yenop 0.0.0 → 0.1.0

package/dist/adapters/gemini/hook.js

@@ -0,0 +1,232 @@
+/**
+ * Gemini CLI hooks adapter (`yenop hook gemini`).
+ *
+ * Gemini CLI runs a command before and after every tool call and reads a JSON answer from stdout. The contract
+ * (geminicli.com/docs/hooks/reference, checked against @google/gemini-cli-core 0.60.0):
+ *  - BeforeTool  {session_id, cwd, tool_name, tool_input, mcp_context?}    → {decision: allow|ask|deny, reason, systemMessage}
+ *  - AfterTool   {..., tool_response: {llmContent, returnDisplay, error?}}  observe-only
+ *  - SessionEnd  {session_id, reason}                                        fire-and-forget
+ *  Every event also carries hook_event_name, transcript_path and timestamp.
+ *
+ * What Gemini does with the answer, from its source rather than its docs:
+ *  - `ask` forces Gemini's own confirmation prompt, even in an auto-approve mode, and shows systemMessage.
+ *    So Gemini can ask a person, like Claude Code and unlike Codex.
+ *  - `deny` skips the tool; the model receives "Tool execution blocked: <reason>".
+ *  - Exit code 0 with JSON is the answer it prefers. Exit 1 means "warning, proceed" (an allow!), any other
+ *    non-zero exit is a deny. A hook that times out or cannot be spawned is logged and IGNORED: the runtime
+ *    is fail-open, like Codex. Yenop therefore answers with exit 0 and JSON for every verdict, including a
+ *    deny and its own failure, which is the one path that is honoured unambiguously; it never exits 1.
+ *
+ * Security decisions baked in here:
+ *  - Every world-touching tool is mapped by name to what it can do; a name Yenop does not know is judged as
+ *    an unknown tool (not read-only), never ignored.
+ *  - Gemini gives no per-call id, so one is derived from session, tool and arguments; that is what lets the
+ *    AfterTool outcome attach to the decision. Two identical calls inside the replay window get one verdict,
+ *    which is the same verdict they would get anyway.
+ *  - MCP tools arrive as `mcp_<server>_<tool>` after Gemini sanitises the name, which is ambiguous when names
+ *    contain underscores. mcp_context carries the exact server and tool and is preferred; the name is the
+ *    fallback, with the whole remainder treated as the tool.
+ *  - run_shell_command may name a directory to run in; the decision is made relative to it, so a relative
+ *    path in the command resolves the way the shell will resolve it.
+ *  - web_fetch takes URLs inside a prose prompt. Every URL is extracted and the first external one is judged
+ *    as the call's destination.
+ *  - Malformed input throws; the pipeline turns that into a deny.
+ */
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { classifyTool, mcpToolRef } from "../../core/tools.js";
+import { isInternalHost } from "../../core/shell.js";
+import { safeUser } from "../hooks/pipeline.js";
+/** Gemini's built-in tools (packages/core/src/tools/tool-names.ts) and what each can do. */
+const BUILTIN = {
+    run_shell_command: { kind: "shell", readOnly: false },
+    read_file: { kind: "read", readOnly: true },
+    read_many_files: { kind: "read", readOnly: true },
+    list_directory: { kind: "read", readOnly: true },
+    glob: { kind: "read", readOnly: true },
+    grep_search: { kind: "read", readOnly: true },
+    search_file_content: { kind: "read", readOnly: true }, // legacy alias of grep_search
+    write_file: { kind: "write", readOnly: false },
+    replace: { kind: "write", readOnly: false },
+    save_memory: { kind: "write", readOnly: false },
+    web_fetch: { kind: "web", readOnly: true },
+    google_web_search: { kind: "web", readOnly: true },
+    read_mcp_resource: { kind: "mcp", readOnly: true },
+    // Tools that act inside Gemini itself, not on outside systems. Judged (cheap) rather than ignored.
+    write_todos: { kind: "read", readOnly: true },
+    ask_user: { kind: "read", readOnly: true },
+    activate_skill: { kind: "read", readOnly: true },
+    enter_plan_mode: { kind: "read", readOnly: true },
+    exit_plan_mode: { kind: "read", readOnly: true },
+    update_topic: { kind: "read", readOnly: true },
+    complete_task: { kind: "read", readOnly: true },
+    get_internal_docs: { kind: "read", readOnly: true },
+    list_mcp_resources: { kind: "read", readOnly: true },
+    invoke_agent: { kind: "read", readOnly: true },
+    tracker_create_task: { kind: "read", readOnly: true },
+    tracker_update_task: { kind: "read", readOnly: true },
+    tracker_get_task: { kind: "read", readOnly: true },
+    tracker_list_tasks: { kind: "read", readOnly: true },
+    tracker_add_dependency: { kind: "read", readOnly: true },
+    tracker_visualize: { kind: "read", readOnly: true },
+};
+function str(v) {
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+function obj(v) {
+    return v && typeof v === "object" && !Array.isArray(v) ? v : {};
+}
+function strings(v) {
+    return Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+}
+export function runIdOf(m) {
+    return `gemini:${str(m.session_id) ?? "unknown"}`;
+}
+/** Gemini sends no call id. Derive one from what identifies the call, so the AfterTool outcome finds its decision. */
+export function geminiCallId(sessionId, tool, input) {
+    return "g_" + createHash("sha256").update(sessionId).update("\0").update(tool).update("\0").update(JSON.stringify(input ?? null)).digest("hex").slice(0, 32);
+}
+const URL_RE = /https?:\/\/[^\s<>"'`)\]]+/gi;
+/** The URLs named in a web_fetch prompt, external ones first, so the judged `url` is the one that leaves the machine. */
+export function urlsInPrompt(prompt) {
+    const found = (prompt.match(URL_RE) ?? []).map((u) => u.replace(/[.,;:!?]+$/, "")); // prose punctuation after a URL is not part of it
+    const external = [];
+    const internal = [];
+    for (const u of found) {
+        let host;
+        try {
+            host = new URL(u).hostname;
+        }
+        catch {
+            continue;
+        }
+        (isInternalHost(host) ? internal : external).push(u);
+    }
+    return [...external, ...internal];
+}
+/** Map one Gemini tool call to what Yenop judges. */
