@ai-sdk/harness-codex 1.0.23 → 1.0.24

package/dist/bridge/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../harness/src/bridge/index.ts","../../src/bridge/index.ts","../../src/bridge/cli-relay.ts","../../src/bridge/tool-relay-auth.ts"],"sourcesContent":["// Shared in-sandbox bridge runtime. Adapter `bridge.mjs` bundles re-bundle\n// this module (tsup inlines it; `ws` stays external and resolves from the\n// sandbox-installed node_modules). It owns everything generic to the bridge\n// transport — the WebSocket server, token auth, single-flight connection\n// replacement, the in-memory event log + monotonic `seq`, resume replay, and\n// the lifecycle/meta files. The adapter supplies only `onStart` (drive its\n// CLI/SDK and translate to wire events) and `onDetach` (its resume payload).\n\nimport { appendFile, mkdir, writeFile } from 'node:fs/promises';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { env as procEnv, pid, stdout } from 'node:process';\nimport { WebSocketServer, type WebSocket } from 'ws';\n\nexport type BridgeState = 'init' | 'waiting' | 'running' | 'draining' | 'done';\n\n/** Outbound turn event the adapter emits. `seq` is added by the runtime. */\nexport type BridgeEvent = Record<string, unknown> & { type: string };\n\nexport type BridgeDebugLevel = 'error' | 'warn' | 'info' | 'debug' | 'trace';\n\n/**\n * Per-session diagnostics config. The host resolves it from settings +\n * env and sends it on `start.debug`; the bridge gates console capture and\n * structured `debug-event`s on it. When disabled, nothing is captured or\n * emitted and no `seq` is consumed.\n */\nexport interface BridgeDebugConfig {\n  enabled?: boolean;\n  level?: BridgeDebugLevel;\n  subsystems?: string[];\n}\n\nconst DEBUG_LEVEL_WEIGHT: Record<BridgeDebugLevel, number> = {\n  error: 0,\n  warn: 1,\n  info: 2,\n  debug: 3,\n  trace: 4,\n};\n\n/** Exact-or-dotted-prefix subsystem match (`'bridge'` matches `'bridge.turn'`). */\nfunction subsystemMatches(\n  filters: string[] | undefined,\n  subsystem: string,\n): boolean {\n  if (!filters || filters.length === 0) return true;\n  return filters.some(\n    filter => subsystem === filter || subsystem.startsWith(`${filter}.`),\n  );\n}\n\nfunction formatBridgeError(err: unknown): {\n  name?: string;\n  message: string;\n  stack?: string;\n} {\n  if (err instanceof Error) {\n    return { name: err.name, message: err.message, stack: err.stack };\n  }\n  return { message: String(err) };\n}\n\nfunction parseEnvList(value: string | undefined): string[] | undefined {\n  if (!value) return undefined;\n  const items = value\n    .split(',')\n    .map(item => item.trim())\n    .filter(Boolean);\n  return items.length > 0 ? items : undefined;\n}\n\nconst ENV_TRUTHY = new Set(['1', 'true', 'yes', 'on']);\n\n/**\n * Per-turn surface handed to {@link RunBridgeOptions.onStart}. The adapter\n * drives its runtime against these primitives; the runtime owns the transport.\n */\nexport interface BridgeTurn {\n  /**\n   * Emit a turn event to the host. Stamps a monotonic `seq`, appends to the\n   * in-memory replay log, and sends to the live socket (best-effort — if the\n   * host is mid-reconnect the event waits in the log and is replayed on\n   * resume).\n   */\n  emit(event: BridgeEvent): void;\n\n  /**\n   * Register interest in a host-executed tool result and resolve when the\n   * matching `tool-result` arrives. The adapter emits the `tool-call` event\n   * itself (via {@link emit}) using the same `toolCallId`.\n   */\n  requestToolResult(\n    toolCallId: string,\n  ): Promise<{ output: unknown; isError?: boolean }>;\n\n  /**\n   * Register interest in a host approval decision and resolve when the matching\n   * `tool-approval-response` arrives. The adapter emits the\n   * `tool-approval-request` event itself using the same `approvalId`.\n   */\n  requestToolApproval(\n    approvalId: string,\n  ): Promise<{ approved: boolean; reason?: string }>;\n\n  /**\n   * Live queue of mid-turn user messages. The runtime pushes inbound\n   * `user-message` text here; the adapter drains it as its runtime accepts\n   * interactive input.\n   */\n  readonly pendingUserMessages: string[];\n\n  /** Aborts when the host sends `abort`. */\n  readonly abortSignal: AbortSignal;\n\n  /** True for the first turn since this bridge process started. */\n  readonly firstTurn: boolean;\n\n  /**\n   * Emit a structured diagnostic. Gated by the session's debug level +\n   * subsystem filter; a no-op when diagnostics are disabled. Adapters use this\n   * for runtime-level instrumentation; raw `console.*` output is captured and\n   * forwarded automatically.\n   */\n  bridgeLog(input: {\n    level?: BridgeDebugLevel;\n    subsystem: string;\n    message: string;\n    attrs?: Record<string, unknown>;\n    error?: unknown;\n  }): void;\n}\n\nexport interface RunBridgeOptions<TStart extends { type: 'start' }> {\n  /** Identifier written into `bridge-meta.json` (`'claude-code'` / `'codex'`). */\n  bridgeType: string;\n  /** Directory for `bridge-meta.json` / `start-config.json`. Created if absent. */\n  bridgeStateDir: string;\n  /** Drive one prompt turn. Rejections surface to the host as an `error` event. */\n  onStart(start: TStart, turn: BridgeTurn): Promise<void>;\n  /** Produce the adapter-defined resume payload for a `detach`. Defaults to `{}`. */\n  onDetach?(): unknown | Promise<unknown>;\n  /** WS port. Defaults to `BRIDGE_WS_PORT` env (0 = OS-assigned). */\n  port?: number;\n  /** Auth token. Defaults to `BRIDGE_CHANNEL_TOKEN` env. */\n  token?: string;\n  /** Called with the bound port once the server is listening. */\n  onListening?(port: number): void;\n  /**\n   * Tear the process down after a `shutdown` / `detach`. Defaults to closing\n   * the server and calling `process.exit(0)`. Overridable for tests.\n   */\n  onExit?(): void;\n}\n\ntype InboundControl =\n  | {\n      type: 'tool-result';\n      toolCallId: string;\n      output: unknown;\n      isError?: boolean;\n    }\n  | {\n      type: 'tool-approval-response';\n      approvalId: string;\n      approved: boolean;\n      reason?: string;\n    }\n  | { type: 'user-message'; text: string }\n  | { type: 'abort' }\n  | { type: 'shutdown' }\n  | { type: 'detach' }\n  | { type: 'resume'; lastSeenEventId: number };\n\nconst WS_OPEN = 1;\n\n/**\n * Boot the bridge: bind the WebSocket server, announce `bridge-ready`, and\n * service host connections for the lifetime of the process. Resolves once the\n * server is listening; the process then stays alive on the server until a\n * `shutdown` / `detach` exits it.\n */\nexport interface BridgeHandle {\n  /** The port the WebSocket server bound to. */\n  readonly port: number;\n  /** Close the WebSocket server. Does not call `process.exit`. */\n  close(): Promise<void>;\n}\n\nexport async function runBridge<TStart extends { type: 'start' }>(\n  options: RunBridgeOptions<TStart>,\n): Promise<BridgeHandle> {\n  const { bridgeType, bridgeStateDir, onStart, onDetach } = options;\n  const expectedToken = options.token ?? procEnv.BRIDGE_CHANNEL_TOKEN ?? '';\n  const bridgeWsPort =\n    options.port ?? parseInt(procEnv.BRIDGE_WS_PORT ?? '0', 10);\n\n  const bridgeMetaPath = `${bridgeStateDir}/bridge-meta.json`;\n  const startConfigPath = `${bridgeStateDir}/start-config.json`;\n  const rerunStartConfigPath = `${bridgeStateDir}/rerun-start-config.json`;\n  const eventLogPath = `${bridgeStateDir}/event-log.ndjson`;\n\n  try {\n    await mkdir(bridgeStateDir, { recursive: true });\n  } catch {\n    // Best-effort; the bridge still runs without its state files.\n  }\n\n  // ─── mutable runtime state ──────────────────────────────────────────\n  let currentBoundPort = 0;\n  let currentTurnState: BridgeState = 'init';\n  let activeSocket: WebSocket | undefined;\n  let isFirstTurn = true;\n  let turnAbort: AbortController | undefined;\n  let currentUserMessages: string[] | undefined;\n\n  // Diagnostics. Resolved per turn from `start.debug` with a sandbox-side\n  // env fallback; gates console capture + structured `debug-event`s.\n  let debugConfig: BridgeDebugConfig | undefined;\n  let consoleCaptureInstalled = false;\n  const envDebugEnabled = ENV_TRUTHY.has(\n    (procEnv.HARNESS_DEBUG ?? '').toLowerCase(),\n  );\n\n  // Replay log. `seq` is monotonic across the whole process — never reset —\n  // because the host's `SandboxChannel` cursor (`lastSeenEventId`) lives across\n  // turns. The log *contents* are cleared at the start of each turn to bound\n  // memory; the just-finished turn stays replayable until the next `start`.\n  let seqCounter = 0;\n  let eventLog: Array<{ seq: number; line: string }> = [];\n\n  /*\n   * Disk mirror of the in-memory replay log. The in-memory log is lost when the\n   * bridge process dies; the on-disk `event-log.ndjson` survives in the sandbox\n   * filesystem so a respawned bridge (started with `BRIDGE_REPLAY_FROM_DISK=1`)\n   * can reload the just-interrupted turn and serve a host's resume cursor —\n   * `replay` recovery. Writes are batched on `setImmediate` (single-flight via\n   * `flushPromise`) to keep `emit` off the disk hot path.\n   */\n  let diskBuffer = '';\n  let flushPromise: Promise<void> | null = null;\n\n  const flushEventsToDisk = async (): Promise<void> => {\n    while (diskBuffer.length > 0) {\n      const buf = diskBuffer;\n      diskBuffer = '';\n      await appendFile(eventLogPath, buf).catch(() => {\n        // Best-effort crash-recovery mirror; the in-memory log is the source of\n        // truth for the live connection.\n      });\n    }\n  };\n\n  const scheduleEventFlush = (): void => {\n    if (flushPromise) return;\n    flushPromise = new Promise<void>(resolve => {\n      setImmediate(() => {\n        void flushEventsToDisk().finally(resolve);\n      });\n    }).finally(() => {\n      flushPromise = null;\n      if (diskBuffer.length > 0) {\n        scheduleEventFlush();\n      }\n    });\n  };\n\n  const flushPendingEventsToDisk = async (): Promise<void> => {\n    if (diskBuffer.length > 0 && !flushPromise) {\n      scheduleEventFlush();\n    }\n    // Await each in-flight flush, re-reading `flushPromise` after every await\n    // since a fresh flush may have been scheduled for buffer that arrived while\n    // we waited.\n    let inFlight = flushPromise;\n    while (inFlight) {\n      await inFlight;\n      inFlight = flushPromise;\n    }\n  };\n\n  /*\n   * When respawned for `replay`, reload the previous turn's log from disk before\n   * accepting any connection so the very first `resume{lastSeenEventId}` can be\n   * served the tail (including the terminal `finish`). The seq counter is\n   * restored to the last persisted seq so it stays aligned with the host's\n   * long-lived cursor. The file is NOT truncated in this mode — only a fresh\n   * `start` (next turn) clears it.\n   */\n  const replayFromDisk = procEnv.BRIDGE_REPLAY_FROM_DISK === '1';\n  if (replayFromDisk && existsSync(eventLogPath)) {\n    try {\n      const lines = readFileSync(eventLogPath, 'utf8')\n        .split('\\n')\n        .map(line => line.trim())\n        .filter(Boolean);\n      eventLog = lines.map(line => ({\n        seq: (JSON.parse(line) as { seq: number }).seq,\n        line,\n      }));\n      seqCounter = eventLog.at(-1)?.seq ?? 0;\n    } catch {\n      // Corrupt/partial log: fall back to an empty log; the host then degrades\n      // to `rerun` instead of replaying a malformed tail.\n      eventLog = [];\n      seqCounter = 0;\n    }\n  }\n\n  const pendingToolResults = new Map<\n    string,\n    (output: { output: unknown; isError?: boolean }) => void\n  >();\n  const pendingToolApprovals = new Map<\n    string,\n    (response: { approved: boolean; reason?: string }) => void\n  >();\n\n  // ─── persistence (best-effort meta + start config) ──────────────────\n  const writeBridgeMeta = async (state: BridgeState): Promise<void> => {\n    try {\n      await writeFile(\n        bridgeMetaPath,\n        JSON.stringify({\n          type: bridgeType,\n          port: currentBoundPort,\n          state,\n          pid,\n        }),\n      );\n    } catch {\n      // Best-effort resilience metadata; not load-bearing for the active turn.\n    }\n  };\n\n  const writeStartConfig = async (start: unknown): Promise<void> => {\n    try {\n      const serialized = JSON.stringify(start);\n      await writeFile(startConfigPath, serialized);\n      // Frozen copy: written once, restored over start-config.json by future\n      // rerun-mode recovery to re-run the original turn from scratch.\n      if (!existsSync(rerunStartConfigPath)) {\n        await writeFile(rerunStartConfigPath, serialized);\n      }\n    } catch {\n      // Best-effort.\n    }\n  };\n\n  // ─── wire send + replay ─────────────────────────────────────────────\n  const sendControl = (msg: Record<string, unknown>): void => {\n    if (activeSocket?.readyState === WS_OPEN) {\n      try {\n        activeSocket.send(JSON.stringify(msg));\n      } catch {\n        // best-effort\n      }\n    }\n  };\n\n  const emit = (event: BridgeEvent): void => {\n    const seq = ++seqCounter;\n    const line = JSON.stringify({ ...event, seq });\n    eventLog.push({ seq, line });\n    diskBuffer += `${line}\\n`;\n    scheduleEventFlush();\n    if (activeSocket?.readyState === WS_OPEN) {\n      try {\n        activeSocket.send(line);\n      } catch {\n        // Send is best-effort: a dropped socket leaves the event in the log,\n        // replayed once the host reconnects and sends `resume`.\n      }\n    }\n  };\n\n  const replay = (ws: WebSocket, afterSeq: number): void => {\n    for (const entry of eventLog) {\n      if (entry.seq > afterSeq && ws.readyState === WS_OPEN) {\n        ws.send(entry.line);\n      }\n    }\n  };\n\n  // ─── diagnostics ──────────────────────────────────────────────\n  const shouldEmitDebugEvent = (\n    level: BridgeDebugLevel,\n    subsystem: string,\n  ): boolean => {\n    if (!debugConfig?.enabled) return false;\n    const threshold = debugConfig.level ?? 'debug';\n    if (DEBUG_LEVEL_WEIGHT[level] > DEBUG_LEVEL_WEIGHT[threshold]) return false;\n    return subsystemMatches(debugConfig.subsystems, subsystem);\n  };\n\n  /*\n   * Forward sandbox console output. We line-buffer the original writers (kept so\n   * output still reaches the real fds) and emit one `sandbox-log` per complete\n   * line. `emit` never writes to stdout/stderr, so there is no recursion.\n   * Installed lazily the first time a turn enables diagnostics; once installed,\n   * capture is gated per-write on `debugConfig.enabled` so a later turn can\n   * disable it. Console capture is independent of the subsystem/level filter.\n   */\n  const rawStdoutWrite = process.stdout.write.bind(process.stdout);\n  const rawStderrWrite = process.stderr.write.bind(process.stderr);\n  const installConsoleCapture = (): void => {\n    if (consoleCaptureInstalled) return;\n    consoleCaptureInstalled = true;\n    const buffers: { stdout: string; stderr: string } = {\n      stdout: '',\n      stderr: '',\n    };\n    const patch =\n      (stream: 'stdout' | 'stderr', raw: typeof process.stdout.write) =>\n      (chunk: unknown, encoding?: unknown, cb?: unknown): boolean => {\n        if (debugConfig?.enabled) {\n          try {\n            const enc = typeof encoding === 'string' ? encoding : 'utf8';\n            const text =\n              typeof chunk === 'string'\n                ? chunk\n                : Buffer.from(chunk as Uint8Array).toString(\n                    enc as BufferEncoding,\n                  );\n            const combined = buffers[stream] + text.replace(/\\r\\n/g, '\\n');\n            const parts = combined.split('\\n');\n            buffers[stream] = parts.pop() ?? '';\n            for (const line of parts) {\n              const trimmed = line.replace(/\\s+$/, '');\n              if (trimmed) {\n                emit({\n                  type: 'sandbox-log',\n                  source: bridgeType,\n                  stream,\n                  line: trimmed,\n                });\n              }\n            }\n          } catch {\n            // Never let capture break real output.\n          }\n        }\n        return (raw as (c: unknown, e?: unknown, cb?: unknown) => boolean)(\n          chunk,\n          encoding,\n          cb,\n        );\n      };\n    process.stdout.write = patch(\n      'stdout',\n      rawStdoutWrite,\n    ) as typeof process.stdout.write;\n    process.stderr.write = patch(\n      'stderr',\n      rawStderrWrite,\n    ) as typeof process.stderr.write;\n  };\n\n  // ─── inbound routing ────────────────────────────────────────────────\n  const handleInbound = async (\n    msg: TStart | InboundControl,\n    ws: WebSocket,\n  ): Promise<void> => {\n    switch (msg.type) {\n      case 'start': {\n        const firstTurn = isFirstTurn;\n        isFirstTurn = false;\n        eventLog = []; // clear previous turn; keep seqCounter monotonic\n        // Mirror the in-memory clear to disk: the log tracks only the current\n        // turn. Discard any unflushed tail from the prior turn first.\n        diskBuffer = '';\n        void writeFile(eventLogPath, '').catch(() => {});\n        turnAbort = new AbortController();\n        currentTurnState = 'running';\n        void writeStartConfig(msg);\n        void writeBridgeMeta('running');\n        const startDebug = (msg as { debug?: BridgeDebugConfig }).debug;\n        debugConfig = {\n          enabled: startDebug?.enabled ?? envDebugEnabled,\n          level:\n            startDebug?.level ??\n            (procEnv.HARNESS_DEBUG_LEVEL as BridgeDebugLevel | undefined),\n          subsystems:\n            startDebug?.subsystems ??\n            parseEnvList(procEnv.HARNESS_DEBUG_SUBSYSTEMS),\n        };\n        if (debugConfig.enabled) {\n          installConsoleCapture();\n        }\n        const turn: BridgeTurn = {\n          emit,\n          requestToolResult: toolCallId =>\n            new Promise(resolve => {\n              pendingToolResults.set(toolCallId, resolve);\n            }),\n          requestToolApproval: approvalId =>\n            new Promise(resolve => {\n              pendingToolApprovals.set(approvalId, resolve);\n            }),\n          pendingUserMessages: [],\n          abortSignal: turnAbort.signal,\n          firstTurn,\n          bridgeLog: input => {\n            const level = input.level ?? 'debug';\n            if (!shouldEmitDebugEvent(level, input.subsystem)) return;\n            emit({\n              type: 'debug-event',\n              level,\n              subsystem: input.subsystem,\n              message: input.message,\n              ...(input.attrs ? { attrs: input.attrs } : {}),\n              ...(input.error !== undefined\n                ? { error: formatBridgeError(input.error) }\n                : {}),\n            });\n          },\n        };\n        currentUserMessages = turn.pendingUserMessages;\n        try {\n          await onStart(msg as TStart, turn);\n        } catch (err) {\n          emit({ type: 'error', error: serialiseError(err) });\n        } finally {\n          currentTurnState = 'waiting';\n          void writeBridgeMeta('waiting');\n        }\n        return;\n      }\n      case 'tool-result': {\n        const resolver = pendingToolResults.get(msg.toolCallId);\n        if (resolver) {\n          pendingToolResults.delete(msg.toolCallId);\n          resolver({ output: msg.output, isError: msg.isError });\n        }\n        return;\n      }\n      case 'tool-approval-response': {\n        const resolver = pendingToolApprovals.get(msg.approvalId);\n        if (resolver) {\n          pendingToolApprovals.delete(msg.approvalId);\n          resolver({ approved: msg.approved, reason: msg.reason });\n        }\n        return;\n      }\n      case 'user-message':\n        currentUserMessages?.push(msg.text);\n        return;\n      case 'abort':\n        turnAbort?.abort();\n        return;\n      case 'resume':\n        replay(ws, msg.lastSeenEventId);\n        return;\n      case 'shutdown':\n        currentTurnState = 'done';\n        void writeBridgeMeta('done');\n        drainThenExit(ws, 1000, 'shutdown');\n        return;\n      case 'detach': {\n        currentTurnState = 'done';\n        void writeBridgeMeta('done');\n        const data = (await onDetach?.()) ?? {};\n        sendControl({ type: 'bridge-detach', data });\n        drainThenExit(ws, 1000, 'detach');\n        return;\n      }\n    }\n  };\n\n  // ─── server ─────────────────────────────────────────────────────────\n  void writeBridgeMeta('init');\n\n  const wss = new WebSocketServer({ port: bridgeWsPort, host: '0.0.0.0' });\n\n  const exit = (): void => {\n    if (options.onExit) {\n      options.onExit();\n      return;\n    }\n    wss.close(() => process.exit(0));\n    setTimeout(() => process.exit(0), 1000).unref();\n  };\n\n  const drainThenExit = (ws: WebSocket, code: number, reason: string): void => {\n    const start = Date.now();\n    const tick = (): void => {\n      const drained = ws.bufferedAmount === 0 || ws.readyState !== WS_OPEN;\n      if (drained || Date.now() - start >= 5_000) {\n        // Flush the on-disk log so a clean shutdown/detach leaves a complete\n        // event-log.ndjson for any later replay recovery.\n        void flushPendingEventsToDisk().finally(() => {\n          try {\n            ws.close(code, reason);\n          } finally {\n            exit();\n          }\n        });\n        return;\n      }\n      setTimeout(tick, 10).unref();\n    };\n    tick();\n  };\n\n  wss.on('listening', () => {\n    const addr = wss.address();\n    currentBoundPort = typeof addr === 'object' && addr ? addr.port : 0;\n    currentTurnState = 'waiting';\n    void writeBridgeMeta('waiting');\n    stdout.write(\n      JSON.stringify({\n        type: 'bridge-ready',\n        port: currentBoundPort,\n      }) + '\\n',\n    );\n    options.onListening?.(currentBoundPort);\n  });\n\n  wss.on('connection', (ws: WebSocket, req: { url?: string }) => {\n    const url = new URL(req.url ?? '/', 'http://localhost');\n    if (url.searchParams.get('agent_bridge_token') !== expectedToken) {\n      ws.close(1008, 'unauthorized');\n      return;\n    }\n\n    // Single-flight: a fresh authorized connection *replaces* the active one\n    // (the host reconnecting after a drop). The previous socket's close is a\n    // no-op below because it is no longer `activeSocket`.\n    activeSocket = ws;\n\n    // Announce liveness the instant we accept. Some sandbox runtimes complete\n    // the host-side WS handshake before the connection is forwarded here; the\n    // host waits for this frame before sending `start`/`resume`.