;IACnD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,KAAK,EAAE,EAAE;QACT,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE;KACzE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAA0B,EAC1B,YAA+B,EAAE;IAKjC,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,MAAM,GACV,SAAS,CAAC,MAAM,KAAK,CAAC;QACpB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,CACf,MAAM,EAAE,EACR,yCAAyC,OAAO,CAAC,GAAG,GAAG,MAAM,OAAO,CACrE,CAAC;IACF,MAAM,KAAK,GAAG,GAAY,EAAE;QAC1B,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CACD,gEAAgE,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,uDAAuD,CACjL,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"subprocessSettings.js","sourceRoot":"","sources":["../../../src/drivers/claude/subprocessSettings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,gEAAgE;AAChE,MAAM,SAAS,GAAG;IAChB,uBAAuB;IACvB,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,6BAA6B;IAC7B,uBAAuB;IACvB,uBAAuB;IACvB,iBAAiB;IACjB,gBAAgB;IAChB,mBAAmB;IACnB,6BAA6B;IAC7B,yBAAyB;IACzB,qBAAqB;IACrB,8EAA8E;IAC9E,mDAAmD;IACnD,qBAAqB;IACrB,0BAA0B;IAC1B,2EAA2E;IAC3E,6EAA6E;IAC7E,mCAAmC;IACnC,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,uBAAuB;IACvB,uBAAuB;IACvB,cAAc;IACd,kBAAkB;IAClB,2BAA2B;IAC3B,cAAc;IACd,qEAAqE;IACrE,qEAAqE;IACrE,8EAA8E;IAC9E,cAAc;IACd,cAAc;IACd,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;CAChB,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,SAA4B,EAC5B,MAAe;IAEf,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,KAAK,EAAE,EAAE;QACT,kEAAkE;QAClE,sEAAsE;QACtE,gDAAgD;QAChD,GAAG,CAAC,MAAM,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QACxC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE;KACzE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,qBAAqB,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CACV,CAAC;YAC1C,MAAM,IAAI,GAAG,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAA0B,EAC1B,YAA+B,EAAE,EACjC,OAA6B,EAAE;IAK/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;IACpC,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,MAAM,GACV,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,CACf,MAAM,EAAE,EACR,yCAAyC,OAAO,CAAC,GAAG,GAAG,MAAM,OAAO,CACrE,CAAC;IACF,MAAM,KAAK,GAAG,GAAY,EAAE;QAC1B,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CACD,gEAAgE,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,uDAAuD,CACjL,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC"}

package/dist/governance/doctorReport.js

@@ -143,7 +143,7 @@ export function governanceReport(opts = {}) {
         key: "agentContainment",
         label: "Agent sandbox",
         value: profile.agentContainment === "enforced"
-            ? "ENFORCED (read-only tools, no network/shell, env allowlist; recipe steps and orchestrator tasks)"
+            ? "ENFORCED (read-only tool set; no network, shell, writes or hooks; user settings + workspace denies; env allowlist; recipe steps and orchestrator tasks)"
             : "OPT-IN per step",
         status: profile.agentContainment === "enforced" ? "ok" : "fail",
         reason: profile.agentContainment === "enforced"

package/dist/governance/doctorReport.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctorReport.js","sourceRoot":"","sources":["../../src/governance/doctorReport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAA0B,cAAc,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAiCzD,MAAM,UAAU,gBAAgB,CAC9B,OAA6B,EAAE;IAE/B,IAAI,GAAG,GAA8C,IAAI,CAAC,MAAM,CAAC;IACjE,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC;YACH,GAAG,GAAG,UAAU,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;IACF,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAiB,EAAE,EAAE;QACjC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC,CAAC;IAEF,cAAc;IACd,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,kBAAkB;YACzB,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,2BAA2B,WAAW,+BAA+B;SAC9E,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,kBAAkB;YACzB,KAAK,EACH,OAAO,CAAC,IAAI,KAAK,UAAU;gBACzB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,OAAO,CAAC,QAAQ;oBAChB,CAAC,CAAC,cAAc;oBAChB,CAAC,CAAC,gCAAgC;YACxC,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YACnD,MAAM,EACJ,OAAO,CAAC,IAAI,KAAK,UAAU;gBACzB