@cleocode/core 2026.6.12 → 2026.6.13

package/dist/llm/pi/pi-errors.js

@@ -0,0 +1,296 @@
+/**
+ * Pi error / exit containment (T11761 · S1 · T11897).
+ *
+ * The Pi agent loop runs **in-process** inside the Cleo daemon with ZERO
+ * authority. Two library packages are in the safe import set
+ * (`@earendil-works/pi-agent-core` + `@earendil-works/pi-ai`) and both are
+ * verified exit-clean, but the daemon MUST be protected from a process
+ * termination originating from a Pi code path. This module is the containment
+ * boundary: it converts a `process.exit()` call or a `process.exitCode` mutation
+ * attempted while running Pi code into a typed {@link PiContainmentError} thrown
+ * back to the caller.
+ *
+ * ## Containment scope (honest guarantee)
+ *
+ * The `process.exit` trap is process-global and REF-COUNTED across overlapping
+ * {@link wrapPiCall} scopes, so it covers the synchronous body, every awaited
+ * continuation, AND any deferred/detached exit (`setTimeout`, un-awaited
+ * promise, microtask) that fires while ANY Pi call is still active. The ONLY
+ * residual window is an exit fired AFTER the last active call has settled. To
+ * close that too — a daemon-lifetime guarantee covering ANY present/future Pi
+ * exit, synchronous or detached — the daemon calls {@link installDaemonExitGuard}
+ * once at startup to PIN the trap for its whole lifetime.
+ *
+ * Scope discipline (S1): NO `pi-ai`/`pi-agent-core` imports, NO DB access, NO
+ * LLM calls. Import-time side-effect free — the logger is resolved lazily
+ * (never at module top level).
+ *
+ * @epic T10403
+ * @task T11761
+ * @task T11897
+ */
+import { ExitCode } from '@cleocode/contracts';
+import { CleoError } from '../../errors.js';
+import { getLogger } from '../../logger.js';
+/**
+ * Typed containment error for the Pi in-process embed.
+ *
+ * Extends {@link CleoError} so it flows through the existing LAFS error
+ * projection (`toLAFSError`/`toProblemDetails`). It carries the Pi-specific
+ * string {@link PiContainmentCode} on {@link piCode} (the numeric `ExitCode`
+ * super-field is `INTERNAL`/`GENERAL_ERROR`-class — it is the daemon, not the
+ * caller, that is being protected, so the failure is an internal one).
+ */
+export class PiContainmentError extends CleoError {
+    /** Machine-readable Pi-containment discriminator. */
+    piCode;
+    /**
+     * @param piCode - The Pi-containment discriminator.
+     * @param message - Human-readable description.
+     * @param options - Optional `cause` and the numeric `ExitCode` (defaults to
+     *   {@link ExitCode.GENERAL_ERROR}).
+     */
+    constructor(piCode, message, options) {
+        super(options?.exitCode ?? ExitCode.GENERAL_ERROR, message, {
+            cause: options?.cause,
+            details: { field: 'pi', piCode },
+        });
+        this.name = 'PiContainmentError';
+        this.piCode = piCode;
+    }
+}
+/**
+ * Type guard for {@link PiContainmentError} (cross-realm-safe via `piCode`).
+ *
+ * @param err - The value to test.
+ * @returns `true` when `err` is a {@link PiContainmentError}.
+ */
+export function isPiContainmentError(err) {
+    return err instanceof PiContainmentError;
+}
+/**
+ * Convert an arbitrary thrown value into a {@link PiContainmentError}.
+ *
+ * A value that is ALREADY a {@link PiContainmentError} passes through unchanged
+ * (so an exit-trap error is not re-wrapped as a generic loop failure). Anything
+ * else becomes an `E_PI_LOOP_FAILED` carrying the original as `cause`.
+ *
+ * @param err - The thrown value.
+ * @returns A typed {@link PiContainmentError}.
+ */
+export function wrapPiError(err) {
+    if (isPiContainmentError(err))
+        return err;
+    const message = err instanceof Error ? err.message : String(err);
+    return new PiContainmentError('E_PI_LOOP_FAILED', `Pi loop failed: ${message}`, { cause: err });
+}
+/**
+ * The original `process.exit`, captured at the FIRST trap install and restored
+ * only when the ref-count returns to zero. `null` while no trap is installed.
