pi-codex-auto-review 0.1.0

package/dist/index.js

@@ -0,0 +1,106 @@
+import { join, resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { createBashToolDefinition, createReadToolDefinition, createEditToolDefinition, createWriteToolDefinition, createGrepToolDefinition, createFindToolDefinition, createLsToolDefinition } from '@earendil-works/pi-coding-agent';
+import { defaultProfile, loadSettings, validateSettings } from './policy/index.js';
+import { ApprovalManager, FileGrantPersistence } from './approvals.js';
+import { AuditLog } from './audit.js';
+import { NativeExecutor } from './sandbox/executor.js';
+import { GuardController } from './tools/controller.js';
+import { AUTHORIZATION_ENTRY, safeEvidence } from './review/context.js';
+import { canonicalJson, createProfile, GuardError } from './contracts.js';
+import { redact } from './audit.js';
+import { createGuardedMcpExtension } from './tools/mcp.js';
+export function createGuardExtension(options = {}) {
+    let controller;
+    const factory = async (pi) => {
+        const cwd = options.cwd ?? process.cwd();
+        const settings = options.settingsPath ? await loadSettings(options.settingsPath) : validateSettings(options.settings ?? {});
+        const agentDir = options.agentDir ?? process.env.PI_CODING_AGENT_DIR ?? join(homedir(), '.pi', 'agent');
+        const controlDir = join(agentDir, 'guard');
+        const baseline = await defaultProfile(cwd, settings, [agentDir, ...(options.settingsPath ? [resolve(options.settingsPath)] : [])], options.trustedExtensionPaths);
+        const profile = options.profile ? createProfile({ ...options.profile,
+            denyRead: [...new Set([...options.profile.denyRead, ...baseline.denyRead])],
+            denyWrite: [...new Set([...options.profile.denyWrite, ...baseline.denyWrite])],
+        }) : baseline;
+        const audit = new AuditLog(join(controlDir, 'audit.jsonl'));
+        const approvals = new ApprovalManager({ reviewTimeoutMs: settings.reviewTimeoutMs, approvalTimeoutMs: settings.approvalTimeoutMs, approvalPolicy: settings.approvalPolicy, approvalsReviewer: settings.approvalsReviewer, audit, persistence: new FileGrantPersistence(join(controlDir, 'grants.json')) });
+        controller = new GuardController({ profile, settings, executor: options.executor ?? new NativeExecutor(), approvals, audit, provider: options.provider, shellPath: options.bashOptions?.shellPath });
+        try {
+            await controller.initialize(cwd);
+        }
+        catch (error) {
+            await controller.close();
+            controller = undefined;
+            throw error;
+        }
+        const guard = controller;
+        pi.registerTool(guard.wrapTool(createBashToolDefinition(cwd, options.bashOptions), options.bashOptions));
+        pi.registerTool(guard.wrapTool(createReadToolDefinition(cwd, options.readOptions), options.readOptions));
+        for (const create of [createEditToolDefinition, createWriteToolDefinition, createGrepToolDefinition, createFindToolDefinition, createLsToolDefinition])
+            pi.registerTool(guard.wrapTool(create(cwd)));
+        pi.on('session_start', (_event, context) => { guard.assertReady(); guard.reset(context.sessionManager.getSessionId(), context.sessionManager); });
+        pi.on('session_tree', (_event, context) => { guard.reset(context.sessionManager.getSessionId(), context.sessionManager); });
+        pi.on('input', event => {
+            if (event.source === 'interactive' || event.source === 'rpc') {
+                guard.authorizeUser(event.text);
+                pi.appendEntry(AUTHORIZATION_ENTRY, { text: safeEvidence(event.text), source: event.source });
+            }
+        });
+        pi.on('before_agent_start', event => { guard.reviewContext.instructions(event); });
+        pi.on('agent_start', () => { guard.startTurn(); });
+        pi.on('message_end', event => { guard.reviewContext.message(event.message); });
+        pi.on('tool_call', event => {
+            guard.assertReady();
+            guard.noteCall(event);
+            if (!['bash', 'read', 'edit', 'write', 'grep', 'find', 'ls', 'codemode', ...settings.trustedTools].includes(event.toolName) && !guard.isExternalTool(event.toolName))
+                return { block: true, reason: 'Unknown tool needs an explicit trusted adapter' };
+        });
+        pi.on('tool_result', event => {
+            guard.reviewContext.toolResult({ tool: event.toolName, content: event.content.filter(item => item.type === 'text').map(item => ({ type: 'text', text: item.text })) }, event.toolCallId);
+            guard.completeCall(event.toolCallId);
+        });
+        pi.on('user_bash', (event, context) => { guard.assertReady(); return { operations: guard.userBashOperations(context, event.command) }; });
+        pi.on('session_shutdown', async () => { await guard.close(); });
+        pi.registerCommand('approve', { description: '최근 자동 검토 거부 중 정확한 작업 하나를 한 번 재검토합니다.', handler: async (args, context) => {
+                await context.waitForIdle();
+                const denials = guard.approvals.lifecycle.recentDenials;
+                if (!denials.length) {
+                    context.ui.notify('재검토할 최근 거부가 없습니다.', 'info');
+                    return;
+                }
+                let id = args.trim();
+                if (!id) {
+                    if (!context.hasUI)
+                        throw new GuardError('APPROVAL_UI_UNAVAILABLE', 'Use /approve <denial-id> to select one exact recent denial');
+                    const choices = denials.map(item => `${item.id} | ${item.action.tool} | ${redact(canonicalJson(item.action.args))} | ${item.assessment.rationale}`);
+                    const selected = await context.ui.select('자동 검토 거부 — 한 번 재검토할 작업 선택', choices);
+                    if (!selected)
+                        return;
+                    id = denials[choices.indexOf(selected)].id;
+                }
+                const retry = await guard.authorizeRetry(id, context);
