@avi770/testteam 3.0.0 → 3.2.0

package/dist/agents/99-logging-hygiene-auditor.js

@@ -0,0 +1,325 @@
+/**
+ * Logging Hygiene Auditor — static scan for log statements that leak
+ * secrets or PII. Logs routinely get shipped to third-party aggregators
+ * (Datadog, Sentry, CloudWatch), so a `console.log(user)` that includes a
+ * password hash or a `logger.info(req.headers)` that includes an
+ * Authorization bearer token is a real exfiltration path.
+ *
+ * Detected log calls: console.{log,info,warn,error,debug,trace,dir},
+ * logger.{...}, log.{...}, req.log.{...}, fastify.log.{...},
+ * this.logger.{...}.
+ *
+ * Findings (scanned within each log call's argument list):
+ *   - 99-logs-sensitive-var  high    code-bug-security
+ *     A clearly-secret identifier/property is logged: password, secret,
+ *     apiKey, privateKey, clientSecret, accessToken, authorization,
+ *     creditCard, ssn (and snake_case variants).
+ *   - 99-logs-process-env    high    code-bug-security
+ *     process.env (whole object or a specific var) is logged — dumps
+ *     secrets straight into the log stream.
+ *   - 99-logs-request-object medium  code-bug-security
+ *     A raw request / req.body / req.headers / req.cookies is logged —
+ *     may carry auth headers, session cookies, or PII in the body.
+ *   - 99-summary             info    infra-issue
+ *
+ * Persists `evidence/logging-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+import { maskNonCode, isTestPath } from './lib/source-scan.js';
+const SRC_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt', 'coverage', 'reports', 'baselines', 'evidence',
+]);
+/** Secret-shaped identifiers. Matched as property accesses or bare/bracketed names. */
+const SENSITIVE_KEYWORDS = [
+    'password', 'passwd', 'pwd',
+    'secret', 'clientSecret', 'client_secret',
+    'apiKey', 'api_key', 'apikey',
+    'accessToken', 'access_token', 'refreshToken', 'refresh_token',
+    'privateKey', 'private_key',
+    'authorization', 'authToken', 'auth_token',
+    'creditCard', 'credit_card', 'cardNumber', 'card_number',
+    'ssn', 'sessionSecret',
+];
+function walk(dir, results = []) {
+    if (!fs.existsSync(dir))
+        return results;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(full, results);
+        }
+        else if (entry.isFile() && SRC_EXTENSIONS.has(path.extname(entry.name))) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+/** Read a balanced `(...)` slice starting at the opening paren; string-aware. */
+function readBalancedParens(content, openIdx) {
+    if (content[openIdx] !== '(')
+        return null;
+    let depth = 0;
+    let inString = null;
+    let escape = false;
+    for (let i = openIdx; i < content.length; i++) {
+        const ch = content[i];
+        if (escape) {
+            escape = false;
+            continue;
+        }
+        if (inString) {
+            if (ch === '\\')
+                escape = true;
+            else if (ch === inString)
+                inString = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            inString = ch;
+            continue;
+        }
+        if (ch === '(')
+            depth++;
+        else if (ch === ')') {
+            depth--;
+            if (depth === 0)
+                return { text: content.slice(openIdx, i + 1), endIdx: i };
+        }
+    }
+    return null;
+}
+/**
+ * Inspect a log call's argument text for sensitive content. Returns the
+ * issues found (a single call can trip more than one).
+ */
+export function inspectLogArgs(args) {
+    const out = [];
+    // process.env — flag the whole object (dumps every secret) always; flag a
+    // specific var only when its name looks secret-shaped. Logging a benign var
+    // like process.env.PORT or process.env.SERVICE_URL is not a leak.
+    const envAccess = args.match(/\bprocess\.env\s*(?:\.\s*([A-Za-z_$][\w$]*)|\[\s*['"`]([^'"`]+)['"`]\s*\])?/);
+    if (envAccess) {
+        const varName = envAccess[1] ?? envAccess[2];
+        if (!varName) {
+            // `process.env` with no accessor → the whole environment object.
+            out.push({ kind: 'logs-process-env', detail: 'process.env' });
+        }
+        else if (/(?:^|_)(?:SECRET|TOKEN|KEY|PASSWORD|PASSWD|CREDENTIAL|PRIVATE|AUTH|DSN)(?:_|$)/i.test(varName)) {
+            // Segment-bounded so AUTH matches AUTH_TOKEN but not NEXTAUTH_URL, KEY matches
+            // API_KEY but not MONKEY, etc.
