@clipboard-health/groundcrew 4.10.5 → 4.12.0

package/dist/commands/doctor.js

@@ -247,6 +247,22 @@ function localCapabilityCheck(host, resolved) {
                 : "sdx runner requires `sbx` (Docker Sandboxes) on PATH (install from https://docs.docker.com/ai/sandboxes/)",
         };
     }
+    if (resolved === "srt") {
+        const missingLinuxDeps = host.isLinux
+            ? [
+                host.hasBubblewrap ? undefined : "bubblewrap",
+                host.hasSocat ? undefined : "socat",
+                host.hasRipgrep ? undefined : "ripgrep (rg)",
+            ].filter((name) => name !== undefined)
+            : [];
+        const ok = host.isSrtSupported && missingLinuxDeps.length === 0;
+        return {
+            name: "local runner (srt)",
+            ok,
+            required: false,
+            hint: srtRunnerHint(ok, host.isSrtSupported, missingLinuxDeps),
+        };
+    }
     // resolved === "none"
     return {
         name: "local runner (none)",
@@ -255,6 +271,15 @@ function localCapabilityCheck(host, resolved) {
         hint: "WARNING: local.runner='none' — agent runs unsandboxed on the host. Only use this when you understand the implications.",
     };
 }
+function srtRunnerHint(ok, isSrtSupported, missingLinuxDeps) {
+    if (ok) {
+        return "ready (beta: @anthropic-ai/sandbox-runtime is a research preview)";
+    }
+    if (!isSrtSupported) {
+        return "srt runner requires macOS or Linux/WSL";
+    }
+    return `srt runner on Linux requires ${missingLinuxDeps.join(", ")} on PATH (Debian/Ubuntu: \`apt install bubblewrap socat ripgrep\`; on Ubuntu 24.04+ also \`sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0\`)`;
+}
 function reportLocalCapability(arguments_) {
     writeOutput();
     writeOutput("Local runner");

package/dist/commands/setupWorkspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setupWorkspace.d.ts","sourceRoot":"","sources":["../../src/commands/setupWorkspace.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAkBnE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAuBD,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,qBAAqB,EAC9B,UAAU,GAAE,wBAA6B,GACxC,OAAO,CAAC,IAAI,CAAC,CAqHf;AAyID,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,IAAI,CAAC,CA4Cf"}
+{"version":3,"file":"setupWorkspace.d.ts","sourceRoot":"","sources":["../../src/commands/setupWorkspace.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoC,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAsBzF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAyDD,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,qBAAqB,EAC9B,UAAU,GAAE,wBAA6B,GACxC,OAAO,CAAC,IAAI,CAAC,CAuIf;AA8ID,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,IAAI,CAAC,CA4Cf"}

