@code-yeongyu/senpi 2026.9.7 → 2026.9.8

package/dist/modes/rpc/host-watchdog.js.map

@@ -1 +1 @@
-{"version":3,"file":"host-watchdog.js","sourceRoot":"","sources":["../../../src/modes/rpc/host-watchdog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,sFAAsF;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAC3D,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AACjE,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAC/D,0CAA0C;AAC1C,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,+FAA+F;AAC/F,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AASrE,SAAS,oBAAoB,CAAC,KAAyB;IACtD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACrC,MAAoD,OAAO,CAAC,GAAG;IAE/D,MAAM,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC5D,IAAI,EAAE,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,UAAU,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9E,OAAO;QACN,EAAE;QACF,IAAI;QACJ,UAAU,EAAE,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QAClF,YAAY;KACZ,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kCAAkC;IACjD,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,wDAAwD;IACxD,OAAO,sBAAsB,CAAC;QAC7B,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,mBAAmB,CAAC;QACpF,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,QAAQ,CAAC,qBAAqB,CAAC;QAC1F,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,QAAQ,CAAC,sBAAsB,CAAC;QAC7F,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,QAAQ,CAAC,wBAAwB,CAAC;KACnG,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC9B,MAAsC,EACtC,gBAAmE;IAEnE,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,MAAc,EAAQ,EAAE;QACrC,MAAM,EAAE,CAAC;QACT,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAClC,yEAAyE;YACzE,6EAA6E;YAC7E,2EAA2E;YAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3E,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACP,KAAK,oBAAoB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3E,CAAC;IACF,CAAC,CAAC;IACF,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,GAAS,EAAE;QACzB,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,IAAI,EAAE,CAAC;IAChD,CAAC,CAAC;IACF,IAAI,MAAM,CAAC,EAAE,KAAK,SAAS;QAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,EAAU,EAAE,IAA8B;IAChE,IAAI,MAA2C,CAAC;IAChD,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;QACzC,IAAI,KAAK;YAAE,OAAO;QAClB,KAAK,GAAG,IAAI,CAAC;QACb,IAAI,CAAC,MAAM,CAAC,CAAC;IACd,CAAC,CAAC;IACF,IAAI,CAAC;QACJ,sEAAsE;QACtE,4EAA4E;QAC5E,MAAM,GAAG,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,QAAQ,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,GAAS,EAAE;QAC1B,IAAI,CAAC,YAAY;YAAE,KAAK,EAAE,CAAC;IAC5B,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,GAAS,EAAE;QAC1B,YAAY,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1B,8EAA8E;IAC9E,0CAA0C;IAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,GAAG,EAAE;QACX,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,aAAqB,EAAE,IAA8B;IACvE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAC9B,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,aAAa,KAAK,OAAO,CAAC,GAAG;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,kBAAkB,aAAa,kBAAkB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;YACvE,OAAO;QACR,CAAC;QACD,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,mBAAmB,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,EAAE,gCAAgC,CAAC;aACzF,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAChB,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO;YACpC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,qBAAqB,EAAE,CAAC;;gBACjD,qBAAqB,GAAG,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO;YACxE,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,qBAAqB,GAAG,CAAC;gBAAE,OAAO;YACxE,IAAI,CAAC,kBAAkB,aAAa,kBAAkB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACxE,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACb,QAAQ,GAAG,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAChC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAChC,IAAI,CAAC;QACJ,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;IAC5E,CAAC;AACF,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAA0B;IAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACJ,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACjF,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACX,CAAC;QACD,OAAO;IACR,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC;YACJ,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACX,CAAC,CAAC,CACF,CAAC;AACH,CAAC","sourcesContent":["/**\n * Opt-in supervisor-lifetime watchdog for the RPC socket host.\n *\n * A host started under the `host-lifecycle.ts` supervisor must not outlive it.\n * Catchable signals cannot carry that guarantee: `kill -9`, an OOM kill, or a\n * crashed supervisor run no JS handler, and the host is then reparented to init\n * as a permanent orphan holding its private socket forever.\n *\n * The binding used here is the OS itself. The supervisor spawns the host with an\n * extra inherited pipe and keeps the write end open without ever writing to it.\n * The kernel closes that end when the supervisor dies for ANY reason, so the\n * host's read end reaches EOF and the host shuts down cleanly.\n *\n * Both variables are unset for every other host launch, so nothing changes for\n * plain `senpi --mode rpc` runs, hosts started by hand, or embedders.\n */\nimport { createReadStream, rmSync } from \"node:fs\";\nimport { rm } from \"node:fs/promises\";\nimport { envValue } from \"../../core/brand.ts\";\nimport { readProcessIdentity } from \"../app-server/daemon/process.ts\";\n\n/** Inherited fd whose EOF means \"the supervisor died\"; set by the supervisor only. */\nexport const HOST_WATCH_FD_ENV = \"SENPI_RPC_HOST_WATCH_FD\";\n/** Supervisor-owned private directory the host removes on watchdog shutdown. */\nexport const HOST_SCRATCH_DIR_ENV = \"SENPI_RPC_HOST_SCRATCH_DIR\";\n/** Fallback binding when no inherited fd is available: poll this pid. */\nexport const HOST_WATCH_PPID_ENV = \"SENPI_RPC_HOST_WATCH_PPID\";\n/** Poll cadence for the ppid fallback. */\nexport const HOST_WATCH_PPID_INTERVAL_MS = 250;\n/** Bound the Windows PowerShell identity probe so one stuck query cannot stop future polls. */\nconst HOST_WATCH_PPID_PROBE_TIMEOUT_MS = 1_000;\nexport const HOST_CLEANUP_PATHS_ENV = \"SENPI_RPC_HOST_CLEANUP_PATHS\";\n\nexport interface HostWatchdogConfig {\n\treadonly fd?: number;\n\treadonly ppid?: number;\n\treadonly scratchDir?: string;\n\treadonly cleanupPaths?: readonly string[];\n}\n\nfunction parsePositiveInteger(value: string | undefined): number | undefined {\n\tif (value === undefined || !