@cluesmith/codev 3.3.3 → 3.3.4

package/dist/agent-farm/servers/ide-forward.js

@@ -0,0 +1,274 @@
+/**
+ * IDE prefix forward (Issue #1668).
+ *
+ * Tower forwards a fixed `/ide/` prefix to a single local VS Code server-web
+ * process — plain HTTP here and, for the workbench's own remote-protocol
+ * sockets, a raw bidirectional WebSocket pipe (Tower never parses those frames;
+ * they are VS Code's protocol, not Tower's — see `tower-websocket.ts` for the
+ * contrast with the PTY terminal bridge).
+ *
+ * Authorization is decided upstream by `isForwardAuthorized` (the HTTP path also
+ * passes the general `isRequestAllowed` choke point first); this module only
+ * proxies, after that decision. Header hygiene and `x-forwarded-*` stamping
+ * happen here, strictly after auth (Issue #1668 §D2).
+ */
+import http from 'node:http';
+import { URL } from 'node:url';
+import { readCloudConfig } from '../lib/cloud-config.js';
+import { TUNNEL_PROXY_HEADER } from '../lib/tunnel-client.js';
+import { TOWER_KEY_HEADER, LEGACY_WEB_KEY_HEADER } from '@cluesmith/codev-types';
+import { IDE_DEFAULT_PREFIX, readIdeConnectionToken } from '../lib/ide-record.js';
+import { getRecordedIdePort, ensureIdeServerLive } from './ide-server.js';
+/** Hop-by-hop headers not forwarded between connections (RFC 7230 §6.1). */
+const HOP_BY_HOP = new Set([
+    'connection',
+    'keep-alive',
+    'proxy-authenticate',
+    'proxy-authorization',
+    'te',
+    'trailers',
+    'transfer-encoding',
+    'upgrade',
+]);
+/**
+ * Headers stripped before forwarding to the IDE server:
+ * - `x-forwarded-port` / `x-original-host`: a leaked upstream port makes the
+ *   browser dial the wrong WebSocket port, breaking the live session.
+ * - `codev-tower-key` / `codev-web-key`: Tower's auth credential — the IDE
+ *   server must never see it.
+ * - `x-codev-tunnel-proxy`: Tower's tunnel marker — never forwarded, so it
+ *   cannot leak or be trusted downstream (marker integrity, #1674).
+ * - `host`: replaced with the loopback target authority below.
+ */
+const STRIP_BEFORE_FORWARD = new Set([
+    'x-forwarded-port',
+    'x-original-host',
+    TOWER_KEY_HEADER,
+    LEGACY_WEB_KEY_HEADER,
+    TUNNEL_PROXY_HEADER,
+    'host',
+]);
+/** True if this request arrived over the tunnel (stamped by `TunnelClient`, #1588). */
+function isTunnelBorne(headers) {
+    return headers[TUNNEL_PROXY_HEADER] === '1';
+}
+/** The connection-token cookie name the VS Code server reads. */
+const IDE_TOKEN_COOKIE = 'vscode-tkn';
+/**
+ * Merge the IDE connection token into a Cookie header value as `vscode-tkn=…`,
+ * preserving every existing cookie and never clobbering an already-present
+ * `vscode-tkn` (Issue #1668). Exported for testing.
+ */
+export function mergeConnectionTokenCookie(existing, token) {
+    const current = Array.isArray(existing) ? existing.join('; ') : existing ?? '';
+    // Never clobber: if a vscode-tkn is already present, leave the header as-is.
+    if (new RegExp(`(^|;\\s*)${IDE_TOKEN_COOKIE}=`).test(current))
+        return current;
+    const pair = `${IDE_TOKEN_COOKIE}=${token}`;
+    return current ? `${current}; ${pair}` : pair;
+}
+/**
+ * Derive the tunnel's public authority from the cloud config, matching the
+ * `accessUrl` Tower advertises (`tower-tunnel.ts`: `${server_url}/t/${tower_name}/`).
+ * Returns null when the tower is not cloud-registered.
