ralph-flow-pi 0.1.0

package/dist/commands/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/commands/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAqC,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAuB,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAqB,MAAM,iBAAiB,CAAC;AAUnE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAC7F;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvH;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,MAA0B;IACvD,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,wBAAwB,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,oHAAoH,CAAC;AAC9H,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAS,YAAY,CAAC,MAAc,EAAE,MAA0B,EAAE,GAAiB;IACjF,MAAM,IAAI,GAAG,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IACd,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,MAAc,EAAE,SAAiB,EAAE,QAAiB;IACxG,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAEvC,IAAI,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO,mCAAmC,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,KAAK,CAAC,aAAa,QAAQ,CAAC;IAC7C,CAAC;IAED,wEAAwE;IACxE,mEAAmE;IACnE,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,aAAa,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;YAChF,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,+BAA+B,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACnH,OAAO,2BAA2B,CAAC;QACrC,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,MAAM,CAAC,YAAY,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACtF,OAAO,qBAAqB,KAAK,CAAC,YAAY,kBAAkB,CAAC;IACnE,CAAC;IAED,wEAAwE;IACxE,qDAAqD;IACrD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,iBAAiB,GAAG,KAAK,CAAC,UAAU,CAAC;QAC3C,MAAM,cAAc,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACjD,MAAM,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACpH,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QAEjH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,YAAY,KAAK,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC9C,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9E,qEAAqE;YACrE,iCAAiC;YACjC,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,+DAA+D;YAC/D,uEAAuE;YACvE,mEAAmE;YACnE,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,eAAe,GAAG,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC,CAAC;YACtI,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,CAAC,SAAS,CAAC,QAAS,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;YAC1I,MAAM,SAAS,GAAG,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;YACrJ,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB;gBACzC,IAAI,eAAe;oBAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,gCAAgC;gBAC9E,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;gBACzH,OAAO,SAAS,CAAC,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,SAAS,GAAG,uBAAuB,iBAAiB,EAAE,CAAC;YAC3D,IAAI,cAAc;gBAAE,SAAS,IAAI,mBAAmB,cAAc,EAAE,CAAC;YACrE,SAAS,IAAI,aAAa,CAAC;YAC3B,OAAO,SAAS,GAAG,cAAc,IAAI,CAAC,EAAE,IAAI,CAAC;QAC/C,CAAC;QAED,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACnE,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;QACvF,IAAI,SAAS,GAAG,uBAAuB,iBAAiB,EAAE,CAAC;QAC3D,IAAI,cAAc;YAAE,SAAS,IAAI,mBAAmB,cAAc,EAAE,CAAC;QACrE,OAAO,SAAS,GAAG,uBAAuB,IAAI,CAAC,EAAE,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IAED,oEAAoE;IACpE,sCAAsC;IACtC,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;YACpC,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBACxF,OAAO,sBAAsB,KAAK,CAAC,YAAY,0DAA0D,CAAC;YAC5G,CAAC;YACD,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;YAChF,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YAC1C,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACjC,MAAM,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,YAAY,KAAK,CAAC,YAAY,aAAa,CAAC;YACrD,CAAC;YACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,mEAAmE;gBACnE,mEAAmE;gBACnE,oEAAoE;gBACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,eAAe,GAAG,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC,CAAC;gBACtI,IAAI,eAAe,EAAE,CAAC;oBACpB,MAAM,CAAC,SAAS,CAAC,QAAS,EAAE,MAAM,CAAC,CAAC;gBACtC,CAAC;gBACD,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACtH,MAAM,SAAS,GAAG,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;gBACpK,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;oBACpB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB;oBACzC,IAAI,eAAe;wBAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,gCAAgC;oBAC9E,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;oBACzH,OAAO,SAAS,CAAC,IAAI,CAAC;gBACxB,CAAC;gBACD,OAAO,iDAAiD,IAAI,CAAC,EAAE,IAAI,CAAC;YACtE,CAAC;YACD,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnE,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;YACD,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,yBAAyB,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;YACtG,OAAO,wDAAwD,IAAI,CAAC,EAAE,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO,UAAU,KAAK,CAAC,aAAa,qBAAqB,CAAC;IAC5D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI;QAAE,OAAO,OAAO,KAAK,CAAC,YAAY,QAAQ,CAAC;IAEpD,yEAAyE;IACzE,8CAA8C;IAC9C,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAE,CAAC;QACvH,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtH,MAAM,SAAS,GAAG,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;YACpK,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACxB,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;gBACzH,OAAO,SAAS,CAAC,IAAI,CAAC;YACxB,CAAC;YACD,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,6BAA6B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,OAAO,iBAAiB,MAAM,iDAAiD,IAAI,CAAC,EAAE,IAAI,CAAC;QAC7F,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACnE,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;QACtG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,6BAA6B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACpG,OAAO,iBAAiB,MAAM,mDAAmD,IAAI,CAAC,EAAE,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9G,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,mBAAmB;IACnB,OAAO,+BAA+B,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAiB;IAC3C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC;IAE7C,wFAAwF;IACxF,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,EAAkC;QACtE,IAAI,CAAC;YACH,OAAO,MAAM,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,cAAc,CAAC,CAAC,CAAC;gBAAE,OAAO,QAAQ,MAAM,0BAA0B,CAAC;YACvE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,SAAS,iBAAiB,CAAC,MAAc;QACvC,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,QAAQ,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;IAC7E,CAAC;IAED,SAAS,aAAa,CAAC,KAAgB;QACrC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrI,CAAC;IAED,+EAA+E;IAE/E,MAAM,eAAe,GAAG,UAAU,CAAC;QACjC,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,+IAA+I;QAC5J,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YACtB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;YACvG,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;YACpF,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE;gBAClD,WAAW,EAAE,uMAAuM;aACrN,CAAC,CAAC;SACJ,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAiB,EAAE,EAAE;YACpE,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;YACjC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;YAClC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;YAE3C,0DAA0D;YAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YAC1D,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC,mBAAmB,IAAI,CAAC,EAAE,WAAW,IAAI,CAAC,KAAK,CAAC,aAAa,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,2DAA2D,CAAC,CAAC;YACvK,CAAC;YAED,MAAM,gBAAgB,GAAa,EAAE,CAAC;YACtC,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YACpE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,OAAO,IAAI,CAAC,QAAQ,QAAQ,iBAAiB,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACvH,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;gBACzC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;oBAC9B,CAAC,CAAC,QAAQ,QAAQ,iBAAiB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC9F,CAAC,CAAC,gDAAgD,CAAC,CAAC;YACxD,CAAC;YAED,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;YAExC,gDAAgD;YAChD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;YAChC,MAAM,iBAAiB,GAAa,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC3B,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzB,IAAI,CAAC,CAAC;oBAAE,SAAS;gBACjB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;oBAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;oBAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBAChE,IAAI,EAAE,GAAG,IAAI,CAAC;gBACd,IAAI,CAAC;oBAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;gBACrC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC;gBAC1E,CAAC;gBACD,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC;YAED,iDAAiD;YACjD,MAAM,MAAM,GAAG,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACnD,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3C,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;YAEjD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC;gBACrC,CAAC,CAAC,mBAAmB,SAAS,CAAC,MAAM,kCAAkC;gBACvE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC;gBAChD,CAAC,CAAC,iBAAiB,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACvE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,SAAS,GAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;YACnM,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAElD,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;gBACnD,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnF,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBACrC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBACpC,MAAM,SAAS,GAAG,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC9F,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;oBACpB,IAAI,CAAC;wBAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAA,CAAC;oBAC5F,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC;gBACD,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClF,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAC7B,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBACnF,OAAO,YAAY,CAAC,QAAQ,QAAQ,cAAc,MAAM,cAAc,IAAI,gBAAgB,QAAQ,gBAAgB,SAAS,CAAC,EAAE,QAAQ,SAAS,CAAC,QAAQ,GAAG,aAAa,GAAG,UAAU,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;YAChN,CAAC;YAED,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACrC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAClF,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACnD,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,IAAI,WAAW,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9E,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;YACD,yEAAyE;YACzE,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC9C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAChF,OAAO,YAAY,CAAC,QAAQ,QAAQ,cAAc,MAAM,cAAc,IAAI,gBAAgB,QAAQ,YAAY,SAAS,CAAC,EAAE,QAAQ,SAAS,CAAC,IAAI,GAAG,aAAa,GAAG,UAAU,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QACrM,CAAC;KACF,CAA8B,CAAC;IAEhC,+EAA+E;IAC/E,EAAE;IACF,oEAAoE;IACpE,8EAA8E;IAC9E,2EAA2E;IAC3E,2CAA2C;IAE3C,MAAM,kBAAkB,GAAG,UAAU,CAAC;QACpC,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,yMAAyM;QACtN,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,uGAAuG,EAAE,CAAC,CAAC;SAC/J,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAiB,EAAE,EAAE;YACpE,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACtE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;YAErC,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,OAAO;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;YAElC,2CAA2C;YAC3C,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;gBAC3F,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,IAAI,CAAC,mBAAmB,KAAK,CAAC,EAAE,WAAW,KAAK,CAAC,KAAK,CAAC,aAAa,QAAQ,KAAK,CAAC,KAAK,CAAC,YAAY,2CAA2C,MAAM,KAAK,CAAC,CAAC;gBACrK,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YAExG,0EAA0E;YAC1E,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACnF,OAAO,YAAY,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;KACF,CAA8B,CAAC;IAEhC,+EAA+E;IAC/E,EAAE;IACF,qEAAqE;IACrE,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAE3E,MAAM,eAAe,GAAG,UAAU,CAAC;QACjC,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,4gBAA4gB;QACzhB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,4FAA4F,EAAE,CAAC,CAAC;SACpJ,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAiB,EAAE,EAAE;YACpE,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACtE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;YAE7B,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,OAAO;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;YAElC,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC,QAAQ,MAAM,WAAW,CAAC,CAAC;YAC3E,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAChF,OAAO,YAAY,CAAC,WAAW,MAAM,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;KACF,CAA8B,CAAC;IAEhC,+EAA+E;IAE/E,MAAM,gBAAgB,GAAG,UAAU,CAAC;QAClC,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,kGAAkG;QAC/G,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2GAA2G,EAAE,CAAC,CAAC;SACnK,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;YAC7B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACtE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1D,MAAM,cAAc,GAAG,KAAK,EAAE,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC;YAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAEnD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE;gBACzC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBACpG,qEAAqE;gBACrE,gDAAgD;gBAChD,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC/D,IAAI,GAAG,GAAG,QAAQ,YAAY,UAAU,MAAM,SAAS,CAAC;gBACxD,IAAI,UAAU;oBAAE,GAAG,IAAI,UAAU,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;gBAChF,IAAI,UAAU;oBAAE,GAAG,IAAI,sBAAsB,UAAU,iDAAiD,CAAC;qBACpG,IAAI,cAAc;oBAAE,GAAG,IAAI,+DAA+D,CAAC;gBAChG,OAAO,GAAG,CAAC;YACb,CAAC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;KACF,CAA8B,CAAC;IAEhC,+EAA+E;IAC/E,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