+                if (retry.denial.action.source === 'user-bash' && !retry.denial.action.args.networkDestination) {
+                    await guard.retryUserBash(retry.denial.action, context);
+                    context.ui.notify('선택한 명령을 다시 검토하고 실행했습니다.', 'info');
+                    return;
+                }
+                const nested = retry.denial.action.source === 'nested' ? 'Invoke only this exact tool through codemode to preserve the original nested source.' : 'Retry only this exact tool action.';
+                pi.sendUserMessage(`${nested}\nTool: ${retry.denial.action.tool}\nArguments: ${canonicalJson(retry.args)}\nThe user selected denial ${id} for one retry. The controller holds a one-use exact-action marker; automatic review and policy still apply. Do not repeat unrelated earlier side effects.`, { expandPromptTemplates: false });
+            } });
+        if (options.mcp !== false) {
+            try {
+                const mcp = await createGuardedMcpExtension(agentDir, () => guard, options.mcp, options.mcpToolPolicies);
+                await (typeof mcp === 'function' ? mcp : mcp.factory)(pi);
+            }
+            catch (error) {
+                await guard.close();
+                controller = undefined;
+                throw error;
+            }
+        }
+    };
+    return { factory, assertReady() { if (!controller)
+            throw new Error('pi-codex-auto-review extension failed to load'); controller.assertReady(); return controller; } };
+}
+export default createGuardExtension().factory;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,sBAAsB,EAA+F,MAAM,iCAAiC,CAAC;AACnU,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAsB,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,cAAc,EAAwB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,yBAAyB,EAAwB,MAAM,gBAAgB,CAAC;AAgBjF,MAAM,UAAU,oBAAoB,CAAC,UAAwB,EAAE;IAC7D,IAAI,UAAuC,CAAC;IAC5C,MAAM,OAAO,GAAqB,KAAK,EAAC,EAAE,EAAC,EAAE;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC5H,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACxG,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAClK,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,EAAC,GAAG,OAAO,CAAC,OAAO;YACjE,QAAQ,EAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzE,SAAS,EAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;SAC7E,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACd,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3S,UAAU,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,cAAc,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QACrM,IAAI,CAAC;YAAC,MAAM,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;YAAC,UAAU,GAAG,SAAS,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;QAC1H,MAAM,KAAK,GAAG,UAAU,CAAC;QACzB,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACzG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACzG,KAAK,MAAM,MAAM,IAAI,CAAC,wBAAwB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,sBAAsB,CAAC;YAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrM,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClJ,EAAE,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5H,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;YACrB,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7D,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,EAAE,CAAC,WAAW,CAAC,mBAAmB,EAAE,EAAC,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAC,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE;YACzB,KAAK,CAAC,WAAW,EAAE,CAAC;YAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,OAAO,EAAC,MAAM,EAAC,MAAM,EAAC,IAAI,EAAC,UAAU,EAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAC,IAAI,EAAE,MAAM,EAAC,gDAAgD,EAAE,CAAC;QAC/O,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE;YAC3B,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,EAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,IAAI,CAAC,IAAI,EAAC,CAAC,CAAC,EAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAClL,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1I,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,EAAC,WAAW,EAAC,sCAAsC,EAAC,OAAO,EAAC,KAAK,EAAC,IAAI,EAAC,OAAO,EAAC,EAAE;gBAC7G,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC;gBACtD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBAAA,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAC,MAAM,CAAC,CAAC;oBAAA,OAAO;gBAAA,CAAC;gBAC5E,IAAI,EAAE,GAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnB,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,IAAI,CAAC,OAAO,CAAC,KAAK;wBAAE,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAC,4DAA4D,CAAC,CAAC;oBACjI,MAAM,OAAO,GAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA,EAAE,CAAA,GAAG,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;oBAChJ,MAAM,QAAQ,GAAC,MAAM,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,2BAA2B,EAAC,OAAO,CAAC,CAAC;oBAC5E,IAAI,CAAC,QAAQ;wBAAE,OAAO;oBAAC,EAAE,GAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAE,CAAC,EAAE,CAAC;gBACnE,CAAC;gBACD,MAAM,KAAK,GAAC,MAAM,KAAK,CAAC,cAAc,CAAC,EAAE,EAAC,OAAO,CAAC,CAAC;gBACnD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAG,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBAC7F,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAC,OAAO,CAAC,CAAC;oBAAA,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,yBAAyB,EAAC,MAAM,CAAC,CAAC;oBAAA,OAAO;gBACpH,CAAC;gBACD,MAAM,MAAM,GAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAG,QAAQ,CAAA,CAAC,CAAA,sFAAsF,CAAA,CAAC,CAAA,oCAAoC,CAAC;gBAC/K,EAAE,CAAC,eAAe,CAAC,GAAG,MAAM,WAAW,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,gBAAgB,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,8BAA8B,EAAE,4JAA4J,EAAC,EAAC,qBAAqB,EAAC,KAAK,EAAC,CAAC,CAAC;YACtU,CAAC,EAAC,CAAC,CAAC;QACJ,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;gBACzG,MAAM,CAAC,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;gBAAC,UAAU,GAAG,SAAS,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;AACxK,CAAC;AACD,eAAe,oBAAoB,EAAE,CAAC,OAAO,CAAC"}