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,8KAA8K;SACrL,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB;IACpB,IAAI,CAAC;QACH,GAAG,EAAE,cAAc;QACnB,KAAK,EAAE,eAAe;QACtB,KAAK,EACH,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,YAAY,GAAG;QACzE,MAAM,EAAE,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACtD,MAAM,EACJ,OAAO,CAAC,YAAY,KAAK,KAAK;YAC5B,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,SAAS;KAChB,CAAC,CAAC;IAEH,qBAAqB;IACrB,IAAI,CAAC;QACH,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,gBAAgB;QACvB,KAAK,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;QAC3E,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QACjD,MAAM,EAAE,OAAO,CAAC,iBAAiB;YAC/B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,gEAAgE;KACrE,CAAC,CAAC;IAEH,0EAA0E;IAC1E,oEAAoE;IACpE,sDAAsD;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,uEAAuE;IACvE,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,GAAG,EAAE,iBAAiB;QACtB,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,sCAAsC;QACrE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAChC,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,4DAA4D;KACjE,CAAC,CAAC;IACH,IAAI,CAAC;QACH,GAAG,EAAE,cAAc;QACnB,KAAK,EAAE,eAAe;QACtB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,KAAK;QAC3D,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,gEAAgE;IAChE,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAErB,GAKD,EAAE,OAAO,CACX,CAAC;QACF,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC;QACpC,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACzE,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,aAAa,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,iCAAiC,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC;QACH,GAAG,EAAE,qBAAqB;QAC1B,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,aAAa;YAClB,CAAC,CAAC,UAAU,aAAa,GAAG;YAC5B,CAAC,CAAC,SAAS,KAAK,CAAC;gBACf,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,GAAG,SAAS,gBAAgB,WAAW,UAAU;QACvD,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAChE,MAAM,EAAE,aAAa;YACnB,CAAC,CAAC,yBAAyB,aAAa,EAAE;YAC1C,CAAC,CAAC,SAAS,KAAK,CAAC;gBACf,CAAC,CAAC,+FAA+F;gBACjG,CAAC,CAAC,SAAS;KAChB,CAAC,CAAC;IAEH,wBAAwB;IACxB,IAAI,CAAC;QACH,GAAG,EAAE,kBAAkB;QACvB,KAAK,EAAE,eAAe;QACtB,KAAK,EACH,OAAO,CAAC,gBAAgB,KAAK,UAAU;YACrC,CAAC,CAAC,kGAAkG;YACpG,CAAC,CAAC,iBAAiB;QACvB,MAAM,EAAE,OAAO,CAAC,gBAAgB,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAC/D,MAAM,EACJ,OAAO,CAAC,gBAAgB,KAAK,UAAU;YACrC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,+HAA+H;KACtI,CAAC,CAAC;IAEH,2BAA2B;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,0BAA0B,CACrC,UAAU,EACV,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,CACpC,CAAC;QACF,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC;QAC9B,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;QAC5B,QAAQ,GAAG,MAAM,OAAO,uBAAuB,OAAO,yBAAyB,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,4BAA4B,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC;QACH,GAAG,EAAE,cAAc;QACnB,KAAK,EAAE,eAAe;QACtB,KAAK,EACH,CAAC,OAAO,CAAC,YAAY,KAAK,WAAW;YACnC,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,4CAA4C,CAAC,GAAG,QAAQ;QAC9D,MAAM,EACJ,OAAO,CAAC,YAAY,KAAK,WAAW;YAClC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,GAAG,CAAC;gBACX,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI;QACZ,MAAM,EACJ,OAAO,CAAC,YAAY,KAAK,WAAW;YAClC,CAAC,CAAC,wDAAwD;YAC1D,CAAC,CAAC,OAAO,GAAG,CAAC;gBACX,CAAC,CAAC,GAAG,OAAO,wHAAwH;gBACpI,CAAC,CAAC,SAAS;KAClB,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,gBAAgB,GAAG,EAAE,CAAC,MAAM,KAAK,2BAA2B,CAAC;IACnE,IAAI,CAAC;QACH,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,gBAAgB;YACrB,CAAC,CAAC,qCAAqC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG;YAC7E,CAAC,CAAC,EAAE,CAAC,OAAO;gBACV,CAAC,CAAC,YAAY,EAAE,CAAC,MAAM,GAAG;gBAC1B,CAAC,CAAC,OAAO,CAAC,oBAAoB;oBAC5B,CAAC,CAAC,sBAAsB;oBACxB,CAAC,CAAC,kCAAkC;QAC1C,MAAM,EAAE,gBAAgB;YACtB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,sBAAsB;gBACpC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,OAAO,CAAC,oBAAoB;oBAC5B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,MAAM;QACd,MAAM,EAAE,gBAAgB;YACtB,CAAC,CAAC,4HAA4H;YAC9H,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,sBAAsB;gBACpC,CAAC,CAAC,6EAA6E;gBAC/E,CAAC,CAAC,SAAS;KAChB,CAAC,CAAC;IAEH,uBAAuB;IACvB,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,GAAG,EAAE,iBAAiB;QACtB,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,uBAAuB,CAAC,uBAAuB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,GAAG;QAC5F,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;IAEH,0BAA0B;IAC1B,IAAI,CAAC;QACH,GAAG,EAAE,mBAAmB;QACxB,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,OAAO,CAAC,iBAAiB;YAC9B,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,uCAAuC;QAC3C,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;KAClD,CAAC,CAAC;IAEH,gDAAgD;IAChD,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,CAAC;QACH,WAAW,GAAG,WAAW,CACvB,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,SAAS,CAAC,CAC5C,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACH,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC;QAC1B,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACzD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,CAAmB;IACxD,MAAM,GAAG,GAAa,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrB,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}
+{"version":3,"file":"doctorReport.js","sourceRoot":"","sources":["../../src/governance/doctorReport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAA0B,cAAc,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAiCzD,MAAM,UAAU,gBAAgB,CAC9B,OAA6B,EAAE;IAE/B,IAAI,GAAG,GAA8C,IAAI,CAAC,MAAM,CAAC;IACjE,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC;YACH,GAAG,GAAG,UAAU,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;IACF,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAiB,EAAE,EAAE;QACjC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC,CAAC;IAEF,cAAc;IACd,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,kBAAkB;YACzB,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,2BAA2B,WAAW,+BAA+B;SAC9E,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,kBAAkB;YACzB,KAAK,EACH,OAAO,CAAC,IAAI,KAAK,UAAU;gBACzB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,OAAO,CAAC,QAAQ;oBAChB,CAAC,CAAC,cAAc;oBAChB,CAAC,CAAC,gCAAgC;YACxC,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YACnD,MAAM,EACJ,OAAO,CAAC,IAAI,KAAK,UAAU;gBACzB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,8KAA8K;SACrL,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB;IACpB,IAAI,CAAC;QACH,GAAG,EAAE,cAAc;QACnB,KAAK,EAAE,eAAe;QACtB,KAAK,EACH,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,YAAY,GAAG;QACzE,MAAM,EAAE,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACtD,MAAM,EACJ,OAAO,CAAC,YAAY,KAAK,KAAK;YAC5B,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,SAAS;KAChB,CAAC,CAAC;IAEH,qBAAqB;IACrB,IAAI,CAAC;QACH,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,gBAAgB;QACvB,KAAK,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;QAC3E,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QACjD,MAAM,EAAE,OAAO,CAAC,iBAAiB;YAC/B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,gEAAgE;KACrE,CAAC,CAAC;IAEH,0EAA0E;IAC1E,oEAAoE;IACpE,sDAAsD;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,uEAAuE;IACvE,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,GAAG,EAAE,iBAAiB;QACtB,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,sCAAsC;QACrE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAChC,MAAM,EAAE,QAAQ;YACd,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,4DAA4D;KACjE,CAAC,CAAC;IACH,IAAI,CAAC;QACH,GAAG,EAAE,cAAc;QACnB,KAAK,EAAE,eAAe;QACtB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,KAAK;QAC3D,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,gEAAgE;IAChE,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAErB,GAKD,EAAE,OAAO,CACX,CAAC;QACF,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC;QACpC,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACzE,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,aAAa,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,iCAAiC,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC;QACH,GAAG,EAAE,qBAAqB;QAC1B,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,aAAa;YAClB,CAAC,CAAC,UAAU,aAAa,GAAG;YAC5B,CAAC,CAAC,SAAS,KAAK,CAAC;gBACf,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,GAAG,SAAS,gBAAgB,WAAW,UAAU;QACvD,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAChE,MAAM,EAAE,aAAa;YACnB,CAAC,CAAC,yBAAyB,aAAa,EAAE;YAC1C,CAAC,CAAC,SAAS,KAAK,CAAC;gBACf,CAAC,CAAC,+FAA+F;gBACjG,CAAC,CAAC,SAAS;KAChB,CAAC,CAAC;IAEH,wBAAwB;IACxB,IAAI,CAAC;QACH,GAAG,EAAE,kBAAkB;QACvB,KAAK,EAAE,eAAe;QACtB,KAAK,EACH,OAAO,CAAC,gBAAgB,KAAK,UAAU;YACrC,CAAC,CAAC,yJAAyJ;YAC3J,CAAC,CAAC,iBAAiB;QACvB,MAAM,EAAE,OAAO,CAAC,gBAAgB,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAC/D,MAAM,EACJ,OAAO,CAAC,gBAAgB,KAAK,UAAU;YACrC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,+HAA+H;KACtI,CAAC,CAAC;IAEH,2BAA2B;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,0BAA0B,CACrC,UAAU,EACV,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,CACpC,CAAC;QACF,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC;QAC9B,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;QAC5B,QAAQ,GAAG,MAAM,OAAO,uBAAuB,OAAO,yBAAyB,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,4BAA4B,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC;QACH,GAAG,EAAE,cAAc;QACnB,KAAK,EAAE,eAAe;QACtB,KAAK,EACH,CAAC,OAAO,CAAC,YAAY,KAAK,WAAW;YACnC,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,4CAA4C,CAAC,GAAG,QAAQ;QAC9D,MAAM,EACJ,OAAO,CAAC,YAAY,KAAK,WAAW;YAClC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,GAAG,CAAC;gBACX,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI;QACZ,MAAM,EACJ,OAAO,CAAC,YAAY,KAAK,WAAW;YAClC,CAAC,CAAC,wDAAwD;YAC1D,CAAC,CAAC,OAAO,GAAG,CAAC;gBACX,CAAC,CAAC,GAAG,OAAO,wHAAwH;gBACpI,CAAC,CAAC,SAAS;KAClB,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,gBAAgB,GAAG,EAAE,CAAC,MAAM,KAAK,2BAA2B,CAAC;IACnE,IAAI,CAAC;QACH,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,gBAAgB;YACrB,CAAC,CAAC,qCAAqC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG;YAC7E,CAAC,CAAC,EAAE,CAAC,OAAO;gBACV,CAAC,CAAC,YAAY,EAAE,CAAC,MAAM,GAAG;gBAC1B,CAAC,CAAC,OAAO,CAAC,oBAAoB;oBAC5B,CAAC,CAAC,sBAAsB;oBACxB,CAAC,CAAC,kCAAkC;QAC1C,MAAM,EAAE,gBAAgB;YACtB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,sBAAsB;gBACpC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,OAAO,CAAC,oBAAoB;oBAC5B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,MAAM;QACd,MAAM,EAAE,gBAAgB;YACtB,CAAC,CAAC,4HAA4H;YAC9H,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,sBAAsB;gBACpC,CAAC,CAAC,6EAA6E;gBAC/E,CAAC,CAAC,SAAS;KAChB,CAAC,CAAC;IAEH,uBAAuB;IACvB,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,GAAG,EAAE,iBAAiB;QACtB,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,uBAAuB,CAAC,uBAAuB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,GAAG;QAC5F,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;IAEH,0BAA0B;IAC1B,IAAI,CAAC;QACH,GAAG,EAAE,mBAAmB;QACxB,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,OAAO,CAAC,iBAAiB;YAC9B,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,uCAAuC;QAC3C,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;KAClD,CAAC,CAAC;IAEH,gDAAgD;IAChD,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,CAAC;QACH,WAAW,GAAG,WAAW,CACvB,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,SAAS,CAAC,CAC5C,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACH,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC;QAC1B,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACzD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,CAAmB;IACxD,MAAM,GAAG,GAAa,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrB,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/governance/profile.d.ts

@@ -114,11 +114,29 @@ export declare function _resetActiveProfileForTesting(): void;
  */
 export declare const CONTAINED_AGENT_ALLOWED_TOOLS: readonly string[];
 /**
- * Tools that are DENIED in every mode when the profile is governed, even when
- * a recipe widens `allowedTools`. Network egress and shell are the two
- * capabilities that turn a prompt injection into exfiltration; a recipe that
- * genuinely needs them must say so with `sandbox: { network: true }` /
+ * The write-capable built-ins. Leaving them off `--allowed-tools` is not
+ * enough: an allow rule from any settings source the CLI loads re-enables a
+ * tool that is merely unlisted (observed against the real CLI). So they are
+ * DENIED by default, and a deny beats every allow rule in a settings file.