+function toolAndArgs(m, name, input) {
+    const ctx = obj(m.mcp_context);
+    const server = str(ctx["server_name"]);
+    const cwd = str(m.cwd);
+    if (server !== undefined)
+        return { tool: mcpToolRef(server, str(ctx["tool_name"]) ?? name), args: input, ...(cwd !== undefined ? { cwd } : {}) };
+    const known = BUILTIN[name];
+    if (known) {
+        const tool = { name, ...known };
+        switch (name) {
+            case "run_shell_command": {
+                const dir = str(input["dir_path"]);
+                const at = dir !== undefined && cwd !== undefined ? resolve(cwd, dir) : dir !== undefined ? resolve(dir) : cwd;
+                return { tool, args: input, ...(at !== undefined ? { cwd: at } : {}) };
+            }
+            case "read_many_files":
+                return { tool, args: { ...input, paths: strings(input["include"]) }, ...(cwd !== undefined ? { cwd } : {}) };
+            case "list_directory":
+            case "glob":
+            case "grep_search":
+            case "search_file_content": {
+                const dir = str(input["dir_path"]);
+                return { tool, args: dir !== undefined ? { ...input, path: dir } : input, ...(cwd !== undefined ? { cwd } : {}) };
+            }
+            case "save_memory":
+                // Persists into the user's global GEMINI.md: a write outside every project, and a persistence vector.
+                return { tool, args: { ...input, file_path: join(homedir(), ".gemini", "GEMINI.md"), content: input["fact"] ?? "" }, ...(cwd !== undefined ? { cwd } : {}) };
+            case "web_fetch": {
+                const urls = urlsInPrompt(str(input["prompt"]) ?? "");
+                return { tool, args: { ...input, urls, ...(urls[0] !== undefined ? { url: urls[0] } : {}) }, ...(cwd !== undefined ? { cwd } : {}) };
+            }
+            case "read_mcp_resource": {
+                const uri = str(input["uri"]);
+                let host = "unknown";
+                try {
+                    if (uri)
+                        host = new URL(uri).hostname || "unknown";
+                }
+                catch {
+                    /* not a URL */
+                }
+                return { tool: { ...tool, server: host }, args: input, ...(cwd !== undefined ? { cwd } : {}) };
+            }
+            default:
+                return { tool, args: input, ...(cwd !== undefined ? { cwd } : {}) };
+        }
+    }
+    // An MCP tool without mcp_context: mcp_<server>_<tool>, sanitised. The split is a guess; the server is taken
+    // as the first segment and everything after it as the tool, which errs towards an unfamiliar (untrusted) server.
+    const mcp = /^mcp_([^_]+)_(.+)$/.exec(name);
+    if (mcp)
+        return { tool: mcpToolRef(mcp[1], mcp[2]), args: input, ...(cwd !== undefined ? { cwd } : {}) };
+    return { tool: classifyTool(name), args: input, ...(cwd !== undefined ? { cwd } : {}) };
+}
+export function parseGemini(raw) {
+    const m = JSON.parse(raw); // throws → deny
+    const event = str(m.hook_event_name);
+    if (!event)
+        throw new Error("gemini hook event without hook_event_name");
+    const session = str(m.session_id);
+    if (!session)
+        throw new Error("gemini hook event without session_id");
+    switch (event) {
+        case "BeforeTool": {
+            const name = str(m.tool_name);
+            if (name === undefined)
+                throw new Error("BeforeTool without tool_name");
+            const input = obj(m.tool_input);
+            const { tool, args, cwd } = toolAndArgs(m, name, input);
+            const request = { runId: runIdOf(m), principal: { runtime: "gemini", agent: "main", user: safeUser() }, tool, args, callId: geminiCallId(session, name, m.tool_input) };
+            if (cwd !== undefined)
+                request.cwd = cwd;
+            return { kind: "decision", event, askCapable: true, request };
+        }
+        case "AfterTool": {
+            const name = str(m.tool_name);
+            if (name === undefined)
+                return { kind: "ignore" };
+            const resp = obj(m.tool_response);
+            const failed = resp["error"] !== undefined && resp["error"] !== null;
+            const out = { kind: "outcome", runId: runIdOf(m), callId: geminiCallId(session, name, m.tool_input), tool: name, outcome: failed ? "failed" : "ran" };
+            const err = resp["error"];
+            const detail = typeof err === "string" ? err : err && typeof err === "object" ? str(err["message"]) : undefined;
+            if (failed && detail)
+                out.detail = detail;
+            const cwd = str(m.cwd);
+            if (cwd !== undefined)
+                out.cwd = cwd;
+            return out;
+        }
+        case "SessionEnd": {
+            const end = { kind: "session-end", runId: runIdOf(m) };
+            const cwd = str(m.cwd);
+            if (cwd !== undefined)
+                end.cwd = cwd;
+            return end;
+        }
+        default:
+            return { kind: "ignore" };
+    }
+}
+export function geminiBody(effect, message, mode) {
+    if (mode === "observe" || effect === "allow")
+        return null; // silence with exit 0 is an allow
+    if (effect === "deny")
+        return { decision: "deny", reason: `Yenop: ${message}` };
+    return { decision: "ask", reason: `Yenop: ${message}`, systemMessage: `Yenop: ${message}` };
+}
+export const geminiTranslator = {
+    runtime: "gemini",
+    parse: parseGemini,
+    body: (effect, message, mode) => geminiBody(effect, message, mode),
+    result(body) {
+        if (body === null || Object.keys(body).length === 0)
+            return { stdout: "", exitCode: 0 };
+        return { stdout: JSON.stringify(body), exitCode: 0 };
+    },
+    // Exit 0 on purpose: a JSON deny on exit 0 is honoured; a non-zero exit is a path Gemini may treat as a
+    // failed hook, and a failed hook is ignored.
+    failure(reason) {
+        return { stdout: JSON.stringify({ decision: "deny", reason: `Yenop failed and refuses by default: ${reason}. Run "yenop status".` }), exitCode: 0 };
+    },
+};
+//# sourceMappingURL=hook.js.map

