workerclaw 0.2.0

package/dist/sandbox/network-sandbox.js

@@ -0,0 +1,114 @@
+/**
+ * 网络访问沙箱
+ *
+ * URL 验证 + 域名白名单 + SSRF 防护
+ * 参考 OpenClaw 的安全增强设计
+ */
+import { createLogger } from '../core/logger.js';
+// ==================== 本地地址模式 ====================
+const LOCAL_HOSTNAMES = [
+    'localhost', '127.0.0.1', '0.0.0.0', '::1', '[::1]',
+    'metadata.google.internal', '169.254.169.254',
+];
+const LOCAL_RANGES = [
+    /^10\./,
+    /^172\.(1[6-9]|2\d|3[01])\./,
+    /^192\.168\./,
+    /^127\./,
+    /^0\./,
+    /^169\.254\./,
+];
+// ==================== 网络沙箱 ====================
+export class NetworkSandbox {
+    logger;
+    config;
+    constructor(config) {
+        this.config = config;
+        this.logger = createLogger('NetworkSandbox');
+    }
+    /**
+     * 验证 URL 是否允许访问
+     */
+    validateUrl(url, permissionLevel) {
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            return { allowed: false, reason: `无效的 URL: ${url.slice(0, 100)}` };
+        }
+        const { protocol, hostname } = parsed;
+        // 1. 阻止 file:// 协议（参考 OpenClaw Windows 安全增强）
+        if (protocol === 'file:') {
+            return { allowed: false, reason: 'file:// 协议已被阻止', protocol, hostname };
+        }
+        // 2. 阻止 data://, javascript: 等危险协议
+        if (['data:', 'javascript:', 'vbscript:', 'blob:'].includes(protocol)) {
+            return { allowed: false, reason: `${protocol} 协议已被阻止`, protocol, hostname };
+        }
+        // 3. 只允许 http/https/wss 协议
+        if (!['http:', 'https:', 'wss:'].includes(protocol)) {
+            return { allowed: false, reason: `不支持的协议: ${protocol}`, protocol, hostname };
+        }
+        // 4. 阻止 localhost 和内网地址
+        if (!this.config.allowLocalhost) {
+            if (this.isLocalAddress(hostname)) {
+                return { allowed: false, reason: `本地网络访问已被阻止: ${hostname}`, protocol, hostname };
+            }
+        }
+        // 5. 检查域名黑名单
+        for (const denied of this.config.deniedDomains) {
+            if (this.matchDomain(hostname, denied)) {
+                return { allowed: false, reason: `域名在黑名单中: ${hostname}（匹配 ${denied}）`, protocol, hostname };
+            }
+        }
+        // 6. 如果启用了未知域名阻止，检查白名单
+        if (this.config.blockUnknownDomains && this.config.allowedDomains.length > 0) {
+            const isAllowed = this.config.allowedDomains.some(allowed => this.matchDomain(hostname, allowed));
+            if (!isAllowed) {
+                return { allowed: false, reason: `域名不在白名单中: ${hostname}`, protocol, hostname };
+            }
+        }
+        return { allowed: true, protocol, hostname };
+    }
+    /**
+     * 检查是否是本地/内网地址
+     */
+    isLocalAddress(hostname) {
+        // 去掉 IPv6 括号
+        const cleanHost = hostname.replace(/^\[|\]$/g, '').toLowerCase();
+        // 精确匹配
+        if (LOCAL_HOSTNAMES.includes(cleanHost))
+            return true;
+        // 正则匹配
+        for (const range of LOCAL_RANGES) {
+            if (range.test(cleanHost))
+                return true;
+        }
+        return false;
+    }
+    /**
+     * 域名匹配（支持通配符 *）
+     */
+    matchDomain(hostname, pattern) {
+        const h = hostname.toLowerCase();
+        const p = pattern.toLowerCase();
+        if (p.startsWith('*.')) {
+            // *.example.com 匹配 sub.example.com 和 example.com
+            const suffix = p.slice(2);
+            return h === suffix || h.endsWith('.' + suffix);
+        }
+        return h === p;
+    }
+    /**
+     * 验证并返回安全的 URL（用于 fetch 包装）
+     */
+    safeFetchUrl(url, permissionLevel) {
+        const result = this.validateUrl(url, permissionLevel);
+        if (!result.allowed) {
+            throw new Error(`网络沙箱阻止访问: ${result.reason}`);
+        }
+        return url;
+    }
+}
+//# sourceMappingURL=network-sandbox.js.map