+ */
+export function getPublicAuthority() {
+    const cfg = readCloudConfig();
+    if (!cfg)
+        return null;
+    let host;
+    let proto;
+    try {
+        const url = new URL(cfg.server_url);
+        host = url.host;
+        proto = url.protocol === 'http:' ? 'http' : 'https';
+    }
+    catch {
+        return null;
+    }
+    return { host, proto, prefix: `/t/${cfg.tower_name}${IDE_DEFAULT_PREFIX.replace(/\/$/, '')}` };
+}
+/**
+ * Build the header set forwarded to the IDE server: drop hop-by-hop and
+ * Tower-internal headers, set the loopback `Host`, and — only when tunnel-borne
+ * — stamp `x-forwarded-host` / `x-forwarded-proto` / `x-forwarded-prefix` from
+ * the public authority so the workbench builds correct `remoteAuthority` and
+ * base-path URLs and never sees a stale upstream port. Response caching headers
+ * (`Cache-Control` / `ETag`) are a RESPONSE concern and preserved separately.
+ *
+ * Pure and exported for unit testing.
+ */
+export function buildForwardHeaders(incoming, port, publicAuthority, connectionToken) {
+    const out = {};
+    for (const [key, value] of Object.entries(incoming)) {
+        if (value === undefined)
+            continue;
+        const lower = key.toLowerCase();
+        if (HOP_BY_HOP.has(lower))
+            continue;
+        if (STRIP_BEFORE_FORWARD.has(lower))
+            continue;
+        out[key] = value;
+    }
+    out['host'] = `127.0.0.1:${port}`;
+    if (isTunnelBorne(incoming) && publicAuthority) {
+        out['x-forwarded-host'] = publicAuthority.host;
+        out['x-forwarded-proto'] = publicAuthority.proto;
+        out['x-forwarded-prefix'] = publicAuthority.prefix;
+    }
+    // Present the IDE server's connection token as a cookie. The server is
+    // spawned with `--connection-token-file` and 403s without it, and it cannot
+    // ride the browser's cookie jar through the relay (Set-Cookie Path=/ide never
+    // matches /t/<tower>/ide/), so Tower injects it here — merging with, never
+    // clobbering, any existing Cookie header (Issue #1668).
+    if (connectionToken) {
+        out['cookie'] = mergeConnectionTokenCookie(incoming.cookie, connectionToken);
+    }
+    return out;
+}
+/** True if `pathname` targets the IDE forward prefix (`/ide` or `/ide/…`). */
+export function matchIdePrefix(pathname) {
+    const bare = IDE_DEFAULT_PREFIX.replace(/\/$/, ''); // "/ide"
+    return pathname === bare || pathname.startsWith(IDE_DEFAULT_PREFIX);
+}
+/** Copy response headers, dropping hop-by-hop; preserves `Cache-Control` / `ETag`. */
+function copyResponseHeaders(headers) {
+    const out = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (value === undefined)
+            continue;
+        if (HOP_BY_HOP.has(key.toLowerCase()))
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
+/**
+ * Forward a plain HTTP request to the local IDE server. Assumes authorization
+ * has already passed. Path and query are forwarded unchanged (the workbench
+ * runs with `--server-base-path /ide` and selects the workspace from `?folder=`).
+ * A dead / unreachable server yields 502, never a crash.
+ */
+export async function forwardIdeHttp(req, res, log) {
+    // Hot path: resolve the target port from the record — no port scan. A dead
+    // server fails the connect below, which triggers a respawn (Issue #1668).
+    const port = getRecordedIdePort();
+    if (port === null) {
+        res.writeHead(502, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'IDE server unavailable' }));
+        return;
+    }
+    const headers = buildForwardHeaders(req.headers, port, getPublicAuthority(), readIdeConnectionToken());
+    const proxyReq = http.request({ hostname: '127.0.0.1', port, path: req.url || '/', method: req.method, headers }, (proxyRes) => {
+        res.writeHead(proxyRes.statusCode ?? 502, copyResponseHeaders(proxyRes.headers));
+        proxyRes.pipe(res);
+        proxyRes.on('error', () => {
+            if (!res.writableEnded)
+                res.end();
+        });
+    });
+    proxyReq.on('error', (err) => {
+        log('WARN', `IDE HTTP forward error: ${err.message}`);
+        onUpstreamConnectError(err, log);
+        if (!res.headersSent) {
+            res.writeHead(502, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Bad Gateway: IDE server unavailable' }));
+        }
+        else if (!res.writableEnded) {
+            res.end();
+        }
+    });
+    req.pipe(proxyReq);
+    req.on('error', () => proxyReq.destroy());
+}
+/**
+ * On a refused/reset upstream connection the recorded server is down. Kick a
+ * respawn off the hot path (fire-and-forget) so the next request lands; this
+ * request still 502s. The respawn (cold path) is where the `lsof` probe lives.