+            out.push({ kind: 'logs-process-env', detail: `process.env.${varName}` });
+        }
+    }
+    // Sensitive identifier as a property (.password), bracket (['password']),
+    // or bare/keyed (password: / password,). Case-insensitive.
+    for (const kw of SENSITIVE_KEYWORDS) {
+        const re = new RegExp(`(?:\\.${kw}\\b|\\[\\s*['"\`]${kw}['"\`]\\s*\\]|\\b${kw}\\s*[:,)])`, 'i');
+        if (re.test(args)) {
+            out.push({ kind: 'logs-sensitive-var', detail: kw });
+            break; // one sensitive-var finding per call is enough signal
+        }
+    }
+    // Raw request object / its sensitive sub-objects.
+    // req, request, ctx.request as a bare arg, or .body/.headers/.cookies.
+    const reqRe = /\b(?:req|request)\b(?:\s*[,)]|\.(?:body|headers|cookies|rawHeaders|session))?/;
+    const reqMatch = args.match(reqRe);
+    if (reqMatch) {
+        // A `req` passed INTO another function — `logger.info(transformRequest(req))`,
+        // a sanitizer — isn't raw-request logging; only flag a direct/top-level req.
+        const before = args.slice(0, reqMatch.index ?? 0);
+        const wrappedInCall = /[A-Za-z_$][\w$]*\s*\(\s*(?:\.\.\.\s*)?$/.test(before);
+        // Only flag when it's the whole arg (req,) or a sensitive sub-object —
+        // not req.params.id which is usually safe.
+        if (!wrappedInCall &&
+            (/\b(?:req|request)\s*[,)]/.test(args) || /\.(?:body|headers|cookies|rawHeaders|session)\b/.test(args))) {
+            out.push({ kind: 'logs-request-object', detail: reqMatch[0].trim().replace(/[,)]$/, '') });
+        }
+    }
+    return out;
+}
+/** Find all log-call sites and the issues within their arguments. */
+export function scanLogging(content) {
+    const hits = [];
+    let logCalls = 0;
+    // Strip comments so a logging example in a doc comment isn't counted as a
+    // real log call. Strings are kept — secret-shaped keywords live inside them.
+    // Line numbers come from the original (comment-only masking preserves them).
+    const masked = maskNonCode(content, { maskStrings: false });
+    // Broad matcher for the call head; we then read balanced parens for args.
+    const heads = [
+        /\b(?:console|logger|log)\s*\.\s*(?:log|info|warn|error|debug|trace|dir)\s*\(/g,
+        /\.\s*log\s*\.\s*(?:info|warn|error|debug|trace)\s*\(/g, // req.log.info(...), fastify.log.error(...)
+    ];
+    const seenIndices = new Set();
+    for (const head of heads) {
+        const re = new RegExp(head.source, head.flags);
+        let m;
+        while ((m = re.exec(masked)) !== null) {
+            const openParen = m.index + m[0].length - 1;
+            if (seenIndices.has(openParen))
+                continue;
+            seenIndices.add(openParen);
+            const balanced = readBalancedParens(masked, openParen);
+            if (!balanced)
+                continue;
+            logCalls++;
+            const line = content.slice(0, m.index).split('\n').length;
+            const snippet = balanced.text.replace(/\s+/g, ' ').slice(0, 160);
+            for (const issue of inspectLogArgs(balanced.text)) {
+                hits.push({ kind: issue.kind, detail: issue.detail, line, snippet });
+            }
+        }
+    }
+    return { logCalls, hits };
+}
+export class LoggingHygieneAuditorAgent extends BaseAgent {
+    agentId = 99;
+    agentName = 'Logging Hygiene Auditor';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const sourceFiles = new Set();
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        try {
+            const map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+            for (const f of map.files) {
+                if (!f.isTest)
+                    sourceFiles.add(path.join(projectRoot, f.path));
+            }
+        }
+        catch {
+            for (const f of walk(projectRoot))
+                sourceFiles.add(f);
+        }
+        const allHits = [];
+        let filesScanned = 0;
+        let logCallsSeen = 0;
+        for (const file of sourceFiles) {
+            // Test files are full of deliberate secret/PII fixtures — skip them, as
+            // the other static scanners do (the map path filters them too).