package/dist/commands/setupWorkspace.js

@@ -1,14 +1,17 @@
 import { rmSync } from "node:fs";
+import path from "node:path";
 import { loadConfig } from "../lib/config.js";
 import { openAgentWorkspace, prepareAgentLaunch } from "../lib/agentLaunch.js";
 import { createBoard } from "../lib/board.js";
 import { buildSources, sourcesFromConfig } from "../lib/buildSources.js";
-import { buildLaunchCommand } from "../lib/launchCommand.js";
+import { collectAllowedDomains } from "../lib/clearanceHosts.js";
+import { buildLaunchCommand, inferAgentCommandName } from "../lib/launchCommand.js";
 import { resolvePrepareWorktreeCommand } from "../lib/repositoryHooks.js";
 import { recordRunState } from "../lib/runState.js";
-import { stageBuildSecrets, stagePromptFromTemplate, stageWorkspaceLaunchCommand, } from "../lib/stagedLaunch.js";
+import { buildSrtSettings } from "../lib/srtPolicy.js";
+import { stageBuildSecrets, stagePromptFromTemplate, stageSrtSettings, stageWorkspaceLaunchCommand, } from "../lib/stagedLaunch.js";
 import { naturalIdFromCanonical } from "../lib/ticketSource.js";
-import { debug, errorMessage, log, okMark } from "../lib/util.js";
+import { debug, errorMessage, log, okMark, readEnvironmentVariable } from "../lib/util.js";
 import { workspaces } from "../lib/workspaces.js";
 import { isWorktreeAlreadyExistsError, worktrees } from "../lib/worktrees.js";
 function stagePrompt(input) {
@@ -25,6 +28,33 @@ function stagePrompt(input) {
         },
     });
 }
+/**
+ * Generate the srt policies for this launch and stage them to temp settings
+ * files. The agent identity comes from the model `cmd`; the git common dir is
+ * the parent clone's `.git` (the worktree lives beside it); the egress
+ * allowlist is translated from the existing clearance env so srt and safehouse
+ * share one source of truth. Only called when `local.runner` resolves to `srt`.
+ *
+ * Two policies: the `prepare` policy is profile-neutral (empty agent → no
+ * `~/.claude`/`~/.codex` grants) so the repo-controlled prepareWorktree hook
+ * can't touch the agent's credentials; the `agent` policy carries the agent's
+ * credential profile.
+ */
+function buildAndStageSrtSettings(input) {
+    const repoDir = path.resolve(input.config.workspace.projectDir, input.repository);
+    const base = {
+        worktreeDir: input.worktreeDir,
+        gitCommonDir: path.join(repoDir, ".git"),
+        allowedDomains: collectAllowedDomains({
+            hosts: readEnvironmentVariable("CLEARANCE_ALLOW_HOSTS"),
+            files: readEnvironmentVariable("CLEARANCE_ALLOW_HOSTS_FILES"),
+        }),
+    };
+    return stageSrtSettings(input.ticket, {
+        prepare: buildSrtSettings({ ...base, agent: "" }),
+        agent: buildSrtSettings({ ...base, agent: inferAgentCommandName(input.definition.cmd) }),
+    });
+}
 export async function setupWorkspace(config, options, runOptions = {}) {
     const { ticket, repository, model } = options;
     const { signal } = runOptions;
@@ -62,6 +92,7 @@ export async function setupWorkspace(config, options, runOptions = {}) {
     // Without rollback the next tick hits "Worktree already exists" and
     // the ticket strands forever.
     let promptDir;
+    let srtSettingsDir;
     try {
         await assertLaunchReady(readinessPromise);
         const ticketDetails = options.details;
@@ -79,6 +110,20 @@ export async function setupWorkspace(config, options, runOptions = {}) {
             defaultHooks: config.defaults.hooks,
         });
         const secretsFile = prepareWorktreeCommand === undefined ? undefined : stageBuildSecrets(promptDir);
+        let srtPrepareSettingsFile;
+        let srtAgentSettingsFile;
+        if (runner === "srt") {
+            const staged = buildAndStageSrtSettings({
+                config,
+                repository,
+                ticket,
+                worktreeDir: launchDir,
+                definition,
+            });
+            srtPrepareSettingsFile = staged.prepareFile;
+            srtAgentSettingsFile = staged.agentFile;
+            srtSettingsDir = staged.directory;
+        }
         const launchCommand = buildLaunchCommand({
             definition,
             promptFile: stagedPrompt.file,
@@ -87,6 +132,9 @@ export async function setupWorkspace(config, options, runOptions = {}) {
             prepareWorktreeCommand,
             runner,
             sandboxName,
+            srtPrepareSettingsFile,
+            srtAgentSettingsFile,
+            srtSettingsDir,
         });
         const launchCmd = stageWorkspaceLaunchCommand(promptDir, launchCommand);
         debug("Opening workspace...");
@@ -119,7 +167,7 @@ export async function setupWorkspace(config, options, runOptions = {}) {
         }
     }
     catch (error) {
-        await rollbackWorktree({ config, entry: created, promptDir });
+        await rollbackWorktree({ config, entry: created, promptDir, srtSettingsDir });
         recordRunStateBestEffort({
             config,
             ticket,
@@ -212,12 +260,16 @@ async function rollbackWorktree(arguments_) {
         log(`Worktree teardown failed during rollback: ${errorMessage(error)}`);
     }
     finally {
-        if (arguments_.promptDir !== undefined) {
-            try {
-                rmSync(arguments_.promptDir, { recursive: true, force: true });
-            }
-            catch {
-                // The launch command would have removed this; silent on retry races.
+        // Both temp dirs are normally removed by the launch command; clean them
+        // here for the pre-launch failure path. Silent on retry races.
+        for (const dir of [arguments_.promptDir, arguments_.srtSettingsDir]) {
+            if (dir !== undefined) {
+                try {
+                    rmSync(dir, { recursive: true, force: true });
+                }
+                catch {
+                    // already gone
+                }
             }
         }
     }