package/dist/sandbox/network-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-sandbox.js","sourceRoot":"","sources":["../../src/sandbox/network-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,mBAAmB,CAAC;AAqB9D,mDAAmD;AAEnD,MAAM,eAAe,GAAG;IACtB,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO;IACnD,0BAA0B,EAAE,iBAAiB;CAC9C,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,OAAO;IACP,4BAA4B;IAC5B,aAAa;IACb,QAAQ;IACR,MAAM;IACN,aAAa;CACd,CAAC;AAEF,iDAAiD;AAEjD,MAAM,OAAO,cAAc;IACjB,MAAM,CAAS;IACf,MAAM,CAAuB;IAErC,YAAY,MAA4B;QACtC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAW,EAAE,eAAiC;QACxD,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAEtC,6CAA6C;QAC7C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC1E,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC9E,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC/E,CAAC;QAED,wBAAwB;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;YACnF,CAAC;QACH,CAAC;QAED,aAAa;QACb,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;gBACvC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,QAAQ,OAAO,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;YAC9F,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC1D,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CACpC,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;YACjF,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,QAAgB;QAC7B,aAAa;QACb,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAEjE,OAAO;QACP,IAAI,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAErD,OAAO;QACP,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;QACzC,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,QAAgB,EAAE,OAAe;QACnD,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAEhC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,iDAAiD;YACjD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,GAAW,EAAE,eAAiC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/security/content-scanner.d.ts

@@ -0,0 +1,59 @@
+/**
+ * 内容安全扫描器
+ *
+ * Phase 2 Layer 3 安全检查：
+ * - 提示注入检测（模式匹配，LLM 二次检测为可选）
+ * - 恶意命令检测
+ * - PII 保护（邮箱、手机号、身份证、API Key）
+ */
+import type { PromptInjectionConfig, MaliciousCommandsConfig, PIIProtectionConfig } from '../core/config.js';
+export interface ContentFlag {
+    type: 'prompt_injection' | 'malicious_command' | 'pii_leak' | 'resource_exhaustion' | 'data_exfiltration';
+    severity: 'low' | 'medium' | 'high' | 'critical';
+    description: string;
+    match: string;
+}
+export interface ContentScanResult {
+    safe: boolean;
+    riskLevel: 'none' | 'low' | 'medium' | 'high' | 'critical';
+    flags: ContentFlag[];
+    sanitizedContent?: string;
+    rejectionReason?: string;
+}
+export interface ContentScannerConfig {
+    promptInjection: PromptInjectionConfig;
+    maliciousCommands: MaliciousCommandsConfig;
+    piiProtection: PIIProtectionConfig;
+}
+export declare class ContentScanner {
+    private logger;
+    private config;
+    private injectionPatterns;
+    private commandPatterns;
+    constructor(config: ContentScannerConfig);
+    /**
+     * 扫描内容安全性
+     */
+    scan(content: string): ContentScanResult;
+    /**
+     * 提示注入检测（模式匹配）
+     */
+    private scanPromptInjection;
+    /**
+     * 恶意命令检测
+     */
+    private scanMaliciousCommands;
+    /**
+     * PII 检测
+     */
+    private scanPII;
+    /**
+     * PII 脱敏
+     */
+    private maskPII;
+    /**
+     * 评估扫描结果
+     */
+    private assessResult;
+}
+//# sourceMappingURL=content-scanner.d.ts.map