IAExE,MAAM,gBAAgB,GAAG,UAAU,CAAC;QAClC,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,mSAAmS;QAChT,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,qEAAqE,EAAE,CAAC,CAAC;SAC7H,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;YAC7B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;YAEzC,iEAAiE;YACjE,IAAI,MAAM,GAAG,IAAyC,CAAC;YACvD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;gBACzD,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtG,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;qBACrD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACpC,OAAO,aAAa,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;wBACzC,CAAC,CAAC,WAAW,MAAM,iBAAiB;wBACpC,CAAC,CAAC,WAAW,MAAM,aAAa,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC5E,CAAC;qBAAM,CAAC;oBACN,OAAO,aAAa,CAAC,OAAO,MAAM,iBAAiB,MAAM,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;gBAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC3B,OAAO,aAAa,CAAC,qCAAqC,CAAC,CAAC;gBAC9D,CAAC;gBACD,OAAO,aAAa,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EACtD,oGAAoG,CAAC,CAAC,CAAC;YAC3G,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAC1D,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACnF,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAEtD,IAAI,MAAM,GAAG;;cAEL,MAAM,CAAC,EAAE;aACV,KAAK,CAAC,aAAa;YACpB,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC;cAChC,KAAK,CAAC,YAAY;cAClB,KAAK,CAAC,aAAa;cACnB,KAAK,CAAC,UAAU;cAChB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG;cAChG,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAEzD,IAAI,UAAU;gBAAE,MAAM,IAAI,qBAAqB,UAAU,gBAAgB,CAAC;YAC1E,IAAI,KAAK,CAAC,mBAAmB;gBAAE,MAAM,IAAI,mBAAmB,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAExF,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,MAAM,IAAI,6DAA6D,CAAC;YAC1E,CAAC;iBAAM,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtD,MAAM,IAAI,wEAAwE,CAAC;YACrF,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI;;;;YAIR,WAAW,CAAC,IAAI;;cAEd,WAAW,CAAC,QAAQ;YACtB,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG;gBACzD,WAAW,CAAC,cAAc,EAAE,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI;;;;YAIR,WAAW,CAAC,IAAI;YAChB,WAAW,CAAC,EAAE;YACd,WAAW,CAAC,KAAK,IAAI,GAAG;YACxB,WAAW,CAAC,MAAM,IAAI,GAAG;YACzB,WAAW,CAAC,KAAK;gBACb,WAAW,CAAC,cAAc,EAAE,CAAC;gBACrC,CAAC;YACH,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,kBAAkB,SAAS,CAAC,MAAM,gEAAgE,CAAC;YAC/G,CAAC;YAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;KACF,CAA8B,CAAC;IAEhC,+EAA+E;IAE/E,MAAM,cAAc,GAAG,UAAU,CAAC;QAChC,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,6DAA6D;QAC1E,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC;gBAC5B,CAAC,CAAC,eAAe,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChF,CAAC,CAAC,gDAAgD,CAAC;YACrD,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,GAAG,IAAI,cAAc,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;KACF,CAA8B,CAAC;IAEhC,+EAA+E;IAE/E,MAAM,gBAAgB,GAAG,UAAU,CAAC;QAClC,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,8TAA8T;QAC3U,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC;YACrF,OAAO,IAAI,CAAC,GAAG,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;KACF,CAA8B,CAAC;IAEhC,OAAO,CAAC,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;AACtI,CAAC"}

package/dist/engine/check-bash.d.ts

@@ -0,0 +1,121 @@
+/**
+ * The verifier's only shell access: a whitelist-checked bash tool.
+ *
+ * Why this file exists at all: both plugin versions delegated the read-only
+ * guarantee to their host (opencode's agent permission map, Claude's
+ * `--allowedTools`). ralph-flow-pi has no host to delegate to, so it enforces
+ * the same allow-list itself, right before spawning.
+ *
+ * The allow-list (RALPH_CHECK_BASH_PERMISSION in core.ts) is a verbatim port.
+ * The ENFORCEMENT is deliberately stricter than either plugin, because here we
+ * own the executor and a glob match against the whole command string is not a
+ * safe primitive:
+ *
+ *   "cat x && rm -rf y"   → the plugins glob-match "cat *" and allow the whole
+ *                            string, rm included. We split on &&/||/;/| and check
+ *                            every segment.
+ *   "cat $(rm -rf /)"     → command substitution smuggles anything past any
+ *                            pattern. We reject $(), ``, and <() outright.
+ *   "cat x > important"   → redirection mutates without a mutating command name.
+ *                            We reject >, >>, and their fd forms.
+ *   "sed -i 's/a/b/' f"   → `sed *` is allow-listed in both plugins, but -i
+ *                            rewrites the file in place. Special-cased deny.
+ *   "awk '{print >"f"}'"  → awk and sed both have file-write syntax INSIDE
+ *   "sed 's/a/b/w f' x"     their own script argument. That script is a single
+ *                            quoted shell token, so the shell-level `>` scan
+ *                            above never sees it (worse: it strips the whole
+ *                            quoted span before scanning, precisely so a
+ *                            literal `>` inside a grep pattern isn't misread
+ *                            as a redirect — the same stripping hides a real
+ *                            awk/sed write just as well). Special-cased deny,
+ *                            found and closed after this file had already
+ *                            shipped claiming it was "residual, same as
+ *                            upstream" — it wasn't actually mitigated, only
+ *                            documented as if it were. See check-bash.test.ts.
+ *
+ * `xargs rm` and `find -delete`/`-exec` are the other two allow-listed-name-
+ * but-destructive-payload cases; both are special-cased below. Beyond these,
+ * the residual risk is smaller and harder to enumerate (a read-only command
+ * with an as-yet-unnoticed side-effecting flag) — which is why the verifier
+ * also runs with no edit or write tool at all, as defense in depth rather than
+ * relying on this file being exhaustive.
+ *
+ * A DIFFERENT, non-fixable category: `cargo test`/`npm test`/`pytest`/`go
+ * test` are allow-listed by name, but once permitted they execute the
+ * project's own test code, build scripts, and proc macros — with the full
+ * privileges of this process (network, filesystem writes anywhere the OS user
+ * can write, env reads). None of that is visible to or governed by this
+ * whitelist; it operates purely on the shell command's syntax, never on what
+ * the invoked program does once it starts running. This isn't an oversight to
+ * patch — verifying "tests pass" has no meaning without actually running
+ * them, so the trust boundary here is identical to running the repo's test
+ * suite locally. Don't try to "fix" this file to close it; if that trust
+ * boundary is ever wrong for a given use case, the answer is running ralphflow
+ * itself inside a container, not tightening this whitelist further.
