synorch 0.2.0 → 0.4.0-beta.0

package/dist/harness/policy/command-classifier.js

@@ -0,0 +1,459 @@
+import { FORBIDDEN_CREDENTIAL_SOURCES } from "../contracts/index.js";
+import { DEPENDENCY_MUTATION_CODE, dependencyMutation, DESTRUCTIVE_COMMAND_RULES, DOWNLOAD_PROGRAMS, DOWNLOAD_REFERENCE, EXTERNAL_WRITE_RULES, gitInvocation, INTERPRETER_PROGRAMS, ruleApplies, } from "./command-rules.js";
+import { carriesSecret } from "./secret-patterns.js";
+import { inlineScriptOf, parseShellScript, programName, shellDialect } from "./shell-parser.js";
+const MAX_SHELL_DEPTH = 4;
+const MAX_WRAPPER_LAYERS = 8;
+const EGRESS_PROGRAMS = new Set([
+    "curl",
+    "wget",
+    "iwr",
+    "irm",
+    "invoke-webrequest",
+    "invoke-restmethod",
+    "start-bitstransfer",
+    "nc",
+    "ncat",
+    "netcat",
+    "socat",
+    "telnet",
+    "scp",
+    "sftp",
+    "ftp",
+    "rsync",
+    "ssh",
+]);
+const FILE_READERS = new Set(["cat", "type", "get-content", "gc", "less", "more", "head", "tail", "base64", "xxd", "od", "strings"]);
+const FOREIGN_CREDENTIAL_MARKERS = FORBIDDEN_CREDENTIAL_SOURCES.map((source) => source.replace(/^~\//, "").replace(/^keychain:/, "").toLowerCase());
+const MUTATING_PROGRAMS = new Set([
+    "rm",
+    "mv",
+    "cp",
+    "touch",
+    "mkdir",
+    "rmdir",
+    "tee",
+    "dd",
+    "ln",
+    "chmod",
+    "chown",
+    "chgrp",
+    "truncate",
+    "install",
+    "patch",
+    "unlink",
+    "shred",
+    "rimraf",
+    "new-item",
+    "ni",
+    "md",
+    "set-content",
+    "sc",
+    "add-content",
+    "ac",
+    "out-file",
+    "copy-item",
+    "cpi",
+    "copy",
+    "move-item",
+    "mi",
+    "move",
+    "rename-item",
+    "ren",
+    "rni",
+    "remove-item",
+    "ri",
+    "del",
+    "erase",
+    "rd",
+    "clear-content",
+    "clc",
+    "set-item",
+    "mklink",
+    "xcopy",
+    "robocopy",
+    "icacls",
+    "takeown",
+    "attrib",
+    "tar",
+    "unzip",
+    "expand-archive",
+    "compress-archive",
+]);
+const GIT_MUTATING = new Set([
+    "add",
+    "commit",
+    "checkout",
+    "switch",
+    "restore",
+    "reset",
+    "clean",
+    "apply",
+    "am",
+    "merge",
+    "rebase",
+    "cherry-pick",
+    "revert",
+    "stash",
+    "push",
+    "pull",
+    "fetch",
+    "tag",
+    "rm",
+    "mv",
+    "init",
+    "clone",
+    "config",
+    "worktree",
+    "submodule",
+    "gc",
+    "update-ref",
+    "notes",
+    "filter-branch",
+    "filter-repo",
+    "reflog",
+]);
+const PACKAGE_MUTATING = new Set([
+    "install",
+    "i",
+    "add",
+    "remove",
+    "rm",
+    "uninstall",
+    "update",
+    "up",
+    "upgrade",
+    "ci",
+    "link",
+    "unlink",
+    "publish",
+    "init",
+    "create",
+    "dlx",
+    "exec",
+    "x",
+    "rebuild",
+    "prune",
+    "dedupe",
+    "patch",
+    "pack",
+    "import",
+]);
+const INLINE_CODE_FLAGS = {
+    node: ["-e", "--eval", "-p", "--print"],
+    bun: ["-e", "--eval", "eval"],
+    deno: ["eval"],
+    python: ["-c"],
+    python3: ["-c"],
+    py: ["-c"],
+    perl: ["-e", "-E", "-i"],
+    ruby: ["-e"],
+    php: ["-r"],
+    sed: ["-i", "--in-place"],
+};
+/**
+ * Classifies one argv, looking through shell wrappers (`bash -c`, `cmd /c`, `powershell
+ * -Command`, `-EncodedCommand`), prefix wrappers (`env`, `xargs`, `timeout`, `npx`, `wsl`) and
+ * every command of every pipeline inside an inline script. The classification never grants:
+ * callers treat any finding as a hard-rail denial.