package/dist/lib/clearanceHosts.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Translate the existing clearance egress allowlist into srt
+ * `network.allowedDomains`. groundcrew keeps one source of truth for which
+ * hosts an agent may reach: the `CLEARANCE_ALLOW_HOSTS` env var and the
+ * newline-delimited files named by `CLEARANCE_ALLOW_HOSTS_FILES` (the shipped
+ * `clearance-allow-hosts` starter plus any personal files).
+ *
+ * clearance and srt share host-matching semantics — a bare `example.com` is an
+ * exact match and `*.example.com` matches subdomains — so the translation is
+ * almost an identity. The only real work is parsing (comments, blanks,
+ * comma/whitespace/newline separators), de-duplication, and dropping entries
+ * srt's domain schema would reject (`*.com`, `*`, leading/trailing dots, bare
+ * tokens without a dot like `localhost`) so the generated settings file always
+ * validates.
+ */
+export interface CollectAllowedDomainsInput {
+    /** Raw `CLEARANCE_ALLOW_HOSTS` value (comma/whitespace separated). */
+    hosts?: string | undefined;
+    /**
+     * Raw `CLEARANCE_ALLOW_HOSTS_FILES` value: a list of file paths joined by
+     * the platform path delimiter (`:` on POSIX), each a newline-delimited host
+     * list. Missing or unreadable files are skipped with a debug line.
+     */
+    files?: string | undefined;
+}
+/**
+ * Parse and validate clearance allow-host sources into a de-duplicated list of
+ * srt domain patterns, preserving first-seen order.
+ */
+export declare function collectAllowedDomains(input: CollectAllowedDomainsInput): string[];
+//# sourceMappingURL=clearanceHosts.d.ts.map

package/dist/lib/clearanceHosts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clearanceHosts.d.ts","sourceRoot":"","sources":["../../src/lib/clearanceHosts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,MAAM,WAAW,0BAA0B;IACzC,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,MAAM,EAAE,CA8BjF"}

package/dist/lib/clearanceHosts.js

@@ -0,0 +1,105 @@
+/**
+ * Translate the existing clearance egress allowlist into srt
+ * `network.allowedDomains`. groundcrew keeps one source of truth for which
+ * hosts an agent may reach: the `CLEARANCE_ALLOW_HOSTS` env var and the
+ * newline-delimited files named by `CLEARANCE_ALLOW_HOSTS_FILES` (the shipped
+ * `clearance-allow-hosts` starter plus any personal files).
+ *
+ * clearance and srt share host-matching semantics — a bare `example.com` is an
+ * exact match and `*.example.com` matches subdomains — so the translation is
+ * almost an identity. The only real work is parsing (comments, blanks,
+ * comma/whitespace/newline separators), de-duplication, and dropping entries
+ * srt's domain schema would reject (`*.com`, `*`, leading/trailing dots, bare
+ * tokens without a dot like `localhost`) so the generated settings file always
+ * validates.
+ */
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { debug } from "./util.js";
+/**
+ * Parse and validate clearance allow-host sources into a de-duplicated list of
+ * srt domain patterns, preserving first-seen order.
+ */
+export function collectAllowedDomains(input) {
+    const texts = [];
+    for (const file of splitPathList(input.files)) {
+        try {
+            texts.push(readFileSync(file, "utf8"));
+        }
+        catch (error) {
+            debug(`Skipping unreadable CLEARANCE_ALLOW_HOSTS_FILES entry ${file}: ${String(error)}`);
+        }
+    }
+    if (input.hosts !== undefined) {
+        texts.push(input.hosts);
+    }
+    const seen = new Set();
+    const domains = [];
+    for (const text of texts) {
+        for (const raw of tokenize(text)) {
+            const domain = normalizeDomain(raw);
+            if (domain === undefined) {
+                continue;
+            }
+            const key = domain.toLowerCase();
+            if (seen.has(key)) {
+                continue;
+            }
+            seen.add(key);
+            domains.push(domain);
+        }
+    }
+    return domains;
+}
+function splitPathList(value) {
+    if (value === undefined || value.length === 0) {
+        return [];
+    }
+    return value
+        .split(path.delimiter)
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+}
+/**
+ * Split a host source into candidate tokens. Handles env-style
+ * comma/whitespace separators and file-style newline lists with `#` comments
+ * (full-line or trailing — hostnames never contain `#`).
+ */
+function tokenize(text) {
+    return text
+        .split(/\r?\n/)
+        .flatMap((line) => line.replace(/#.*$/, "").split(/[\s,]+/))
+        .map((token) => token.trim())
+        .filter((token) => token.length > 0);
+}
+/**
+ * Normalize a raw host token into a valid srt domain pattern, or `undefined`
+ * if srt would reject it. Mirrors srt's `DomainPatternSchema`: a wildcard must
+ * be `*.<domain-with-a-dot>`; a bare host must contain a dot and no `*`. A
+ * leading-dot suffix form (`.example.com`) is rewritten to `*.example.com`.
+ */
+function normalizeDomain(token) {
+    const candidate = token.startsWith(".") ? `*${token}` : token;
+    if (candidate.startsWith("*.")) {
+        const base = candidate.slice(2);
+        return isPlainDomain(base) ? candidate : undefined;
+    }
+    return isPlainDomain(candidate) ? candidate : undefined;
+}
+function isPlainDomain(value) {
+    return (value.length > 0 &&
+        !value.includes("*") &&
+        // Mirror srt's DomainPatternSchema, which rejects scheme/path/port tokens.
+        // This matters for safety, not just correctness: a token srt rejects (e.g.
+        // `https://api.github.com`, `api.github.com:443`, `github.com/path`) fails
+        // the whole settings file's schema validation, and srt's `loadConfig` then
+        // returns null → the CLI silently falls back to a config with no read mask.
+        // Dropping such tokens here keeps the generated settings valid (fail closed
+        // for that host, never fail open for the launch).
+        !value.includes("://") &&
+        !value.includes("/") &&
+        !value.includes(":") &&
+        value.includes(".") &&
+        !value.startsWith(".") &&
+        !value.endsWith("."));
+}

