shieldcortex 2.4.23 → 2.4.24

package/dist/defence/skill-scanner/patterns.js

@@ -0,0 +1,240 @@
+/**
+ * Skill-Specific Threat Patterns
+ *
+ * Detects malicious patterns in agent instruction files (skill files, tool
+ * definitions, .mdc rules, etc.) and in code files (JS/TS/JSON) that may
+ * accompany them.
+ *
+ * Two entry points:
+ *  - detectSkillThreats()  — natural-language instruction scanning
+ *  - detectCodeThreats()   — JavaScript / JSON code scanning
+ *
+ * Follows the same conventions as instruction-detector.ts:
+ *  - One match per group is enough (break after first)
+ *  - MAX_SCAN_LENGTH truncation to prevent ReDOS
+ *  - safeRegexTest wrapper for every test
+ *  - Length caps on unbounded quantifiers ([\s\S]{0,N})
+ */
+// ── Constants ────────────────────────────────────────────────────────────────
+/** Maximum content length to analyse (prevents ReDOS on very long inputs). */
+const MAX_SCAN_LENGTH = 50000;
+// ── Helpers ──────────────────────────────────────────────────────────────────
+/**
+ * Safely test a regex against content with a length limit.
+ */
+function safeRegexTest(pattern, text) {
+    const truncated = text.length > MAX_SCAN_LENGTH ? text.slice(0, MAX_SCAN_LENGTH) : text;
+    return pattern.test(truncated);
+}
+/**
+ * Run a set of pattern groups against content and return a SkillThreatResult.
+ *
+ * Confidence = max matched group weight + 0.1 bonus per additional group,
+ * capped at 1.0.
+ */
+function runPatternGroups(content, groups) {
+    const matchedThreats = [];
+    let maxWeight = 0;
+    for (const group of groups) {
+        for (const pattern of group.patterns) {
+            if (safeRegexTest(pattern, content)) {
+                matchedThreats.push(group.name);
+                if (group.weight > maxWeight) {
+                    maxWeight = group.weight;
+                }
+                break; // one match per group is enough
+            }
+        }
+    }
+    const groupBonus = Math.min((matchedThreats.length - 1) * 0.1, 0.3);
+    const confidence = matchedThreats.length > 0 ? Math.min(maxWeight + groupBonus, 1.0) : 0;
+    return {
+        detected: matchedThreats.length > 0,
+        threats: [...new Set(matchedThreats)],
+        confidence: Math.round(confidence * 100) / 100,
+    };
+}
+// ── Skill Instruction Patterns ───────────────────────────────────────────────
+const SKILL_PATTERN_GROUPS = [
+    // 1. Tool injection — instructions to run shell commands or write files
+    {
+        name: 'tool_injection',
+        weight: 0.9,
+        patterns: [
+            /always run\s*:?\s*[`'"]/i,
+            /execute\s+(this\s+)?(bash|shell|command|script)/i,
+            /run\s+the\s+following\s+(command|script)/i,
+            /write\s+(this|the\s+following)\s+to\s+\//i,
+            /use\s+the\s+Bash\s+tool\s+to/i,
+            /pipe[\s\S]{0,50}\|\s*(bash|sh|zsh)/i,
+            /echo\s+[\s\S]{0,100}>\s*\//i,
+        ],
+    },
+    // 2. Scope escalation — access to files / data outside the project
+    {
+        name: 'scope_escalation',
+        weight: 0.85,
+        patterns: [
+            /read\s+[\s\S]{0,50}~\/\.ssh/i,
+            /read\s+[\s\S]{0,50}~\/\.aws/i,
+            /read\s+[\s\S]{0,50}~\/\.env/i,
+            /read\s+[\s\S]{0,50}\/etc\/(passwd|shadow|hosts)/i,
+            /access\s+[\s\S]{0,50}environment\s+var/i,
+            /process\.env\[/i,
+            /cat\s+~\//i,
+            /cat\s+\/etc\//i,
+            /~\/\.gnupg/i,
+            /~\/\.config\/(gcloud|gh|hub)/i,
+            /read[\s\S]{0,50}(private\.key|id_rsa|id_ed25519)/i,
+        ],
+    },
+    // 3. Data exfiltration — extract and send data externally
+    {
+        name: 'data_exfiltration',
+        weight: 0.9,
+        patterns: [
+            /include\s+(the\s+)?(contents?|data|output|result)\s+(in|with)\s+(your\s+)?response/i,
+            /send\s+(to|via)\s+https?:/i,
+            /post\s+(to|data)[\s\S]{0,50}https?:/i,
+            /curl\s+[\s\S]{0,100}-d\s+[\s\S]{0,100}https?:/i,
+            /upload\s+[\s\S]{0,50}to\s+https?:/i,
+            /webhook\s*[=:]\s*https?:/i,
+            /fetch\s*\(\s*['"]https?:/i,
+            /encode\s+[\s\S]{0,50}base64[\s\S]{0,50}send/i,
+        ],
+    },
+    // 4. Persistence — modify agent configuration files
+    {
+        name: 'persistence',
+        weight: 0.85,