\n    sendControl({\n      type: 'bridge-hello',\n      state: currentTurnState,\n      lastSeq: seqCounter,\n    });\n\n    ws.on('message', (raw: ArrayBufferLike | string) => {\n      let parsed: TStart | InboundControl;\n      try {\n        const text =\n          typeof raw === 'string' ? raw : Buffer.from(raw).toString('utf8');\n        parsed = JSON.parse(text) as TStart | InboundControl;\n      } catch (err) {\n        sendControl({\n          type: 'error',\n          error: `protocol parse error: ${(err as Error).message}`,\n        });\n        return;\n      }\n      void handleInbound(parsed, ws);\n    });\n\n    ws.on('close', () => {\n      // Only the *current* socket's close matters. A stale socket (already\n      // replaced by a reconnect) closing is a no-op. Crucially we do NOT abort\n      // the in-flight turn — it keeps running and its events accumulate in the\n      // log for replay when the host reconnects.\n      if (activeSocket === ws) {\n        activeSocket = undefined;\n      }\n    });\n\n    ws.on('error', () => {\n      // 'close' follows; nothing to do beyond keeping the process alive.\n    });\n  });\n\n  // Surface bridge-internal crashes to the host instead of dying silently.\n  process.on('uncaughtException', err => {\n    emit({ type: 'error', error: serialiseError(err) });\n  });\n  process.on('unhandledRejection', err => {\n    emit({ type: 'error', error: serialiseError(err) });\n  });\n\n  await new Promise<void>((resolve, reject) => {\n    if (wss.address() != null) {\n      resolve();\n      return;\n    }\n\n    wss.once('listening', resolve);\n    wss.once('error', reject);\n  });\n\n  return {\n    port: currentBoundPort,\n    close: () =>\n      new Promise<void>(resolve => {\n        wss.close(() => resolve());\n      }),\n  };\n}\n\nfunction serialiseError(err: unknown): unknown {\n  if (err instanceof Error) {\n    return { name: err.name, message: err.message, stack: err.stack };\n  }\n  return err;\n}\n","// Long-running process that runs alongside the `codex` CLI in the sandbox.\n// The generic transport — WebSocket server, token auth, single-flight\n// reconnect, the in-memory event log + `seq`, resume replay, and the\n// lifecycle/meta files — lives in the shared `@ai-sdk/harness/bridge` runtime.\n// This file supplies only the Codex-specific turn driver.\n//\n// Host-defined tools are routed through an HTTP relay bound to\n// `127.0.0.1:0`. The codex CLI spawns `host-tool-mcp.mjs` (shipped alongside\n// this file) as a stdio MCP server; the shim POSTs each tool call to the\n// relay, which emits `tool-call` to the host and waits for the matching\n// `tool-result`.\n\nimport {\n  runBridge,\n  type BridgeEvent,\n  type BridgeTurn,\n} from '@ai-sdk/harness/bridge';\nimport type { HarnessV1BuiltinToolName } from '@ai-sdk/harness';\nimport type { StartMessage } from '../codex-bridge-protocol';\nimport { randomUUID } from 'node:crypto';\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport { createServer, type Server } from 'node:http';\n// Temporary workaround for upstream codex MCP-tool bug — see ./cli-relay.ts\nimport {\n  CLI_SHIM_FILENAME,\n  buildCliShimScript,\n  parseToolRelayCommand,\n} from './cli-relay';\nimport {\n  ToolRelayAuthorizer,\n  ToolRelayPendingCalls,\n  isToolRelayRequestFromAllowedProcess,\n  type ToolRelayCall,\n} from './tool-relay-auth';\nimport { argv, env as procEnv, stdout } from 'node:process';\n\n/*\n * CONSTRAINT — the third-party imports below are NEVER bundled into the\n * compiled `bridge/index.mjs`. They are declared `external` in\n * tsup.config.ts and resolved at runtime from the node_modules that this\n * bridge installs *inside the sandbox* from `src/bridge/package.json` (and\n * its pinned `pnpm-lock.yaml`). That bridge package.json — NOT this host\n * package — is the single source of truth for these packages and their\n * versions; the published `@ai-sdk/harness-codex` package does not provide\n * them at runtime.\n *\n * When adding or changing a third-party import here you MUST keep all three\n * in sync, or the bridge will either get the dependency bundled in or fail\n * to resolve it in the sandbox:\n *   1. the import statement below,\n *   2. the `external` array in tsup.config.ts, and\n *   3. the dependency entry in `src/bridge/package.json`.\n */\nimport * as codexSdkModule from '@openai/codex-sdk';\n\n/*\n * Native Codex tool name → cross-harness common name. Tools outside this map\n * (e.g. MCP tools the model invokes by name) have no common equivalent; their\n * native name is forwarded as-is on `tool-call` events.\n */\nconst NATIVE_TO_COMMON: Readonly<Record<string, HarnessV1BuiltinToolName>> = {\n  shell: 'bash',\n  web_search: 'webSearch',\n};\n\nfunction toCommonName(nativeName: string): HarnessV1BuiltinToolName | string {\n  return NATIVE_TO_COMMON[nativeName] ?? nativeName;\n}\n\nconst args = parseArgs(argv.slice(2));\nconst workdir = requireArg({ value: args.workdir, name: '--workdir' });\nconst bridgeStateDir = requireArg({\n  value: args.bridgeStateDir,\n  name: '--bridge-state-dir',\n});\nconst cliShimDir = requireArg({\n  value: args.cliShimDir,\n  name: '--cli-shim-dir',\n});\nconst bootstrapDir = args.bootstrapDir ?? workdir;\nconst HARNESS_CLIENT_APP = procEnv.AI_SDK_HARNESS_CLIENT_APP;\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nconst codexSdk = codexSdkModule as any;\n\n// Codex thread id — survives across turns within this bridge process and is\n// returned to the host on `detach` so a future process can resume the thread.\nconst threadState: { id: string | undefined } = { id: undefined };\n\nawait runBridge<StartMessage>({\n  bridgeType: 'codex',\n  bridgeStateDir,\n  onStart: runTurn,\n  onDetach: () => (threadState.id ? { threadId: threadState.id } : {}),\n});\n\ntype Emit = (msg: Record<string, unknown>) => void;\ntype ToolRelay = {\n  port: number;\n  close(): void;\n  authorizeToolCall(call: ToolRelayCall): void;\n  authorizeAnyToolCall(): void;\n};\n\nasync function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {\n  const emit: Emit = msg => turn.emit(msg as BridgeEvent);\n\n  // Cross-process resume: the host carries the threadId we returned on detach.\n  // Seed `threadState.id` so the codex SDK call below takes the `resumeThread`\n  // branch.\n  if (\n    typeof start.resumeThreadId === 'string' &&\n    start.resumeThreadId.length > 0\n  ) {\n    threadState.id = start.resumeThreadId;\n  }\n\n  /*\n   * Known limitation: codex CLI does not currently surface MCP tools to the\n   * model in `codex exec --experimental-json` mode (the path the\n   * `@openai/codex-sdk` uses). The MCP handshake completes and `tools/list`\n   * returns the host tool, but codex never registers it as a model-callable\n   * function. Built-in MCP-resource accessors (`list_mcp_resources` etc.) are\n   * exposed; tools are not. Tracked upstream at\n   * https://github.com/openai/codex/issues/19425.\n   *\n   * Until that's fixed, host tools are made available to the model via a\n   * separate CLI-relay workaround (see `./cli-relay.ts`). The MCP server\n   * config below is kept so that the day codex starts exposing MCP tools\n   * properly, host tools work both ways. Writing the shim here, adding matching\n   * prompt guidance in the host adapter, and filtering the shim command below\n   * implement the workaround and can be removed once the upstream bug is fixed.\n   */\n  const mcpServers: Record<string, unknown> = {};\n  let relay: ToolRelay | undefined;\n  let cliShimPath: string | undefined;\n  if (start.tools && start.tools.length > 0) {\n    cliShimPath = `${cliShimDir}/${CLI_SHIM_FILENAME}`;\n    relay = await startToolRelay({\n      allowedScriptPaths: [cliShimPath, `${bootstrapDir}/host-tool-mcp.mjs`],\n      tools: start.tools,\n      emit,\n      requestToolResult: turn.requestToolResult,\n    });\n    mcpServers['harness-tools'] = {\n      enabled: true,\n      command: 'node',\n      args: [`${bootstrapDir}/host-tool-mcp.mjs`],\n      env: {\n        TOOL_SCHEMAS: JSON.stringify(\n          start.tools.map(t => ({\n            name: t.name,\n            description: t.description,\n            inputSchema: t.inputSchema,\n          })),\n        ),\n        TOOL_RELAY_URL: `http://127.0.0.1:${relay.port}`,\n      },\n    };\n    // Temporary workaround for upstream codex MCP-tool bug — see ./cli-relay.ts\n    await mkdir(cliShimDir, { recursive: true });\n    await writeFile(\n      cliShimPath,\n      buildCliShimScript({ relayPort: relay.port }),\n      'utf8',\n    );\n  }\n\n  const codexConfig: Record<string, unknown> = {};\n  if (Object.keys(mcpServers).length > 0) codexConfig.mcp_servers = mcpServers;\n\n  const gatewayBaseUrl = procEnv.AI_GATEWAY_BASE_URL;\n  const hasGatewayAuth = Boolean(procEnv.AI_GATEWAY_API_KEY || gatewayBaseUrl);\n  if (hasGatewayAuth && !gatewayBaseUrl) {\n    throw new Error(\n      'AI Gateway auth was selected but AI_GATEWAY_BASE_URL is missing from the Codex bridge environment.',\n    );\n  }\n  const apiBaseUrl = hasGatewayAuth ? gatewayBaseUrl : procEnv.OPENAI_BASE_URL;\n  if (apiBaseUrl) {\n    codexConfig.preferred_auth_method = 'apikey';\n    codexConfig.model_provider = 'agent_bridge_openai';\n    codexConfig.model_providers = {\n      agent_bridge_openai: {\n        name: procEnv.CODEX_MODEL_PROVIDER_NAME || 'Agent Bridge OpenAI',\n        base_url: apiBaseUrl,\n        env_key: 'CODEX_API_KEY',\n        wire_api: 'responses',\n        supports_websockets: false,\n        ...(hasGatewayAuth && HARNESS_CLIENT_APP\n          ? {\n              http_headers: {\n                'User-Agent': HARNESS_CLIENT_APP,\n                'x-client-app': HARNESS_CLIENT_APP,\n              },\n            }\n          : {}),\n      },\n    };\n  }\n  const usesConfiguredModelProvider =\n    typeof codexConfig.model_provider === 'string';\n\n  const codex = new codexSdk.Codex({\n    ...(procEnv.CODEX_API_KEY ? { apiKey: procEnv.CODEX_API_KEY } : {}),\n    ...(!usesConfiguredModelProvider && apiBaseUrl\n      ? { baseUrl: apiBaseUrl }\n      : {}),\n    env: Object.fromEntries(\n      Object.entries(procEnv).filter(\n        (entry): entry is [string, string] => typeof entry[1] === 'string',\n      ),\n    ),\n    ...(Object.keys(codexConfig).length > 0 ? { config: codexConfig } : {}),\n  });\n\n  const threadOptions = {\n    ...(start.model ? { model: start.model } : {}),\n    sandboxMode: 'danger-full-access',\n    approvalPolicy: 'never',\n    workingDirectory: workdir,\n    skipGitRepoCheck: true,\n    ...(start.reasoningEffort\n      ? { modelReasoningEffort: start.reasoningEffort }\n      : {}),\n    webSearchMode: start.webSearch ? 'live' : 'disabled',\n  };\n  const thread = threadState.id\n    ? codex.resumeThread(threadState.id, threadOptions)\n    : codex.startThread(threadOptions);\n\n  emit({ type: 'stream-start' });\n\n  const userMessage = start.prompt;\n  let turnUsage: Record<string, unknown> | undefined;\n  const textByItem = new Map<string, string>();\n  const reasoningByItem = new Map<string, string>();\n\n  try {\n    const { events } = await thread.runStreamed(userMessage, {\n      signal: turn.abortSignal,\n    });\n    for await (const event of events as AsyncIterable<CodexEvent>) {\n      if (turn.abortSignal.aborted) break;\n      if (\n        event.type === 'thread.started' &&\n        typeof event.thread_id === 'string'\n      ) {\n        threadState.id = event.thread_id;\n        // Announce to the host so it can include the id in resume state.\n        emit({ type: 'bridge-thread', threadId: event.thread_id });\n      }\n      // Temporary workaround for upstream codex MCP-tool bug — see ./cli-relay.ts\n      if (cliShimPath && event.item?.type === 'command_execution') {\n        const relayCall =\n          typeof event.item.command === 'string'\n            ? parseToolRelayCommand({\n                command: event.item.command,\n                cliShimPath,\n              })\n            : undefined;\n        if (event.type === 'item.started' && relay) {\n          if (relayCall) {\n            relay.authorizeToolCall(relayCall);\n          } else if (typeof event.item.command !== 'string') {\n            relay.authorizeAnyToolCall();\n          }\n        }\n        if (relayCall) {\n          continue;\n        }\n      }\n      if (relay && isHostMcpToolEvent(event)) {\n        const relayCall = relayCallFromCodexMcpEvent(event);\n        if (relayCall) relay.authorizeToolCall(relayCall);\n        continue;\n      }\n      translateAndEmit(event, {\n        send: emit,\n        textByItem,\n        reasoningByItem,\n        setTurnUsage: u => (turnUsage = u),\n      });\n    }\n  } catch (err) {\n    emit({ type: 'error', error: serialiseError(err) });\n    return;\n  } finally {\n    relay?.close();\n  }\n\n  emit({\n    type: 'finish',\n    finishReason: { unified: 'stop', raw: 'stop' },\n    totalUsage: turnUsage ?? defaultUsage(),\n  });\n\n  void turn.pendingUserMessages; // accepted but only consumed when codex supports streamed user input\n}\n\ntype CodexItem = {\n  type: string;\n  id?: string;\n  text?: string;\n  command?: string;\n  exit_code?: number;\n  aggregated_output?: string;\n  status?: 'in_progress' | 'completed' | 'failed';\n  server?: string;\n  tool?: string;\n  arguments?: unknown;\n  result?: { content?: unknown; structured_content?: unknown } | unknown;\n  error?: { message?: string };\n  query?: string;\n  message?: string;\n  changes?: ReadonlyArray<{\n    path: string;\n    kind: 'add' | 'delete' | 'update';\n  }>;\n};\n\nfunction extractMcpToolCallResult(item: CodexItem): unknown {\n  if (\n    item.result === undefined ||\n    item.result === null ||\n    typeof item.result !== 'object'\n  ) {\n    return item.error?.message ? { error: item.error.message } : null;\n  }\n  const result = item.result as {\n    content?: unknown;\n    structured_content?: unknown;\n  };\n  if (\n    result.structured_content !== undefined &&\n    result.structured_content !== null\n  ) {\n    return result.structured_content;\n  }\n  return result.content ?? null;\n}\n\ntype CodexEvent = {\n  type:\n    | 'thread.started'\n    | 'turn.completed'\n    | 'turn.failed'\n    | 'error'\n    | 'item.started'\n    | 'item.updated'\n    | 'item.completed';\n  item?: CodexItem;\n  usage?: Record<string, number>;\n  error?: { message: string };\n  message?: string;\n  thread_id?: string;\n};\n\nfunction isHostMcpToolEvent(event: CodexEvent): boolean {\n  return (\n    event.item?.type === 'mcp_tool_call' &&\n    event.item.server === 'harness-tools'\n  );\n}\n\nfunction relayCallFromCodexMcpEvent(\n  event: CodexEvent,\n): ToolRelayCall | undefined {\n  if (event.type !== 'item.started') return undefined;\n  const toolName = event.item?.tool;\n  if (!toolName) return undefined;\n  return {\n    toolName,\n    input: event.item?.arguments ?? {},\n  };\n}\n\nfunction translateAndEmit(\n  event: CodexEvent,\n  ctx: {\n    send: Emit;\n    textByItem: Map<string, string>;\n    reasoningByItem: Map<string, string>;\n    setTurnUsage: (u: Record<string, unknown>) => void;\n  },\n): void {\n  if (event.type === 'turn.completed') {\n    if (event.usage) ctx.setTurnUsage(mapUsage(event.usage));\n    ctx.send({\n      type: 'finish-step',\n      finishReason: { unified: 'stop', raw: 'stop' },\n      usage: event.usage ? mapUsage(event.usage) : defaultUsage(),\n    });\n    return;\n  }\n  if (event.type === 'turn.failed') {\n    ctx.send({\n      type: 'error',\n      error: event.error?.message ?? 'codex turn failed',\n    });\n    return;\n  }\n  if (event.type === 'error') {\n    ctx.send({ type: 'error', error: event.message ?? 'codex error' });\n    return;\n  }\n  if (!event.item) return;\n  const item = event.item;\n  const id = item.id ?? randomUUID();\n\n  if (item.type === 'agent_message' && typeof item.text === 'string') {\n    /*\n     * The presence of `id` in `textByItem` — not the `item.started` event —\n     * marks the text part as opened. Codex does not guarantee an\n     * `item.started` event carrying text precedes the first `item.updated`\n     * with text, so keying the `text-start` off the event type can emit a\n     * `text-delta` for a part that was never opened. Opening lazily on the\n     * first event with text keeps `text-start` before any `text-delta`.\n     */\n    if (!ctx.textByItem.has(id)) {\n      ctx.send({ type: 'text-start', id });\n      ctx.textByItem.set(id, '');\n    }\n    const last = ctx.textByItem.get(id) ?? '';\n    const next = item.text;\n    if (next.length > last.length) {\n      ctx.send({ type: 'text-delta', id, delta: next.slice(last.length) });\n      ctx.textByItem.set(id, next);\n    }\n    if (event.type === 'item.completed') ctx.send({ type: 'text-end', id });\n    return;\n  }\n\n  if (item.type === 'reasoning' && typeof item.text === 'string') {\n    if (!ctx.reasoningByItem.has(id)) {\n      ctx.send({ type: 'reasoning-start', id });\n      ctx.reasoningByItem.set(id, '');\n    }\n    const last = ctx.reasoningByItem.get(id) ?? '';\n    const next = item.text;\n    if (next.length > last.length) {\n      ctx.send({ type: 'reasoning-delta', id, delta: next.slice(last.length) });\n      ctx.reasoningByItem.set(id, next);\n    }\n    if (event.type === 'item.completed')\n      ctx.send({ type: 'reasoning-end', id });\n    return;\n  }\n\n  if (item.type === 'command_execution') {\n    const nativeName = 'shell';\n    if (event.type === 'item.started') {\n      ctx.send({\n        type: 'tool-call',\n        toolCallId: id,\n        toolName: toCommonName(nativeName),\n        nativeName,\n        input: JSON.stringify({ command: item.command ?? '' }),\n        providerExecuted: true,\n      });\n    } else if (event.type === 'item.completed') {\n      ctx.send({\n        type: 'tool-result',\n        toolCallId: id,\n        toolName: toCommonName(nativeName),\n        result: {\n          exitCode: item.exit_code ?? null,\n          output: item.aggregated_output ?? '',\n          status: item.status ?? 'completed',\n        },\n      });\n    }\n    return;\n  }\n\n  if (item.type === 'mcp_tool_call') {\n    const isHostTool = item.server === 'harness-tools';\n    if (event.type === 'item.started') {\n      ctx.send({\n        type: 'tool-call',\n        toolCallId: id,\n        toolName: item.tool ?? 'unknown',\n        ...(isHostTool ? {} : { nativeName: item.tool ?? 'unknown' }),\n        input: JSON.stringify(item.arguments ?? {}),\n        providerExecuted: !isHostTool,\n      });\n    } else if (event.type === 'item.completed') {\n      ctx.send({\n        type: 'tool-result',\n        toolCallId: id,\n        toolName: item.tool ?? 'unknown',\n        result: extractMcpToolCallResult(item),\n      });\n    }\n    return;\n  }\n\n  if (item.type === 'web_search') {\n    const nativeName = 'web_search';\n    if (event.type === 'item.started') {\n      ctx.send({\n        type: 'tool-call',\n        toolCallId: id,\n        toolName: toCommonName(nativeName),\n        nativeName,\n        input: JSON.stringify({ query: item.query ?? '' }),\n        providerExecuted: true,\n      });\n    } else if (event.type === 'item.completed') {\n      ctx.send({\n        type: 'tool-result',\n        toolCallId: id,\n        toolName: toCommonName(nativeName),\n        result: item.result ?? null,\n      });\n    }\n    return;\n  }\n\n  if (item.type === 'file_change' && event.type === 'item.completed') {\n    for (const change of item.changes ?? []) {\n      ctx.send({\n        type: 'file-change',\n        event:\n          change.kind === 'add'\n            ? 'create'\n            : change.kind === 'delete'\n              ? 'delete'\n              : 'modify',\n        path: change.path,\n      });\n    }\n    return;\n  }\n\n  if (item.type === 'error' && event.type === 'item.completed') {\n    ctx.send({\n      type: 'error',\n      error: (item as { message?: string }).message ?? 'codex item error',\n    });\n    return;\n  }\n}\n\nfunction mapUsage(usage: Record<string, number>): Record<string, unknown> {\n  const input = usage.input_tokens ?? 0;\n  const cacheRead = usage.cached_input_tokens ?? 0;\n  return {\n    inputTokens: {\n      total: input,\n      noCache: Math.max(0, input - cacheRead),\n      cacheRead,\n      cacheWrite: 0,\n    },\n    outputTokens: {\n      total: usage.output_tokens ?? 0,\n      text: usage.output_tokens ?? 0,\n    },\n  };\n}\n\nfunction defaultUsage(): Record<string, unknown> {\n  return {\n    inputTokens: { total: 0, noCache: 0, cacheRead: 0, cacheWrite: 0 },\n    outputTokens: { total: 0, text: 0 },\n  };\n}\n\n/**\n * Tool relay — HTTP server on 127.0.0.1:0. The MCP stdio shim spawned by\n * codex POSTs each tool invocation here; the relay forwards the call to the\n * host (via the shared runtime's `emit`), awaits the matching `tool-result`\n * (via `requestToolResult`), and responds with `{ result }`.\n */\nasync function startToolRelay({\n  allowedScriptPaths,\n  tools,\n  emit,\n  requestToolResult,\n}: {\n  allowedScriptPaths: ReadonlyArray<string>;\n  tools: ReadonlyArray<{ name: string }>;\n  emit: Emit;\n  requestToolResult: (\n    toolCallId: string,\n  ) => Promise<{ output: unknown; isError?: boolean }>;\n}): Promise<ToolRelay> {\n  const toolNames = new Set(tools.map(t => t.name));\n  const allowedScriptPathSet = new Set(allowedScriptPaths);\n  const authorizer = new ToolRelayAuthorizer();\n  const pendingCalls = new ToolRelayPendingCalls();\n\n  const server = createServer(async (req, res) => {\n    try {\n      if (req.method !== 'POST' || req.url !