package/dist/native/darwin-arm64/artifact.json

@@ -0,0 +1,5 @@
+{
+  "platform": "darwin-arm64",
+  "sourceDigest": "77a7cd21c340d5d5956164cc0ce32970097bc8f4180a2e373df56a1ff79b5088",
+  "sha256": "c8dba8e1fa765135ff805a6c71707c706bfb193a6593552f334e256816942973"
+}

package/dist/native/linux-x64/artifact.json

@@ -0,0 +1,5 @@
+{
+  "platform": "linux-x64",
+  "sourceDigest": "77a7cd21c340d5d5956164cc0ce32970097bc8f4180a2e373df56a1ff79b5088",
+  "sha256": "d969c9574db6c5c1c172b03bf440be0f3df9c96d0239159a71a78fecf9c4d958"
+}

package/dist/policy/domains.d.ts

@@ -0,0 +1,5 @@
+export declare function normalizeHost(host: string): string;
+export declare function isNetworkHost(host: unknown): boolean;
+export declare function isDomainPattern(pattern: unknown): pattern is string;
+/** Shared with the native configuration so policy and transport agree on subdomains. */
+export declare function matchesDomain(host: string, pattern: string): boolean;

package/dist/policy/domains.js

@@ -0,0 +1,18 @@
+import { isIP } from 'node:net';
+export function normalizeHost(host) {
+    const value = host.toLowerCase().replace(/\.+$/, '');
+    const literal = value.startsWith('[') && value.endsWith(']') ? value.slice(1, -1) : value;
+    return isIP(literal) === 6 ? new URL(`http://[${literal}]/`).hostname.slice(1, -1) : value;
+}
+export function isNetworkHost(host) {
+    return typeof host === 'string' && (isIP(normalizeHost(host)) === 6 || /^[a-z0-9][a-z0-9.-]*$/i.test(host));
+}
+export function isDomainPattern(pattern) {
+    return typeof pattern === 'string' && (isNetworkHost(pattern) || pattern.startsWith('*.') && /^[a-z0-9][a-z0-9.-]*$/i.test(pattern.slice(2)));
+}
+/** Shared with the native configuration so policy and transport agree on subdomains. */
+export function matchesDomain(host, pattern) {
+    const value = normalizeHost(host), rule = normalizeHost(pattern);
+    return rule.startsWith('*.') ? value.endsWith(rule.slice(1)) && value !== rule.slice(2) : value === rule;
+}
+//# sourceMappingURL=domains.js.map

package/dist/policy/domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domains.js","sourceRoot":"","sources":["../../src/policy/domains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzF,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5F,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9G,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChJ,CAAC;AACD,wFAAwF;AACxF,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe;IACzD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC;AAC3G,CAAC"}

package/dist/policy/index.d.ts

@@ -0,0 +1,56 @@
+import { type GuardAction, type PermissionProfile, type PolicyDecision, type ApprovalPolicy } from '../contracts.js';
+import { canonicalPath, isWithin, resolveToolPath } from './paths.js';
+import { analyzeShell, matchesPrefix } from './shell.js';
+export { canonicalPath, isWithin, analyzeShell, matchesPrefix, resolveToolPath };
+export interface CommandRule {
+    readonly prefix: readonly string[];
+    readonly decision: 'allow' | 'ask' | 'deny';
+}
+export interface GuardSettings {
+    readonly mode: 'read-only' | 'workspace-write';
+    readonly commandRules: readonly CommandRule[];
+    readonly allowedDomains: readonly string[];
+    readonly reviewTimeoutMs: number;
+    readonly approvalTimeoutMs: number;
+    readonly executionTimeoutSeconds: number;
+    readonly trustedTools: readonly string[];
+    readonly approvalPolicy: ApprovalPolicy;
+    readonly approvalsReviewer: 'auto_review' | 'user';
+    readonly reviewModel: {
+        readonly provider: string;
+        readonly id: string;
+    } | null;
+    /** Replaces only the tenant policy; intrinsic risk, trust and outcome rules remain enforced. */
+    readonly reviewPolicy: string | null;
+    readonly reviewMaxRounds: number;
+    readonly reviewMaxOutputTokens: number;
+    readonly reviewContextChars: number;
+    readonly ruleFiles: readonly string[];
+    readonly writableRoots: readonly string[];
+    readonly excludeSlashTmp: boolean;
+    readonly excludeTmpdir: boolean;
+    readonly projectDocMaxBytes: number;
+    readonly projectDocFallbackFilenames: readonly string[];
+    readonly projectRootMarkers: readonly string[] | null;
+}
+export declare const DEFAULT_SETTINGS: GuardSettings;
+export declare function validateSettings(value: unknown): GuardSettings;
+export declare function loadSettings(path: string): Promise<GuardSettings>;
+export declare function defaultProfile(cwd: string, settings: GuardSettings, controlPaths?: readonly string[], trustedExtensionPaths?: readonly string[]): Promise<PermissionProfile>;
+export declare class PolicyEngine {
+    readonly settings: GuardSettings;
+    private rules;
+    private isInitialized;
+    private ruleSources;
+    private compiledRules?;
+    private readonly matchCache;
+    private effectiveProfile;
+    get profile(): PermissionProfile;
+    get revision(): string;
+    constructor(settings: GuardSettings, profile: PermissionProfile);
+    initialize(cwd?: string): Promise<void>;
+    evaluate(action: GuardAction, signal?: AbortSignal): Promise<PolicyDecision>;
+    private shellDecision;
+    private resolvedProfile;
+    private nativeWriteScope;
+}