+ */
+export function classifyCommand(argv, scope) {
+    const analysis = { findings: [], external: [], mutating: false };
+    analyzeArgv(argv, scope, 0, analysis);
+    const destructive = analysis.findings.some((finding) => finding.rail === "destructive-command");
+    return {
+        destructive,
+        effect: analysis.external.length > 0 ? "external-write" : "exec",
+        mutating: analysis.mutating || destructive,
+        findings: dedupe(analysis.findings),
+        external: dedupe(analysis.external),
+    };
+}
+function analyzeArgv(argv, scope, depth, analysis) {
+    let current = argv;
+    for (let layer = 0; layer < MAX_WRAPPER_LAYERS && current.length > 0; layer += 1) {
+        const program = programName(current[0] ?? "");
+        const args = current.slice(1);
+        applyRules(program, args, scope, analysis);
+        inspectCredentials(program, current, analysis);
+        if (scope.dependencyLinks === true) {
+            const mutation = dependencyMutation(program, args);
+            if (mutation !== undefined)
+                analysis.findings.push({ rail: "write-outside-scope", code: DEPENDENCY_MUTATION_CODE, message: mutation });
+        }
+        const script = inlineScriptOf(program, args);
+        if (script !== undefined) {
+            analysis.mutating = true;
+            if (script.kind === "script")
+                analyzeScript(script.text, shellDialect(program), scope, depth + 1, analysis);
+            else if (script.kind === "opaque") {
+                analysis.findings.push({ rail: "destructive-command", code: "opaque-script", message: `${program} runs a script that cannot be read: ${script.reason}` });
+            }
+            return;
+        }
+        if (isMutatingLeaf(program, args))
+            analysis.mutating = true;
+        for (const embedded of embeddedScripts(program, args))
+            analyzeScript(embedded, "posix", scope, depth + 1, analysis);
+        for (const nested of embeddedCommands(program, args))
+            analyzeArgv(nested, scope, depth + 1, analysis);
+        const inner = unwrapPrefix(program, args);
+        if (inner === undefined)
+            return;
+        current = inner;
+    }
+    if (current.length > 0) {
+        analysis.findings.push({ rail: "destructive-command", code: "wrapper-depth", message: "too many nested command wrappers to classify" });
+    }
+}
+function analyzeScript(script, dialect, scope, depth, analysis) {
+    if (depth > MAX_SHELL_DEPTH) {
+        analysis.findings.push({ rail: "destructive-command", code: "nested-shell", message: "shell nesting is too deep to classify" });
+        return;
+    }
+    const parsed = parseShellScript(script, dialect);
+    if (parsed.redirection)
+        analysis.mutating = true;
+    const programs = [];
+    for (const pipeline of parsed.pipelines) {
+        const names = pipeline.map((command) => programName(command[0] ?? ""));
+        programs.push(...names);
+        for (const command of pipeline)
+            analyzeArgv(command, scope, depth, analysis);
+        if (names.some((name, index) => DOWNLOAD_PROGRAMS.has(name) && names.slice(index + 1).some((next) => INTERPRETER_PROGRAMS.has(next)))) {
+            analysis.findings.push(remoteScript());
+        }
+        const leaksInto = pipeline.findIndex((command) => isSecretSource(command));
+        if (leaksInto !== -1 && names.slice(leaksInto + 1).some((name) => EGRESS_PROGRAMS.has(name))) {
+            analysis.findings.push({ rail: "secret-egress", code: "secret-pipe", message: "a secret source is piped into a network command" });
+        }
+    }
+    const downloads = programs.some((name) => DOWNLOAD_PROGRAMS.has(name));
+    if (parsed.substitution && downloads && programs.some((name) => INTERPRETER_PROGRAMS.has(name)))
+        analysis.findings.push(remoteScript());
+    if (programs.some((name) => name === "iex" || name === "invoke-expression") && DOWNLOAD_REFERENCE.test(script)) {
+        analysis.findings.push(remoteScript());
+    }
+}
+const GIT_COMMAND_KEYS = /^(?:core\.(?:sshcommand|pager|editor|fsmonitor|askpass)|sequence\.editor|diff\.external|diff\.[^.]+\.command|merge\.[^.]+\.driver|filter\.[^.]+\.(?:clean|smudge|process)|gpg\.program|pager\.[^.]+)$/i;