/^\\d+$/.test(value.trim())) return undefined;\n\tconst parsed = Number(value.trim());\n\treturn Number.isSafeInteger(parsed) && parsed > 0 ? parsed : undefined;\n}\n\n/**\n * Reads the watchdog configuration from the environment. Returns `undefined`\n * when neither binding is requested, which is the case for every host launch\n * that does not come from the lifecycle supervisor.\n */\nexport function readHostWatchdogConfig(\n\tenv: Readonly<Record<string, string | undefined>> = process.env,\n): HostWatchdogConfig | undefined {\n\tconst fd = parsePositiveInteger(env[HOST_WATCH_FD_ENV]);\n\tconst ppid = parsePositiveInteger(env[HOST_WATCH_PPID_ENV]);\n\tif (fd === undefined && ppid === undefined) return undefined;\n\tconst scratchDir = env[HOST_SCRATCH_DIR_ENV];\n\tconst cleanupPaths = env[HOST_CLEANUP_PATHS_ENV]?.split(\"\\n\").filter(Boolean);\n\treturn {\n\t\tfd,\n\t\tppid,\n\t\tscratchDir: scratchDir === undefined || scratchDir === \"\" ? undefined : scratchDir,\n\t\tcleanupPaths,\n\t};\n}\n\n/** Same configuration, resolved through the brand-aware env prefixes. */\nexport function readHostWatchdogConfigFromBrandEnv(): HostWatchdogConfig | undefined {\n\t// The lifecycle supervisor intentionally uses the canonical SENPI_RPC_HOST_*\n\t// names when spawning a child. envValue() resolves branded aliases for normal\n\t// launches, but must not hide the canonical variables from the supervisor\n\t// handoff or the lifetime binding is silently disabled.\n\treturn readHostWatchdogConfig({\n\t\t[HOST_WATCH_FD_ENV]: process.env[HOST_WATCH_FD_ENV] ?? envValue(\"RPC_HOST_WATCH_FD\"),\n\t\t[HOST_WATCH_PPID_ENV]: process.env[HOST_WATCH_PPID_ENV] ?? envValue(\"RPC_HOST_WATCH_PPID\"),\n\t\t[HOST_SCRATCH_DIR_ENV]: process.env[HOST_SCRATCH_DIR_ENV] ?? envValue(\"RPC_HOST_SCRATCH_DIR\"),\n\t\t[HOST_CLEANUP_PATHS_ENV]: process.env[HOST_CLEANUP_PATHS_ENV] ?? envValue(\"RPC_HOST_CLEANUP_PATHS\"),\n\t});\n}\n\n/**\n * Arms the configured watchdog. `onSupervisorGone` receives the reason and is\n * expected to perform the host's normal clean shutdown; the scratch directory\n * (the supervisor's private socket directory, which no longer has an owner) is\n * removed first so nothing is left behind even if shutdown then hangs.\n *\n * Takes ownership of `config.fd`: disarming (or firing) closes it, so callers\n * must not close it themselves. Returns a disarm function; a no-op when no\n * binding is configured.\n */\nexport function armHostWatchdog(\n\tconfig: HostWatchdogConfig | undefined,\n\tonSupervisorGone: (reason: string, cleanup?: Promise<void>) => void,\n): () => void {\n\tif (!config) return () => {};\n\tconst fire = (reason: string): void => {\n\t\tdisarm();\n\t\tif (process.platform === \"win32\") {\n\t\t\t// Arm the host shutdown fallback before attempting metadata cleanup. The\n\t\t\t// synchronous Win32 removal below handles the state files deterministically,\n\t\t\t// while the fallback still covers a named-pipe close that never completes.\n\t\t\tconst cleanup = Promise.resolve().then(() => cleanupWatchdogPaths(config));\n\t\t\tonSupervisorGone(reason, cleanup);\n\t\t} else {\n\t\t\tvoid cleanupWatchdogPaths(config).finally(() => onSupervisorGone(reason));\n\t\t}\n\t};\n\tconst disarmers: Array<() => void> = [];\n\tconst disarm = (): void => {\n\t\tfor (const stop of disarmers.splice(0)) stop();\n\t};\n\tif (config.fd !== undefined) disarmers.push(watchFdForEof(config.fd, fire));\n\tif (config.ppid !== undefined) disarmers.push(watchPpid(config.ppid, fire));\n\treturn disarm;\n}\n\n/**\n * EOF on the inherited pipe is the primary signal. The supervisor never writes\n * to it, so any readable data is ignored; only close matters. An fd that cannot\n * be opened (never inherited) leaves the binding inert rather than killing a\n * healthy host.\n */\nfunction watchFdForEof(fd: number, fire: (reason: string) => void): () => void {\n\tlet stream: ReturnType<typeof createReadStream>;\n\tlet streamFailed = false;\n\tlet fired = false;\n\tconst fireOnce = (reason: string): void => {\n\t\tif (fired) return;\n\t\tfired = true;\n\t\tfire(reason);\n\t};\n\ttry {\n\t\t// The watchdog owns this inherited read end. autoClose is required on\n\t\t// Win32 so the stream releases fd 3 and observes the pipe's terminal close.\n\t\tstream = createReadStream(\"\", { fd, autoClose: true });\n\t} catch {\n\t\treturn () => {};\n\t}\n\tstream.resume();\n\tconst onEnd = (): void => fireOnce(`supervisor pipe fd ${fd} closed`);\n\tconst onClose = (): void => {\n\t\tif (!streamFailed) onEnd();\n\t};\n\tconst onError = (): void => {\n\t\tstreamFailed = true;\n\t};\n\tstream.once(\"end\", onEnd);\n\t// Win32 pipe teardown may report close without end; POSIX invalid-fd close is\n\t// not supervisor death and remains inert.\n\tif (process.platform === \"win32\") stream.once(\"close\", onClose);\n\tstream.once(\"error\", onError);\n\treturn () => {\n\t\tstream.off(\"end\", onEnd);\n\t\tstream.off(\"close\", onClose);\n\t\tstream.off(\"error\", onError);\n\t\tstream.destroy();\n\t};\n}\n\n/**\n * Fallback binding: the supervisor pid is gone, or this process was reparented\n * to init because the supervisor died. Polling covers the case where no extra\n * fd could be inherited.\n */\nfunction watchPpid(supervisorPid: number, fire: (reason: string) => void): () => void {\n\tlet checking = false;\n\tlet missingIdentityChecks = 0;\n\t// Tests and embedders may bind the watchdog to this process itself; that\n\t// is a valid live binding rather than evidence of supervisor loss.\n\tif (supervisorPid === process.pid) return () => {};\n\tconst timer = setInterval(() => {\n\t\tif (!processAlive(supervisorPid)) {\n\t\t\tfire(`supervisor pid ${supervisorPid} is gone (ppid=${process.ppid})`);\n\t\t\treturn;\n\t\t}\n\t\tif (checking) return;\n\t\tchecking = true;\n\t\tvoid readProcessIdentity(supervisorPid, process.platform, HOST_WATCH_PPID_PROBE_TIMEOUT_MS)\n\t\t\t.then((result) => {\n\t\t\t\tif (result.kind === \"error\") return;\n\t\t\t\tif (result.kind === \"absent\") missingIdentityChecks++;\n\t\t\t\telse missingIdentityChecks = 0;\n\t\t\t\tif (process.ppid === supervisorPid && result.kind === \"present\") return;\n\t\t\t\tif (process.ppid === supervisorPid && missingIdentityChecks < 3) return;\n\t\t\t\tfire(`supervisor pid ${supervisorPid} is gone (ppid=${process.ppid})`);\n\t\t\t})\n\t\t\t.finally(() => {\n\t\t\t\tchecking = false;\n\t\t\t});\n\t}, HOST_WATCH_PPID_INTERVAL_MS);\n\ttimer.unref?.();\n\treturn () => clearInterval(timer);\n}\n\nfunction processAlive(pid: number): boolean {\n\ttry {\n\t\tprocess.kill(pid, 0);\n\t\treturn true;\n\t} catch (cause) {\n\t\treturn cause instanceof Error && \"code\" in cause && cause.code !== \"ESRCH\";\n\t}\n}\n\nasync function cleanupWatchdogPaths(config: HostWatchdogConfig): Promise<void> {\n\tconst paths = [...(config.cleanupPaths ?? []), ...(config.scratchDir ? [config.scratchDir] : [])];\n\tif (process.platform === \"win32\") {\n\t\tfor (const path of paths) {\n\t\t\ttry {\n\t\t\t\trmSync(path, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });\n\t\t\t} catch {}\n\t\t}\n\t\treturn;\n\t}\n\tawait Promise.all(\n\t\tpaths.map(async (path) => {\n\t\t\ttry {\n\t\t\t\tawait rm(path, { recursive: true, force: true });\n\t\t\t} catch {}\n\t\t}),\n\t);\n}\n"]}