package/dist/policy/index.js

@@ -0,0 +1,304 @@
+import { readFile, stat } from 'node:fs/promises';
+import { basename, dirname, join, resolve } from 'node:path';
+import { homedir, tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { createProfile, decision, digest, immutable, GuardError, EMPTY_DELTA, TOOL_NAMES } from '../contracts.js';
+import { canonicalPath, isWithin, resolveToolPath } from './paths.js';
+import { analyzeShell, matchesPrefix } from './shell.js';
+import { reviewPolicy } from '../review/policy.js';
+import { matchesDomain, isNetworkHost, isDomainPattern, normalizeHost } from './domains.js';
+import { evaluateRules, ruleCommands, matchesRule } from './rules.js';
+import { runtimeWritePaths } from '../sandbox/runtime-write-paths.js';
+import { hasNativePatternChars } from '../sandbox/paths.js';
+export { canonicalPath, isWithin, analyzeShell, matchesPrefix, resolveToolPath };
+export const DEFAULT_SETTINGS = immutable({
+    mode: 'workspace-write', commandRules: [], allowedDomains: [], reviewTimeoutMs: 20_000, approvalTimeoutMs: 60_000, executionTimeoutSeconds: 120, trustedTools: [],
+    approvalPolicy: 'on-request', approvalsReviewer: 'auto_review', reviewModel: null, reviewPolicy: null,
+    reviewMaxRounds: 4, reviewMaxOutputTokens: 2048, reviewContextChars: 60000,
+    ruleFiles: [], writableRoots: [], excludeSlashTmp: false, excludeTmpdir: false,
+    projectDocMaxBytes: 32768, projectDocFallbackFilenames: [], projectRootMarkers: null,
+});
+export function validateSettings(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new GuardError('INVALID_SETTINGS', 'Settings must be an object');
+    const raw = value;
+    for (const key of Object.keys(raw))
+        if (!Object.hasOwn(DEFAULT_SETTINGS, key))
+            throw new GuardError('INVALID_SETTINGS', `Unknown setting: ${key}`);
+    const settings = { ...DEFAULT_SETTINGS, ...raw };
+    if (!['read-only', 'workspace-write'].includes(settings.mode))
+        throw new GuardError('INVALID_SETTINGS', 'Unknown mode');
+    for (const key of ['reviewTimeoutMs', 'approvalTimeoutMs', 'executionTimeoutSeconds'])
+        if (!Number.isFinite(settings[key]) || settings[key] <= 0)
+            throw new GuardError('INVALID_SETTINGS', `Invalid ${key}`);
+    if (!Array.isArray(settings.allowedDomains) || settings.allowedDomains.some(x => !isDomainPattern(x)))
+        throw new GuardError('INVALID_SETTINGS', 'Invalid domains');
+    if (!Array.isArray(settings.trustedTools) || settings.trustedTools.some(x => typeof x !== 'string' || !x))
+        throw new GuardError('INVALID_SETTINGS', 'Invalid trusted tools');
+    const approval = settings.approvalPolicy;
+    if (approval !== 'on-request' && approval !== 'never' && (!approval || typeof approval !== 'object' || Array.isArray(approval) || Object.keys(approval).some(key => !['sandbox', 'rules', 'mcp_elicitations'].includes(key)) || typeof approval.sandbox !== 'boolean' || typeof approval.rules !== 'boolean' || approval.mcp_elicitations !== undefined && typeof approval.mcp_elicitations !== 'boolean'))
+        throw new GuardError('INVALID_SETTINGS', 'Invalid approval policy');
+    if (!['auto_review', 'user'].includes(settings.approvalsReviewer))
+        throw new GuardError('INVALID_SETTINGS', 'Invalid approvals reviewer');
+    if (settings.reviewModel !== null && (!settings.reviewModel || typeof settings.reviewModel !== 'object' || Array.isArray(settings.reviewModel) || Object.keys(settings.reviewModel).some(key => !['provider', 'id'].includes(key)) || ![settings.reviewModel.provider, settings.reviewModel.id].every(value => typeof value === 'string' && value.trim().length > 0 && !/[\0\r\n]/.test(value))))
+        throw new GuardError('INVALID_SETTINGS', 'Invalid review model');
+    if (settings.reviewPolicy !== null && (typeof settings.reviewPolicy !== 'string' || !settings.reviewPolicy.trim() || settings.reviewPolicy.length > 100000))
+        throw new GuardError('INVALID_SETTINGS', 'Invalid reviewer policy');
+    for (const [key, maximum] of [['reviewMaxRounds', 16], ['reviewMaxOutputTokens', 16384], ['reviewContextChars', 500000]])
+        if (!Number.isInteger(settings[key]) || settings[key] < 1 || settings[key] > maximum)
+            throw new GuardError('INVALID_SETTINGS', `Invalid ${key}`);
+    for (const key of ['ruleFiles', 'writableRoots'])
+        if (!Array.isArray(settings[key]) || settings[key].some(value => typeof value !== 'string' || !value || value.includes('\0')))
+            throw new GuardError('INVALID_SETTINGS', `Invalid ${key}`);
+    for (const key of ['excludeSlashTmp', 'excludeTmpdir'])
+        if (typeof settings[key] !== 'boolean')
+            throw new GuardError('INVALID_SETTINGS', `Invalid ${key}`);
+    if (!Number.isSafeInteger(settings.projectDocMaxBytes) || settings.projectDocMaxBytes < 0 || settings.projectDocMaxBytes > 1000000)
+        throw new GuardError('INVALID_SETTINGS', 'Invalid project document byte budget');
+    for (const values of [settings.projectDocFallbackFilenames, settings.projectRootMarkers ?? []])
+        if (!Array.isArray(values) || values.some(value => typeof value !== 'string'))
+            throw new GuardError('INVALID_SETTINGS', 'Invalid context discovery filenames');
+    if (!Array.isArray(settings.commandRules))
+        throw new GuardError('INVALID_SETTINGS', 'Invalid command rules');
+    for (const rule of settings.commandRules) {
+        if (!rule || !['allow', 'ask', 'deny'].includes(rule.decision) || !Array.isArray(rule.prefix) || !rule.prefix.length || rule.prefix.some((x) => typeof x !== 'string' || !x || /[\0\n]/.test(x)))
+            throw new GuardError('INVALID_SETTINGS', 'Invalid command rule');
+        if (Object.keys(rule).some(k => !['prefix', 'decision'].includes(k)))
+            throw new GuardError('INVALID_SETTINGS', 'Unknown command rule field');
+    }
+    return immutable(JSON.parse(JSON.stringify(settings)));
+}
+export async function loadSettings(path) {
+    try {
+        return validateSettings(JSON.parse(await readFile(path, 'utf8')));
+    }
+    catch (error) {
+        throw new GuardError('INVALID_SETTINGS', 'Permission settings could not be loaded', { cause: error });
+    }
+}
+export async function defaultProfile(cwd, settings, controlPaths = [], trustedExtensionPaths = []) {
+    const workspace = await canonicalPath(cwd, cwd), home = homedir();
+    const hardRead = [join(home, '.ssh'), join(home, '.aws'), join(home, '.codex'), join(home, '.pi', 'agent'), ...controlPaths, ...settings.ruleFiles];
+    const hardWrite = [...hardRead, join(workspace, '.pi', 'guard'), fileURLToPath(new URL('../', import.meta.url))];