+ */
+function onUpstreamConnectError(err, log) {
+    if (err.code === 'ECONNREFUSED' || err.code === 'ECONNRESET') {
+        ensureIdeServerLive(log).catch(() => { });
+    }
+}
+/**
+ * Forward a WebSocket upgrade to the local IDE server as a raw bidirectional
+ * byte pipe. Tower authenticates the upgrade (caller) and then gets out of the
+ * way — the workbench speaks VS Code's own remote protocol, which Tower must not
+ * parse. Mirrors `tunnel-client.ts handleWebSocketConnect`'s pipe.
+ */
+export async function forwardIdeWebSocket(req, socket, head, log) {
+    const port = getRecordedIdePort();
+    if (port === null) {
+        socket.write('HTTP/1.1 502 Bad Gateway\r\n\r\n');
+        socket.destroy();
+        return;
+    }
+    // Header hygiene drops the hop-by-hop `Connection`/`Upgrade` pair, so re-add
+    // them for the upstream upgrade (as `tunnel-client.ts` does). The client's
+    // `Sec-WebSocket-Key` is preserved by `buildForwardHeaders` and forwarded as-is
+    // so the upstream's `Sec-WebSocket-Accept` — relayed back verbatim — validates
+    // against the client's own key.
+    const headers = buildForwardHeaders(req.headers, port, getPublicAuthority(), readIdeConnectionToken());
+    headers['Connection'] = 'Upgrade';
+    headers['Upgrade'] = 'websocket';
+    const upstream = http.request({
+        hostname: '127.0.0.1',
+        port,
+        path: req.url || '/',
+        method: 'GET',
+        headers,
+    });
+    upstream.on('upgrade', (_upstreamRes, upstreamSocket, upstreamHead) => {
+        // Replay the handshake response and any buffered bytes, then pipe both ways.
+        socket.write(rebuildUpgradeResponse(_upstreamRes));
+        if (upstreamHead.length > 0)
+            socket.write(upstreamHead);
+        if (head.length > 0)
+            upstreamSocket.write(head);
+        upstreamSocket.pipe(socket);
+        socket.pipe(upstreamSocket);
+        const closeBoth = () => {
+            if (!socket.destroyed)
+                socket.destroy();
+            if (!upstreamSocket.destroyed)
+                upstreamSocket.destroy();
+        };
+        socket.on('error', closeBoth);
+        upstreamSocket.on('error', closeBoth);
+        socket.on('close', closeBoth);
+        upstreamSocket.on('close', closeBoth);
+    });
+    upstream.on('response', (upstreamRes) => {
+        // Upstream declined the upgrade (e.g. 404) — relay the status and close.