+/** Shell text a program runs on our behalf: `git -c alias.x='!cmd'`, `git -c core.sshCommand=cmd`. */
+function embeddedScripts(program, args) {
+    if (program !== "git")
+        return [];
+    const scripts = [];
+    for (const [index, argument] of args.entries()) {
+        const setting = argument === "-c" ? args[index + 1] : undefined;
+        if (setting === undefined)
+            continue;
+        const separator = setting.indexOf("=");
+        const key = separator === -1 ? setting : setting.slice(0, separator);
+        const value = separator === -1 ? "" : setting.slice(separator + 1);
+        if (/^alias\./i.test(key) && value.startsWith("!"))
+            scripts.push(value.slice(1));
+        else if (GIT_COMMAND_KEYS.test(key))
+            scripts.push(value);
+    }
+    return scripts;
+}
+/**
+ * Commands a program runs from its own arguments: `find ... -exec cmd {} ;`. The `{}` placeholder
+ * stands for paths under the search roots, so it is replaced by the root it came from; without a
+ * root it stays unresolved and any scope check on it fails closed.
+ */
+function embeddedCommands(program, args) {
+    if (program !== "find")
+        return [];
+    const expressionStart = args.findIndex((value) => value.startsWith("-") || value === "(" || value === "!");
+    const roots = expressionStart === -1 ? args : args.slice(0, expressionStart);
+    const placeholder = roots.length === 1 ? `${roots[0]}/_` : "{}";
+    const commands = [];
+    for (let index = 0; index < args.length; index += 1) {
+        if (!["-exec", "-execdir", "-ok", "-okdir"].includes((args[index] ?? "").toLowerCase()))
+            continue;
+        const command = [];
+        for (index += 1; index < args.length && args[index] !== ";" && args[index] !== "+" && args[index] !== "\\;"; index += 1) {
+            command.push(args[index] === "{}" ? placeholder : (args[index] ?? ""));
+        }
+        if (command.length > 0)
+            commands.push(command);
+    }
+    return commands;
+}
+function remoteScript() {
+    return { rail: "destructive-command", code: "remote-script-exec", message: "downloading and executing a remote script bypasses every review" };
+}
+function applyRules(program, args, scope, analysis) {
+    for (const rule of DESTRUCTIVE_COMMAND_RULES) {
+        if (ruleApplies(rule, program) && rule.matches(args, scope)) {
+            analysis.findings.push({ rail: "destructive-command", code: rule.code, message: rule.message });
+        }
+    }
+    for (const rule of EXTERNAL_WRITE_RULES) {
+        if (ruleApplies(rule, program) && rule.matches(args, scope))
+            analysis.external.push({ code: rule.code, message: rule.message });
+    }
+    if (EGRESS_PROGRAMS.has(program) && args.some(carriesSecret)) {
+        analysis.findings.push({ rail: "secret-egress", code: "secret-egress", message: `${program} would send a secret or secret file off the machine` });
+    }
+    const invocation = program === "git" ? gitInvocation(args) : undefined;
+    if (invocation !== undefined && ["push", "clone", "fetch", "pull", "remote"].includes(invocation.sub) && invocation.rest.some(carriesSecret)) {
+        analysis.findings.push({ rail: "secret-egress", code: "secret-egress", message: "git would send embedded credentials to a remote" });
+    }
+    if (program === "git" && args.some((argument) => argument.toLowerCase().includes("core.hookspath"))) {
+        analysis.findings.push({ rail: "reserved-path-write", code: "git-hooks-path", message: "core.hooksPath points git at hooks outside the reserved .git directory" });
+    }
+    else if (invocation?.sub === "config" && isGitConfigWrite(invocation.rest)) {
+        analysis.findings.push({ rail: "reserved-path-write", code: "git-config-write", message: "git config writes .git/config (or a global config), which is reserved" });
+    }
+}
+const GIT_CONFIG_READ_FLAGS = new Set(["--get", "--get-all", "--get-regexp", "--get-urlmatch", "--get-color", "--get-colorbool", "-l", "--list"]);
+const GIT_CONFIG_WRITE_FLAGS = new Set(["--add", "--unset", "--unset-all", "--replace-all", "--rename-section", "--remove-section", "-e", "--edit"]);