+ */
+let originalProcessExit = null;
+/** Number of live {@link wrapPiCall} scopes currently holding the exit trap. */
+let exitTrapRefCount = 0;
+/** Whether the daemon has pinned the trap for its whole lifetime (never released). */
+let daemonExitTrapPinned = false;
+/** The trapped `process.exit` — throws instead of terminating. Built once, reused. */
+const trappedExit = ((code) => {
+    throw new PiContainmentError('E_PI_PROCESS_EXIT_TRAPPED', `Pi attempted process.exit(${code ?? ''}) in-process; daemon-fatal exit neutralized`);
+});
+/**
+ * Install the process-global `process.exit` trap if it is not already installed.
+ * Idempotent — overlapping callers share ONE trap.
+ */
+function ensureExitTrapInstalled() {
+    if (originalProcessExit === null) {
+        originalProcessExit = process.exit;
+        process.exit = trappedExit;
+    }
+}
+/**
+ * Restore the real `process.exit` when (and only when) no scope holds the trap
+ * and the daemon has not pinned it. A no-op otherwise.
+ */
+function maybeRestoreExitTrap() {
+    if (exitTrapRefCount === 0 && !daemonExitTrapPinned && originalProcessExit !== null) {
+        process.exit = originalProcessExit;
+        originalProcessExit = null;
+    }
+}
+/**
+ * Pin the `process.exit` trap for the ENTIRE daemon lifetime.
+ *
+ * This is the durable, complete fix for the async-exit leak: once pinned, the
+ * trap is NEVER restored, so a `process.exit()` originating from ANY Pi code path
+ * — synchronous, awaited, deferred (`setTimeout`), detached (fire-and-forget),
+ * present or future — is neutralized for as long as the daemon runs. Call this
+ * once at daemon startup BEFORE any Pi-touching work is dispatched.
+ *
+ * Idempotent. The returned function un-pins (e.g. for a graceful shutdown that
+ * legitimately needs to exit); after un-pinning, the trap is restored when no
+ * {@link wrapPiCall} scope is active.
+ *
+ * @returns A function that un-pins the daemon-lifetime trap.
+ *
+ * @example
+ * ```ts
+ * // daemon bootstrap, before serving requests:
+ * const unpin = installDaemonExitGuard();
+ * // ... daemon runs; all Pi exits are trapped for the whole lifetime ...
+ * unpin(); // only if a controlled shutdown must reach the real process.exit
+ * ```
+ */
+export function installDaemonExitGuard() {
+    daemonExitTrapPinned = true;
+    ensureExitTrapInstalled();
+    return releaseDaemonExitGuard;
+}
+/**
+ * Un-pin the daemon-lifetime `process.exit` trap (idempotent).
+ *
+ * Identical to the closure returned by {@link installDaemonExitGuard}, but
+ * callable WITHOUT that handle — for code paths that must reach the real
+ * `process.exit` yet do not hold the closure (e.g. a daemon bootstrap-failure
+ * handler in a different module). After un-pinning, the trap is restored once no
+ * {@link wrapPiCall} scope is active. A no-op if the guard was never pinned.
+ *
+ * Idempotent: safe to call multiple times and from multiple paths.
+ */
+export function releaseDaemonExitGuard() {
+    daemonExitTrapPinned = false;
+    maybeRestoreExitTrap();
+}
+/**
+ * Acquire the ref-counted process-exit guard for one wrapped Pi call.
+ *
+ * Increments the global ref-count and installs the shared `process.exit` trap on
+ * the 0→1 transition; snapshots `process.exitCode` for this scope. The trap is
+ * released (and, at the last release, restored — unless daemon-pinned) via
+ * {@link ProcessExitGuard.release}.
+ *
+ * `process.exitCode` is, on modern Node, a NON-CONFIGURABLE native accessor — it
+ * cannot be redefined to intercept writes. It IS writable via its native setter,
+ * so the guard uses **snapshot + synchronous detect-and-restore**
+ * ({@link ProcessExitGuard.checkExitCode}).
+ *
+ * Re-entrant-safe: overlapping calls share the single installed trap; each holds
+ * its own `exitCode` snapshot and `release` is an idempotent decrement.
+ *
+ * @returns A scoped guard handle.
+ */
+function acquireExitTrap() {
+    // Snapshot the value (NOT the descriptor — the property is non-configurable on
+    // modern Node, so we never redefine it; we compare-and-write via its setter).