+            if (isTestPath(file, projectRoot))
+                continue;
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            filesScanned++;
+            const rel = relativise(file, projectRoot);
+            const { logCalls, hits } = scanLogging(content);
+            logCallsSeen += logCalls;
+            for (const hit of hits)
+                allHits.push({ ...hit, file: rel });
+        }
+        if (allHits.length === 0) {
+            findings.push({
+                id: `${this.agentId}-clean`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'logging-hygiene-auditor',
+                description: `Scanned ${filesScanned} file(s), ${logCallsSeen} log call(s) — no secret/PII logging detected.`,
+            });
+            this.persistAudit(projectRoot, filesScanned, logCallsSeen, allHits);
+            return findings;
+        }
+        const seen = new Set();
+        for (const hit of allHits) {
+            const key = `${hit.kind}:${hit.file}:${hit.line}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            findings.push(this.toFinding(hit));
+            if (seen.size >= 100)
+                break;
+        }
+        this.persistAudit(projectRoot, filesScanned, logCallsSeen, allHits);
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'logging-hygiene-auditor',
+            description: `Logging hygiene: ${allHits.length} issue(s) across ${filesScanned} file(s) / ${logCallsSeen} log call(s).`,
+        });
+        return findings;
+    }
+    toFinding(hit) {
+        const slug = `${hit.file.replace(/[^\w]/g, '_')}-${hit.line}`;
+        const base = { agentId: this.agentId, module: 'logging-hygiene-auditor', file: hit.file, line: hit.line };
+        switch (hit.kind) {
+            case 'logs-sensitive-var':
+                return {
+                    ...base,
+                    id: `${this.agentId}-logs-sensitive-var-${slug}`,
+                    type: 'code-bug-security',
+                    severity: 'high',
+                    description: `Log statement at ${hit.file}:${hit.line} references a secret-shaped value ("${hit.detail}") — it will be written to the log stream and likely shipped to a log aggregator. \`${hit.snippet}\``,
+                };
+            case 'logs-process-env':
+                return {
+                    ...base,
+                    id: `${this.agentId}-logs-process-env-${slug}`,
+                    type: 'code-bug-security',
+                    severity: 'high',
+                    description: `Log statement at ${hit.file}:${hit.line} logs process.env — this dumps environment secrets (DB URLs, API keys) into the logs. \`${hit.snippet}\``,
+                };
+            case 'logs-request-object':
+                return {
+                    ...base,
+                    id: `${this.agentId}-logs-request-object-${slug}`,
+                    type: 'code-bug-security',
+                    severity: 'medium',
+                    description: `Log statement at ${hit.file}:${hit.line} logs a raw request object ("${hit.detail}") — request headers carry Authorization tokens and cookies; bodies carry PII. Log specific safe fields instead. \`${hit.snippet}\``,
+                };
+        }
+    }
+    persistAudit(projectRoot, filesScanned, logCallsSeen, hits) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            filesScanned,
+            logCallsSeen,
+            hits,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'logging-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/logging-audit.json',
+                description: `Logging hygiene: ${hits.length} issue(s) across ${filesScanned} file(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=99-logging-hygiene-auditor.js.map

package/dist/agents/99-logging-hygiene-auditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"99-logging-hygiene-auditor.js","sourceRoot":"","sources":["../../agents/99-logging-hygiene-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACpG,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC7C,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU;CAC1G,CAAC,CAAC;AAEH,uFAAuF;AACvF,MAAM,kBAAkB,GAA0B;IAChD,UAAU,EAAE,QAAQ,EAAE,KAAK;IAC3B,QAAQ,EAAE,cAAc,EAAE,eAAe;IACzC,QAAQ,EAAE,SAAS,EAAE,QAAQ;IAC7B,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe;IAC9D,YAAY,EAAE,aAAa;IAC3B,eAAe,EAAE,WAAW,EAAE,YAAY;IAC1C,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa;IACxD,KAAK,EAAE,eAAe;CACvB,CAAC;AAqBF,SAAS,IAAI,CAAC,GAAW,EAAE,UAAoB,EAAE;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,OAAe,EAAE,OAAe;IAC1D,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,KAAK,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,EAAE,KAAK,IAAI;gBAAE,MAAM,GAAG,IAAI,CAAC;iBAC1B,IAAI,EAAE,KAAK,QAAQ;gBAAE,QAAQ,GAAG,IAAI,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC3C,QAAQ,GAAG,