slaunt 0.1.17 → 0.1.18

package/src/setup/hook-installer.js

@@ -0,0 +1,496 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const { catalog } = require('../discovery/catalog');
+
+const { SLAUNT_SERVER_NAME } = require('../mcp-identity');
+const { DENIAL } = require('../desktop/tool-guard');
+const GUARD_MARKER = ': slaunt-pretooluse-v1; ';
+const GUARD_STATUS = 'Requesting Slaunt tool authorization';
+const CAPTURE_MARKER = ': slaunt-chat-capture-v1; ';
+const CAPTURE_STATUS = 'Capturing visible Slaunt messages';
+const NATIVE_LIFECYCLE_MARKER = ': slaunt-native-lifecycle-v1; ';
+const PREVIOUS_SERVER_NAMES = new Set([SLAUNT_SERVER_NAME, 'Slaunt', 'slaunt-2']);
+const MANAGED_TOOL_NAMES = new Set(['aki_workspace_context', 'codex_hook_event', 'slaunt_hook_event', 'tool_authorize_codex']);
+const MAX_CONFIG_BYTES = 2 * 1024 * 1024;
+const HOOK_SETUP_TARGETS = Object.freeze({
+  'claude-code': 'claude-mcp-tool',
+  'codex-cli': 'codex-mcp-tool'
+});
+// Hook installation uses only documented, fixed per-client config paths. Do
+// not search for arbitrary files or accept a target path from renderer input.
+const CLIENT_HOOK_TARGETS = Object.freeze({
+  'codex-mcp-tool': Object.freeze({ directory: '.codex', file: 'hooks.json' }),
+  'claude-mcp-tool': Object.freeze({ directory: '.claude', file: 'settings.json' })
+});
+
+function makeHook(input, options = {}) {
+  const hook = {
+    type: 'mcp_tool',
+    server: SLAUNT_SERVER_NAME,
+    tool: options.tool || 'codex_hook_event',
+    input,
+    timeout: options.timeout || 15,
+    statusMessage: options.statusMessage
+  };
+  return hook;
+}
+
+function makeGuardHook(broker, clientId) {
+  const quote = value => `'${value.replace(/'/g, `'\\''`)}'`;
+  const fallback = `printf '%s\\n' ${quote(JSON.stringify(DENIAL))}`;
+  let command = fallback;
+  if (broker) {
+    if (!path.isAbsolute(broker.command || '') || !Array.isArray(broker.args)
+        || broker.args.length > 4 || [broker.command, ...broker.args].some(value =>
+          typeof value !== 'string' || !value || value.length > 4096 || /[\x00-\x1f\x7f]/.test(value))
+        || broker.args.filter(value => value === '--slaunt-mcp-stdio').length !== 1
+        || broker.args.some(value => value.startsWith('--slaunt-client='))) throw new Error('invalid-guard-broker');
+    const script = path.resolve(__dirname, '../desktop/tool-guard-command.js');
+    command = `/usr/bin/env -u NODE_OPTIONS -u NODE_PATH ELECTRON_RUN_AS_NODE=1 ${[
+      broker.command, script, '--slaunt-pretooluse', `--slaunt-client=${clientId}`
+    ].map(quote).join(' ')} 2>/dev/null || { ${fallback}; }`;
+  }
+  return { type: 'command', command: GUARD_MARKER + command, timeout: 20, statusMessage: GUARD_STATUS };
+}
+
+function makeCaptureHook(broker) {
+  // Reuse the fixed-executable validation; no transcript path or content is
+  // interpolated into a shell command. Native hook JSON arrives only on stdin.