package/dist/lib/config.d.ts

@@ -29,16 +29,18 @@ export type WorkspaceKindSetting = "auto" | "cmux" | "tmux";
 export declare const WORKSPACE_KIND_SETTINGS: readonly WorkspaceKindSetting[];
 /**
  * Concrete local isolation backend selected for a launch. `safehouse` is
- * macOS-only (clearance HTTP-egress + sandbox profile); `sdx` is Docker
- * Sandboxes (`sbx` CLI) — works on Linux and macOS and is the only known
- * option that lets the agent use Docker safely without exposing the host
- * socket; `none` is an explicit unsandboxed escape hatch.
+ * macOS-only (clearance HTTP-egress + sandbox profile); `srt` is Anthropic's
+ * sandbox-runtime (macOS `sandbox-exec` + Linux `bubblewrap`, with a built-in
+ * network allowlist) — a fast, non-Docker option on both macOS and Linux/WSL;
+ * `sdx` is Docker Sandboxes (`sbx` CLI) — works on Linux and macOS and is the
+ * only known option that lets the agent use Docker safely without exposing the
+ * host socket; `none` is an explicit unsandboxed escape hatch.
  */
-export type LocalRunner = "safehouse" | "sdx" | "none";
+export type LocalRunner = "safehouse" | "srt" | "sdx" | "none";
 /**
  * User-facing local runner setting. `auto` resolves at launch time:
- * macOS picks `safehouse`, Linux picks `sdx`. `none` is never picked
- * implicitly.
+ * macOS picks `safehouse`, Linux picks `sdx`. `srt` and `none` are never
+ * picked implicitly — both are opt-in via an explicit `local.runner`.
  */
 export type LocalRunnerSetting = LocalRunner | "auto";
 export declare const LOCAL_RUNNER_SETTINGS: readonly LocalRunnerSetting[];
@@ -140,6 +142,12 @@ export interface Config {
     git?: {
         remote?: string;
         defaultBranch?: string;
+        /**
+         * Overrides the prefix groundcrew puts in front of the ticket id when it
+         * names a worktree branch (`<branchPrefix>-<ticket>`). Defaults to the OS
+         * account username when unset. Must be a git-ref-safe, slash-free slug.
+         */
+        branchPrefix?: string;
     };
     workspace: {
         projectDir: string;
@@ -204,6 +212,7 @@ export interface ResolvedConfig {
     git: {
         remote: string;
         defaultBranch: string;
+        branchPrefix?: string;
     };
     workspace: {
         projectDir: string;