== '/') {\n        res.writeHead(401, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'unauthorized tool relay request' }));\n        return;\n      }\n      const chunks: Buffer[] = [];\n      for await (const chunk of req) {\n        chunks.push(chunk as Buffer);\n      }\n      const body = Buffer.concat(chunks).toString('utf8');\n      const { requestId, toolName, input } = JSON.parse(body) as {\n        requestId: string;\n        toolName: string;\n        input: unknown;\n      };\n\n      if (!toolNames.has(toolName)) {\n        res.writeHead(403, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({ error: `Tool \"${toolName}\" is not available` }),\n        );\n        return;\n      }\n      const relayCall = { toolName, input };\n      const authorized =\n        authorizer.consumeToolCall(relayCall) ||\n        (await isToolRelayRequestFromAllowedProcess({\n          socket: req.socket,\n          allowedScriptPaths: allowedScriptPathSet,\n        }));\n      if (!authorized) {\n        res.writeHead(401, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'unauthorized tool relay request' }));\n        return;\n      }\n\n      const { result } = pendingCalls.begin({\n        call: relayCall,\n        run: async () => {\n          emit({\n            type: 'tool-call',\n            toolCallId: requestId,\n            toolName,\n            input: JSON.stringify(input ?? {}),\n            providerExecuted: false,\n          });\n\n          const toolResult = await requestToolResult(requestId);\n          emit({\n            type: 'tool-result',\n            toolCallId: requestId,\n            toolName,\n            result: toolResult.output ?? null,\n            isError: !!toolResult.isError,\n          });\n          return toolResult;\n        },\n      });\n      const { output } = await result;\n\n      res.writeHead(200, { 'Content-Type': 'application/json' });\n      res.end(JSON.stringify({ result: output }));\n    } catch (error) {\n      res.writeHead(500, { 'Content-Type': 'application/json' });\n      res.end(\n        JSON.stringify({\n          error: error instanceof Error ? error.message : String(error),\n        }),\n      );\n    }\n  });\n\n  await new Promise<void>(resolve =>\n    server.listen(0, '127.0.0.1', () => resolve()),\n  );\n  const address = server.address();\n  if (!address || typeof address === 'string') {\n    throw new Error('tool relay did not expose a numeric port');\n  }\n  return {\n    port: address.port,\n    close: () => closeServer(server),\n    authorizeToolCall: call => authorizer.authorizeToolCall(call),\n    authorizeAnyToolCall: () => authorizer.authorizeAnyToolCall(),\n  };\n}\n\nfunction closeServer(server: Server): void {\n  try {\n    server.close();\n  } catch {}\n}\n\nfunction parseArgs(args: string[]): {\n  workdir?: string;\n  bridgeStateDir?: string;\n  bootstrapDir?: string;\n  cliShimDir?: string;\n} {\n  const out: {\n    workdir?: string;\n    bridgeStateDir?: string;\n    bootstrapDir?: string;\n    cliShimDir?: string;\n  } = {};\n  for (let i = 0; i < args.length; i++) {\n    if (args[i] === '--workdir' && i + 1 < args.length) {\n      out.workdir = args[++i];\n    } else if (args[i] === '--bridge-state-dir' && i + 1 < args.length) {\n      out.bridgeStateDir = args[++i];\n    } else if (args[i] === '--bootstrap-dir' && i + 1 < args.length) {\n      out.bootstrapDir = args[++i];\n    } else if (args[i] === '--cli-shim-dir' && i + 1 < args.length) {\n      out.cliShimDir = args[++i];\n    }\n  }\n  return out;\n}\n\nfunction serialiseError(err: unknown): unknown {\n  if (err instanceof Error) {\n    return { name: err.name, message: err.message, stack: err.stack };\n  }\n  return err;\n}\n\nfunction emitFatal(message: string): never {\n  stdout.write(JSON.stringify({ type: 'bridge-fatal', message }) + '\\n');\n  process.exit(1);\n}\n\nfunction requireArg({\n  value,\n  name,\n}: {\n  value: string | undefined;\n  name: string;\n}): string {\n  if (!value) {\n    emitFatal(`Missing ${name} argument.`);\n  }\n  return value;\n}\n","/*\n * Temporary workaround for upstream codex CLI bug\n * https://github.com/openai/codex/issues/19425 — MCP tools registered via\n * `mcp_servers.*` are not exposed to the model in `codex exec --experimental-json`\n * mode (which is what `@openai/codex-sdk` uses). The MCP handshake completes\n * and `tools/list` succeeds, but codex never registers the tools as\n * model-callable functions.\n *\n * Until that's fixed upstream, this file implements a CLI-based relay:\n *\n *   1. A small Node script is written into harness-owned session state at turn\n *      start (`buildCliShimScript`). It accepts `<toolName> <jsonInput>` as\n *      argv, POSTs to the same HTTP relay the MCP shim uses, and prints the\n *      result to stdout.\n *\n *   2. Tool descriptions and invocation instructions are injected into the\n *      initial user prompt by the host adapter, telling the model to call host\n *      tools by running `node <shim-path> <toolName> '<jsonInput>'` via its\n *      built-in `bash` tool.\n *\n *   3. The bridge's event loop suppresses the matching `command_execution`\n *      events (`isToolRelayCommand`) so callers receive clean `tool-call` /\n *      `tool-result` events from the HTTP relay rather than seeing the\n *      relay invocations as raw bash commands.\n *\n * Once #19425 is fixed and MCP tools are properly exposed in exec mode, the\n * three hookpoints in `bridge/index.ts` can be removed along with this file.\n */\nexport const CLI_SHIM_FILENAME = 'harness-tool.mjs';\n\nexport function buildCliShimScript({\n  relayPort,\n}: {\n  relayPort: number;\n}): string {\n  return `#!/usr/bin/env node\nconst [toolName, inputJson = '{}'] = process.argv.slice(2);\nif (!toolName) {\n  console.error('Usage: harness-tool <tool_name> <json_input>');\n  process.exit(64);\n}\nlet input;\ntry {\n  input = JSON.parse(inputJson);\n} catch (error) {\n  console.error('Invalid JSON input: ' + (error instanceof Error ? error.message : String(error)));\n  process.exit(64);\n}\nconst requestId = 'cli-' + Date.now() + '-' + Math.random().toString(16).slice(2);\nconst response = await fetch('http://127.0.0.1:${relayPort}', {\n  method: 'POST',\n  headers: { 'Content-Type': 'application/json' },\n  body: JSON.stringify({ requestId, toolName, input }),\n});\nconst text = await response.text();\nlet payload;\ntry {\n  payload = text ? JSON.parse(text) : {};\n} catch {\n  payload = { error: text };\n}\nif (!response.ok || payload.error) {\n  console.error(String(payload.error ?? ('tool relay failed with HTTP ' + response.status)));\n  process.exit(1);\n}\nconsole.log(JSON.stringify(payload.result ?? payload, null, 2));\n`;\n}\n\nexport function isToolRelayCommand({\n  command,\n  cliShimPath,\n}: {\n  command: string;\n  cliShimPath: string;\n}): boolean {\n  return parseToolRelayCommand({ command, cliShimPath }) !== undefined;\n}\n\nexport function parseToolRelayCommand({\n  command,\n  cliShimPath,\n}: {\n  command: string;\n  cliShimPath: string;\n}): { toolName: string; input: unknown } | undefined {\n  return parseToolRelayCommandInternal({ command, cliShimPath, depth: 0 });\n}\n\nfunction parseToolRelayCommandInternal({\n  command,\n  cliShimPath,\n  depth,\n}: {\n  command: string;\n  cliShimPath: string;\n  depth: number;\n}): { toolName: string; input: unknown } | undefined {\n  const argv = parseShellWords(command);\n  if (!argv) return undefined;\n\n  const relayCall = parseDirectToolRelayArgv({ argv, cliShimPath });\n  if (relayCall) return relayCall;\n\n  const innerCommand = extractShellEvalCommand(argv);\n  if (!innerCommand || depth >= 2) return undefined;\n  return parseToolRelayCommandInternal({\n    command: innerCommand,\n    cliShimPath,\n    depth: depth + 1,\n  });\n}\n\nfunction parseDirectToolRelayArgv({\n  argv,\n  cliShimPath,\n}: {\n  argv: string[];\n  cliShimPath: string;\n}): { toolName: string; input: unknown } | undefined {\n  if (argv.length < 3 || argv.length > 4) return undefined;\n  if (argv[0] !== 'node' || argv[1] !== cliShimPath) return undefined;\n  const toolName = argv[2];\n  if (!toolName) return undefined;\n  try {\n    return { toolName, input: JSON.parse(argv[3] ?? '{}') };\n  } catch {\n    return undefined;\n  }\n}\n\nfunction extractShellEvalCommand(argv: string[]): string | undefined {\n  if (argv.length !== 3) return undefined;\n  const shellName = argv[0].split('/').at(-1);\n  if (shellName !== 'bash' && shellName !== 'sh' && shellName !== 'zsh') {\n    return undefined;\n  }\n  if (argv[1] !== '-c' && argv[1] !== '-lc') return undefined;\n  return argv[2];\n}\n\nfunction parseShellWords(command: string): string[] | undefined {\n  const words: string[] = [];\n  let current = '';\n  let quote: '\"' | \"'\" | undefined;\n  let hasCurrent = false;\n\n  const pushCurrent = () => {\n    if (!hasCurrent) return;\n    words.push(current);\n    current = '';\n    hasCurrent = false;\n  };\n\n  for (let i = 0; i < command.length; i++) {\n    const char = command[i];\n    if (quote === \"'\") {\n      if (char === \"'\") {\n        quote = undefined;\n      } else {\n        current += char;\n      }\n      hasCurrent = true;\n      continue;\n    }\n    if (quote === '\"') {\n      if (char === '\"') {\n        quote = undefined;\n      } else if (char === '\\\\' && i + 1 < command.length) {\n        current += command[++i];\n      } else {\n        current += char;\n      }\n      hasCurrent = true;\n      continue;\n    }\n    if (/\\s/.test(char)) {\n      pushCurrent();\n      continue;\n    }\n    if (char === '\"' || char === \"'\") {\n      quote = char;\n      hasCurrent = true;\n      continue;\n    }\n    if (char === '\\\\' && i + 1 < command.length) {\n      current += command[++i];\n      hasCurrent = true;\n      continue;\n    }\n    if (/[;&|<>()`$]/.test(char)) return undefined;\n    current += char;\n    hasCurrent = true;\n  }\n  if (quote) return undefined;\n  pushCurrent();\n  return words;\n}\n","import { readdir, readFile, readlink } from 'node:fs/promises';\nimport type { Socket } from 'node:net';\n\nexport type ToolRelayCall = {\n  toolName: string;\n  input: unknown;\n};\n\nexport type ToolRelayResult = {\n  output: unknown;\n  isError?: boolean;\n};\n\nexport class ToolRelayAuthorizer {\n  private readonly ttlMs: number;\n  private readonly now: () => number;\n  private readonly authorizations: Array<{\n    key?: string;\n    expiresAt: number;\n  }> = [];\n\n  constructor({\n    ttlMs = 10_000,\n    now = Date.now,\n  }: {\n    ttlMs?: number;\n    now?: () => number;\n  } = {}) {\n    this.ttlMs = ttlMs;\n    this.now = now;\n  }\n\n  authorizeToolCall(call: ToolRelayCall): void {\n    this.pruneExpired();\n    this.authorizations.push({\n      key: toolRelayCallKey(call),\n      expiresAt: this.now() + this.ttlMs,\n    });\n  }\n\n  authorizeAnyToolCall(): void {\n    this.pruneExpired();\n    this.authorizations.push({\n      expiresAt: this.now() + this.ttlMs,\n    });\n  }\n\n  consumeToolCall(call: ToolRelayCall): boolean {\n    this.pruneExpired();\n    const key = toolRelayCallKey(call);\n    let index = this.authorizations.findIndex(auth => auth.key === key);\n    if (index === -1) {\n      index = this.authorizations.findIndex(auth => auth.key === undefined);\n    }\n    if (index === -1) return false;\n    this.authorizations.splice(index, 1);\n    return true;\n  }\n\n  private pruneExpired(): void {\n    const now = this.now();\n    for (let i = this.authorizations.length - 1; i >= 0; i--) {\n      if (this.authorizations[i].expiresAt <= now) {\n        this.authorizations.splice(i, 1);\n      }\n    }\n  }\n}\n\nexport class ToolRelayPendingCalls {\n  private readonly calls = new Map<string, Promise<ToolRelayResult>>();\n\n  begin({\n    call,\n    run,\n  }: {\n    call: ToolRelayCall;\n    run: () => Promise<ToolRelayResult>;\n  }): { result: Promise<ToolRelayResult>; isNew: boolean } {\n    const key = toolRelayCallKey(call);\n    const existing = this.calls.get(key);\n    if (existing) return { result: existing, isNew: false };\n\n    const result = run();\n    this.calls.set(key, result);\n    void result\n      .finally(() => {\n        if (this.calls.get(key) === result) {\n          this.calls.delete(key);\n        }\n      })\n      .catch(() => {});\n    return { result, isNew: true };\n  }\n}\n\nfunction toolRelayCallKey({ toolName, input }: ToolRelayCall): string {\n  return `${toolName}\\0${canonicalJson(input ?? {})}`;\n}\n\nfunction canonicalJson(value: unknown): string {\n  return JSON.stringify(normalizeJsonValue(value));\n}\n\nfunction normalizeJsonValue(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map(normalizeJsonValue);\n  }\n  if (value && typeof value === 'object') {\n    return Object.fromEntries(\n      Object.entries(value as Record<string, unknown>)\n        .filter(([, entryValue]) => entryValue !== undefined)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([key, entryValue]) => [key, normalizeJsonValue(entryValue)]),\n    );\n  }\n  return value;\n}\n\nexport async function isToolRelayRequestFromAllowedProcess({\n  socket,\n  allowedScriptPaths,\n}: {\n  socket: Socket;\n  allowedScriptPaths: ReadonlySet<string>;\n}): Promise<boolean> {\n  if (process.platform !== 'linux') return false;\n  if (!socket.remotePort || !socket.localPort) return false;\n\n  const inode = await findTcpSocketInode({\n    clientPort: socket.remotePort,\n    serverPort: socket.localPort,\n  });\n  if (!inode) return false;\n\n  const cmdline = await findProcessCmdlineForSocketInode({ inode });\n  return cmdline?.some(arg => allowedScriptPaths.has(arg)) ?? false;\n}\n\nasync function findTcpSocketInode({\n  clientPort,\n  serverPort,\n}: {\n  clientPort: number;\n  serverPort: number;\n}): Promise<string | undefined> {\n  for (const tablePath of ['/proc/net/tcp', '/proc/net/tcp6']) {\n    const table = await readFile(tablePath, 'utf8').catch(() => undefined);\n    if (!table) continue;\n    for (const line of table.split('\\n').slice(1)) {\n      const columns = line.trim().split(/\\s+/);\n      if (columns.length < 10) continue;\n      const local = parseProcNetAddress(columns[1]);\n      const remote = parseProcNetAddress(columns[2]);\n      if (\n        local?.port === clientPort &&\n        remote?.port === serverPort &&\n        columns[9] !== '0'\n      ) {\n        return columns[9];\n      }\n    }\n  }\n  return undefined;\n}\n\nfunction parseProcNetAddress(value: string): { port: number } | undefined {\n  const [, portHex] = value.split(':');\n  if (!portHex) return undefined;\n  return { port: Number.parseInt(portHex, 16) };\n}\n\nasync function findProcessCmdlineForSocketInode({\n  inode,\n}: {\n  inode: string;\n}): Promise<string[] | undefined> {\n  const procEntries = await readdir('/proc', { withFileTypes: true }).catch(\n    () => [],\n  );\n  for (const entry of procEntries) {\n    if (!entry.isDirectory() || !/^\\d+$/.test(entry.name)) continue;\n    const fdDir = `/proc/${entry.name}/fd`;\n    const fds = await readdir(fdDir).catch(() => []);\n    for (const fd of fds) {\n      const target = await readlink(`${fdDir}/${fd}`).catch(() => undefined);\n      if (target !== `socket:[${inode}]`) continue;\n      const cmdline = await readFile(`/proc/${entry.name}/cmdline`, 'utf8')\n        .then(value => value.split('\\0').filter(Boolean))\n        .catch(() => undefined);\n      if (cmdline) return cmdline;\n    }\n  }\n  return undefined;\n}\n"],"mappings":";AAQA,SAAS,YAAY,OAAO,iBAAiB;AAC7C,SAAS,YAAY,oBAAoB;AACzC,SAAS,OAAO,SAAS,KAAK,cAAc;AAC5C,SAAS,uBAAuC;AAqBhD,IAAM,qBAAuD;EAC3D,OAAO;EACP,MAAM;EACN,MAAM;EACN,OAAO;EACP,OAAO;AACT;AAGA,SAAS,iBACP,SACA,WACS;AACT,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAC7C,SAAO,QAAQ;IACb,CAAA,WAAU,cAAc,UAAU,UAAU,WAAW,GAAG,MAAM,GAAG;EACrE;AACF;AAEA,SAAS,kBAAkB,KAIzB;AACA,MAAI,eAAe,OAAO;AACxB,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,OAAO,IAAI,MAAM;EAClE;AACA,SAAO,EAAE,SAAS,OAAO,GAAG,EAAE;AAChC;AAEA,SAAS,aAAa,OAAiD;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,MACX,MAAM,GAAG,EACT,IAAI,CAAA,SAAQ,KAAK,KAAK,CAAC,EACvB,OAAO,OAAO;AACjB,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAEA,IAAM,aAAa,oBAAI,IAAI,CAAC,KAAK,QAAQ,OAAO,IAAI,CAAC;AAsGrD,IAAM,UAAU;AAehB,eAAsB,UACpB,SACuB;AACvB,QAAM,EAAE,YAAY,gBAAAA,iBAAgB,SAAS,SAAS,IAAI;AAC1D,QAAM,gBAAgB,QAAQ,SAAS,QAAQ,wBAAwB;AACvE,QAAM,eACJ,QAAQ,QAAQ,SAAS,QAAQ,kBAAkB,KAAK,EAAE;AAE5D,QAAM,iBAAiB,GAAGA,eAAc;AACxC,QAAM,kBAAkB,GAAGA,eAAc;AACzC,QAAM,uBAAuB,GAAGA,eAAc;AAC9C,QAAM,eAAe,GAAGA,eAAc;AAEtC,MAAI;AACF,UAAM,MAAMA,iBAAgB,EAAE,WAAW,KAAK,CAAC;EACjD,QAAQ;EAER;AAGA,MAAI,mBAAmB;AACvB,MAAI,mBAAgC;AACpC,MAAI;AACJ,MAAI,cAAc;AAClB,MAAI;AACJ,MAAI;AAIJ,MAAI;AACJ,MAAI,0BAA0B;AAC9B,QAAM,kBAAkB,WAAW;KAChC,QAAQ,iBAAiB,IAAI,YAAY;EAC5C;AAMA,MAAI,aAAa;AACjB,MAAI,WAAiD,CAAC;AAUtD,MAAI,aAAa;AACjB,MAAI,eAAqC;AAEzC,QAAM,oBAAoB,YAA2B;AACnD,WAAO,WAAW,SAAS,GAAG;AAC5B,YAAM,MAAM;AACZ,mBAAa;AACb,YAAM,WAAW,cAAc,GAAG,EAAE,MAAM,MAAM;MAGhD,CAAC;IACH;EACF;AAEA,QAAM,qBAAqB,MAAY;AACrC,QAAI,aAAc;AAClB,mBAAe,IAAI,QAAc,CAAA,YAAW;AAC1C,mBAAa,MAAM;AACjB,aAAK,kBAAkB,EAAE,QAAQ,OAAO;MAC1C,CAAC;IACH,CAAC,EAAE,QAAQ,MAAM;AACf,qBAAe;AACf,UAAI,WAAW,SAAS,GAAG;AACzB,2BAAmB;MACrB;IACF,CAAC;EACH;AAEA,QAAM,2BAA2B,YAA2B;AAC1D,QAAI,WAAW,SAAS,KAAK,CAAC,cAAc;AAC1C,yBAAmB;IACrB;AAIA,QAAI,WAAW;AACf,WAAO,UAAU;AACf,YAAM;AACN,iBAAW;IACb;EACF;AAUA,QAAM,iBAAiB,QAAQ,4BAA4B;AAC3D,MAAI,kBAAkB,WAAW,YAAY,GAAG;AAC9C,QAAI;AACF,YAAM,QAAQ,aAAa,cAAc,MAAM,EAC5C,MAAM,IAAI,EACV,IAAI,CAAA,SAAQ,KAAK,KAAK,CAAC,EACvB,OAAO,OAAO;AACjB,iBAAW,MAAM,IAAI,CAAA,UAAS;QAC5B,KAAM,KAAK,MAAM,IAAI,EAAsB;QAC3C;MACF,EAAE;AACF,mBAAa,SAAS,GAAG,EAAE,GAAG,OAAO;IACvC,QAAQ;AAGN,iBAAW,CAAC;AACZ,mBAAa;IACf;EACF;AAEA,QAAM,qBAAqB,oBAAI,IAG7B;AACF,QAAM,uBAAuB,oBAAI,IAG/B;AAGF,QAAM,kBAAkB,OAAO,UAAsC;AACnE,QAAI;AACF,YAAM;QACJ;QACA,KAAK,UAAU;UACb,MAAM;UACN,MAAM;UACN;UACA;QACF,CAAC;MACH;IACF,QAAQ;IAER;EACF;AAEA,QAAM,mBAAmB,OAAO,UAAkC;AAChE,QAAI;AACF,YAAM,aAAa,KAAK,UAAU,KAAK;AACvC,YAAM,UAAU,iBAAiB,UAAU;AAG3C,UAAI,CAAC,WAAW,oBAAoB,GAAG;AACrC,cAAM,UAAU,sBAAsB,UAAU;MAClD;IACF,QAAQ;IAER;EACF;AAGA,QAAM,cAAc,CAAC,QAAuC;AAC1D,QAAI,cAAc,eAAe,SAAS;AACxC,UAAI;AACF,qBAAa,KAAK,KAAK,UAAU,GAAG,CAAC;MACvC,QAAQ;MAER;IACF;EACF;AAEA,QAAM,OAAO,CAAC,UAA6B;AACzC,UAAM,MAAM,EAAE;AACd,UAAM,OAAO,KAAK,UAAU,EAAE,GAAG,OAAO,IAAI,CAAC;AAC7C,aAAS,KAAK,EAAE,KAAK,KAAK,CAAC;AAC3B,kBAAc,GAAG,IAAI;;AACrB,uBAAmB;AACnB,QAAI,cAAc,eAAe,SAAS;AACxC,UAAI;AACF,qBAAa,KAAK,IAAI;MACxB,QAAQ;MAGR;IACF;EACF;AAEA,QAAM,SAAS,CAAC,IAAe,aAA2B;AACxD,eAAW,SAAS,UAAU;AAC5B,UAAI,MAAM,MAAM,YAAY,GAAG,eAAe,SAAS;AACrD,WAAG,KAAK,MAAM,IAAI;MACpB;IACF;EACF;AAGA,QAAM,uBAAuB,CAC3B,OACA,cACY;AACZ,QAAI,CAAC,aAAa,QAAS,QAAO;AAClC,UAAM,YAAY,YAAY,SAAS;AACvC,QAAI,mBAAmB,KAAK,IAAI,mBAAmB,SAAS,EAAG,QAAO;AACtE,WAAO,iBAAiB,YAAY,YAAY,SAAS;EAC3D;AAUA,QAAM,iBAAiB,QAAQ,OAAO,MAAM,KAAK,QAAQ,MAAM;AAC/D,QAAM,iBAAiB,QAAQ,OAAO,MAAM,KAAK,QAAQ,MAAM;AAC/D,QAAM,wBAAwB,MAAY;AACxC,QAAI,wBAAyB;AAC7B,8BAA0B;AAC1B,UAAM,UAA8C;MAClD,QAAQ;MACR,QAAQ;IACV;AACA,UAAM,QACJ,CAAC,QAA6B,QAC9B,CAAC,OAAgB,UAAoB,OAA0B;AAC7D,UAAI,aAAa,SAAS;AACxB,YAAI;AACF,gBAAM,MAAM,OAAO,aAAa,WAAW,WAAW;AACtD,gBAAM,OACJ,OAAO,UAAU,WACb,QACA,OAAO,KAAK,KAAmB,EAAE;YAC/B;UACF;AACN,gBAAM,WAAW,QAAQ,MAAM,IAAI,KAAK,QAAQ,SAAS,IAAI;AAC7D,gBAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,kBAAQ,MAAM,IAAI,MAAM,IAAI,KAAK;AACjC,qBAAW,QAAQ,OAAO;AACxB,kBAAM,UAAU,KAAK,QAAQ,QAAQ,EAAE;AACvC,gBAAI,SAAS;AACX,mBAAK;gBACH,MAAM;gBACN,QAAQ;gBACR;gBACA,MAAM;cACR,CAAC;YACH;UACF;QACF,QAAQ;QAER;MACF;AACA,aAAQ;QACN;QACA;QACA;MACF;IACF;AACF,YAAQ,OAAO,QAAQ;MACrB;MACA;IACF;AACA,YAAQ,OAAO,QAAQ;MACrB;MACA;IACF;EACF;AAGA,QAAM,gBAAgB,OACpB,KACA,OACkB;AAClB,YAAQ,IAAI,MAAM;MAChB,KAAK,SAAS;AACZ,cAAM,YAAY;AAClB,sBAAc;AACd,mBAAW,CAAC;AAGZ,qBAAa;AACb,aAAK,UAAU,cAAc,EAAE,EAAE,MAAM,MAAM;QAAC,CAAC;AAC/C,oBAAY,IAAI,gBAAgB;AAChC,2BAAmB;AACnB,aAAK,iBAAiB,GAAG;AACzB,aAAK,gBAAgB,SAAS;AAC9B,cAAM,aAAc,IAAsC;AAC1D,sBAAc;UACZ,SAAS,YAAY,WAAW;UAChC,OACE,YAAY,SACX,QAAQ;UACX,YACE,YAAY,cACZ,aAAa,QAAQ,wBAAwB;QACjD;AACA,YAAI,YAAY,SAAS;AACvB,gCAAsB;QACxB;AACA,cAAM,OAAmB;UACvB;UACA,mBAAmB,CAAA,eACjB,IAAI,QAAQ,CAAA,YAAW;AACrB,+BAAmB,IAAI,YAAY,OAAO;UAC5C,CAAC;UACH,qBAAqB,CAAA,eACnB,IAAI,QAAQ,CAAA,YAAW;AACrB,iCAAqB,IAAI,YAAY,OAAO;UAC9C,CAAC;UACH,qBAAqB,CAAC;UACtB,aAAa,UAAU;UACvB;UACA,WAAW,CAAA,UAAS;AAClB,kBAAM,QAAQ,MAAM,SAAS;AAC7B,gBAAI,CAAC,qBAAqB,OAAO,MAAM,SAAS,EAAG;AACnD,iBAAK;cACH,MAAM;cACN;cACA,WAAW,MAAM;cACjB,SAAS,MAAM;cACf,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;cAC5C,GAAI,MAAM,UAAU,SAChB,EAAE,OAAO,kBAAkB,MAAM,KAAK,EAAE,IACxC,CAAC;YACP,CAAC;UACH;QACF;AACA,8BAAsB,KAAK;AAC3B,YAAI;AACF,gBAAM,QAAQ,KAAe,IAAI;QACnC,SAAS,KAAK;AACZ,eAAK,EAAE,MAAM,SAAS,OAAO,eAAe,GAAG,EAAE,CAAC;QACpD,UAAA;AACE,6BAAmB;AACnB,eAAK,gBAAgB,SAAS;QAChC;AACA;MACF;MACA,KAAK,eAAe;AAClB,cAAM,WAAW,mBAAmB,IAAI,IAAI,UAAU;AACtD,YAAI,UAAU;AACZ,6BAAmB,OAAO,IAAI,UAAU;AACxC,mBAAS,EAAE,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,CAAC;QACvD;AACA;MACF;MACA,KAAK,0BAA0B;AAC7B,cAAM,WAAW,qBAAqB,IAAI,IAAI,UAAU;AACxD,YAAI,UAAU;AACZ,+BAAqB,OAAO,IAAI,UAAU;AAC1C,mBAAS,EAAE,UAAU,IAAI,UAAU,QAAQ,IAAI,OAAO,CAAC;QACzD;AACA;MACF;MACA,KAAK;AACH,6BAAqB,KAAK,IAAI,IAAI;AAClC;MACF,KAAK;AACH,mBAAW,MAAM;AACjB;MACF,KAAK;AACH,eAAO,IAAI,IAAI,eAAe;AAC9B;MACF,KAAK;AACH,2BAAmB;AACnB,aAAK,gBAAgB,MAAM;AAC3B,sBAAc,IAAI,KAAM,UAAU;AAClC;MACF,KAAK,UAAU;AACb,2BAAmB;AACnB,aAAK,gBAAgB,MAAM;AAC3B,cAAM,OAAQ,MAAM,WAAW,KAAM,CAAC;AACtC,oBAAY,EAAE,MAAM,iBAAiB,KAAK,CAAC;AAC3C,sBAAc,IAAI,KAAM,QAAQ;AAChC;MACF;IACF;EACF;AAGA,OAAK,gBAAgB,MAAM;AAE3B,QAAM,MAAM,IAAI,gBAAgB,EAAE,MAAM,cAAc,MAAM,UAAU,CAAC;AAEvE,QAAM,OAAO,MAAY;AACvB,QAAI,QAAQ,QAAQ;AAClB,cAAQ,OAAO;AACf;IACF;AACA,QAAI,MAAM,MAAM,QAAQ,KAAK,CAAC,CAAC;AAC/B,eAAW,MAAM,QAAQ,KAAK,CAAC,GAAG,GAAI,EAAE,MAAM;EAChD;AAEA,QAAM,gBAAgB,CAAC,IAAe,MAAc,WAAyB;AAC3E,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,OAAO,MAAY;AACvB,YAAM,UAAU,GAAG,mBAAmB,KAAK,GAAG,eAAe;AAC7D,UAAI,WAAW,KAAK,IAAI,IAAI,SAAS,KAAO;AAG1C,aAAK,yBAAyB,EAAE,QAAQ,MAAM;AAC5C,cAAI;AACF,eAAG,MAAM,MAAM,MAAM;UACvB,UAAA;AACE,iBAAK;UACP;QACF,CAAC;AACD;MACF;AACA,iBAAW,MAAM,EAAE,EAAE,MAAM;IAC7B;AACA,SAAK;EACP;AAEA,MAAI,GAAG,aAAa,MAAM;AACxB,UAAM,OAAO,IAAI,QAAQ;AACzB,uBAAmB,OAAO,SAAS,YAAY,OAAO,KAAK,OAAO;AAClE,uBAAmB;AACnB,SAAK,gBAAgB,SAAS;AAC9B,WAAO;MACL,KAAK,UAAU;QACb,MAAM;QACN,MAAM;MACR,CAAC,IAAI;IACP;AACA,YAAQ,cAAc,gBAAgB;EACxC,CAAC;AAED,MAAI,GAAG,cAAc,CAAC,IAAe,QAA0B;AAC7D,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AACtD,QAAI,IAAI,aAAa,IAAI,oBAAoB,MAAM,eAAe;AAChE,SAAG,MAAM,MAAM,cAAc;AAC7B;IACF;AAKA,mBAAe;AAKf,gBAAY;MACV,MAAM;MACN,OAAO;MACP,SAAS;IACX,CAAC;AAED,OAAG,GAAG,WAAW,CAAC,QAAkC;AAClD,UAAI;AACJ,UAAI;AACF,cAAM,OACJ,OAAO,QAAQ,WAAW,MAAM,OAAO,KAAK,GAAG,EAAE,SAAS,MAAM;AAClE,iBAAS,KAAK,MAAM,IAAI;MAC1B,SAAS,KAAK;AACZ,oBAAY;UACV,MAAM;UACN,OAAO,yBAA0B,IAAc,OAAO;QACxD,CAAC;AACD;MACF;AACA,WAAK,cAAc,QAAQ,EAAE;IAC/B,CAAC;AAED,OAAG,GAAG,SAAS,MAAM;AAKnB,UAAI,iBAAiB,IAAI;AACvB,uBAAe;MACjB;IACF,CAAC;AAED,OAAG,GAAG,SAAS,MAAM;IAErB,CAAC;EACH,CAAC;AAGD,UAAQ,GAAG,qBAAqB,CAAA,QAAO;AACrC,SAAK,EAAE,MAAM,SAAS,OAAO,eAAe,GAAG,EAAE,CAAC;EACpD,CAAC;AACD,UAAQ,GAAG,sBAAsB,CAAA,QAAO;AACtC,SAAK,EAAE,MAAM,SAAS,OAAO,eAAe,GAAG,EAAE,CAAC;EACpD,CAAC;AAED,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,QAAI,IAAI,QAAQ,KAAK,MAAM;AACzB,cAAQ;AACR;IACF;AAEA,QAAI,KAAK,aAAa,OAAO;AAC7B,QAAI,KAAK,SAAS,MAAM;EAC1B,CAAC;AAED,SAAO;IACL,MAAM;IACN,OAAO,MACL,IAAI,QAAc,CAAA,YAAW;AAC3B,UAAI,MAAM,MAAM,QAAQ,CAAC;IAC3B,CAAC;EACL;AACF;AAEA,SAAS,eAAe,KAAuB;AAC7C,MAAI,eAAe,OAAO;AACxB,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,OAAO,IAAI,MAAM;EAClE;AACA,SAAO;AACT;;;AC1qBA,SAAS,kBAAkB;AAC3B,SAAS,SAAAC,QAAO,aAAAC,kBAAiB;AACjC,SAAS,oBAAiC;;;ACOnC,IAAM,oBAAoB;AAE1B,SAAS,mBAAmB;AAAA,EACjC;AACF,GAEW;AACT,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iDAcwC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkB1D;AAYO,SAAS,sBAAsB;AAAA,EACpC;AAAA,EACA;AACF,GAGqD;AACnD,SAAO,8BAA8B,EAAE,SAAS,aAAa,OAAO,EAAE,CAAC;AACzE;AAEA,SAAS,8BAA8B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AACF,GAIqD;AACnD,QAAMC,QAAO,gBAAgB,OAAO;AACpC,MAAI,CAACA,MAAM,QAAO;AAElB,QAAM,YAAY,yBAAyB,EAAE,MAAAA,OAAM,YAAY