+{"version":3,"file":"host-watchdog.js","sourceRoot":"","sources":["../../../src/modes/rpc/host-watchdog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,sFAAsF;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAC3D,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AACjE,sFAAsF;AACtF,MAAM,CAAC,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AACrE,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAC/D,0CAA0C;AAC1C,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,+FAA+F;AAC/F,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AAkBrE,SAAS,oBAAoB,CAAC,KAAyB;IACtD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACrC,MAAoD,OAAO,CAAC,GAAG;IAE/D,MAAM,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC5D,IAAI,EAAE,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,UAAU,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACjD,OAAO;QACN,EAAE;QACF,IAAI;QACJ,UAAU,EAAE,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QAClF,YAAY;QACZ,YAAY,EAAE,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY;KAC5D,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kCAAkC;IACjD,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,wDAAwD;IACxD,OAAO,sBAAsB,CAAC;QAC7B,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,mBAAmB,CAAC;QACpF,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,QAAQ,CAAC,qBAAqB,CAAC;QAC1F,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,QAAQ,CAAC,sBAAsB,CAAC;QAC7F,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,QAAQ,CAAC,wBAAwB,CAAC;QACnG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,QAAQ,CAAC,wBAAwB,CAAC;KACnG,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC9B,MAAsC,EACtC,gBAAmE;IAEnE,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,MAAc,EAAQ,EAAE;QACrC,MAAM,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAClC,yEAAyE;YACzE,6EAA6E;YAC7E,2EAA2E;YAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAClE,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACP,KAAK,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAChG,CAAC;IACF,CAAC,CAAC;IACF,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,GAAS,EAAE;QACzB,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,IAAI,EAAE,CAAC;IAChD,CAAC,CAAC;IACF,IAAI,MAAM,CAAC,EAAE,KAAK,SAAS;QAAE,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,EAAU,EAAE,IAA8B;IAChE,IAAI,MAA2C,CAAC;IAChD,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;QACzC,IAAI,KAAK;YAAE,OAAO;QAClB,KAAK,GAAG,IAAI,CAAC;QACb,IAAI,CAAC,MAAM,CAAC,CAAC;IACd,CAAC,CAAC;IACF,IAAI,CAAC;QACJ,sEAAsE;QACtE,4EAA4E;QAC5E,MAAM,GAAG,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,QAAQ,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,GAAS,EAAE;QAC1B,IAAI,CAAC,YAAY;YAAE,KAAK,EAAE,CAAC;IAC5B,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,GAAS,EAAE;QAC1B,YAAY,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1B,8EAA8E;IAC9E,0CAA0C;IAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,GAAG,EAAE;QACX,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,aAAqB,EAAE,IAA8B;IACvE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAC9B,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,aAAa,KAAK,OAAO,CAAC,GAAG;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,kBAAkB,aAAa,kBAAkB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;YACvE,OAAO;QACR,CAAC;QACD,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,mBAAmB,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,EAAE,gCAAgC,CAAC;aACzF,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAChB,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO;YACpC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,qBAAqB,EAAE,CAAC;;gBACjD,qBAAqB,GAAG,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO;YACxE,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,qBAAqB,GAAG,CAAC;gBAAE,OAAO;YACxE,IAAI,CAAC,kBAAkB,aAAa,kBAAkB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACxE,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACb,QAAQ,GAAG,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAChC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAChC,IAAI,CAAC;QACJ,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;IAC5E,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,SAAS,oBAAoB,CAAC,MAA0B;IACvD,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACjE,OAAO,OAAO,CAAC,OAAO,EAAE;SACtB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;SAC1B,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAA0B;IAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACJ,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACjF,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACX,CAAC;QACD,OAAO;IACR,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC;YACJ,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACX,CAAC,CAAC,CACF,CAAC;AACH,CAAC","sourcesContent":["/**\n * Opt-in supervisor-lifetime watchdog for the RPC socket host.\n *\n * A host started under the `host-lifecycle.ts` supervisor must not outlive it.\n * Catchable signals cannot carry that guarantee: `kill -9`, an OOM kill, or a\n * crashed supervisor run no JS handler, and the host is then reparented to init\n * as a permanent orphan holding its private socket forever.\n *\n * The binding used here is the OS itself. The supervisor spawns the host with an\n * extra inherited pipe and keeps the write end open without ever writing to it.\n * The kernel closes that end when the supervisor dies for ANY reason, so the\n * host's read end reaches EOF and the host shuts down cleanly.\n *\n * Both variables are unset for every other host launch, so nothing changes for\n * plain `senpi --mode rpc` runs, hosts started by hand, or embedders.