package/dist/adapters/gemini/hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../../src/adapters/gemini/hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAE,QAAQ,EAAwE,MAAM,sBAAsB,CAAC;AAYtH,4FAA4F;AAC5F,MAAM,OAAO,GAAiE;IAC5E,iBAAiB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;IACrD,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC3C,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACjD,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAChD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACtC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC7C,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,8BAA8B;IACrF,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC3C,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC/C,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC1C,iBAAiB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;IAClD,iBAAiB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;IAClD,mGAAmG;IACnG,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC7C,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC1C,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAChD,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACjD,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAChD,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC9C,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC/C,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACnD,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACpD,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC9C,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACrD,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACrD,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACpD,sBAAsB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxD,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;CACpD,CAAC;AAEF,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AACD,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/F,CAAC;AACD,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,CAAa;IACnC,OAAO,UAAU,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,SAAS,EAAE,CAAC;AACpD,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,IAAY,EAAE,KAAc;IAC1E,OAAO,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC/J,CAAC;AAED,MAAM,MAAM,GAAG,6BAA6B,CAAC;AAC7C,yHAAyH;AACzH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,kDAAkD;IACtI,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,qDAAqD;AACrD,SAAS,WAAW,CAAC,CAAa,EAAE,IAAY,EAAE,KAA8B;IAC9E,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAEjJ,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,GAAY,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;QACzC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,mBAAmB,CAAC,CAAC,CAAC;gBACzB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;gBACnC,MAAM,EAAE,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC/G,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACzE,CAAC;YACD,KAAK,iBAAiB;gBACpB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/G,KAAK,gBAAgB,CAAC;YACtB,KAAK,MAAM,CAAC;YACZ,KAAK,aAAa,CAAC;YACnB,KAAK,qBAAqB,CAAC,CAAC,CAAC;gBAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;gBACnC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACpH,CAAC;YACD,KAAK,aAAa;gBAChB,sGAAsG;gBACtG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/J,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACvI,CAAC;YACD,KAAK,mBAAmB,CAAC,CAAC,CAAC;gBACzB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9B,IAAI,IAAI,GAAG,SAAS,CAAC;gBACrB,IAAI,CAAC;oBACH,IAAI,GAAG;wBAAE,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,eAAe;gBACjB,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACjG,CAAC;YACD;gBACE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;IAED,6GAA6G;IAC7G,iHAAiH;IACjH,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3G,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC,CAAC,gBAAgB;IACzD,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAEtE,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,OAAO,GAAoB,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;YACzL,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;YACrE,MAAM,GAAG,GAAc,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YACjK,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAE,GAA+B,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7I,IAAI,MAAM,IAAI,MAAM;gBAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,GAAG,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC;YACrC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,GAAG,GAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,GAAG,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC;YACrC,OAAO,GAAG,CAAC;QACb,CAAC;QACD;YACE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,OAAe,EAAE,IAAU;IACpE,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;IAC7F,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;IAChF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC9C,OAAO,EAAE,QAAQ;IACjB,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;IAClE,MAAM,CAAC,IAAI;QACT,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,wGAAwG;IACxG,6CAA6C;IAC7C,OAAO,CAAC,MAAM;QACZ,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,wCAAwC,MAAM,uBAAuB,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACtJ,CAAC;CACF,CAAC"}