+    const snapshotExitCode = process.exitCode;
+    let exitCodeChecked = false;
+    let released = false;
+    exitTrapRefCount += 1;
+    ensureExitTrapInstalled();
+    return {
+        checkExitCode() {
+            if (exitCodeChecked)
+                return undefined;
+            exitCodeChecked = true;
+            const current = process.exitCode;
+            if (current !== snapshotExitCode) {
+                process.exitCode = snapshotExitCode;
+                return { mutatedExitCode: current };
+            }
+            return undefined;
+        },
+        release() {
+            if (released)
+                return;
+            released = true;
+            exitTrapRefCount -= 1;
+            maybeRestoreExitTrap();
+        },
+    };
+}
+/**
+ * Run a Pi-touching async function under process-exit containment + abort
+ * routing.
+ *
+ * Behaviour:
+ * - Acquires the REF-COUNTED, process-global {@link acquireExitTrap} for the
+ *   duration of `fn` and releases it in a `finally`. A `process.exit()` call —
+ *   synchronous, awaited, OR deferred/detached but firing while ANY Pi call is
+ *   still active — becomes a thrown {@link PiContainmentError} (the daemon
+ *   survives). A `process.exitCode` mutation is detected-and-restored the instant
+ *   `fn` settles, then surfaced as a thrown `E_PI_EXIT_CODE_MUTATION_TRAPPED`.
+ *   For a guarantee that spans even an exit fired AFTER the last call settles,
+ *   the daemon should additionally pin the trap once at startup via
+ *   {@link installDaemonExitGuard}.
+ * - If `signal` is already aborted, rejects with `E_PI_ABORTED` WITHOUT invoking
+ *   `fn`. Otherwise the signal is propagated to `fn` (the caller threads it into
+ *   Pi's agent loop); an abort that surfaces as a thrown `AbortError`/`DOMException`
+ *   is normalized to `E_PI_ABORTED`.
+ * - Any other thrown value is normalized via {@link wrapPiError}.
+ *
+ * @typeParam T - The resolved value type of the wrapped call.
+ * @param fn - The Pi-touching async function. Receives the (live) `AbortSignal`
+ *   so it can thread cancellation into the agent loop.
+ * @param signal - Optional cancellation signal.
+ * @returns The resolved value of `fn`.
+ * @throws {PiContainmentError} On exit-trap, abort, or any failure from `fn`.
+ *
+ * @example
+ * ```ts
+ * const result = await wrapPiCall(async (sig) => runAgentLoop(prompts, ctx, cfg, emit, sig), signal);
+ * ```
+ */
+export async function wrapPiCall(fn, signal) {
+    if (signal?.aborted) {
+        throw new PiContainmentError('E_PI_ABORTED', 'Pi call aborted before start');
+    }
+    // A local controller is always passed to `fn` so cancellation has a single
+    // shape; when an external signal is supplied we mirror its abort into ours.
+    const controller = new AbortController();
+    const onExternalAbort = () => controller.abort(signal?.reason);
+    if (signal)
+        signal.addEventListener('abort', onExternalAbort, { once: true });
+    const guard = acquireExitTrap();
+    try {
+        const value = await fn(controller.signal);
+        // Detect a quiet `process.exitCode` mutation SYNCHRONOUSLY here — the instant
+        // `fn` settled — while the value is still observable. If Pi set it, the value
+        // is restored and a typed error replaces the clean return.
+        const mutation = guard.checkExitCode();
+        if (mutation !== undefined) {
+            throw new PiContainmentError('E_PI_EXIT_CODE_MUTATION_TRAPPED', `Pi set process.exitCode=${String(mutation.mutatedExitCode)} in-process; neutralized`);
+        }
+        return value;
+    }
+    catch (err) {
+        // A mutation can also accompany a thrown failure — neutralize the leak even
+        // though the thrown error (below) is the primary signal.
+        guard.checkExitCode();
+        if (err instanceof PiContainmentError)
+            throw err;
+        if (isAbortError(err) || controller.signal.aborted) {
+            throw new PiContainmentError('E_PI_ABORTED', 'Pi call aborted', { cause: err });
+        }
+        throw wrapPiError(err);
+    }
+    finally {
+        guard.release();
+        if (signal)
+            signal.removeEventListener('abort', onExternalAbort);
+        // Lazy logger — never resolved at import time (S1 import-side-effect rule).
