pi-harness-runtime 1.1.321 → 1.1.322

package/RULES.md

@@ -52,3 +52,22 @@ Follow conventional commits:
 - `fix:` for bug fixes
 - `feat:` for new features
 - `chore:` for maintenance tasks
+
+## SSH Necessity Check
+
+Before every SSH invocation:
+
+1. Run `ip address` in the current execution environment.
+2. Identify the SSH destination, including any hostname or SSH alias.
+3. Compare its resolved address with this environment's local addresses.
+4. If the destination is this same server and the required user,
+   filesystem, and execution environment match, run the command locally.
+5. If SSH is still necessary, briefly state why.
+
+Do not assume the current terminal is on a different machine.
+
+**Automatic enforcement:** The harness intercepts SSH commands and performs this check automatically using `ip -j address` for machine-readable output. If it detects an unnecessary connection back to the current environment, it returns:
+
+> SSH destination matches this environment. Run the command locally, or explain why a separate SSH session is required.
+
+Do not automatically rewrite SSH commands into local commands. SSH may intentionally use another account, a container boundary, or forwarding. Hostnames and SSH aliases need resolution; comparing the command's hostname directly with `ip address` output is insufficient.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-harness-runtime",
-  "version": "1.1.321",
+  "version": "1.1.322",
   "description": "[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.",
   "type": "module",
   "scripts": {

package/packages/a2a-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/a2a-adapter",
-  "version": "1.1.321",
+  "version": "1.1.322",
   "type": "module",
   "description": "Google Agent-to-Agent (A2A) protocol adapter for pi-harness",
   "main": "dist/index.js",

package/packages/agent-policy/dist/extension.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,YAAY,EAKb,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,EACV,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAepB;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,YAAY,EAChB,MAAM,EAAE,iBAAiB,GACxB,IAAI,CAqUN;AAmED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAiBtD"}
+{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,YAAY,EAKb,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,EACV,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAgBpB;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,YAAY,EAChB,MAAM,EAAE,iBAAiB,GACxB,IAAI,CAuVN;AAmED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAiBtD"}

package/packages/agent-policy/dist/extension.js

@@ -11,6 +11,7 @@ import { logError, logInfo } from "./file-logger.js";
 import { getPolicyStore } from "./policy-store.js";
 import { renderSystemContract, renderFullRules, } from "./policy-renderer.js";
 import { classifyToolCall } from "./types.js";
+import { checkSshNecessity } from "./ssh-guard.js";
 import { randomUUID } from "node:crypto";
 // ---------------------------------------------------------------------------
 // Extension Registration
@@ -106,6 +107,22 @@ Use harness_rules to check policy status.
                     };
                 }
             }
+            // Check SSH guard for shell/bash commands
+            if ((toolName === "bash" || toolName === "shell" || toolName === "ctx_execute") && input && typeof input === "object") {
+                const inputObj = input;
+                const command = String(inputObj.command ?? "");
+                // Check if this is an SSH command
+                if (/\bssh\b/.test(command)) {
+                    const sshCheck = await checkSshNecessity(command);
+                    if (!sshCheck.allowed) {
+                        logInfo("[agent-policy]", `Blocked SSH to local destination: ${sshCheck.message}`);
+                        return {
+                            block: true,
+                            reason: `[SSH GUARD] ${sshCheck.message}`,
+                        };
+                    }
+                }
+            }
             // Policy satisfied, allow the call
             return {};
         }