,CAAC;AAChE,MAAI,UAAW,QAAO;AAEtB,QAAM,eAAe,wBAAwBA,KAAI;AACjD,MAAI,CAAC,gBAAgB,SAAS,EAAG,QAAO;AACxC,SAAO,8BAA8B;AAAA,IACnC,SAAS;AAAA,IACT;AAAA,IACA,OAAO,QAAQ;AAAA,EACjB,CAAC;AACH;AAEA,SAAS,yBAAyB;AAAA,EAChC,MAAAA;AAAA,EACA;AACF,GAGqD;AACnD,MAAIA,MAAK,SAAS,KAAKA,MAAK,SAAS,EAAG,QAAO;AAC/C,MAAIA,MAAK,CAAC,MAAM,UAAUA,MAAK,CAAC,MAAM,YAAa,QAAO;AAC1D,QAAM,WAAWA,MAAK,CAAC;AACvB,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,WAAO,EAAE,UAAU,OAAO,KAAK,MAAMA,MAAK,CAAC,KAAK,IAAI,EAAE;AAAA,EACxD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,wBAAwBA,OAAoC;AACnE,MAAIA,MAAK,WAAW,EAAG,QAAO;AAC9B,QAAM,YAAYA,MAAK,CAAC,EAAE,MAAM,GAAG,EAAE,GAAG,EAAE;AAC1C,MAAI,cAAc,UAAU,cAAc,QAAQ,cAAc,OAAO;AACrE,WAAO;AAAA,EACT;AACA,MAAIA,MAAK,CAAC,MAAM,QAAQA,MAAK,CAAC,MAAM,MAAO,QAAO;AAClD,SAAOA,MAAK,CAAC;AACf;AAEA,SAAS,gBAAgB,SAAuC;AAC9D,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,MAAI;AACJ,MAAI,aAAa;AAEjB,QAAM,cAAc,MAAM;AACxB,QAAI,CAAC,WAAY;AACjB,UAAM,KAAK,OAAO;AAClB,cAAU;AACV,iBAAa;AAAA,EACf;AAEA,WAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,UAAM,OAAO,QAAQ,CAAC;AACtB,QAAI,UAAU,KAAK;AACjB,UAAI,SAAS,KAAK;AAChB,gBAAQ;AAAA,MACV,OAAO;AACL,mBAAW;AAAA,MACb;AACA,mBAAa;AACb;AAAA,IACF;AACA,QAAI,UAAU,KAAK;AACjB,UAAI,SAAS,KAAK;AAChB,gBAAQ;AAAA,MACV,WAAW,SAAS,QAAQ,IAAI,IAAI,QAAQ,QAAQ;AAClD,mBAAW,QAAQ,EAAE,CAAC;AAAA,MACxB,OAAO;AACL,mBAAW;AAAA,MACb;AACA,mBAAa;AACb;AAAA,IACF;AACA,QAAI,KAAK,KAAK,IAAI,GAAG;AACnB,kBAAY;AACZ;AAAA,IACF;AACA,QAAI,SAAS,OAAO,SAAS,KAAK;AAChC,cAAQ;AACR,mBAAa;AACb;AAAA,IACF;AACA,QAAI,SAAS,QAAQ,IAAI,IAAI,QAAQ,QAAQ;AAC3C,iBAAW,QAAQ,EAAE,CAAC;AACtB,mBAAa;AACb;AAAA,IACF;AACA,QAAI,cAAc,KAAK,IAAI,EAAG,QAAO;AACrC,eAAW;AACX,iBAAa;AAAA,EACf;AACA,MAAI,MAAO,QAAO;AAClB,cAAY;AACZ,SAAO;AACT;;;ACrMA,SAAS,SAAS,UAAU,gBAAgB;AAarC,IAAM,sBAAN,MAA0B;AAAA,EAQ/B,YAAY;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,KAAK;AAAA,EACb,IAGI,CAAC,GAAG;AAXR,SAAiB,iBAGZ,CAAC;AASJ,SAAK,QAAQ;AACb,SAAK,MAAM;AAAA,EACb;AAAA,EAEA,kBAAkB,MAA2B;AAC3C,SAAK,aAAa;AAClB,SAAK,eAAe,KAAK;AAAA,MACvB,KAAK,iBAAiB,IAAI;AAAA,MAC1B,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,IAC/B,CAAC;AAAA,EACH;AAAA,EAEA,uBAA6B;AAC3B,SAAK,aAAa;AAClB,SAAK,eAAe,KAAK;AAAA,MACvB,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,IAC/B,CAAC;AAAA,EACH;AAAA,EAEA,gBAAgB,MAA8B;AAC5C,SAAK,aAAa;AAClB,UAAM,MAAM,iBAAiB,IAAI;AACjC,QAAI,QAAQ,KAAK,eAAe,UAAU,UAAQ,KAAK,QAAQ,GAAG;AAClE,QAAI,UAAU,IAAI;AAChB,cAAQ,KAAK,eAAe,UAAU,UAAQ,KAAK,QAAQ,MAAS;AAAA,IACtE;AACA,QAAI,UAAU,GAAI,QAAO;AACzB,SAAK,eAAe,OAAO,OAAO,CAAC;AACnC,WAAO;AAAA,EACT;AAAA,EAEQ,eAAqB;AAC3B,UAAM,MAAM,KAAK,IAAI;AACrB,aAAS,IAAI,KAAK,eAAe,SAAS,GAAG,KAAK,GAAG,KAAK;AACxD,UAAI,KAAK,eAAe,CAAC,EAAE,aAAa,KAAK;AAC3C,aAAK,eAAe,OAAO,GAAG,CAAC;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,wBAAN,MAA4B;AAAA,EAA5B;AACL,SAAiB,QAAQ,oBAAI,IAAsC;AAAA;AAAA,EAEnE,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,EACF,GAGyD;AACvD,UAAM,MAAM,iBAAiB,IAAI;AACjC,UAAM,WAAW,KAAK,MAAM,IAAI,GAAG;AACnC,QAAI,SAAU,QAAO,EAAE,QAAQ,UAAU,OAAO,MAAM;AAEtD,UAAM,SAAS,IAAI;AACnB,SAAK,MAAM,IAAI,KAAK,MAAM;AAC1B,SAAK,OACF,QAAQ,MAAM;AACb,UAAI,KAAK,MAAM,IAAI,GAAG,MAAM,QAAQ;AAClC,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF,CAAC,EACA,MAAM,MAAM;AAAA,IAAC,CAAC;AACjB,WAAO,EAAE,QAAQ,OAAO,KAAK;AAAA,EAC/B;AACF;AAEA,SAAS,iBAAiB,EAAE,UAAU,MAAM,GAA0B;AACpE,SAAO,GAAG,QAAQ,KAAK,cAAc,SAAS,CAAC,CAAC,CAAC;AACnD;AAEA,SAAS,cAAc,OAAwB;AAC7C,SAAO,KAAK,UAAU,mBAAmB,KAAK,CAAC;AACjD;AAEA,SAAS,mBAAmB,OAAyB;AACnD,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,kBAAkB;AAAA,EACrC;AACA,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAgC,EAC5C,OAAO,CAAC,CAAC,EAAE,UAAU,MAAM,eAAe,MAAS,EACnD,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,KAAK,UAAU,MAAM,CAAC,KAAK,mBAAmB,UAAU,CAAC,CAAC;AAAA,IACrE;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,qCAAqC;AAAA,EACzD;AAAA,EACA;AACF,GAGqB;AACnB,MAAI,QAAQ,aAAa,QAAS,QAAO;AACzC,MAAI,CAAC,OAAO,cAAc,CAAC,OAAO,UAAW,QAAO;AAEpD,QAAM,QAAQ,MAAM,mBAAmB;AAAA,IACrC,YAAY,OAAO;AAAA,IACnB,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,MAAM,iCAAiC,EAAE,MAAM,CAAC;AAChE,SAAO,SAAS,KAAK,SAAO,mBAAmB,IAAI,GAAG,CAAC,KAAK;AAC9D;AAEA,eAAe,mBAAmB;AAAA,EAChC;AAAA,EACA;AACF,GAGgC;AAC9B,aAAW,aAAa,CAAC,iBAAiB,gBAAgB,GAAG;AAC3D,UAAM,QAAQ,MAAM,SAAS,WAAW,MAAM,EAAE,MAAM,MAAM,MAAS;AACrE,QAAI,CAAC,MAAO;AACZ,eAAW,QAAQ,MAAM,MAAM,IAAI,EAAE,MAAM,CAAC,GAAG;AAC7C,YAAM,UAAU,KAAK,KAAK,EAAE,MAAM,KAAK;AACvC,UAAI,QAAQ,SAAS,GAAI;AACzB,YAAM,QAAQ,oBAAoB,QAAQ,CAAC,CAAC;AAC5C,YAAM,SAAS,oBAAoB,QAAQ,CAAC,CAAC;AAC7C,UACE,OAAO,SAAS,cAChB,QAAQ,SAAS,cACjB,QAAQ,CAAC,MAAM,KACf;AACA,eAAO,QAAQ,CAAC;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAA6C;AACxE,QAAM,CAAC,EAAE,OAAO,IAAI,MAAM,MAAM,GAAG;AACnC,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,EAAE,MAAM,OAAO,SAAS,SAAS,EAAE,EAAE;AAC9C;AAEA,eAAe,iCAAiC;AAAA,EAC9C;AACF,GAEkC;AAChC,QAAM,cAAc,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC,EAAE;AAAA,IAClE,MAAM,CAAC;AAAA,EACT;AACA,aAAW,SAAS,aAAa;AAC/B,QAAI,CAAC,MAAM,YAAY,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,EAAG;AACvD,UAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,UAAM,MAAM,MAAM,QAAQ,KAAK,EAAE,MAAM,MAAM,CAAC,CAAC;AAC/C,eAAW,MAAM,KAAK;AACpB,YAAM,SAAS,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE,EAAE,EAAE,MAAM,MAAM,MAAS;AACrE,UAAI,WAAW,WAAW,KAAK,IAAK;AACpC,YAAM,UAAU,MAAM,SAAS,SAAS,MAAM,IAAI,YAAY,MAAM,EACjE,KAAK,WAAS,MAAM,MAAM,IAAI,EAAE,OAAO,OAAO,CAAC,EAC/C,MAAM,MAAM,MAAS;AACxB,UAAI,QAAS,QAAO;AAAA,IACtB;AAAA,EACF;AACA,SAAO;AACT;;;AFhKA,SAAS,MAAM,OAAOC,UAAS,UAAAC,eAAc;AAmB7C,YAAY,oBAAoB;AAOhC,IAAM,mBAAuE;AAAA,EAC3E,OAAO;AAAA,EACP,YAAY;AACd;AAEA,SAAS,aAAa,YAAuD;AAC3E,SAAO,iBAAiB,UAAU,KAAK;AACzC;AAEA,IAAM,OAAO,UAAU,KAAK,MAAM,CAAC,CAAC;AACpC,IAAM,UAAU,WAAW,EAAE,OAAO,KAAK,SAAS,MAAM,YAAY,CAAC;AACrE,IAAM,iBAAiB,WAAW;AAAA,EAChC,OAAO,KAAK;AAAA,EACZ,MAAM;AACR,CAAC;AACD,IAAM,aAAa,WAAW;AAAA,EAC5B,OAAO,KAAK;AAAA,EACZ,MAAM;AACR,CAAC;AACD,IAAM,eAAe,KAAK,gBAAgB;AAC1C,IAAM,qBAAqBD,SAAQ;AAGnC,IAAM,WAAW;AAIjB,IAAM,cAA0C,EAAE,IAAI,OAAU;AAEhE,MAAM,UAAwB;AAAA,EAC5B,YAAY;AAAA,EACZ;AAAA,EACA,SAAS;AAAA,EACT,UAAU,MAAO,YAAY,KAAK,EAAE,UAAU,YAAY,GAAG,IAAI,CAAC;AACpE,CAAC;AAUD,eAAe,QAAQ,OAAqB,MAAiC;AAC3E,QAAM,OAAa,SAAO,KAAK,KAAK,GAAkB;AAKtD,MACE,OAAO,MAAM,mBAAmB,YAChC,MAAM,eAAe,SAAS,GAC9B;AACA,gBAAY,KAAK,MAAM;AAAA,EACzB;AAkBA,QAAM,aAAsC,CAAC;AAC7C,MAAI;AACJ,MAAI;AACJ,MAAI,MAAM,SAAS,MAAM,MAAM,SAAS,GAAG;AACzC,kBAAc,GAAG,UAAU,IAAI,iBAAiB;AAChD,YAAQ,MAAM,eAAe;AAAA,MAC3B,oBAAoB,CAAC,aAAa,GAAG,YAAY,oBAAoB;AAAA,MACrE,OAAO,MAAM;AAAA,MACb;AAAA,MACA,mBAAmB,KAAK;AAAA,IAC1B,CAAC;AACD,eAAW,eAAe,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS;AAAA,MACT,MAAM,CAAC,GAAG,YAAY,oBAAoB;AAAA,MAC1C,KAAK;AAAA,QACH,cAAc,KAAK;AAAA,UACjB,MAAM,MAAM,IAAI,QAAM;AAAA,YACpB,MAAM,EAAE;AAAA,YACR,aAAa,EAAE;AAAA,YACf,aAAa,EAAE;AAAA,UACjB,EAAE;AAAA,QACJ;AAAA,QACA,gBAAgB,oBAAoB,MAAM,IAAI;AAAA,MAChD;AAAA,IACF;AAEA,UAAME,OAAM,YAAY,EAAE,WAAW,KAAK,CAAC;AAC3C,UAAMC;AAAA,MACJ;AAAA,MACA,mBAAmB,EAAE,WAAW,MAAM,KAAK,CAAC;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAuC,CAAC;AAC9C,MAAI,OAAO,KAAK,UAAU,EAAE,SAAS,EAAG,aAAY,cAAc;AAElE,QAAM,iBAAiBH,SAAQ;AAC/B,QAAM,iBAAiB,QAAQA,SAAQ,sBAAsB,cAAc;AAC3E,MAAI,kBAAkB,CAAC,gBAAgB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,iBAAiB,iBAAiBA,SAAQ;AAC7D,MAAI,YAAY;AACd,gBAAY,wBAAwB;AACpC,gBAAY,iBAAiB;AAC7B,gBAAY,kBAAkB;AAAA,MAC5B,qBAAqB;AAAA,QACnB,MAAMA,SAAQ,6BAA6B;AAAA,QAC3C,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,qBAAqB;AAAA,QACrB,GAAI,kBAAkB,qBAClB;AAAA,UACE,cAAc;AAAA,YACZ,cAAc;AAAA,YACd,gBAAgB;AAAA,UAClB;AAAA,QACF,IACA,CAAC;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACA,QAAM,8BACJ,OAAO,YAAY,mBAAmB;AAExC,QAAM,QAAQ,IAAI,SAAS,MAAM;AAAA,IAC/B,GAAIA,SAAQ,gBAAgB,EAAE,QAAQA,SAAQ,cAAc,IAAI,CAAC;AAAA,IACjE,GAAI,CAAC,+BAA+B,aAChC,EAAE,SAAS,WAAW,IACtB,CAAC;AAAA,IACL,KAAK,OAAO;AAAA,MACV,OAAO,QAAQA,QAAO,EAAE;AAAA,QACtB,CAAC,UAAqC,OAAO,MAAM,CAAC,MAAM;AAAA,MAC5D;AAAA,IACF;AAAA,IACA,GAAI,OAAO,KAAK,WAAW,EAAE,SAAS,IAAI,EAAE,QAAQ,YAAY,IAAI,CAAC;AAAA,EACvE,CAAC;AAED,QAAM,gBAAgB;AAAA,IACpB,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC5C,aAAa;AAAA,IACb,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,GAAI,MAAM,kBACN,EAAE,sBAAsB,MAAM,gBAAgB,IAC9C,CAAC;AAAA,IACL,eAAe,MAAM,YAAY,SAAS;AAAA,EAC5C;AACA,QAAM,SAAS,YAAY,KACvB,MAAM,aAAa,YAAY,IAAI,aAAa,IAChD,MAAM,YAAY,aAAa;AAEnC,OAAK,EAAE,MAAM,eAAe,CAAC;AAE7B,QAAM,cAAc,MAAM;AAC1B,MAAI;AACJ,QAAM,aAAa,oBAAI,IAAoB;AAC3C,QAAM,kBAAkB,oBAAI,IAAoB;AAEhD,MAAI;AACF,UAAM,EAAE,OAAO,IAAI,MAAM,OAAO,YAAY,aAAa;AAAA,MACvD,QAAQ,KAAK;AAAA,IACf,CAAC;AACD,qBAAiB,SAAS,QAAqC;AAC7D,UAAI,KAAK,YAAY,QAAS;AAC9B,UACE,MAAM,SAAS,oBACf,OAAO,MAAM,cAAc,UAC3B;AACA,oBAAY,KAAK,MAAM;AAEvB,aAAK,EAAE,MAAM,iBAAiB,UAAU,MAAM,UAAU,CAAC;AAAA,MAC3D;AAEA,UAAI,eAAe,MAAM,MAAM,SAAS,qBAAqB;AAC3D,cAAM,YACJ,OAAO,MAAM,KAAK,YAAY,WAC1B,sBAAsB;AAAA,UACpB,SAAS,MAAM,KAAK;AAAA,UACpB;AAAA,QACF,CAAC,IACD;AACN,YAAI,MAAM,SAAS,kBAAkB,OAAO;AAC1C,cAAI,WAAW;AACb,kBAAM,kBAAkB,SAAS;AAAA,UACnC,WAAW,OAAO,MAAM,KAAK,YAAY,UAAU;AACjD,kBAAM,qBAAqB;AAAA,UAC7B;AAAA,QACF;AACA,YAAI,WAAW;AACb;AAAA,QACF;AAAA,MACF;AACA,UAAI,SAAS,mBAAmB,KAAK,GAAG;AACtC,cAAM,YAAY,2BAA2B,KAAK;AAClD,YAAI,UAAW,OAAM,kBAAkB,SAAS;AAChD;AAAA,MACF;AACA,uBAAiB,OAAO;AAAA,QACtB,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,cAAc,OAAM,YAAY;AAAA,MAClC,CAAC;AAAA,IACH;AAAA,EACF,SAAS,KAAK;AACZ,SAAK,EAAE,MAAM,SAAS,OAAOI,gBAAe,GAAG,EAAE,CAAC;AAClD;AAAA,EACF,UAAE;AACA,WAAO,MAAM;AAAA,EACf;AAEA,OAAK;AAAA,IACH,MAAM;AAAA,IACN,cAAc,EAAE,SAAS,QAAQ,KAAK,OAAO;AAAA,IAC7C,YAAY,aAAa,aAAa;AAAA,EACxC,CAAC;AAED,OAAK,KAAK;AACZ;AAuBA,SAAS,yBAAyB,MAA0B;AAC1D,MACE,KAAK,WAAW,UAChB,KAAK,WAAW,QAChB,OAAO,KAAK,WAAW,UACvB;AACA,WAAO,KAAK,OAAO,UAAU,EAAE,OAAO,KAAK,MAAM,QAAQ,IAAI;AAAA,EAC/D;AACA,QAAM,SAAS,KAAK;AAIpB,MACE,OAAO,uBAAuB,UAC9B,OAAO,uBAAuB,MAC9B;AACA,WAAO,OAAO;AAAA,EAChB;AACA,SAAO,OAAO,WAAW;AAC3B;AAkBA,SAAS,mBAAmB,OAA4B;AACtD,SACE,MAAM,MAAM,SAAS,mBACrB,MAAM,KAAK,WAAW;AAE1B;AAEA,SAAS,2BACP,OAC2B;AAC3B,MAAI,MAAM,SAAS,eAAgB,QAAO;AAC1C,QAAM,WAAW,MAAM,MAAM;AAC7B,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO;AAAA,IACL;AAAA,IACA,OAAO,MAAM,MAAM,aAAa,CAAC;AAAA,EACnC;AACF;AAEA,SAAS,iBACP,OACA,KAMM;AACN,MAAI,MAAM,SAAS,kBAAkB;AACnC,QAAI,MAAM,MAAO,KAAI,aAAa,SAAS,MAAM,KAAK,CAAC;AACvD,QAAI,KAAK;AAAA,MACP,MAAM;AAAA,MACN,cAAc,EAAE,SAAS,QAAQ,KAAK,OAAO;AAAA,MAC7C,OAAO,MAAM,QAAQ,SAAS,MAAM,KAAK,IAAI,aAAa;AAAA,IAC5D,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,SAAS,eAAe;AAChC,QAAI,KAAK;AAAA,MACP,MAAM;AAAA,MACN,OAAO,MAAM,OAAO,WAAW;AAAA,IACjC,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,SAAS,SAAS;AAC1B,QAAI,KAAK,EAAE,MAAM,SAAS,OAAO,MAAM,WAAW,cAAc,CAAC;AACjE;AAAA,EACF;AACA,MAAI,CAAC,MAAM,KAAM;AACjB,QAAM,OAAO,MAAM;AACnB,QAAM,KAAK,KAAK,MAAM,WAAW;AAEjC,MAAI,KAAK,SAAS,mBAAmB,OAAO,KAAK,SAAS,UAAU;AASlE,QAAI,CAAC,IAAI,WAAW,IAAI,EAAE,GAAG;AAC3B,UAAI,KAAK,EAAE,MAAM,cAAc,GAAG,CAAC;AACnC,UAAI,WAAW,IAAI,IAAI,EAAE;AAAA,IAC3B;AACA,UAAM,OAAO,IAAI,WAAW,IAAI,EAAE,KAAK;AACvC,UAAM,OAAO,KAAK;AAClB,QAAI,KAAK,SAAS,KAAK,QAAQ;AAC7B,UAAI,KAAK,EAAE,MAAM,cAAc,IAAI,OAAO,KAAK,MAAM,KAAK,MAAM,EAAE,CAAC;AACnE,UAAI,WAAW,IAAI,IAAI,IAAI;AAAA,IAC7B;AACA,QAAI,MAAM,SAAS,iBAAkB,KAAI,KAAK,EAAE,MAAM,YAAY,GAAG,CAAC;AACtE;AAAA,EACF;AAEA,MAAI,KAAK,SAAS,eAAe,OAAO,KAAK,SAAS,UAAU;AAC9D,QAAI,CAAC,IAAI,gBAAgB,IAAI,EAAE,GAAG;AAChC,UAAI,KAAK,EAAE,MAAM,mBAAmB,GAAG,CAAC;AACxC,UAAI,gBAAgB,IAAI,IAAI,EAAE;AAAA,IAChC;AACA,UAAM,OAAO,IAAI,gBAAgB,IAAI,EAAE,KAAK;AAC5C,UAAM,OAAO,KAAK;AAClB,QAAI,KAAK,SAAS,KAAK,QAAQ;AAC7B,UAAI,KAAK,EAAE,MAAM,mBAAmB,IAAI,OAAO,KAAK,MAAM,KAAK,MAAM,EAAE,CAAC;AACxE,UAAI,gBAAgB,IAAI,IAAI,IAAI;AAAA,IAClC;AACA,QAAI,MAAM,SAAS;AACjB,UAAI,KAAK,EAAE,MAAM,iBAAiB,GAAG,CAAC;AACxC;AAAA,EACF;AAEA,MAAI,KAAK,SAAS,qBAAqB;AACrC,UAAM,aAAa;AACnB,QAAI,MAAM,SAAS,gBAAgB;AACjC,UAAI,KAAK;AAAA,QACP,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,UAAU,aAAa,UAAU;AAAA,QACjC;AAAA,QACA,OAAO,KAAK,UAAU,EAAE,SAAS,KAAK,WAAW,GAAG,CAAC;AAAA,QACrD,kBAAkB;AAAA,MACpB,CAAC;AAAA,IACH,WAAW,MAAM,SAAS,kBAAkB;AAC1C,UAAI,KAAK;AAAA,QACP,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,UAAU,aAAa,UAAU;AAAA,QACjC,QAAQ;AAAA,UACN,UAAU,KAAK,aAAa;AAAA,UAC5B,QAAQ,KAAK,qBAAqB;AAAA,UAClC,QAAQ,KAAK,UAAU;AAAA,QACzB;AAAA,MACF,CAAC;AAAA,IACH;AACA;AAAA,EACF;AAEA,MAAI,KAAK,SAAS,iBAAiB;AACjC,UAAM,aAAa,KAAK,WAAW;AACnC,QAAI,MAAM,SAAS,gBAAgB;AACjC,UAAI,KAAK;AAAA,QACP,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,UAAU,KAAK,QAAQ;AAAA,QACvB,GAAI,aAAa,CAAC,IAAI,EAAE,YAAY,KAAK,QAAQ,UAAU;AAAA,QAC3D,OAAO,KAAK,UAAU,KAAK,aAAa,CAAC,CAAC;AAAA,QAC1C,kBAAkB,CAAC;AAAA,MACrB,CAAC;AAAA,IACH,WAAW,MAAM,SAAS,kBAAkB;AAC1C,UAAI,KAAK;AAAA,QACP,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,UAAU,KAAK,QAAQ;AAAA,QACvB,QAAQ,yBAAyB,IAAI;AAAA,MACvC,CAAC;AAAA,IACH;AACA;AAAA,EACF;AAEA,MAAI,KAAK,SAAS,cAAc;AAC9B,UAAM,aAAa;AACnB,QAAI,MAAM,SAAS,gBAAgB;AACjC,UAAI,KAAK;AAAA,QACP,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,UAAU,aAAa,UAAU;AAAA,QACjC;AAAA,QACA,OAAO,KAAK,UAAU,EAAE,OAAO,KAAK,SAAS,GAAG,CAAC;AAAA,QACjD,kBAAkB;AAAA,MACpB,CAAC;AAAA,IACH,WAAW,MAAM,SAAS,kBAAkB;AAC1C,UAAI,KAAK;AAAA,QACP,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,UAAU,aAAa,UAAU;AAAA,QACjC,QAAQ,KAAK,UAAU;AAAA,MACzB,CAAC;AAAA,IACH;AACA;AAAA,EACF;AAEA,MAAI,KAAK,SAAS,iBAAiB,MAAM,SAAS,kBAAkB;AAClE,eAAW,UAAU,KAAK,WAAW,CAAC,GAAG;AACvC,UAAI,KAAK;AAAA,QACP,MAAM;AAAA,QACN,OACE,OAAO,SAAS,QACZ,WACA,OAAO,SAAS,WACd,WACA;AAAA,QACR,MAAM,OAAO;AAAA,MACf,CAAC;AAAA,IACH;AACA;AAAA,EACF;AAEA,MAAI,KAAK,SAAS,WAAW,MAAM,SAAS,kBAAkB;AAC5D,QAAI,KAAK;AAAA,MACP,MAAM;AAAA,MACN,OAAQ,KAA8B,WAAW;AAAA,IACnD,CAAC;AACD;AAAA,EACF;AACF;AAEA,SAAS,SAAS,OAAwD;AACxE,QAAM,QAAQ,MAAM,gBAAgB;AACpC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,SAAO;AAAA,IACL,aAAa;AAAA,MACX,OAAO;AAAA,MACP,SAAS,KAAK,IAAI,GAAG,QAAQ,SAAS;AAAA,MACtC;AAAA,MACA,YAAY;AAAA,IACd;AAAA,IACA,cAAc;AAAA,MACZ,OAAO,MAAM,iBAAiB;AAAA,MAC9B,MAAM,MAAM,iBAAiB;AAAA,IAC/B;AAAA,EACF;AACF;AAEA,SAAS,eAAwC;AAC/C,SAAO;AAAA,IACL,aAAa,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,EAAE;AAAA,IACjE,cAAc,EAAE,OAAO,GAAG,MAAM,EAAE;AAAA,EACpC;AACF;AAQA,eAAe,eAAe;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAOuB;AACrB,QAAM,YAAY,IAAI,IAAI,MAAM,IAAI,OAAK,EAAE,IAAI,CAAC;AAChD,QAAM,uBAAuB,IAAI,IAAI,kBAAkB;AACvD,QAAM,aAAa,IAAI,oBAAoB;AAC3C,QAAM,eAAe,IAAI,sBAAsB;AAE/C,QAAM,SAAS,aAAa,OAAO,KAAK,QAAQ;AAC9C,QAAI;AACF,UAAI,IAAI,WAAW,UAAU,IAAI,QAAQ,KAAK;AAC5C,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kCAAkC,CAAC,CAAC;AACpE;AAAA,MACF;AACA,YAAM,SAAmB,CAAC;AAC1B,uBAAiB,SAAS,KAAK;AAC7B,eAAO,KAAK,KAAe;AAAA,MAC7B;AACA,YAAM,OAAO,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AAClD,YAAM,EAAE,WAAW,UAAU,MAAM,IAAI,KAAK,MAAM,IAAI;AAMtD,UAAI,CAAC,UAAU,IAAI,QAAQ,GAAG;AAC5B,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI;AAAA,UACF,KAAK,UAAU,EAAE,OAAO,SAAS,QAAQ,qBAAqB,CAAC;AAAA,QACjE;AACA;AAAA,MACF;AACA,YAAM,YAAY,EAAE,UAAU,MAAM;AACpC,YAAM,aACJ,WAAW,gBAAgB,SAAS,KACnC,MAAM,qCAAqC;AAAA,QAC1C,QAAQ,IAAI;AAAA,QACZ,oBAAoB;AAAA,MACtB,CAAC;AACH,UAAI,CAAC,YAAY;AACf,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kCAAkC,CAAC,CAAC;AACpE;AAAA,MACF;AAEA,YAAM,EAAE,OAAO,IAAI,aAAa,MAAM;AAAA,QACpC,MAAM;AAAA,QACN,KAAK,YAAY;AACf,eAAK;AAAA,YACH,MAAM;AAAA,YACN,YAAY;AAAA,YACZ;AAAA,YACA,OAAO,KAAK,UAAU,SAAS,CAAC,CAAC;AAAA,YACjC,kBAAkB;AAAA,UACpB,CAAC;AAED,gBAAM,aAAa,MAAM,kBAAkB,SAAS;AACpD,eAAK;AAAA,YACH,MAAM;AAAA,YACN,YAAY;AAAA,YACZ;AAAA,YACA,QAAQ,WAAW,UAAU;AAAA,YAC7B,SAAS,CAAC,CAAC,WAAW;AAAA,UACxB,CAAC;AACD,iBAAO;AAAA,QACT;AAAA,MACF,CAAC;AACD,YAAM,EAAE,OAAO,IAAI,MAAM;AAEzB,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,QAAQ,OAAO,CAAC,CAAC;AAAA,IAC5C,SAAS,OAAO;AACd,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI;AAAA,QACF,KAAK,UAAU;AAAA,UACb,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC9D,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,IAAI;AAAA,IAAc,aACtB,OAAO,OAAO,GAAG,aAAa,MAAM,QAAQ,CAAC;AAAA,EAC/C;AACA,QAAM,UAAU,OAAO,QAAQ;AAC/B,MAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO;AAAA,IACL,MAAM,QAAQ;AAAA,IACd,OAAO,MAAM,YAAY,MAAM;AAAA,IAC/B,mBAAmB,UAAQ,WAAW,kBAAkB,IAAI;AAAA,IAC5D,sBAAsB,MAAM,WAAW,qBAAqB;AAAA,EAC9D;AACF;AAEA,SAAS,YAAY,QAAsB;AACzC,MAAI;AACF,WAAO,MAAM;AAAA,EACf,QAAQ;AAAA,EAAC;AACX;AAEA,SAAS,UAAUC,OAKjB;AACA,QAAM,MAKF,CAAC;AACL,WAAS,IAAI,GAAG,IAAIA,MAAK,QAAQ,KAAK;AACpC,QAAIA,MAAK,CAAC,MAAM,eAAe,IAAI,IAAIA,MAAK,QAAQ;AAClD,UAAI,UAAUA,MAAK,EAAE,CAAC;AAAA,IACxB,WAAWA,MAAK,CAAC,MAAM,wBAAwB,IAAI,IAAIA,MAAK,QAAQ;AAClE,UAAI,iBAAiBA,MAAK,EAAE,CAAC;AAAA,IAC/B,WAAWA,MAAK,CAAC,MAAM,qBAAqB,IAAI,IAAIA,MAAK,QAAQ;AAC/D,UAAI,eAAeA,MAAK,EAAE,CAAC;AAAA,IAC7B,WAAWA,MAAK,CAAC,MAAM,oBAAoB,IAAI,IAAIA,MAAK,QAAQ;AAC9D,UAAI,aAAaA,MAAK,EAAE,CAAC;AAAA,IAC3B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAASD,gBAAe,KAAuB;AAC7C,MAAI,eAAe,OAAO;AACxB,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,OAAO,IAAI,MAAM;AAAA,EAClE;AACA,SAAO;AACT;AAEA,SAAS,UAAU,SAAwB;AACzC,EAAAH,QAAO,MAAM,KAAK,UAAU,EAAE,MAAM,gBAAgB,QAAQ,CAAC,IAAI,IAAI;AACrE,UAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,WAAW;AAAA,EAClB;AAAA,EACA;AACF,GAGW;AACT,MAAI,CAAC,OAAO;AACV,cAAU,WAAW,IAAI,YAAY;AAAA,EACvC;AACA,SAAO;AACT;","names":["bridgeStateDir","mkdir","writeFile","argv","procEnv","stdout","mkdir","writeFile","serialiseError","args"]}
+{"version":3,"sources":["../../../harness/src/bridge/index.ts","../../src/bridge/index.ts","../../src/bridge/cli-relay.ts","../../src/bridge/codex-step-tracker.ts","../../src/bridge/tool-relay-auth.ts"],"sourcesContent":["// Shared in-sandbox bridge runtime. Adapter `bridge.mjs` bundles re-bundle\n// this module (tsup inlines it; `ws` stays external and resolves from the\n// sandbox-installed node_modules). It owns everything generic to the bridge\n// transport — the WebSocket server, token auth, single-flight connection\n// replacement, the in-memory event log + monotonic `seq`, resume replay, and\n// the lifecycle/meta files. The adapter supplies only `onStart` (drive its\n// CLI/SDK and translate to wire events) and `onDetach` (its resume payload).\n\nimport { appendFile, mkdir, writeFile } from 'node:fs/promises';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { env as procEnv, pid, stdout } from 'node:process';\nimport { WebSocketServer, type WebSocket } from 'ws';\n\nexport type BridgeState = 'init' | 'waiting' | 'running' | 'draining' | 'done';\n\n/** Outbound turn event the adapter emits. `seq` is added by the runtime. */\nexport type BridgeEvent = Record<string, unknown> & { type: string };\n\nexport type BridgeDebugLevel = 'error' | 'warn' | 'info' | 'debug' | 'trace';\n\n/**\n * Per-session diagnostics config. The host resolves it from settings +\n * env and sends it on `start.debug`; the bridge gates console capture and\n * structured `debug-event`s on it. When disabled, nothing is captured or\n * emitted and no `seq` is consumed.\n */\nexport interface BridgeDebugConfig {\n  enabled?: boolean;\n  level?: BridgeDebugLevel;\n  subsystems?: string[];\n}\n\nconst DEBUG_LEVEL_WEIGHT: Record<BridgeDebugLevel, number> = {\n  error: 0,\n  warn: 1,\n  info: 2,\n  debug: 3,\n  trace: 4,\n};\n\n/** Exact-or-dotted-prefix subsystem match (`'bridge'` matches `'bridge.turn'`). */\nfunction subsystemMatches(\n  filters: string[] | undefined,\n  subsystem: string,\n): boolean {\n  if (!filters || filters.length === 0) return true;\n  return filters.some(\n    filter => subsystem === filter || subsystem.startsWith(`${filter}.`),\n  );\n}\n\nfunction formatBridgeError(err: unknown): {\n  name?: string;\n  message: string;\n  stack?: string;\n} {\n  if (err instanceof Error) {\n    return { name: err.name, message: err.message, stack: err.stack };\n  }\n  if (typeof err === 'string') {\n    return { message: err };\n  }\n  if (err !== null && typeof err === 'object') {\n    try {\n      return { message: JSON.stringify(err) };\n    } catch {}\n  }\n  return { message: String(err) };\n}\n\nfunction parseEnvList(value: string | undefined): string[] | undefined {\n  if (!value) return undefined;\n  const items = value\n    .split(',')\n    .map(item => item.trim())\n    .filter(Boolean);\n  return items.length > 0 ? items : undefined;\n}\n\nconst ENV_TRUTHY = new Set(['1', 'true', 'yes', 'on']);\n\n/**\n * Per-turn surface handed to {@link RunBridgeOptions.onStart}. The adapter\n * drives its runtime against these primitives; the runtime owns the transport.\n */\nexport interface BridgeTurn {\n  /**\n   * Emit a turn event to the host. Stamps a monotonic `seq`, appends to the\n   * in-memory replay log, and sends to the live socket (best-effort — if the\n   * host is mid-reconnect the event waits in the log and is replayed on\n   * resume).\n   */\n  emit(event: BridgeEvent): void;\n\n  /**\n   * Register interest in a host-executed tool result and resolve when the\n   * matching `tool-result` arrives. The adapter emits the `tool-call` event\n   * itself (via {@link emit}) using the same `toolCallId`.\n   */\n  requestToolResult(\n    toolCallId: string,\n  ): Promise<{ output: unknown; isError?: boolean }>;\n\n  /**\n   * Register interest in a host approval decision and resolve when the matching\n   * `tool-approval-response` arrives. The adapter emits the\n   * `tool-approval-request` event itself using the same `approvalId`.\n   */\n  requestToolApproval(\n    approvalId: string,\n  ): Promise<{ approved: boolean; reason?: string }>;\n\n  /**\n   * Live queue of mid-turn user messages. The runtime pushes inbound\n   * `user-message` text here; the adapter drains it as its runtime accepts\n   * interactive input.\n   */\n  readonly pendingUserMessages: string[];\n\n  /** Aborts when the host sends `abort`. */\n  readonly abortSignal: AbortSignal;\n\n  /**\n   * Register the runtime-specific interrupt hook for this active turn. The\n   * shared bridge invokes it when the host sends `interrupt`, then acknowledges\n   * only after the hook settles.\n   */\n  onInterrupt(handler: () => void | Promise<void>): void;\n\n  /** True for the first turn since this bridge process started. */\n  readonly firstTurn: boolean;\n\n  /**\n   * Emit a structured diagnostic. Gated by the session's debug level +\n   * subsystem filter; a no-op when diagnostics are disabled. Adapters use this\n   * for runtime-level instrumentation; raw `console.*` output is captured and\n   * forwarded automatically.\n   */\n  bridgeLog(input: {\n    level?: BridgeDebugLevel;\n    subsystem: string;\n    message: string;\n    attrs?: Record<string, unknown>;\n    error?: unknown;\n  }): void;\n\n  /**\n   * Emit a non-fatal bridge warning to stderr using the runtime's harness\n   * prefix. This is diagnostic-only: it does not emit a stream event, does not\n   * consume a `seq`, and does not fail the turn.\n   */\n  emitWarning(input: { message: string }): void;\n\n  emitError(input: { error: unknown; message?: string }): void;\n}\n\nexport interface RunBridgeOptions<TStart extends { type: 'start' }> {\n  /** Identifier written into `bridge-meta.json` (`'claude-code'` / `'codex'`). */\n  bridgeType: string;\n  /** Directory for `bridge-meta.json` / `start-config.json`. Created if absent. */\n  bridgeStateDir: string;\n  /** Drive one prompt turn. Rejections surface to the host as an `error` event. */\n  onStart(start: TStart, turn: BridgeTurn): Promise<void>;\n  /** Produce the adapter-defined resume payload for a `detach`. Defaults to `{}`. */\n  onDetach?