+ */
+import type { PermissionAction } from "./types.js";
+export declare const CHECK_BASH_TIMEOUT_MS = 120000;
+export interface CheckBashDecision {
+    allowed: boolean;
+    /** The segment that caused a denial, for the message shown to the model. */
+    offendingSegment?: string;
+    reason?: string;
+}
+export interface ExtraBashValidation {
+    /** Accepted patterns, ready to merge into resolveAction's table as "allow". */
+    allowed: Record<string, PermissionAction>;
+    /** Patterns refused, with why — surfaced by `ralphflow doctor`. */
+    rejected: Array<{
+        pattern: string;
+        reason: string;
+    }>;
+}
+/**
+ * Filter a workflow's `extra_allowed_bash` patterns against NEVER_EXTRA_ALLOWED
+ * and basic sanity (must start with a concrete literal, not immediately a
+ * wildcard — a bare "*" or "* rm -rf /" pattern would otherwise reopen
+ * everything by overriding the table's own `"*": "deny"` fallback).
+ */
+export declare function validateExtraAllowedBash(patterns: string[] | undefined): ExtraBashValidation;
+/**
+ * Resolve one command segment against the table. Most-specific match wins:
+ * the longest pattern (ignoring wildcards) that matches decides, so `cargo fmt
+ * --check*` beats a hypothetical `cargo *`, and the `"*": "deny"` fallback only
+ * applies when nothing else matches.
+ */
+export declare function resolveAction(command: string, extra?: Record<string, PermissionAction>): PermissionAction;
+/**
+ * Split a command line into the segments that each need to pass the allow-list.
+ * Separators: && || ; | & and newlines. Quoted spans are respected so a
+ * separator inside a string literal doesn't create a phantom segment.
+ *
+ * Two `&` forms are NOT separators and must stay inside their segment:
+ *   `2>&1` (fd dup)  — splitting it would strand a bare "2>" that then looks
+ *                      like a write redirection and denies a legal command.
+ *   `&>file`         — bash's redirect-both shorthand; kept whole so the
+ *                      redirection check sees and denies it.
+ */
+export declare function splitSegments(command: string): string[];
+/**
+ * Decide whether the verifier may run this command line.
+ *
+ * `extraAllowedBash` is a workflow's own `adversarial_check.extra_allowed_bash`
+ * (raw, unvalidated strings straight from YAML) — always re-validated here via
+ * validateExtraAllowedBash rather than trusting a pre-built table, so there is
+ * exactly one path into resolveAction's extra table and no way for a future
+ * caller to skip the NEVER_EXTRA_ALLOWED filter by constructing one by hand.
+ * Every guard below (substitution, write redirection, mutating flags,
+ * script-embedded writes) runs BEFORE resolveAction and applies identically
+ * regardless of which table allowed the base command — an extra-allowed
+ * `./scripts/check.sh` is exactly as constrained by those guards as a
+ * built-in `npm test`.
+ */
+export declare function checkCommand(command: string, extraAllowedBash?: string[]): CheckBashDecision;
+export interface CheckBashRunResult {
+    output: string;
+    exitCode: number | null;
+    timedOut: boolean;
+}
+/** Run an already-approved command. Never call without checkCommand passing. */
+export declare function runApprovedCommand(command: string, cwd: string, signal?: AbortSignal): Promise<CheckBashRunResult>;
+//# sourceMappingURL=check-bash.d.ts.map

package/dist/engine/check-bash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-bash.d.ts","sourceRoot":"","sources":["../../src/engine/check-bash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAG7C,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA2CD,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC1C,mEAAmE;IACnE,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,mBAAmB,CAmB5F;AAYD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,gBAAgB,CAUzG;AAqBD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBvD;AAsDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAmC5F;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoClH"}

package/dist/engine/check-bash.js

@@ -0,0 +1,373 @@
+/**
+ * The verifier's only shell access: a whitelist-checked bash tool.
+ *
+ * Why this file exists at all: both plugin versions delegated the read-only
+ * guarantee to their host (opencode's agent permission map, Claude's
+ * `--allowedTools`). ralph-flow-pi has no host to delegate to, so it enforces
+ * the same allow-list itself, right before spawning.
+ *
+ * The allow-list (RALPH_CHECK_BASH_PERMISSION in core.ts) is a verbatim port.
+ * The ENFORCEMENT is deliberately stricter than either plugin, because here we
+ * own the executor and a glob match against the whole command string is not a
+ * safe primitive:
+ *
+ *   "cat x && rm -rf y"   → the plugins glob-match "cat *" and allow the whole
+ *                            string, rm included. We split on &&/||/;/| and check
+ *                            every segment.
+ *   "cat $(rm -rf /)"     → command substitution smuggles anything past any
+ *                            pattern. We reject $(), ``, and <() outright.
+ *   "cat x > important"   → redirection mutates without a mutating command name.
+ *                            We reject >, >>, and their fd forms.
+ *   "sed -i 's/a/b/' f"   → `sed *` is allow-listed in both plugins, but -i
+ *                            rewrites the file in place. Special-cased deny.
+ *   "awk '{print >"f"}'"  → awk and sed both have file-write syntax INSIDE
+ *   "sed 's/a/b/w f' x"     their own script argument. That script is a single
+ *                            quoted shell token, so the shell-level `>` scan
+ *                            above never sees it (worse: it strips the whole
+ *                            quoted span before scanning, precisely so a
+ *                            literal `>` inside a grep pattern isn't misread
+ *                            as a redirect — the same stripping hides a real
+ *                            awk/sed write just as well). Special-cased deny,
+ *                            found and closed after this file had already
+ *                            shipped claiming it was "residual, same as
+ *                            upstream" — it wasn't actually mitigated, only
+ *                            documented as if it were. See check-bash.test.ts.