+        getLogger('pi-errors').debug({ aborted: controller.signal.aborted }, 'pi call boundary closed');
+    }
+}
+/**
+ * Whether a thrown value represents an abort (a `DOMException`/`Error` whose
+ * `name` is `AbortError`).
+ *
+ * @param err - The thrown value.
+ * @returns `true` when `err` is an abort error.
+ */
+function isAbortError(err) {
+    return (typeof err === 'object' &&
+        err !== null &&
+        'name' in err &&
+        err.name === 'AbortError');
+}
+//# sourceMappingURL=pi-errors.js.map

package/dist/llm/pi/pi-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-errors.js","sourceRoot":"","sources":["../../../src/llm/pi/pi-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAoB5C;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/C,qDAAqD;IAC5C,MAAM,CAAoB;IAEnC;;;;;OAKG;IACH,YACE,MAAyB,EACzB,OAAe,EACf,OAAkD;QAElD,KAAK,CAAC,OAAO,EAAE,QAAQ,IAAI,QAAQ,CAAC,aAAa,EAAE,OAAO,EAAE;YAC1D,KAAK,EAAE,OAAO,EAAE,KAAK;YACrB,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,OAAO,GAAG,YAAY,kBAAkB,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,oBAAoB,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,mBAAmB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;AAClG,CAAC;AA8BD;;;GAGG;AACH,IAAI,mBAAmB,GAA+B,IAAI,CAAC;AAE3D,gFAAgF;AAChF,IAAI,gBAAgB,GAAG,CAAC,CAAC;AAEzB,sFAAsF;AACtF,IAAI,oBAAoB,GAAG,KAAK,CAAC;AAEjC,sFAAsF;AACtF,MAAM,WAAW,GAAG,CAAC,CAAC,IAAa,EAAS,EAAE;IAC5C,MAAM,IAAI,kBAAkB,CAC1B,2BAA2B,EAC3B,6BAA6B,IAAI,IAAI,EAAE,6CAA6C,CACrF,CAAC;AACJ,CAAC,CAAwB,CAAC;AAE1B;;;GAGG;AACH,SAAS,uBAAuB;IAC9B,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACjC,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;QACnC,OAAO,CAAC,IAAI,GAAG,WAAW,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB;IAC3B,IAAI,gBAAgB,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACpF,OAAO,CAAC,IAAI,GAAG,mBAAmB,CAAC;QACnC,mBAAmB,GAAG,IAAI,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,sBAAsB;IACpC,oBAAoB,GAAG,IAAI,CAAC;IAC5B,uBAAuB,EAAE,CAAC;IAC1B,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB;IACpC,oBAAoB,GAAG,KAAK,CAAC;IAC7B,oBAAoB,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,eAAe;IACtB,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,gBAAgB,GAA4B,OAAO,CAAC,QAAQ,CAAC;IACnE,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,gBAAgB,IAAI,CAAC,CAAC;IACtB,uBAAuB,EAAE,CAAC;IAE1B,OAAO;QACL,aAAa;YACX,IAAI,eAAe;gBAAE,OAAO,SAAS,CAAC;YACtC,eAAe,GAAG,IAAI,CAAC;YACvB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;YACjC,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;gBACjC,OAAO,CAAC,QAAQ,GAAG,gBAAgB,CAAC;gBACpC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;YACtC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,gBAAgB,IAAI,CAAC,CAAC;YACtB,oBAAoB,EAAE,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAuC,EACvC,MAAoB;IAEpB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,kBAAkB,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAC;IAC/E,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,eAAe,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,MAAM;QAAE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9E,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,8EAA8E;QAC9E,8EAA8E;QAC9E,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,kBAAkB,CAC1B,iCAAiC,EACjC,2BAA2B,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,0BAA0B,CACtF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,yDAAyD;QACzD,KAAK,CAAC,aAAa,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,kBAAkB;YAAE,MAAM,GAAG,CAAC;QACjD,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,IAAI,kBAAkB,CAAC,cAAc,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,IAAI,MAAM;YAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACjE,4EAA4E;QAC5E,SAAS,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,MAAM,IAAI,GAAG;QACZ,GAA0B,CAAC,IAAI,KAAK,YAAY,CAClD,CAAC;AACJ,CAAC"}

package/dist/llm/pi/pi-execution-env.d.ts

@@ -0,0 +1,286 @@
+/**
+ * Guarded Pi `ExecutionEnv` (T11761 · S1 · T11897).