+  makeGuardHook(broker, 'codex-cli');
+  const quote = value => `'${value.replace(/'/g, `'\\''`)}'`;
+  const command = broker
+    ? `/usr/bin/env -u NODE_OPTIONS -u NODE_PATH ELECTRON_RUN_AS_NODE=1 ${[
+      broker.command, path.resolve(__dirname, '../desktop/chat-capture-command.js')
+    ].map(quote).join(' ')}`
+    : `printf '%s\\n' 'Slaunt visible chat capture unavailable (capture-broker-unavailable).' >&2; printf '%s\\n' '{}'`;
+  return { type: 'command', command: CAPTURE_MARKER + command, timeout: 10, statusMessage: CAPTURE_STATUS };
+}
+
+function createSlauntHooks({ broker, captureVisibleMessages = false } = {}) {
+  const config = {
+    hooks: {
+      SessionStart: [{
+        matcher: '^(startup|resume|clear|compact)$',
+        hooks: [makeHook({
+          event_name: 'SessionStart',
+          session_id: '${session_id}',
+          model: '${model}'
+        }, {
+          timeout: 30,
+          statusMessage: 'Registering Slaunt session'
+        })]
+      }],
+      UserPromptSubmit: [{
+        hooks: [makeHook({
+          event_name: 'UserPromptSubmit',
+          session_id: '${session_id}',
+          turn_id: '${turn_id}',
+          model: '${model}',
+          permission_mode: '${permission_mode}'
+        }, { statusMessage: 'Refreshing Slaunt context and starting thread logging' })]
+      }],
+      PreToolUse: [{
+        matcher: '*',
+        hooks: [makeHook({event_name:'PreToolUse',session_id:'${session_id}',turn_id:'${turn_id}',tool_name:'${tool_name}',tool_use_id:'${tool_use_id}'}, {tool:'tool_authorize_codex',timeout:10,statusMessage:GUARD_STATUS})]
+      }],
+      PostToolUse: [{
+        matcher: '*',
+        hooks: [makeHook({
+          event_name: 'PostToolUse',
+          session_id: '${session_id}',
+          turn_id: '${turn_id}',
+          tool_name: '${tool_name}',
+          tool_use_id: '${tool_use_id}',
+          model: '${model}',
+          permission_mode: '${permission_mode}'
+        }, { timeout: 15, statusMessage: 'Logging tool completion' })]
+      }],
+      SubagentStart: [{
+        hooks: [makeHook({
+          event_name: 'SubagentStart',
+          session_id: '${session_id}',
+          turn_id: '${turn_id}',
+          agent_type: '${agent_type}',
+          agent_id: '${agent_id}'
+        }, { timeout: 15, statusMessage: 'Logging subagent start' })]
+      }],
+      SubagentStop: [{
+        hooks: [makeHook({
+          event_name: 'SubagentStop',
+          session_id: '${session_id}',
+          turn_id: '${turn_id}',
+          agent_type: '${agent_type}',
+          agent_id: '${agent_id}'
+        }, { timeout: 15, statusMessage: 'Logging subagent completion' })]
+      }],
+      PreCompact: [{
+        matcher: '^(manual|auto)$',
+        hooks: [makeHook({
+          event_name: 'PreCompact',
+          session_id: '${session_id}',
+          turn_id: '${turn_id}',
+          trigger: '${trigger}'
+        }, { timeout: 15, statusMessage: 'Logging compaction start' })]
+      }],
+      PostCompact: [{
+        matcher: '^(manual|auto)$',
+        hooks: [makeHook({
+          event_name: 'PostCompact',
+          session_id: '${session_id}',
+          turn_id: '${turn_id}',
+          trigger: '${trigger}'
+        }, { timeout: 15, statusMessage: 'Logging compaction completion' })]
+      }],
+      Stop: [{
+        hooks: [makeHook({
+          event_name: 'Stop',
+          session_id: '${session_id}',
+          turn_id: '${turn_id}'
+        }, { timeout: 15, statusMessage: 'Closing Slaunt run' })]
+      }],
+      Interrupt: [{
+        hooks: [makeHook({
+          event_name: 'Interrupt',
+          session_id: '${session_id}',
+          turn_id: '${turn_id}'
+        }, { timeout: 3, statusMessage: 'Closing interrupted Slaunt run' })]
+      }]
+    }
+  };
+  if (captureVisibleMessages) {
+    for (const event of ['UserPromptSubmit', 'PreToolUse', 'PostToolUse', 'Stop', 'Interrupt']) {
+      config.hooks[event][0].hooks.push(makeCaptureHook(broker));
+    }
+  }
+  return config;
+}
+
+function createClaudeCodeHooks({ broker, nativeBroker = false } = {}) {
+  if(nativeBroker){
+    if(!broker)throw new Error('invalid-guard-broker');
+    const quote=value=>`'${value.replace(/'/g, `'\\''`)}'`;
+    const guard=makeGuardHook(broker,'claude-code');