+        patterns: [
+            /modify\s+[\s\S]{0,50}\.claude\/settings/i,
+            /edit\s+[\s\S]{0,50}CLAUDE\.md/i,
+            /write\s+[\s\S]{0,50}\.cursorrules/i,
+            /write\s+[\s\S]{0,50}\.windsurfrules/i,
+            /write\s+[\s\S]{0,50}\.clinerules/i,
+            /modify\s+[\s\S]{0,50}\.claude\/commands/i,
+            /add\s+[\s\S]{0,50}hook/i,
+            /install\s+[\s\S]{0,50}hook/i,
+            /modify\s+[\s\S]{0,50}\.claude\/plugins/i,
+            /\bcrontab\b/i,
+            /\blaunchd\b/i,
+            /systemctl\s+enable/i,
+            /write\s+[\s\S]{0,50}\.(bashrc|zshrc|profile)/i,
+        ],
+    },
+    // 5. Supply chain — install packages or modify dependencies
+    {
+        name: 'supply_chain',
+        weight: 0.8,
+        patterns: [
+            /npm\s+install\s+/i,
+            /pip\s+install\s+/i,
+            /add\s+[\s\S]{0,50}to\s+(package\.json|requirements\.txt|Gemfile|go\.mod)/i,
+            /install\s+(this\s+)?package/i,
+            /add\s+(this\s+)?dependency/i,
+            /cargo\s+add\s+/i,
+            /brew\s+install/i,
+        ],
+    },
+    // 6. Agent manipulation — override agent safety or behaviour
+    {
+        name: 'agent_manipulation',
+        weight: 0.9,
+        patterns: [
+            /ignore\s+(all\s+)?(safety|security|permission|restriction)/i,
+            /bypass\s+(the\s+)?(sandbox|permission|safety|check)/i,
+            /disable\s+(the\s+)?(firewall|security|protection|hook|guard)/i,
+            /never\s+(ask|check|verify|confirm|prompt)\s+(for\s+)?permission/i,
+            /auto-?approve\s+all/i,
+            /skip\s+(verification|validation|check)/i,
+            /override\s+(the\s+)?(safety|security)/i,
+            /dangerouslyDisableSandbox/i,
+            /--no-verify|--force|--yes/i,
+        ],
+    },
+    // 7. Stealth instruction — hidden instructions using formatting tricks
+    {
+        name: 'stealth_instruction',
+        weight: 0.85,
+        patterns: [
+            // HTML comments containing actionable words (length-capped)
+            /<!--[\s\S]{0,500}?(always|never|must|ignore|execute|run|send|read)[\s\S]{0,500}?-->/i,
+            // Buried after excessive whitespace (length-capped)
+            /\n{10,}[\s\S]{0,200}(always|never|must|ignore|execute|run|send|read)/i,
+            // Content after --- end-of-document marker with actionable words
+            /\n---\s*\n[\s\S]{0,500}?(always|never|must|ignore|execute|run|send|read)/i,
+            // Unicode direction overrides in instruction context
+            /[\u200E\u200F\u202A-\u202E\u2066-\u2069]/,
+        ],
+    },
+];
+// ── Code Threat Patterns (JS / JSON) ─────────────────────────────────────────
+const CODE_PATTERN_GROUPS = [
+    // 1. Dangerous require / import
+    {
+        name: 'dangerous_require',
+        weight: 0.9,
+        patterns: [
+            /require\s*\(\s*['"]child_process['"]\s*\)/,
+            /require\s*\(\s*['"]net['"]\s*\)/,
+            /require\s*\(\s*['"]http['"]\s*\)/,
+            /require\s*\(\s*['"]https['"]\s*\)/,
+            /require\s*\(\s*['"]dgram['"]\s*\)/,
+            /import\s+.*from\s+['"]child_process['"]/,
+        ],
+    },
+    // 2. Dangerous function calls
+    {
+        name: 'dangerous_calls',
+        weight: 0.9,
+        patterns: [
+            /\beval\s*\(/,
+            /\bFunction\s*\(/,
+            /child_process\.(exec|spawn|execSync|fork)/,
+            /\.exec\s*\(\s*[`'"]/,
+            /process\.exit/,
+        ],
+    },
+    // 3. Filesystem access to sensitive paths
+    {
+        name: 'filesystem_access',
+        weight: 0.7,
+        patterns: [
+            /fs\.readFileSync\s*\(\s*['"][\s\S]{0,100}\.(env|key|pem|ssh)/,
+            /readFile[\s\S]{0,50}\/etc\/(passwd|shadow)/,
+            /writeFile[\s\S]{0,50}\.(bashrc|zshrc|profile|claude)/,
+        ],
+    },
+    // 4. Network access
+    {
+        name: 'network_access',
+        weight: 0.8,
+        patterns: [
+            /http\.request|https\.request/,
+            /fetch\s*\(\s*['"]https?:/,
+            /new\s+WebSocket/,
+            /\.listen\s*\(\s*\d+\s*\)/,
+        ],
+    },
+];
+// ── Public API ───────────────────────────────────────────────────────────────
+/**
+ * Analyse natural-language skill / instruction content for threat patterns.