+ *
+ * Pi's agent loop performs ALL filesystem + shell work through a single
+ * pluggable seam: `ExecutionEnv extends FileSystem, Shell`. This module supplies
+ * Cleo's implementation of that seam — {@link GuardedExecutionEnv} — which routes
+ * every operation through the deny-first {@link ToolGuard} chokepoint and an
+ * injected **workspace boundary**, so Pi can touch nothing outside the
+ * allowlisted roots and runs no command on the denylist.
+ *
+ * Two layers of confinement (deny-first):
+ * 1. **Workspace boundary** — every fs path is canonicalized with SYMLINK
+ *    RESOLUTION (`fs.realpath` on the nearest existing ancestor) and the REAL
+ *    target MUST fall under the injected `workspaceRoot`; a `../` escape, an
+ *    out-of-root absolute path, OR a symlink (file or parent dir) whose real
+ *    target leaves the root is rejected as a Pi `Result.err(FileError)` BEFORE
+ *    the guard is consulted. A purely lexical check is symlink-blind, so the
+ *    boundary resolves symlinks first. (The guard's own `allowedRoots` is a
+ *    second, ALSO-symlink-resolving net.)
+ * 2. **ToolGuard** — the allowed operations delegate to the `ToolGuard` surface
+ *    (`readFileText`/`writeFileAtomic`/`pathExists`/`executeShell`/`runGit`),
+ *    which applies the project's symlink-resolved path allowlist + shell
+ *    denylist + subprocess-env scrub. A `GuardDeniedError` from enforce-mode is
+ *    CAUGHT and converted to a Pi `Result.err` — Pi's `FileSystem`/`Shell` ops
+ *    must NEVER throw. The guard MUST be constructed in `enforce` mode (the
+ *    factory asserts it) — in `warn` mode its allowlist/denylist are advisory
+ *    and confinement would collapse to the workspace boundary alone.
+ *
+ * Every other capability (binary reads, raw temp/dir mutation, listing, …) for
+ * which there is no atomic primitive in v0 is DENIED with a typed error rather
+ * than reaching the real filesystem. The structural Pi interfaces are declared
+ * locally here (the `@earendil-works/pi-agent-core` package is not yet a
+ * dependency); S2 replaces these with the real type-only imports — the shapes
+ * match `@earendil-works/pi-agent-core@0.78.1` `harness/types.ts:268-332`.
+ *
+ * Scope discipline (S1): NO `pi-ai`/`pi-agent-core` imports, NO DB access, NO
+ * LLM calls. Import-time side-effect free.
+ *
+ * @epic T10403
+ * @task T11761
+ * @task T11897
+ */
+import { type GuardMode, type ToolGuard } from '../../tools/guard.js';
+/**
+ * Pi's `Result<T, E>` discriminated union. Pi's `FileSystem`/`Shell` ops return
+ * this and MUST never throw — failures are encoded as `{ ok: false, error }`.
+ *
+ * Matches `@earendil-works/pi-agent-core@0.78.1` result shape.
+ */
+export type PiResult<T, E> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: E;
+};
+/** A filesystem failure surfaced to Pi (never thrown). */
+export interface PiFileError {
+    /** Stable failure kind. */
+    readonly code: string;
+    /** Human-readable description. */
+    readonly message: string;
+    /** The path the operation targeted, when applicable. */
+    readonly path?: string;
+}
+/** A shell-execution failure surfaced to Pi (never thrown). */
+export interface PiExecutionError {
+    /** Stable failure kind. */
+    readonly code: string;
+    /** Human-readable description. */
+    readonly message: string;
+}
+/** Metadata returned by `fileInfo`. */
+export interface PiFileInfo {
+    /** Whether the entry is a regular file. */
+    readonly isFile: boolean;
+    /** Whether the entry is a directory. */
+    readonly isDirectory: boolean;
+}
+/** Result of a `Shell.exec`. */
+export interface PiExecResult {
+    /** Captured standard output. */
+    readonly stdout: string;
+    /** Captured standard error. */
+    readonly stderr: string;
+    /** Process exit code (`null` when killed by signal/timeout). */
+    readonly exitCode: number | null;
+}
+/** Options for a `Shell.exec`. */
+export interface PiExecOptions {
+    /** Working directory. */
+    readonly cwd?: string;
+    /** Hard timeout in milliseconds. */
+    readonly timeout?: number;
+    /** Extra environment variables. */
+    readonly env?: Readonly<Record<string, string>>;
+}
+/**
+ * Pi's `FileSystem` interface (the fs half of `ExecutionEnv`). Every op returns
+ * a {@link PiResult} and must never throw. Mirrors
+ * `@earendil-works/pi-agent-core@0.78.1` `harness/types.ts:268-318`.