+const GIT_CONFIG_VALUE_FLAGS = new Set(["-f", "--file", "--blob", "--type", "--default", "--comment", "--value"]);
+/** Default-deny: a `git config` form counts as a write unless it is positively a read (`--get*`, `--list`, `get`, one key). */
+function isGitConfigWrite(rest) {
+    const positional = [];
+    let read = false;
+    for (let index = 0; index < rest.length; index += 1) {
+        const argument = (rest[index] ?? "").toLowerCase();
+        if (GIT_CONFIG_WRITE_FLAGS.has(argument))
+            return true;
+        if (GIT_CONFIG_READ_FLAGS.has(argument))
+            read = true;
+        else if (GIT_CONFIG_VALUE_FLAGS.has(argument))
+            index += 1;
+        else if (!argument.startsWith("-"))
+            positional.push(argument);
+    }
+    const verb = positional[0];
+    if (verb === "get" || verb === "list")
+        return false;
+    if (verb === "set" || verb === "unset" || verb === "edit" || verb === "rename-section" || verb === "remove-section")
+        return true;
+    return !(read || positional.length === 1);
+}
+function inspectCredentials(program, argv, analysis) {
+    const joined = argv.join(" ").replaceAll("\\", "/").toLowerCase();
+    const args = argv.slice(1).map((argument) => argument.toLowerCase());
+    if (FOREIGN_CREDENTIAL_MARKERS.some((marker) => joined.includes(marker))) {
+        analysis.findings.push({ rail: "foreign-credential-store", code: "foreign-credential-store", message: "another application's credential store is off limits" });
+        return;
+    }
+    const keychainRead = (program === "security" && args.some((argument) => ["find-generic-password", "find-internet-password", "dump-keychain", "export", "delete-generic-password"].includes(argument))) ||
+        (program === "secret-tool" && args.some((argument) => ["lookup", "search", "clear"].includes(argument))) ||
+        program === "cmdkey" ||
+        program === "vaultcmd" ||
+        program === "get-storedcredential" ||
+        (program === "rundll32" && joined.includes("keymgr.dll"));
+    if (keychainRead || joined.includes(".synorch/credentials")) {
+        analysis.findings.push({ rail: "credential-access", code: "credential-access", message: "credential stores are reachable only through the auth module" });
+    }
+    if (joined.includes(".synorch/config") || joined.includes(".synorch/policy") || ((program === "syn" || program === "synorch") && args[0] === "config")) {
+        analysis.findings.push({ rail: "policy-self-modification", code: "policy-self-modification", message: "policy sources cannot be changed by a tool" });
+    }
+}
+function isSecretSource(command) {
+    const program = programName(command[0] ?? "");
+    const args = command.slice(1);
+    if ((program === "env" || program === "printenv" || program === "set" || program === "export") && args.every((argument) => argument.startsWith("-")))
+        return true;
+    if (["get-childitem", "gci", "dir", "ls", "get-item", "gi"].includes(program) && args.some((argument) => argument.toLowerCase().startsWith("env:")))
+        return true;
+    return FILE_READERS.has(program) && args.some(carriesSecret);
+}
+function isMutatingLeaf(program, args) {
+    if (MUTATING_PROGRAMS.has(program))
+        return true;
+    if (program === "git") {
+        const invocation = gitInvocation(args);
+        if (invocation === undefined)
+            return false;
+        if (GIT_MUTATING.has(invocation.sub))
+            return true;
+        return invocation.sub === "branch" && invocation.rest.some((argument) => !argument.startsWith("-") || /^-[dDmMcC]$/.test(argument));
+    }
+    if (["npm", "pnpm", "yarn", "bun", "pip", "pip3", "cargo", "go", "gem", "composer"].includes(program)) {
+        const first = args.find((argument) => !argument.startsWith("-"))?.toLowerCase();
+        if (first !== undefined && PACKAGE_MUTATING.has(first))
+            return true;
+    }
+    const inline = INLINE_CODE_FLAGS[program];
+    if (inline === undefined)
+        return false;
+    return args.some((argument) => inline.some((flag) => argument === flag || argument.startsWith(`${flag}=`) || (program === "sed" && flag === "-i" && argument.startsWith("-i"))));
+}