+ *
+ * Designed for scanning .mdc files, skill definitions, tool descriptions,
+ * and similar agent instruction documents.
+ */
+export function detectSkillThreats(content) {
+    return runPatternGroups(content, SKILL_PATTERN_GROUPS);
+}
+/**
+ * Analyse JavaScript / JSON code content for threat patterns.
+ *
+ * Designed for scanning code files that accompany skill definitions —
+ * tool implementations, config files, etc.
+ */
+export function detectCodeThreats(content) {
+    return runPatternGroups(content, CODE_PATTERN_GROUPS);
+}
+//# sourceMappingURL=patterns.js.map

package/dist/defence/skill-scanner/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/defence/skill-scanner/patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAgBH,gFAAgF;AAEhF,8EAA8E;AAC9E,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B,gFAAgF;AAEhF;;GAEG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,IAAY;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,OAAe,EAAE,MAAsB;IAC/D,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;gBACpC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;oBAC7B,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;gBAC3B,CAAC;gBACD,MAAM,CAAC,gCAAgC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,UAAU,GACd,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAExE,OAAO;QACL,QAAQ,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC;QACnC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QACrC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,GAAG;KAC/C,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,MAAM,oBAAoB,GAAmB;IAC3C,wEAAwE;IACxE;QACE,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE;YACR,0BAA0B;YAC1B,kDAAkD;YAClD,2CAA2C;YAC3C,2CAA2C;YAC3C,+BAA+B;YAC/B,qCAAqC;YACrC,6BAA6B;SAC9B;KACF;IAED,mEAAmE;IACnE;QACE,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE;YACR,8BAA8B;YAC9B,8BAA8B;YAC9B,8BAA8B;YAC9B,kDAAkD;YAClD,yCAAyC;YACzC,iBAAiB;YACjB,YAAY;YACZ,gBAAgB;YAChB,aAAa;YACb,+BAA+B;YAC/B,mDAAmD;SACpD;KACF;IAED,0DAA0D;IAC1D;QACE,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE;YACR,qFAAqF;YACrF,4BAA4B;YAC5B,sCAAsC;YACtC,gDAAgD;YAChD,oCAAoC;YACpC,2BAA2B;YAC3B,2BAA2B;YAC3B,8CAA8C;SAC/C;KACF;IAED,oDAAoD;IACpD;QACE,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE;YACR,0CAA0C;YAC1C,gCAAgC;YAChC,oCAAoC;YACpC,sCAAsC;YACtC,mCAAmC;YACnC,0CAA0C;YAC1C,yBAAyB;YACzB,6BAA6B;YAC7B,yCAAyC;YACzC,cAAc;YACd,cAAc;YACd,qBAAqB;YACrB,+CAA+C;SAChD;KACF;IAED,4DAA4D;IAC5D;QACE,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE;YACR,mBAAmB;YACnB,mBAAmB;YACnB,2EAA2E;YAC3E,8BAA8B;YAC9B,6BAA6B;YAC7B,iBAAiB;YACjB,iBAAiB;SAClB;KACF;IAED,6DAA6D;IAC7D;QACE,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE;YACR,6DAA6D;YAC7D,sDAAsD;YACtD,+DAA+D;YAC/D,kEAAkE;YAClE,sBAAsB;YACtB,yCAAyC;YACzC,wCAAwC;YACxC,4BAA4B;YAC5B,4BAA4B;SAC7B;KACF;IAED,uEAAuE;IACvE;QACE,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE;YACR,4DAA4D;YAC5D,sFAAsF;YACtF,oDAAoD;YACpD,uEAAuE;YACvE,iEAAiE;YACjE,2EAA2E;YAC3E,qDAAqD;YACrD,0CAA0C;SAC3C;KACF;CACF,CAAC;AAEF,gFAAgF;AAEhF,MAAM,mBAAmB,GAAmB;IAC1C,gCAAgC;IAChC;QACE,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE;YACR,2CAA2C;YAC3C,iCAAiC;YACjC,kCAAkC;YAClC,mCAAmC;YACnC,mCAAmC;YACnC,yCAAyC;SAC1C;KACF;IAED,8BAA8B;IAC9B;QACE,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE;YACR,aAAa;YACb,iBAAiB;YACjB,2CAA2C;YAC3C,qBAAqB;YACrB,eAAe;SAChB;KACF;IAED,0CAA0C;IAC1C;QACE,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE;YACR,8DAA8D;YAC9D,4CAA4C;YAC5C,sDAAsD;SACvD;KACF;IAED,oBAAoB;IACpB;QACE,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE;YACR,8BAA8B;YAC9B,0BAA0B;YAC1B,iBAAiB;YACjB,0BAA0B;SAC3B;KACF;CACF,CAAC;AAEF,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,gBAAgB,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AACxD,CAAC"}

package/dist/defence/skill-scanner/scan-skill.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Skill Scanner — Core Module
+ *
+ * Scans agent instruction files (skill definitions, tool configs, rules files)
+ * for threats using the full ShieldCortex defence pipeline combined with
+ * skill-specific pattern detection.