+    const lifecycle=`/usr/bin/env -u NODE_OPTIONS -u NODE_PATH ${[broker.command,path.resolve(__dirname,'../desktop/broker-hook-command.js')].map(quote).join(' ')}`;
+    const eventHook=()=>({type:'command',command:NATIVE_LIFECYCLE_MARKER+lifecycle,timeout:20,onFailure:'block',statusMessage:'Connecting Slaunt run'});
+    return {hooks:{SessionStart:[{hooks:[eventHook()]}],UserPromptSubmit:[{hooks:[eventHook()]}],PreToolUse:[{matcher:'*',hooks:[{...guard,onFailure:'block'}]}],Stop:[{hooks:[eventHook()]}]}};
+  }
+  const hooks = createSlauntHooks({ broker, captureVisibleMessages: false }).hooks;
+  hooks.PreToolUse[0].hooks = [{ ...makeGuardHook(broker, 'claude-code'), onFailure: 'block' }];
+  delete hooks.Interrupt;
+
+  // Claude Code runs SessionStart before MCP servers are available on initial
+  // startup/resume. Only refresh after clear/compaction, when MCP is available.
+  hooks.SessionStart[0].matcher = '^(clear|compact)$';
+
+  hooks.UserPromptSubmit[0].hooks[0].input = {
+    event_name: 'UserPromptSubmit',
+    session_id: '${session_id}',
+    prompt_id: '${prompt_id}',
+    prompt: '${prompt}',
+    agent_id: '${agent_id}'
+  };
+  hooks.UserPromptSubmit[0].hooks[0].statusMessage = 'Saving Claude chat and refreshing Slaunt context';
+  hooks.PostToolUse[0].hooks[0].input = {
+    event_name: 'PostToolUse',
+    session_id: '${session_id}',
+    tool_name: '${tool_name}',
+    tool_use_id: '${tool_use_id}',
+    permission_mode: '${permission_mode}'
+  };
+  for (const eventName of ['SubagentStart', 'SubagentStop']) {
+    hooks[eventName][0].hooks[0].input = {
+      event_name: eventName,
+      session_id: '${session_id}',
+      agent_type: '${agent_type}',
+      agent_id: '${agent_id}'
+    };
+  }
+  for (const eventName of ['PreCompact', 'PostCompact']) {
+    hooks[eventName][0].hooks[0].input = {
+      event_name: eventName,
+      session_id: '${session_id}',
+      trigger: '${trigger}'
+    };
+  }
+  hooks.Stop[0].hooks[0].input = {
+    event_name: 'Stop',
+    session_id: '${session_id}',
+    prompt_id: '${prompt_id}',
+    last_assistant_message: '${last_assistant_message}'
+  };
+
+  for (const groups of Object.values(hooks)) {
+    for (const group of groups) for (const hook of group.hooks) {
+      if (hook.type === 'mcp_tool') hook.tool = 'slaunt_hook_event';
+    }
+  }
+  hooks.SessionStart[0].hooks[0].input = { event_name: 'SessionStart', session_id: '${session_id}' };
+  return { hooks };
+}
+
+function isManagedSlauntHook(hook) {
+  return Boolean(hook?.type === 'command' && typeof hook.command==='string' && hook.command.startsWith(NATIVE_LIFECYCLE_MARKER)) || Boolean(hook?.type === 'command' && hook.statusMessage === CAPTURE_STATUS
+    && typeof hook.command === 'string' && hook.command.startsWith(CAPTURE_MARKER)) || Boolean(hook?.type === 'command' && hook.statusMessage === GUARD_STATUS
+    && typeof hook.command === 'string' && hook.command.startsWith(GUARD_MARKER)) || Boolean(hook
+    && hook.type === 'mcp_tool'
+    && PREVIOUS_SERVER_NAMES.has(hook.server)
+    && MANAGED_TOOL_NAMES.has(hook.tool));
+}
+
+function mergeSlauntHooks(existingConfig, hookConfig = createSlauntHooks()) {
+  if (!existingConfig || typeof existingConfig !== 'object' || Array.isArray(existingConfig)) {
+    throw new Error('invalid-config-root');
+  }
+
+  const merged = { ...existingConfig };
+  if (merged.hooks === undefined) merged.hooks = {};
+  if (!merged.hooks || typeof merged.hooks !== 'object' || Array.isArray(merged.hooks)) {
+    throw new Error('invalid-hooks-section');
+  }
+  merged.hooks = { ...merged.hooks };
+
+  const managed = hookConfig.hooks;
+  for (const [eventName, groups] of Object.entries(managed)) {
+    const existingGroups = merged.hooks[eventName] || [];
+    if (!Array.isArray(existingGroups)) throw new Error('invalid-event-hook-list');
+
+    const retainedGroups = existingGroups
+      .map((group) => {
+        if (!group || typeof group !== 'object' || Array.isArray(group)) return group;
+        if (!Array.isArray(group.hooks)) return group;
+        const retainedHooks = group.hooks.filter((hook) => !isManagedSlauntHook(hook)
+          // The collector owns final assistant capture for Codex. Keep existing
+          // prompt/tool capture hooks, but avoid a second Stop final event.