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAMrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,QAAQ,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5D,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EAIzD,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvD;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,MAAM,CAAC;AAEtD,eAAO,MAAM,qBAAqB,EAAE,SAAS,kBAAkB,EAKrD,CAAC;AAEX;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QACN,QAAQ,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACjD,CAAC;IACF;;;;OAIG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,KAAK,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC;AAC/D,KAAK,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,GAAG;IAC1E,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AACF,KAAK,mBAAmB,GAAG,0BAA0B,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,WAAW,MAAM;IACrB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB,GAAG,CAAC,EAAE;QACJ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,SAAS,EAAE;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,iBAAiB,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,YAAY,CAAC;KACtB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,sBAAsB,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC;IACF,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;;;WAKG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;KACnD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF;;;;OAIG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE,kBAAkB,CAAC;KAC7B,CAAC;IACF,OAAO,CAAC,EAAE;QACR;;;;;WAKG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,GAAG,EAAE;QACH,MAAM,EAAE,MAAM,CAAC;QACf,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,SAAS,EAAE;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,iBAAiB,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC;IACF,QAAQ,EAAE;QACR,KAAK,EAAE,YAAY,CAAC;KACrB,CAAC;IACF,YAAY,EAAE;QACZ,iBAAiB,EAAE,MAAM,CAAC;QAC1B,wBAAwB,EAAE,MAAM,CAAC;QACjC,sBAAsB,EAAE,MAAM,CAAC;KAChC,CAAC;IACF,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;KAC9C,CAAC;IACF,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF;;;OAGG;IACH,aAAa,EAAE,oBAAoB,CAAC;IACpC;;;;OAIG;IACH,KAAK,EAAE;QACL,MAAM,EAAE,kBAAkB,CAAC;KAC5B,CAAC;IACF,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,CAAC;AAEzD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IACjC,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;CAChC;AAuMD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,cAAc,CAAC,GAAG,OAAO,CAE1F;AA6FD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,EACtC,IAAI,EAAE,MAAM,GACX,OAAO,CAKT;AAqbD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CA2B5E;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAGpE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAMrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,QAAQ,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5D,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EAIzD,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,MAAM,CAAC;AAEtD,eAAO,MAAM,qBAAqB,EAAE,SAAS,kBAAkB,EAMrD,CAAC;AAEX;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QACN,QAAQ,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACjD,CAAC;IACF;;;;OAIG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,KAAK,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC;AAC/D,KAAK,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,GAAG;IAC1E,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AACF,KAAK,mBAAmB,GAAG,0BAA0B,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,WAAW,MAAM;IACrB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB,GAAG,CAAC,EAAE;QACJ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB;;;;WAIG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,SAAS,EAAE;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,iBAAiB,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,YAAY,CAAC;KACtB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,sBAAsB,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC;IACF,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;;;WAKG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;KACnD,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF;;;;OAIG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE,kBAAkB,CAAC;KAC7B,CAAC;IACF,OAAO,CAAC,EAAE;QACR;;;;;WAKG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,GAAG,EAAE;QACH,MAAM,EAAE,MAAM,CAAC;QACf,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,SAAS,EAAE;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,iBAAiB,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC;IACF,QAAQ,EAAE;QACR,KAAK,EAAE,YAAY,CAAC;KACrB,CAAC;IACF,YAAY,EAAE;QACZ,iBAAiB,EAAE,MAAM,CAAC;QAC1B,wBAAwB,EAAE,MAAM,CAAC;QACjC,sBAAsB,EAAE,MAAM,CAAC;KAChC,CAAC;IACF,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;KAC9C,CAAC;IACF,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF;;;OAGG;IACH,aAAa,EAAE,oBAAoB,CAAC;IACpC;;;;OAIG;IACH,KAAK,EAAE;QACL,MAAM,EAAE,kBAAkB,CAAC;KAC5B,CAAC;IACF,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,CAAC;AAEzD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IACjC,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;CAChC;AAsND;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,cAAc,CAAC,GAAG,OAAO,CAE1F;AA6FD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,EACtC,IAAI,EAAE,MAAM,GACX,OAAO,CAKT;AA4bD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CA2B5E;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAGpE"}