+ *
+ * Unlike network and shell, the step's own `tools:` (internally
+ * `allowedTools`) lifts the deny for exactly the tools it names, scoped
+ * (`Edit(src/**)`) or bare. That is a recorded widening (`allowedTools+X`),
+ * so `policy explain` shows it and it needs approval, the same as before.
+ * Orchestrator dispatch does not honour a caller's `allowedTools`, so these
+ * tools stay denied there.
+ */
+export declare const CONTAINED_AGENT_WRITE_TOOLS: readonly string[];
+/**
+ * Tools DENIED by default when the profile is governed.
+ *
+ * Network egress and shell can turn a prompt injection into exfiltration, so
+ * the recipe's `allowedTools` never lifts them. A recipe that genuinely needs
+ * them must say so with `sandbox: { network: true }` or
  * `sandbox: { shell: true }`, which `policy explain` reports as a widening.
+ *
+ * The write tools (see `CONTAINED_AGENT_WRITE_TOOLS`) ARE lifted by the
+ * step's own `tools:` (internally `allowedTools`), scoped or bare.
  */
 export declare const CONTAINED_AGENT_DENIED_TOOLS: readonly string[];
 export interface AgentContainment {
@@ -132,6 +150,17 @@ export interface AgentContainment {
     mcpAccess: boolean;
     /** Human-readable widenings the recipe requested, for `policy explain`. */
     widenings: string[];
+    /**
+     * Governed (profile-enforced) containment, as opposed to a compat step's
+     * own `sandbox: true` opt-in. A strict run is not widened by anything
+     * outside the recipe:
+     * - only USER Claude settings load, and the workspace's deny rules are
+     *   merged in by the bridge;
+     * - the built-in tool SET is restricted to the allowlist;
+     * - all hooks are disabled.
+     * Absent means not strict, which keeps a compat opt-in byte-identical.
+     */
+    strict?: boolean;
 }
 export interface StepSandboxRequest {
     /** Recipe-declared `sandbox: true` / `allowedTools:` (existing fields). */

package/dist/governance/profile.js

@@ -114,16 +114,40 @@ export const CONTAINED_AGENT_ALLOWED_TOOLS = Object.freeze([
     "LS",
 ]);
 /**
- * Tools that are DENIED in every mode when the profile is governed, even when
- * a recipe widens `allowedTools`. Network egress and shell are the two
- * capabilities that turn a prompt injection into exfiltration; a recipe that
- * genuinely needs them must say so with `sandbox: { network: true }` /
+ * The write-capable built-ins. Leaving them off `--allowed-tools` is not
+ * enough: an allow rule from any settings source the CLI loads re-enables a
+ * tool that is merely unlisted (observed against the real CLI). So they are
+ * DENIED by default, and a deny beats every allow rule in a settings file.
+ *
+ * Unlike network and shell, the step's own `tools:` (internally
+ * `allowedTools`) lifts the deny for exactly the tools it names, scoped
+ * (`Edit(src/**)`) or bare. That is a recorded widening (`allowedTools+X`),
+ * so `policy explain` shows it and it needs approval, the same as before.
+ * Orchestrator dispatch does not honour a caller's `allowedTools`, so these
+ * tools stay denied there.
+ */
+export const CONTAINED_AGENT_WRITE_TOOLS = Object.freeze([
+    "Edit",
+    "Write",
+    "MultiEdit",
+    "NotebookEdit",
+]);
+/**
+ * Tools DENIED by default when the profile is governed.
+ *
+ * Network egress and shell can turn a prompt injection into exfiltration, so
+ * the recipe's `allowedTools` never lifts them. A recipe that genuinely needs
+ * them must say so with `sandbox: { network: true }` or
  * `sandbox: { shell: true }`, which `policy explain` reports as a widening.
+ *
+ * The write tools (see `CONTAINED_AGENT_WRITE_TOOLS`) ARE lifted by the
+ * step's own `tools:` (internally `allowedTools`), scoped or bare.