+    const roots = [...new Set(await Promise.all([workspace, ...settings.writableRoots, ...(!settings.excludeSlashTmp ? ['/tmp'] : []), ...(!settings.excludeTmpdir ? [tmpdir()] : [])].map(path => canonicalPath(path, cwd))))];
+    const readOnlyPaths = [];
+    for (const input of trustedExtensionPaths) {
+        const path = await canonicalPath(input, cwd);
+        // A trusted module can import sibling modules; protect its containing code directory.
+        hardWrite.push((await stat(path)).isDirectory() ? path : dirname(path));
+    }
+    for (const root of roots) {
+        const git = join(root, '.git');
+        readOnlyPaths.push(await canonicalPath(git, cwd));
+        try {
+            if ((await stat(git)).isFile()) {
+                const pointer = /^gitdir:\s*(.+)\s*$/m.exec(await readFile(git, 'utf8'));
+                if (pointer)
+                    readOnlyPaths.push(await canonicalPath(resolve(root, pointer[1]), cwd));
+            }
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        for (const name of ['.agents', '.codex']) {
+            const path = join(root, name);
+            try {
+                if ((await stat(path)).isDirectory())
+                    readOnlyPaths.push(await canonicalPath(path, cwd));
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        readOnlyPaths.push(await canonicalPath(join(root, '.pi'), cwd));
+        hardWrite.push(...['mcp.json', 'settings.json', 'extensions', 'guard'].map(name => join(root, '.pi', name)));
+    }
+    return createProfile({ mode: settings.mode, readRoots: ['/'], writeRoots: settings.mode === 'workspace-write' ? roots : [], denyRead: await Promise.all(hardRead.map(p => canonicalPath(p, cwd))), denyWrite: await Promise.all(hardWrite.map(p => canonicalPath(p, cwd))), readOnlyPaths, allowedDomains: [...settings.allowedDomains], deniedDomains: [] });
+}
+export class PolicyEngine {
+    settings;
+    rules;
+    isInitialized;
+    ruleSources = [];
+    compiledRules;
+    matchCache = new Map();
+    effectiveProfile;
+    get profile() { return this.effectiveProfile; }
+    get revision() { return digest({ settings: this.settings, profile: this.profile, rules: this.rules, ruleSources: this.ruleSources, compiledRules: this.compiledRules ?? null, reviewPolicyDigest: reviewPolicy(this.settings.reviewPolicy).digest }); }
+    constructor(settings, profile) {
+        this.settings = settings;
+        this.effectiveProfile = profile;
+        this.rules = settings.commandRules.map(rule => ({ pattern: rule.prefix, decision: rule.decision === 'ask' ? 'prompt' : rule.decision === 'deny' ? 'forbidden' : 'allow' }));
+        this.isInitialized = settings.ruleFiles.length === 0;
+    }
+    async initialize(cwd = process.cwd()) {
+        if (this.isInitialized)
+            return;
+        this.ruleSources = immutable(await Promise.all(this.settings.ruleFiles.map(async (path) => ({ name: resolve(cwd, path), source: await readFile(resolve(cwd, path), 'utf8') }))));
+        this.compiledRules = await evaluateRules(this.ruleSources);
+        const allowed = this.compiledRules.allowedDomains, denied = this.compiledRules.deniedDomains;
+        this.effectiveProfile = createProfile({ ...this.profile, allowedDomains: [...new Set([...this.profile.allowedDomains.filter(host => !denied.includes(host)), ...allowed])], deniedDomains: [...new Set([...this.profile.deniedDomains, ...denied])] });
+        this.isInitialized = true;
+    }
+    async evaluate(action, signal) {
+        if (!this.isInitialized)
+            return decision(action, 'deny', 'Command rules have not been loaded', EMPTY_DELTA, true);
+        if (action.policyRevision !== this.revision || action.permissionDigest !== digest(this.profile))
+            return decision(action, 'deny', 'Stale policy or permission profile', EMPTY_DELTA, true);
+        if (!TOOL_NAMES.includes(action.tool))
+            return decision(action, 'ask', 'Unknown tool: annotations do not establish permission');
+        if (action.tool === 'bash')
+            return this.shellDecision(action, signal);
+        const input = action.args.path ?? action.cwd;
+        if (typeof input !== 'string')
+            return decision(action, 'deny', 'Invalid path input', EMPTY_DELTA, true);
+        const target = await canonicalPath(await resolveToolPath(input, action.cwd, action.tool === 'read'), action.cwd);
+        const profile = await this.resolvedProfile(action.cwd);
+        const isWrite = action.tool === 'write' || action.tool === 'edit';
+        if (profile.denyRead.some(p => isWithin(target, p)) || (isWrite && profile.denyWrite.some(p => isWithin(target, p))))
+            return decision(action, 'deny', 'Protected path', EMPTY_DELTA, true);
+        const canRead = profile.readRoots.some(p => isWithin(target, p));
+        const canWrite = !isWrite || profile.writeRoots.some(p => isWithin(target, p)) && !(profile.readOnlyPaths ?? []).some(p => isWithin(target, p));
+        if (canRead && canWrite)
+            return decision(action, 'allow', 'Within current filesystem permissions');
+        const writePath = isWrite && !canWrite ? await this.nativeWriteScope(target, action.cwd) : target;
+        if ((!canRead && hasNativePatternChars(target)) || (!canWrite && hasNativePatternChars(writePath)))
+            return decision(action, 'deny', 'Native permission roots containing *, ?, [ or ] cannot be approved as literal paths', EMPTY_DELTA, true);
+        return decision(action, 'ask', writePath === target ? 'Filesystem permission required' : 'The native backend requires the enclosing directory in this invocation; review this full write scope', { readPaths: canRead ? [] : [target], writePaths: canWrite ? [] : [writePath], domains: [] });
+    }
+    async shellDecision(action, signal) {
+        const profile = await this.resolvedProfile(action.cwd);
+        const command = action.args.command;
+        if (typeof command !== 'string')
+            return decision(action, 'deny', 'Invalid command input', EMPTY_DELTA, true);
+        const analysis = analyzeShell(command);
+        let shouldAsk = false;
+        const delta = { readPaths: [], writePaths: [], domains: [] };
+        const commandGroups = ruleCommands(command, typeof action.args.shellPath === 'string' ? action.args.shellPath : '/bin/bash');
+        const key = digest(commandGroups);
+        let compiledMatches = this.matchCache.get(key);
+        if (!compiledMatches && this.ruleSources.length) {
+            compiledMatches = (await evaluateRules(this.ruleSources, commandGroups, signal)).matches;
+            if (this.matchCache.size >= 256)
+                this.matchCache.delete(this.matchCache.keys().next().value);
+            this.matchCache.set(key, compiledMatches);
+        }