package/dist/lib/config.js

@@ -23,6 +23,7 @@ export const WORKSPACE_KIND_SETTINGS = [
 export const LOCAL_RUNNER_SETTINGS = [
     "auto",
     "safehouse",
+    "srt",
     "sdx",
     "none",
 ];
@@ -148,6 +149,17 @@ function normalizeOptionalString(value, configKey) {
     }
     return value.trim();
 }
+// Git-ref-safe, slash-free slug: must start alphanumeric/underscore (git rejects
+// a leading '.', and `git worktree add -b` would read a leading '-' as a flag)
+// and contain no `..` (git rejects it).
+const BRANCH_PREFIX_RE = /^(?!.*\.\.)\w[\w.-]*$/;
+function normalizeBranchPrefix(value) {
+    const normalized = normalizeOptionalString(value, "git.branchPrefix");
+    if (normalized !== undefined && !BRANCH_PREFIX_RE.test(normalized)) {
+        fail(`git.branchPrefix must be a slash-free slug of letters, digits, '.', '_', or '-' (got ${JSON.stringify(value)})`);
+    }
+    return normalized;
+}
 function normalizeHookCommands(value, configKey) {
     if (value === undefined) {
         return {};
@@ -435,9 +447,16 @@ function applyDefaults(user) {
         fail("local must be an object");
     }
     const sources = normalizeSources(user.sources);
+    const branchPrefix = normalizeBranchPrefix(user.git?.branchPrefix);
     return {
         sources,
-        git: { ...DEFAULT_GIT, ...user.git },
+        // Only carry the key when set so `git.branchPrefix` stays truly optional
+        // under exactOptionalPropertyTypes.
+        git: {
+            ...DEFAULT_GIT,
+            ...user.git,
+            ...(branchPrefix === undefined ? {} : { branchPrefix }),
+        },
         workspace: {
             projectDir: expandHome(user.workspace.projectDir),
             knownRepositories: user.workspace.knownRepositories,

package/dist/lib/host.d.ts

@@ -12,6 +12,12 @@ export interface HostCapabilities {
     hasCmux: boolean;
     /** True when the `tmux` binary is on PATH. */
     hasTmux: boolean;
+    /** True when the `bubblewrap` binary is on PATH (Linux srt dependency). */
+    hasBubblewrap: boolean;
+    /** True when the `socat` binary is on PATH (Linux srt dependency). */
+    hasSocat: boolean;
+    /** True when the `rg` (ripgrep) binary is on PATH (Linux srt dependency). */
+    hasRipgrep: boolean;
     /** True when the host platform is macOS. Safehouse is macOS-only. */
     isMacOS: boolean;
     /** True when the host platform is Linux. */
@@ -22,6 +28,14 @@ export interface HostCapabilities {
      * or WSL before creating a worktree.
      */
     isSafehouseSupported: boolean;
+    /**
+     * True when srt (Anthropic sandbox-runtime) is supportable on this
+     * platform. srt uses `sandbox-exec` on macOS and `bubblewrap` on Linux,
+     * so this tracks "macOS || Linux"; WSL inherits the Linux path. The srt
+     * binary itself ships as a groundcrew dependency, so there is no PATH
+     * probe — but the Linux backend additionally needs bubblewrap/socat/rg.
+     */
+    isSrtSupported: boolean;
     /**
      * True when sdx (Docker Sandboxes) is supportable on this platform —
      * sbx is published for both macOS and Linux, so this stays in sync with

package/dist/lib/host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/lib/host.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,YAAY,EAAE,OAAO,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAc1F;AAED,wBAAsB,sBAAsB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmB5F"}
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/lib/host.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,YAAY,EAAE,OAAO,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,aAAa,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,QAAQ,EAAE,OAAO,CAAC;IAClB,6EAA6E;IAC7E,UAAU,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAc1F;AAED,wBAAsB,sBAAsB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0B5F"}