  */
 export const CONTAINED_AGENT_DENIED_TOOLS = Object.freeze([
     "WebFetch",
     "WebSearch",
     "Bash",
+    ...CONTAINED_AGENT_WRITE_TOOLS,
 ]);
 /**
  * Pure: (profile, step request) → containment the driver must apply.
@@ -152,6 +176,15 @@ export function resolveAgentContainment(profile, req) {
         allowed.add(t);
     }
     const denied = new Set(CONTAINED_AGENT_DENIED_TOOLS);
+    // The recipe's own allowedTools lifts the default deny on a write tool
+    // (recorded above as a widening). The recipe's own disallowedTools are
+    // applied AFTER, so a tool it both allows and denies stays denied.
+    for (const t of req?.allowedTools ?? []) {
+        // `Edit(src/**)` lifts the bare `Edit` deny; the scoped rule then limits it.
+        const base = t.split("(")[0] ?? t;
+        if (CONTAINED_AGENT_WRITE_TOOLS.includes(base))
+            denied.delete(base);
+    }
     for (const t of req?.disallowedTools ?? [])
         denied.add(t);
     if (req?.network === true) {
@@ -176,6 +209,7 @@ export function resolveAgentContainment(profile, req) {
         envAllowlist: true,
         mcpAccess,
         widenings,
+        strict: true,
     };
 }
 //# sourceMappingURL=profile.js.map

package/dist/governance/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/governance/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAU,CAAC;AAuE7D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAmC;IAEnC,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC;IACxD,MAAM,IAAI,GAAgB,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrE,MAAM,cAAc,GAClB,GAAG,EAAE,YAAY,KAAK,MAAM;QAC5B,GAAG,EAAE,YAAY,KAAK,KAAK;QAC3B,GAAG,EAAE,YAAY,KAAK,KAAK;QACzB,CAAC,CAAC,GAAG,CAAC,YAAY;QAClB,CAAC,CAAC,KAAK,CAAC;IACZ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,IAAI;YACJ,QAAQ;YACR,YAAY,EAAE,cAAc;YAC5B,iBAAiB,EAAE,KAAK;YACxB,eAAe,EAAE,KAAK;YACtB,aAAa,EAAE,KAAK;YACpB,gBAAgB,EAAE,QAAQ;YAC1B,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,KAAK;YAC3B,iBAAiB,EAAE,OAAO;YAC1B,iBAAiB,EAAE,MAAM;YACzB,iBAAiB,EAAE,KAAK;YACxB,oBAAoB,EAAE,IAAI;SAC3B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,YAAY,EAAE,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;QACvD,iBAAiB,EAAE,IAAI;QACvB,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,IAAI;QACnB,gBAAgB,EAAE,UAAU;QAC5B,YAAY,EAAE,WAAW;QACzB,oBAAoB,EAAE,IAAI;QAC1B,iBAAiB,EAAE,MAAM;QACzB,iBAAiB,EAAE,QAAQ;QAC3B,iBAAiB,EAAE,IAAI;QACvB,oBAAoB,EAAE,KAAK;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAsB,MAAM,CAAC,MAAM,CAC5D,cAAc,CAAC,SAAS,CAAC,CAC1B,CAAC;AACF,MAAM,CAAC,MAAM,gBAAgB,GAAsB,MAAM,CAAC,MAAM,CAC9D,cAAc,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CACxC,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,CAAgC;IACzD,OAAO,CAAC,EAAE,IAAI,KAAK,UAAU,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,EAAE;AACF,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,6BAA6B;AAC7B,8EAA8E;AAE9E,IAAI,MAAM,GAAsB,cAAc,CAAC;AAE/C,MAAM,UAAU,gBAAgB,CAAC,CAAoB;IACnD,MAAM,GAAG,CAAC,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,6BAA6B;IAC3C,MAAM,GAAG,cAAc,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC5E,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;CACL,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC3E,UAAU;IACV,WAAW;IACX,MAAM;CACP,CAAC,CAAC;AA0BH;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA0B,EAC1B,GAAmC;IAEnC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;QACvC,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5D,WAAW,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;YAC9C,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,GAAG,EAAE,SAAS,KAAK,IAAI;YAClC,SAAS;SACV,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,6BAA6B,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,4BAA4B,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,eAAe,IAAI,EAAE;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,GAAG,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3B,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,6EAA6E;IAC7E,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,KAAK,IAAI,CAAC;IAC1C,IAAI,SAAS;QAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC;QAC1B,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC;QACxB,YAAY,EAAE,IAAI;QAClB,SAAS;QACT,SAAS;KACV,CAAC;AACJ,CAAC"}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/governance/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAU,CAAC;AAuE7D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAmC;IAEnC,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC;IACxD,MAAM,IAAI,GAAgB,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrE,MAAM,cAAc,GAClB,GAAG,EAAE,YAAY,KAAK,MAAM;QAC5B,GAAG,EAAE,YAAY,KAAK,KAAK;QAC3B,GAAG,EAAE,YAAY,KAAK,KAAK;QACzB,CAAC,CAAC,GAAG,CAAC,YAAY;QAClB,CAAC,CAAC,KAAK,CAAC;IACZ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,IAAI;YACJ,QAAQ;YACR,YAAY,EAAE,cAAc;YAC5B,iBAAiB,EAAE,KAAK;YACxB,eAAe,EAAE,KAAK;YACtB,aAAa,EAAE,KAAK;YACpB,gBAAgB,EAAE,QAAQ;YAC1B,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,KAAK;YAC3B,iBAAiB,EAAE,OAAO;YAC1B,iBAAiB,EAAE,MAAM;YACzB,iBAAiB,EAAE,KAAK;YACxB,oBAAoB,EAAE,IAAI;SAC3B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,YAAY,EAAE,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;QACvD,iBAAiB,EAAE,IAAI;QACvB,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,IAAI;QACnB,gBAAgB,EAAE,UAAU;QAC5B,YAAY,EAAE,WAAW;QACzB,oBAAoB,EAAE,IAAI;QAC1B,iBAAiB,EAAE,MAAM;QACzB,iBAAiB,EAAE,QAAQ;QAC3B,iBAAiB,EAAE,IAAI;QACvB,oBAAoB,EAAE,KAAK;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAsB,MAAM,CAAC,MAAM,CAC5D,cAAc,CAAC,SAAS,CAAC,CAC1B,CAAC;AACF,MAAM,CAAC,MAAM,gBAAgB,GAAsB,MAAM,CAAC,MAAM,CAC9D,cAAc,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CACxC,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,CAAgC;IACzD,OAAO,CAAC,EAAE,IAAI,KAAK,UAAU,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,EAAE;AACF,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,6BAA6B;AAC7B,8EAA8E;AAE9E,IAAI,MAAM,GAAsB,cAAc,CAAC;AAE/C,MAAM,UAAU,gBAAgB,CAAC,CAAoB;IACnD,MAAM,GAAG,CAAC,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,6BAA6B;IAC3C,MAAM,GAAG,cAAc,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC5E,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;CACL,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1E,MAAM;IACN,OAAO;IACP,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC3E,UAAU;IACV,WAAW;IACX,MAAM;IACN,GAAG,2BAA2B;CAC/B,CAAC,CAAC;AAqCH;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA0B,EAC1B,GAAmC;IAEnC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;QACvC,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5D,WAAW,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;YAC9C,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,GAAG,EAAE,SAAS,KAAK,IAAI;YAClC,SAAS;SACV,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,6BAA6B,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,4BAA4B,CAAC,CAAC;IAC7D,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,6EAA6E;QAC7E,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,eAAe,IAAI,EAAE;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,GAAG,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3B,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,6EAA6E;IAC7E,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,KAAK,IAAI,CAAC;IAC1C,IAAI,SAAS;QAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC;QAC1B,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC;QACxB,YAAY,EAAE,IAAI;QAClB,SAAS;QACT,SAAS;QACT,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC"}

package/dist/recipes/yamlRunner.d.ts

@@ -811,6 +811,14 @@ export declare function defaultClaudeCodeFn(prompt: string, opts?: {
      * fallback below covers that case.
      */
     systemPrompt?: string;
+    /**
+     * Resolved by `executeAgent` (Phase 0 step 6). When enforced it is
+     * applied exactly as the subprocess driver applies it, via the shared
+     * `containedPermissionArgs`, plus the same settings deny file and env
+     * allowlist. This is the `recipe run --local` / `recipe record` path,
+     * and it must not be a way around containment.
+     */
+    containment?: import("../governance/profile.js").AgentContainment;
 }): Promise<string>;
 /**
  * Map a driver's `providerMeta` to AgentUsage. Returns undefined unless BOTH