\n */\nimport { createReadStream, rmSync } from \"node:fs\";\nimport { rm } from \"node:fs/promises\";\nimport { envValue } from \"../../core/brand.ts\";\nimport { readProcessIdentity } from \"../app-server/daemon/process.ts\";\n\n/** Inherited fd whose EOF means \"the supervisor died\"; set by the supervisor only. */\nexport const HOST_WATCH_FD_ENV = \"SENPI_RPC_HOST_WATCH_FD\";\n/** Supervisor-owned private directory the host removes on watchdog shutdown. */\nexport const HOST_SCRATCH_DIR_ENV = \"SENPI_RPC_HOST_SCRATCH_DIR\";\n/** Public socket path the supervisor bound; the host removes it ownership-checked. */\nexport const HOST_PUBLIC_SOCKET_ENV = \"SENPI_RPC_HOST_PUBLIC_SOCKET\";\n/** Fallback binding when no inherited fd is available: poll this pid. */\nexport const HOST_WATCH_PPID_ENV = \"SENPI_RPC_HOST_WATCH_PPID\";\n/** Poll cadence for the ppid fallback. */\nexport const HOST_WATCH_PPID_INTERVAL_MS = 250;\n/** Bound the Windows PowerShell identity probe so one stuck query cannot stop future polls. */\nconst HOST_WATCH_PPID_PROBE_TIMEOUT_MS = 1_000;\nexport const HOST_CLEANUP_PATHS_ENV = \"SENPI_RPC_HOST_CLEANUP_PATHS\";\n\nexport interface HostWatchdogConfig {\n\treadonly fd?: number;\n\treadonly ppid?: number;\n\treadonly scratchDir?: string;\n\treadonly cleanupPaths?: readonly string[];\n\treadonly publicSocket?: string;\n\t/**\n\t * Runs when the watchdog fires, BEFORE `scratchDir` and `cleanupPaths` are removed. The\n\t * host uses it to read state that lives inside the supervisor's private directory and\n\t * that its shutdown still needs - the public-socket ownership token above all. A\n\t * supervisor killed while the host is still starting up leaves that token unread, and\n\t * removing the directory first would turn the public socket into an unprovable orphan.\n\t */\n\treadonly beforeCleanup?: () => Promise<void>;\n}\n\nfunction parsePositiveInteger(value: string | undefined): number | undefined {\n\tif (value === undefined || !/^\\d+$/.test(value.trim())) return undefined;\n\tconst parsed = Number(value.trim());\n\treturn Number.isSafeInteger(parsed) && parsed > 0 ? parsed : undefined;\n}\n\n/**\n * Reads the watchdog configuration from the environment. Returns `undefined`\n * when neither binding is requested, which is the case for every host launch\n * that does not come from the lifecycle supervisor.\n */\nexport function readHostWatchdogConfig(\n\tenv: Readonly<Record<string, string | undefined>> = process.env,\n): HostWatchdogConfig | undefined {\n\tconst fd = parsePositiveInteger(env[HOST_WATCH_FD_ENV]);\n\tconst ppid = parsePositiveInteger(env[HOST_WATCH_PPID_ENV]);\n\tif (fd === undefined && ppid === undefined) return undefined;\n\tconst scratchDir = env[HOST_SCRATCH_DIR_ENV];\n\tconst cleanupPaths = env[HOST_CLEANUP_PATHS_ENV]?.split(\"\\n\").filter(Boolean);\n\tconst publicSocket = env[HOST_PUBLIC_SOCKET_ENV];\n\treturn {\n\t\tfd,\n\t\tppid,\n\t\tscratchDir: scratchDir === undefined || scratchDir === \"\" ? undefined : scratchDir,\n\t\tcleanupPaths,\n\t\tpublicSocket: publicSocket === \"\" ? undefined : publicSocket,\n\t};\n}\n\n/** Same configuration, resolved through the brand-aware env prefixes. */\nexport function readHostWatchdogConfigFromBrandEnv(): HostWatchdogConfig | undefined {\n\t// The lifecycle supervisor intentionally uses the canonical SENPI_RPC_HOST_*\n\t// names when spawning a child. envValue() resolves branded aliases for normal\n\t// launches, but must not hide the canonical variables from the supervisor\n\t// handoff or the lifetime binding is silently disabled.\n\treturn readHostWatchdogConfig({\n\t\t[HOST_WATCH_FD_ENV]: process.env[HOST_WATCH_FD_ENV] ?? envValue(\"RPC_HOST_WATCH_FD\"),\n\t\t[HOST_WATCH_PPID_ENV]: process.env[HOST_WATCH_PPID_ENV] ?? envValue(\"RPC_HOST_WATCH_PPID\"),\n\t\t[HOST_SCRATCH_DIR_ENV]: process.env[HOST_SCRATCH_DIR_ENV] ?? envValue(\"RPC_HOST_SCRATCH_DIR\"),\n\t\t[HOST_PUBLIC_SOCKET_ENV]: process.env[HOST_PUBLIC_SOCKET_ENV] ?? envValue(\"RPC_HOST_PUBLIC_SOCKET\"),\n\t\t[HOST_CLEANUP_PATHS_ENV]: process.env[HOST_CLEANUP_PATHS_ENV] ?? envValue(\"RPC_HOST_CLEANUP_PATHS\"),\n\t});\n}\n\n/**\n * Arms the configured watchdog. `onSupervisorGone` receives the reason and is\n * expected to perform the host's normal clean shutdown; the scratch directory\n * (the supervisor's private socket directory, which no longer has an owner) is\n * removed first so nothing is left behind even if shutdown then hangs.\n *\n * Takes ownership of `config.fd`: disarming (or firing) closes it, so callers\n * must not close it themselves. Returns a disarm function; a no-op when no\n * binding is configured.\n */\nexport function armHostWatchdog(\n\tconfig: HostWatchdogConfig | undefined,\n\tonSupervisorGone: (reason: string, cleanup?: Promise<void>) => void,\n): () => void {\n\tif (!config) return () => {};\n\tconst fire = (reason: string): void => {\n\t\tdisarm();\n\t\tconst captured = captureBeforeCleanup(config);\n\t\tif (process.platform === \"win32\") {\n\t\t\t// Arm the host shutdown fallback before attempting metadata cleanup. The\n\t\t\t// synchronous Win32 removal below handles the state files deterministically,\n\t\t\t// while the fallback still covers a named-pipe close that never completes.\n\t\t\tconst cleanup = captured.then(() => cleanupWatchdogPaths(config));\n\t\t\tonSupervisorGone(reason, cleanup);\n\t\t} else {\n\t\t\tvoid captured.then(() => cleanupWatchdogPaths(config)).finally(() => onSupervisorGone(reason));\n\t\t}\n\t};\n\tconst disarmers: Array<() => void> = [];\n\tconst disarm = (): void => {\n\t\tfor (const stop of disarmers.splice(0)) stop();\n\t};\n\tif (config.fd !== undefined) disarmers.push(watchFdForEof(config.fd, fire));\n\tif (config.ppid !== undefined) disarmers.push(watchPpid(config.ppid, fire));\n\treturn disarm;\n}\n\n/**\n * EOF on the inherited pipe is the primary signal. The supervisor never writes\n * to it, so any readable data is ignored; only close matters. An fd that cannot\n * be opened (never inherited) leaves the binding inert rather than killing a\n * healthy host.\n */\nfunction watchFdForEof(fd: number, fire: (reason: string) => void): () => void {\n\tlet stream: ReturnType<typeof createReadStream>;\n\tlet streamFailed = false;\n\tlet fired = false;\n\tconst fireOnce = (reason: string): void => {\n\t\tif (fired) return;\n\t\tfired = true;\n\t\tfire(reason);\n\t};\n\ttry {\n\t\t// The watchdog owns this inherited read end. autoClose is required on\n\t\t// Win32 so the stream releases fd 3 and observes the pipe's terminal close.\n\t\tstream = createReadStream(\"\", { fd, autoClose: true });\n\t} catch {\n\t\treturn () => {};\n\t}\n\tstream.resume();\n\tconst onEnd = (): void => fireOnce(`supervisor pipe fd ${fd} closed`);\n\tconst onClose = (): void => {\n\t\tif (!streamFailed) onEnd();\n\t};\n\tconst onError = (): void => {\n\t\tstreamFailed = true;\n\t};\n\tstream.once(\"end\", onEnd);\n\t// Win32 pipe teardown may report close without end; POSIX invalid-fd close is\n\t// not supervisor death and remains inert.\n\tif (process.platform === \"win32\") stream.once(\"close\", onClose);\n\tstream.once(\"error\", onError);\n\treturn () => {\n\t\tstream.off(\"end\", onEnd);\n\t\tstream.off(\"close\", onClose);\n\t\tstream.off(\"error\", onError);\n\t\tstream.destroy();\n\t};\n}\n\n/**\n * Fallback binding: the supervisor pid is gone, or this process was reparented\n * to init because the supervisor died. Polling covers the case where no extra\n * fd could be inherited.