package/packages/agent-policy/dist/extension.js.map

@@ -1 +1 @@
-{"version":3,"file":"extension.js","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,oBAAoB,EACpB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAgB,EAChB,MAAyB;IAEzB,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;QAC9B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;KAClD,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,gBAAgB,CAAC;IACjE,MAAM,iBAAiB,GAAG,UAAU,UAAU,EAAE,EAAE,CAAC;IAEnD,gCAAgC;IAChC,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,kDAAkD;IAClD,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,KAAwB,EAAE,EAAE;QACxD,4DAA4D;QAC5D,MAAM,cAAc,GAAI,KAAuC,CAAC,cAAc,IAAI,EAAE,CAAC;QACrF,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,6CAA6C;IAC7C,8EAA8E;IAE9E,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,KAAK,EAAE,KAA4B,EAAE,GAAG,EAAE,EAAE;QACtE,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAEnC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAExC,2BAA2B;YAC3B,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CACjC,SAAS,EACT,QAAQ,EACR,eAAe,CAChB,CAAC;YAEF,6BAA6B;YAC7B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAEhD,gCAAgC;YAChC,MAAM,eAAe,GAAG,KAAK,CAAC,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC;YAE/D,oBAAoB;YACpB,OAAO,CAAC,gBAAgB,EAAE,oBAAoB,QAAQ,CAAC,QAAQ,eAAe,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YAEnG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtE,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,YAAY,EAAE,CAAC,CAAC;YAErE,2DAA2D;YAC3D,MAAM,gBAAgB,GAAG;;;;;CAK9B,CAAC,IAAI,EAAE,CAAC;YAEH,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,GAAG,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,kDAAkD;IAClD,8EAA8E;IAE9E,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,KAAoB,EAAE,GAAG,EAAE,EAAE;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAEnD,0BAA0B;QAC1B,IAAI,CAAC,UAAU,CAAC,cAAc,IAAI,CAAC,UAAU,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;YAC/F,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAElE,uCAAuC;YACvC,IAAI,MAAM,CAAC,4BAA4B,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChG,MAAM,WAAW,GAAG,OAAO;oBACzB,CAAC,CAAC,qCAAqC,QAAQ,CAAC,QAAQ,cAAc,OAAO,CAAC,QAAQ,GAAG;oBACzF,CAAC,CAAC,mBAAmB,QAAQ,CAAC,QAAQ,oBAAoB,CAAC;gBAE7D,OAAO,CAAC,gBAAgB,EAAE,WAAW,QAAQ,KAAK,WAAW,EAAE,CAAC,CAAC;gBAEjE,MAAM,MAAM,GAAG,qBAAqB,WAAW,MAAM;oBACnD,uDAAuD;oBACvD,iDAAiD;oBACjD,kEAAkE,QAAQ,CAAC,QAAQ,UAAU;oBAC7F,gDAAgD,CAAC;gBAEnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACjC,CAAC;YAED,4BAA4B;YAC5B,IAAI,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;gBACzD,6DAA6D;gBAC7D,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;gBAC9E,IAAI,gBAAgB,EAAE,CAAC;oBACrB,OAAO;wBACL,KAAK,EAAE,IAAI;wBACX,MAAM,EAAE,sEAAsE,gBAAgB,EAAE;qBACjG,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,mCAAmC;YACnC,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtE,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,YAAY,EAAE,CAAC,CAAC;YAEnE,wDAAwD;YACxD,sDAAsD;YACtD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,oCAAoC;IACpC,8EAA8E;IAE9E,EAAE,CAAC,YAAY,CAAC;QACd,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE;YACX,gDAAgD;YAChD,UAAU;YACV,wEAAwE;YACxE,yEAAyE;YACzE,yDAAyD;SAC1D,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC;oBACzC,WAAW,EAAE,mBAAmB;iBACjC;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oDAAoD;iBAClE;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,sCAAsC;iBACpD;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,yBAAyB;iBACvC;aACF;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACZ;QAEV,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG;YACxD,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAE9D,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAA2B,CAAC;gBAE1C,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;oBACrB,KAAK,UAAU,EAAE,CAAC;wBAChB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACxC,OAAO;4BACL,OAAO,EAAE,CAAC;oCACR,IAAI,EAAE,MAAe;oCACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;iCAC5C,CAAC;4BACF,OAAO,EAAE,EAAE,QAAQ,EAAE;yBACtB,CAAC;oBACJ,CAAC;oBAED,KAAK,MAAM,EAAE,CAAC;wBACZ,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACxC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE;4BACvC,MAAM,EAAE,KAAK,CAAC,MAAM;4BACpB,OAAO,EAAE,KAAK,CAAC,OAAO;yBACvB,CAAC,CAAC;wBAEH,0CAA0C;wBAC1C,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;wBAC1E,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;4BACvE,KAAK,CAAC,aAAa,CACjB,SAAS,EACT,QAAQ,EACR,MAAM,EACN,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CACzC,CAAC;wBACJ,CAAC;wBAED,iCAAiC;wBACjC,IAAI,MAAM,GAAG,mCAAmC,QAAQ,CAAC,QAAQ,KAAK,CAAC;wBACvE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;wBAElC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;4BACpB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gCACtC,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,KAAK,IAAI,CAAC;gCACnE,MAAM,IAAI,WAAW,OAAO,CAAC,MAAM,IAAI,CAAC;gCACxC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;oCACtB,MAAM,IAAI,eAAe,CAAC;gCAC5B,CAAC;gCACD,MAAM,IAAI,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC;4BAC5C,CAAC;wBACH,CAAC;wBAED,OAAO;4BACL,OAAO,EAAE,CAAC;oCACR,IAAI,EAAE,MAAe;oCACrB,IAAI,EAAE,MAAM;iCACb,CAAC;4BACF,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;yBACvC,CAAC;oBACJ,CAAC;oBAED,KAAK,aAAa,EAAE,CAAC;wBACnB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAExC,2CAA2C;wBAC3C,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;4BAC3D,OAAO;gCACL,OAAO,EAAE,CAAC;wCACR,IAAI,EAAE,MAAe;wCACrB,IAAI,EAAE,sCAAsC,KAAK,CAAC,QAAQ,yBAAyB,QAAQ,CAAC,QAAQ,EAAE;qCACvG,CAAC;gCACF,OAAO,EAAE,IAAI;gCACb,OAAO,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE;6BACxC,CAAC;wBACJ,CAAC;wBAED,yBAAyB;wBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CACjC,SAAS,EACT,QAAQ,EACR,MAAM,EACN,CAAC,GAAG,CAAC,CAAC,4BAA4B;yBACnC,CAAC;wBAEF,OAAO;4BACL,OAAO,EAAE,CAAC;oCACR,IAAI,EAAE,MAAe;oCACrB,IAAI,EAAE,mCAAmC,OAAO,CAAC,QAAQ,gBAAgB,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE;iCACvH,CAAC;4BACF,OAAO,EAAE,EAAE,OAAO,EAAE;yBACrB,CAAC;oBACJ,CAAC;oBAED,SAAS,CAAC;wBACR,MAAM,aAAa,GAAI,KAA0B,CAAC,MAAM,CAAC;wBACzD,OAAO;4BACL,OAAO,EAAE,CAAC;oCACR,IAAI,EAAE,MAAe;oCACrB,IAAI,EAAE,0BAA0B,aAAa,EAAE;iCAChD,CAAC;4BACF,OAAO,EAAE,IAAI;4BACb,OAAO,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE;yBACrC,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtE,QAAQ,CAAC,gBAAgB,EAAE,yBAAyB,YAAY,EAAE,CAAC,CAAC;gBACpE,OAAO;oBACL,OAAO,EAAE,CAAC;4BACR,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,4BAA4B,YAAY,EAAE;yBACjD,CAAC;oBACF,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;iBACjC,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,8EAA8E;IAC9E,6CAA6C;IAC7C,8EAA8E;IAE9E,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,MAAyB,EAAE,GAAY,EAAE,EAAE;QACjE,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAEnC,OAAO,CAAC,gBAAgB,EAAE,oBAAoB,SAAS,OAAO,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,wCAAwC;IACxC,8EAA8E;IAC9E,iEAAiE;IACjE,8EAA8E;IAC9E,EAAE;IACF,yFAAyF;IACzF,oEAAoE;IACpE,EAAE;IAEF,EAAE,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,MAA2B,EAAE,GAAY,EAAE,EAAE;QACrE,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAE9D,6EAA6E;QAC7E,sFAAsF;QACtF,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAE9B,OAAO,CAAC,gBAAgB,EAAE,iDAAiD,SAAS,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,qBAAqB;IACrB,8EAA8E;IAE9E,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE;QACtB,sDAAsD;IACxD,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,gBAAgB,EAAE,iCAAiC,CAAC,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;GAEG;AACH,SAAS,mBAAmB,CAAC,GAAY,EAAE,iBAAyB;IAClE,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,EAAE,cAA6D,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC;IAC5C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED,IAAI,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,EAAE,CAAC;IACnB,CAAC;IAED,0EAA0E;IAC1E,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,MAAM,MAAM,GAAG,GAA8B,CAAC;IAE9C,IAAI,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,MAAM,EAAE,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACjD,OAAO,MAAM,CAAC,gBAAgB,CAAC;IACjC,CAAC;IAED,0BAA0B;IAC1B,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,wBAAwB,CACrC,IAAa,EACb,eAAwB;IAExB,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,CAAC,uCAAuC;IACtD,CAAC;IAED,kDAAkD;IAClD,oDAAoD;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,EAAgB;IAC9C,2EAA2E;IAC3E,4DAA4D;IAC5D,iDAAiD;IACjD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAE1C,uDAAuD;IACvD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzE,mBAAmB,CAAC,EAAE,EAAE;QACtB,gBAAgB;QAChB,4BAA4B,EAAE,IAAI;QAClC,OAAO,EAAE,SAAS;KACnB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"extension.js","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,oBAAoB,EACpB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAgB,EAChB,MAAyB;IAEzB,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;QAC9B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;KAClD,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,gBAAgB,CAAC;IACjE,MAAM,iBAAiB,GAAG,UAAU,UAAU,EAAE,EAAE,CAAC;IAEnD,gCAAgC;IAChC,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,kDAAkD;IAClD,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,KAAwB,EAAE,EAAE;QACxD,4DAA4D;QAC5D,MAAM,cAAc,GAAI,KAAuC,CAAC,cAAc,IAAI,EAAE,CAAC;QACrF,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,6CAA6C;IAC7C,8EAA8E;IAE9E,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,KAAK,EAAE,KAA4B,EAAE,GAAG,EAAE,EAAE;QACtE,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAEnC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAExC,2BAA2B;YAC3B,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CACjC,SAAS,EACT,QAAQ,EACR,eAAe,CAChB,CAAC;YAEF,6BAA6B;YAC7B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAEhD,gCAAgC;YAChC,MAAM,eAAe,GAAG,KAAK,CAAC,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC;YAE/D,oBAAoB;YACpB,OAAO,CAAC,gBAAgB,EAAE,oBAAoB,QAAQ,CAAC,QAAQ,eAAe,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YAEnG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtE,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,YAAY,EAAE,CAAC,CAAC;YAErE,2DAA2D;YAC3D,MAAM,gBAAgB,GAAG;;;;;CAK9B,CAAC,IAAI,EAAE,CAAC;YAEH,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,GAAG,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,kDAAkD;IAClD,8EAA8E;IAE9E,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,KAAoB,EAAE,GAAG,EAAE,EAAE;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAEnD,0BAA0B;QAC1B,IAAI,CAAC,UAAU,CAAC,cAAc,IAAI,CAAC,UAAU,CAAC,eAAe,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;YAC/F,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAElE,uCAAuC;YACvC,IAAI,MAAM,CAAC,4BAA4B,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChG,MAAM,WAAW,GAAG,OAAO;oBACzB,CAAC,CAAC,qCAAqC,QAAQ,CAAC,QAAQ,cAAc,OAAO,CAAC,QAAQ,GAAG;oBACzF,CAAC,CAAC,mBAAmB,QAAQ,CAAC,QAAQ,oBAAoB,CAAC;gBAE7D,OAAO,CAAC,gBAAgB,EAAE,WAAW,QAAQ,KAAK,WAAW,EAAE,CAAC,CAAC;gBAEjE,MAAM,MAAM,GAAG,qBAAqB,WAAW,MAAM;oBACnD,uDAAuD;oBACvD,iDAAiD;oBACjD,kEAAkE,QAAQ,CAAC,QAAQ,UAAU;oBAC7F,gDAAgD,CAAC;gBAEnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACjC,CAAC;YAED,4BAA4B;YAC5B,IAAI,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;gBACzD,6DAA6D;gBAC7D,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;gBAC9E,IAAI,gBAAgB,EAAE,CAAC;oBACrB,OAAO;wBACL,KAAK,EAAE,IAAI;wBACX,MAAM,EAAE,sEAAsE,gBAAgB,EAAE;qBACjG,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,0CAA0C;YAC1C,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,aAAa,CAAC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACtH,MAAM,QAAQ,GAAG,KAAgC,CAAC;gBAClD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;gBAE/C,kCAAkC;gBAClC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5B,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;oBAClD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;wBACtB,OAAO,CAAC,gBAAgB,EAAE,qCAAqC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;wBACnF,OAAO;4BACL,