+ *
+ * `xargs rm` and `find -delete`/`-exec` are the other two allow-listed-name-
+ * but-destructive-payload cases; both are special-cased below. Beyond these,
+ * the residual risk is smaller and harder to enumerate (a read-only command
+ * with an as-yet-unnoticed side-effecting flag) — which is why the verifier
+ * also runs with no edit or write tool at all, as defense in depth rather than
+ * relying on this file being exhaustive.
+ *
+ * A DIFFERENT, non-fixable category: `cargo test`/`npm test`/`pytest`/`go
+ * test` are allow-listed by name, but once permitted they execute the
+ * project's own test code, build scripts, and proc macros — with the full
+ * privileges of this process (network, filesystem writes anywhere the OS user
+ * can write, env reads). None of that is visible to or governed by this
+ * whitelist; it operates purely on the shell command's syntax, never on what
+ * the invoked program does once it starts running. This isn't an oversight to
+ * patch — verifying "tests pass" has no meaning without actually running
+ * them, so the trust boundary here is identical to running the repo's test
+ * suite locally. Don't try to "fix" this file to close it; if that trust
+ * boundary is ever wrong for a given use case, the answer is running ralphflow
+ * itself inside a container, not tightening this whitelist further.
+ */
+import { spawn } from "child_process";
+import { RALPH_CHECK_BASH_PERMISSION } from "./core.js";
+export const CHECK_BASH_TIMEOUT_MS = 120_000;
+const MAX_OUTPUT_BYTES = 30_000;
+/**
+ * Base commands `adversarial_check.extra_allowed_bash` (a workflow's own
+ * whitelist additions — see types.ts) can NEVER open, no matter what pattern
+ * a workflow YAML asks for. The built-in table above is reviewed and pinned
+ * in this repo; a workflow's extra_allowed_bash isn't — it can arrive in a
+ * copied/shared YAML file, or be generated by a model designing a workflow
+ * via /ralphflow-create, neither of which should be able to reopen `rm`, a
+ * shell, an interpreter, or credentialed network access just by asking.
+ * Package managers and git are banned too even though some of their
+ * subcommands ARE already allow-listed above (`cargo test`, `git diff`, …) —
+ * that curation is deliberate per-subcommand and extra_allowed_bash is not a
+ * back door around it; a workflow that needs one more specific safe
+ * subcommand should get it added to the built-in table instead.
+ * Enforced here, at the runtime decision point in resolveAction — not only
+ * as a doctor warning, since doctor is advisory and can be skipped.
+ */
+const NEVER_EXTRA_ALLOWED = new Set([
+    // Destructive/mutating file ops.
+    "rm", "rmdir", "mv", "cp", "ln", "dd", "shred", "truncate", "mkfifo", "mknod",
+    // System / process control.
+    "shutdown", "reboot", "halt", "poweroff", "kill", "killall", "pkill",
+    "systemctl", "service", "crontab", "at", "batch", "chmod", "chown", "chgrp",
+    // Network / remote exec — includes the "curl -o file" / "wget -O file"
+    // script-embedded-write pattern (see findScriptEmbeddedWrite's awk/sed
+    // comment for why a command's OWN write flags are invisible to the
+    // shell-level redirection scan).
+    "curl", "wget", "ssh", "scp", "sftp", "rsync", "nc", "ncat", "netcat", "telnet", "ftp",
+    // Shells / interpreters / eval — the same "smuggle anything past the
+    // whitelist" problem $() and `` are banned outright for, just spelled as
+    // a command name instead of shell syntax.
+    "sh", "bash", "zsh", "ksh", "dash", "fish", "csh", "tcsh", "eval", "exec", "source",
+    "python", "python2", "python3", "node", "nodejs", "deno", "bun", "ruby", "perl", "php", "lua", "tclsh",
+    // Privilege escalation.
+    "sudo", "su", "doas", "env",
+    // Containers / orchestration.
+    "docker", "podman", "kubectl", "helm",
+    // Ecosystem tools already curated per-subcommand in the built-in table —
+    // extra_allowed_bash must not widen them.
+    "git", "npm", "yarn", "pnpm", "npx", "pip", "pip3", "cargo", "go", "gem", "bundle", "composer", "mvn", "gradle",
+]);
+/**
+ * Filter a workflow's `extra_allowed_bash` patterns against NEVER_EXTRA_ALLOWED
+ * and basic sanity (must start with a concrete literal, not immediately a
+ * wildcard — a bare "*" or "* rm -rf /" pattern would otherwise reopen
+ * everything by overriding the table's own `"*": "deny"` fallback).
+ */
+export function validateExtraAllowedBash(patterns) {
+    const allowed = {};
+    const rejected = [];
+    for (const raw of patterns ?? []) {
+        const pattern = String(raw ?? "").trim();
+        if (!pattern)
+            continue;
+        const literalHead = pattern.split("*")[0].trim();
+        if (!literalHead) {
+            rejected.push({ pattern, reason: "过于宽泛：必须以具体命令名开头，不能以通配符开头" });
+            continue;
+        }
+        const base = literalHead.split(/\s+/)[0].replace(/^\.\//, "").split("/").pop()?.toLowerCase() ?? "";
+        if (NEVER_EXTRA_ALLOWED.has(base)) {
+            rejected.push({ pattern, reason: `"${base}" 是内置永久拒绝的命令名，写在 extra_allowed_bash 里也不会生效` });
+            continue;
+        }
+        allowed[pattern] = "allow";
+    }
+    return { allowed, rejected };
+}
+/**
+ * Glob match in the shape the permission table uses: `*` matches any run of
+ * characters. Ported from the semantics of opencode's permission matcher —
+ * patterns are anchored at both ends.