+          && !(eventName === 'Stop' && groups.some(g => g.hooks.some(h => h.command?.startsWith(CAPTURE_MARKER)))
+            && hook.type === 'mcp_tool' && PREVIOUS_SERVER_NAMES.has(hook.server)
+            && hook.tool === 'chat_hook_event'));
+        if (retainedHooks.length === group.hooks.length) return group;
+        return retainedHooks.length > 0 ? { ...group, hooks: retainedHooks } : null;
+      })
+      .filter(Boolean);
+
+    merged.hooks[eventName] = [...retainedGroups, ...groups];
+  }
+
+  return merged;
+}
+
+function ensureConfigDirectory(homeDir, directoryName, fileSystem) {
+  if (!/^\.[a-z0-9-]+$/.test(directoryName)) throw new Error('unsafe-config-directory');
+  const configDirectory = path.join(homeDir, directoryName);
+  try {
+    const stats = fileSystem.lstatSync(configDirectory);
+    if (stats.isSymbolicLink() || !stats.isDirectory()) throw new Error('unsafe-config-directory');
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    fileSystem.mkdirSync(configDirectory, { mode: 0o700 });
+  }
+
+  const stats = fileSystem.lstatSync(configDirectory);
+  if (stats.isSymbolicLink() || !stats.isDirectory()) throw new Error('unsafe-config-directory');
+  return configDirectory;
+}
+
+function readExistingConfig(configPath, fileSystem) {
+  let stats;
+  try {
+    stats = fileSystem.lstatSync(configPath);
+  } catch (error) {
+    if (error.code === 'ENOENT') return {};
+    throw error;
+  }
+
+  if (stats.isSymbolicLink() || !stats.isFile()) throw new Error('unsafe-config-file');
+  if (stats.size > MAX_CONFIG_BYTES) throw new Error('config-file-too-large');
+  try {
+    const parsed = JSON.parse(fileSystem.readFileSync(configPath, 'utf8'));
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error('invalid-config-root');
+    return parsed;
+  } catch (error) {
+    if (error instanceof SyntaxError) throw new Error('invalid-config-json');
+    throw error;
+  }
+}
+
+function writeConfigAtomically(configPath, configDirectory, serialized, fileSystem) {
+  const temporaryPath = path.join(
+    configDirectory,
+    `.hooks.json.slaunt-${process.pid}-${crypto.randomBytes(8).toString('hex')}.tmp`
+  );
+  let fileDescriptor;
+  try {
+    fileDescriptor = fileSystem.openSync(temporaryPath, 'wx', 0o600);
+    fileSystem.writeFileSync(fileDescriptor, serialized, 'utf8');
+    fileSystem.fsyncSync(fileDescriptor);
+    fileSystem.closeSync(fileDescriptor);
+    fileDescriptor = undefined;
+
+    try {
+      const current = fileSystem.lstatSync(configPath);
+      if (current.isSymbolicLink() || !current.isFile()) throw new Error('unsafe-config-file');
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+    }
+
+    fileSystem.renameSync(temporaryPath, configPath);
+    fileSystem.chmodSync(configPath, 0o600);
+  } finally {
+    if (fileDescriptor !== undefined) fileSystem.closeSync(fileDescriptor);
+    try {
+      fileSystem.unlinkSync(temporaryPath);
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+    }
+  }
+}
+
+function installHooksFile(homeDir, directoryName, fileName, hookConfig, fileSystem = fs) {
+  const configDirectory = ensureConfigDirectory(homeDir, directoryName, fileSystem);
+  const configPath = path.join(configDirectory, fileName);
+  const existing = readExistingConfig(configPath, fileSystem);
+  const merged = mergeSlauntHooks(existing, hookConfig);
+  const serialized = `${JSON.stringify(merged, null, 2)}\n`;