\n */\nfunction watchPpid(supervisorPid: number, fire: (reason: string) => void): () => void {\n\tlet checking = false;\n\tlet missingIdentityChecks = 0;\n\t// Tests and embedders may bind the watchdog to this process itself; that\n\t// is a valid live binding rather than evidence of supervisor loss.\n\tif (supervisorPid === process.pid) return () => {};\n\tconst timer = setInterval(() => {\n\t\tif (!processAlive(supervisorPid)) {\n\t\t\tfire(`supervisor pid ${supervisorPid} is gone (ppid=${process.ppid})`);\n\t\t\treturn;\n\t\t}\n\t\tif (checking) return;\n\t\tchecking = true;\n\t\tvoid readProcessIdentity(supervisorPid, process.platform, HOST_WATCH_PPID_PROBE_TIMEOUT_MS)\n\t\t\t.then((result) => {\n\t\t\t\tif (result.kind === \"error\") return;\n\t\t\t\tif (result.kind === \"absent\") missingIdentityChecks++;\n\t\t\t\telse missingIdentityChecks = 0;\n\t\t\t\tif (process.ppid === supervisorPid && result.kind === \"present\") return;\n\t\t\t\tif (process.ppid === supervisorPid && missingIdentityChecks < 3) return;\n\t\t\t\tfire(`supervisor pid ${supervisorPid} is gone (ppid=${process.ppid})`);\n\t\t\t})\n\t\t\t.finally(() => {\n\t\t\t\tchecking = false;\n\t\t\t});\n\t}, HOST_WATCH_PPID_INTERVAL_MS);\n\ttimer.unref?.();\n\treturn () => clearInterval(timer);\n}\n\nfunction processAlive(pid: number): boolean {\n\ttry {\n\t\tprocess.kill(pid, 0);\n\t\treturn true;\n\t} catch (cause) {\n\t\treturn cause instanceof Error && \"code\" in cause && cause.code !== \"ESRCH\";\n\t}\n}\n\n// A failing capture must never block the cleanup or the shutdown it precedes.\nfunction captureBeforeCleanup(config: HostWatchdogConfig): Promise<void> {\n\tif (config.beforeCleanup === undefined) return Promise.resolve();\n\treturn Promise.resolve()\n\t\t.then(config.beforeCleanup)\n\t\t.catch(() => undefined);\n}\n\nasync function cleanupWatchdogPaths(config: HostWatchdogConfig): Promise<void> {\n\tconst paths = [...(config.cleanupPaths ?? []), ...(config.scratchDir ? [config.scratchDir] : [])];\n\tif (process.platform === \"win32\") {\n\t\tfor (const path of paths) {\n\t\t\ttry {\n\t\t\t\trmSync(path, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });\n\t\t\t} catch {}\n\t\t}\n\t\treturn;\n\t}\n\tawait Promise.all(\n\t\tpaths.map(async (path) => {\n\t\t\ttry {\n\t\t\t\tawait rm(path, { recursive: true, force: true });\n\t\t\t} catch {}\n\t\t}),\n\t);\n}\n"]}

package/dist/modes/rpc/multi-session-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"multi-session-host.d.ts","sourceRoot":"","sources":["../../../src/modes/rpc/multi-session-host.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AAgB5F,OAAO,EAAE,KAAK,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAU/D,MAAM,WAAW,uBAAuB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,gCAAgC,CAAC;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAClC;AAED,kFAAkF;AAClF,eAAO,MAAM,gCAAgC,uCAAuC,CAAC;AACrF,4EAA4E;AAC5E,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AACzE,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AACjE,sGAAsG;AACtG,eAAO,MAAM,gCAAgC,QAAc,CAAC;AAC5D,0GAA0G;AAC1G,eAAO,MAAM,0BAA0B,QAAc,CAAC;AAItD,kGAAkG;AAClG,MAAM,WAAW,iBAAiB;IACjC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;IACzB,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACpC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACjD,SAAS,GAAE,iBAAsB,GAC/B;IAAE,GAAG,EAAE,MAAM,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAUpE;AASD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,CAG1F;AAED,wBAAgB,cAAc,CAC7B,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,kBAAkB,EAC1B,YAAY,WAA+D,EAC3E,IAAI,GAAE,iBAAsB;;mBAsBA,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;EAiBlD"}
+{"version":3,"file":"multi-session-host.d.ts","sourceRoot":"","sources":["../../../src/modes/rpc/multi-session-host.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AAgB5F,OAAO,EAAE,KAAK,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAmB/D,MAAM,WAAW,uBAAuB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,gCAAgC,CAAC;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAClC;AAED,kFAAkF;AAClF,eAAO,MAAM,gCAAgC,uCAAuC,CAAC;AACrF,4EAA4E;AAC5E,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AACzE,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AACjE,sGAAsG;AACtG,eAAO,MAAM,gCAAgC,QAAc,CAAC;AAC5D,0GAA0G;AAC1G,eAAO,MAAM,0BAA0B,QAAc,CAAC;AAItD,kGAAkG;AAClG,MAAM,WAAW,iBAAiB;IACjC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;IACzB,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACpC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACjD,SAAS,GAAE,iBAAsB,GAC/B;IAAE,GAAG,EAAE,MAAM,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAUpE;AASD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,CAG1F;AAED,wBAAgB,cAAc,CAC7B,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,kBAAkB,EAC1B,YAAY,WAA+D,EAC3E,IAAI,GAAE,iBAAsB;;mBAsBA,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;EAiBlD"}

package/dist/modes/rpc/multi-session-host.js

@@ -12,6 +12,7 @@ import { rpcCommandShapeError } from "./rpc-input-validation.js";
 import { SessionCommandRouter } from "./session-command-router.js";
 import { SessionEventWriter } from "./session-event-writer.js";
 import { RpcSessionRegistry } from "./session-registry.js";
+import { PUBLIC_SOCKET_IDENTITY_FILE, readSocketIdentityFile, shieldSocketDuringClose, statSocketIdentity, unlinkOwnedSocket, waitForSocketIdentityFile, } from "./socket-ownership.js";
 import { authenticateSocket, ensureSocketSecret, resolveSocketTransportAddress, SOCKET_SECRET_FILE_ENV, socketSecretPath, } from "./socket-transport.js";
 /** Environment override for the idle-session eviction window, in milliseconds. */
 export const RPC_SESSION_IDLE_EVICTION_MS_ENV = "SENPI_RPC_SESSION_IDLE_EVICTION_MS";
@@ -131,6 +132,20 @@ async function runSocketHost(options, socketPath) {
     const secret = process.platform === "win32"
         ? await ensureSocketSecret(process.env[SOCKET_SECRET_FILE_ENV] ?? socketSecretPath(socketPath))
         : undefined;
+    const watchdogConfig = readHostWatchdogConfigFromBrandEnv();
+    // Crash-path ownership for the supervisor's PUBLIC socket: the supervisor
+    // records the identity of the entry it bound (inside its private scratch
+    // directory, which no replacement supervisor writes) right after its listen,
+    // and this host removes that path only while the identity still matches. A
+    // blind path removal here would unlink a newer host's freshly published
+    // entry after a takeover - the startup path already refuses to touch a
+    // socket owned by a live server; teardown follows the same rule.