(): unknown | Promise<unknown>;\n  /** WS port. Defaults to `BRIDGE_WS_PORT` env (0 = OS-assigned). */\n  port?: number;\n  /** Auth token. Defaults to `BRIDGE_CHANNEL_TOKEN` env. */\n  token?: string;\n  /** Called with the bound port once the server is listening. */\n  onListening?(port: number): void;\n  /**\n   * Tear the process down after a `shutdown` / `detach`. Defaults to closing\n   * the server and calling `process.exit(0)`. Overridable for tests.\n   */\n  onExit?(): void;\n}\n\ntype InboundControl =\n  | {\n      type: 'tool-result';\n      toolCallId: string;\n      output: unknown;\n      isError?: boolean;\n    }\n  | {\n      type: 'tool-approval-response';\n      approvalId: string;\n      approved: boolean;\n      reason?: string;\n    }\n  | { type: 'user-message'; text: string }\n  | { type: 'abort' }\n  | { type: 'interrupt' }\n  | { type: 'shutdown' }\n  | { type: 'detach' }\n  | { type: 'resume'; lastSeenEventId: number };\n\nconst WS_OPEN = 1;\n\n/**\n * Boot the bridge: bind the WebSocket server, announce `bridge-ready`, and\n * service host connections for the lifetime of the process. Resolves once the\n * server is listening; the process then stays alive on the server until a\n * `shutdown` / `detach` exits it.\n */\nexport interface BridgeHandle {\n  /** The port the WebSocket server bound to. */\n  readonly port: number;\n  /** Close the WebSocket server. Does not call `process.exit`. */\n  close(): Promise<void>;\n}\n\nexport async function runBridge<TStart extends { type: 'start' }>(\n  options: RunBridgeOptions<TStart>,\n): Promise<BridgeHandle> {\n  const { bridgeType, bridgeStateDir, onStart, onDetach } = options;\n  const expectedToken = options.token ?? procEnv.BRIDGE_CHANNEL_TOKEN ?? '';\n  const bridgeWsPort =\n    options.port ?? parseInt(procEnv.BRIDGE_WS_PORT ?? '0', 10);\n\n  const bridgeMetaPath = `${bridgeStateDir}/bridge-meta.json`;\n  const startConfigPath = `${bridgeStateDir}/start-config.json`;\n  const rerunStartConfigPath = `${bridgeStateDir}/rerun-start-config.json`;\n  const eventLogPath = `${bridgeStateDir}/event-log.ndjson`;\n\n  try {\n    await mkdir(bridgeStateDir, { recursive: true });\n  } catch {\n    // Best-effort; the bridge still runs without its state files.\n  }\n\n  // ─── mutable runtime state ──────────────────────────────────────────\n  let currentBoundPort = 0;\n  let currentTurnState: BridgeState = 'init';\n  let activeSocket: WebSocket | undefined;\n  let isFirstTurn = true;\n  let turnAbort: AbortController | undefined;\n  let currentUserMessages: string[] | undefined;\n  let currentInterruptHandler: (() => void | Promise<void>) | undefined;\n\n  // Diagnostics. Resolved per turn from `start.debug` with a sandbox-side\n  // env fallback; gates console capture + structured `debug-event`s.\n  let debugConfig: BridgeDebugConfig | undefined;\n  let consoleCaptureInstalled = false;\n  const envDebugEnabled = ENV_TRUTHY.has(\n    (procEnv.HARNESS_DEBUG ?? '').toLowerCase(),\n  );\n\n  // Replay log. `seq` is monotonic across the whole process — never reset —\n  // because the host's `SandboxChannel` cursor (`lastSeenEventId`) lives across\n  // turns. The log *contents* are cleared at the start of each turn to bound\n  // memory; the just-finished turn stays replayable until the next `start`.\n  let seqCounter = 0;\n  let eventLog: Array<{ seq: number; line: string }> = [];\n\n  /*\n   * Disk mirror of the in-memory replay log. The in-memory log is lost when the\n   * bridge process dies; the on-disk `event-log.ndjson` survives in the sandbox\n   * filesystem so a respawned bridge (started with `BRIDGE_REPLAY_FROM_DISK=1`)\n   * can reload the just-interrupted turn and serve a host's resume cursor —\n   * `replay` recovery. Writes are batched on `setImmediate` (single-flight via\n   * `flushPromise`) to keep `emit` off the disk hot path.\n   */\n  let diskBuffer = '';\n  let flushPromise: Promise<void> | null = null;\n\n  const flushEventsToDisk = async (): Promise<void> => {\n    while (diskBuffer.length > 0) {\n      const buf = diskBuffer;\n      diskBuffer = '';\n      await appendFile(eventLogPath, buf).catch(() => {\n        // Best-effort crash-recovery mirror; the in-memory log is the source of\n        // truth for the live connection.\n      });\n    }\n  };\n\n  const scheduleEventFlush = (): void => {\n    if (flushPromise) return;\n    flushPromise = new Promise<void>(resolve => {\n      setImmediate(() => {\n        void flushEventsToDisk().finally(resolve);\n      });\n    }).finally(() => {\n      flushPromise = null;\n      if (diskBuffer.length > 0) {\n        scheduleEventFlush();\n      }\n    });\n  };\n\n  const flushPendingEventsToDisk = async (): Promise<void> => {\n    if (diskBuffer.length > 0 && !flushPromise) {\n      scheduleEventFlush();\n    }\n    // Await each in-flight flush, re-reading `flushPromise` after every await\n    // since a fresh flush may have been scheduled for buffer that arrived while\n    // we waited.\n    let inFlight = flushPromise;\n    while (inFlight) {\n      await inFlight;\n      inFlight = flushPromise;\n    }\n  };\n\n  /*\n   * When respawned for `replay`, reload the previous turn's log from disk before\n   * accepting any connection so the very first `resume{lastSeenEventId}` can be\n   * served the tail (including the terminal `finish`). The seq counter is\n   * restored to the last persisted seq so it stays aligned with the host's\n   * long-lived cursor. The file is NOT truncated in this mode — only a fresh\n   * `start` (next turn) clears it.\n   */\n  const replayFromDisk = procEnv.BRIDGE_REPLAY_FROM_DISK === '1';\n  if (replayFromDisk && existsSync(eventLogPath)) {\n    try {\n      const lines = readFileSync(eventLogPath, 'utf8')\n        .split('\\n')\n        .map(line => line.trim())\n        .filter(Boolean);\n      eventLog = lines.map(line => ({\n        seq: (JSON.parse(line) as { seq: number }).seq,\n        line,\n      }));\n      seqCounter = eventLog.at(-1)?.seq ?? 0;\n    } catch {\n      // Corrupt/partial log: fall back to an empty log; the host then degrades\n      // to `rerun` instead of replaying a malformed tail.\n      eventLog = [];\n      seqCounter = 0;\n    }\n  }\n\n  const pendingToolResults = new Map<\n    string,\n    (output: { output: unknown; isError?: boolean }) => void\n  >();\n  const pendingToolApprovals = new Map<\n    string,\n    (response: { approved: boolean; reason?: string }) => void\n  >();\n\n  // ─── persistence (best-effort meta + start config) ──────────────────\n  const writeBridgeMeta = async (state: BridgeState): Promise<void> => {\n    try {\n      await writeFile(\n        bridgeMetaPath,\n        JSON.stringify({\n          type: bridgeType,\n          port: currentBoundPort,\n          state,\n          pid,\n        }),\n      );\n    } catch {\n      // Best-effort resilience metadata; not load-bearing for the active turn.\n    }\n  };\n\n  const writeStartConfig = async (start: unknown): Promise<void> => {\n    try {\n      const serialized = JSON.stringify(start);\n      await writeFile(startConfigPath, serialized);\n      // Frozen copy: written once, restored over start-config.json by future\n      // rerun-mode recovery to re-run the original turn from scratch.\n      if (!existsSync(rerunStartConfigPath)) {\n        await writeFile(rerunStartConfigPath, serialized);\n      }\n    } catch {\n      // Best-effort.\n    }\n  };\n\n  // ─── wire send + replay ─────────────────────────────────────────────\n  const sendControl = (msg: Record<string, unknown>): void => {\n    if (activeSocket?.readyState === WS_OPEN) {\n      try {\n        activeSocket.send(JSON.stringify(msg));\n      } catch {\n        // best-effort\n      }\n    }\n  };\n\n  const emit = (event: BridgeEvent): void => {\n    const seq = ++seqCounter;\n    const line = JSON.stringify({ ...event, seq });\n    eventLog.push({ seq, line });\n    diskBuffer += `${line}\\n`;\n    scheduleEventFlush();\n    if (activeSocket?.readyState === WS_OPEN) {\n      try {\n        activeSocket.send(line);\n      } catch {\n        // Send is best-effort: a dropped socket leaves the event in the log,\n        // replayed once the host reconnects and sends `resume`.\n      }\n    }\n  };\n\n  const replay = (ws: WebSocket, afterSeq: number): void => {\n    for (const entry of eventLog) {\n      if (entry.seq > afterSeq && ws.readyState === WS_OPEN) {\n        ws.send(entry.line);\n      }\n    }\n  };\n\n  // ─── diagnostics ──────────────────────────────────────────────\n  const shouldEmitDebugEvent = (\n    level: BridgeDebugLevel,\n    subsystem: string,\n  ): boolean => {\n    if (!debugConfig?.enabled) return false;\n    const threshold = debugConfig.level ?? 'debug';\n    if (DEBUG_LEVEL_WEIGHT[level] > DEBUG_LEVEL_WEIGHT[threshold]) return false;\n    return subsystemMatches(debugConfig.subsystems, subsystem);\n  };\n\n  /*\n   * Forward sandbox console output. We line-buffer the original writers (kept so\n   * output still reaches the real fds) and emit one `sandbox-log` per complete\n   * line. `emit` never writes to stdout/stderr, so there is no recursion.\n   * Installed lazily the first time a turn enables diagnostics; once installed,\n   * capture is gated per-write on `debugConfig.enabled` so a later turn can\n   * disable it. Console capture is independent of the subsystem/level filter.\n   */\n  const rawStdoutWrite = process.stdout.write.bind(process.stdout);\n  const rawStderrWrite = process.stderr.write.bind(process.stderr);\n\n  const writeErrorToStderr = (input: {\n    message: string;\n    error: unknown;\n  }): void => {\n    try {\n      const formatted = formatBridgeError(input.error);\n      rawStderrWrite(\n        `[harness:${bridgeType}:error] ${input.message}: ${formatted.message}\\n`,\n      );\n      if (formatted.stack) {\n        rawStderrWrite(`${formatted.stack}\\n`);\n      }\n    } catch {}\n  };\n\n  const emitWarning = (input: { message: string }): void => {\n    try {\n      for (const line of input.message.split('\\n')) {\n        if (line.trim().length > 0) {\n          rawStderrWrite(`[harness:${bridgeType}:warn] ${line}\\n`);\n        }\n      }\n    } catch {}\n  };\n\n  const emitError = (input: { error: unknown; message?: string }): void => {\n    writeErrorToStderr({\n      message: input.message ?? 'bridge error',\n      error: input.error,\n    });\n    emit({ type: 'error', error: serialiseError(input.error) });\n  };\n\n  const installConsoleCapture = (): void => {\n    if (consoleCaptureInstalled) return;\n    consoleCaptureInstalled = true;\n    const buffers: { stdout: string; stderr: string } = {\n      stdout: '',\n      stderr: '',\n    };\n    const patch =\n      (stream: 'stdout' | 'stderr', raw: typeof process.stdout.write) =>\n      (chunk: unknown, encoding?: unknown, cb?: unknown): boolean => {\n        if (debugConfig?.enabled) {\n          try {\n            const enc = typeof encoding === 'string' ? encoding : 'utf8';\n            const text =\n              typeof chunk === 'string'\n                ? chunk\n                : Buffer.from(chunk as Uint8Array).toString(\n                    enc as BufferEncoding,\n                  );\n            const combined = buffers[stream] + text.replace(/\\r\\n/g, '\\n');\n            const parts = combined.split('\\n');\n            buffers[stream] = parts.pop() ?? '';\n            for (const line of parts) {\n              const trimmed = line.replace(/\\s+$/, '');\n              if (trimmed) {\n                emit({\n                  type: 'sandbox-log',\n                  source: bridgeType,\n                  stream,\n                  line: trimmed,\n                });\n              }\n            }\n          } catch {\n            // Never let capture break real output.\n          }\n        }\n        return (raw as (c: unknown, e?: unknown, cb?: unknown) => boolean)(\n          chunk,\n          encoding,\n          cb,\n        );\n      };\n    process.stdout.write = patch(\n      'stdout',\n      rawStdoutWrite,\n    ) as typeof process.stdout.write;\n    process.stderr.write = patch(\n      'stderr',\n      rawStderrWrite,\n    ) as typeof process.stderr.write;\n  };\n\n  // ─── inbound routing ────────────────────────────────────────────────\n  const handleInbound = async (\n    msg: TStart | InboundControl,\n    ws: WebSocket,\n  ): Promise<void> => {\n    switch (msg.type) {\n      case 'start': {\n        const firstTurn = isFirstTurn;\n        isFirstTurn = false;\n        eventLog = []; // clear previous turn; keep seqCounter monotonic\n        // Mirror the in-memory clear to disk: the log tracks only the current\n        // turn. Discard any unflushed tail from the prior turn first.\n        diskBuffer = '';\n        void writeFile(eventLogPath, '').catch(() => {});\n        turnAbort = new AbortController();\n        currentTurnState = 'running';\n        currentInterruptHandler = undefined;\n        void writeStartConfig(msg);\n        void writeBridgeMeta('running');\n        const startDebug = (msg as { debug?: BridgeDebugConfig }).debug;\n        debugConfig = {\n          enabled: startDebug?.enabled ?? envDebugEnabled,\n          level:\n            startDebug?.level ??\n            (procEnv.HARNESS_DEBUG_LEVEL as BridgeDebugLevel | undefined),\n          subsystems:\n            startDebug?.subsystems ??\n            parseEnvList(procEnv.HARNESS_DEBUG_SUBSYSTEMS),\n        };\n        if (debugConfig.enabled) {\n          installConsoleCapture();\n        }\n        const turn: BridgeTurn = {\n          emit,\n          requestToolResult: toolCallId =>\n            new Promise(resolve => {\n              pendingToolResults.set(toolCallId, resolve);\n            }),\n          requestToolApproval: approvalId =>\n            new Promise(resolve => {\n              pendingToolApprovals.set(approvalId, resolve);\n            }),\n          pendingUserMessages: [],\n          abortSignal: turnAbort.signal,\n          onInterrupt: handler => {\n            currentInterruptHandler = handler;\n          },\n          firstTurn,\n          bridgeLog: input => {\n            const level = input.level ?? 'debug';\n            if (!shouldEmitDebugEvent(level, input.subsystem)) return;\n            emit({\n              type: 'debug-event',\n              level,\n              subsystem: input.subsystem,\n              message: input.message,\n              ...(input.attrs ? { attrs: input.attrs } : {}),\n              ...(input.error !== undefined\n                ? { error: formatBridgeError(input.error) }\n                : {}),\n            });\n          },\n          emitWarning,\n          emitError,\n        };\n        currentUserMessages = turn.pendingUserMessages;\n        try {\n          await onStart(msg as TStart, turn);\n        } catch (err) {\n          emitError({ error: err, message: 'bridge turn failed' });\n        } finally {\n          currentInterruptHandler = undefined;\n          currentTurnState = 'waiting';\n          void writeBridgeMeta('waiting');\n        }\n        return;\n      }\n      case 'tool-result': {\n        const resolver = pendingToolResults.get(msg.toolCallId);\n        if (resolver) {\n          pendingToolResults.delete(msg.toolCallId);\n          resolver({ output: msg.output, isError: msg.isError });\n        }\n        return;\n      }\n      case 'tool-approval-response': {\n        const resolver = pendingToolApprovals.get(msg.approvalId);\n        if (resolver) {\n          pendingToolApprovals.delete(msg.approvalId);\n          resolver({ approved: msg.approved, reason: msg.reason });\n        }\n        return;\n      }\n      case 'user-message':\n        currentUserMessages?.push(msg.text);\n        return;\n      case 'abort':\n        turnAbort?.abort();\n        return;\n      case 'interrupt':\n        try {\n          if (currentInterruptHandler) {\n            await currentInterruptHandler();\n          } else {\n            turnAbort?.abort();\n          }\n          sendControl({ type: 'bridge-interrupted', ok: true });\n        } catch (err) {\n          sendControl({\n            type: 'bridge-interrupted',\n            ok: false,\n            error: serialiseError(err),\n          });\n        }\n        return;\n      case 'resume':\n        replay(ws, msg.lastSeenEventId);\n        return;\n      case 'shutdown':\n        currentTurnState = 'done';\n        void writeBridgeMeta('done');\n        drainThenExit(ws, 1000, 'shutdown');\n        return;\n      case 'detach': {\n        currentTurnState = 'done';\n        void writeBridgeMeta('done');\n        const data = (await onDetach?.()) ?? {};\n        sendControl({ type: 'bridge-detach', data });\n        drainThenExit(ws, 1000, 'detach');\n        return;\n      }\n    }\n  };\n\n  // ─── server ─────────────────────────────────────────────────────────\n  void writeBridgeMeta('init');\n\n  const wss = new WebSocketServer({ port: bridgeWsPort, host: '0.0.0.0' });\n\n  const exit = (): void => {\n    if (options.onExit) {\n      options.onExit();\n      return;\n    }\n    wss.close(() => process.exit(0));\n    setTimeout(() => process.exit(0), 1000).unref();\n  };\n\n  const drainThenExit = (ws: WebSocket, code: number, reason: string): void => {\n    const start = Date.now();\n    const tick = (): void => {\n      const drained = ws.bufferedAmount === 0 || ws.readyState !== WS_OPEN;\n      if (drained || Date.now() - start >= 5_000) {\n        // Flush the on-disk log so a clean shutdown/detach leaves a complete\n        // event-log.ndjson for any later replay recovery.\n        void flushPendingEventsToDisk().finally(() => {\n          try {\n            ws.close(code, reason);\n          } finally {\n            exit();\n          }\n        });\n        return;\n      }\n      setTimeout(tick, 10).unref();\n    };\n    tick();\n  };\n\n  wss.on('listening', () => {\n    const addr = wss.address();\n    currentBoundPort = typeof addr === 'object' && addr ? addr.port : 0;\n    currentTurnState = 'waiting';\n    void writeBridgeMeta('waiting');\n    stdout.write(\n      JSON.stringify({\n        type: 'bridge-ready',\n        port: currentBoundPort,\n      }) + '\\n',\n    );\n    options.onListening?.(currentBoundPort);\n  });\n\n  wss.on('connection', (ws: WebSocket, req: { url?: string }) => {\n    const url = new URL(req.url ?? '/', 'http://localhost');\n    if (url.searchParams.get('agent_bridge_token') !== expectedToken) {\n      ws.close(1008, 'unauthorized');\n      return;\n    }\n\n    // Single-flight: a fresh authorized connection *replaces* the active one\n    // (the host reconnecting after a drop). The previous socket's close is a\n    // no-op below because it is no longer `activeSocket`.\n    activeSocket = ws;\n\n    // Announce liveness the instant we accept. Some sandbox runtimes complete\n    // the host-side WS handshake before the connection is forwarded here; the\n    // host waits for this frame before sending `start`/`resume`.\n    sendControl({\n      type: 'bridge-hello',\n      state: currentTurnState,\n      lastSeq: seqCounter,\n    });\n\n    ws.on('message', (raw: ArrayBufferLike | string) => {\n      let parsed: TStart | InboundControl;\n      try {\n        const text =\n          typeof raw === 'string' ? raw : Buffer.from(raw).toString('utf8');\n        parsed = JSON.parse(text) as TStart | InboundControl;\n      } catch (err) {\n        sendControl({\n          type: 'error',\n          error: `protocol parse error: ${(err as Error).message}`,\n        });\n        return;\n      }\n      void handleInbound(parsed, ws);\n    });\n\n    ws.on('close', () => {\n      // Only the *current* socket's close matters. A stale socket (already\n      // replaced by a reconnect) closing is a no-op. Crucially we do NOT abort\n      // the in-flight turn — it keeps running and its events accumulate in the\n      // log for replay when the host reconnects.\n      if (activeSocket === ws) {\n        activeSocket = undefined;\n      }\n    });\n\n    ws.on('error', () => {\n      // 'close' follows; nothing to do beyond keeping the process alive.\n    });\n  });\n\n  // Surface bridge-internal crashes to the host instead of dying silently.\n  process.on('uncaughtException', err => {\n    emitError({ error: err, message: 'uncaught exception' });\n  });\n  process.on('unhandledRejection', err => {\n    emitError({ error: err, message: 'unhandled rejection' });\n  });\n\n  await new Promise<void>((resolve, reject) => {\n    if (wss.address() != null) {\n      resolve();\n      return;\n    }\n\n    wss.once('listening', resolve);\n    wss.once('error', reject);\n  });\n\n  return {\n    port: currentBoundPort,\n    close: () =>\n      new Promise<void>(resolve => {\n        wss.close(() => resolve());\n      }),\n  };\n}\n\nfunction serialiseError(err: unknown): unknown {\n  if (err instanceof Error) {\n    return { name: err.name, message: err.message, stack: err.stack };\n  }\n  return err;\n}\n","// Long-running process that runs alongside the `codex` CLI in the sandbox.\n// The generic transport — WebSocket server, token auth, single-flight\n// reconnect, the in-memory event log + `seq`, resume replay, and the\n// lifecycle/meta files — lives in the shared `@ai-sdk/harness/bridge` runtime.\n// This file supplies only the Codex-specific turn driver.\n//\n// Host-defined tools are routed through an HTTP relay bound to\n// `127.0.0.1:0`. The codex CLI spawns `host-tool-mcp.mjs` (shipped alongside\n// this file) as a stdio MCP server; the shim POSTs each tool call to the\n// relay, which emits `tool-call` to the host and waits for the matching\n// `tool-result`.\n\nimport {\n  runBridge,\n  type BridgeEvent,\n  type BridgeTurn,\n} from '@ai-sdk/harness/bridge';\nimport type { HarnessV1BuiltinToolName } from '@ai-sdk/harness';\nimport type { StartMessage } from '../codex-bridge-protocol';\nimport { randomUUID } from 'node:crypto';\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport { createServer, type Server } from 'node:http';\n// Temporary workaround for upstream codex MCP-tool bug — see ./cli-relay.ts\nimport {\n  CLI_SHIM_FILENAME,\n  buildCliShimScript,\n  parseToolRelayCommand,\n} from './cli-relay';\nimport {\n  createCodexStepTracker,\n  defaultUsage,\n  type CodexStepTracker,\n} from './codex-step-tracker';\nimport {\n  ToolRelayAuthorizer,\n  ToolRelayPendingCalls,\n  isToolRelayRequestFromAllowedProcess,\n  type ToolRelayCall,\n} from './tool-relay-auth';\nimport { argv, env as procEnv, stdout } from 'node:process';\n\n/*\n * CONSTRAINT — the third-party imports below are NEVER bundled into the\n * compiled `bridge/index.mjs`. They are declared `external` in\n * tsup.config.ts and resolved at runtime from the node_modules that this\n * bridge installs *inside the sandbox* from `src/bridge/package.json` (and\n * its pinned `pnpm-lock.yaml`). That bridge package.json — NOT this host\n * package — is the single source of truth for these packages and their\n * versions; the published `@ai-sdk/harness-codex` package does not provide\n * them at runtime.