KAAK,EAAE,IAAI;4BACX,MAAM,EAAE,eAAe,QAAQ,CAAC,OAAO,EAAE;yBAC1C,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,mCAAmC;YACnC,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtE,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,YAAY,EAAE,CAAC,CAAC;YAEnE,wDAAwD;YACxD,sDAAsD;YACtD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,oCAAoC;IACpC,8EAA8E;IAE9E,EAAE,CAAC,YAAY,CAAC;QACd,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE;YACX,gDAAgD;YAChD,UAAU;YACV,wEAAwE;YACxE,yEAAyE;YACzE,yDAAyD;SAC1D,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC;oBACzC,WAAW,EAAE,mBAAmB;iBACjC;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oDAAoD;iBAClE;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,sCAAsC;iBACpD;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,yBAAyB;iBACvC;aACF;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACZ;QAEV,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG;YACxD,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAE9D,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAA2B,CAAC;gBAE1C,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;oBACrB,KAAK,UAAU,EAAE,CAAC;wBAChB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACxC,OAAO;4BACL,OAAO,EAAE,CAAC;oCACR,IAAI,EAAE,MAAe;oCACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;iCAC5C,CAAC;4BACF,OAAO,EAAE,EAAE,QAAQ,EAAE;yBACtB,CAAC;oBACJ,CAAC;oBAED,KAAK,MAAM,EAAE,CAAC;wBACZ,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACxC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE;4BACvC,MAAM,EAAE,KAAK,CAAC,MAAM;4BACpB,OAAO,EAAE,KAAK,CAAC,OAAO;yBACvB,CAAC,CAAC;wBAEH,0CAA0C;wBAC1C,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;wBAC1E,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;4BACvE,KAAK,CAAC,aAAa,CACjB,SAAS,EACT,QAAQ,EACR,MAAM,EACN,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CACzC,CAAC;wBACJ,CAAC;wBAED,iCAAiC;wBACjC,IAAI,MAAM,GAAG,mCAAmC,QAAQ,CAAC,QAAQ,KAAK,CAAC;wBACvE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;wBAElC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;4BACpB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gCACtC,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,KAAK,IAAI,CAAC;gCACnE,MAAM,IAAI,WAAW,OAAO,CAAC,MAAM,IAAI,CAAC;gCACxC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;oCACtB,MAAM,IAAI,eAAe,CAAC;gCAC5B,CAAC;gCACD,MAAM,IAAI,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC;4BAC5C,CAAC;wBACH,CAAC;wBAED,OAAO;4BACL,OAAO,EAAE,CAAC;oCACR,IAAI,EAAE,MAAe;oCACrB,IAAI,EAAE,MAAM;iCACb,CAAC;4BACF,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;yBACvC,CAAC;oBACJ,CAAC;oBAED,KAAK,aAAa,EAAE,CAAC;wBACnB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAExC,2CAA2C;wBAC3C,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;4BAC3D,OAAO;gCACL,OAAO,EAAE,CAAC;wCACR,IAAI,EAAE,MAAe;wCACrB,IAAI,EAAE,sCAAsC,KAAK,CAAC,QAAQ,yBAAyB,QAAQ,CAAC,QAAQ,EAAE;qCACvG,CAAC;gCACF,OAAO,EAAE,IAAI;gCACb,OAAO,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE;6BACxC,CAAC;wBACJ,CAAC;wBAED,yBAAyB;wBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CACjC,SAAS,EACT,QAAQ,EACR,MAAM,EACN,CAAC,GAAG,CAAC,CAAC,4BAA4B;yBACnC,CAAC;wBAEF,OAAO;4BACL,OAAO,EAAE,CAAC;oCACR,IAAI,EAAE,MAAe;oCACrB,IAAI,EAAE,mCAAmC,OAAO,CAAC,QAAQ,gBAAgB,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE;iCACvH,CAAC;4BACF,OAAO,EAAE,EAAE,OAAO,EAAE;yBACrB,CAAC;oBACJ,CAAC;oBAED,SAAS,CAAC;wBACR,MAAM,aAAa,GAAI,KAA0B,CAAC,MAAM,CAAC;wBACzD,OAAO;4BACL,OAAO,EAAE,CAAC;oCACR,IAAI,EAAE,MAAe;oCACrB,IAAI,EAAE,0BAA0B,aAAa,EAAE;iCAChD,CAAC;4BACF,OAAO,EAAE,IAAI;4BACb,OAAO,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE;yBACrC,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtE,QAAQ,CAAC,gBAAgB,EAAE,yBAAyB,YAAY,EAAE,CAAC,CAAC;gBACpE,OAAO;oBACL,OAAO,EAAE,CAAC;4BACR,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,4BAA4B,YAAY,EAAE;yBACjD,CAAC;oBACF,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;iBACjC,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,8EAA8E;IAC9E,6CAA6C;IAC7C,8EAA8E;IAE9E,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,MAAyB,EAAE,GAAY,EAAE,EAAE;QACjE,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAEnC,OAAO,CAAC,gBAAgB,EAAE,oBAAoB,SAAS,OAAO,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,wCAAwC;IACxC,8EAA8E;IAC9E,iEAAiE;IACjE,8EAA8E;IAC9E,EAAE;IACF,yFAAyF;IACzF,oEAAoE;IACpE,EAAE;IAEF,EAAE,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,MAA2B,EAAE,GAAY,EAAE,EAAE;QACrE,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAE9D,6EAA6E;QAC7E,sFAAsF;QACtF,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAE9B,OAAO,CAAC,gBAAgB,EAAE,iDAAiD,SAAS,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,qBAAqB;IACrB,8EAA8E;IAE9E,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE;QACtB,sDAAsD;IACxD,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,gBAAgB,EAAE,iCAAiC,CAAC,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;GAEG;AACH,SAAS,mBAAmB,CAAC,GAAY,EAAE,iBAAyB;IAClE,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,EAAE,cAA6D,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC;IAC5C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED,IAAI,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,EAAE,CAAC;IACnB,CAAC;IAED,0EAA0E;IAC1E,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,MAAM,MAAM,GAAG,GAA8B,CAAC;IAE9C,IAAI,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,MAAM,EAAE,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACjD,OAAO,MAAM,CAAC,gBAAgB,CAAC;IACjC,CAAC;IAED,0BAA0B;IAC1B,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,wBAAwB,CACrC,IAAa,EACb,eAAwB;IAExB,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,CAAC,uCAAuC;IACtD,CAAC;IAED,kDAAkD;IAClD,oDAAoD;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,EAAgB;IAC9C,2EAA2E;IAC3E,4DAA4D;IAC5D,iDAAiD;IACjD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAE1C,uDAAuD;IACvD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzE,mBAAmB,CAAC,EAAE,EAAE;QACtB,gBAAgB;QAChB,4BAA4B,EAAE,IAAI;QAClC,OAAO,EAAE,SAAS;KACnB,CAAC,CAAC;AACL,CAAC"}