+ */
+function globMatches(pattern, command) {
+    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+    return new RegExp(`^${escaped}$`, "s").test(command);
+}
+/**
+ * Resolve one command segment against the table. Most-specific match wins:
+ * the longest pattern (ignoring wildcards) that matches decides, so `cargo fmt
+ * --check*` beats a hypothetical `cargo *`, and the `"*": "deny"` fallback only
+ * applies when nothing else matches.
+ */
+export function resolveAction(command, extra) {
+    const cmd = command.trim();
+    let best = null;
+    const table = extra ? { ...RALPH_CHECK_BASH_PERMISSION, ...extra } : RALPH_CHECK_BASH_PERMISSION;
+    for (const [pattern, action] of Object.entries(table)) {
+        if (!globMatches(pattern, cmd))
+            continue;
+        const specificity = pattern.replace(/\*/g, "").length;
+        if (!best || specificity > best.specificity)
+            best = { action, specificity };
+    }
+    return best ? best.action : "deny";
+}
+/** Shell metacharacters that can smuggle a command past any name-based check. */
+const SUBSTITUTION_PATTERNS = [
+    { re: /\$\(/, what: "命令替换 $(...)" },
+    { re: /`/, what: "反引号命令替换" },
+    { re: /<\(/, what: "进程替换 <(...)" },
+    { re: />\(/, what: "进程替换 >(...)" },
+];
+/** Redirection that writes. `2>&1` and `<` (read) are fine; `>`/`>>` are not. */
+function findWriteRedirection(segment) {
+    // Strip quoted spans first so a literal ">" inside a grep pattern is not a
+    // redirection (e.g. grep -n "a > b" file).
+    const unquoted = segment.replace(/'[^']*'/g, "''").replace(/"[^"]*"/g, '""');
+    // >&N / N>&N is an fd dup (2>&1), not a file write — allow it.
+    const withoutFdDup = unquoted.replace(/\d*>&\d+/g, "");
+    const m = withoutFdDup.match(/\d*>>?/);
+    return m ? m[0] : null;
+}
+/**
+ * Split a command line into the segments that each need to pass the allow-list.
+ * Separators: && || ; | & and newlines. Quoted spans are respected so a
+ * separator inside a string literal doesn't create a phantom segment.
+ *
+ * Two `&` forms are NOT separators and must stay inside their segment:
+ *   `2>&1` (fd dup)  — splitting it would strand a bare "2>" that then looks
+ *                      like a write redirection and denies a legal command.
+ *   `&>file`         — bash's redirect-both shorthand; kept whole so the
+ *                      redirection check sees and denies it.
+ */
+export function splitSegments(command) {
+    const segments = [];
+    let current = "";
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        const next = command[i + 1];
+        const prev = command[i - 1];
+        if (quote) {
+            current += c;
+            if (c === quote && command[i - 1] !== "\\")
+                quote = null;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            quote = c;
+            current += c;
+            continue;
+        }
+        if (c === "\n") {
+            segments.push(current);
+            current = "";
+            continue;
+        }
+        if (c === ";") {
+            segments.push(current);
+            current = "";
+            continue;
+        }
+        if (c === "&" && (prev === ">" || next === ">")) {
+            current += c;
+            continue;
+        } // 2>&1 / &>file
+        if ((c === "&" || c === "|") && next === c) {
+            segments.push(current);
+            current = "";
+            i++;
+            continue;
+        }
+        if (c === "|" || c === "&") {
+            segments.push(current);
+            current = "";
+            continue;
+        }
+        current += c;
+    }
+    segments.push(current);
+    return segments.map((s) => s.trim()).filter(Boolean);
+}
+/** Commands that are allow-listed by name but have a mutating flag. */
+function findMutatingFlag(segment) {
+    const s = segment.trim();
+    // `sed -i` / `sed --in-place` rewrite files in place. Both plugins allow bare
+    // `sed *`; we carve this out (recorded as an intentional divergence in SYNC.md).
+    if (/^sed\b/.test(s) && /(^|\s)(-i\b|--in-place\b|-[a-zA-Z]*i[a-zA-Z]*\b(?!\S))/.test(s))
+        return "sed -i（原地改写文件）";
+    // `find -delete` / `-exec rm` mutate despite `find *` being allow-listed.
+    if (/^find\b/.test(s) && /(^|\s)-delete\b/.test(s))
+        return "find -delete";
+    if (/^find\b/.test(s) && /(^|\s)-(exec|execdir|ok|okdir)\b/.test(s))
+        return "find -exec（可执行任意命令）";
+    // `xargs rm`-style: the payload command must itself be allow-listed.
+    if (/^xargs\b/.test(s)) {
+        const payload = s.replace(/^xargs\s+(-[^\s]+\s+)*/, "").trim();
+        if (payload && resolveAction(payload) !== "allow")
+            return `xargs 的目标命令「${payload}」不在只读白名单内`;
+    }
+    return null;
+}
+/**
+ * awk and sed both have their OWN write syntax inside their script argument —
+ * `awk 'BEGIN{print "x" > "file"}'` and `sed 's/a/b/w file'` — which never
+ * reaches the shell as a redirection token, so findWriteRedirection's
+ * shell-level `>` scan (which deliberately strips quoted spans so a literal
+ * `>` inside a grep pattern isn't misread as a redirect) cannot see it: from
+ * the shell's point of view the whole script is just one quoted string
+ * argument. Both commands are allow-listed for their genuinely common
+ * read-only uses (`awk '{print $1}'`, `sed -n '1,10p'`), so the fix has to
+ * look inside the script rather than deny the command outright.