+ *
+ * Public API:
+ *  - scanSkill(filePath, options?)     — read from disc and scan
+ *  - scanSkillContent(content, options?) — scan raw content directly
+ *
+ * Never throws — returns safe defaults on errors.
+ */
+import type { FirewallAnalysis, SensitivityClassification } from '../types.js';
+import type { SkillFormat } from './parser.js';
+export interface SkillScanOptions {
+    /** Defence mode override (defaults to config default — 'balanced'). */
+    mode?: 'strict' | 'balanced' | 'permissive';
+    /** When true, include the matched text snippet in each finding. */
+    includeContent?: boolean;
+}
+export interface SkillThreatFinding {
+    /** Pattern group name, e.g. 'tool_injection', 'data_exfiltration'. */
+    pattern: string;
+    /** Derived severity for this finding. */
+    severity: 'low' | 'medium' | 'high' | 'critical';
+    /** Human-readable explanation of the threat. */
+    description: string;
+    /** The text that triggered the finding (truncated to 80 chars). */
+    matchedText?: string;
+    /** Line number in the source file, if determinable. */
+    line?: number;
+}
+export interface SkillScanResult {
+    /** True when no high or critical findings exist. */
+    safe: boolean;
+    /** Name extracted from the skill file. */
+    skillName: string;
+    /** Detected format of the skill file. */
+    format: SkillFormat;
+    /** Individual threat findings. */
+    findings: SkillThreatFinding[];
+    /** Overall risk level — the highest severity found, or 'safe'. */
+    riskLevel: 'safe' | 'low' | 'medium' | 'high' | 'critical';
+    /** One-line human-readable summary. */
+    summary: string;
+    /** Time taken to scan in milliseconds. */
+    scanDurationMs: number;
+    /** Full firewall analysis result. */
+    firewall: FirewallAnalysis;
+    /** Sensitivity classification result. */
+    sensitivity: SensitivityClassification;
+}
+/**
+ * Scan a skill file from disc for threats.
+ *
+ * Reads the file, auto-detects its format, and runs the full defence pipeline
+ * plus skill-specific pattern detection.
+ *
+ * Never throws — returns safe defaults if the file cannot be read.
+ */
+export declare function scanSkill(filePath: string, options?: SkillScanOptions): SkillScanResult;
+/**
+ * Scan raw skill content for threats without reading from disc.
+ *
+ * Useful when the content is already in memory (e.g. received via API,
+ * read from a database, or extracted from a larger document).
+ *
+ * @param content  Raw file content to scan
+ * @param options  Scan options (mode, includeContent)
+ * @param format   Optional format hint — auto-detected as 'unknown' if omitted
+ * @param name     Optional skill name — defaults to 'inline'
+ */
+export declare function scanSkillContent(content: string, options?: SkillScanOptions, format?: SkillFormat, name?: string): SkillScanResult;
+//# sourceMappingURL=scan-skill.d.ts.map

package/dist/defence/skill-scanner/scan-skill.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-skill.d.ts","sourceRoot":"","sources":["../../../src/defence/skill-scanner/scan-skill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAGV,gBAAgB,EAChB,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AAKrB,OAAO,KAAK,EAAE,WAAW,EAAe,MAAM,aAAa,CAAC;AAI5D,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,IAAI,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,YAAY,CAAC;IAC5C,mEAAmE;IACnE,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjD,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,IAAI,EAAE,OAAO,CAAC;IACd,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,MAAM,EAAE,WAAW,CAAC;IACpB,kCAAkC;IAClC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,kEAAkE;IAClE,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,yCAAyC;IACzC,WAAW,EAAE,yBAAyB,CAAC;CACxC;AAiWD;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,eAAe,CA+BjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,gBAAgB,EAC1B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,CAAC,EAAE,MAAM,GACZ,eAAe,CAuCjB"}