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAkD,EAAE,CAAC;IAE9D,0EAA0E;IAC1E,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAC5G,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,iEAAiE;YACjE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,iFAAiF,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3G,+EAA+E;YAC/E,+BAA+B;YAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,2DAA2D;IAC3D,KAAK,MAAM,EAAE,IAAI,kBAAkB,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,SAAS,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,YAAY,EACnE,GAAG,CACJ,CAAC;QACF,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACrD,MAAM,CAAC,sDAAsD;QAC/D,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,uEAAuE;IACvE,MAAM,KAAK,GAAG,+EAA+E,CAAC;IAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,QAAQ,EAAE,CAAC;QACb,+EAA+E;QAC/E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,yCAAyC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7E,uEAAuE;QACvE,2CAA2C;QAC3C,IAAI,CAAC,aAAa;YACd,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iDAAiD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC5G,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,IAAI,GAAgC,EAAE,CAAC;IAC7C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5D,0EAA0E;IAC1E,MAAM,KAAK,GAAG;QACZ,+EAA+E;QAC/E,uDAAuD,EAAE,4CAA4C;KACtG,CAAC;IAEF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC5C,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,SAAS;YACzC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACvD,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,QAAQ,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACjE,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,OAAO,0BAA2B,SAAQ,SAAS;IAC9C,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,yBAAyB,CAAC;IAErC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,wEAAwE;YACxE,gEAAgE;YAChE,IAAI,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,YAAY,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAChD,YAAY,IAAI,QAAQ,CAAC;YACzB,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,yBAAyB;gBACjC,WAAW,EAAE,WAAW,YAAY,aAAa,YAAY,gDAAgD;aAC9G,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACpE,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG;gBAAE,MAAM;QAC9B,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAEpE,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,yBAAyB;YACjC,WAAW,EAAE,oBAAoB,OAAO,CAAC,MAAM,oBAAoB,YAAY,cAAc,YAAY,eAAe;SACzH,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,SAAS,CAAC,GAAW;QAC3B,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1G,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,oBAAoB;gBACvB,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,uBAAuB,IAAI,EAAE;oBAChD,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,oBAAoB,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,uCAAuC,GAAG,CAAC,MAAM,uFAAuF,GAAG,CAAC,OAAO,IAAI;iBAC7M,CAAC;YACJ,KAAK,kBAAkB;gBACrB,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,qBAAqB,IAAI,EAAE;oBAC9C,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,oBAAoB,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,2FAA2F,GAAG,CAAC,OAAO,IAAI;iBAChK,CAAC;YACJ,KAAK,qBAAqB;gBACxB,OAAO;oBACL,GAAG,IAAI;oBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,wBAAwB,IAAI,EAAE;oBACjD,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,oBAAoB,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,gCAAgC,GAAG,CAAC,MAAM,sHAAsH,GAAG,CAAC,OAAO,IAAI;iBACrO,CAAC;QACN,CAAC;IACH,CAAC;IAEO,YAAY,CAClB,WAAmB,EACnB,YAAoB,EACpB,YAAoB,EACpB,IAAc;QAEd,MAAM,KAAK,GAAiB;YAC1B,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,YAAY;YACZ,YAAY;YACZ,IAAI;SACL,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAC5C,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,6BAA6B;gBACnC,WAAW,EAAE,oBAAoB,IAAI,CAAC,MAAM,oBAAoB,YAAY,UAAU;aACvF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/agents/base-agent.d.ts

@@ -1,14 +1,69 @@
-import type { AgentResult, Finding, Phase, EvidenceItem } from '../core/types';
-import type { ValidatedConfig } from '../core/config';
-import type { TotalRecallClient } from '../clients/total-recall';
+import type { AgentResult, Finding, Phase, EvidenceItem } from '../core/types.js';
+import type { ValidatedConfig } from '../core/config.js';
+import type { TotalRecallClient } from '../clients/total-recall.js';
+import { type RunMode, type FrameStreamer } from '../core/run-mode/index.js';
+import { type AgentContract } from '../core/agent-contract.js';
+import { LoopKernel, type KernelConfig, type LoopEvent, type LoopHandlers, type LoopReducer, type TraceSink } from '../core/loop-engine/index.js';
+/**
+ * Thrown by an agent when its preconditions aren't met (no reachable app, the
+ * target package/route doesn't exist, etc.). The runner maps it to an `idle`
+ * result — informational, not a failure — so a phase gate isn't blocked just
+ * because there was nothing to test.