+        socket.write(`HTTP/1.1 ${upstreamRes.statusCode ?? 502} ${upstreamRes.statusMessage ?? ''}\r\n\r\n`);
+        socket.destroy();
+    });
+    upstream.on('error', (err) => {
+        log('WARN', `IDE WS forward error: ${err.message}`);
+        onUpstreamConnectError(err, log);
+        if (!socket.destroyed) {
+            socket.write('HTTP/1.1 502 Bad Gateway\r\n\r\n');
+            socket.destroy();
+        }
+    });
+    upstream.end();
+}
+/** Reconstruct the HTTP/1.1 101 switching-protocols response line + headers. */
+function rebuildUpgradeResponse(res) {
+    const statusLine = `HTTP/1.1 ${res.statusCode ?? 101} ${res.statusMessage ?? 'Switching Protocols'}`;
+    const lines = [statusLine];
+    for (const [key, value] of Object.entries(res.headers)) {
+        if (value === undefined)
+            continue;
+        if (Array.isArray(value)) {
+            for (const v of value)
+                lines.push(`${key}: ${v}`);
+        }
+        else {
+            lines.push(`${key}: ${value}`);
+        }
+    }
+    return lines.join('\r\n') + '\r\n\r\n';
+}
+//# sourceMappingURL=ide-forward.js.map

package/dist/agent-farm/servers/ide-forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ide-forward.js","sourceRoot":"","sources":["../../../src/agent-farm/servers/ide-forward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE1E,4EAA4E;AAC5E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,UAAU;IACV,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,mBAAmB;IACnB,MAAM;CACP,CAAC,CAAC;AASH,uFAAuF;AACvF,SAAS,aAAa,CAAC,OAAiC;IACtD,OAAO,OAAO,CAAC,mBAAmB,CAAC,KAAK,GAAG,CAAC;AAC9C,CAAC;AAED,iEAAiE;AACjE,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAuC,EAAE,KAAa;IAC/F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC/E,6EAA6E;IAC7E,IAAI,IAAI,MAAM,CAAC,YAAY,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9E,MAAM,IAAI,GAAG,GAAG,gBAAgB,IAAI,KAAK,EAAE,CAAC;IAC5C,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,IAAY,CAAC;IACjB,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAChB,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;AACjG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAkC,EAClC,IAAY,EACZ,eAAuC,EACvC,eAA8B;IAE9B,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC9C,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,GAAG,aAAa,IAAI,EAAE,CAAC;IAElC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,eAAe,EAAE,CAAC;QAC/C,GAAG,CAAC,kBAAkB,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC;QAC/C,GAAG,CAAC,mBAAmB,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC;QACjD,GAAG,CAAC,oBAAoB,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC;IACrD,CAAC;IAED,uEAAuE;IACvE,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,wDAAwD;IACxD,IAAI,eAAe,EAAE,CAAC;QACpB,GAAG,CAAC,QAAQ,CAAC,GAAG,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;IAC7D,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AACtE,CAAC;AAED,sFAAsF;AACtF,SAAS,mBAAmB,CAAC,OAAiC;IAC5D,MAAM,GAAG,GAA+C,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QAChD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAyB,EACzB,GAAwB,EACxB,GAAgE;IAEhE,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACvG,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC3B,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,EAClF,CAAC,QAAQ,EAAE,EAAE;QACX,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3B,GAAG,CAAC,MAAM,EAAE,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,GAA0B,EAAE,GAAgE;IAC1H,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC7D,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAyB,EACzB,MAAkB,EAClB,IAAY,EACZ,GAAgE;IAEhE,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,gFAAgF;IAChF,+EAA+E;IAC/E,gCAAgC;IAChC,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACvG,OAAO,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC;IAClC,OAAO,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,QAAQ,EAAE,WAAW;QACrB,IAAI;QACJ,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG;QACpB,MAAM,EAAE,KAAK;QACb,OAAO;KACR,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE;QACpE,6EAA6E;QAC7E,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC;QACnD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEhD,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE5B,MAAM,SAAS,GAAG,GAAG,EAAE;YACrB,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,CAAC,cAAc,CAAC,SAAS;gBAAE,cAAc,CAAC,OAAO,EAAE,CAAC;QAC1D,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9B,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9B,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,EAAE;QACtC,yEAAyE;QACzE,MAAM,CAAC,KAAK,CAAC,YAAY,WAAW,CAAC,UAAU,IAAI,GAAG,IAAI,WAAW,CAAC,aAAa,IAAI,EAAE,UAAU,CAAC,CAAC;QACrG,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAClD,GAAG,CAAC,MAAM,EAAE,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,SAAS,sBAAsB,CAAC,GAAyB;IACvD,MAAM,UAAU,GAAG,YAAY,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,aAAa,IAAI,qBAAqB,EAAE,CAAC;IACrG,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC;AACzC,CAAC"}

package/dist/agent-farm/servers/ide-server.d.ts

@@ -0,0 +1,68 @@
+/**
+ * IDE server lifecycle, Tower-side (Issue #1668).
+ *
+ * Tower is the spawner: `afx ide start` drives this through the local-only
+ * `/api/ide` endpoint, and the same spawn path is reused by boot reconcile and
+ * by on-demand respawn when a `/ide/` request arrives and the server is down.
+ * Runtime state lives in the `~/.agent-farm/ide-server.json` record (Issue
+ * #1668 §D3) — no config file, no `global.db` change. Liveness is discovered by
+ * port (`getProcessesOnPort`), the same way Tower finds its own process.