+    const supervisorPublicSocketPath = process.platform === "win32" || socketPath.startsWith("\0") ? undefined : watchdogConfig?.publicSocket;
+    const supervisorPublicOwnerFile = supervisorPublicSocketPath && watchdogConfig?.scratchDir
+        ? join(watchdogConfig.scratchDir, PUBLIC_SOCKET_IDENTITY_FILE)
+        : undefined;
+    let boundIdentity;
+    let supervisorPublicIdentity;
     const server = createServer((socket) => {
         const accept = () => {
             const id = `socket-${++nextConnection}`;
@@ -194,12 +209,21 @@ async function runSocketHost(options, socketPath) {
                 connection.detach();
                 connection.close();
             }
-            await (process.platform === "win32"
+            // libuv unlinks the bound NAME when the listening handle closes - which
+            // would delete a newer host's entry renamed over this path. Shield the
+            // current entry for the close, then let the ownership check decide.
+            await shieldSocketDuringClose(socketPath, () => process.platform === "win32"
                 ? Promise.race([closeServer(server), delay(WINDOWS_SHUTDOWN_HARD_EXIT_MS)])
                 : closeServer(server));
             await router.dispose();
             await writer.flush();
-            await removeSocketPath(socketPath);
+            // Ownership-checked: unlink only the entry THIS process bound. After a
+            // takeover renamed a newer host's socket over the same path, the
+            // identity no longer matches and the replacement stays published.
+            await unlinkOwnedSocket(socketPath, boundIdentity, hostLog);
+            if (supervisorPublicSocketPath) {
+                await unlinkOwnedSocket(supervisorPublicSocketPath, supervisorPublicIdentity, hostLog);
+            }
             if (watchdogCleanup)
                 await watchdogCleanup;
         }
@@ -213,7 +237,19 @@ async function runSocketHost(options, socketPath) {
     registerShutdownSignals(shutdown);
     // Arm before listen: a supervisor death during the listen transition must
     // still close the child and clean its private endpoint.
-    armHostWatchdog(readHostWatchdogConfigFromBrandEnv(), (reason, cleanup) => {
+    const watchdog = watchdogConfig && supervisorPublicOwnerFile
+        ? {
+            ...watchdogConfig,
+            // The supervisor may die while this host is still waiting for the token
+            // below; read it before the watchdog removes the scratch directory, or the
+            // shutdown's ownership check has nothing to prove with and leaves the
+            // public socket behind.
+            beforeCleanup: async () => {
+                supervisorPublicIdentity ??= await readSocketIdentityFile(supervisorPublicOwnerFile);
+            },
+        }
+        : watchdogConfig;
+    armHostWatchdog(watchdog, (reason, cleanup) => {
         process.stderr.write(`senpi rpc host: ${reason}; shutting down\n`);
         // Enter shutdown before killing session-owned child processes. The Windows
         // tree killer is synchronous, while the shutdown fallback must be armed
@@ -221,7 +257,13 @@ async function runSocketHost(options, socketPath) {
         void shutdown(0, cleanup);
         setImmediate(killTrackedDetachedChildren);
     });
-    await listen(server, socketPath, secret);
+    boundIdentity = await listen(server, socketPath, secret);
+    if (supervisorPublicOwnerFile) {
+        // The supervisor publishes its public-socket token after this internal
+        // listener is ready, so a short bounded wait keeps the lifecycles in step
+        // without delaying unsupervised hosts.
+        supervisorPublicIdentity = await waitForSocketIdentityFile(supervisorPublicOwnerFile);
+    }
     process.stderr.write(`senpi rpc listening on ${formatSocketAddress(socketPath)}\n`);
     // Opt-in only: set by the lifecycle supervisor so this host can never outlive
     // it, including when the supervisor is SIGKILLed and runs no handler at all.
@@ -315,9 +357,13 @@ function listen(server, socketPath, secret) {
         server.listen(resolveSocketTransportAddress(socketPath, process.platform, secret), async () => {
             server.off("error", reject);
             try {
-                if (process.platform !== "win32" && !socketPath.startsWith("\0"))
+                if (process.platform !== "win32" && !socketPath.startsWith("\0")) {
                     await chmod(socketPath, 0o600);
-                resolve();
+                    // Record which filesystem entry THIS listener created; shutdown
+                    // removes the path only while this identity still matches.