+const SIMPLE_WRAPPERS = new Set(["nohup", "exec", "command", "builtin", "time", "call", "busybox", "doas", "sudo", "gsudo", "pkexec"]);
+const VALUE_FLAGS = {
+    env: ["-u", "--unset", "-C", "--chdir", "-S", "--split-string"],
+    nice: ["-n", "--adjustment"],
+    ionice: ["-c", "-n", "-p"],
+    timeout: ["-s", "--signal", "-k", "--kill-after"],
+    xargs: ["-I", "-i", "-n", "-P", "-d", "-a", "-L", "-s", "-E", "--max-args", "--max-procs", "--delimiter", "--arg-file"],
+    npx: ["-p", "--package", "-c", "--call"],
+    pnpx: ["-p", "--package"],
+    bunx: ["-p", "--package"],
+    wsl: ["-d", "--distribution", "-u", "--user", "--cd"],
+    stdbuf: ["-i", "-o", "-e"],
+    sudo: ["-u", "--user", "-g", "--group", "-C", "-D", "-h", "-p", "-r", "-t"],
+};
+/** The wrapped command of a prefix wrapper (`env X=1 rm ...` → `rm ...`), or undefined. */
+function unwrapPrefix(program, args) {
+    if (program === "env" && args.some((argument) => argument === "-S" || argument === "--split-string")) {
+        const index = args.findIndex((argument) => argument === "-S" || argument === "--split-string");
+        return ["sh", "-c", args.slice(index + 1).join(" ")];
+    }
+    if (["pnpm", "yarn", "npm"].includes(program)) {
+        const first = args[0]?.toLowerCase();
+        if (first === "dlx" || first === "exec" || first === "x")
+            return skipOptions(args.slice(1), []);
+        return undefined;
+    }
+    if (program === "start")
+        return skipStartOptions(args);
+    const valueFlags = VALUE_FLAGS[program];
+    if (!SIMPLE_WRAPPERS.has(program) && valueFlags === undefined)
+        return undefined;
+    let rest = skipOptions(args, valueFlags ?? []);
+    if (program === "timeout" && rest.length > 0)
+        rest = rest.slice(1);
+    if (program === "env")
+        rest = dropAssignments(rest);
+    if (program === "wsl" && (rest[0] === "-e" || rest[0] === "--exec"))
+        rest = rest.slice(1);
+    return rest.length > 0 ? rest : undefined;
+}
+function dropAssignments(args) {
+    let index = 0;
+    while (index < args.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(args[index] ?? ""))
+        index += 1;
+    return args.slice(index);
+}
+function skipOptions(args, valueFlags) {
+    let index = 0;
+    while (index < args.length) {
+        const argument = args[index] ?? "";
+        if (argument === "--")
+            return args.slice(index + 1);
+        if (!argument.startsWith("-") || argument === "-")
+            break;
+        index += valueFlags.includes(argument) ? 2 : 1;
+    }
+    return args.slice(index);
+}
+function skipStartOptions(args) {
+    let index = 0;
+    while (index < args.length && /^\/[a-z]+$/i.test(args[index] ?? ""))
+        index += 1;
+    const rest = args.slice(index);
+    return rest.length > 0 ? rest : undefined;
+}
+function dedupe(items) {
+    const seen = new Set();
+    return items.filter((item) => {
+        const key = `${"rail" in item ? String(item.rail) : ""}:${item.code}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+//# sourceMappingURL=command-classifier.js.map

package/dist/harness/policy/command-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-classifier.js","sourceRoot":"","sources":["../../../src/harness/policy/command-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAiB,MAAM,uBAAuB,CAAC;AACpF,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,WAAW,GAEZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAqB,MAAM,mBAAmB,CAAC;AA0BnH,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,IAAI;IACJ,MAAM;IACN,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,KAAK;CACN,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAErI,MAAM,0BAA0B,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7E,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CACnE,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,OAAO;IACP,OAAO;IACP,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,OAAO;IACP,OAAO;IACP,UAAU;IACV,SAAS;IACT,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,UAAU;IACV,IAAI;IACJ,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,aAAa;IACb,IAAI;IACJ,UAAU;IACV,WAAW;IACX,KAAK;IACL,MAAM;IACN,WAAW;IACX,IAAI;IACJ,MAAM;IACN,aAAa;IACb,KAAK;IACL,KAAK;IACL,aAAa;IACb,IAAI;IACJ,KAAK;IACL,OAAO;IACP,IAAI;IACJ,eAAe;IACf,KAAK;IACL,UAAU;IACV,QAAQ;IACR,OAAO;IACP,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,KAAK;IACL,OAAO;IACP,gBAAgB;IAChB,kBAAkB;CACnB,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,KAAK;IACL,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,OAAO;IACP,OAAO;IACP,OAAO;IACP,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,aAAa;IACb,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,WAAW;IACX,IAAI;IACJ,YAAY;IACZ,OAAO;IACP,eAAe;IACf,aAAa;IACb,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,SAAS;IACT,GAAG;IACH,KAAK;IACL,QAAQ;IACR,IAAI;IACJ,WAAW;IACX,QAAQ;IACR,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;IACN,QAAQ;IACR,KAAK;IACL,MAAM;IACN,GAAG;IACH,SAAS;IACT,OAAO;IACP,QAAQ;IACR,OAAO;IACP,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,iBAAiB,GAAgD;IACrE,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC;IACvC,GAAG,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,MAAM,EAAE,CAAC,IAAI,CAAC;IACd,OAAO,EAAE,CAAC,IAAI,CAAC;IACf,EAAE,EAAE,CAAC,IAAI,CAAC;IACV,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACxB,IAAI,EAAE,CAAC,IAAI,CAAC;IACZ,GAAG,EAAE,CAAC,IAAI,CAAC;IACX,GAAG,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC;CAC1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,KAAmB;IAC1E,MAAM,QAAQ,GAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC3E,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;IAChG,OAAO;QACL,WAAW;QACX,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM;QAChE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,WAAW;QAC1C,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAuB,EAAE,KAAmB,EAAE,KAAa,EAAE,QAAkB;IAClG,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACjF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC3C,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACnD,IAAI,QAAQ,KAAK,SAAS;gBAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzI,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC;YACzB,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;iBACvG,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,OAAO,uCAAuC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5J,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5D,KAAK,MAAM,QAAQ,IAAI,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpH,KAAK,MAAM,MAAM,IAAI,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACtG,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;IAC1I,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,OAAqB,EAAE,KAAmB,EAAE,KAAa,EAAE,QAAkB;IAClH,IAAI,KAAK,GAAG,eAAe,EAAE,CAAC;QAC5B,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;QAChI,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,WAAW;QAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC7E,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACtI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7F,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC;QACrI,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,YAAY,IAAI,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACxI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,mBAAmB,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/G,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,wMAAwM,CAAC;AAElO,sGAAsG;AACtG,SAAS,eAAe,CAAC,OAAe,EAAE,IAAuB;IAC/D,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACnE,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;aAC5E,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAe,EAAE,IAAuB;IAChE,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC;IAC3G,MAAM,KAAK,GAAG,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,MAAM,QAAQ,GAAe,EAAE,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAClG,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,KAAK,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACxH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAAC;AACjJ,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAuB,EAAE,KAAmB,EAAE,QAAkB;IACnG,KAAK,MAAM,IAAI,IAAI,yBAAyB,EAAE,CAAC;QAC7C,IAAI,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC5D,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,IAAI,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7D,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,OAAO,qDAAqD,EAAE,CAAC,CAAC;IACrJ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