+ *
+ * Conservative on purpose: this also denies awk's legitimate numeric `>`
+ * comparisons (e.g. `awk '$3 > 100'`) and any sed script containing a bare
+ * `w` token, which is a real false-positive cost. For a verifier whose entire
+ * point is "cannot mutate the workspace it is judging," failing closed on an
+ * ambiguous case is the correct tradeoff — same posture as the blanket
+ * `sed -i` denial just above, which doesn't try to prove `-i` is destructive
+ * either.
+ */
+function findScriptEmbeddedWrite(segment) {
+    const s = segment.trim();
+    if (/^(g|n|m)?awk\b/.test(s) && />/.test(s)) {
+        return "awk 脚本内包含 `>`：可能是 print/printf 的输出重定向，awk 能借此写文件";
+    }
+    // Requires real whitespace between `w` and its filename (sed's actual
+    // syntax) so a word ending in "w" followed by more text ("below file.txt")
+    // doesn't false-positive; only excludes a LETTER immediately before `w`
+    // (not a digit), because the address form (`5w file`, `1,5w file`) has a
+    // number directly abutting `w` with no separator at all.
+    if (/^g?sed\b/.test(s) && /(^|[^A-Za-z])w\s+\S/.test(s.replace(/^g?sed\b/, ""))) {
+        return "sed 脚本内包含 `w` 写命令：sed 能借此把匹配行写入文件";
+    }
+    return null;
+}
+/**
+ * Decide whether the verifier may run this command line.
+ *
+ * `extraAllowedBash` is a workflow's own `adversarial_check.extra_allowed_bash`
+ * (raw, unvalidated strings straight from YAML) — always re-validated here via
+ * validateExtraAllowedBash rather than trusting a pre-built table, so there is
+ * exactly one path into resolveAction's extra table and no way for a future
+ * caller to skip the NEVER_EXTRA_ALLOWED filter by constructing one by hand.
+ * Every guard below (substitution, write redirection, mutating flags,
+ * script-embedded writes) runs BEFORE resolveAction and applies identically
+ * regardless of which table allowed the base command — an extra-allowed
+ * `./scripts/check.sh` is exactly as constrained by those guards as a
+ * built-in `npm test`.
+ */
+export function checkCommand(command, extraAllowedBash) {
+    const raw = String(command ?? "").trim();
+    if (!raw)
+        return { allowed: false, reason: "命令为空" };
+    for (const { re, what } of SUBSTITUTION_PATTERNS) {
+        if (re.test(raw)) {
+            return { allowed: false, reason: `禁止${what}：它可以绕过只读白名单执行任意命令` };
+        }
+    }
+    const segments = splitSegments(raw);
+    if (segments.length === 0)
+        return { allowed: false, reason: "命令为空" };
+    const extra = extraAllowedBash && extraAllowedBash.length > 0
+        ? validateExtraAllowedBash(extraAllowedBash).allowed
+        : undefined;
+    for (const segment of segments) {
+        const redirection = findWriteRedirection(segment);
+        if (redirection) {
+            return { allowed: false, offendingSegment: segment, reason: `禁止写重定向 \`${redirection}\`：验证者不能修改它正在评判的工作区` };
+        }
+        const mutating = findMutatingFlag(segment);
+        if (mutating) {
+            return { allowed: false, offendingSegment: segment, reason: `禁止 ${mutating}` };
+        }
+        const scriptWrite = findScriptEmbeddedWrite(segment);
+        if (scriptWrite) {
+            return { allowed: false, offendingSegment: segment, reason: `禁止 ${scriptWrite}` };
+        }
+        if (resolveAction(segment, extra) !== "allow") {
+            return { allowed: false, offendingSegment: segment, reason: `命令不在只读白名单内` };
+        }
+    }
+    return { allowed: true };
+}
+/** Run an already-approved command. Never call without checkCommand passing. */
+export function runApprovedCommand(command, cwd, signal) {
+    return new Promise((resolve) => {
+        const child = spawn(command, { cwd, shell: true, signal });
+        let out = "";
+        let truncated = false;
+        let timedOut = false;
+        const append = (chunk) => {
+            if (truncated)
+                return;
+            out += chunk.toString("utf-8");
+            if (out.length > MAX_OUTPUT_BYTES) {
+                out = out.slice(0, MAX_OUTPUT_BYTES) + `\n…（输出超过 ${MAX_OUTPUT_BYTES} 字节，已截断）`;
+                truncated = true;
+            }
+        };
+        child.stdout?.on("data", append);
+        child.stderr?.on("data", append);
+        const timer = setTimeout(() => {
+            timedOut = true;
+            try {
+                child.kill("SIGKILL");
+            }
+            catch { }
+        }, CHECK_BASH_TIMEOUT_MS);
+        child.on("error", (e) => {
+            clearTimeout(timer);
+            resolve({ output: out + `\n命令执行失败：${e.message}`, exitCode: null, timedOut });
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            resolve({
+                output: timedOut ? out + `\n命令超时（>${CHECK_BASH_TIMEOUT_MS / 1000}s），已终止` : out,
+                exitCode: code,
+                timedOut,
+            });
+        });
+    });
+}
+//# sourceMappingURL=check-bash.js.map

package/dist/engine/check-bash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-bash.js","sourceRoot":"","sources":["../../src/engine/check-bash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AAGxD,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAC7C,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAShC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,iCAAiC;IACjC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO;IAC7E,4BAA4B;IAC5B,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO;IACpE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,iCAAiC;IACjC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK;IACtF,qEAAqE;IACrE,yEAAyE;IACzE,0CAA0C;IAC1C,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;IACnF,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO;IACtG,wBAAwB;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK;IAC3B,8BAA8B;IAC9B,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM;IACrC,yEAAyE;IACzE,0CAA0C;IAC1C,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ;CAChH,CAAC,CAAC;AASH;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAA8B;IACrE,MAAM,OAAO,GAAqC,EAAE,CAAC;IACrD,MAAM,QAAQ,GAA+C,EAAE,CAAC;IAChE,KAAK,MAAM,GAAG,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACpG,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,IAAI,4CAA4C,EAAE,CAAC,CAAC;YACzF,SAAS;QACX,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,OAAe;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClF,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,KAAwC;IACrF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,IAAI,GAA6D,IAAI,CAAC;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,2BAA2B,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,2BAA2B,CAAC;IACjG,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC;YAAE,SAAS;QACzC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;QACtD,IAAI,CAAC,IAAI,IAAI,WAAW,GAAG,IAAI,CAAC,WAAW;YAAE,IAAI,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