package/dist/adapters/gemini/install.d.ts

@@ -0,0 +1,21 @@
+export declare const GEMINI_MARKER = "hook gemini";
+export declare const GEMINI_DECISION_EVENT = "BeforeTool";
+export declare const GEMINI_REPORT_EVENTS: readonly ["AfterTool", "SessionEnd"];
+export declare const GEMINI_HOOK_NAME = "yenop";
+export declare function geminiSettingsPath(scope: "project" | "user", projectDir?: string): string;
+export declare function geminiDetected(projectDir: string): boolean;
+export declare function installGeminiHooks(path: string, command: string): {
+    changed: boolean;
+    path: string;
+};
+/**
+ * Gemini keeps two switches that decide whether a project's hooks run at all, both under ~/.gemini:
+ *  - trustedFolders.json: when folder trust is enabled, project hooks are skipped entirely in a folder that
+ *    is not trusted ("Project hooks disabled because the folder is not trusted").
+ *  - trusted_hooks.json: { "<project path>": ["<name>:<command>", ...] }; a project hook not listed there is
+ *    shown to the person with a warning before it runs, and listed once acknowledged.
+ * `yenop status` reads both so "installed" is never mistaken for "enforcing". Found the hard way with Codex.
+ */
+export type GeminiTrust = "trusted" | "untrusted" | "unknown";
+export declare function geminiFolderTrust(projectDir: string, file?: string): GeminiTrust;
+export declare function geminiHookTrust(projectDir: string, command: string, file?: string): GeminiTrust;