package/dist/security/content-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-scanner.d.ts","sourceRoot":"","sources":["../../src/security/content-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAI3B,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,kBAAkB,GAAG,mBAAmB,GAAG,UAAU,GAAG,qBAAqB,GAAG,mBAAmB,CAAC;IAC1G,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AA4GD,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,qBAAqB,CAAC;IACvC,iBAAiB,EAAE,uBAAuB,CAAC;IAC3C,aAAa,EAAE,mBAAmB,CAAC;CACpC;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAuB;IAGrC,OAAO,CAAC,iBAAiB,CAAW;IACpC,OAAO,CAAC,eAAe,CAAW;gBAEtB,MAAM,EAAE,oBAAoB;IAexC;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB;IAyBxC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAsB3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAsB7B;;OAEG;IACH,OAAO,CAAC,OAAO;IA4Bf;;OAEG;IACH,OAAO,CAAC,OAAO;IAaf;;OAEG;IACH,OAAO,CAAC,YAAY;CAuErB"}

package/dist/security/content-scanner.js

@@ -0,0 +1,289 @@
+/**
+ * 内容安全扫描器
+ *
+ * Phase 2 Layer 3 安全检查：
+ * - 提示注入检测（模式匹配，LLM 二次检测为可选）
+ * - 恶意命令检测
+ * - PII 保护（邮箱、手机号、身份证、API Key）
+ */
+import { createLogger } from '../core/logger.js';
+// ==================== 提示注入模式 ====================
+const DEFAULT_INJECTION_PATTERNS = [
+    // 忽略系统指令
+    /ignore\s+(all\s+)?(previous|prior|above|system)\s+(instructions?|prompts?|rules?|directives?)/i,
+    / disregard\s+(all\s+)?(previous|prior|above|system)\s+(instructions?|prompts?)/i,
+    /forget\s+(all\s+)?(previous|prior|your)\s+(instructions?|prompts?|rules?)/i,
+    // 角色扮演/系统提示泄露
+    /you\s+are\s+now\s+(a|an|the)\s+/i,
+    /act\s+as\s+(if\s+you\s+(are|were)|a|an)\s+/i,
+    /pretend\s+(to\s+be|you\s+are)\s+/i,
+    /roleplay\s+as\s+/i,
+    /from\s+now\s+on.*?\s+(you\s+are|act)\s+/i,
+    // 系统提示提取
+    /repeat\s+(your|the|all)\s+(system\s+)?(instructions?|prompts?|rules?)/i,
+    /output\s+(your|the)\s+(system\s+)?prompt/i,
+    /show\s+(me\s+)?(your|the)\s+(system|hidden|secret)\s+(instructions?|prompt|message)/i,
+    /print\s+(your|the)\s+(system\s+)?instructions?/i,
+    /reveal\s+(your|the)\s+(system|original)\s+prompt/i,
+    /what\s+(are|is)\s+your\s+(system|initial|original)\s+(instructions?|prompt|rules?)/i,
+    /dump\s+(your|the)\s+(system\s+)?prompt/i,
+    /display\s+(your|the)\s+system\s+prompt/i,
+    // 注入新系统指令
+    /new\s+(system|override)\s+instruction/i,
+    /system\s*:\s*you\s+are/i,
+    /\[system\]/i,
+    /\[instructions?\]/i,
+    // 分隔符攻击
+    /-{3,}\s*system\s*-{3,}/i,
+    /<{3,}\s*system\s*>{3,}/i,
+    // 编码绕过
+    /base64\s*decode.*?system/i,
+    /ROT13.*?instruction/i,
+    // 输出格式操控
+    /respond\s+only\s+with\s+(the\s+)?(following|this)\s+(text|format|json|code)/i,
+    /output\s+(the\s+)?(following|this)\s+exactly/i,
+    /do\s+not\s+say\s+(anything\s+else|no|warning)/i,
+];
+// ==================== 恶意命令模式 ====================
+const DEFAULT_BLOCKED_COMMAND_PATTERNS = [
+    // 参考 OpenClaw 2026.3.22 安全增强
+    /MAVEN_OPTS/i,
+    /JAVA_TOOL_OPTIONS/i,
+    /GLIBC_TUNABLES/i,
+    /DOTNET_ADDITIONAL_DEPS/i,
+    /DOTNET_STARTUP_HOOKS/i,
+    // 通用危险命令
+    /rm\s+-rf\s+\/(?!\.\/)/, // rm -rf / (排除 rm -rf ./xxx)
+    /curl.*\|.*sh/i, // curl | sh
+    /wget.*\|.*sh/i, // wget | sh
+    /curl.*\|.*bash/i,
+    /wget.*\|.*bash/i,
+    /mkfs/i, // 格式化
+    /dd\s+if=/i, // dd 磁盘操作
+    />\s*\/dev\//i, // 直接写设备
+    /chmod\s+777\s+\//i, // 全局 777
+    /chown\s+.*\s+\//i, // 全局 chown
+    /mkfifo/i,
+    /nc\s+-[el]/i, // netcat 监听
+    /socat/i,
+    /python.*-c.*import\s+socket/i, // Python 反弹 shell
+    /bash\s+-i\s+>&/i, // bash 反弹 shell
+    /sh\s+-i\s+>&/i,
+    /nohup.*&/i,
+    /eval\s*\(/i,
+    /exec\s*\(/i,
+    /child_process/i,
+    /require\s*\(\s*['"]child_process/i,
+];
+// ==================== PII 检测模式 ====================
+const PII_PATTERNS = {
+    email: {
+        regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
+        label: '邮箱地址',
+    },
+    phone: {
+        regex: /1[3-9]\d{9}/g,
+        label: '手机号',
+    },
+    id_card: {
+        regex: /\b\d{17}[\dXx]\b/g,
+        label: '身份证号',
+    },
+    api_key: {