package/packages/agent-policy/dist/ssh-guard.d.ts

@@ -0,0 +1,51 @@
+/**
+ * SSH Guard Tool
+ *
+ * Intercepts SSH commands and checks if the destination matches the local environment.
+ * Combines automatic checking with a fresh reminder when the agent proposes SSH.
+ */
+/**
+ * Result of SSH guard check
+ */
+export interface SshGuardResult {
+    /** Whether SSH is allowed to proceed */
+    allowed: boolean;
+    /** Message explaining the decision */
+    message: string;
+    /** Whether the destination matches local */
+    isLocal: boolean;
+    /** Resolved destination address */
+    destinationAddress?: string;
+}
+/**
+ * Check if destination is local
+ */
+export declare function checkSshNecessity(command: string): Promise<SshGuardResult>;
+/**
+ * Tool definition for SSH guard
+ */
+export declare const SshGuardTool: {
+    readonly name: "ssh_guard_check";
+    readonly description: "Check if SSH destination matches local environment before allowing SSH";
+    readonly parameters: {
+        readonly type: "object";
+        readonly properties: {
+            readonly command: {
+                readonly type: "string";
+                readonly description: "The SSH command to check";
+            };
+        };
+        readonly required: readonly ["command"];
+    };
+};
+/**
+ * Execute SSH guard check
+ */
+export declare function executeSshGuard(args: {
+    command: string;
+}, _api: unknown, _context: unknown): Promise<{
+    allowed: boolean;
+    message: string;
+    isLocal: boolean;
+}>;
+//# sourceMappingURL=ssh-guard.d.ts.map

package/packages/agent-policy/dist/ssh-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-guard.d.ts","sourceRoot":"","sources":["../src/ssh-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,mCAAmC;IACnC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAkGD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CA0ChF;AAED;;GAEG;AACH,eAAO,MAAM,YAAY;aACvB,IAAI,EAAE,iBAAiB;aACvB,WAAW,EAAE,wEAAwE;aACrF,UAAU;iBACR,IAAI,EAAE,QAAQ;iBACd,UAAU;qBACR,OAAO;yBACL,IAAI,EAAE,QAAQ;yBACd,WAAW,EAAE,0BAA0B;;;iBAG3C,QAAQ,YAAG,SAAS;;CAEd,CAAC;AAEX;;GAEG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EACzB,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAOlE"}