AACrC,CAAC;AAED,iFAAiF;AACjF,MAAM,qBAAqB,GAAwC;IACjE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE;IACnC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE;IAC5B,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE;IAClC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE;CACnC,CAAC;AAEF,iFAAiF;AACjF,SAAS,oBAAoB,CAAC,OAAe;IAC3C,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC7E,+DAA+D;IAC/D,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,CAAC,KAAK,KAAK,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;gBAAE,KAAK,GAAG,IAAI,CAAC;YACzD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,GAAG,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAClE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACnE,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAClE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC,CAAC,gBAAgB;QAC7F,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACpG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/E,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,uEAAuE;AACvE,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACzB,8EAA8E;IAC9E,iFAAiF;IACjF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,wDAAwD,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAClH,0EAA0E;IAC1E,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC;IAC1E,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAClG,qEAAqE;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO,eAAe,OAAO,WAAW,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,OAAO,kDAAkD,CAAC;IAC5D,CAAC;IACD,sEAAsE;IACtE,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,yDAAyD;IACzD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,mCAAmC,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,gBAA2B;IACvE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAEpD,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACjD,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,mBAAmB,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAErE,MAAM,KAAK,GAAG,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAC3D,CAAC,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC,OAAO;QACpD,CAAC,CAAC,SAAS,CAAC;IAEd,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,WAAW,qBAAqB,EAAE,CAAC;QAC7G,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,EAAE,EAAE,CAAC;QACjF,CAAC;QACD,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,EAAE,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAQD,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,GAAW,EAAE,MAAoB;IACnF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,SAAS;gBAAE,OAAO;YACtB,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC/B,IAAI,GAAG,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBAClC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,GAAG,YAAY,gBAAgB,UAAU,CAAC;gBAC9E,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAEjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACzC,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAE1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAM,EAAE,EAAE;YAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,WAAW,qBAAqB,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG;gBAC9E,QAAQ,EAAE,IAAI;gBACd,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/engine/check.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Adversarial Check (Independent Verification) — Pi adapter.
+ *
+ * Mirrors the contract of both plugin versions' adversarialCheck: same inputs,
+ * same `{ passed, infra?, reason }` result, same infra-vs-work-failure
+ * classification (an infra result pauses with check_error and does NOT burn a
+ * failure count, so `ralphflow_continue` re-verifies for free).
+ *
+ * The execution vehicle is what differs. The Claude version spawned
+ * `claude -p --allowedTools "…"`; the opencode version opened an SDK session
+ * with the read-only `ralph-check` agent. Here the verifier is a fresh Pi
+ * session that is read-only *structurally*: it gets Pi's read-only built-ins
+ * (read/grep/find/ls — no bash, no edit, no write) plus exactly two custom
+ * tools, `check_bash` (whitelist-enforced) and `verdict`. There is no host
+ * permission layer to misconfigure, and no prompt asking the model to please
+ * not write.
+ *
+ * The verdict likewise moved from prose to a tool call: the plugins parsed
+ * `<promise-check>true</promise-check>` off the last line, which meant a model
+ * that reasoned past its own tag, or fenced it, silently read as "false".
+ *
+ * Cancellation: the check session's JSONL path is written to the instance dir
+ * (.adversarial-session — counterpart of the Claude version's .adversarial-pid)
+ * and an abort handle is registered in-process so destroyInstance can reach it.
+ * A check owned by ANOTHER process cannot be reached from here; its result is
+ * discarded by the caller's post-check state re-read.
+ */
+import { type Engine } from "./core.js";
+import type { AdversarialCheckConfig, CheckResult, NormalStepDef } from "./types.js";
+import { createCheckSession, type StepEvent } from "../pi/adapter.js";
+/** Abort a still-running check for an instance (in-process only). */
+export declare function abortActiveCheck(instId: string): void;
+export declare function hasActiveCheck(instId: string): boolean;
+/** Seam for tests: swap in a scripted session instead of a real model call. */
+export type CheckSessionFactory = typeof createCheckSession;
+export interface AdversarialCheckDeps {
+    createSession?: CheckSessionFactory;
+}
+/**
+ * Run the independent verification for a step. `checkPrompt` is built by the
+ * caller (with the explicit instId) and passed in, so this function needs no
+ * instance binding of its own.
+ */
+export declare function adversarialCheck(engine: Engine, instId: string, step: NormalStepDef, checkPrompt: string, userTask: string | undefined, adversarialConfig?: AdversarialCheckConfig, onBashEvent?: (line: string) => void, deps?: AdversarialCheckDeps, 
+/** Live stream of the verifier session (reasoning / text / tool calls) for the run view. */
+onEvent?: (event: StepEvent) => void): Promise<CheckResult>;
+//# sourceMappingURL=check.d.ts.map

package/dist/engine/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/engine/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAIL,KAAK,MAAM,EACZ,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EACL,kBAAkB,EAIlB,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAC;AAS1B,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAcrD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEtD;AAoFD,+EAA+E;AAC/E,MAAM,MAAM,mBAAmB,GAAG,OAAO,kBAAkB,CAAC;AAE5D,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,iBAAiB,CAAC,EAAE,sBAAsB,EAC1C,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EACpC,IAAI,CAAC,EAAE,oBAAoB;AAC3B,4FAA4F;AAC5F,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GACnC,OAAO,CAAC,WAAW,CAAC,CAwKtB"}