+        regex: /\b(sk|pk|api[_-]?key|secret[_-]?key|access[_-]?token|bearer)\s*[:=]\s*['"]?[\w-]{20,}['"]?\b/gi,
+        label: 'API 密钥',
+    },
+    password: {
+        regex: /\b(password|passwd|pwd)\s*[:=]\s*['"][^'"]{4,}['"]/gi,
+        label: '密码',
+    },
+};
+export class ContentScanner {
+    logger;
+    config;
+    // 编译后的正则缓存
+    injectionPatterns;
+    commandPatterns;
+    constructor(config) {
+        this.config = config;
+        this.logger = createLogger('ContentScanner');
+        // 编译提示注入模式
+        this.injectionPatterns = config.promptInjection.patterns
+            ? config.promptInjection.patterns.map(p => new RegExp(p, 'i'))
+            : DEFAULT_INJECTION_PATTERNS;
+        // 编译恶意命令模式
+        this.commandPatterns = config.maliciousCommands.blockPatterns
+            ? config.maliciousCommands.blockPatterns.map(p => new RegExp(p, 'i'))
+            : DEFAULT_BLOCKED_COMMAND_PATTERNS;
+    }
+    /**
+     * 扫描内容安全性
+     */
+    scan(content) {
+        const flags = [];
+        // 1. 提示注入检测
+        if (this.config.promptInjection.enabled) {
+            const injectionFlags = this.scanPromptInjection(content);
+            flags.push(...injectionFlags);
+        }
+        // 2. 恶意命令检测
+        if (this.config.maliciousCommands.enabled) {
+            const commandFlags = this.scanMaliciousCommands(content);
+            flags.push(...commandFlags);
+        }
+        // 3. PII 保护
+        if (this.config.piiProtection?.enabled) {
+            const piiFlags = this.scanPII(content);
+            flags.push(...piiFlags);
+        }
+        // 评估整体风险
+        return this.assessResult(content, flags);
+    }
+    /**
+     * 提示注入检测（模式匹配）
+     */
+    scanPromptInjection(content) {
+        const flags = [];
+        for (const pattern of this.injectionPatterns) {
+            const match = content.match(pattern);
+            if (match) {
+                flags.push({
+                    type: 'prompt_injection',
+                    severity: 'high',
+                    description: '检测到疑似提示注入',
+                    match: match[0].slice(0, 100),
+                });
+            }
+        }
+        if (flags.length > 0) {
+            this.logger.warn(`检测到 ${flags.length} 个提示注入模式`);
+        }
+        return flags;
+    }
+    /**
+     * 恶意命令检测
+     */
+    scanMaliciousCommands(content) {
+        const flags = [];
+        for (const pattern of this.commandPatterns) {
+            const match = content.match(pattern);
+            if (match) {
+                flags.push({
+                    type: 'malicious_command',
+                    severity: 'critical',
+                    description: '检测到恶意命令模式',
+                    match: match[0].slice(0, 100),
+                });
+            }
+        }
+        if (flags.length > 0) {
+            this.logger.warn(`检测到 ${flags.length} 个恶意命令`);
+        }
+        return flags;
+    }
+    /**
+     * PII 检测
+     */
+    scanPII(content) {
+        const flags = [];
+        const detectTypes = this.config.piiProtection?.detectTypes || ['api_key', 'password'];
+        for (const type of detectTypes) {
+            const piiDef = PII_PATTERNS[type];
+            if (!piiDef)
+                continue;
+            const matches = content.match(piiDef.regex);
+            if (matches) {
+                for (const m of matches) {
+                    flags.push({
+                        type: 'pii_leak',
+                        severity: 'medium',
+                        description: `检测到${piiDef.label}`,
+                        match: this.maskPII(m, type),
+                    });
+                }
+            }
+        }
+        if (flags.length > 0) {
+            this.logger.warn(`检测到 ${flags.length} 个 PII 信息泄露`);
+        }
+        return flags;
+    }
+    /**
+     * PII 脱敏
+     */