+ */
+export declare class PreconditionNotMetError extends Error {
+    constructor(message: string);
+}
 export declare abstract class BaseAgent {
     protected readonly config: ValidatedConfig;
     protected readonly phase: Phase;
     protected readonly runDir: string;
     protected readonly totalRecall?: TotalRecallClient | undefined;
-    constructor(config: ValidatedConfig, phase: Phase, runDir: string, totalRecall?: TotalRecallClient | undefined);
+    /**
+     * Headed/headless run mode (Phase 3.2 seam). Defaults to headless so every existing
+     * caller is unchanged; the run engine passes a headed RunMode for the live Cockpit
+     * screencast. Browser-launching agents derive Playwright options via `launchOptions(this.runMode)`.
+     */
+    protected readonly runMode: RunMode;
+    /**
+     * Per-run screencast streamer (Phase 3.2). Undefined on headless/non-streamed runs (the common
+     * case — capture costs nothing). On a headed Cockpit run the engine supplies one, and
+     * browser-launching agents pipe their page into it via `startScreencast(page, this.frames)`.
+     */
+    protected readonly frames?: FrameStreamer | undefined;
+    constructor(config: ValidatedConfig, phase: Phase, runDir: string, totalRecall?: TotalRecallClient | undefined, 
+    /**
+     * Headed/headless run mode (Phase 3.2 seam). Defaults to headless so every existing
+     * caller is unchanged; the run engine passes a headed RunMode for the live Cockpit
+     * screencast. Browser-launching agents derive Playwright options via `launchOptions(this.runMode)`.
+     */
+    runMode?: RunMode, 
+    /**
+     * Per-run screencast streamer (Phase 3.2). Undefined on headless/non-streamed runs (the common
+     * case — capture costs nothing). On a headed Cockpit run the engine supplies one, and
+     * browser-launching agents pipe their page into it via `startScreencast(page, this.frames)`.
+     */
+    frames?: FrameStreamer | undefined);
     abstract readonly agentId: number;
     abstract readonly agentName: string;
+    /**
+     * Agent Contract (governance standard, Phase 0.3). Default = read-only with no declared
+     * capabilities (default-deny). Subclasses override to declare capabilities + a higher tier.
+     */
+    readonly contract: AgentContract;
+    /**
+     * Live loop-cognition observer, injected by the run engine (Option B). When set BEFORE
+     * `run()`, an agent that opts into the kernel forwards it to `LoopKernel`'s `onEvent`, so its
+     * per-cycle cognition streams to the Cockpit. Undefined by default → no wiring, zero cost (the
+     * 84 engine agents + all headless runs are unaffected). It is a read-only observer: it cannot
+     * change the agent's findings, and the kernel isolates a throwing observer (replay stays exact).
+     */
+    private loopEventObserver?;
+    /**
+     * Register a live loop-event observer for this agent's kernel (called by `registerAllAgents`
+     * during registration, before `run()`). The observer is already bound by the caller to this
+     * agent's identity, so the kernel-facing callback stays the plain `(event) => void` shape.
+     */
+    setLoopEventObserver(observer: (event: LoopEvent) => void): void;
     run(): Promise<AgentResult>;
     protected evidence: EvidenceItem[];
     /** AVI-OS pre-flight: audit dependencies, validate plan, check pre-conditions */
@@ -16,6 +71,21 @@ export declare abstract class BaseAgent {
     /** Main execution logic -- single pass, no incremental fix-and-see */
     protected abstract execute(): Promise<Finding[]>;
     protected addEvidence(item: EvidenceItem): void;
+    /** The effective, identity-stamped contract — every agent exposes this (conformance surface). */
+    describeContract(): AgentContract & {
+        readonly agentId: number;
+        readonly agentName: string;
+    };
+    /**
+     * Construct a shared Loop Engine kernel (Phase 1.1) for this agent's core-cognition loops.
+     * ADDITIVE + opt-in: the existing `run()` path is unchanged, so all 84 engine agents are
+     * unaffected; agents that want the cognitive substrate (budgets, confidence-gating,
+     * circuit-breakers, tracing, event-sourced replay) call this. Spec: blueprint/loops/00-LOOP-ENGINE.md.