+ */
+import http from 'node:http';
+import { type IdeServerRecord } from '../lib/ide-record.js';
+type LogFn = (level: 'INFO' | 'ERROR' | 'WARN', message: string) => void;
+/**
+ * The recorded IDE server port, or null if none — the forward's hot-path target
+ * resolution. A plain record read, no port scan (Issue #1668): a dead server
+ * fails the proxy connect immediately, which is the only liveness check the
+ * forward needs.
+ */
+export declare function getRecordedIdePort(): number | null;
+export interface SpawnIdeOptions {
+    serverPath: string;
+    port?: number;
+    defaultFolder?: string;
+}
+/**
+ * Spawn the IDE server detached (so it survives a Tower restart, like a
+ * shellper) and write the runtime record. Resolves to the record once the
+ * server is listening, or throws if the binary is missing or never binds.
+ */
+export declare function spawnIdeServer(opts: SpawnIdeOptions, log: LogFn): Promise<IdeServerRecord>;
+/**
+ * Stop the IDE server on the recorded port: SIGTERM, wait for exit, escalate to
+ * SIGKILL for survivors (mirrors `towerStop`, #1668 plan §4), then delete the
+ * record. Cold path — `getProcessesOnPort` is fine here.
+ */
+export declare function stopIdeServer(log: LogFn): Promise<{
+    stopped: boolean;
+    port: number | null;
+}>;
+export interface IdeStatus {
+    record: IdeServerRecord | null;
+    alive: boolean;
+    pid: number | null;
+}
+/** Report the IDE server's status from the record plus a live port probe. */
+export declare function ideServerStatus(): IdeStatus;
+/**
+ * Ensure the IDE server is live and return its port, or null if it cannot be
+ * made live (no record, or a respawn that never bound). A live server is the
+ * fast path (no spawn). A recorded-but-dead server is respawned from the
+ * recorded `serverPath`; concurrent callers share one in-flight respawn.
+ */
+export declare function ensureIdeServerLive(log?: LogFn): Promise<number | null>;
+/**
+ * Boot-time reconcile: adopt a live server (no orphan) or respawn a recorded
+ * but dead one. Best-effort — never throws into Tower boot.
+ */
+export declare function reconcileIdeServer(log: LogFn): Promise<void>;
+/**
+ * Local-only `/api/ide` management endpoint driving the lifecycle above:
+ * `POST` starts (body `{ serverPath, port?, defaultFolder? }`), `DELETE` stops,
+ * `GET` reports status. Reached only post-`isRequestAllowed` (key required) and
+ * blocked from the tunnel like `/api/tunnel/*` — it spawns/kills a process.
+ */
+export declare function handleIdeApi(req: http.IncomingMessage, res: http.ServerResponse, log: LogFn): Promise<void>;
+export {};
+//# sourceMappingURL=ide-server.d.ts.map

package/dist/agent-farm/servers/ide-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ide-server.d.ts","sourceRoot":"","sources":["../../../src/agent-farm/servers/ide-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAM7B,OAAO,EAGL,KAAK,eAAe,EAMrB,MAAM,sBAAsB,CAAC;AAE9B,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;AA4BzE;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAElD;AAYD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC,eAAe,CAAC,CA6EhG;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAkClG;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,IAAI,SAAS,CAK3C;AAKD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,GAAE,KAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsBvF;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAQlE;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,GAAG,EAAE,KAAK,GACT,OAAO,CAAC,IAAI,CAAC,CA6Cf"}

package/dist/agent-farm/servers/ide-server.js

@@ -0,0 +1,281 @@
+/**
+ * IDE server lifecycle, Tower-side (Issue #1668).
+ *
+ * Tower is the spawner: `afx ide start` drives this through the local-only
+ * `/api/ide` endpoint, and the same spawn path is reused by boot reconcile and
+ * by on-demand respawn when a `/ide/` request arrives and the server is down.
+ * Runtime state lives in the `~/.agent-farm/ide-server.json` record (Issue
+ * #1668 §D3) — no config file, no `global.db` change. Liveness is discovered by
+ * port (`getProcessesOnPort`), the same way Tower finds its own process.