package/dist/adapters/gemini/install.js

@@ -0,0 +1,101 @@
+/**
+ * Install the Yenop hooks into a Gemini CLI settings.json (project: <root>/.gemini/settings.json, user:
+ * ~/.gemini/settings.json). Hooks live under the top-level "hooks" key: event → [{ matcher?, hooks: [...] }],
+ * timeouts in milliseconds. Idempotent: our entries are replaced, anyone else's are kept, every other setting
+ * in the file is untouched. Written atomically, since a half-written settings.json would make Gemini skip its
+ * hooks, and Gemini fails open.
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve, sep } from "node:path";
+import { homedir } from "node:os";
+export const GEMINI_MARKER = "hook gemini";
+export const GEMINI_DECISION_EVENT = "BeforeTool";
+export const GEMINI_REPORT_EVENTS = ["AfterTool", "SessionEnd"];
+export const GEMINI_HOOK_NAME = "yenop";
+export function geminiSettingsPath(scope, projectDir) {
+    return scope === "user" ? join(homedir(), ".gemini", "settings.json") : join(projectDir ?? process.cwd(), ".gemini", "settings.json");
+}
+export function geminiDetected(projectDir) {
+    return existsSync(join(homedir(), ".gemini")) || existsSync(join(projectDir, ".gemini"));
+}
+const isOurs = (h) => typeof h.command === "string" && h.command.trim().endsWith(GEMINI_MARKER);
+function writeAtomic(path, text) {
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, text);
+    renameSync(tmp, path);
+}
+export function installGeminiHooks(path, command) {
+    const file = existsSync(path) ? JSON.parse(readFileSync(path, "utf8")) : {};
+    const before = JSON.stringify(file);
+    file.hooks ??= {};
+    const put = (event, hook) => {
+        const groups = (file.hooks[event] ??= []);
+        const mine = groups.find((g) => g.hooks?.some(isOurs));
+        if (mine)
+            mine.hooks = [...mine.hooks.filter((h) => !isOurs(h)), hook];
+        else
+            groups.push({ hooks: [hook] }); // no matcher: every tool, built-in or MCP
+    };
+    // The hook's name is part of the key Gemini records when a person acknowledges it; keep it stable.
+    put(GEMINI_DECISION_EVENT, { type: "command", name: GEMINI_HOOK_NAME, command, timeout: 15000, description: "Yenop decides whether this action is allowed" });
+    put("AfterTool", { type: "command", name: `${GEMINI_HOOK_NAME}-outcome`, command, timeout: 5000, description: "Yenop records what became of the call" });
+    put("SessionEnd", { type: "command", name: `${GEMINI_HOOK_NAME}-session`, command, timeout: 3000, description: "Yenop closes the run" });
+    const after = JSON.stringify(file);
+    if (after === before)
+        return { changed: false, path };
+    writeAtomic(path, JSON.stringify(file, null, 2) + "\n");
+    return { changed: true, path };
+}
+function norm(p) {
+    const r = resolve(p);
+    return r.length > 1 && r.endsWith(sep) ? r.slice(0, -1) : r;
+}
+export function geminiFolderTrust(projectDir, file = join(homedir(), ".gemini", "trustedFolders.json")) {
+    if (!existsSync(file))
+        return "unknown";
+    let entries;
+    try {
+        entries = JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch {
+        return "unknown";
+    }
+    const dir = norm(projectDir);
+    let verdict = "unknown";
+    for (const [p, v] of Object.entries(entries)) {
+        if (typeof v !== "string")
+            continue;
+        const at = v === "TRUST_PARENT" ? dirname(norm(p)) : norm(p);
+        const covers = dir === at || dir.startsWith(at + sep);
+        if (!covers)
+            continue;
+        if (v === "DO_NOT_TRUST") {
+            if (dir === norm(p))
+                return "untrusted";
+        }
+        else if (v === "TRUST_FOLDER" || v === "TRUST_PARENT")
+            verdict = "trusted";
+    }
+    return verdict;
+}
+export function geminiHookTrust(projectDir, command, file = join(homedir(), ".gemini", "trusted_hooks.json")) {
+    if (!existsSync(file))
+        return "unknown";
+    let entries;
+    try {
+        entries = JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch {
+        return "unknown";
+    }
+    const dir = norm(projectDir);
+    const key = `${GEMINI_HOOK_NAME}:${command}`;
+    for (const [p, keys] of Object.entries(entries)) {
+        if (norm(p) !== dir || !Array.isArray(keys))
+            continue;
+        return keys.includes(key) ? "trusted" : "untrusted";
+    }
+    return "untrusted";
+}
+//# sourceMappingURL=install.js.map