+                    return resolve(await statSocketIdentity(socketPath));
+                }
+                resolve(undefined);
             }
             catch (cause) {
                 reject(cause);
@@ -330,16 +376,8 @@ function closeServer(server) {
         server.close((cause) => (cause ? reject(cause) : resolve()));
     });
 }
-async function removeSocketPath(socketPath) {
-    if (process.platform === "win32" || socketPath.startsWith("\0"))
-        return;
-    try {
-        await unlink(socketPath);
-    }
-    catch (cause) {
-        if (!isNodeErrorCode(cause, "ENOENT"))
-            throw cause;
-    }
+function hostLog(message) {
+    process.stderr.write(`senpi rpc host: ${message}\n`);
 }
 function isNodeErrorCode(cause, code) {
     return cause instanceof Error && "code" in cause && cause.code === code;

package/dist/modes/rpc/multi-session-host.js.map

@@ -1 +1 @@
-{"version":3,"file":"multi-session-host.js","sourceRoot":"","sources":["../../../src/modes/rpc/multi-session-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAA4B,MAAM,UAAU,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EACN,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,cAAc,GACd,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAEnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAA0B,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,EAC7B,sBAAsB,EACtB,gBAAgB,GAChB,MAAM,uBAAuB,CAAC;AAc/B,kFAAkF;AAClF,MAAM,CAAC,MAAM,gCAAgC,GAAG,oCAAoC,CAAC;AACrF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAG,8BAA8B,CAAC;AACzE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AACjE,sGAAsG;AACtG,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,MAAM,CAAC;AAC5D,0GAA0G;AAC1G,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,MAAM,CAAC;AACtD,oGAAoG;AACpG,MAAM,6BAA6B,GAAG,KAAK,CAAC;AAc5C;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACpC,GAAiD,EACjD,YAA+B,EAAE;IAEjC,OAAO;QACN,GAAG,EAAE,SAAS,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;QAC9B,cAAc,EACb,SAAS,CAAC,cAAc;YACxB,eAAe,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YACtD,gCAAgC;QACjC,WAAW,EACV,SAAS,CAAC,WAAW,IAAI,eAAe,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,IAAI,0BAA0B;KACxG,CAAC;AACH,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAgC;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAChG,OAAO,aAAa,CAAC,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,cAAc,CAC7B,OAAgC,EAChC,MAA0B,EAC1B,YAAY,GAAG,uBAAuB,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,EAC3E,OAA0B,EAAE;IAE5B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,oBAAoB,CACtC,IAAI,kBAAkB,CAAC;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,IAAI,MAAM;KACjG,CAAC,EACF,MAAM,EACN,OAAO,EACP,OAAO,CAAC,aAAa,EACrB,EAAE,YAAY,EAAE,EAChB;QACC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACvC,CACD,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QACpD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,4BAA4B,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3F,OAAO;QACR,CAAC;QACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,UAAU,EAAE,CAAC;YAChB,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;YACpD,OAAO;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAoB,CAAC,CAAC;QAC3D,IAAI,QAAQ;YAAE,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,oEAAoE;AACpE,KAAK,UAAU,YAAY,CAAC,OAAgC;IAC3D,cAAc,EAAE,CAAC;IACjB,MAAM,IAAI,GAAsB,EAAE,QAAQ,EAAE,cAAc,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,CAAC;IAChH,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC/E,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE;QACrE,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,GAAG,CAAC,EAAkB,EAAE;QACvD,IAAI,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,EAAE,CAAC;QACT,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,cAAc,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC;IACpC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE;QACtF,aAAa,EAAE,uBAAuB;QACtC,eAAe,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;KACnF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,GAAG,EAAE;QACnB,YAAY,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC;IACF,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAgC,EAAE,UAAkB;IAChF,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;IAClD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CACxC,OAAO,EACP,MAAM,EACN,uBAAuB,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAClE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,qBAAqB,CACpD;IACD,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CACvF,CAAC;IACF,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,MAAM,GACX,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC3B,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC/F,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,GAAS,EAAE;YACzB,MAAM,EAAE,GAAG,UAAU,EAAE,cAAc,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAChC,MAAM,CAAC,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACpC,MAAM,YAAY,GAAG,qBAAqB,CACzC,MAAM,EACN,CAAC,IAAI,EAAE,EAAE;gBACR,qEAAqE;gBACrE,6EAA6E;gBAC7E,KAAK,MAAM;qBACT,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;qBACtC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,YAAY,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrF,CAAC,CAAC,CAAC;YACL,CAAC,EACD;gBACC,aAAa,EAAE,uBAAuB;gBACtC,eAAe,EAAE,GAAG,EAAE;oBACrB,KAAK,MAAM;yBACT,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;yBACjF,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,YAAY,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CACnF,CAAC;gBACJ,CAAC;aACD,CACD,CAAC;YACF,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,MAAM,GAAG,GAAG,EAAE;gBACnB,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,EAAE,CAAC;gBACf,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;gBAChC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvB,gFAAgF;gBAChF,kFAAkF;gBAClF,iFAAiF;gBACjF,6EAA6E;gBAC7E,KAAK,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,oBAAoB,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC7F,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC;YACF,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC;QACF,IAAI,MAAM;YAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;;YAClD,MAAM,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5B,IAAI,CAAC,YAAY;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,GAAG,CAAC,EAAE,eAA+B,EAAkB,EAAE;QACxF,IAAI,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,YAAY,GAAG,IAAI,CAAC;QACpB,yEAAyE;QACzE,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,CAAC;YACJ,KAAK,MAAM,UAAU,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/C,UAAU,CAAC,MAAM,EAAE,CAAC;gBACpB,UAAU,CAAC,KAAK,EAAE,CAAC;YACpB,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAClC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;gBAC3E,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YACxB,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACnC,IAAI,eAAe;gBAAE,MAAM,eAAe,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACV,wEAAwE;YACxE,wEAAwE;YACxE,2DAA2D;YAC3D,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;IACF,CAAC,CAAC;IACF,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAClC,0EAA0E;IAC1E,wDAAwD;IACxD,eAAe,CAAC,kCAAkC,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,MAAM,mBAAmB,CAAC,CAAC;QACnE,2EAA2E;QAC3E,wEAAwE;QACxE,oDAAoD;QACpD,KAAK,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1B,YAAY,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,mBAAmB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAEpF,8EAA8E;IAC9E,6EAA6E;IAC7E,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAChC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB;IAC1B,OAAO,0BAA0B,uBAAuB,cAAc,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,QAAgB;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC9C,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,UAAU,EAAE,CAAC;AAChG,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IACjC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,OAAO;QACN,QAAQ,CAAC,KAAK;YACb,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,UAAU,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK;YACJ,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC;QACD,mBAAmB;YAClB,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,UAAU;