+ */
+export interface PiFileSystem {
+    cwd(): string;
+    absolutePath(path: string): string;
+    joinPath(...segments: string[]): string;
+    readTextFile(path: string): Promise<PiResult<string, PiFileError>>;
+    readTextLines(path: string): Promise<PiResult<string[], PiFileError>>;
+    readBinaryFile(path: string): Promise<PiResult<Uint8Array, PiFileError>>;
+    writeFile(path: string, content: string): Promise<PiResult<void, PiFileError>>;
+    appendFile(path: string, content: string): Promise<PiResult<void, PiFileError>>;
+    fileInfo(path: string): Promise<PiResult<PiFileInfo, PiFileError>>;
+    listDir(path: string): Promise<PiResult<string[], PiFileError>>;
+    canonicalPath(path: string): Promise<PiResult<string, PiFileError>>;
+    exists(path: string): Promise<PiResult<boolean, PiFileError>>;
+    createDir(path: string): Promise<PiResult<void, PiFileError>>;
+    remove(path: string): Promise<PiResult<void, PiFileError>>;
+    createTempDir(prefix?: string): Promise<PiResult<string, PiFileError>>;
+    createTempFile(prefix?: string): Promise<PiResult<string, PiFileError>>;
+    cleanup(): Promise<void>;
+}
+/**
+ * Pi's `Shell` interface (the shell half of `ExecutionEnv`). Mirrors
+ * `@earendil-works/pi-agent-core@0.78.1` `harness/types.ts:321-328`.
+ */
+export interface PiShell {
+    exec(command: string, options?: PiExecOptions): Promise<PiResult<PiExecResult, PiExecutionError>>;
+    cleanup(): Promise<void>;
+}
+/**
+ * Pi's `ExecutionEnv` — the single pluggable surface for all fs + process work.
+ * Mirrors `@earendil-works/pi-agent-core@0.78.1` `harness/types.ts:332`.
+ */
+export interface PiExecutionEnv extends PiFileSystem, PiShell {
+}
+/** Construction dependencies for {@link GuardedExecutionEnv}. */
+export interface GuardedExecutionEnvDeps {
+    /**
+     * The guarded primitive surface (path allowlist + shell denylist) the env
+     * delegates allowed operations to. Injected by the dispatcher — the env never
+     * constructs it (atomic primitives are Gate-11-bound to `core/src/tools`).
+     */
+    readonly guard: ToolGuard;
+    /**
+     * The absolute workspace root every fs path is confined under. A path that
+     * resolves outside this root is denied BEFORE the guard is consulted.
+     */
+    readonly workspaceRoot: string;
+}
+/**
+ * Deny-first {@link PiExecutionEnv} backed by the Cleo {@link ToolGuard} surface
+ * and a workspace boundary.
+ *
+ * - File reads/writes/existence checks route through the guard's atomic
+ *   primitives, confined to `workspaceRoot`.
+ * - `exec` routes through the guard's `executeShell` (shell denylist applies).
+ * - Capabilities with no atomic primitive in v0 (binary read, `listDir`,
+ *   `createDir`, `remove`, temp dir/file) are DENIED with a typed
+ *   `Result.err` — they never reach the real filesystem.
+ * - Pure path arithmetic (`cwd`/`absolutePath`/`joinPath`) is computed locally
+ *   (no fs access), anchored to `workspaceRoot`.
+ *
+ * Every method honours the Pi contract: it returns a {@link PiResult} and never
+ * throws — a {@link GuardDeniedError} from the guard is caught and converted.
+ */
+export declare class GuardedExecutionEnv implements PiExecutionEnv {
+    #private;
+    /**
+     * @param deps - The guard surface + the workspace root to confine to.