package/dist/adapters/gemini/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../../src/adapters/gemini/install.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,WAAW,EAAE,YAAY,CAAU,CAAC;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAmBxC,MAAM,UAAU,kBAAkB,CAAC,KAAyB,EAAE,UAAmB;IAC/E,OAAO,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AACxI,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAO,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AAEtG,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,OAAe;IAC9D,MAAM,IAAI,GAAa,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IACpG,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;IAClB,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,IAAU,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,KAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,IAAI,IAAI;YAAE,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;;YAClE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,0CAA0C;IACjF,CAAC,CAAC;IACF,mGAAmG;IACnG,GAAG,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC,CAAC;IAC9J,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,gBAAgB,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC,CAAC;IACzJ,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,gBAAgB,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACzI,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACtD,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAYD,SAAS,IAAI,CAAC,CAAS;IACrB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,CAAC;IAC5G,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7B,IAAI,OAAO,GAAgB,SAAS,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,MAAM,EAAE,GAAG,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,CAAC,KAAK,cAAc,EAAE,CAAC;YACzB,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,WAAW,CAAC;QAC1C,CAAC;aAAM,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,cAAc;YAAE,OAAO,GAAG,SAAS,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,OAAe,EAAE,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,oBAAoB,CAAC;IAC1H,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,GAAG,gBAAgB,IAAI,OAAO,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACtD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IACtD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/adapters/hooks/pipeline.d.ts

@@ -0,0 +1,69 @@
+import type { DecisionRequest, Outcome } from "../../core/types.js";
+import type { Mode } from "../../core/config.js";
+export type Effect = "allow" | "ask" | "deny";
+export type HookEvent = {
+    kind: "decision";
+    request: DecisionRequest;
+    /** false when the runtime's hook can only allow or deny: an ask must then become a deny, never an allow. */
+    askCapable: boolean;
+    /** the runtime's own event name, for translators that answer differently per event */
+    event: string;
+}
+/** cwd on outcome and session-end selects the same project instance (tenant, policies) the decision used. */
+ | {
+    kind: "outcome";
+    runId: string;
+    callId: string;
+    tool: string;
+    outcome: Outcome;
+    detail?: string;
+    cwd?: string;
+} | {
+    kind: "session-end";
+    runId: string;
+    cwd?: string;
+} | {
+    kind: "ignore";
+};
+/** The project directory an event belongs to, whatever its kind. */
+export declare function eventCwd(event: HookEvent): string | undefined;
+export interface HookRunResult {
+    stdout: string;
+    exitCode: number;
+    /** Some runtimes read the reason for a block from stderr (Codex on exit 2). */
+    stderr?: string;
+}
+export interface HookTranslator {
+    /** The runtime id, also the daemon route: /hooks/<runtime>. */
+    runtime: string;
+    /** Parse raw stdin. MUST throw on input it cannot make sense of; the pipeline turns that into a deny. */
+    parse(raw: string): HookEvent;
+    /** The runtime's answer for a decision. Always an object for a decision the runtime is waiting on. */
+    body(effect: Effect, message: string, mode: Mode, event: Extract<HookEvent, {
+        kind: "decision";
+    }>): Record<string, unknown> | null;
+    /** How to print a body: null or an empty object means print nothing. */
+    result(body: Record<string, unknown> | null): HookRunResult;
+    /** The answer when Yenop itself failed. MUST block. */
+    failure(reason: string): HookRunResult;
+}
+export declare function yenopHome(): string;
+/**
+ * Decide one raw hook event for a runtime. Daemon first, in-process second. Throws only on a Yenop failure,
+ * which the caller renders with translator.failure() so the runtime blocks.
+ */
+export declare function runHookWith(t: HookTranslator, raw: string): Promise<HookRunResult>;
+/** Apply one parsed event to an open Yenop and produce the runtime's body. Shared by the daemon route. */
+export declare function decideEvent(yenop: {
+    decide: (r: DecisionRequest) => {
+        effect: Effect;
+        message: string;
+    };
+    recordOutcome: (runId: string, callId: string, tool: string, outcome: Outcome, detail?: string) => unknown;
+    endRun: (runId: string) => void;
+    config: {
+        mode: Mode;
+    };
+}, t: HookTranslator, event: HookEvent): Record<string, unknown> | null;
+export declare function readStdin(): Promise<string>;
+export declare function safeUser(): string;