+     */
+    protected loopKernel<S>(initialState: S, handlers: LoopHandlers<S>, reduce: LoopReducer<S>, config?: Partial<KernelConfig>, options?: {
+        readonly trace?: TraceSink;
+        readonly clock?: () => number;
+    }): LoopKernel<S>;
     private buildSummary;
 }
 //# sourceMappingURL=base-agent.d.ts.map

package/dist/agents/base-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-agent.d.ts","sourceRoot":"","sources":["../../agents/base-agent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,8BAAsB,SAAS;IAE3B,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe;IAC1C,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK;IAC/B,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACjC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB;gBAH/B,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,iBAAiB,YAAA;IAGpD,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE9B,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC;IAiDjC,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAM;IAExC,iFAAiF;IACjF,SAAS,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAE7C,sEAAsE;IACtE,SAAS,CAAC,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAEhD,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAI/C,OAAO,CAAC,YAAY;CAQrB"}
+{"version":3,"file":"base-agent.d.ts","sourceRoot":"","sources":["../../agents/base-agent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAoB,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,KAAK,aAAa,EAA0B,MAAM,wBAAwB,CAAC;AACpF,OAAO,EACL,UAAU,EACV,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAE7B;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAWD,8BAAsB,SAAS;IAE3B,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe;IAC1C,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK;IAC/B,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACjC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB;IAClD;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO;IACnC;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa;gBAftB,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,iBAAiB,YAAA;IAClD;;;;OAIG;IACgB,OAAO,GAAE,OAA0B;IACtD;;;;OAIG;IACgB,MAAM,CAAC,EAAE,aAAa,YAAA;IAG3C,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAEpC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAA0B;IAE1D;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB,CAAC,CAA6B;IAEvD;;;;OAIG;IACH,oBAAoB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,IAAI;IAI1D,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC;IA2EjC,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAM;IAExC,iFAAiF;IACjF,SAAS,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAE7C,sEAAsE;IACtE,SAAS,CAAC,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAEhD,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAI/C,iGAAiG;IACjG,gBAAgB,IAAI,aAAa,GAAG;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAS5F;;;;;OAKG;IACH,SAAS,CAAC,UAAU,CAAC,CAAC,EACpB,YAAY,EAAE,CAAC,EACf,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,EACtB,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,EAC9B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE,GACtE,UAAU,CAAC,CAAC,CAAC;IAShB,OAAO,CAAC,YAAY;CAQrB"}

package/dist/agents/base-agent.js

@@ -1,13 +1,71 @@
+import { DEFAULT_RUN_MODE } from '../core/run-mode/index.js';
+import { DEFAULT_AGENT_CONTRACT } from '../core/agent-contract.js';
+import { LoopKernel, } from '../core/loop-engine/index.js';
+/**
+ * Thrown by an agent when its preconditions aren't met (no reachable app, the
+ * target package/route doesn't exist, etc.). The runner maps it to an `idle`
+ * result — informational, not a failure — so a phase gate isn't blocked just
+ * because there was nothing to test.
+ */
+export class PreconditionNotMetError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'PreconditionNotMetError';
+    }
+}
+function isPreconditionNotMet(error) {
+    // Duck-typed alongside instanceof: tsx/ESM can load this module in more than
+    // one realm, where instanceof alone would miss a cross-realm instance.
+    return (error instanceof PreconditionNotMetError ||
+        (error instanceof Error && error.name === 'PreconditionNotMetError'));
+}
 export class BaseAgent {
     config;
     phase;
     runDir;
     totalRecall;
-    constructor(config, phase, runDir, totalRecall) {
+    runMode;
+    frames;
+    constructor(config, phase, runDir, totalRecall, 
+    /**
+     * Headed/headless run mode (Phase 3.2 seam). Defaults to headless so every existing
+     * caller is unchanged; the run engine passes a headed RunMode for the live Cockpit
+     * screencast. Browser-launching agents derive Playwright options via `launchOptions(this.runMode)`.
+     */
+    runMode = DEFAULT_RUN_MODE, 
+    /**
+     * Per-run screencast streamer (Phase 3.2). Undefined on headless/non-streamed runs (the common
+     * case — capture costs nothing). On a headed Cockpit run the engine supplies one, and
+     * browser-launching agents pipe their page into it via `startScreencast(page, this.frames)`.
+     */
+    frames) {
         this.config = config;
         this.phase = phase;
         this.runDir = runDir;
         this.totalRecall = totalRecall;
+        this.runMode = runMode;
+        this.frames = frames;
+    }
+    /**
+     * Agent Contract (governance standard, Phase 0.3). Default = read-only with no declared
+     * capabilities (default-deny). Subclasses override to declare capabilities + a higher tier.