+     */
+    constructor(deps: GuardedExecutionEnvDeps);
+    /** The workspace root (the in-process Pi run's working directory). */
+    cwd(): string;
+    /** Resolve `path` to an absolute path anchored at the workspace root. */
+    absolutePath(path: string): string;
+    /** Join path segments (pure). */
+    joinPath(...segments: string[]): string;
+    /** Read a file's text, confined to the workspace + guarded. */
+    readTextFile(path: string): Promise<PiResult<string, PiFileError>>;
+    /** Read a file's text as an array of lines. */
+    readTextLines(path: string): Promise<PiResult<string[], PiFileError>>;
+    /**
+     * Binary read — DENIED in v0. The atomic `readFileText` primitive is
+     * text-only (`ReadFileInput.encoding` has no binary variant); a binary
+     * primitive must be added under `core/src/tools` (Gate 11) before this is
+     * supported. Deny-first: never reaches the filesystem.
+     */
+    readBinaryFile(path: string): Promise<PiResult<Uint8Array, PiFileError>>;
+    /** Atomically write a file, confined to the workspace + guarded. */
+    writeFile(path: string, content: string): Promise<PiResult<void, PiFileError>>;
+    /**
+     * Append to a file. The atomic surface offers only whole-file atomic writes,
+     * so this reads-then-writes the concatenation (still confined + guarded). A
+     * missing file is treated as empty.
+     *
+     * Confinement happens EXACTLY ONCE here, then the read + write delegate
+     * straight to the guard with the already-resolved `abs`. Re-entering the
+     * public `readTextFile`/`writeFile` would re-`#confine` the value `#confine`
+     * just returned — and because `#confine` yields the SYMLINK-RESOLVED real path
+     * (e.g. macOS `/tmp`→`/private/tmp`, or a symlinked workspace root), that real
+     * path is `../`-outside the lexical `workspaceRoot`, so the second lexical
+     * gate would spuriously reject it (`E_PI_FS_DENIED`). Reading once through the
+     * guard — whose own allowlist canonicalizes both sides — avoids the
+     * double-confine while keeping the symlink-escape denial intact.
+     */
+    appendFile(path: string, content: string): Promise<PiResult<void, PiFileError>>;
+    /** Report whether a path is a file or directory, confined + guarded. */
+    fileInfo(path: string): Promise<PiResult<PiFileInfo, PiFileError>>;
+    /** Whether a path exists, confined + guarded. */
+    exists(path: string): Promise<PiResult<boolean, PiFileError>>;
+    /**
+     * Canonicalize a path inside the workspace. SYMLINK-RESOLVING: `#confine`
+     * follows every symlink component via `fs.realpath`, so the returned value is
+     * the REAL on-disk location (matching Pi's `NodeExecutionEnv.canonicalPath`
+     * contract), and a path whose real target escapes the workspace is denied.
+     */
+    canonicalPath(path: string): Promise<PiResult<string, PiFileError>>;
+    /** DENIED in v0 — no `listDir` atomic primitive. */
+    listDir(path: string): Promise<PiResult<string[], PiFileError>>;
+    /** DENIED in v0 — no `createDir` atomic primitive. */
+    createDir(path: string): Promise<PiResult<void, PiFileError>>;
+    /** DENIED in v0 — no `remove` atomic primitive. */
+    remove(path: string): Promise<PiResult<void, PiFileError>>;
+    /** DENIED in v0 — no temp-dir atomic primitive. */
+    createTempDir(): Promise<PiResult<string, PiFileError>>;
+    /** DENIED in v0 — no temp-file atomic primitive. */
+    createTempFile(): Promise<PiResult<string, PiFileError>>;
+    /**
+     * Execute a command through the guard's shell surface (denylist applies). The
+     * Pi `command` string is a bare executable name (args are passed by Pi via the
+     * loop, but the v0 seam takes only `command`); we forward it as the guard's
+     * `command` with empty args. `cwd` is symlink-confined to the workspace.
+     *
+     * ## Env is SCRUBBED before it leaves this seam (T11897 · security)
+     *
+     * Pi's `options.env` is UNTRUSTED model-driven input. Forwarding it verbatim
+     * would let Pi set `LD_PRELOAD`/`NODE_OPTIONS`/`GIT_SSH_COMMAND` (arbitrary
+     * native code execution outside any allowlist) or hijack `PATH` to make a
+     * workspace-resident impostor satisfy an allowed command basename. So the env
+     * is run through {@link scrubSubprocessEnv} HERE — forbidden keys (loader
+     * hooks, `PATH`, secrets) are dropped and `PATH` is pinned to a trusted value
+     * — before it reaches the guard (which scrubs again as a redundant net, as
+     * does `defaultShellExecutor`). This also prevents the daemon's own secrets
+     * from leaking into the child (the scrubbed env never inherits `process.env`).