+    maskPII(value, type) {
+        switch (type) {
+            case 'email':
+                return value.replace(/(.{2})(.*)(@.*)/, '$1***$3');
+            case 'phone':
+                return value.replace(/(\d{3})\d{4}(\d{4})/, '$1****$2');
+            case 'id_card':
+                return value.replace(/(\d{4})\d{10}(\d{4})/, '$1**********$2');
+            default:
+                return value.slice(0, 4) + '***';
+        }
+    }
+    /**
+     * 评估扫描结果
+     */
+    assessResult(content, flags) {
+        if (flags.length === 0) {
+            return { safe: true, riskLevel: 'none', flags: [] };
+        }
+        // 确定最高风险级别
+        const severityOrder = ['low', 'medium', 'high', 'critical'];
+        const highestSeverity = flags.reduce((max, f) => {
+            const idx = severityOrder.indexOf(f.severity);
+            const maxIdx = severityOrder.indexOf(max);
+            return idx > maxIdx ? f.severity : max;
+        }, 'low');
+        const riskLevel = highestSeverity === 'critical' ? 'critical'
+            : highestSeverity === 'high' ? 'high'
+                : highestSeverity === 'medium' ? 'medium'
+                    : 'low';
+        // critical 或 high 且包含 prompt_injection/malicious_command → 拒绝
+        const hasCriticalFlag = flags.some(f => (f.type === 'prompt_injection' && f.severity === 'high') ||
+            f.type === 'malicious_command');
+        if (hasCriticalFlag) {
+            const rejectionReason = flags
+                .filter(f => f.type === 'prompt_injection' || f.type === 'malicious_command')
+                .map(f => f.description)
+                .join('; ');
+            return {
+                safe: false,
+                riskLevel: 'high',
+                flags,
+                rejectionReason: `内容安全扫描未通过: ${rejectionReason}`,
+            };
+        }
+        // PII 泄露根据 action 决定
+        const piiFlags = flags.filter(f => f.type === 'pii_leak');
+        if (piiFlags.length > 0) {
+            const action = this.config.piiProtection?.action || 'warn';
+            if (action === 'block') {
+                return {
+                    safe: false,
+                    riskLevel: 'medium',
+                    flags,
+                    rejectionReason: `内容包含敏感信息（${piiFlags.length} 处 PII），已被阻止`,
+                };
+            }
+            if (action === 'mask') {
+                return {
+                    safe: true,
+                    riskLevel: 'low',
+                    flags,
+                };
+            }
+            // warn 模式：允许通过但标记
+            this.logger.warn(`内容包含 ${piiFlags.length} 处 PII 信息（warn 模式，已放行）`);
+        }
+        // low 风险 → 放行并记录
+        return {
+            safe: true,
+            riskLevel,
+            flags,
+        };
+    }
+}
+//# sourceMappingURL=content-scanner.js.map

package/dist/security/content-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-scanner.js","sourceRoot":"","sources":["../../src/security/content-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,mBAAmB,CAAC;AAwB9D,mDAAmD;AAEnD,MAAM,0BAA0B,GAAa;IAC3C,SAAS;IACT,gGAAgG;IAChG,iFAAiF;IACjF,4EAA4E;IAE5E,cAAc;IACd,kCAAkC;IAClC,6CAA6C;IAC7C,mCAAmC;IACnC,mBAAmB;IACnB,0CAA0C;IAE1C,SAAS;IACT,wEAAwE;IACxE,2CAA2C;IAC3C,sFAAsF;IACtF,iDAAiD;IACjD,mDAAmD;IACnD,qFAAqF;IACrF,yCAAyC;IACzC,yCAAyC;IAEzC,UAAU;IACV,wCAAwC;IACxC,yBAAyB;IACzB,aAAa;IACb,oBAAoB;IAEpB,QAAQ;IACR,yBAAyB;IACzB,yBAAyB;IAEzB,OAAO;IACP,2BAA2B;IAC3B,sBAAsB;IAEtB,SAAS;IACT,8EAA8E;IAC9E,+CAA+C;IAC/C,gDAAgD;CACjD,CAAC;AAEF,mDAAmD;AAEnD,MAAM,gCAAgC,GAAa;IACjD,6BAA6B;IAC7B,aAAa;IACb,oBAAoB;IACpB,iBAAiB;IACjB,yBAAyB;IACzB,uBAAuB;IAEvB,SAAS;IACT,uBAAuB,EAAQ,6BAA6B;IAC5D,eAAe,EAAgB,YAAY;IAC3C,eAAe,EAAgB,YAAY;IAC3C,iBAAiB;IACjB,iBAAiB;IACjB,OAAO,EAAyB,MAAM;IACtC,WAAW,EAAqB,UAAU;IAC1C,cAAc,EAAmB,QAAQ;IACzC,mBAAmB,EAAa,SAAS;IACzC,kBAAkB,EAAc,WAAW;IAC3C,SAAS;IACT,aAAa,EAAmB,YAAY;IAC5C,QAAQ;IACR,8BAA8B,EAAE,kBAAkB;IAClD,iBAAiB,EAAe,gBAAgB;IAChD,eAAe;IACf,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,gBAAgB;IAChB,mCAAmC;CACpC,CAAC;AAEF,qDAAqD;AAErD,MAAM,YAAY,GAAqD;IACrE,KAAK,EAAE;QACL,KAAK,EAAE,iDAAiD;QACxD,KAAK,EAAE,MAAM;KACd;IACD,KAAK,EAAE;QACL,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,KAAK;KACb;IACD,OAAO,EAAE;QACP,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,MAAM;KACd;IACD,OAAO,EAAE;QACP,KAAK,EAAE,gGAAgG;QACvG,KAAK,EAAE,QAAQ;KAChB;IACD,QAAQ,EAAE;QACR,KAAK,EAAE,sDAAsD;QAC7D,KAAK,EAAE,IAAI;KACZ;CACF,CAAC;AAUF,MAAM,OAAO,cAAc;IACjB,MAAM,CAAS;IACf,MAAM,CAAuB;IAErC,WAAW;IACH,iBAAiB,CAAW;IAC5B,eAAe,CAAW;IAElC,YAAY,MAA4B;QACtC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAE7C,WAAW;QACX,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,eAAe,CAAC,QAAQ;YACtD,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC,CAAC,0BAA0B,CAAC;QAE/B,WAAW;QACX,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC,aAAa;YAC3D,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACrE,CAAC,CAAC,gCAAgC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,OAAe;QAClB,MAAM,KAAK,GAAkB,EAAE,CAAC;QAEhC,YAAY;QACZ,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;QAChC,CAAC;QAED,YAAY;QACZ,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC9B,CAAC;QAED,YAAY;QACZ,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAED,SAAS;QACT,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,OAAe;QACzC,MAAM,KAAK,GAAkB,EAAE,CAAC;QAEhC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,kBAAkB;oBACxB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,WAAW;oBACxB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,UAAU,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,OAAe;QAC3C,MAAM,KAAK,GAAkB,EAAE,CAAC;QAEhC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,UAAU;oBACpB,WAAW,EAAE,WAAW;oBACxB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,OAAe;QAC7B,MAAM,KAAK,GAAkB,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAEtF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM;gBAAE,SAAS;YAEtB,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,QAAQ;wBAClB,WAAW,EAAE,MAAM,MAAM,CAAC,KAAK,EAAE;wBACjC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC;qBAC7B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,KAAa,EAAE,IAAY;QACzC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,OAAO;gBACV,OAAO,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;YACrD,KAAK,OAAO;gBACV,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC;YAC1D,KAAK,SAAS;gBACZ,OAAO,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,gBAAgB,CAAC,CAAC;YACjE;gBACE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;QACrC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,OAAe,EAAE,KAAoB;QACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACtD,CAAC;QAED,WAAW;QACX,MAAM,aAAa,GAAkD,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC3G,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAiC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YAC9E,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,OAAO,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;QACzC,CAAC,EAAE,KAAK,CAAC,CAAC;QAEV,MAAM,SAAS,GAAmC,eAAe,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU;YAC3F,CAAC,CAAC,eAAe,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM;gBACrC,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ;oBACzC,CAAC,CAAC,KAAK,CAAC;QAEV,8DAA8D;QAC9D,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACrC,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;YACxD,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAC/B,CAAC;QAEF,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,eAAe,GAAG,KAAK;iBAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC;iBAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