+ */
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { getProcessesOnPort } from '../utils/port.js';
+import { sanitizeAgentEnv } from '../../lib/agent-env.js';
+import { parseJsonBody } from '../utils/server-utils.js';
+import { IDE_DEFAULT_PREFIX, IDE_DEFAULT_PORT, readIdeRecord, writeIdeRecord, deleteIdeRecord, ensureIdeConnectionToken, getIdeConnectionTokenPath, } from '../lib/ide-record.js';
+const READY_TIMEOUT_MS = 15_000;
+const READY_POLL_MS = 200;
+const STOP_EXIT_TIMEOUT_MS = 5_000;
+const STOP_POLL_MS = 200;
+/**
+ * True if some process is listening on the port. Uses `lsof` (`getProcessesOnPort`),
+ * which is ~100 ms and synchronous, so it is a **COLD-path only** check — restart
+ * reconcile, `afx ide status`, start-collision detection, and respawn. The request
+ * forward must NEVER call this (Issue #1668): it reads the port from the record and
+ * lets the upstream connect error be the liveness truth-teller.
+ */
+function isPortLive(port) {
+    return getProcessesOnPort(port).length > 0;
+}
+/** True if a PID is alive (cheap, non-blocking). */
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The recorded IDE server port, or null if none — the forward's hot-path target
+ * resolution. A plain record read, no port scan (Issue #1668): a dead server
+ * fails the proxy connect immediately, which is the only liveness check the
+ * forward needs.
+ */
+export function getRecordedIdePort() {
+    return readIdeRecord()?.port ?? null;
+}
+/** Poll until a process is listening on `port`, or the timeout elapses. */
+async function waitForPort(port, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (isPortLive(port))
+            return true;
+        await new Promise((r) => setTimeout(r, READY_POLL_MS));
+    }
+    return isPortLive(port);
+}
+/**
+ * Spawn the IDE server detached (so it survives a Tower restart, like a
+ * shellper) and write the runtime record. Resolves to the record once the
+ * server is listening, or throws if the binary is missing or never binds.
+ */
+export async function spawnIdeServer(opts, log) {
+    const port = opts.port ?? IDE_DEFAULT_PORT;
+    if (!opts.serverPath) {
+        throw new Error('IDE server path is required (no default — set --server-path)');
+    }
+    if (!existsSync(opts.serverPath)) {
+        throw new Error(`IDE server binary not found at ${opts.serverPath}`);
+    }
+    // Start-collision: a prior server recorded on a DIFFERENT port would be orphaned
+    // (still running, no longer tracked) if we just overwrote the singleton record.
+    // Stop it first so "start on a new port" never leaves a detached stray (#1668).
+    const existing = readIdeRecord();
+    if (existing && existing.port !== port && isPortLive(existing.port)) {
+        log('WARN', `IDE server already recorded on port ${existing.port}; stopping it before starting on ${port}`);
+        await stopIdeServer(log);
+    }
+    // Already live on the port — idempotent: adopt and record, don't double-spawn.
+    if (isPortLive(port)) {
+        log('INFO', `IDE server already listening on port ${port}; adopting`);
+        const pid = getProcessesOnPort(port)[0] ?? 0;
+        const record = {
+            prefix: IDE_DEFAULT_PREFIX,
+            port,
+            serverPath: opts.serverPath,
+            pid,
+            defaultFolder: opts.defaultFolder,
+            startedAt: new Date().toISOString(),
+        };
+        writeIdeRecord(record);
+        return record;
+    }
+    const basePath = IDE_DEFAULT_PREFIX.replace(/\/$/, ''); // "/ide"
+    const tokenFile = getIdeConnectionTokenPath();
+    ensureIdeConnectionToken();
+    const args = [
+        '--host', '127.0.0.1',
+        '--port', String(port),
+        '--server-base-path', basePath,
+        '--connection-token-file', tokenFile,
+        '--accept-server-license-terms',
+    ];
+    if (opts.defaultFolder) {
+        args.push('--default-folder', opts.defaultFolder);
+    }
+    log('INFO', `Spawning IDE server: ${opts.serverPath} ${args.join(' ')}`);
+    const child = spawn(opts.serverPath, args, {
+        cwd: process.cwd(),
+        env: sanitizeAgentEnv(process.env),
+        detached: true,
+        stdio: 'ignore',
+    });
+    if (!child.pid) {
+        throw new Error('Failed to spawn IDE server process');
+    }
+    child.unref();
+    const ready = await waitForPort(port, READY_TIMEOUT_MS);
+    if (!ready) {
+        throw new Error(`IDE server did not start listening on port ${port} within ${READY_TIMEOUT_MS / 1000}s`);
+    }
+    const record = {
+        prefix: IDE_DEFAULT_PREFIX,
+        port,
+        serverPath: opts.serverPath,
+        pid: child.pid,
+        defaultFolder: opts.defaultFolder,
+        startedAt: new Date().toISOString(),
+    };
+    writeIdeRecord(record);
+    log('INFO', `IDE server listening on port ${port} (pid ${child.pid})`);
+    return record;
+}
+/**
+ * Stop the IDE server on the recorded port: SIGTERM, wait for exit, escalate to
+ * SIGKILL for survivors (mirrors `towerStop`, #1668 plan §4), then delete the
+ * record. Cold path — `getProcessesOnPort` is fine here.