+     */
+    contract = DEFAULT_AGENT_CONTRACT;
+    /**
+     * Live loop-cognition observer, injected by the run engine (Option B). When set BEFORE
+     * `run()`, an agent that opts into the kernel forwards it to `LoopKernel`'s `onEvent`, so its
+     * per-cycle cognition streams to the Cockpit. Undefined by default → no wiring, zero cost (the
+     * 84 engine agents + all headless runs are unaffected). It is a read-only observer: it cannot
+     * change the agent's findings, and the kernel isolates a throwing observer (replay stays exact).
+     */
+    loopEventObserver;
+    /**
+     * Register a live loop-event observer for this agent's kernel (called by `registerAllAgents`
+     * during registration, before `run()`). The observer is already bound by the caller to this
+     * agent's identity, so the kernel-facing callback stays the plain `(event) => void` shape.
+     */
+    setLoopEventObserver(observer) {
+        this.loopEventObserver = observer;
     }
     async run() {
         const startedAt = new Date().toISOString();
@@ -34,6 +92,30 @@ export class BaseAgent {
         }
         catch (error) {
             const completedAt = new Date().toISOString();
+            const durationMs = new Date(completedAt).getTime() - new Date(startedAt).getTime();
+            // Preconditions not met → idle (informational), not a failure.
+            if (isPreconditionNotMet(error)) {
+                const message = error instanceof Error ? error.message : String(error);
+                return {
+                    agentId: this.agentId,
+                    agentName: this.agentName,
+                    phase: this.phase,
+                    status: 'idle',
+                    startedAt,
+                    completedAt,
+                    durationMs,
+                    findings: [{
+                            id: `${this.agentId}-idle`,
+                            type: 'infra-issue',
+                            severity: 'info',
+                            agentId: this.agentId,
+                            module: 'agent-runtime',
+                            description: message,
+                        }],
+                    evidence: this.evidence,
+                    summary: `${this.agentName}: idle — ${message}`,
+                };
+            }
             return {
                 agentId: this.agentId,
                 agentName: this.agentName,
@@ -60,6 +142,29 @@ export class BaseAgent {
     addEvidence(item) {
         this.evidence.push(item);
     }
+    /** The effective, identity-stamped contract — every agent exposes this (conformance surface). */
+    describeContract() {
+        return {
+            agentId: this.agentId,
+            agentName: this.agentName,
+            capabilities: this.contract.capabilities,
+            autonomyTier: this.contract.autonomyTier,
+        };
+    }
+    /**
+     * Construct a shared Loop Engine kernel (Phase 1.1) for this agent's core-cognition loops.
+     * ADDITIVE + opt-in: the existing `run()` path is unchanged, so all 84 engine agents are
+     * unaffected; agents that want the cognitive substrate (budgets, confidence-gating,
+     * circuit-breakers, tracing, event-sourced replay) call this. Spec: blueprint/loops/00-LOOP-ENGINE.md.
+     */
+    loopKernel(initialState, handlers, reduce, config, options) {
+        // Thread the run engine's live observer (if registered) into the kernel's onEvent hook,
+        // so an opted-in agent's cognition streams to the Cockpit. Undefined observer = no-op.
+        return new LoopKernel(initialState, handlers, reduce, config, {
+            ...options,
+            onEvent: this.loopEventObserver,
+        });
+    }
     buildSummary(findings) {
         if (findings.length === 0)
             return `${this.agentName}: All checks passed`;

package/dist/agents/base-agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"base-agent.js","sourceRoot":"","sources":["../../agents/base-agent.ts"],"names":[],"mappings":"AAIA,MAAM,OAAgB,SAAS;IAER;IACA;IACA;IACA;IAJrB,YACqB,MAAuB,EACvB,KAAY,EACZ,MAAc,EACd,WAA+B;QAH/B,WAAM,GAAN,MAAM,CAAiB;QACvB,UAAK,GAAL,KAAK,CAAO;QACZ,WAAM,GAAN,MAAM,CAAQ;QACd,gBAAW,GAAX,WAAW,CAAoB;IACjD,CAAC;IAKJ,KAAK,CAAC,GAAG;QACP,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAEtC,gEAAgE;YAChE,IAAI,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC/F,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7C,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;gBACpG,SAAS;gBACT,WAAW;gBACX,UAAU,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;gBAC3E,QAAQ;gBACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;aACrC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7C,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,QAAQ;gBAChB,SAAS;gBACT,WAAW;gBACX,UAAU,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;gBAC3E,QAAQ,EAAE,CAAC;wBACT,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;wBAC3B,IAAI,EAAE,aAAa;wBACnB,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,eAAe;wBACvB,WAAW,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;wBACnE,UAAU,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;qBAC7D,CAAC;gBACF,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,SAAS,IAAI,CAAC,SAAS,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAChH,CAAC;QACJ,CAAC;IACH,CAAC;IAES,QAAQ,GAAmB,EAAE,CAAC;IAQ9B,WAAW,CAAC,IAAkB;QACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAEO,YAAY,CAAC,QAAmB;QACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC,SAAS,qBAAqB,CAAC;QACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;QACxE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;QAC9D,OAAO,GAAG,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,MAAM,cAAc,QAAQ,cAAc,IAAI,UAAU,MAAM,YAAY,GAAG,OAAO,CAAC;IAC7H,CAAC;CACF"}
+{"version":3,"file":"base-agent.js","sourceRoot":"","sources":["../../agents/base-agent.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAoC,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAsB,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,EACL,UAAU,GAMX,MAAM,qBAAqB,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,6EAA6E;IAC7E,uEAAuE;IACvE,OAAO,CACL,KAAK,YAAY,uBAAuB;QACxC,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,OAAgB,SAAS;IAER;IACA;IACA;IACA;IAMA;IAMA;IAhBrB,YACqB,MAAuB,EACvB,KAAY,EACZ,MAAc,EACd,WAA+B;IAClD;;;;OAIG;IACgB,UAAmB,gBAAgB;IACtD;;;;OAIG;IACgB,MAAsB;QAftB,WAAM,GAAN,MAAM,CAAiB;QACvB,UAAK,GAAL,KAAK,CAAO;QACZ,WAAM,GAAN,MAAM,CAAQ;QACd,gBAAW,GAAX,WAAW,CAAoB;QAM/B,YAAO,GAAP,OAAO,CAA4B;QAMnC,WAAM,GAAN,MAAM,CAAgB;IACxC,CAAC;IAKJ;;;OAGG;IACM,QAAQ,GAAkB,sBAAsB,CAAC;IAE1D;;;;;;OAMG;IACK,iBAAiB,CAA8B;IAEvD;;;;OAIG;IACH,oBAAoB,CAAC,QAAoC;QACvD,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,GAAG;QACP,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAEtC,gEAAgE;YAChE,IAAI,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC/F,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7C,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;gBACpG,SAAS;gBACT,WAAW;gBACX,UAAU,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;gBAC3E,QAAQ;gBACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;aACrC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YAEnF,+DAA+D;YAC/D,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,OAAO;oBACL,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,MAAM,EAAE,MAAM;oBACd,SAAS;oBACT,WAAW;oBACX,UAAU;oBACV,QAAQ,EAAE,CAAC;4BACT,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,OAAO;4BAC1B,IAAI,EAAE,aAAa;4BACnB,QAAQ,EAAE,MAAM;4BAChB,OAAO,EAAE,IAAI,CAAC,OAAO;4BACrB,MAAM,EAAE,eAAe;4BACvB,WAAW,EAAE,OAAO;yBACrB,CAAC;oBACF,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,YAAY,OAAO,EAAE;iBAChD,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,QAAQ;gBAChB,SAAS;gBACT,WAAW;gBACX,UAAU,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;gBAC3E,QAAQ,EAAE,CAAC;wBACT,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;wBAC3B,IAAI,EAAE,aAAa;wBACnB,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,eAAe;wBACvB,WAAW,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;wBACnE,UAAU,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;qBAC7D,CAAC;gBACF,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,SAAS,IAAI,CAAC,SAAS,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAChH,CAAC;QACJ,CAAC;IACH,CAAC;IAES,QAAQ,GAAmB,EAAE,CAAC;IAQ9B,WAAW,CAAC,IAAkB;QACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,iGAAiG;IACjG,gBAAgB;QACd,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY;YACxC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY;SACzC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACO,UAAU,CAClB,YAAe,EACf,QAAyB,EACzB,MAAsB,EACtB,MAA8B,EAC9B,OAAuE;QAEvE,wFAAwF;QACxF,uFAAuF;QACvF,OAAO,IAAI,UAAU,CAAI,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;YAC/D,GAAG,OAAO;YACV,OAAO,EAAE,IAAI,CAAC,iBAAiB;SAChC,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAAC,QAAmB;QACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC,SAAS,qBAAqB,CAAC;QACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;QACxE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;QAC9D,OAAO,GAAG,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,MAAM,cAAc,QAAQ,cAAc,IAAI,UAAU,MAAM,YAAY,GAAG,OAAO,CAAC;IAC7H,CAAC;CACF"}