\n *\n * When adding or changing a third-party import here you MUST keep all three\n * in sync, or the bridge will either get the dependency bundled in or fail\n * to resolve it in the sandbox:\n *   1. the import statement below,\n *   2. the `external` array in tsup.config.ts, and\n *   3. the dependency entry in `src/bridge/package.json`.\n */\nimport * as codexSdkModule from '@openai/codex-sdk';\n\n/*\n * Native Codex tool name → cross-harness common name. Tools outside this map\n * (e.g. MCP tools the model invokes by name) have no common equivalent; their\n * native name is forwarded as-is on `tool-call` events.\n */\nconst NATIVE_TO_COMMON: Readonly<Record<string, HarnessV1BuiltinToolName>> = {\n  shell: 'bash',\n  web_search: 'webSearch',\n};\n\nfunction toCommonName(nativeName: string): HarnessV1BuiltinToolName | string {\n  return NATIVE_TO_COMMON[nativeName] ?? nativeName;\n}\n\nconst args = parseArgs(argv.slice(2));\nconst workdir = requireArg({ value: args.workdir, name: '--workdir' });\nconst bridgeStateDir = requireArg({\n  value: args.bridgeStateDir,\n  name: '--bridge-state-dir',\n});\nconst cliShimDir = requireArg({\n  value: args.cliShimDir,\n  name: '--cli-shim-dir',\n});\nconst bootstrapDir = args.bootstrapDir ?? workdir;\nconst HARNESS_CLIENT_APP = procEnv.AI_SDK_HARNESS_CLIENT_APP;\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nconst codexSdk = codexSdkModule as any;\n\n// Codex thread id — survives across turns within this bridge process and is\n// returned to the host on `detach` so a future process can resume the thread.\nconst threadState: { id: string | undefined } = { id: undefined };\n\nawait runBridge<StartMessage>({\n  bridgeType: 'codex',\n  bridgeStateDir,\n  onStart: runTurn,\n  onDetach: () => (threadState.id ? { threadId: threadState.id } : {}),\n});\n\ntype Emit = (msg: Record<string, unknown>) => void;\ntype ToolRelay = {\n  port: number;\n  close(): void;\n  authorizeToolCall(call: ToolRelayCall): void;\n  authorizeAnyToolCall(): void;\n};\n\nasync function runTurn(start: StartMessage, turn: BridgeTurn): Promise<void> {\n  const emit: Emit = msg => turn.emit(msg as BridgeEvent);\n\n  // Cross-process resume: the host carries the threadId we returned on detach.\n  // Seed `threadState.id` so the codex SDK call below takes the `resumeThread`\n  // branch.\n  if (\n    typeof start.resumeThreadId === 'string' &&\n    start.resumeThreadId.length > 0\n  ) {\n    threadState.id = start.resumeThreadId;\n  }\n\n  /*\n   * Known limitation: codex CLI does not currently surface MCP tools to the\n   * model in `codex exec --experimental-json` mode (the path the\n   * `@openai/codex-sdk` uses). The MCP handshake completes and `tools/list`\n   * returns the host tool, but codex never registers it as a model-callable\n   * function. Built-in MCP-resource accessors (`list_mcp_resources` etc.) are\n   * exposed; tools are not. Tracked upstream at\n   * https://github.com/openai/codex/issues/19425.\n   *\n   * Until that's fixed, host tools are made available to the model via a\n   * separate CLI-relay workaround (see `./cli-relay.ts`). The MCP server\n   * config below is kept so that the day codex starts exposing MCP tools\n   * properly, host tools work both ways. Writing the shim here, adding matching\n   * prompt guidance in the host adapter, and filtering the shim command below\n   * implement the workaround and can be removed once the upstream bug is fixed.\n   */\n  const mcpServers: Record<string, unknown> = {};\n  let relay: ToolRelay | undefined;\n  let cliShimPath: string | undefined;\n  if (start.tools && start.tools.length > 0) {\n    cliShimPath = `${cliShimDir}/${CLI_SHIM_FILENAME}`;\n    relay = await startToolRelay({\n      allowedScriptPaths: [cliShimPath, `${bootstrapDir}/host-tool-mcp.mjs`],\n      tools: start.tools,\n      emit,\n      requestToolResult: turn.requestToolResult,\n    });\n    mcpServers['harness-tools'] = {\n      enabled: true,\n      command: 'node',\n      args: [`${bootstrapDir}/host-tool-mcp.mjs`],\n      env: {\n        TOOL_SCHEMAS: JSON.stringify(\n          start.tools.map(t => ({\n            name: t.name,\n            description: t.description,\n            inputSchema: t.inputSchema,\n          })),\n        ),\n        TOOL_RELAY_URL: `http://127.0.0.1:${relay.port}`,\n      },\n    };\n    // Temporary workaround for upstream codex MCP-tool bug — see ./cli-relay.ts\n    await mkdir(cliShimDir, { recursive: true });\n    await writeFile(\n      cliShimPath,\n      buildCliShimScript({ relayPort: relay.port }),\n      'utf8',\n    );\n  }\n\n  const codexConfig: Record<string, unknown> = {};\n  if (Object.keys(mcpServers).length > 0) codexConfig.mcp_servers = mcpServers;\n\n  const gatewayBaseUrl = procEnv.AI_GATEWAY_BASE_URL;\n  const hasGatewayAuth = Boolean(procEnv.AI_GATEWAY_API_KEY || gatewayBaseUrl);\n  if (hasGatewayAuth && !gatewayBaseUrl) {\n    throw new Error(\n      'AI Gateway auth was selected but AI_GATEWAY_BASE_URL is missing from the Codex bridge environment.',\n    );\n  }\n  const apiBaseUrl = hasGatewayAuth ? gatewayBaseUrl : procEnv.OPENAI_BASE_URL;\n  if (apiBaseUrl) {\n    codexConfig.preferred_auth_method = 'apikey';\n    codexConfig.model_provider = 'agent_bridge_openai';\n    codexConfig.model_providers = {\n      agent_bridge_openai: {\n        name: procEnv.CODEX_MODEL_PROVIDER_NAME || 'Agent Bridge OpenAI',\n        base_url: apiBaseUrl,\n        env_key: 'CODEX_API_KEY',\n        wire_api: 'responses',\n        supports_websockets: false,\n        ...(hasGatewayAuth && HARNESS_CLIENT_APP\n          ? {\n              http_headers: {\n                'User-Agent': HARNESS_CLIENT_APP,\n                'x-client-app': HARNESS_CLIENT_APP,\n              },\n            }\n          : {}),\n      },\n    };\n  }\n  const usesConfiguredModelProvider =\n    typeof codexConfig.model_provider === 'string';\n\n  const codex = new codexSdk.Codex({\n    ...(procEnv.CODEX_API_KEY ? { apiKey: procEnv.CODEX_API_KEY } : {}),\n    ...(!usesConfiguredModelProvider && apiBaseUrl\n      ? { baseUrl: apiBaseUrl }\n      : {}),\n    env: Object.fromEntries(\n      Object.entries(procEnv).filter(\n        (entry): entry is [string, string] => typeof entry[1] === 'string',\n      ),\n    ),\n    ...(Object.keys(codexConfig).length > 0 ? { config: codexConfig } : {}),\n  });\n\n  const threadOptions = {\n    ...(start.model ? { model: start.model } : {}),\n    sandboxMode: 'danger-full-access',\n    approvalPolicy: 'never',\n    workingDirectory: workdir,\n    skipGitRepoCheck: true,\n    ...(start.reasoningEffort\n      ? { modelReasoningEffort: start.reasoningEffort }\n      : {}),\n    webSearchMode: start.webSearch ? 'live' : 'disabled',\n  };\n  const thread = threadState.id\n    ? codex.resumeThread(threadState.id, threadOptions)\n    : codex.startThread(threadOptions);\n\n  emit({ type: 'stream-start' });\n\n  const userMessage = start.prompt;\n  let turnUsage: Record<string, unknown> | undefined;\n  const textByItem = new Map<string, string>();\n  const reasoningByItem = new Map<string, string>();\n  const stepTracker = createCodexStepTracker({ send: emit });\n\n  try {\n    const { events } = await thread.runStreamed(userMessage, {\n      signal: turn.abortSignal,\n    });\n    for await (const event of events as AsyncIterable<CodexEvent>) {\n      if (turn.abortSignal.aborted) break;\n      if (\n        event.type === 'thread.started' &&\n        typeof event.thread_id === 'string'\n      ) {\n        threadState.id = event.thread_id;\n        // Announce to the host so it can include the id in resume state.\n        emit({ type: 'bridge-thread', threadId: event.thread_id });\n      }\n      // Temporary workaround for upstream codex MCP-tool bug — see ./cli-relay.ts\n      if (cliShimPath && event.item?.type === 'command_execution') {\n        const relayCall =\n          typeof event.item.command === 'string'\n            ? parseToolRelayCommand({\n                command: event.item.command,\n                cliShimPath,\n              })\n            : undefined;\n        if (event.type === 'item.started' && relay) {\n          if (relayCall) {\n            relay.authorizeToolCall(relayCall);\n          } else if (typeof event.item.command !== 'string') {\n            relay.authorizeAnyToolCall();\n          }\n        }\n        if (relayCall) {\n          stepTracker.observeEvent({ event, itemId: event.item.id });\n          continue;\n        }\n      }\n      if (relay && isHostMcpToolEvent(event)) {\n        stepTracker.observeEvent({ event, itemId: event.item?.id });\n        const relayCall = relayCallFromCodexMcpEvent(event);\n        if (relayCall) relay.authorizeToolCall(relayCall);\n        continue;\n      }\n      translateAndEmit(event, {\n        send: emit,\n        textByItem,\n        reasoningByItem,\n        stepTracker,\n        setTurnUsage: u => (turnUsage = u),\n        emitWarning: turn.emitWarning,\n        emitError: turn.emitError,\n      });\n    }\n  } catch (err) {\n    turn.emitError({ error: err, message: 'codex turn failed' });\n    return;\n  } finally {\n    relay?.close();\n  }\n\n  emit({\n    type: 'finish',\n    finishReason: { unified: 'stop', raw: 'stop' },\n    totalUsage: turnUsage ?? defaultUsage(),\n  });\n\n  void turn.pendingUserMessages; // accepted but only consumed when codex supports streamed user input\n}\n\ntype CodexItem = {\n  type: string;\n  id?: string;\n  text?: string;\n  command?: string;\n  exit_code?: number;\n  aggregated_output?: string;\n  status?: 'in_progress' | 'completed' | 'failed';\n  server?: string;\n  tool?: string;\n  arguments?: unknown;\n  result?: { content?: unknown; structured_content?: unknown } | unknown;\n  error?: { message?: string };\n  query?: string;\n  message?: string;\n  changes?: ReadonlyArray<{\n    path: string;\n    kind: 'add' | 'delete' | 'update';\n  }>;\n};\n\nfunction extractMcpToolCallResult(item: CodexItem): unknown {\n  if (\n    item.result === undefined ||\n    item.result === null ||\n    typeof item.result !== 'object'\n  ) {\n    return item.error?.message ? { error: item.error.message } : null;\n  }\n  const result = item.result as {\n    content?: unknown;\n    structured_content?: unknown;\n  };\n  if (\n    result.structured_content !== undefined &&\n    result.structured_content !== null\n  ) {\n    return result.structured_content;\n  }\n  return result.content ?? null;\n}\n\ntype CodexEvent = {\n  type:\n    | 'thread.started'\n    | 'turn.completed'\n    | 'turn.failed'\n    | 'error'\n    | 'item.started'\n    | 'item.updated'\n    | 'item.completed';\n  item?: CodexItem;\n  usage?: Record<string, number>;\n  error?: { message: string };\n  message?: string;\n  thread_id?: string;\n};\n\nfunction isHostMcpToolEvent(event: CodexEvent): boolean {\n  return (\n    event.item?.type === 'mcp_tool_call' &&\n    event.item.server === 'harness-tools'\n  );\n}\n\nfunction relayCallFromCodexMcpEvent(\n  event: CodexEvent,\n): ToolRelayCall | undefined {\n  if (event.type !== 'item.started') return undefined;\n  const toolName = event.item?.tool;\n  if (!toolName) return undefined;\n  return {\n    toolName,\n    input: event.item?.arguments ?? {},\n  };\n}\n\nfunction translateAndEmit(\n  event: CodexEvent,\n  ctx: {\n    send: Emit;\n    textByItem: Map<string, string>;\n    reasoningByItem: Map<string, string>;\n    stepTracker: CodexStepTracker;\n    setTurnUsage: (u: Record<string, unknown>) => void;\n    emitWarning: BridgeTurn['emitWarning'];\n    emitError: BridgeTurn['emitError'];\n  },\n): void {\n  if (event.type === 'turn.completed') {\n    if (event.usage) ctx.setTurnUsage(mapUsage(event.usage));\n    ctx.stepTracker.finishStep();\n    return;\n  }\n  if (event.type === 'turn.failed') {\n    ctx.emitError({\n      error: event.error?.message ?? 'codex turn failed',\n      message: 'codex turn failed',\n    });\n    return;\n  }\n  if (event.type === 'error') {\n    ctx.emitError({\n      error: event.message ?? 'codex error',\n      message: 'codex stream error',\n    });\n    return;\n  }\n  if (!event.item) return;\n  const item = event.item;\n  const id = item.id ?? randomUUID();\n  const observeStep = (): void => {\n    ctx.stepTracker.observeEvent({ event, itemId: id });\n  };\n\n  if (item.type === 'agent_message' && typeof item.text === 'string') {\n    /*\n     * The presence of `id` in `textByItem` — not the `item.started` event —\n     * marks the text part as opened. Codex does not guarantee an\n     * `item.started` event carrying text precedes the first `item.updated`\n     * with text, so keying the `text-start` off the event type can emit a\n     * `text-delta` for a part that was never opened. Opening lazily on the\n     * first event with text keeps `text-start` before any `text-delta`.\n     */\n    if (!ctx.textByItem.has(id)) {\n      ctx.send({ type: 'text-start', id });\n      ctx.textByItem.set(id, '');\n    }\n    const last = ctx.textByItem.get(id) ?? '';\n    const next = item.text;\n    if (next.length > last.length) {\n      ctx.send({ type: 'text-delta', id, delta: next.slice(last.length) });\n      ctx.textByItem.set(id, next);\n    }\n    if (event.type === 'item.completed') ctx.send({ type: 'text-end', id });\n    observeStep();\n    return;\n  }\n\n  if (item.type === 'reasoning' && typeof item.text === 'string') {\n    if (!ctx.reasoningByItem.has(id)) {\n      ctx.send({ type: 'reasoning-start', id });\n      ctx.reasoningByItem.set(id, '');\n    }\n    const last = ctx.reasoningByItem.get(id) ?? '';\n    const next = item.text;\n    if (next.length > last.length) {\n      ctx.send({ type: 'reasoning-delta', id, delta: next.slice(last.length) });\n      ctx.reasoningByItem.set(id, next);\n    }\n    if (event.type === 'item.completed')\n      ctx.send({ type: 'reasoning-end', id });\n    observeStep();\n    return;\n  }\n\n  if (item.type === 'command_execution') {\n    const nativeName = 'shell';\n    if (event.type === 'item.started') {\n      ctx.send({\n        type: 'tool-call',\n        toolCallId: id,\n        toolName: toCommonName(nativeName),\n        nativeName,\n        input: JSON.stringify({ command: item.command ?? '' }),\n        providerExecuted: true,\n      });\n    } else if (event.type === 'item.completed') {\n      ctx.send({\n        type: 'tool-result',\n        toolCallId: id,\n        toolName: toCommonName(nativeName),\n        result: {\n          exitCode: item.exit_code ?? null,\n          output: item.aggregated_output ?? '',\n          status: item.status ?? 'completed',\n        },\n      });\n    }\n    observeStep();\n    return;\n  }\n\n  if (item.type === 'mcp_tool_call') {\n    const isHostTool = item.server === 'harness-tools';\n    if (event.type === 'item.started') {\n      ctx.send({\n        type: 'tool-call',\n        toolCallId: id,\n        toolName: item.tool ?? 'unknown',\n        ...(isHostTool ? {} : { nativeName: item.tool ?? 'unknown' }),\n        input: JSON.stringify(item.arguments ?? {}),\n        providerExecuted: !isHostTool,\n      });\n    } else if (event.type === 'item.completed') {\n      ctx.send({\n        type: 'tool-result',\n        toolCallId: id,\n        toolName: item.tool ?? 'unknown',\n        result: extractMcpToolCallResult(item),\n      });\n    }\n    observeStep();\n    return;\n  }\n\n  if (item.type === 'web_search') {\n    const nativeName = 'web_search';\n    if (event.type === 'item.started') {\n      ctx.send({\n        type: 'tool-call',\n        toolCallId: id,\n        toolName: toCommonName(nativeName),\n        nativeName,\n        input: JSON.stringify({ query: item.query ?? '' }),\n        providerExecuted: true,\n      });\n    } else if (event.type === 'item.completed') {\n      ctx.send({\n        type: 'tool-result',\n        toolCallId: id,\n        toolName: toCommonName(nativeName),\n        result: item.result ?? null,\n      });\n    }\n    observeStep();\n    return;\n  }\n\n  if (item.type === 'file_change' && event.type === 'item.completed') {\n    for (const change of item.changes ?? []) {\n      ctx.send({\n        type: 'file-change',\n        event:\n          change.kind === 'add'\n            ? 'create'\n            : change.kind === 'delete'\n              ? 'delete'\n              : 'modify',\n        path: change.path,\n      });\n    }\n    observeStep();\n    return;\n  }\n\n  if (item.type === 'error' && event.type === 'item.completed') {\n    const message =\n      typeof item.message === 'string' && item.message.trim()\n        ? item.message\n        : 'codex reported a non-fatal error item';\n    ctx.emitWarning({ message });\n    return;\n  }\n}\n\nfunction mapUsage(usage: Record<string, number>): Record<string, unknown> {\n  const input = usage.input_tokens ?? 0;\n  const cacheRead = usage.cached_input_tokens ?? 0;\n  return {\n    inputTokens: {\n      total: input,\n      noCache: Math.max(0, input - cacheRead),\n      cacheRead,\n      cacheWrite: 0,\n    },\n    outputTokens: {\n      total: usage.output_tokens ?? 0,\n      text: usage.output_tokens ?? 0,\n    },\n  };\n}\n\n/**\n * Tool relay — HTTP server on 127.0.0.1:0. The MCP stdio shim spawned by\n * codex POSTs each tool invocation here; the relay forwards the call to the\n * host (via the shared runtime's `emit`), awaits the matching `tool-result`\n * (via `requestToolResult`), and responds with `{ result }`.\n */\nasync function startToolRelay({\n  allowedScriptPaths,\n  tools,\n  emit,\n  requestToolResult,\n}: {\n  allowedScriptPaths: ReadonlyArray<string>;\n  tools: ReadonlyArray<{ name: string }>;\n  emit: Emit;\n  requestToolResult: (\n    toolCallId: string,\n  ) => Promise<{ output: unknown; isError?: boolean }>;\n}): Promise<ToolRelay> {\n  const toolNames = new Set(tools.map(t => t.name));\n  const allowedScriptPathSet = new Set(allowedScriptPaths);\n  const authorizer = new ToolRelayAuthorizer();\n  const pendingCalls = new ToolRelayPendingCalls();\n\n  const server = createServer(async (req, res) => {\n    try {\n      if (req.method !== 'POST' || req.url !== '/') {\n        res.writeHead(401, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'unauthorized tool relay request' }));\n        return;\n      }\n      const chunks: Buffer[] = [];\n      for await (const chunk of req) {\n        chunks.push(chunk as Buffer);\n      }\n      const body = Buffer.concat(chunks).toString('utf8');\n      const { requestId, toolName, input } = JSON.parse(body) as {\n        requestId: string;\n        toolName: string;\n        input: unknown;\n      };\n\n      if (!toolNames.has(toolName)) {\n        res.writeHead(403, { 'Content-Type': 'application/json' });\n        res.end(\n          JSON.stringify({ error: `Tool \"${toolName}\" is not available` }),\n        );\n        return;\n      }\n      const relayCall = { toolName, input };\n      const authorized =\n        authorizer.consumeToolCall(relayCall) ||\n        (await isToolRelayRequestFromAllowedProcess({\n          socket: req.socket,\n          allowedScriptPaths: allowedScriptPathSet,\n        }));\n      if (!authorized) {\n        res.writeHead(401, { 'Content-Type': 'application/json' });\n        res.end(JSON.stringify({ error: 'unauthorized tool relay request' }));\n        return;\n      }\n\n      const { result } = pendingCalls.begin({\n        call: relayCall,\n        run: async () => {\n          emit({\n            type: 'tool-call',\n            toolCallId: requestId,\n            toolName,\n            input: JSON.stringify(input ?? {}),\n            providerExecuted: false,\n          });\n\n          const toolResult = await requestToolResult(requestId);\n          emit({\n            type: 'tool-result',\n            toolCallId: requestId,\n            toolName,\n            result: toolResult.output ?? null,\n            isError: !!toolResult.isError,\n          });\n          return toolResult;\n        },\n      });\n      const { output } = await result;\n\n      res.writeHead(200, { 'Content-Type': 'application/json' });\n      res.end(JSON.stringify({ result: output }));\n    } catch (error) {\n      res.writeHead(500, { 'Content-Type': 'application/json' });\n      res.end(\n        JSON.stringify({\n          error: error instanceof Error ? error.message : String(error),\n        }),\n      );\n    }\n  });\n\n  await new Promise<void>(resolve =>\n    server.listen(0, '127.0.0.1', () => resolve()),\n  );\n  const address = server.address();\n  if (!address || typeof address === 'string') {\n    throw new Error('tool relay did not expose a numeric port');\n  }\n  return {\n    port: address.port,\n    close: () => closeServer(server),\n    authorizeToolCall: call => authorizer.authorizeToolCall(call),\n    authorizeAnyToolCall: () => authorizer.authorizeAnyToolCall(),\n  };\n}\n\nfunction closeServer(server: Server): void {\n  try {\n    server.close();\n  } catch {}\n}\n\nfunction parseArgs(args: string[]): {\n  workdir?: string;\n  bridgeStateDir?: string;\n  bootstrapDir?: string;\n  cliShimDir?: string;\n} {\n  const out: {\n    workdir?: string;\n    bridgeStateDir?: string;\n    bootstrapDir?: string;\n    cliShimDir?: string;\n  } = {};\n  for (let i = 0; i < args.length; i++) {\n    if (args[i] === '--workdir' && i + 1 < args.length) {\n      out.workdir = args[++i];\n    } else if (args[i] === '--bridge-state-dir' && i + 1 < args.length) {\n      out.bridgeStateDir = args[++i];\n    } else if (args[i] === '--bootstrap-dir' && i + 1 < args.length) {\n      out.bootstrapDir = args[++i];\n    } else if (args[i] === '--cli-shim-dir' && i + 1 < args.length) {\n      out.cliShimDir = args[++i];\n    }\n  }\n  return out;\n}\n\nfunction emitFatal(message: string): never {\n  stdout.write(JSON.stringify({ type: 'bridge-fatal', message }) + '\\n');\n  process.exit(1);\n}\n\nfunction requireArg({\n  value,\n  name,\n}: {\n  value: string | undefined;\n  name: string;\n}): string {\n  if (!value) {\n    emitFatal(`Missing ${name} argument.