+        const matches = commandGroups.map((argv, index) => [...this.rules.filter(rule => matchesRule(argv, rule)), ...(compiledMatches?.[index] ?? [])]);
+        const forbidden = matches.flat().find(rule => rule.decision === 'forbidden');
+        if (forbidden)
+            return decision(action, 'deny', forbidden.justification ?? 'Command forbidden by trusted rule', EMPTY_DELTA, true);
+        const prompted = matches.flat().find(rule => rule.decision === 'prompt');
+        const isRuleAllowed = !prompted && matches.length > 0 && matches.every(group => group.some(rule => rule.decision === 'allow'));
+        if (prompted)
+            shouldAsk = true;
+        if (action.args.sandbox_permissions !== undefined && !['use_default', 'require_escalated'].includes(String(action.args.sandbox_permissions)))
+            return decision(action, 'deny', 'Invalid sandbox permission request', EMPTY_DELTA, true);
+        const explicit = action.args.additional_permissions;
+        if (explicit !== undefined) {
+            if (!explicit || typeof explicit !== 'object' || Array.isArray(explicit) || Object.keys(explicit).some(key => !['readPaths', 'writePaths', 'domains'].includes(key)))
+                return decision(action, 'deny', 'Invalid additional permissions', EMPTY_DELTA, true);
+            for (const key of ['readPaths', 'writePaths', 'domains']) {
+                const values = explicit[key] ?? [];
+                if (!Array.isArray(values) || values.some(value => typeof value !== 'string' || !value || value.includes('\0')))
+                    return decision(action, 'deny', 'Invalid permission list', EMPTY_DELTA, true);
+                delta[key].push(...values);
+            }
+            shouldAsk = true;
+        }
+        for (const item of analysis.commands) {
+            const executable = basename(item.argv[0]);
+            const isSafeRead = ['pwd', 'echo', 'printf', 'ls', 'cat', 'head', 'tail', 'wc', 'rg', 'grep', 'find', 'stat', 'true', 'false'].includes(executable);
+            const operands = item.argv.slice(1).filter(arg => !arg.startsWith('-'));
+            const reads = [...item.reads], writes = [...item.writes];
+            if (analysis.isSupported) {
+                if (isSafeRead && !['echo', 'printf', 'true', 'false', 'pwd'].includes(executable))
+                    reads.push(...operands);
+                if (['touch', 'mkdir', 'rmdir', 'rm', 'truncate', 'tee', 'chmod', 'chown'].includes(executable))
+                    writes.push(...operands);
+                if (['cp', 'mv'].includes(executable)) {
+                    reads.push(...operands.slice(0, -1));
+                    writes.push(...operands.slice(-1));
+                    if (executable === 'mv')
+                        writes.push(...operands.slice(0, -1));
+                }
+                if (executable === 'git' && !['status', 'diff', 'log', 'show', 'ls-files', 'rev-parse'].includes(item.argv[1] ?? ''))
+                    writes.push(...(profile.readOnlyPaths ?? []).filter(path => path === join(action.cwd, '.git') || path.includes('/.git/')));
+            }
+            for (const path of writes) {
+                const target = await canonicalPath(path, action.cwd);
+                if ([...profile.denyRead, ...profile.denyWrite].some(root => isWithin(target, root)))
+                    return decision(action, 'deny', 'Command writes a protected path', EMPTY_DELTA, true);
+                if (!profile.writeRoots.some(root => isWithin(target, root)) || (profile.readOnlyPaths ?? []).some(root => isWithin(target, root))) {
+                    shouldAsk = true;
+                    delta.writePaths.push(target);
+                }
+            }
+            for (const path of reads) {
+                const target = await canonicalPath(path, action.cwd);
+                if (profile.denyRead.some(root => isWithin(target, root)))
+                    return decision(action, 'deny', 'Command reads a protected path', EMPTY_DELTA, true);
+                if (!profile.readRoots.some(root => isWithin(target, root))) {
+                    shouldAsk = true;
+                    delta.readPaths.push(target);
+                }
+            }
+            if (analysis.isSupported && ['curl', 'wget'].includes(executable)) {
+                const urls = item.argv.slice(1).filter(arg => /^https?:\/\//.test(arg));
+                for (const text of urls) {
+                    const domain = normalizeHost(new URL(text).hostname);
+                    if (profile.deniedDomains.some(pattern => matchesDomain(domain, pattern)))
+                        return decision(action, 'deny', 'Network domain denied', EMPTY_DELTA, true);
+                    if (!profile.allowedDomains.some(pattern => matchesDomain(domain, pattern))) {
+                        delta.domains.push(domain);
+                        shouldAsk = true;
+                    }
+                }
+            }
+        }
+        for (const key of ['readPaths', 'writePaths'])
+            delta[key] = [...new Set(await Promise.all(delta[key].map(path => canonicalPath(path, action.cwd))))];
+        if (delta.readPaths.some(path => profile.denyRead.some(root => isWithin(path, root))) || delta.writePaths.some(path => [...profile.denyRead, ...profile.denyWrite].some(root => isWithin(path, root))) || delta.domains.some(host => !isNetworkHost(host) || profile.deniedDomains.some(pattern => matchesDomain(host, pattern))))
+            return decision(action, 'deny', 'Requested permissions target an absolute deny', EMPTY_DELTA, true);
+        const writeScopes = await Promise.all(delta.writePaths.map(path => this.nativeWriteScope(path, action.cwd)));
+        const hasCreationScope = writeScopes.some((path, index) => path !== delta.writePaths[index]);
+        const boundDelta = { ...delta, writePaths: [...new Set(writeScopes)], domains: [...new Set(delta.domains.map(normalizeHost))] };
+        if ([...boundDelta.readPaths, ...boundDelta.writePaths].some(hasNativePatternChars))
+            return decision(action, 'deny', 'Native permission roots containing *, ?, [ or ] cannot be approved as literal paths', EMPTY_DELTA, true);
+        if (isRuleAllowed)
+            return immutable({ ...decision(action, 'allow', 'Trusted prefix rule authorizes this command', boundDelta), authority: { kind: 'command-rule', actionDigest: action.digest, ruleDigest: digest(matches) } });
+        const isFullRequest = action.args.sandbox_permissions === 'require_escalated' && explicit === undefined;
+        shouldAsk ||= action.args.sandbox_permissions === 'require_escalated';
+        const reason = hasCreationScope ? 'The native backend requires the enclosing directory in this invocation; review this full write scope' : prompted?.justification ?? (shouldAsk ? 'Command requires permission review' : 'Execute within the current native sandbox');