7I,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;QACpG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAC,CAAC;IACrK,CAAC;SAAM,IAAI,UAAU,EAAE,GAAG,KAAK,QAAQ,IAAI,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,uEAAuE,EAAE,CAAC,CAAC;IACtK,CAAC;AACH,CAAC;AAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AAClJ,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrJ,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AAElH,+HAA+H;AAC/H,SAAS,gBAAgB,CAAC,IAAuB;IAC/C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC;aAChD,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;aACrD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACjI,OAAO,CAAC,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,IAAuB,EAAE,QAAkB;IACtF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACrE,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACzE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAC;QAChK,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAChB,CAAC,OAAO,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,uBAAuB,EAAE,wBAAwB,EAAE,eAAe,EAAE,QAAQ,EAAE,yBAAyB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjL,CAAC,OAAO,KAAK,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxG,OAAO,KAAK,QAAQ;QACpB,OAAO,KAAK,UAAU;QACtB,OAAO,KAAK,sBAAsB;QAClC,CAAC,OAAO,KAAK,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5D,IAAI,YAAY,IAAI,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC5D,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC,CAAC;IAC5J,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACvJ,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;IACxJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,OAA0B;IAChD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClK,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjK,OAAO,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,IAAuB;IAC9D,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC3C,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtI,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtG,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAChF,IAAI,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CACjJ,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvI,MAAM,WAAW,GAAgD;IAC/D,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,CAAC;IAC/D,IAAI,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC;IAC5B,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IAC1B,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,CAAC;IACjD,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,CAAC;IACvH,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC;IACxC,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC;IACzB,GAAG,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;IACrD,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IAC1B,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;CAC5E,CAAC;AAEF,2FAA2F;AAC3F,SAAS,YAAY,CAAC,OAAe,EAAE,IAAuB;IAC5D,IAAI,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,gBAAgB,CAAC,EAAE,CAAC;QACrG,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,gBAAgB,CAAC,CAAC;QAC/F,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG;YAAE,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChF,IAAI,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK;QAAE,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,IAAuB;IAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,IAAuB,EAAE,UAA6B;IACzE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,GAAG;YAAE,MAAM;QACzD,KAAK,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB;IAC/C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,SAAS,MAAM,CAAsC,KAAmB;IACtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/harness/policy/command-rules.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The irreversible-command table (ADR-08 hard rail `destructive-command`). It is data: each rule
+ * names the programs it applies to, a predicate over the remaining arguments and the examples the
+ * test suite proves it catches. The list may grow; removing a rule or an example weakens a rail
+ * and needs an ADR. Programs are compared after `programName` (lower-case basename without
+ * `.exe`/`.cmd`/`.ps1`), so `rm`, `RM.EXE` and `C:\tools\rm.exe` are one program.