package/packages/agent-policy/dist/ssh-guard.js

@@ -0,0 +1,172 @@
+/**
+ * SSH Guard Tool
+ *
+ * Intercepts SSH commands and checks if the destination matches the local environment.
+ * Combines automatic checking with a fresh reminder when the agent proposes SSH.
+ */
+import { execSync } from "node:child_process";
+import dns from "node:dns";
+import { promisify } from "node:util";
+const lookupAsync = promisify(dns.lookup);
+/**
+ * Parse SSH destination from command line
+ */
+function parseSshDestination(command) {
+    // Match patterns like:
+    // ssh user@host
+    // ssh host
+    // ssh -p port user@host
+    // ssh host.domain.com
+    const match = command.match(/ssh\s+(?:-[a-z]+\s+)*((?:[a-zA-Z0-9_-]+\@)?[a-zA-Z0-9._-]+)/);
+    return match ? match[1] : null;
+}
+/**
+ * Get local IP addresses (cross-platform)
+ */
+function getLocalAddresses() {
+    try {
+        const isWindows = process.platform === "win32";
+        let output;
+        if (isWindows) {
+            // Windows: use ipconfig
+            output = execSync("ipconfig", { encoding: "utf8", timeout: 5000, windowsHide: true });
+        }
+        else {
+            // Unix-like: use ip address
+            output = execSync("ip -j address 2>/dev/null || ip address 2>/dev/null", {
+                encoding: "utf8",
+                timeout: 5000,
+            });
+        }
+        const addresses = ["127.0.0.1", "::1", "localhost"];
+        // Parse JSON output if available (Linux)
+        try {
+            const json = JSON.parse(output);
+            for (const iface of json) {
+                for (const addr of iface.addr_info || []) {
+                    if (addr.local !== addr.peer) {
+                        addresses.push(addr.local);
+                    }
+                }
+            }
+        }
+        catch {
+            // Fallback to text parsing
+            if (isWindows) {
+                // Windows ipconfig: parse "IPv4 Address. . . . . . . . . . : X.X.X.X"
+                const windowsMatch = output.matchAll(/IPv4[^:]*:\s*([0-9.]+)/gi);
+                for (const match of windowsMatch) {
+                    const ip = match[1];
+                    if (ip !== "127.0.0.1") {
+                        addresses.push(ip);
+                    }
+                }
+                // Also check for IPv6
+                const ipv6Match = output.matchAll(/IPv6[^:]*:\s*([0-9a-f:]+)/gi);
+                for (const match of ipv6Match) {
+                    addresses.push(match[1]);
+                }
+            }
+            else {
+                // Unix-like: parse "inet X.X.X.X"
+                const ipMatch = output.match(/inet\s+([0-9.]+)/g);
+                if (ipMatch) {
+                    for (const match of ipMatch) {
+                        const ip = match.replace("inet ", "");
+                        if (ip !== "127.0.0.1") {
+                            addresses.push(ip);
+                        }
+                    }
+                }
+            }
+        }
+        return [...new Set(addresses)];
+    }
+    catch {
+        return ["127.0.0.1", "::1", "localhost"];
+    }
+}
+/**
+ * Resolve hostname to IP address
+ */
+async function resolveHost(hostname) {
+    // Skip if already an IP
+    if (/^[0-9.]+$/.test(hostname))
+        return hostname;
+    if (/^[0-9a-f:]+$/i.test(hostname))
+        return hostname;
+    try {
+        const result = await lookupAsync(hostname);
+        return result.address;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Check if destination is local
+ */
+export async function checkSshNecessity(command) {
+    const destination = parseSshDestination(command);
+    if (!destination) {
+        return {
+            allowed: true,
+            message: "Could not parse SSH destination",
+            isLocal: false,
+        };
+    }
+    const localAddresses = getLocalAddresses();
+    const resolved = await resolveHost(destination);
+    if (!resolved) {
+        return {
+            allowed: true,
+            message: `Could not resolve SSH destination: ${destination}`,
+            isLocal: false,
+            destinationAddress: undefined,
+        };
+    }
+    const isLocal = localAddresses.some((addr) => addr === resolved || resolved === addr);
+    if (isLocal) {
+        return {
+            allowed: false,
+            message: `SSH destination ${destination} (${resolved}) matches this environment (local addresses: ${localAddresses.join(", ")}). Run the command locally, or explain why a separate SSH session is required.`,
+            isLocal: true,
+            destinationAddress: resolved,
+        };
+    }
+    return {
+        allowed: true,
+        message: `SSH to ${destination} (${resolved}) appears necessary - destination differs from local addresses`,
+        isLocal: false,
+        destinationAddress: resolved,
+    };
+}
+/**
+ * Tool definition for SSH guard
+ */
+export const SshGuardTool = {
+    name: "ssh_guard_check",
+    description: "Check if SSH destination matches local environment before allowing SSH",
+    parameters: {
+        type: "object",
+        properties: {
+            command: {
+                type: "string",
+                description: "The SSH command to check",
+            },
+        },
+        required: ["command"],
+    },
+};
+/**
+ * Execute SSH guard check
+ */
+export async function executeSshGuard(args, _api, _context) {
+    const result = await checkSshNecessity(args.command);
+    return {
+        allowed: result.allowed,
+        message: result.message,
+        isLocal: result.isLocal,
+    };
+}
+//# sourceMappingURL=ssh-guard.js.map