+        return immutable({ ...decision(action, shouldAsk ? 'ask' : 'allow', reason, boundDelta), approvalCategory: prompted ? 'rules' : 'sandbox', ...(isFullRequest ? { authority: { kind: 'reviewed-command', actionDigest: action.digest } } : {}) });
+    }
+    async resolvedProfile(cwd) {
+        const result = { ...this.profile };
+        for (const key of ['readRoots', 'writeRoots', 'denyRead', 'denyWrite'])
+            result[key] = await Promise.all(this.profile[key].map(path => canonicalPath(path, cwd)));
+        if (this.profile.readOnlyPaths)
+            result.readOnlyPaths = await Promise.all(this.profile.readOnlyPaths.map(path => canonicalPath(path, cwd)));
+        return result;
+    }
+    async nativeWriteScope(target, cwd) {
+        let candidate = target;
+        while (process.platform === 'linux') {
+            try {
+                await stat(candidate);
+                break;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                const parent = dirname(candidate);
+                if (parent === candidate)
+                    throw error;
+                candidate = parent;
+            }
+        }
+        const defaults = await runtimeWritePaths(cwd);
+        return defaults.find(root => isWithin(candidate, root)) ?? candidate;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAA4G,MAAM,iBAAiB,CAAC;AAC5N,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAgB,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAwE,MAAM,YAAY,CAAC;AAC5I,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AA2BjF,MAAM,CAAC,MAAM,gBAAgB,GAAkB,SAAS,CAAC;IACvD,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,uBAAuB,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE;IACjK,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI;IACrG,eAAe,EAAE,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK;IAC1E,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK;IAC9E,kBAAkB,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI;CACrF,CAAC,CAAC;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IACxI,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,GAAG,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,oBAAoB,GAAG,EAAE,CAAC,CAAC;IACnJ,MAAM,QAAQ,GAAG,EAAE,GAAG,gBAAgB,EAAE,GAAG,GAAG,EAAmB,CAAC;IAClE,IAAI,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IACxH,KAAK,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,CAAU;QAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,WAAW,GAAG,EAAE,CAAC,CAAC;IACtN,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;IACnK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;IAC7K,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC;IACzC,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAC,OAAO,EAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,CAAC;IAC9c,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC1I,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IACnc,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,CAAC;IACjO,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,uBAAuB,EAAE,KAAK,CAAC,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAU;QAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,WAAW,GAAG,EAAE,CAAC,CAAC;IACpR,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,eAAe,CAAU;QAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,WAAW,GAAG,EAAE,CAAC,CAAC;IACrP,KAAK,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAU;QAAE,IAAI,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,WAAW,GAAG,EAAE,CAAC,CAAC;IACpK,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,kBAAkB,GAAG,CAAC,IAAI,QAAQ,CAAC,kBAAkB,GAAG,OAAO;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;IACrN,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,CAAC,2BAA2B,EAAE,QAAQ,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;IAC/P,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;IAC7G,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;QAC5Q,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC/I,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,CAAC;QAAC,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAC1E,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,yCAAyC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;AAC1H,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,QAAuB,EAAE,eAAkC,EAAE,EAAE,wBAA2C,EAAE;IAC5J,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACpJ,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjH,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5N,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC7C,sFAAsF;QACtF,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC;YAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAAC,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;gBAAC,IAAI,OAAO;oBAAE,aAAa,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;QACnS,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YAAC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAAC,IAAI,CAAC;gBAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;oBAAE,aAAa,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;QAAC,CAAC;QACrQ,aAAa,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAChE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,GAAG,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;AAChW,CAAC;AACD,MAAM,OAAO,YAAY;IASF;IARb,KAAK,CAAwB;IAC7B,aAAa,CAAU;IACvB,WAAW,GAA0B,EAAE,CAAC;IACxC,aAAa,CAAiB;IACrB,UAAU,GAAG,IAAI,GAAG,EAA6C,CAAC;IAC3E,gBAAgB,CAAoB;IAC5C,IAAI,OAAO,KAAwB,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAa,OAAO,MAAM,CAAC,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,kBAAkB,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,EAAC,CAAC,CAAC,CAAC,CAAC;IAC7P,YAAqB,QAAuB,EAAE,OAA0B;QAAnD,aAAQ,GAAR,QAAQ,CAAe;QAC1C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAC,CAAC,CAAC,CAAC;QAC1K,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;QAClC,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO;QAC/B,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,CAAC,EAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7K,IAAI,CAAC,aAAa,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;QAC7F,IAAI,CAAC,gBAAgB,GAAG,aAAa,CAAC,EAAC,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC;QACrP,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,MAAmB,EAAE,MAAoB;QACtD,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,oCAAoC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAClH,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,gBAAgB,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,oCAAoC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAC1L,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAa,CAAC;YAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,uDAAuD,CAAC,CAAC;QACxI,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC;QAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,eAAe,CAAC,KAAK,EAAC,MAAM,CAAC,GAAG,EAAC,MAAM,CAAC,IAAI,KAAG,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7G,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC;QAClE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAC3L,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QAChJ,IAAI,OAAO,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,uCAAuC,CAAC,CAAC;QACnG,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAClG,IAAI,CAAC,CAAC,OAAO,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,qFAAqF,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAC9O,OAAO,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,sGAAsG,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACjS,CAAC;IACO,KAAK,CAAC,aAAa,CAAC,MAAmB,EAAE,MAAoB;QACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACpC,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAC7G,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,KAAK,GAAqE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC/H,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC7H,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QAClC,IAAI,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAChD,eAAe,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACzF,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,GAAG;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;YAC9F,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjJ,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC;QAC7E,IAAI,SAAS;YAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,aAAa,IAAI,mCAAmC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAClI,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACzE,MAAM,aAAa,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC;QAC/H,IAAI,QAAQ;YAAE,SAAS,GAAG,IAAI,CAAC;QAC/B,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,oCAAoC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QACvO,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC;QACpD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,gCAAgC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YAC3P,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAU,EAAE,CAAC;gBAClE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC/L,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,MAAkB,CAAC,CAAC;YACzC,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACpJ,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACzD,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzB,IAAI,UAAU,IAAI,CAAC,CAAC,MAAM,EAAC,QAAQ,EAAC,MAAM,EAAC,OAAO,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;gBACxG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;gBAC1H,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAAC,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAAC,IAAI,UAAU,KAAK,IAAI;wBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBACpL,IAAI,UAAU,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACnP,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrD,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,iCAAiC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC5K,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;oBAAC,SAAS,GAAG,IAAI,CAAC;oBAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;YAC1L,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,gCAAgC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;gBAChJ,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;oBAAC,SAAS,GAAG,IAAI,CAAC;oBAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;YAClH,CAAC;YACD,IAAI,QAAQ,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxE,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;oBACxB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;oBACrD,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;wBAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;oBACvJ,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;wBAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBAAC,SAAS,GAAG,IAAI,CAAC;oBAAC,CAAC;gBAChI,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAC,YAAY,CAAU;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7J,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,+CAA+C,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QACva,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7G,MAAM,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7F,MAAM,UAAU,GAAG,EAAC,GAAG,KAAK,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAC,CAAC;QAC9H,IAAI,CAAC,GAAG,UAAU,CAAC,SAAS,EAAC,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;YAAE,OAAO,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,qFAAqF,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAC9N,IAAI,aAAa;YAAE,OAAO,SAAS,CAAC,EAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,6CAA6C,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,EAAC,IAAI,EAAC,cAAc,EAAE,YAAY,EAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAC,MAAM,CAAC,OAAO,CAAC,EAAC,EAAC,CAAC,CAAC;QACzN,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,mBAAmB,IAAI,QAAQ,KAAK,SAAS,CAAC;QACxG,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,mBAAmB,CAAC;QACtE,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,sGAAsG,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC;QACvQ,OAAO,SAAS,CAAC,EAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAC,SAAS,EAAC,EAAC,IAAI,EAAC,kBAAkB,EAAC,YAAY,EAAC,MAAM,CAAC,MAAM,EAAC,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAC,CAAC,CAAC;IACzO,CAAC;IACO,KAAK,CAAC,eAAe,CAAC,GAAW;QACvC,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,CAAU;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1K,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa;YAAE,MAAM,CAAC,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3I,OAAO,MAAM,CAAC;IAChB,CAAC;IACO,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,GAAW;QACxD,IAAI,SAAS,GAAG,MAAM,CAAC;QACvB,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;YACrC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBACpE,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;gBAClC,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,KAAK,CAAC;gBACtC,SAAS,GAAG,MAAM,CAAC;YACrB,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC;IACvE,CAAC;CACF"}

package/dist/policy/paths.d.ts

@@ -0,0 +1,5 @@
+export declare function isWithin(path: string, root: string): boolean;
+/** Pi 0.99.1 file-input semantics, including its screenshot filename variants. */
+export declare function resolveToolPath(input: string, cwd: string, isRead?: boolean, homeDir?: string): Promise<string>;
+/** Resolve existing ancestors as well as missing write targets, never just string prefixes. */
+export declare function canonicalPath(path: string, cwd: string): Promise<string>;