+ */
+export interface CommandScope {
+    /** Workspace-relative working directory of the command. */
+    readonly cwd: string;
+    readonly writeScope: readonly string[];
+    readonly forbidden: readonly string[];
+    /**
+     * The attempt workspace links dependency directories from the main tree (ADR-19). Commands that
+     * install, add, remove or update dependencies would write through the link into the main tree,
+     * outside the change set, so they are refused (`dependency-mutation-in-linked-worktree`).
+     */
+    readonly dependencyLinks?: boolean;
+}
+export declare const DEPENDENCY_MUTATION_CODE = "dependency-mutation-in-linked-worktree";
+/**
+ * Why `program args…` mutates dependencies (install/add/remove/update, `pip install`, `npm ci`,
+ * `pnpm install`, bare `yarn`, `cargo fetch`, `go mod download`, `python -m venv` …), or undefined.
+ * Only consulted while dependency directories are linked into the attempt workspace.
+ */
+export declare function dependencyMutation(program: string, args: readonly string[]): string | undefined;
+export interface CommandRule {
+    readonly code: string;
+    readonly message: string;
+    readonly programs: readonly string[];
+    readonly matches: (args: readonly string[], scope: CommandScope) => boolean;
+    readonly examples: readonly (readonly [string, ...string[]])[];
+}
+/** `git [global options] <subcommand> <rest>`, or undefined for a bare `git --version`. */
+export declare function gitInvocation(args: readonly string[]): {
+    readonly sub: string;
+    readonly rest: readonly string[];
+} | undefined;
+/** `-r`, `-R`, `-rf`, `--recursive`, PowerShell `-Recurse`/`-rec`, cmd `/s`. Never `-Force`. */
+export declare function isRecursiveFlag(argument: string): boolean;
+/** Operands of a delete-like command: everything that is not a flag or a flag's value. */
+export declare function deleteTargets(args: readonly string[]): string[];
+/**
+ * True only when every target is a plain relative path that stays inside the task's write scope.
+ * A missing target (piped input), a variable, `~`, an absolute or UNC path, `..`, `.` or a glob
+ * without a literal prefix all count as outside, so the command is destructive.
+ */
+export declare function targetsInScope(targets: readonly string[], scope: CommandScope): boolean;
+export declare const DOWNLOAD_REFERENCE: RegExp;
+export declare const DESTRUCTIVE_COMMAND_RULES: readonly CommandRule[];
+export declare const DOWNLOAD_PROGRAMS: Set<string>;
+export declare const INTERPRETER_PROGRAMS: Set<string>;
+/** Commands that write to a system outside the workspace; they are `external-write`, not `exec`. */
+export declare const EXTERNAL_WRITE_RULES: readonly CommandRule[];
+export declare function ruleApplies(rule: CommandRule, program: string): boolean;
+//# sourceMappingURL=command-rules.d.ts.map

package/dist/harness/policy/command-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-rules.d.ts","sourceRoot":"","sources":["../../../src/harness/policy/command-rules.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AAEH,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,eAAO,MAAM,wBAAwB,2CAA2C,CAAC;AAqDjF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAqB/F;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC;IAC5E,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;CAChE;AAOD,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CAW7H;AAgCD,gGAAgG;AAChG,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAOzD;AAKD,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAuB/D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAGvF;AAgDD,eAAO,MAAM,kBAAkB,QAA2H,CAAC;AAE3J,eAAO,MAAM,yBAAyB,EAAE,SAAS,WAAW,EAyP3D,CAAC;AAEF,eAAO,MAAM,iBAAiB,aAA0G,CAAC;AACzI,eAAO,MAAM,oBAAoB,aAkB/B,CAAC;AAIH,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,EAAE,SAAS,WAAW,EA8EtD,CAAC;AAEF,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvE"}