package/packages/agent-policy/dist/ssh-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-guard.js","sourceRoot":"","sources":["../src/ssh-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAgB1C;;GAEG;AACH,SAAS,mBAAmB,CAAC,OAAe;IAC1C,uBAAuB;IACvB,gBAAgB;IAChB,WAAW;IACX,wBAAwB;IACxB,sBAAsB;IACtB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;QAC/C,IAAI,MAAc,CAAC;QAEnB,IAAI,SAAS,EAAE,CAAC;YACd,wBAAwB;YACxB,MAAM,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;aAAM,CAAC;YACN,4BAA4B;YAC5B,MAAM,GAAG,QAAQ,CAAC,qDAAqD,EAAE;gBACvE,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAa,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAE9D,yCAAyC;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBACzB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;oBACzC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;wBAC7B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAC7B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,IAAI,SAAS,EAAE,CAAC;gBACd,sEAAsE;gBACtE,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;gBACjE,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;oBACjC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACpB,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;wBACvB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;gBACD,sBAAsB;gBACtB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC;gBACjE,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;oBAC9B,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,kCAAkC;gBAClC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBAClD,IAAI,OAAO,EAAE,CAAC;oBACZ,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;wBAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;wBACtC,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;4BACvB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBACrB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,WAAW,CAAC,QAAgB;IACzC,wBAAwB;IACxB,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe;IACrD,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,iCAAiC;YAC1C,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;IAEhD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,sCAAsC,WAAW,EAAE;YAC5D,OAAO,EAAE,KAAK;YACd,kBAAkB,EAAE,SAAS;SAC9B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,CACjD,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,mBAAmB,WAAW,KAAK,QAAQ,gDAAgD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,gFAAgF;YAC7M,OAAO,EAAE,IAAI;YACb,kBAAkB,EAAE,QAAQ;SAC7B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,UAAU,WAAW,KAAK,QAAQ,gEAAgE;QAC3G,OAAO,EAAE,KAAK;QACd,kBAAkB,EAAE,QAAQ;KAC7B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,wEAAwE;IACrF,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,0BAA0B;aACxC;SACF;QACD,QAAQ,EAAE,CAAC,SAAS,CAAC;KACtB;CACO,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAyB,EACzB,IAAa,EACb,QAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;AACJ,CAAC"}

package/packages/agent-policy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/agent-policy",
-  "version": "1.1.321",
+  "version": "1.1.322",
   "description": "Agent policy runtime for pi-harness - enforces mandatory rule delivery and mutation gating",
   "type": "module",
   "main": "./dist/index.js",