package/dist/adapters/hooks/pipeline.js

@@ -0,0 +1,131 @@
+/**
+ * The shared hook pipeline. Every runtime that calls a command before acting (Claude Code, Cursor, Codex,
+ * Gemini CLI, ...) goes through this: one translator per runtime turns that runtime's event into a
+ * DecisionRequest and turns Yenop's decision back into the runtime's answer. The engine, the policies, the
+ * run state and the receipts never know which runtime asked.
+ *
+ * Security rules of this file, in order:
+ *  - Fail closed. Input that cannot be parsed, or that a translator rejects, is a deny, never "no opinion".
+ *    A permission hook that prints nothing when it should have judged is a bypass.
+ *  - stdin is untrusted. Translators validate shape and never trust a field they did not check.
+ *  - Nothing the agent can influence weakens enforcement: the only escape hatch is observe mode, which is
+ *    operator configuration and is honoured exactly as in every other path.
+ *
+ * Performance: the fast path posts the raw event to the resident daemon over a raw socket (about a
+ * millisecond); the fallback decides in-process and then starts a daemon for next time. Both are shared, so
+ * a new runtime costs a translator and nothing else.
+ */
+import { homedir, userInfo } from "node:os";
+import { join } from "node:path";
+import { appendFileSync, mkdirSync } from "node:fs";
+/** The project directory an event belongs to, whatever its kind. */
+export function eventCwd(event) {
+    if (event.kind === "decision")
+        return event.request.cwd;
+    if (event.kind === "ignore")
+        return undefined;
+    return event.cwd;
+}
+export function yenopHome() {
+    return process.env["YENOP_HOME"] ?? join(homedir(), ".yenop");
+}
+function isEmpty(o) {
+    return o === null || Object.keys(o).length === 0;
+}
+/**
+ * Decide one raw hook event for a runtime. Daemon first, in-process second. Throws only on a Yenop failure,
+ * which the caller renders with translator.failure() so the runtime blocks.
+ */
+export async function runHookWith(t, raw) {
+    const home = yenopHome();
+    const useDaemon = process.env["YENOP_NO_DAEMON"] !== "1";
+    recordRawEvent(t.runtime, raw);
+    if (useDaemon) {
+        const { readDaemonInfoFast, rawPost } = await import("../../daemon/fast.js");
+        const info = readDaemonInfoFast(home);
+        if (info) {
+            try {
+                const r = await rawPost(info, `/hooks/${t.runtime}`, raw, 1500);
+                if (r.status === 200) {
+                    const body = JSON.parse(r.body);
+                    return t.result(isEmpty(body) ? null : body);
+                }
+            }
+            catch {
+                /* daemon not reachable: decide here */
+            }
+        }
+    }
+    const event = t.parse(raw); // throws on malformed input → caller fails closed
+    if (event.kind === "ignore")
+        return t.result(null);
+    const { openYenop } = await import("../../core/index.js");
+    const cwd = eventCwd(event);
+    const yenop = openYenop(cwd !== undefined ? { cwd } : {});
+    try {
+        return t.result(decideEvent(yenop, t, event));
+    }
+    finally {
+        yenop.close();
+        if (useDaemon) {
+            const { startDaemonDetached } = await import("../../daemon/client.js");
+            try {
+                startDaemonDetached(home);
+            }
+            catch {
+                /* next call will try again */
+            }
+        }
+    }
+}
+/** Apply one parsed event to an open Yenop and produce the runtime's body. Shared by the daemon route. */
+export function decideEvent(yenop, t, event) {
+    switch (event.kind) {
+        case "outcome":
+            yenop.recordOutcome(event.runId, event.callId, event.tool, event.outcome, event.detail);
+            return null;
+        case "session-end":
+            // the runtime told us the session ended: forget its run so a new session on the same id starts fresh
+            yenop.endRun(event.runId);
+            return null;
+        case "ignore":
+            return null;
+        case "decision": {
+            const d = yenop.decide(event.request);
+            return t.body(d.effect, d.message, yenop.config.mode, event);
+        }
+    }
+}
+/**
+ * Opt-in recorder for building test fixtures from what a runtime REALLY sends, rather than what its docs say.
+ * `YENOP_RECORD_HOOKS=<dir>` appends one line per event to <dir>/<runtime>.jsonl. Off by default. Recordings can
+ * contain file contents and secrets (Cursor's beforeReadFile carries the file), so they are reviewed and
+ * redacted before becoming fixtures; see docs/test-plan.md. Errors here never affect the decision.
+ */
+function recordRawEvent(runtime, raw) {
+    const dir = process.env["YENOP_RECORD_HOOKS"];
+    if (!dir)
+        return;
+    try {
+        mkdirSync(dir, { recursive: true });
+        appendFileSync(join(dir, `${runtime}.jsonl`), JSON.stringify({ runtime, ts: new Date().toISOString(), raw }) + "\n");
+    }
+    catch {
+        /* recording is a convenience; the decision must not depend on it */
+    }
+}
+export async function readStdin() {
+    const chunks = [];
+    for await (const c of process.stdin)
+        chunks.push(c);
+    return Buffer.concat(chunks).toString("utf8");
+}
+export function safeUser() {
+    try {
+        return userInfo().username;
+    }
+    catch {
+        return "unknown";
+    }
+}
+//# sourceMappingURL=pipeline.js.map