+ */
+export async function stopIdeServer(log) {
+    const record = readIdeRecord();
+    if (!record) {
+        return { stopped: false, port: null };
+    }
+    const pids = getProcessesOnPort(record.port);
+    for (const pid of pids) {
+        try {
+            process.kill(pid, 'SIGTERM');
+        }
+        catch {
+            // already gone
+        }
+    }
+    // Wait for the SIGTERMed processes to actually exit before deleting the record;
+    // escalate any survivors to SIGKILL, so a lingering process can't be re-adopted.
+    const deadline = Date.now() + STOP_EXIT_TIMEOUT_MS;
+    let survivors = pids.filter(isPidAlive);
+    while (survivors.length > 0 && Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, STOP_POLL_MS));
+        survivors = survivors.filter(isPidAlive);
+    }
+    for (const pid of survivors) {
+        try {
+            process.kill(pid, 'SIGKILL');
+        }
+        catch {
+            // exited between the check and the kill
+        }
+    }
+    deleteIdeRecord();
+    const killedNote = survivors.length > 0 ? `, SIGKILL escalated for ${survivors.length}` : '';
+    log('INFO', `Stopped IDE server on port ${record.port} (${pids.length} process(es)${killedNote})`);
+    return { stopped: pids.length > 0, port: record.port };
+}
+/** Report the IDE server's status from the record plus a live port probe. */
+export function ideServerStatus() {
+    const record = readIdeRecord();
+    if (!record)
+        return { record: null, alive: false, pid: null };
+    const pids = getProcessesOnPort(record.port);
+    return { record, alive: pids.length > 0, pid: pids[0] ?? null };
+}
+// Guards against two concurrent `/ide/` requests both triggering a respawn.
+let respawnInFlight = null;
+/**
+ * Ensure the IDE server is live and return its port, or null if it cannot be
+ * made live (no record, or a respawn that never bound). A live server is the
+ * fast path (no spawn). A recorded-but-dead server is respawned from the
+ * recorded `serverPath`; concurrent callers share one in-flight respawn.
+ */
+export async function ensureIdeServerLive(log = () => { }) {
+    const record = readIdeRecord();
+    if (!record)
+        return null;
+    if (isPortLive(record.port))
+        return record.port;
+    if (respawnInFlight)
+        return respawnInFlight;
+    respawnInFlight = (async () => {
+        try {
+            log('INFO', `IDE server on port ${record.port} is down; respawning from ${record.serverPath}`);
+            const fresh = await spawnIdeServer({ serverPath: record.serverPath, port: record.port, defaultFolder: record.defaultFolder }, log);
+            return fresh.port;
+        }
+        catch (err) {
+            log('WARN', `IDE server respawn failed: ${err.message}`);
+            return null;
+        }
+        finally {
+            respawnInFlight = null;
+        }
+    })();
+    return respawnInFlight;
+}
+/**
+ * Boot-time reconcile: adopt a live server (no orphan) or respawn a recorded
+ * but dead one. Best-effort — never throws into Tower boot.