+  const previousSerialized = `${JSON.stringify(existing, null, 2)}\n`;
+
+  if (serialized === previousSerialized) return { status: 'unchanged' };
+  writeConfigAtomically(configPath, configDirectory, serialized, fileSystem);
+  return { status: 'installed' };
+}
+
+function installCodexHooks(homeDir, fileSystem = fs, options = {}) {
+  const target = CLIENT_HOOK_TARGETS['codex-mcp-tool'];
+  return installHooksFile(homeDir, target.directory, target.file, createSlauntHooks(options), fileSystem);
+}
+
+function claudeSupportsBlocking(versionOutput) {
+  const match = /^\s*(\d+)\.(\d+)\.(\d+)(?:\s|$)/.exec(versionOutput || '');
+  if (!match) return false;
+  const parts=match.slice(1).map(Number), minimum=[2,1,295];
+  for(let i=0;i<3;i++){if(parts[i]>minimum[i])return true;if(parts[i]<minimum[i])return false;}
+  return true;
+}
+
+function installClaudeCodeHooks(homeDir, fileSystem = fs, options = {}) {
+  const probe=(options.versionProbe || (()=>spawnSync('claude',['--version'],{encoding:'utf8',timeout:10000,stdio:['ignore','pipe','ignore']})))();
+  if (probe?.error || probe?.status !== 0 || !claudeSupportsBlocking(probe.stdout)) throw new Error('claude-version-unsupported');
+  const target = CLIENT_HOOK_TARGETS['claude-mcp-tool'];
+  const result = installHooksFile(homeDir, target.directory, target.file, createClaudeCodeHooks(options), fileSystem);
+  return {
+    status: 'partial',
+    reason: result.status === 'installed' || result.status === 'unchanged'
+      ? 'claude-lifecycle-differences'
+      : null
+  };
+}
+
+function safeClientResult(client, status, reason = null) {
+  return {
+    id: client.id,
+    surface: client.surface || 'unknown',
+    status,
+    reason
+  };
+}
+
+function safeInstallErrorReason(error) {
+  const knownReasons = new Set([
+    'invalid-config-root',
+    'invalid-hooks-section',
+    'invalid-event-hook-list',
+    'invalid-config-json',
+    'unsafe-config-directory',
+    'unsafe-config-file',
+    'config-file-too-large'
+    ,'claude-version-unsupported'
+  ]);
+  if (knownReasons.has(error?.message)) return error.message;
+  if (error?.code === 'EACCES' || error?.code === 'EPERM') return 'permission-denied';
+  if (error?.code === 'ENOSPC') return 'insufficient-storage';
+  return 'config-write-failed';
+}
+
+function installHooksForDetectedClients({ clients = [], selectedClientIds, homeDir, broker, nativeBroker = false, fileSystem = fs, versionProbe } = {}) {
+  const byId = new Map(catalog.map((entry) => [entry.id, entry]));
+  const selected = Array.isArray(selectedClientIds) ? new Set(selectedClientIds) : null;
+  const detectedById = new Map();
+  clients.filter((client) => {
+    const entry = byId.get(client?.id);
+    return entry
+      && entry.localDetection
+      && entry.displayInOnboarding
+      && entry.nativeMcpClient
+      && (!selected || selected.has(entry.id))
+      && HOOK_SETUP_TARGETS[entry.id] === entry.hookAdapter;
+  }).forEach((client) => {
+    if (!detectedById.has(client.id)) detectedById.set(client.id, client);
+  });
+  const detectedClients = [...detectedById.values()];
+  const codexClients = detectedClients.filter((client) => byId.get(client.id).hookAdapter === 'codex-mcp-tool');
+  const claudeClients = detectedClients.filter((client) => byId.get(client.id).hookAdapter === 'claude-mcp-tool');
+
+  let codexInstallResult = null;
+  if (codexClients.length > 0) {
+    try {
+      codexInstallResult = installCodexHooks(homeDir, fileSystem, { broker });