package/dist/lib/host.js

@@ -28,20 +28,27 @@ export async function which(cmd, signal) {
 export async function detectHostCapabilities(signal) {
     const isMacOS = process.platform === "darwin";
     const isLinux = process.platform === "linux";
-    const [safehouse, sbx, cmux, tmux] = await Promise.all([
+    const [safehouse, sbx, cmux, tmux, bubblewrap, socat, ripgrep] = await Promise.all([
         which("safehouse", signal),
         which("sbx", signal),
         which("cmux", signal),
         which("tmux", signal),
+        which("bwrap", signal),
+        which("socat", signal),
+        which("rg", signal),
     ]);
     return {
         hasSafehouse: safehouse !== undefined,
         hasSbx: sbx !== undefined,
         hasCmux: cmux !== undefined,
         hasTmux: tmux !== undefined,
+        hasBubblewrap: bubblewrap !== undefined,
+        hasSocat: socat !== undefined,
+        hasRipgrep: ripgrep !== undefined,
         isMacOS,
         isLinux,
         isSafehouseSupported: isMacOS,
+        isSrtSupported: isMacOS || isLinux,
         isSdxSupported: isMacOS || isLinux,
     };
 }

package/dist/lib/launchCommand.d.ts

@@ -11,6 +11,31 @@ export { shellSingleQuote } from "./shell.ts";
  *   exercise the catch branch.
  */
 export declare function resolveSafehouseClearancePath(baseUrl?: string): string;
+/**
+ * Resolve the `srt` CLI shipped by `@anthropic-ai/sandbox-runtime` (a pinned
+ * groundcrew dependency) via Node's module resolution, reading the package's
+ * `bin` field so the path survives version bumps that move the entry point.
+ * The resolved `dist/cli.js` carries a `#!/usr/bin/env node` shebang and npm
+ * marks it executable, so it is exec'd directly like the safehouse wrapper.
+ *
+ * @param baseUrl - **Test-only seam.** Production callers must omit this so the
+ *   helper resolves from this module's URL. Tests pass an invalid value to
+ *   exercise the catch branch.
+ */
+export declare function resolveSrtBinPath(baseUrl?: string): string;
+/**
+ * Extract the `srt` entry from a package manifest's `bin` field, which npm
+ * allows as either a bare string (single-bin packages) or a name→path map.
+ */
+export declare function srtBinEntry(manifest: {
+    bin?: string | Record<string, string>;
+}): string;
+/**
+ * Infer the agent's command basename from a model `cmd` (skipping a leading
+ * `env`/`KEY=val` prefix). Safehouse uses it to pick the matching `.sb`
+ * profile; srt uses it to pick the agent's credential profile in `srtPolicy`.
+ */
+export declare function inferAgentCommandName(agentCmd: string): string;
 interface LaunchCommandArguments {
     definition: ModelDefinition;
     promptFile: string;
@@ -42,6 +67,22 @@ interface LaunchCommandArguments {
      * on one host and sdx on another without config edits.
      */
     sandboxName?: string | undefined;
+    /**
+     * Absolute path to the profile-neutral srt settings JSON for the
+     * prepareWorktree wrap (no agent credential grants). Required when
+     * `runner === "srt"`. Staged in `srtSettingsDir`.
+     */
+    srtPrepareSettingsFile?: string | undefined;
+    /**
+     * Absolute path to the full agent srt settings JSON for the agent wrap.
+     * Required when `runner === "srt"`. Staged in `srtSettingsDir`.
+     */
+    srtAgentSettingsFile?: string | undefined;
+    /**
+     * Absolute temp dir holding the srt settings files. Required when
+     * `runner === "srt"`; torn down by the launch command after srt exits.
+     */
+    srtSettingsDir?: string | undefined;
 }
 /**
  * Build the shell command that runs inside the workspace. The prompt is

package/dist/lib/launchCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launchCommand.d.ts","sourceRoot":"","sources":["../../src/lib/launchCommand.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,GAAE,MAAwB,GAAG,MAAM,CAcvF;AA2KD,UAAU,sBAAsB;IAC9B,UAAU,EAAE,eAAe,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C;;;;OAIG;IACH,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,sBAAsB,GAAG,MAAM,CA0B7E"}
+{"version":3,"file":"launchCommand.d.ts","sourceRoot":"","sources":["../../src/lib/launchCommand.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,GAAE,MAAwB,GAAG,MAAM,CAcvF;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,MAAwB,GAAG,MAAM,CAgB3E;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,MAAM,CAMvF;AAqMD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CA8B9D;AAED,UAAU,sBAAsB;IAC9B,UAAU,EAAE,eAAe,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C;;;;OAIG;IACH,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,sBAAsB,GAAG,MAAM,CA6B7E"}