package/packages/agent-policy/src/ssh-guard.ts

@@ -0,0 +1,204 @@
+/**
+ * SSH Guard Tool
+ *
+ * Intercepts SSH commands and checks if the destination matches the local environment.
+ * Combines automatic checking with a fresh reminder when the agent proposes SSH.
+ */
+
+import { execSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import dns from "node:dns";
+import { promisify } from "node:util";
+
+const lookupAsync = promisify(dns.lookup);
+
+/**
+ * Result of SSH guard check
+ */
+export interface SshGuardResult {
+  /** Whether SSH is allowed to proceed */
+  allowed: boolean;
+  /** Message explaining the decision */
+  message: string;
+  /** Whether the destination matches local */
+  isLocal: boolean;
+  /** Resolved destination address */
+  destinationAddress?: string;
+}
+
+/**
+ * Parse SSH destination from command line
+ */
+function parseSshDestination(command: string): string | null {
+  // Match patterns like:
+  // ssh user@host
+  // ssh host
+  // ssh -p port user@host
+  // ssh host.domain.com
+  const match = command.match(/ssh\s+(?:-[a-z]+\s+)*((?:[a-zA-Z0-9_-]+\@)?[a-zA-Z0-9._-]+)/);
+  return match ? match[1] : null;
+}
+
+/**
+ * Get local IP addresses (cross-platform)
+ */
+function getLocalAddresses(): string[] {
+  try {
+    const isWindows = process.platform === "win32";
+    let output: string;
+    
+    if (isWindows) {
+      // Windows: use ipconfig
+      output = execSync("ipconfig", { encoding: "utf8", timeout: 5000, windowsHide: true });
+    } else {
+      // Unix-like: use ip address
+      output = execSync("ip -j address 2>/dev/null || ip address 2>/dev/null", {
+        encoding: "utf8",
+        timeout: 5000,
+      });
+    }
+
+    const addresses: string[] = ["127.0.0.1", "::1", "localhost"];
+
+    // Parse JSON output if available (Linux)
+    try {
+      const json = JSON.parse(output);
+      for (const iface of json) {
+        for (const addr of iface.addr_info || []) {
+          if (addr.local !== addr.peer) {
+            addresses.push(addr.local);
+          }
+        }
+      }
+    } catch {
+      // Fallback to text parsing
+      if (isWindows) {
+        // Windows ipconfig: parse "IPv4 Address. . . . . . . . . . : X.X.X.X"
+        const windowsMatch = output.matchAll(/IPv4[^:]*:\s*([0-9.]+)/gi);
+        for (const match of windowsMatch) {
+          const ip = match[1];
+          if (ip !== "127.0.0.1") {
+            addresses.push(ip);
+          }
+        }
+        // Also check for IPv6
+        const ipv6Match = output.matchAll(/IPv6[^:]*:\s*([0-9a-f:]+)/gi);
+        for (const match of ipv6Match) {
+          addresses.push(match[1]);
+        }
+      } else {
+        // Unix-like: parse "inet X.X.X.X"
+        const ipMatch = output.match(/inet\s+([0-9.]+)/g);
+        if (ipMatch) {
+          for (const match of ipMatch) {
+            const ip = match.replace("inet ", "");
+            if (ip !== "127.0.0.1") {
+              addresses.push(ip);
+            }
+          }
+        }
+      }
+    }
+
+    return [...new Set(addresses)];
+  } catch {
+    return ["127.0.0.1", "::1", "localhost"];
+  }
+}
+
+/**
+ * Resolve hostname to IP address
+ */
+async function resolveHost(hostname: string): Promise<string | null> {
+  // Skip if already an IP
+  if (/^[0-9.]+$/.test(hostname)) return hostname;
+  if (/^[0-9a-f:]+$/i.test(hostname)) return hostname;
+
+  try {
+    const result = await lookupAsync(hostname);
+    return result.address;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Check if destination is local
+ */
+export async function checkSshNecessity(command: string): Promise<SshGuardResult> {
+  const destination = parseSshDestination(command);
+
+  if (!destination) {
+    return {
+      allowed: true,
+      message: "Could not parse SSH destination",
+      isLocal: false,
+    };
+  }
+
+  const localAddresses = getLocalAddresses();
+  const resolved = await resolveHost(destination);
+
+  if (!resolved) {
+    return {
+      allowed: true,
+      message: `Could not resolve SSH destination: ${destination}`,
+      isLocal: false,
+      destinationAddress: undefined,
+    };
+  }
+
+  const isLocal = localAddresses.some(
+    (addr) => addr === resolved || resolved === addr
+  );
+
+  if (isLocal) {
+    return {
+      allowed: false,
+      message: `SSH destination ${destination} (${resolved}) matches this environment (local addresses: ${localAddresses.join(", ")}). Run the command locally, or explain why a separate SSH session is required.`,
+      isLocal: true,
+      destinationAddress: resolved,
+    };
+  }
+
+  return {
+    allowed: true,
+    message: `SSH to ${destination} (${resolved}) appears necessary - destination differs from local addresses`,
+    isLocal: false,
+    destinationAddress: resolved,
+  };
+}
+
+/**
+ * Tool definition for SSH guard
+ */
+export const SshGuardTool = {
+  name: "ssh_guard_check",
+  description: "Check if SSH destination matches local environment before allowing SSH",
+  parameters: {
+    type: "object",
+    properties: {
+      command: {
+        type: "string",
+        description: "The SSH command to check",
+      },
+    },
+    required: ["command"],
+  },
+} as const;
+
+/**
+ * Execute SSH guard check
+ */
+export async function executeSshGuard(
+  args: { command: string },
+  _api: unknown,
+  _context: unknown
+): Promise<{ allowed: boolean; message: string; isLocal: boolean }> {
+  const result = await checkSshNecessity(args.command);
+  return {
+    allowed: result.allowed,
+    message: result.message,
+    isLocal: result.isLocal,
+  };
+}

package/packages/architecture-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/architecture-generator",
-  "version": "1.1.321",
+  "version": "1.1.322",
   "description": "Generate ADR and Mermaid diagrams from project analysis",
   "type": "module",
   "main": "./dist/index.js",

package/packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/auth",
-  "version": "1.1.321",
+  "version": "1.1.322",
   "description": "pi-harness-runtime — auth",
   "type": "module",
   "main": "./dist/index.js",

package/packages/autonomous-refactor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-refactor",
-  "version": "1.1.321",
+  "version": "1.1.322",
   "type": "module",
   "description": "Autonomous refactoring engine",
   "main": "dist/index.js",

package/packages/autonomous-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-runtime",
-  "version": "1.1.321",
+  "version": "1.1.322",
   "description": "Autonomous Operations Runtime — task inbox, lease management, and worker lifecycle (RFC-0101)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cache-strategy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cache-strategy",
-  "version": "1.1.321",
+  "version": "1.1.322",
   "type": "module",
   "description": "Smart caching with TTL and invalidation strategies (RFC-0022)",
   "main": "dist/index.js",

package/packages/capability-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/capability-registry",
-  "version": "1.1.321",
+  "version": "1.1.322",
   "description": "Capability Registry for pi-harness-runtime — tracks model capabilities and enables capability-based routing",
   "type": "module",
   "main": "./dist/index.js",

package/packages/checkpoint/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/checkpoint",
-  "version": "1.1.321",
+  "version": "1.1.322",
   "description": "Enhanced checkpoint system with incremental snapshots, diff-based storage, and recovery strategies",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cli-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cli-plugin-sdk",
-  "version": "1.1.321",
+  "version": "1.1.322",
   "type": "module",
   "description": "CLI Plugin SDK for pi-harness — install, list, remove, update, invoke plugins",
   "main": "dist/index.js",

package/packages/clipboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard",
-  "version": "1.1.321",
+  "version": "1.1.322",
   "type": "module",
   "main": "src/index.ts",
   "exports": {