`);\n  }\n  return value;\n}\n","/*\n * Temporary workaround for upstream codex CLI bug\n * https://github.com/openai/codex/issues/19425 — MCP tools registered via\n * `mcp_servers.*` are not exposed to the model in `codex exec --experimental-json`\n * mode (which is what `@openai/codex-sdk` uses). The MCP handshake completes\n * and `tools/list` succeeds, but codex never registers the tools as\n * model-callable functions.\n *\n * Until that's fixed upstream, this file implements a CLI-based relay:\n *\n *   1. A small Node script is written into harness-owned session state at turn\n *      start (`buildCliShimScript`). It accepts `<toolName> <jsonInput>` as\n *      argv, POSTs to the same HTTP relay the MCP shim uses, and prints the\n *      result to stdout.\n *\n *   2. Tool descriptions and invocation instructions are injected into the\n *      initial user prompt by the host adapter, telling the model to call host\n *      tools by running `node <shim-path> <toolName> '<jsonInput>'` via its\n *      built-in `bash` tool.\n *\n *   3. The bridge's event loop suppresses the matching `command_execution`\n *      events (`isToolRelayCommand`) so callers receive clean `tool-call` /\n *      `tool-result` events from the HTTP relay rather than seeing the\n *      relay invocations as raw bash commands.\n *\n * Once #19425 is fixed and MCP tools are properly exposed in exec mode, the\n * three hookpoints in `bridge/index.ts` can be removed along with this file.\n */\nexport const CLI_SHIM_FILENAME = 'harness-tool.mjs';\n\nexport function buildCliShimScript({\n  relayPort,\n}: {\n  relayPort: number;\n}): string {\n  return `#!/usr/bin/env node\nconst [toolName, inputJson = '{}'] = process.argv.slice(2);\nif (!toolName) {\n  console.error('Usage: harness-tool <tool_name> <json_input>');\n  process.exit(64);\n}\nlet input;\ntry {\n  input = JSON.parse(inputJson);\n} catch (error) {\n  console.error('Invalid JSON input: ' + (error instanceof Error ? error.message : String(error)));\n  process.exit(64);\n}\nconst requestId = 'cli-' + Date.now() + '-' + Math.random().toString(16).slice(2);\nconst response = await fetch('http://127.0.0.1:${relayPort}', {\n  method: 'POST',\n  headers: { 'Content-Type': 'application/json' },\n  body: JSON.stringify({ requestId, toolName, input }),\n});\nconst text = await response.text();\nlet payload;\ntry {\n  payload = text ? JSON.parse(text) : {};\n} catch {\n  payload = { error: text };\n}\nif (!response.ok || payload.error) {\n  console.error(String(payload.error ?? ('tool relay failed with HTTP ' + response.status)));\n  process.exit(1);\n}\nconsole.log(JSON.stringify(payload.result ?? payload, null, 2));\n`;\n}\n\nexport function isToolRelayCommand({\n  command,\n  cliShimPath,\n}: {\n  command: string;\n  cliShimPath: string;\n}): boolean {\n  return parseToolRelayCommand({ command, cliShimPath }) !== undefined;\n}\n\nexport function parseToolRelayCommand({\n  command,\n  cliShimPath,\n}: {\n  command: string;\n  cliShimPath: string;\n}): { toolName: string; input: unknown } | undefined {\n  return parseToolRelayCommandInternal({ command, cliShimPath, depth: 0 });\n}\n\nfunction parseToolRelayCommandInternal({\n  command,\n  cliShimPath,\n  depth,\n}: {\n  command: string;\n  cliShimPath: string;\n  depth: number;\n}): { toolName: string; input: unknown } | undefined {\n  const argv = parseShellWords(command);\n  if (!argv) return undefined;\n\n  const relayCall = parseDirectToolRelayArgv({ argv, cliShimPath });\n  if (relayCall) return relayCall;\n\n  const innerCommand = extractShellEvalCommand(argv);\n  if (!innerCommand || depth >= 2) return undefined;\n  return parseToolRelayCommandInternal({\n    command: innerCommand,\n    cliShimPath,\n    depth: depth + 1,\n  });\n}\n\nfunction parseDirectToolRelayArgv({\n  argv,\n  cliShimPath,\n}: {\n  argv: string[];\n  cliShimPath: string;\n}): { toolName: string; input: unknown } | undefined {\n  if (argv.length < 3 || argv.length > 4) return undefined;\n  if (argv[0] !== 'node' || argv[1] !== cliShimPath) return undefined;\n  const toolName = argv[2];\n  if (!toolName) return undefined;\n  try {\n    return { toolName, input: JSON.parse(argv[3] ?? '{}') };\n  } catch {\n    return undefined;\n  }\n}\n\nfunction extractShellEvalCommand(argv: string[]): string | undefined {\n  if (argv.length !== 3) return undefined;\n  const shellName = argv[0].split('/').at(-1);\n  if (shellName !== 'bash' && shellName !== 'sh' && shellName !== 'zsh') {\n    return undefined;\n  }\n  if (argv[1] !== '-c' && argv[1] !== '-lc') return undefined;\n  return argv[2];\n}\n\nfunction parseShellWords(command: string): string[] | undefined {\n  const words: string[] = [];\n  let current = '';\n  let quote: '\"' | \"'\" | undefined;\n  let hasCurrent = false;\n\n  const pushCurrent = () => {\n    if (!hasCurrent) return;\n    words.push(current);\n    current = '';\n    hasCurrent = false;\n  };\n\n  for (let i = 0; i < command.length; i++) {\n    const char = command[i];\n    if (quote === \"'\") {\n      if (char === \"'\") {\n        quote = undefined;\n      } else {\n        current += char;\n      }\n      hasCurrent = true;\n      continue;\n    }\n    if (quote === '\"') {\n      if (char === '\"') {\n        quote = undefined;\n      } else if (char === '\\\\' && i + 1 < command.length) {\n        current += command[++i];\n      } else {\n        current += char;\n      }\n      hasCurrent = true;\n      continue;\n    }\n    if (/\\s/.test(char)) {\n      pushCurrent();\n      continue;\n    }\n    if (char === '\"' || char === \"'\") {\n      quote = char;\n      hasCurrent = true;\n      continue;\n    }\n    if (char === '\\\\' && i + 1 < command.length) {\n      current += command[++i];\n      hasCurrent = true;\n      continue;\n    }\n    if (/[;&|<>()`$]/.test(char)) return undefined;\n    current += char;\n    hasCurrent = true;\n  }\n  if (quote) return undefined;\n  pushCurrent();\n  return words;\n}\n","import type { BridgeEvent } from '@ai-sdk/harness/bridge';\n\ntype Emit = (msg: BridgeEvent) => void;\n\nexport type CodexStepTrackerItem = {\n  type: string;\n};\n\nexport type CodexStepTrackerEvent = {\n  type: string;\n  item?: CodexStepTrackerItem;\n};\n\nexport type CodexStepTracker = {\n  observeEvent(input: {\n    event: CodexStepTrackerEvent;\n    itemId: string | undefined;\n  }): void;\n  finishStep(): void;\n};\n\nexport function createCodexStepTracker(input: {\n  send: Emit;\n}): CodexStepTracker {\n  let stepOpen = false;\n  const pendingToolItemIds = new Set<string>();\n\n  const finishStep = (): void => {\n    if (!stepOpen || pendingToolItemIds.size > 0) return;\n    input.send({\n      type: 'finish-step',\n      finishReason: { unified: 'stop', raw: 'stop' },\n      usage: defaultUsage(),\n      harnessMetadata: { codex: { inferredStep: true } },\n    });\n    stepOpen = false;\n  };\n\n  return {\n    observeEvent({ event, itemId }) {\n      const item = event.item;\n      if (!item || !isStepItem(item)) return;\n\n      stepOpen = true;\n\n      if (isToolStepItem(item)) {\n        if (event.type === 'item.started' && itemId) {\n          pendingToolItemIds.add(itemId);\n        } else if (event.type === 'item.completed') {\n          if (itemId) pendingToolItemIds.delete(itemId);\n          finishStep();\n        }\n        return;\n      }\n    },\n    finishStep,\n  };\n}\n\nfunction isStepItem(item: CodexStepTrackerItem): boolean {\n  return isModelStepItem(item) || isToolStepItem(item);\n}\n\nfunction isModelStepItem(item: CodexStepTrackerItem): boolean {\n  return item.type === 'reasoning' || item.type === 'agent_message';\n}\n\nfunction isToolStepItem(item: CodexStepTrackerItem): boolean {\n  return (\n    item.type === 'command_execution' ||\n    item.type === 'mcp_tool_call' ||\n    item.type === 'web_search' ||\n    item.type === 'file_change' ||\n    item.type === 'todo_list'\n  );\n}\n\nexport function defaultUsage(): Record<string, unknown> {\n  return {\n    inputTokens: { total: 0, noCache: 0, cacheRead: 0, cacheWrite: 0 },\n    outputTokens: { total: 0, text: 0 },\n  };\n}\n","import { readdir, readFile, readlink } from 'node:fs/promises';\nimport type { Socket } from 'node:net';\n\nexport type ToolRelayCall = {\n  toolName: string;\n  input: unknown;\n};\n\nexport type ToolRelayResult = {\n  output: unknown;\n  isError?: boolean;\n};\n\nexport class ToolRelayAuthorizer {\n  private readonly ttlMs: number;\n  private readonly now: () => number;\n  private readonly authorizations: Array<{\n    key?: string;\n    expiresAt: number;\n  }> = [];\n\n  constructor({\n    ttlMs = 10_000,\n    now = Date.now,\n  }: {\n    ttlMs?: number;\n    now?: () => number;\n  } = {}) {\n    this.ttlMs = ttlMs;\n    this.now = now;\n  }\n\n  authorizeToolCall(call: ToolRelayCall): void {\n    this.pruneExpired();\n    this.authorizations.push({\n      key: toolRelayCallKey(call),\n      expiresAt: this.now() + this.ttlMs,\n    });\n  }\n\n  authorizeAnyToolCall(): void {\n    this.pruneExpired();\n    this.authorizations.push({\n      expiresAt: this.now() + this.ttlMs,\n    });\n  }\n\n  consumeToolCall(call: ToolRelayCall): boolean {\n    this.pruneExpired();\n    const key = toolRelayCallKey(call);\n    let index = this.authorizations.findIndex(auth => auth.key === key);\n    if (index === -1) {\n      index = this.authorizations.findIndex(auth => auth.key === undefined);\n    }\n    if (index === -1) return false;\n    this.authorizations.splice(index, 1);\n    return true;\n  }\n\n  private pruneExpired(): void {\n    const now = this.now();\n    for (let i = this.authorizations.length - 1; i >= 0; i--) {\n      if (this.authorizations[i].expiresAt <= now) {\n        this.authorizations.splice(i, 1);\n      }\n    }\n  }\n}\n\nexport class ToolRelayPendingCalls {\n  private readonly calls = new Map<string, Promise<ToolRelayResult>>();\n\n  begin({\n    call,\n    run,\n  }: {\n    call: ToolRelayCall;\n    run: () => Promise<ToolRelayResult>;\n  }): { result: Promise<ToolRelayResult>; isNew: boolean } {\n    const key = toolRelayCallKey(call);\n    const existing = this.calls.get(key);\n    if (existing) return { result: existing, isNew: false };\n\n    const result = run();\n    this.calls.set(key, result);\n    void result\n      .finally(() => {\n        if (this.calls.get(key) === result) {\n          this.calls.delete(key);\n        }\n      })\n      .catch(() => {});\n    return { result, isNew: true };\n  }\n}\n\nfunction toolRelayCallKey({ toolName, input }: ToolRelayCall): string {\n  return `${toolName}\\0${canonicalJson(input ?? {})}`;\n}\n\nfunction canonicalJson(value: unknown): string {\n  return JSON.stringify(normalizeJsonValue(value));\n}\n\nfunction normalizeJsonValue(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map(normalizeJsonValue);\n  }\n  if (value && typeof value === 'object') {\n    return Object.fromEntries(\n      Object.entries(value as Record<string, unknown>)\n        .filter(([, entryValue]) => entryValue !== undefined)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([key, entryValue]) => [key, normalizeJsonValue(entryValue)]),\n    );\n  }\n  return value;\n}\n\nexport async function isToolRelayRequestFromAllowedProcess({\n  socket,\n  allowedScriptPaths,\n}: {\n  socket: Socket;\n  allowedScriptPaths: ReadonlySet<string>;\n}): Promise<boolean> {\n  if (process.platform !== 'linux') return false;\n  if (!socket.remotePort || !socket.localPort) return false;\n\n  const inode = await findTcpSocketInode({\n    clientPort: socket.remotePort,\n    serverPort: socket.localPort,\n  });\n  if (!inode) return false;\n\n  const cmdline = await findProcessCmdlineForSocketInode({ inode });\n  return cmdline?.some(arg => allowedScriptPaths.has(arg)) ?? false;\n}\n\nasync function findTcpSocketInode({\n  clientPort,\n  serverPort,\n}: {\n  clientPort: number;\n  serverPort: number;\n}): Promise<string | undefined> {\n  for (const tablePath of ['/proc/net/tcp', '/proc/net/tcp6']) {\n    const table = await readFile(tablePath, 'utf8').catch(() => undefined);\n    if (!table) continue;\n    for (const line of table.split('\\n').slice(1)) {\n      const columns = line.trim().split(/\\s+/);\n      if (columns.length < 10) continue;\n      const local = parseProcNetAddress(columns[1]);\n      const remote = parseProcNetAddress(columns[2]);\n      if (\n        local?.port === clientPort &&\n        remote?.port === serverPort &&\n        columns[9] !== '0'\n      ) {\n        return columns[9];\n      }\n    }\n  }\n  return undefined;\n}\n\nfunction parseProcNetAddress(value: string): { port: number } | undefined {\n  const [, portHex] = value.split(':');\n  if (!portHex) return undefined;\n  return { port: Number.parseInt(portHex, 16) };\n}\n\nasync function findProcessCmdlineForSocketInode({\n  inode,\n}: {\n  inode: string;\n}): Promise<string[] | undefined> {\n  const procEntries = await readdir('/proc', { withFileTypes: true }).catch(\n    () => [],\n  );\n  for (const entry of procEntries) {\n    if (!entry.isDirectory() || !/^\\d+$/.test(entry.name)) continue;\n    const fdDir = `/proc/${entry.name}/fd`;\n    const fds = await readdir(fdDir).catch(() => []);\n    for (const fd of fds) {\n      const target = await readlink(`${fdDir}/${fd}`).catch(() => undefined);\n      if (target !== `socket:[${inode}]`) continue;\n      const cmdline = await readFile(`/proc/${entry.name}/cmdline`, 'utf8')\n        .then(value => value.split('\\0').filter(Boolean))\n        .catch(() => undefined);\n      if (cmdline) return cmdline;\n    }\n  }\n  return undefined;\n}\n"],"mappings":";AAQA,SAAS,YAAY,OAAO,iBAAiB;AAC7C,SAAS,YAAY,oBAAoB;AACzC,SAAS,OAAO,SAAS,KAAK,cAAc;AAC5C,SAAS,uBAAuC;AAqBhD,IAAM,qBAAuD;EAC3D,OAAO;EACP,MAAM;EACN,MAAM;EACN,OAAO;EACP,OAAO;AACT;AAGA,SAAS,iBACP,SACA,WACS;AACT,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAC7C,SAAO,QAAQ;IACb,CAAA,WAAU,cAAc,UAAU,UAAU,WAAW,GAAG,MAAM,GAAG;EACrE;AACF;AAEA,SAAS,kBAAkB,KAIzB;AACA,MAAI,eAAe,OAAO;AACxB,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,OAAO,IAAI,MAAM;EAClE;AACA,MAAI,OAAO,QAAQ,UAAU;AAC3B,WAAO,EAAE,SAAS,IAAI;EACxB;AACA,MAAI,QAAQ,QAAQ,OAAO,QAAQ,UAAU;AAC3C,QAAI;AACF,aAAO,EAAE,SAAS,KAAK,UAAU,GAAG,EAAE;IACxC,QAAQ;IAAC;EACX;AACA,SAAO,EAAE,SAAS,OAAO,GAAG,EAAE;AAChC;AAEA,SAAS,aAAa,OAAiD;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,MACX,MAAM,GAAG,EACT,IAAI,CAAA,SAAQ,KAAK,KAAK,CAAC,EACvB,OAAO,OAAO;AACjB,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAEA,IAAM,aAAa,oBAAI,IAAI,CAAC,KAAK,QAAQ,OAAO,IAAI,CAAC;AAuHrD,IAAM,UAAU;AAehB,eAAsB,UACpB,SACuB;AACvB,QAAM,EAAE,YAAY,gBAAAA,iBAAgB,SAAS,SAAS,IAAI;AAC1D,QAAM,gBAAgB,QAAQ,SAAS,QAAQ,wBAAwB;AACvE,QAAM,eACJ,QAAQ,QAAQ,SAAS,QAAQ,kBAAkB,KAAK,EAAE;AAE5D,QAAM,iBAAiB,GAAGA,eAAc;AACxC,QAAM,kBAAkB,GAAGA,eAAc;AACzC,QAAM,uBAAuB,GAAGA,eAAc;AAC9C,QAAM,eAAe,GAAGA,eAAc;AAEtC,MAAI;AACF,UAAM,MAAMA,iBAAgB,EAAE,WAAW,KAAK,CAAC;EACjD,QAAQ;EAER;AAGA,MAAI,mBAAmB;AACvB,MAAI,mBAAgC;AACpC,MAAI;AACJ,MAAI,cAAc;AAClB,MAAI;AACJ,MAAI;AACJ,MAAI;AAIJ,MAAI;AACJ,MAAI,0BAA0B;AAC9B,QAAM,kBAAkB,WAAW;KAChC,QAAQ,iBAAiB,IAAI,YAAY;EAC5C;AAMA,MAAI,aAAa;AACjB,MAAI,WAAiD,CAAC;AAUtD,MAAI,aAAa;AACjB,MAAI,eAAqC;AAEzC,QAAM,oBAAoB,YAA2B;AACnD,WAAO,WAAW,SAAS,GAAG;AAC5B,YAAM,MAAM;AACZ,mBAAa;AACb,YAAM,WAAW,cAAc,GAAG,EAAE,MAAM,MAAM;MAGhD,CAAC;IACH;EACF;AAEA,QAAM,qBAAqB,MAAY;AACrC,QAAI,aAAc;AAClB,mBAAe,IAAI,QAAc,CAAA,YAAW;AAC1C,mBAAa,MAAM;AACjB,aAAK,kBAAkB,EAAE,QAAQ,OAAO;MAC1C,CAAC;IACH,CAAC,EAAE,QAAQ,MAAM;AACf,qBAAe;AACf,UAAI,WAAW,SAAS,GAAG;AACzB,2BAAmB;MACrB;IACF,CAAC;EACH;AAEA,QAAM,2BAA2B,YAA2B;AAC1D,QAAI,WAAW,SAAS,KAAK,CAAC,cAAc;AAC1C,yBAAmB;IACrB;AAIA,QAAI,WAAW;AACf,WAAO,UAAU;AACf,YAAM;AACN,iBAAW;IACb;EACF;AAUA,QAAM,iBAAiB,QAAQ,4BAA4B;AAC3D,MAAI,kBAAkB,WAAW,YAAY,GAAG;AAC9C,QAAI;AACF,YAAM,QAAQ,aAAa,cAAc,MAAM,EAC5C,MAAM,IAAI,EACV,IAAI,CAAA,SAAQ,KAAK,KAAK,CAAC,EACvB,OAAO,OAAO;AACjB,iBAAW,MAAM,IAAI,CAAA,UAAS;QAC5B,KAAM,KAAK,MAAM,IAAI,EAAsB;QAC3C;MACF,EAAE;AACF,mBAAa,SAAS,GAAG,EAAE,GAAG,OAAO;IACvC,QAAQ;AAGN,iBAAW,CAAC;AACZ,mBAAa;IACf;EACF;AAEA,QAAM,qBAAqB,oBAAI,IAG7B;AACF,QAAM,uBAAuB,oBAAI,IAG/B;AAGF,QAAM,kBAAkB,OAAO,UAAsC;AACnE,QAAI;AACF,YAAM;QACJ;QACA,KAAK,UAAU;UACb,MAAM;UACN,MAAM;UACN;UACA;QACF,CAAC;MACH;IACF,QAAQ;IAER;EACF;AAEA,QAAM,mBAAmB,OAAO,UAAkC;AAChE,QAAI;AACF,YAAM,aAAa,KAAK,UAAU,KAAK;AACvC,YAAM,UAAU,iBAAiB,UAAU;AAG3C,UAAI,CAAC,WAAW,oBAAoB,GAAG;AACrC,cAAM,UAAU,sBAAsB,UAAU;MAClD;IACF,QAAQ;IAER;EACF;AAGA,QAAM,cAAc,CAAC,QAAuC;AAC1D,QAAI,cAAc,eAAe,SAAS;AACxC,UAAI;AACF,qBAAa,KAAK,KAAK,UAAU,GAAG,CAAC;MACvC,QAAQ;MAER;IACF;EACF;AAEA,QAAM,OAAO,CAAC,UAA6B;AACzC,UAAM,MAAM,EAAE;AACd,UAAM,OAAO,KAAK,UAAU,EAAE,GAAG,OAAO,IAAI,CAAC;AAC7C,aAAS,KAAK,EAAE,KAAK,KAAK,CAAC;AAC3B,kBAAc,GAAG,IAAI;;AACrB,uBAAmB;AACnB,QAAI,cAAc,eAAe,SAAS;AACxC,UAAI;AACF,qBAAa,KAAK,IAAI;MACxB,QAAQ;MAGR;IACF;EACF;AAEA,QAAM,SAAS,CAAC,IAAe,aAA2B;AACxD,eAAW,SAAS,UAAU;AAC5B,UAAI,MAAM,MAAM,YAAY,GAAG,eAAe,SAAS;AACrD,WAAG,KAAK,MAAM,IAAI;MACpB;IACF;EACF;AAGA,QAAM,uBAAuB,CAC3B,OACA,cACY;AACZ,QAAI,CAAC,aAAa,QAAS,QAAO;AAClC,UAAM,YAAY,YAAY,SAAS;AACvC,QAAI,mBAAmB,KAAK,IAAI,mBAAmB,SAAS,EAAG,QAAO;AACtE,WAAO,iBAAiB,YAAY,YAAY,SAAS;EAC3D;AAUA,QAAM,iBAAiB,QAAQ,OAAO,MAAM,KAAK,QAAQ,MAAM;AAC/D,QAAM,iBAAiB,QAAQ,OAAO,MAAM,KAAK,QAAQ,MAAM;AAE/D,QAAM,qBAAqB,CAAC,UAGhB;AACV,QAAI;AACF,YAAM,YAAY,kBAAkB,MAAM,KAAK;AAC/C;QACE,YAAY,UAAU,WAAW,MAAM,OAAO,KAAK,UAAU,OAAO;;MACtE;AACA,UAAI,UAAU,OAAO;AACnB,uBAAe,GAAG,UAAU,KAAK;CAAI;MACvC;IACF,QAAQ;IAAC;EACX;AAEA,QAAM,cAAc,CAAC,UAAqC;AACxD,QAAI;AACF,iBAAW,QAAQ,MAAM,QAAQ,MAAM,IAAI,GAAG;AAC5C,YAAI,KAAK,KAAK,EAAE,SAAS,GAAG;AAC1B,yBAAe,YAAY,UAAU,UAAU,IAAI;CAAI;QACzD;MACF;IACF,QAAQ;IAAC;EACX;AAEA,QAAM,YAAY,CAAC,UAAsD;AACvE,uBAAmB;MACjB,SAAS,MAAM,WAAW;MAC1B,OAAO,MAAM;IACf,CAAC;AACD,SAAK,EAAE,MAAM,SAAS,OAAO,eAAe,MAAM,KAAK,EAAE,CAAC;EAC5D;AAEA,QAAM,wBAAwB,MAAY;AACxC,QAAI,wBAAyB;AAC7B,8BAA0B;AAC1B,UAAM,UAA8C;MAClD,QAAQ;MACR,QAAQ;IACV;AACA,UAAM,QACJ,CAAC,QAA6B,QAC9B,CAAC,OAAgB,UAAoB,OAA0B;AAC7D,UAAI,aAAa,SAAS;AACxB,YAAI;AACF,gBAAM,MAAM,OAAO,aAAa,WAAW,WAAW;AACtD,gBAAM,OACJ,OAAO,UAAU,WACb,QACA,OAAO,KAAK,KAAmB,EAAE;YAC/B;UACF;AACN,gBAAM,WAAW,QAAQ,MAAM,IAAI,KAAK,QAAQ,SAAS,IAAI;AAC7D,gBAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,kBAAQ,MAAM,IAAI,MAAM,IAAI,KAAK;AACjC,qBAAW,QAAQ,OAAO;AACxB,kBAAM,UAAU,KAAK,QAAQ,QAAQ,EAAE;AACvC,gBAAI,SAAS;AACX,mBAAK;gBACH,MAAM;gBACN,QAAQ;gBACR;gBACA,MAAM;cACR,CAAC;YACH;UACF;QACF,QAAQ;QAER;MACF;AACA,aAAQ;QACN;QACA;QACA;MACF;IACF;AACF,YAAQ,OAAO,QAAQ;MACrB;MACA;IACF;AACA,YAAQ,OAAO,QAAQ;MACrB;MACA;IACF;EACF;AAGA,QAAM,gBAAgB,OACpB,KACA,OACkB;AAClB,YAAQ,IAAI,MAAM;MAChB,KAAK,SAAS;AACZ,cAAM,YAAY;AAClB,sBAAc;AACd,mBAAW,CAAC;AAGZ,qBAAa;AACb,aAAK,UAAU,cAAc,EAAE,EAAE,MAAM,MAAM;QAAC,CAAC;AAC/C,oBAAY,IAAI,gBAAgB;AAChC,2BAAmB;AACnB,kCAA0B;AAC1B,aAAK,iBAAiB,GAAG;AACzB,aAAK,gBAAgB,SAAS;AAC9B,cAAM,aAAc,IAAsC;AAC1D,sBAAc;UACZ,SAAS,YAAY,WAAW;UAChC,OACE,YAAY,SACX,QAAQ;UACX,YACE,YAAY,cACZ,aAAa,QAAQ,wBAAwB;QACjD;AACA,YAAI,YAAY,SAAS;AACvB,gCAAsB;QACxB;AACA,cAAM,OAAmB;UACvB;UACA,mBAAmB,CAAA,eACjB,IAAI,QAAQ,CAAA,YAAW;AACrB,+BAAmB,IAAI,YAAY,OAAO;UAC5C,CAAC;UACH,qBAAqB,CAAA,eACnB,IAAI,QAAQ,CAAA,YAAW;AACrB,iCAAqB,IAAI,YAAY,OAAO;UAC9C,CAAC;UACH,qBAAqB,CAAC;UACtB,aAAa,UAAU;UACvB,aAAa,CAAA,YAAW;AACtB,sCAA0B;UAC5B;UACA;UACA,WAAW,CAAA,UAAS;AAClB,kBAAM,QAAQ,MAAM,SAAS;AAC7B,gBAAI,CAAC,qBAAqB,OAAO,MAAM,SAAS,EAAG;AACnD,iBAAK;cACH,MAAM;cACN;cACA,WAAW,MAAM;cACjB,SAAS,MAAM;cACf,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;cAC5C,GAAI,MAAM,UAAU,SAChB,EAAE,OAAO,kBAAkB,MAAM,KAAK,EAAE,IACxC,CAAC;YACP,CAAC;UACH;UACA;UACA;QACF;AACA,8BAAsB,KAAK;AAC3B,YAAI;AACF,gBAAM,QAAQ,KAAe,IAAI;QACnC,SAAS,KAAK;AACZ,oBAAU,EAAE,OAAO,KAAK,SAAS,qBAAqB,CAAC;QACzD,UAAA;AACE,oCAA0B;AAC1B,6BAAmB;AACnB,eAAK,gBAAgB,SAAS;QAChC;AACA;MACF;MACA,KAAK,eAAe;AAClB,cAAM,WAAW,mBAAmB,IAAI,IAAI,UAAU;AACtD,YAAI,UAAU;AACZ,6BAAmB,OAAO,IAAI,UAAU;AACxC,mBAAS,EAAE,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,CAAC;QACvD;AACA;MACF;MACA,KAAK,0BAA0B;AAC7B,cAAM,WAAW,qBAAqB,IAAI,IAAI,UAAU;AACxD,YAAI,UAAU;AACZ,+BAAqB,OAAO,IAAI,UAAU;AAC1C,mBAAS,EAAE,UAAU,IAAI,UAAU,QAAQ,IAAI,OAAO,CAAC;QACzD;AACA;MACF;MACA,KAAK;AACH,6BAAqB,KAAK,IAAI,IAAI;AAClC;MACF,KAAK;AACH,mBAAW,MAAM;AACjB;MACF,KAAK;AACH,YAAI;AACF,cAAI,yBAAyB;AAC3B,kBAAM,wBAAwB;UAChC,OAAO;AACL,uBAAW,MAAM;UACnB;AACA,sBAAY,EAAE,MAAM,sBAAsB,IAAI,KAAK,CAAC;QACtD,SAAS,KAAK;AACZ,sBAAY;YACV,MAAM;YACN,IAAI;YACJ,OAAO,eAAe,GAAG;UAC3B,CAAC;QACH;AACA;MACF,KAAK;AACH,eAAO,IAAI,IAAI,eAAe;AAC9B;MACF,KAAK;AACH,2BAAmB;AACnB,aAAK,gBAAgB,MAAM;AAC3B,sBAAc,IAAI,KAAM,UAAU;AAClC;MACF,KAAK,UAAU;AACb,2BAAmB;AACnB,aAAK,gBAAgB,MAAM;AAC3B,cAAM,OAAQ,MAAM,WAAW,KAAM,CAAC;AACtC,oBAAY,EAAE,MAAM,iBAAiB,KAAK,CAAC;AAC3C,sBAAc,IAAI,KAAM,QAAQ;AAChC;MACF;IACF;EACF;AAGA,OAAK,gBAAgB,MAAM;AAE3B,QAAM,MAAM,IAAI,gBAAgB,EAAE,MAAM,cAAc,MAAM,UAAU,CAAC;AAEvE,QAAM,OAAO,MAAY;AACvB,QAAI,QAAQ,QAAQ;AAClB,cAAQ,OAAO;AACf;IACF;AACA,QAAI,MAAM,MAAM,QAAQ,KAAK,CAAC,CAAC;AAC/B,eAAW,MAAM,QAAQ,KAAK,CAAC,GAAG,GAAI,EAAE,MAAM;EAChD;AAEA,QAAM,gBAAgB,CAAC,IAAe,MAAc,WAAyB;AAC3E,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,OAAO,MAAY;AACvB,YAAM,UAAU,GAAG,mBAAmB,KAAK,GAAG,eAAe;AAC7D,UAAI,WAAW,KAAK,IAAI,IAAI,SAAS,KAAO;AAG1C,aAAK,yBAAyB,EAAE,QAAQ,MAAM;AAC5C,cAAI;AACF,eAAG,MAAM,MAAM,MAAM;UACvB,UAAA;AACE,iBAAK;UACP;QACF,CAAC;AACD;MACF;AACA,iBAAW,MAAM,EAAE,EAAE,MAAM;IAC7B;AACA,SAAK;EACP;AAEA,MAAI,GAAG,aAAa,MAAM;AACxB,UAAM,OAAO,IAAI,QAAQ;AACzB,uBAAmB,OAAO,SAAS,YAAY,OAAO,KAAK,OAAO;AAClE,uBAAmB;AACnB,SAAK,gBAAgB,SAAS;AAC9B,WAAO;MACL,KAAK,UAAU;QACb,MAAM;QACN,MAAM;MACR,CAAC,IAAI;IACP;AACA,YAAQ,cAAc,gBAAgB;EACxC,CAAC;AAED,MAAI,GAAG,cAAc,CAAC,IAAe,QAA0B;AAC7D,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AACtD,QAAI,IAAI,aAAa,IAAI,oBAAoB,MAAM,eAAe;AAChE,SAAG,MAAM,MAAM,cAAc;AAC7B;IACF;AAKA,mBAAe;AAKf,gBAAY;MACV,MAAM;MACN,OAAO;MACP,SAAS;IACX,CAAC;AAED,OAAG,GAAG,WAAW,CAAC,QAAkC;AAClD,UAAI;AACJ,UAAI;AACF,cAAM,OACJ,OAAO,QAAQ,WAAW,MAAM,OAAO,KAAK,GAAG,EAAE,SAAS,MAAM;AAClE,iBAAS,KAAK,MAAM,IAAI;MAC1B,SAAS,KAAK;AACZ,oBAAY;UACV,MAAM;UACN,OAAO,yBAA0B,IAAc,OAAO;QACxD,CAAC;AACD;MACF;AACA,WAAK,cAAc,QAAQ,EAAE;IAC/B,CAAC;AAED,OAAG,GAAG,SAAS,MAAM;AAKnB,UAAI,iBAAiB,IAAI;AACvB,uBAAe;MACjB;IACF,CAAC;AAED,OAAG,GAAG,SAAS,MAAM;IAErB,CAAC;EACH,CAAC;AAGD,UAAQ,GAAG,qBAAqB,CAAA,QAAO;AACrC,cAAU,EAAE,OAAO,KAAK,SAAS,qBAAqB,CAAC;EACzD,CAAC;AACD,UAAQ,GAAG,sBAAsB,CAAA,QAAO;AACtC,cAAU,EAAE,OAAO,KAAK,SAAS,sBAAsB,CAAC;EAC1D,CAAC;AAED,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,QAAI,IAAI,QAAQ,KAAK,MAAM;AACzB,cAAQ;AACR;IACF;AAEA,QAAI,KAAK,aAAa,OAAO;AAC7B,QAAI,KAAK,SAAS,MAAM;EAC1B,CAAC;AAED,SAAO;IACL,MAAM;IACN,OAAO,MACL,IAAI,QAAc,CAAA,YAAW;AAC3B,UAAI,MAAM,MAAM,QAAQ,CAAC;IAC3B,CAAC;EACL;AACF;AAEA,SAAS,eAAe,KAAuB;AAC7C,MAAI,eAAe,OAAO;AACxB,WAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,OAAO,IAAI,MAAM;EAClE;AACA,SAAO;AACT;;;AC7vBA,SAAS,kBAAkB;AAC3B,SAAS,SAAAC,QAAO,aAAAC,kBAAiB;AACjC,SAAS,oBAAiC;;;ACOnC,IAAM,oBAAoB;AAE1B,SAAS,mBAAmB;AAAA,EACjC;AACF,GAEW;AACT,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iDAcwC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkB1D;AAYO,SAAS,sBAAsB;AAAA,EACpC;AAAA,EACA;AACF,GAGqD;AACnD,SAAO,8BAA8B,EAAE,SAAS,aAAa,OAAO,EAAE,CAAC;AACzE;AAEA,SAAS,8BAA8B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AACF,GAIqD;AACnD,QAAMC,QAAO,gBAAgB,OAAO;AACpC,MAAI,CAACA,MAAM,QAAO;AAElB,QAAM,YAAY,yBAAyB,EAAE,MAAAA,OAAM,YAAY,CAAC;AAChE,MAAI,UAAW,QAAO;AAEtB,QAAM,eAAe,wBAAwBA,KAAI;AACjD,MAAI,CAAC,gBAAgB,SAAS,EAAG,QAAO;AACxC,SAAO,8BAA8B;AAAA,IACnC,SAAS;AAAA,IACT;AAAA,IACA,OAAO,QAAQ;AAAA,EACjB,CAAC;AACH;AAEA,SAAS,yBAAyB;AAAA,EAChC,MAAAA;AAAA,EACA;AACF,GAGqD;AACnD,MAAIA,MAAK,SAAS,KAAKA,MAAK,SAAS,EAAG,QAAO;AAC/C,MAAIA,MAAK,CAAC,MAAM,UAAUA,MAAK,CAAC,MAAM,YAAa,QAAO;AAC1D,QAAM,WAAWA,MAAK,CAAC;AACvB,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,WAAO,EAAE,UAAU,OAAO,KAAK,MAAMA,MAAK,CAAC,KAAK,IAAI,EAAE;AAAA,EACxD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,wBAAwBA,OAAoC;AACnE,MAAIA,MAAK,WAAW,EAAG,QAAO;AAC9B,QAAM,YAAYA,MAAK,CAAC,EAAE,MAAM,GAAG,EAAE,GAAG,EAAE;AAC1C,MAAI,cAAc,UAAU,cAAc,QAAQ,cAAc,OAAO;AACrE,WAAO;AAAA,EACT;AACA,MAAIA,MAAK,CAAC,MAAM,QAAQA,MAAK,CAAC,MAAM,MAAO,QAAO;AAClD,SAAOA,MAAK,CAAC;AACf;AAEA,SAAS,gBAAgB,SAAuC;AAC9D,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,MAAI;AACJ,MAAI,aAAa;AAEjB,QAAM,cAAc,MAAM;AACxB,QAAI,CAAC,WAAY;AACjB,UAAM,KAAK,OAAO;AAClB,cAAU;AACV,iBAAa;AAAA,EACf;AAEA,WAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,UAAM,OAAO,QAAQ,CAAC;AACtB,QAAI,UAAU,KAAK;AACjB,UAAI,SAAS,KAAK;AAChB,gBAAQ;AAAA,MACV,OAAO;AACL,mBAAW;AAAA,MACb;AACA,mBAAa;AACb;AAAA,IACF;AACA,QAAI,UAAU,KAAK;AACjB,UAAI,SAAS,KAAK;AAChB,gBAAQ;AAAA,MACV,WAAW,SAAS,QAAQ,IAAI,IAAI,QAAQ,QAAQ;AAClD,mBAAW,QAAQ,EAAE,CAAC;AAAA,MACxB,OAAO;AACL,mBAAW;AAAA,MACb;AACA,mBAAa;AACb;AAAA,IACF;AACA,QAAI,KAAK,KAAK,IAAI,GAAG;AACnB,kBAAY;AACZ;AAAA,IACF;AACA,QAAI,SAAS,OAAO,SAAS,KAAK;AAChC,cAAQ;AACR,mBAAa;AACb;AAAA,IACF;AACA,QAAI,SAAS,QAAQ,IAAI,IAAI,QAAQ,QAAQ;AAC3C,iBAAW,QAAQ,EAAE,CAAC;AACtB,mBAAa;AACb;AAAA,IACF;AACA,QAAI,cAAc,KAAK,IAAI,EAAG,QAAO;AACrC,eAAW;AACX,iBAAa;AAAA,EACf;AACA,MAAI,MAAO,QAAO;AAClB,cAAY;AACZ,SAAO;AACT;;;AChLO,SAAS,uBAAuB,OAElB;AACnB,MAAI,WAAW;AACf,QAAM,qBAAqB,oBAAI,IAAY;AAE3C,QAAM,aAAa,MAAY;AAC7B,QAAI,CAAC,YAAY,mBAAmB,OAAO,EAAG;AAC9C,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,cAAc,EAAE,SAAS,QAAQ,KAAK,OAAO;AAAA,MAC7C,OAAO,aAAa;AAAA,MACpB,iBAAiB,EAAE,OAAO,EAAE,cAAc,KAAK,EAAE;AAAA,IACnD,CAAC;AACD,eAAW;AAAA,EACb;AAEA,SAAO;AAAA,IACL,aAAa,EAAE,OAAO,OAAO,GAAG;AAC9B,YAAM,OAAO,MAAM;AACnB,UAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAG;AAEhC,iBAAW;AAEX,UAAI,eAAe,IAAI,GAAG;AACxB,YAAI,MAAM,SAAS,kBAAkB,QAAQ;AAC3C,6BAAmB,IAAI,MAAM;AAAA,QAC/B,WAAW,MAAM,SAAS,kBAAkB;AAC1C,cAAI,OAAQ,oBAAmB,OAAO,MAAM;AAC5C,qBAAW;AAAA,QACb;AACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,WAAW,MAAqC;AACvD,SAAO,gBAAgB,IAAI,KAAK,eAAe,IAAI;AACrD;AAEA,SAAS,gBAAgB,MAAqC;AAC5D,SAAO,KAAK,SAAS,eAAe,KAAK,SAAS;AACpD;AAEA,SAAS,eAAe,MAAqC;AAC3D,SACE,KAAK,SAAS,uBACd,KAAK,SAAS,mBACd,KAAK,SAAS,gBACd,KAAK,SAAS,iBACd,KAAK,SAAS;AAElB;AAEO,SAAS,eAAwC;AACtD,SAAO;AAAA,IACL,aAAa,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,EAAE;AAAA,IACjE,cAAc,EAAE,OAAO,GAAG,MAAM,EAAE;AAAA,EACpC;AACF;;;AClFA,SAAS,SAAS,UAAU,gBAAgB;AAarC,IAAM,sBAAN,MAA0B;AAAA,EAQ/B,YAAY;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,KAAK;AAAA,EACb,IAGI,CAAC,GAAG;AAXR,SAAiB,iBAGZ,CAAC;AASJ,SAAK,QAAQ;AACb,SAAK,MAAM;AAAA,EACb;AAAA,EAEA,kBAAkB,MAA2B;AAC3C,SAAK,aAAa;AAClB,SAAK,eAAe,KAAK;AAAA,MACvB,KAAK,iBAAiB,IAAI;AAAA,MAC1B,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,IAC/B,CAAC;AAAA,EACH;AAAA,EAEA,uBAA6B;AAC3B,SAAK,aAAa;AAClB,SAAK,eAAe,KAAK;AAAA,MACvB,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,IAC/B,CAAC;AAAA,EACH;AAAA,EAEA,gBAAgB,MAA8B;AAC5C,SAAK,aAAa;AAClB,UAAM,MAAM,iBAAiB,IAAI;AACjC,QAAI,QAAQ,KAAK,eAAe,UAAU,UAAQ,KAAK,QAAQ,GAAG;AAClE,QAAI,UAAU,IAAI;AAChB,cAAQ,KAAK,eAAe,UAAU,UAAQ,KAAK,QAAQ,MAAS;AAAA,IACtE;AACA,QAAI,UAAU,GAAI,QAAO;AACzB,SAAK,eAAe,OAAO,OAAO,CAAC;AACnC,WAAO;AAAA,EACT;AAAA,EAEQ,eAAqB;AAC3B,UAAM,MAAM,KAAK,IAAI;AACrB,aAAS,IAAI,KAAK,eAAe,SAAS,GAAG,KAAK,GAAG,KAAK;AACxD,UAAI,KAAK,eAAe,CAAC,EAAE,aAAa,KAAK;AAC3C,aAAK,eAAe,OAAO,GAAG,CAAC;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AACF;AAEO,IAAM,wBAAN,MAA4B;AAAA,EAA5B;AACL,SAAiB,QAAQ,oBAAI,IAAsC;AAAA;AAAA,EAEnE,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,EACF,GAGyD;AACvD,UAAM,MAAM,iBAAiB,IAAI;AACjC,UAAM,WAAW,KAAK,MAAM,IAAI,GAAG;AACnC,QAAI,SAAU,QAAO,EAAE,QAAQ,UAAU,OAAO,MAAM;AAEtD,UAAM,SAAS,IAAI;AACnB,SAAK,MAAM,IAAI,KAAK,MAAM;AAC1B,SAAK,OACF,QAAQ,MAAM;AACb,UAAI,KAAK,MAAM,IAAI,GAAG,MAAM,QAAQ;AAClC,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF,CAAC,EACA,MAAM,MAAM;AAAA,IAAC,CAAC;AACjB,WAAO,EAAE,QAAQ,OAAO,KAAK;AAAA,EAC/B;AACF;AAEA,SAAS,iBAAiB,EAAE,UAAU,MAAM,GAA0B;AACpE,SAAO,GAAG,QAAQ,KAAK,cAAc,SAAS,CAAC,CAAC,CAAC;AACnD;AAEA,SAAS,cAAc,OAAwB;AAC7C,SAAO,KAAK,UAAU,mBAAmB,KAAK,CAAC;AACjD;AAEA,SAAS,mBAAmB,OAAyB;AACnD,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,kBAAkB;AAAA,EACrC;AACA,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAgC,EAC5C,OAAO,CAAC,CAAC,EAAE,UAAU,MAAM,eAAe,MAAS,EACnD,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,KAAK,UAAU,MAAM,CAAC,KAAK,mBAAmB,UAAU,CAAC,CAAC;AAAA,IACrE;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,qCAAqC;AAAA,EACzD;AAAA,EACA;AACF,GAGqB;AACnB,MAAI,QAAQ,aAAa,QAAS,QAAO;AACzC,MAAI,CAAC,OAAO,cAAc,CAAC,OAAO,UAAW,QAAO;AAEpD,QAAM,QAAQ,MAAM,mBAAmB;AAAA,IACrC,YAAY,OAAO;AAAA,IACnB,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,MAAM,iCAAiC,EAAE,MAAM,CAAC;AAChE,SAAO,SAAS,KAAK,SAAO,mBAAmB,IAAI,GAAG,CAAC,KAAK;AAC9D;AAEA,eAAe,mBAAmB;AAAA,EAChC;AAAA,EACA;AACF,GAGgC;AAC9B,aAAW,aAAa,CAAC,iBAAiB,gBAAgB,GAAG;AAC3D,UAAM,QAAQ,MAAM,SAAS,WAAW,MAAM,EAAE,MAAM,MAAM,MAAS;AACrE,QAAI,CAAC,MAAO;AACZ,eAAW,QAAQ,MAAM,MAAM,IAAI,EAAE,MAAM,CAAC,GAAG;AAC7C,YAAM,UAAU,KAAK,KAAK,EAAE,MAAM,KAAK;AACvC,UAAI,QAAQ,SAAS,GAAI;AACzB,YAAM,QAAQ,oBAAoB,QAAQ,CAAC,CAAC;AAC5C,YAAM,SAAS,oBAAoB,QAAQ,CAAC,CAAC;AAC7C,UACE,OAAO,SAAS,cAChB,QAAQ,SAAS,cACjB,QAAQ,CAAC,MAAM,KACf;AACA,eAAO,QAAQ,CAAC;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAA6C;AACxE,QAAM,CAAC,EAAE,OAAO,IAAI,MAAM,MAAM,GAAG;AACnC,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,EAAE,MAAM,OAAO,SAAS,SAAS,EAAE,EAAE;AAC9C;AAEA,eAAe,iCAAiC;AAAA,EAC9C;AACF,GAEkC;AAChC,QAAM,cAAc,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC,EAAE;AAAA,IAClE,MAAM,CAAC;AAAA,EACT;AACA,aAAW,SAAS,aAAa;AAC/B,QAAI,CAAC,MAAM,YAAY,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,EAAG;AACvD,UAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,UAAM,MAAM,MAAM,QAAQ,KAAK,EAAE,MAAM,MAAM,CAAC,CAAC;AAC/C,eAAW,MAAM,KAAK;AACpB,YAAM,SAAS,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE,EAAE,EAAE,MAAM,MAAM,MAAS;AACrE,UAAI,WAAW,WAAW,KAAK,IAAK;AACpC,YAAM,UAAU,MAAM,SAAS,SAAS,MAAM,IAAI,YAAY,MAAM,EACjE,KAAK,WAAS,MAAM,MAAM,IAAI,EAAE,OAAO,OAAO,CAAC,EAC/C,MAAM,MAAM,MAAS;AACxB,UAAI,QAAS,QAAO;AAAA,IACtB;AAAA,EACF;AACA,SAAO;AACT;;;AH3JA,SAAS,MAAM,OAAOC,UAAS,UAAAC,eAAc;AAmB7C,YAAY,oBAAoB;AAOhC,IAAM,mBAAuE;AAAA,EAC3E,OAAO;AAAA,EACP,YAAY;AACd;AAEA,SAAS,aAAa,YAAuD;AAC3E,SAAO,iBAAiB,UAAU,KAAK;AACzC;AAEA,IAAM,OAAO,UAAU,KAAK,MAAM,CAAC,CAAC;AACpC,IAAM,UAAU,WAAW,EAAE,OAAO,KAAK,SAAS,MAAM,YAAY,CAAC;AACrE,IAAM,iBAAiB,WAAW;AAAA,EAChC,OAAO,KAAK;AAAA,EACZ,MAAM;AACR,CAAC;AACD,IAAM,aAAa,WAAW;AAAA,EAC5B,OAAO,KAAK;AAAA,EACZ,MAAM;AACR,CAAC;AACD,IAAM,eAAe,KAAK,gBAAgB;AAC1C,IAAM,qBAAqBD,SAAQ;AAGnC,IAAM,WAAW;AAIjB,IAAM,cAA0C,EAAE,IAAI,OAAU;AAEhE,MAAM,UAAwB;AAAA,EAC5B,YAAY;AAAA,EACZ;AAAA,EACA,SAAS;AAAA,EACT,UAAU,MAAO,YAAY,KAAK,EAAE,UAAU,YAAY,GAAG,IAAI,CAAC;AACpE,CAAC;AAUD,eAAe,QAAQ,OAAqB,MAAiC;AAC3E,QAAM,OAAa,SAAO,KAAK,KAAK,GAAkB;AAKtD,MACE,OAAO,MAAM,mBAAmB,YAChC,MAAM,eAAe,SAAS,GAC9B;AACA,gBAAY,KAAK,MAAM;AAAA,EACzB;AAkBA,QAAM,aAAsC,CAAC;AAC7C,MAAI;AACJ,MAAI;AACJ,MAAI,MAAM,SAAS,MAAM,MAAM,SAAS,GAAG;AACzC,kBAAc,GAAG,UAAU,IAAI,iBAAiB;AAChD,YAAQ,MAAM,eAAe;AAAA,MAC3B,oBAAoB,CAAC,aAAa,GAAG,YAAY,oBAAoB;AAAA,MACrE,OAAO,MAAM;AAAA,MACb;AAAA,MACA,mBAAmB,KAAK;AAAA,IAC1B,CAAC;AACD,eAAW,eAAe,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS;AAAA,MACT,MAAM,CAAC,GAAG,YAAY,oBAAoB;AAAA,MAC1C,KAAK;AAAA,QACH,cAAc,KAAK;AAAA,UACjB,MAAM,MAAM,IAAI,QAAM;AAAA,YACpB,MAAM,EAAE;AAAA,YACR,aAAa,EAAE;AAAA,YACf,aAAa,EAAE;AAAA,UACjB,EAAE;AAAA,QACJ;AAAA,QACA,gBAAgB,oBAAoB,MAAM,IAAI;AAAA,MAChD;AAAA,IACF;AAEA,UAAME,OAAM,YAAY,EAAE,WAAW,KAAK,CAAC;AAC3C,UAAMC;AAAA,MACJ;AAAA,MACA,mBAAmB,EAAE,WAAW,MAAM,KAAK,CAAC;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAuC,CAAC;AAC9C,MAAI,OAAO,KAAK,UAAU,EAAE,SAAS,EAAG,aAAY,cAAc;AAElE,QAAM,iBAAiBH,SAAQ;AAC/B,QAAM,iBAAiB,QAAQA,SAAQ,sBAAsB,cAAc;AAC3E,MAAI,kBAAkB,CAAC,gBAAgB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,aAAa,iBAAiB,iBAAiBA,SAAQ;AAC7D,MAAI,YAAY;AACd,gBAAY,wBAAwB;AACpC,gBAAY,iBAAiB;AAC7B,gBAAY,kBAAkB;AAAA,MAC5B,qBAAqB;AAAA,QACnB,MAAMA,SAAQ,6BAA6B;AAAA,QAC3C,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,qBAAqB;AAAA,QACrB,GAAI,kBAAkB,qBAClB;AAAA,UACE,cAAc;AAAA,YACZ,cAAc;AAAA,YACd,gBAAgB;AAAA,UAClB;AAAA,QACF,IACA,CAAC;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACA,QAAM,8BACJ,OAAO,YAAY,mBAAmB;AAExC,QAAM,QAAQ,IAAI,SAAS,MAAM;AAAA,IAC/B,GAAIA,SAAQ,gBAAgB,EAAE,QAAQA,SAAQ,cAAc,IAAI,CAAC;AAAA,IACjE,GAAI,CAAC,+BAA+B,aAChC,EAAE,SAAS,WAAW,IACtB,CAAC;AAAA,IACL,KAAK,OAAO;AAAA,MACV,OAAO,QAAQA,QAAO,EAAE;AAAA,QACtB,CAAC,UAAqC,OAAO,MAAM,CAAC,MAAM;AAAA,MAC5D;AAAA,IACF;AAAA,IACA,GAAI,OAAO,KAAK,WAAW,EAAE,SAAS,IAAI,EAAE,QAAQ,YAAY,IAAI,CAAC;AAAA,EACvE,CAAC;AAED,QAAM,gBAAgB;AAAA,IACpB,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC5C,aAAa;AAAA,IACb,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,GAAI,MAAM,kBACN,EAAE,sBAAsB,MAAM,gBAAgB,IAC9C,CAAC;AAAA,IACL,eAAe,MAAM,YAAY,SAAS;AAAA,EAC5C;AACA,QAAM,SAAS,YAAY,KACvB,MAAM,aAAa,YAAY,IAAI,aAAa,IAChD,MAAM,YAAY,aAAa;AAEnC,OAAK,EAAE,MAAM,eAAe,CAAC;AAE7B,QAAM,cAAc,MAAM;AAC1B,MAAI;AACJ,QAAM,aAAa,oBAAI,IAAoB;AAC3C,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,QAAM,cAAc,uBAAuB,EAAE,MAAM,KAAK,CAAC;AAEzD,MAAI;AACF,UAAM,EAAE,OAAO,IAAI,MAAM,OAAO,YAAY,aAAa;AAAA,MACvD,QAAQ,KAAK;AAAA,IACf,CAAC;AACD,qBAAiB,SAAS,QAAqC;AAC7D,UAAI,KAAK,YAAY,QAAS;AAC9B,UACE,MAAM,SAAS,oBACf,OAAO,MAAM,cAAc,UAC3B;AACA,oBAAY,KAAK,MAAM;AAEvB,aAAK,EAAE,MAAM,iBAAiB,UAAU,MAAM,UAAU,CAAC;AAAA,MAC3D;AAEA,UAAI,eAAe,MAAM,MAAM,SAAS,qBAAqB;AAC3D,cAAM,YACJ,OAAO,MAAM,KAAK,YAAY,WAC1B,sBAAsB;AAAA,UACpB,SAAS,MAAM,KAAK;AAAA,UACpB;AAAA,QACF,CAAC,IACD;AACN,YAAI,MAAM,SAAS,kBAAkB,OAAO;AAC1C,cAAI,WAAW;AACb,kBAAM,kBAAkB,SAAS;AAAA,UACnC,WAAW,OAAO,MAAM,KAAK,YAAY,UAAU;AACjD,kBAAM,qBAAqB;AAAA,UAC7B;AAAA,QACF;AACA,YAAI,WAAW;AACb,sBAAY,aAAa,EAAE,OAAO,QAAQ,MAAM,KAAK,GAAG,CAAC;AACzD;AAAA,QACF;AAAA,MACF;AACA,UAAI,SAAS,mBAAmB,KAAK,GAAG;AACtC,oBAAY,aAAa,EAAE,OAAO,QAAQ,MAAM,MAAM,GAAG,CAAC;AAC1D,cAAM,YAAY,2BAA2B,KAAK;AAClD,YAAI,UAAW,OAAM,kBAAkB,SAAS;AAChD;AAAA,MACF;AACA,uBAAiB,OAAO;AAAA,QACtB,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,OAAM,YAAY;AAAA,QAChC,aAAa,KAAK;AAAA,QAClB,WAAW,KAAK;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF,SAAS,KAAK;AACZ,SAAK,UAAU,EAAE,OAAO,KAAK,SAAS,oBAAoB,CAAC;AAC3D;AAAA,EACF,UAAE;AACA,WAAO,MAAM;AAAA,EACf;AAEA,OAAK;AAAA,IACH,MAAM;AAAA,IACN,cAAc,EAAE,SAAS,QAAQ,KAAK,OAAO;AAAA,IAC7C,YAAY,aAAa,aAAa;AAAA,EACxC,CAAC;AAED,OAAK,KAAK;AACZ;AAuBA,SAAS,yBAAyB,MAA0B;AAC1D,MACE,KAAK,WAAW,UAChB,KAAK,WAAW,QAChB,OAAO,KAAK,WAAW,UACvB;AACA,WAAO,KAAK,OAAO,UAAU,EAAE,OAAO,KAAK,MAAM,QAAQ,IAAI;AAAA,EAC/D;AACA,QAAM,SAAS,KAAK;AAIpB,MACE,OAAO,uBAAuB,UAC9B,OAAO,uBAAuB,MAC9B;AACA,WAAO,OAAO;AAAA,EAChB;AACA,SAAO,OAAO,WAAW;AAC3B;AAkBA,SAAS,mBAAmB,OAA4B;AACtD,SACE,MAAM,MAAM,SAAS,mBACrB,MAAM,KAAK,WAAW;AAE1B;AAEA,SAAS,2BACP,OAC2B;AAC3B,MAAI,MAAM,SAAS,eAAgB,QAAO;AAC1C,QAAM,WAAW,MAAM,MAAM;AAC7B,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO;AAAA,IACL;AAAA,IACA,OAAO,MAAM,MAAM,aAAa,CAAC;AAAA,EACnC;AACF;AAEA,SAAS,iBACP,OACA,KASM;AACN,MAAI,MAAM,SAAS,kBAAkB;AACnC,QAAI,MAAM,MAAO,KAAI,aAAa,SAAS,MAAM,KAAK,CAAC;AACvD,QAAI,YAAY,WAAW;AAC3B;AAAA,EACF;AACA,MAAI,MAAM,SAAS,eAAe;AAChC,QAAI,UAAU;AAAA,MACZ,OAAO,MAAM,OAAO,WAAW;AAAA,MAC/B,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,SAAS,SAAS;AAC1B,QAAI,UAAU;AAAA,MACZ,OAAO,MAAM,WAAW;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,CAAC,MAAM,KAAM;AACjB,QAAM,OAAO,MAAM;AACnB,QAAM,KAAK,KAAK,MAAM,WAAW;AACjC,QAAM,cAAc,MAAY;AAC9B,QAAI,YAAY,aAAa,EAAE,OAAO,QAAQ,GAAG,CAAC;AAAA,EACpD;AAEA,MAAI,KAAK,SAAS,mBAAmB,OAAO,KAAK,SAAS,UAAU;AASlE,QAAI,CAAC,IAAI,WAAW,IAAI,EAAE,GAAG;AAC3B,UAAI,KAAK,EAAE,MAAM,cAAc,GAAG,CAAC;AACnC,UAAI,WAAW,IAAI,IAAI,EAAE;AAAA,IAC3B;AACA,UAAM,OAAO,IAAI,WAAW,IAAI,EAAE,KAAK;AACvC,UAAM,OAAO,KAAK;AAClB,QAAI,KAAK,SAAS,KAAK,QAAQ;AAC7B,UAAI,KAAK,EAAE,MAAM,cAAc,IAAI,OAAO,KAAK,MAAM,KAAK,MAAM,EAAE,CAAC;AACnE,UAAI,WAAW,IAAI,IAAI,IAAI;AAAA,IAC7B;AACA,QAAI,MAAM,SAAS,iBAAkB,KAAI,KAAK,EAAE,MAAM,YAAY,GAAG,CAAC;AACtE,gBAAY;AACZ;AAAA,EACF;AAEA,MAAI,KAAK,SAAS,eAAe,OAAO,KAAK,SAAS,UAAU;AAC9D,QAAI,CAAC,IAAI,gBAAgB,IAAI,EAAE,GAAG;AAChC,UAAI,KAAK,EAAE,MAAM,mBAAmB,GAAG,CAAC;AACxC,UAAI,gBAAgB,IAAI,IAAI,EAAE;AAAA,IAChC;AACA,UAAM,OAAO,IAAI,gBAAgB,IAAI,EAAE,KAAK;AAC5C,UAAM,OAAO,KAAK;AAClB,QAAI,KAAK,SAAS,KAAK,QAAQ;AAC7B,UAAI,KAAK,EAAE,MAAM,mBAAmB,IAAI,OAAO,KAAK,MAAM,KAAK,MAAM,EAAE,CAAC;AACxE,UAAI,gBAAgB,IAAI,IAAI,IAAI;AAAA,IAClC;AACA,QAAI,MAAM,SAAS;AACjB,UAAI,KAAK,EAAE,MAAM,iBAAiB,GAAG,CAAC;AACxC,gBAAY;AACZ;AAAA,EACF;AAEA,MAAI,KAAK,SAAS,qBAAqB;AACrC,UAAM,aAAa;AACnB,QAAI,MAAM,SAAS,gBAAgB;AACjC,UAAI,KAAK;AAAA,QACP,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,UAAU,aAAa,UAAU;AAAA,QACjC;AAAA,QACA,OAAO,KAAK,UAAU,EAAE,SAAS,KAAK,WAAW,GAAG,CAAC;AAAA,QACrD,kBAAkB;AAAA,MACpB,CAAC;AAAA,IACH,WAAW,MAAM,SAAS,kBAAkB;AAC1C,UAAI,KAAK;AAAA,QACP,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,UAAU,aAAa,UAAU;AAAA,QACjC,QAAQ;AAAA,UACN,UAAU,KAAK,aAAa;AAAA,UAC5B,QAAQ,KAAK,qBAAqB;AAAA,UAClC,QAAQ,KAAK,UAAU;AAAA,QACzB;AAAA,MACF,CAAC;AAAA,IACH;AACA,gBAAY;AACZ;AAAA,EACF;AAEA,MAAI,KAAK,SAAS,iBAAiB;AACjC,UAAM,aAAa,KAAK,WAAW;AACnC,QAAI,MAAM,SAAS,gBAAgB;AACjC,UAAI,KAAK;AAAA,QACP,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,UAAU,KAAK,QAAQ;AAAA,QACvB,GAAI,aAAa,CAAC,IAAI,EAAE,YAAY,KAAK,QAAQ,UAAU;AAAA,QAC3D,OAAO,KAAK,UAAU,KAAK,aAAa,CAAC,CAAC;AAAA,QAC1C,kBAAkB,CAAC;AAAA,MACrB,CAAC;AAAA,IACH,WAAW,MAAM,SAAS,kBAAkB;AAC1C,UAAI,KAAK;AAAA,QACP,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,UAAU,KAAK,QAAQ;AAAA,QACvB,QAAQ,yBAAyB,IAAI;AAAA,MACvC,CAAC;AAAA,IACH;AACA,gBAAY;AACZ;AAAA,EACF;AAEA,MAAI,KAAK,SAAS,cAAc;AAC9B,UAAM,aAAa;AACnB,QAAI,MAAM,SAAS,gBAAgB;AACjC,UAAI,KAAK;AAAA,QACP,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,UAAU,aAAa,UAAU;AAAA,QACjC;AAAA,QACA,OAAO,KAAK,UAAU,EAAE,OAAO,KAAK,SAAS,GAAG,CAAC;AAAA,QACjD,kBAAkB;AAAA,MACpB,CAAC;AAAA,IACH,WAAW,MAAM,SAAS,kBAAkB;AAC1C,UAAI,KAAK;AAAA,QACP,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,UAAU,aAAa,UAAU;AAAA,QACjC,QAAQ,KAAK,UAAU;AAAA,MACzB,CAAC;AAAA,IACH;AACA,gBAAY;AACZ;AAAA,EACF;AAEA,MAAI,KAAK,SAAS,iBAAiB,MAAM,SAAS,kBAAkB;AAClE,eAAW,UAAU,KAAK,WAAW,CAAC,GAAG;AACvC,UAAI,KAAK;AAAA,QACP,MAAM;AAAA,QACN,OACE,OAAO,SAAS,QACZ,WACA,OAAO,SAAS,WACd,WACA;AAAA,QACR,MAAM,OAAO;AAAA,MACf,CAAC;AAAA,IACH;AACA,gBAAY;AACZ;AAAA,EACF;AAEA,MAAI,KAAK,SAAS,WAAW,MAAM,SAAS,kBAAkB;AAC5D,UAAM,UACJ,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,KAAK,IAClD,KAAK,UACL;AACN,QAAI,YAAY,EAAE,QAAQ,CAAC;AAC3B;AAAA,EACF;AACF;AAEA,SAAS,SAAS,OAAwD;AACxE,QAAM,QAAQ,MAAM,gBAAgB;AACpC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,SAAO;AAAA,IACL,aAAa;AAAA,MACX,OAAO;AAAA,MACP,SAAS,KAAK,IAAI,GAAG,QAAQ,SAAS;AAAA,MACtC;AAAA,MACA,YAAY;AAAA,IACd;AAAA,IACA,cAAc;AAAA,MACZ,OAAO,MAAM,iBAAiB;AAAA,MAC9B,MAAM,MAAM,iBAAiB;AAAA,IAC/B;AAAA,EACF;AACF;AAQA,eAAe,eAAe;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAOuB;AACrB,QAAM,YAAY,IAAI,IAAI,MAAM,IAAI,OAAK,EAAE,IAAI,CAAC;AAChD,QAAM,uBAAuB,IAAI,IAAI,kBAAkB;AACvD,QAAM,aAAa,IAAI,oBAAoB;AAC3C,QAAM,eAAe,IAAI,sBAAsB;AAE/C,QAAM,SAAS,aAAa,OAAO,KAAK,QAAQ;AAC9C,QAAI;AACF,UAAI,IAAI,WAAW,UAAU,IAAI,QAAQ,KAAK;AAC5C,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kCAAkC,CAAC,CAAC;AACpE;AAAA,MACF;AACA,YAAM,SAAmB,CAAC;AAC1B,uBAAiB,SAAS,KAAK;AAC7B,eAAO,KAAK,KAAe;AAAA,MAC7B;AACA,YAAM,OAAO,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AAClD,YAAM,EAAE,WAAW,UAAU,MAAM,IAAI,KAAK,MAAM,IAAI;AAMtD,UAAI,CAAC,UAAU,IAAI,QAAQ,GAAG;AAC5B,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI;AAAA,UACF,KAAK,UAAU,EAAE,OAAO,SAAS,QAAQ,qBAAqB,CAAC;AAAA,QACjE;AACA;AAAA,MACF;AACA,YAAM,YAAY,EAAE,UAAU,MAAM;AACpC,YAAM,aACJ,WAAW,gBAAgB,SAAS,KACnC,MAAM,qCAAqC;AAAA,QAC1C,QAAQ,IAAI;AAAA,QACZ,oBAAoB;AAAA,MACtB,CAAC;AACH,UAAI,CAAC,YAAY;AACf,YAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,YAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kCAAkC,CAAC,CAAC;AACpE;AAAA,MACF;AAEA,YAAM,EAAE,OAAO,IAAI,aAAa,MAAM;AAAA,QACpC,MAAM;AAAA,QACN,KAAK,YAAY;AACf,eAAK;AAAA,YACH,MAAM;AAAA,YACN,YAAY;AAAA,YACZ;AAAA,YACA,OAAO,KAAK,UAAU,SAAS,CAAC,CAAC;AAAA,YACjC,kBAAkB;AAAA,UACpB,CAAC;AAED,gBAAM,aAAa,MAAM,kBAAkB,SAAS;AACpD,eAAK;AAAA,YACH,MAAM;AAAA,YACN,YAAY;AAAA,YACZ;AAAA,YACA,QAAQ,WAAW,UAAU;AAAA,YAC7B,SAAS,CAAC,CAAC,WAAW;AAAA,UACxB,CAAC;AACD,iBAAO;AAAA,QACT;AAAA,MACF,CAAC;AACD,YAAM,EAAE,OAAO,IAAI,MAAM;AAEzB,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI,IAAI,KAAK,UAAU,EAAE,QAAQ,OAAO,CAAC,CAAC;AAAA,IAC5C,SAAS,OAAO;AACd,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,UAAI;AAAA,QACF,KAAK,UAAU;AAAA,UACb,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC9D,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,IAAI;AAAA,IAAc,aACtB,OAAO,OAAO,GAAG,aAAa,MAAM,QAAQ,CAAC;AAAA,EAC/C;AACA,QAAM,UAAU,OAAO,QAAQ;AAC/B,MAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO;AAAA,IACL,MAAM,QAAQ;AAAA,IACd,OAAO,MAAM,YAAY,MAAM;AAAA,IAC/B,mBAAmB,UAAQ,WAAW,kBAAkB,IAAI;AAAA,IAC5D,sBAAsB,MAAM,WAAW,qBAAqB;AAAA,EAC9D;AACF;AAEA,SAAS,YAAY,QAAsB;AACzC,MAAI;AACF,WAAO,MAAM;AAAA,EACf,QAAQ;AAAA,EAAC;AACX;AAEA,SAAS,UAAUI,OAKjB;AACA,QAAM,MAKF,CAAC;AACL,WAAS,IAAI,GAAG,IAAIA,MAAK,QAAQ,KAAK;AACpC,QAAIA,MAAK,CAAC,MAAM,eAAe,IAAI,IAAIA,MAAK,QAAQ;AAClD,UAAI,UAAUA,MAAK,EAAE,CAAC;AAAA,IACxB,WAAWA,MAAK,CAAC,MAAM,wBAAwB,IAAI,IAAIA,MAAK,QAAQ;AAClE,UAAI,iBAAiBA,MAAK,EAAE,CAAC;AAAA,IAC/B,WAAWA,MAAK,CAAC,MAAM,qBAAqB,IAAI,IAAIA,MAAK,QAAQ;AAC/D,UAAI,eAAeA,MAAK,EAAE,CAAC;AAAA,IAC7B,WAAWA,MAAK,CAAC,MAAM,oBAAoB,IAAI,IAAIA,MAAK,QAAQ;AAC9D,UAAI,aAAaA,MAAK,EAAE,CAAC;AAAA,IAC3B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,UAAU,SAAwB;AACzC,EAAAH,QAAO,MAAM,KAAK,UAAU,EAAE,MAAM,gBAAgB,QAAQ,CAAC,IAAI,IAAI;AACrE,UAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,WAAW;AAAA,EAClB;AAAA,EACA;AACF,GAGW;AACT,MAAI,CAAC,OAAO;AACV,cAAU,WAAW,IAAI,YAAY;AAAA,EACvC;AACA,SAAO;AACT;","names":["bridgeStateDir","mkdir","writeFile","argv","procEnv","stdout","mkdir","writeFile","args"]}

package/dist/index.js

@@ -10,6 +10,10 @@ import {
 } from "@ai-sdk/harness";
 import {
   classifyDiskLog,
+  createBridgeErrorHandler,
+  createBridgeStartupError,
+  drainBridgeProcessStream,
+  forwardBridgeProcessStream,
   markBridgeStarting,
   resolveSandboxHomeDir,
   SandboxChannel,
@@ -120,7 +124,7 @@ var inboundMessageSchema = z.discriminatedUnion("type", [
 var CLI_SHIM_FILENAME = "harness-tool.mjs";
 
 // src/version.ts
-var VERSION = true ? "1.0.23" : "0.0.0-test";
+var VERSION = true ? "1.0.24" : "0.0.0-test";
 
 // src/codex-harness.ts
 var DEFAULT_CODEX_MODEL = "gpt-5.3-codex";
@@ -223,6 +227,10 @@ function createCodex(settings = {}) {
           timestamp: Date.now()
         })
       ) : void 0;
+      const onBridgeError = createBridgeErrorHandler({
+        harnessId: "codex",
+        sessionId: startOpts.sessionId
+      });
       if (coords) {
         try {
           const attachUrl = await sandboxSession.getPortUrl({
@@ -233,7 +241,8 @@ function createCodex(settings = {}) {
             connect: () => openWebSocket(attachUrl),
             outboundSchema: outboundMessageSchema,
             initialLastSeenEventId: coords.lastSeenEventId,
-            onDiagnostic
+            onDiagnostic,
+            onBridgeError
           });
           await attachChannel.open(isContinue ? { resume: true } : void 0);
           return createSession({
@@ -305,6 +314,13 @@ function createCodex(settings = {}) {
         env,
         abortSignal: startOpts.abortSignal
       });
+      const stderrTail = [];
+      const bridgeStderrDone = forwardBridgeProcessStream({
+        stream: proc.stderr,
+        streamName: "stderr",
+        source: "codex",
+        collectTail: stderrTail
+      });
       const { port: boundPort } = await waitForBridgeReady({
         proc,
         sandbox: session,
@@ -312,11 +328,22 @@ function createCodex(settings = {}) {
         bridgeType: "codex",
         timeoutMs,
         abortSignal: startOpts.abortSignal,
-        createTimeoutError: () => new Error("codex bridge did not become ready in time."),
-        createExitError: () => new Error("codex bridge exited before becoming ready.")
+        createTimeoutError: ({ proc: proc2, stdoutTail }) => createBridgeStartupError({
+          message: "codex bridge did not become ready in time.",
+          proc: proc2,
+          stdoutTail,
+          stderrTail,
+          stderrDone: bridgeStderrDone
+        }),
+        createExitError: ({ proc: proc2, stdoutTail }) => createBridgeStartupError({
+          message: "codex bridge exited before becoming ready.",
+          proc: proc2,
+          stdoutTail,
+          stderrTail,
+          stderrDone: bridgeStderrDone
+        })
       });
-      void drainRest(proc.stdout);
-      void forwardBridgeStderr(proc.stderr);
+      void drainBridgeProcessStream(proc.stdout);
       const wsUrl = await sandboxSession.getPortUrl({
         port: boundPort,
         protocol: "ws"
@@ -325,6 +352,7 @@ function createCodex(settings = {}) {
         connect: () => openWebSocket(wsUrl),
         outboundSchema: outboundMessageSchema,
         onDiagnostic,
+        onBridgeError,
         // In replay mode the respawned bridge reloaded the finished turn from
         // disk; seed the cursor and resume so it streams the tail (incl.
         // `finish`).
@@ -404,32 +432,6 @@ async function writeCodexSkills({
     codexHomeDir
   };
 }
-async function forwardBridgeStderr(stream) {
-  try {
-    const reader = stream.pipeThrough(new TextDecoderStream()).getReader();
-    while (true) {
-      const { value, done } = await reader.read();
-      if (done) return;
-      if (value) {
-        const trimmed = value.endsWith("\n") ? value.slice(0, -1) : value;
-        if (trimmed.length > 0) {
-          console.log(`[bridge stderr] ${trimmed}`);
-        }
-      }
-    }
-  } catch {
-  }
-}
-async function drainRest(stream) {
-  try {
-    const reader = stream.pipeThrough(new TextDecoderStream()).getReader();
-    while (true) {
-      const { done } = await reader.read();
-      if (done) return;
-    }
-  } catch {
-  }
-}
 function openWebSocket(url) {
   return new Promise((resolve, reject) => {
     const ws = new WebSocket(url);
@@ -802,6 +804,7 @@ function createSession({
         );
       }
       stopped = true;
+      await channel.interrupt();
       const lastSeenEventId = await channel.suspend();
       const payload = {
         type: "continue-turn",