+     */
+    exec(command: string, options?: PiExecOptions): Promise<PiResult<PiExecResult, PiExecutionError>>;
+    /** Best-effort cleanup; the guarded surface owns no resources, so a no-op. */
+    cleanup(): Promise<void>;
+}
+/**
+ * Thrown by {@link createGuardedExecutionEnv} when the injected guard is NOT in
+ * `enforce` mode. In `warn` mode the guard's path allowlist + command denylist
+ * are advisory (log-and-proceed), so the second confinement net does not exist
+ * and the boundary would collapse to the workspace check alone. The Pi adapter
+ * therefore REFUSES a non-enforce guard rather than running untrusted Pi work
+ * behind an advisory boundary.
+ */
+export declare class PiGuardModeError extends Error {
+    /** Machine-readable code. */
+    readonly code = "E_PI_GUARD_NOT_ENFORCING";
+    /**
+     * @param mode - The (non-enforce) mode the guard was constructed with.
+     */
+    constructor(mode: GuardMode);
+}
+/**
+ * Construct a deny-first {@link GuardedExecutionEnv}.
+ *
+ * REQUIRES an `enforce`-mode guard: a `warn`-mode guard's allowlist/denylist are
+ * advisory, so handing untrusted Pi work behind one would leave confinement to
+ * the workspace boundary alone. The factory ASSERTS the mode and throws
+ * {@link PiGuardModeError} otherwise — the Pi adapter never silently degrades to
+ * an advisory boundary.
+ *
+ * @param deps - The guard surface + the workspace root to confine to.
+ * @returns A {@link PiExecutionEnv} safe to hand to Pi's agent loop.
+ * @throws {PiGuardModeError} When `deps.guard.mode !== 'enforce'`.
+ *
+ * @example
+ * ```ts
+ * const guard = createToolGuard({ allowedRoots: [projectRoot], mode: 'enforce' });
+ * const env = createGuardedExecutionEnv({ guard, workspaceRoot: projectRoot });
+ * ```
+ */
+export declare function createGuardedExecutionEnv(deps: GuardedExecutionEnvDeps): PiExecutionEnv;
+//# sourceMappingURL=pi-execution-env.d.ts.map

package/dist/llm/pi/pi-execution-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-execution-env.d.ts","sourceRoot":"","sources":["../../../src/llm/pi/pi-execution-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAKH,OAAO,EAAoB,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAMxF;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,IACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACxC;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;CACnB,CAAC;AAEN,0DAA0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAAgB;IAC/B,2BAA2B;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,uCAAuC;AACvC,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,wCAAwC;IACxC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED,gCAAgC;AAChC,MAAM,WAAW,YAAY;IAC3B,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+BAA+B;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC5B,yBAAyB;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,mCAAmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,IAAI,MAAM,CAAC;IACd,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACxC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IACnE,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACtE,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IACzE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/E,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IAChE,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IACpE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9D,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3D,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IACvE,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAClG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAe,SAAQ,YAAY,EAAE,OAAO;CAAG;AAwChE,iEAAiE;AACjE,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,mBAAoB,YAAW,cAAc;;IAIxD;;OAEG;gBACS,IAAI,EAAE,uBAAuB;IA8CzC,sEAAsE;IACtE,GAAG,IAAI,MAAM;IAIb,yEAAyE;IACzE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAIlC,iCAAiC;IACjC,QAAQ,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM;IAMvC,+DAA+D;IACzD,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAWxE,+CAA+C;IACzC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC;IAK3E;;;;;OAKG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAM9E,oEAAoE;IAC9D,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAWpF;;;;;;;;;;;;;;OAcG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAyBrF,wEAAwE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAYxE,iDAAiD;IAC3C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAWnE;;;;;OAKG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAQzE,oDAAoD;IAC9C,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC;IAIrE,sDAAsD;IAChD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAInE,mDAAmD;IAC7C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAIhE,mDAAmD;IAC7C,aAAa,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAI7D,oDAAoD;IAC9C,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAM9D;;;;;;;;;;;;;;;;;OAiBG;IACG,IAAI,CACR,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IA4BpD,8EAA8E;IACxE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAkB/B;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,8BAA8B;IAC3C;;OAEG;gBACS,IAAI,EAAE,SAAS;CAO5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,uBAAuB,GAAG,cAAc,CAKvF"}