;iBACvB,IAAI,CAAC,IAAI,CAAC,CAAC;YAEd,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,SAAS,EAAE,MAAM;gBACjB,KAAK;gBACL,eAAe,EAAE,cAAc,eAAe,EAAE;aACjD,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QAC1D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,IAAI,MAAM,CAAC;YAE3D,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,OAAO;oBACL,IAAI,EAAE,KAAK;oBACX,SAAS,EAAE,QAAQ;oBACnB,KAAK;oBACL,eAAe,EAAE,YAAY,QAAQ,CAAC,MAAM,cAAc;iBAC3D,CAAC;YACJ,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,OAAO;oBACL,IAAI,EAAE,IAAI;oBACV,SAAS,EAAE,KAAK;oBAChB,KAAK;iBACN,CAAC;YACJ,CAAC;YAED,kBAAkB;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,QAAQ,CAAC,MAAM,wBAAwB,CAAC,CAAC;QACpE,CAAC;QAED,iBAAiB;QACjB,OAAO;YACL,IAAI,EAAE,IAAI;YACV,SAAS;YACT,KAAK;SACN,CAAC;IACJ,CAAC;CACF"}

package/dist/security/gate.d.ts

@@ -0,0 +1,78 @@
+/**
+ * 安全门（Security Gate）
+ *
+ * 安全审查的总调度器，串联四层安全检查：
+ * Layer 1: 速率限制
+ * Layer 2: 来源验证
+ * Layer 3: 内容安全扫描
+ * Layer 4: 权限分级
+ */
+import { EventBus } from '../core/events.js';
+import { PermissionGrader, type PermissionLevel } from './permission-level.js';
+import type { PlatformMessage } from '../types/message.js';
+import type { Task } from '../types/task.js';
+import type { SecurityConfig } from '../core/config.js';
+export interface SecurityCheckResult {
+    passed: boolean;
+    blockedBy?: string;
+    reason?: string;
+    permissionLevel?: PermissionLevel;
+    contentFlags?: any[];
+}
+export interface SecurityGateConfig {
+    rateLimit: SecurityConfig['rateLimit'];
+    sourceVerify: {
+        validateTimestamp: boolean;
+        maxTimestampSkewMs: number;
+    };
+    contentScan: SecurityConfig['contentScan'];
+    sandbox: SecurityConfig['sandbox'];
+}
+export declare class SecurityGate {
+    private logger;
+    private rateLimiter;
+    private sourceVerifier;
+    private contentScanner;
+    private permissionGrader;
+    private eventBus;
+    constructor(config: SecurityGateConfig, eventBus: EventBus);
+    /**
+     * 对消息执行完整安全检查（Layer 1-2-3）
+     */
+    check(message: PlatformMessage): Promise<SecurityCheckResult>;
+    /**
+     * Layer 4: 为任务确定权限级别
+     */
+    gradePermission(task: Task): PermissionLevel;
+    /**
+     * 获取权限分级器（供外部查询权限）
+     */
+    getPermissionGrader(): PermissionGrader;
+    /**
+     * 扫描 Agent 输出内容的安全性
+     */
+    scanOutput(content: string): {
+        safe: boolean;
+        reason?: string;
+    };
+    /**
+     * 检查任务容量
+     */
+    checkTaskCapacity(): boolean;
+    /**
+     * 通知任务开始
+     */
+    taskStarted(): void;
+    /**
+     * 通知任务结束
+     */
+    taskFinished(): void;
+    /**
+     * 获取速率限制器状态
+     */
+    getRateLimitStatus(): {
+        runningTasks: number;
+        maxConcurrent: number;
+    };
+}
+//# sourceMappingURL=gate.d.ts.map

package/dist/security/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/security/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,QAAQ,EAAmB,MAAM,mBAAmB,CAAC;AAI9D,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,IAAI,EAAwB,MAAM,kBAAkB,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;IACvC,YAAY,EAAE;QACZ,iBAAiB,EAAE,OAAO,CAAC;QAC3B,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,WAAW,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAC3C,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;CACpC;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAW;gBAEf,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ;IAqB1D;;OAEG;IACG,KAAK,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAiEnE;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,eAAe;IAI5C;;OAEG;IACH,mBAAmB,IAAI,gBAAgB;IAIvC;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAM/D;;OAEG;IACH,iBAAiB,IAAI,OAAO;IAI5B;;OAEG;IACH,WAAW,IAAI,IAAI;IAInB;;OAEG;IACH,YAAY,IAAI,IAAI;IAIpB;;OAEG;IACH,kBAAkB;;;;CAGnB"}