+    } catch (error) {
+      codexInstallResult = {
+        status: 'error',
+        reason: safeInstallErrorReason(error)
+      };
+    }
+  }
+
+  let claudeInstallResult = null;
+  if (claudeClients.length > 0) {
+    try {
+      claudeInstallResult = installClaudeCodeHooks(homeDir, fileSystem, { broker, nativeBroker, versionProbe });
+    } catch (error) {
+      claudeInstallResult = {
+        status: 'error',
+        reason: safeInstallErrorReason(error)
+      };
+    }
+  }
+
+  const results = detectedClients.map((client) => {
+    const entry = byId.get(client.id);
+    if (entry.hookAdapter === 'codex-mcp-tool') {
+      return safeClientResult(client, codexInstallResult.status, codexInstallResult.reason || null);
+    }
+    if (entry.hookAdapter === 'claude-mcp-tool') {
+      return safeClientResult(client, claudeInstallResult.status, claudeInstallResult.reason || null);
+    }
+    return null;
+  });
+  const targetResults = results.filter(Boolean);
+
+  return {
+    serverName: SLAUNT_SERVER_NAME,
+    results: targetResults,
+    summary: {
+      detected: targetResults.length,
+      installed: targetResults.filter((result) => result.status === 'installed').length,
+      unchanged: targetResults.filter((result) => result.status === 'unchanged').length,
+      partial: targetResults.filter((result) => result.status === 'partial').length,
+      unsupported: 0,
+      failed: targetResults.filter((result) => result.status === 'error').length
+    }
+  };
+}
+
+module.exports = {
+  SLAUNT_SERVER_NAME,
+  CLIENT_HOOK_TARGETS,
+  createSlauntHooks,
+  createClaudeCodeHooks,
+  claudeSupportsBlocking,
+  mergeSlauntHooks,
+  installCodexHooks,
+  installClaudeCodeHooks,
+  installHooksForDetectedClients
+};

package/src/setup/managed-policy.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const path = require('node:path');
+const { stringify } = require('smol-toml');
+
+function createCodexManagedPolicy() {
+  return stringify({features:{hooks:true},hooks:{PreToolUse:[{matcher:'.*',hooks:[{type:'mcp_tool',server:'slaunt',tool:'tool_authorize_codex',input:{event_name:'PreToolUse',session_id:'${session_id}',turn_id:'${turn_id}',tool_name:'${tool_name}',tool_use_id:'${tool_use_id}'},timeout:10,statusMessage:'Requesting Slaunt tool authorization'}]}]}});
+}
+
+// Generate policy only; the administrator must deploy the guard executable in
+// a root-owned directory and install the output through their management system.
+// A managed hook cannot make Codex itself fail closed when the hook fails.
+function createManagedPolicies({ guardPath, managedDir }) {
+  if (typeof guardPath !== 'string' || typeof managedDir !== 'string' ||
+      !path.posix.isAbsolute(guardPath) || !path.posix.isAbsolute(managedDir) ||
+      /[\x00-\x1f\x7f]/.test(guardPath + managedDir) ||
+      path.posix.normalize(guardPath) !== guardPath || path.posix.normalize(managedDir) !== managedDir ||
+      !guardPath.startsWith(managedDir.replace(/\/$/, '') + '/')) throw new Error('invalid-managed-guard-path');
+  const quote = value => `'${value.replace(/'/g, `'\\''`)}'`;
+  const command = quote(guardPath);
+  return {
+    codex: createCodexManagedPolicy(),
+    claude: {hooks:{PreToolUse:[{hooks:[{type:'command',command,onFailure:'block',timeout:20,statusMessage:'Requesting Slaunt tool authorization'}]}]}}
+  };
+}
+module.exports = { createManagedPolicies, createCodexManagedPolicy };