package/dist/adapters/hooks/pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../../src/adapters/hooks/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAoBpD,oEAAoE;AACpE,MAAM,UAAU,QAAQ,CAAC,KAAgB;IACvC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAsBD,MAAM,UAAU,SAAS;IACvB,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,OAAO,CAAC,CAAiC;IAChD,OAAO,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,CAAiB,EAAE,GAAW;IAC9D,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,GAAG,CAAC;IACzD,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAE/B,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAChE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAA4B,CAAC;oBAC3D,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,kDAAkD;IAC9E,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YACvE,IAAI,CAAC;gBACH,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;YAChC,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,WAAW,CACzB,KAAmP,EACnP,CAAiB,EACjB,KAAgB;IAEhB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,SAAS;YACZ,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACxF,OAAO,IAAI,CAAC;QACd,KAAK,aAAa;YAChB,qGAAqG;YACrG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC;QACd,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,GAAW;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACvH,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/adapters/hooks/registry.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The runtimes Yenop can hook. `yenop hook <runtime>` and the daemon's /hooks/<runtime> route both look here,
+ * so adding a runtime is one translator and one line. Loading is lazy on purpose: the command hook must stay
+ * close to bare Node startup, so it loads its own translator and nothing else.
+ */
+import type { HookTranslator } from "./pipeline.js";
+export declare function hookTranslator(runtime: string): Promise<HookTranslator | undefined>;
+export declare function hookRuntimes(): string[];

package/dist/adapters/hooks/registry.js

@@ -0,0 +1,14 @@
+const LOADERS = {
+    "claude-code": async () => (await import("../claude-code/hook.js")).claudeCodeTranslator,
+    cursor: async () => (await import("../cursor/hook.js")).cursorTranslator,
+    codex: async () => (await import("../codex/hook.js")).codexTranslator,
+    gemini: async () => (await import("../gemini/hook.js")).geminiTranslator,
+};
+export async function hookTranslator(runtime) {
+    const load = Object.prototype.hasOwnProperty.call(LOADERS, runtime) ? LOADERS[runtime] : undefined;
+    return load ? load() : undefined;
+}
+export function hookRuntimes() {
+    return Object.keys(LOADERS);
+}
+//# sourceMappingURL=registry.js.map

package/dist/adapters/hooks/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/adapters/hooks/registry.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,GAAkD;IAC7D,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,oBAAoB;IACxF,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB;IACxE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,eAAe;IACrE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB;CACzE,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACnC,CAAC;AACD,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}