+ */
+export async function reconcileIdeServer(log) {
+    const record = readIdeRecord();
+    if (!record)
+        return;
+    if (isPortLive(record.port)) {
+        log('INFO', `Adopted running IDE server on port ${record.port}`);
+        return;
+    }
+    await ensureIdeServerLive(log);
+}
+/**
+ * Local-only `/api/ide` management endpoint driving the lifecycle above:
+ * `POST` starts (body `{ serverPath, port?, defaultFolder? }`), `DELETE` stops,
+ * `GET` reports status. Reached only post-`isRequestAllowed` (key required) and
+ * blocked from the tunnel like `/api/tunnel/*` — it spawns/kills a process.
+ */
+export async function handleIdeApi(req, res, log) {
+    if (req.method === 'GET') {
+        const status = ideServerStatus();
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(status));
+        return;
+    }
+    if (req.method === 'DELETE') {
+        const result = await stopIdeServer(log);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(result));
+        return;
+    }
+    if (req.method === 'POST') {
+        let body;
+        try {
+            body = await parseJsonBody(req);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON body' }));
+            return;
+        }
+        const serverPath = typeof body.serverPath === 'string' ? body.serverPath : '';
+        const port = typeof body.port === 'number' ? body.port : undefined;
+        const defaultFolder = typeof body.defaultFolder === 'string' ? body.defaultFolder : undefined;
+        if (!serverPath) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'serverPath is required' }));
+            return;
+        }
+        try {
+            const record = await spawnIdeServer({ serverPath, port, defaultFolder }, log);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: true, ...record }));
+        }
+        catch (err) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: err.message }));
+        }
+        return;
+    }
+    res.writeHead(405, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Method not allowed' }));
+}
+//# sourceMappingURL=ide-server.js.map

package/dist/agent-farm/servers/ide-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ide-server.js","sourceRoot":"","sources":["../../../src/agent-farm/servers/ide-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAEhB,aAAa,EACb,cAAc,EACd,eAAe,EACf,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAI9B,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,oDAAoD;AACpD,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,EAAE,EAAE,IAAI,IAAI,IAAI,CAAC;AACvC,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,SAAiB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAQD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB,EAAE,GAAU;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,gBAAgB,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,iFAAiF;IACjF,gFAAgF;IAChF,gFAAgF;IAChF,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,MAAM,EAAE,uCAAuC,QAAQ,CAAC,IAAI,oCAAoC,IAAI,EAAE,CAAC,CAAC;QAC5G,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,+EAA+E;IAC/E,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,GAAG,CAAC,MAAM,EAAE,wCAAwC,IAAI,YAAY,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAoB;YAC9B,MAAM,EAAE,kBAAkB;YAC1B,IAAI;YACJ,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG;YACH,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;IACjE,MAAM,SAAS,GAAG,yBAAyB,EAAE,CAAC;IAC9C,wBAAwB,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;QACtB,oBAAoB,EAAE,QAAQ;QAC9B,yBAAyB,EAAE,SAAS;QACpC,+BAA+B;KAChC,CAAC;IACF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC;IAED,GAAG,CAAC,MAAM,EAAE,wBAAwB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE;QACzC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC;QAClC,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,WAAW,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,MAAM,GAAoB;QAC9B,MAAM,EAAE,kBAAkB;QAC1B,IAAI;QACJ,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,GAAG,CAAC,MAAM,EAAE,gCAAgC,IAAI,SAAS,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAU;IAC5C,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,iFAAiF;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;IACnD,IAAI,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;QACtD,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;IAED,eAAe,EAAE,CAAC;IAClB,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,GAAG,CAAC,MAAM,EAAE,8BAA8B,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,eAAe,UAAU,GAAG,CAAC,CAAC;IACnG,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACzD,CAAC;AAQD,6EAA6E;AAC7E,MAAM,UAAU,eAAe;IAC7B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,4EAA4E;AAC5E,IAAI,eAAe,GAAkC,IAAI,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAa,GAAG,EAAE,GAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAEhD,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE;QAC5B,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,EAAE,sBAAsB,MAAM,CAAC,IAAI,6BAA6B,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YAC/F,MAAM,KAAK,GAAG,MAAM,cAAc,CAChC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,EACzF,GAAG,CACJ,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,EAAE,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAU;IACjD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,MAAM,EAAE,sCAAsC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAyB,EACzB,GAAwB,EACxB,GAAU;IAEV,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACxC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;YAC9E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO;IACT,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}