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YAC9D,UAAU,GAAG,KAAK,CAAC;YACnB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACpC,MAAM,IAAI,GAAG,GAAG,EAAE;oBACjB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC1B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC1B,OAAO,EAAE,CAAC;gBACX,CAAC,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACJ,CAAC;KACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IACxE,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO;QAC7C,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,MAAM,WAAW,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,4CAA4C,CAAC,CAAC;IAC9G,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB;IACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,6BAA6B,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,CAAC,IAAa,EAAE,EAAE;YAChC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,UAAkB,EAAE,MAAmB;IACtE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE;YAC7F,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACJ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;oBAAE,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBACjG,OAAO,EAAE,CAAC;YACX,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;QACF,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IACxE,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC;IACpD,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY;IACpD,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACzE,CAAC;AAED,SAAS,uBAAuB,CAAC,QAA+C;IAC/E,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAE,CAAC,SAAS,CAAW,CAAC,CAAC,CAAE,CAAC,SAAS,EAAE,QAAQ,CAAW,EAAE,CAAC;QAC/G,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACvB,2BAA2B,EAAE,CAAC;YAC9B,KAAK,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACJ,CAAC;AACF,CAAC","sourcesContent":["import { access, chmod, mkdir, unlink } from \"node:fs/promises\";\nimport { createConnection, createServer, type Server, type Socket } from \"node:net\";\nimport { dirname, join } from \"node:path\";\nimport type { CreateAgentSessionRuntimeFactory } from \"../../core/agent-session-runtime.ts\";\nimport { envValue } from \"../../core/brand.ts\";\nimport {\n\tflushRawStdout,\n\ttakeOverStdout,\n\twaitForRawStdoutBackpressure,\n\twriteRawStdout,\n} from \"../../core/output-guard.ts\";\nimport { killTrackedDetachedChildren } from \"../../utils/shell.ts\";\nimport type { RpcConnectionSink } from \"./connection-handler.ts\";\nimport { parseClientCapabilities } from \"./custom-capability.ts\";\nimport { parseIdleExitMs } from \"./host-lifecycle.ts\";\nimport { armHostWatchdog, readHostWatchdogConfigFromBrandEnv } from \"./host-watchdog.ts\";\nimport { attachJsonlLineReader, MAX_RPC_LINE_CHARACTERS } from \"./jsonl.ts\";\nimport { rpcCommandShapeError } from \"./rpc-input-validation.ts\";\nimport type { RpcCommand, RpcResponse } from \"./rpc-types.ts\";\nimport { type RpcBindingFactory, SessionCommandRouter } from \"./session-command-router.ts\";\nimport { SessionEventWriter } from \"./session-event-writer.ts\";\nimport { RpcSessionRegistry } from \"./session-registry.ts\";\nimport {\n\tauthenticateSocket,\n\tensureSocketSecret,\n\tresolveSocketTransportAddress,\n\tSOCKET_SECRET_FILE_ENV,\n\tsocketSecretPath,\n} from \"./socket-transport.ts\";\n\nexport interface MultiSessionHostOptions {\n\tagentDir: string;\n\tcreateRuntime: CreateAgentSessionRuntimeFactory;\n\tcwd: string;\n\tpermissionPreset?: string;\n\tcreationModel?: { provider: string; modelId: string };\n\tinitialThinkingLevel?: string;\n\tlisten?: string;\n\t/** Test seam: defaults to the real shared-session binding. */\n\tcreateBinding?: RpcBindingFactory;\n}\n\n/** Environment override for the idle-session eviction window, in milliseconds. */\nexport const RPC_SESSION_IDLE_EVICTION_MS_ENV = \"SENPI_RPC_SESSION_IDLE_EVICTION_MS\";\n/** Environment override for the empty-host exit window, in milliseconds. */\nexport const RPC_HOST_EMPTY_EXIT_MS_ENV = \"SENPI_RPC_HOST_EMPTY_EXIT_MS\";\n/** Environment override for the graceful close_session teardown window, in milliseconds. */\nexport const RPC_CLOSE_GRACE_MS_ENV = \"SENPI_RPC_CLOSE_GRACE_MS\";\n/** Default idle-eviction window: 30 minutes after a session's last routed command or settled turn. */\nexport const DEFAULT_SESSION_IDLE_EVICTION_MS = 30 * 60_000;\n/** Default empty-host exit: 15 minutes with zero open sessions, matching the supervisor's idle window. */\nexport const DEFAULT_HOST_EMPTY_EXIT_MS = 15 * 60_000;\n/** Win32 named-pipe close can leave libuv's server callback pending after handles are destroyed. */\nconst WINDOWS_SHUTDOWN_HARD_EXIT_MS = 2_000;\n\n/** Explicit occupancy-policy overrides for createHostCore; tests inject clocks and hooks here. */\nexport interface HostIdleOverrides {\n\tnow?: () => number;\n\tidleEvictionMs?: number;\n\temptyExitMs?: number;\n\tcloseGraceMs?: number;\n\t/** Shutdown hook the empty-exit window invokes; hosts pass their exit path. */\n\tonEmptyExit?: () => void;\n\t/** Gate consulted before the empty-exit window advances (connected clients block it). */\n\tcanExitWhenEmpty?: () => boolean;\n}\n\n/**\n * Resolve the host's idle lifecycle policy.\n */\nexport function resolveHostIdlePolicy(\n\tenv: Readonly<Record<string, string | undefined>>,\n\toverrides: HostIdleOverrides = {},\n): { now: () => number; idleEvictionMs: number; emptyExitMs: number } {\n\treturn {\n\t\tnow: overrides.now ?? Date.now,\n\t\tidleEvictionMs:\n\t\t\toverrides.idleEvictionMs ??\n\t\t\tparseIdleExitMs(env[RPC_SESSION_IDLE_EVICTION_MS_ENV]) ??\n\t\t\tDEFAULT_SESSION_IDLE_EVICTION_MS,\n\t\temptyExitMs:\n\t\t\toverrides.emptyExitMs ?? parseIdleExitMs(env[RPC_HOST_EMPTY_EXIT_MS_ENV]) ?? DEFAULT_HOST_EMPTY_EXIT_MS,\n\t};\n}\n\ninterface Connection {\n\treadonly id: string;\n\treadonly sink: RpcConnectionSink;\n\treadonly detach: () => void;\n\treadonly close: () => void;\n}\n\n/**\n * Socket agent events are delivered only to connections attached to their\n * session, tagged with its routing sessionId. Content-free session lifecycle\n * events remain visible to every connection. Responses and extension UI\n * requests remain requester-only; foreign observation uses attach-on-open.\n */\nexport async function runMultiSessionHost(options: MultiSessionHostOptions): Promise<never> {\n\tif (options.listen === undefined || options.listen === \"stdio://\") return runStdioHost(options);\n\treturn runSocketHost(options, resolveSocketPath(options.listen, options.agentDir));\n}\n\nexport function createHostCore(\n\toptions: MultiSessionHostOptions,\n\twriter: SessionEventWriter,\n\tcapabilities = parseClientCapabilities(envValue(\"RPC_CLIENT_CAPABILITIES\")),\n\tidle: HostIdleOverrides = {},\n) {\n\tconst policy = resolveHostIdlePolicy(process.env, idle);\n\tconst router = new SessionCommandRouter(\n\t\tnew RpcSessionRegistry({\n\t\t\tagentDir: options.agentDir,\n\t\t\tcreateRuntime: options.createRuntime,\n\t\t\tnow: policy.now,\n\t\t\tcloseGraceMs: idle.closeGraceMs ?? parseIdleExitMs(process.env[RPC_CLOSE_GRACE_MS_ENV]) ?? 10_000,\n\t\t}),\n\t\twriter,\n\t\toptions,\n\t\toptions.createBinding,\n\t\t{ capabilities },\n\t\t{\n\t\t\tnow: policy.now,\n\t\t\tidleEvictionMs: policy.idleEvictionMs,\n\t\t\temptyExitMs: policy.emptyExitMs,\n\t\t\tonEmptyExit: idle.onEmptyExit,\n\t\t\tcanExitWhenEmpty: idle.canExitWhenEmpty,\n\t\t},\n\t);\n\tconst handle = async (line: string): Promise<void> => {\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(line);\n\t\t} catch (cause) {\n\t\t\tawait writer.enqueueControl(parseError(`Failed to parse command: ${errorMessage(cause)}`));\n\t\t\treturn;\n\t\t}\n\t\tconst shapeError = rpcCommandShapeError(parsed);\n\t\tif (shapeError) {\n\t\t\tawait writer.enqueueControl(parseError(shapeError));\n\t\t\treturn;\n\t\t}\n\t\tconst response = await router.handle(parsed as RpcCommand);\n\t\tif (response) await writer.enqueueControl(response);\n\t};\n\treturn { router, handle };\n}\n\n/** Plain-stdio host with no eagerly-created AgentSessionRuntime. */\nasync function runStdioHost(options: MultiSessionHostOptions): Promise<never> {\n\ttakeOverStdout();\n\tconst sink: RpcConnectionSink = { writeRaw: writeRawStdout, waitForBackpressure: waitForRawStdoutBackpressure };\n\tconst writer = new SessionEventWriter(sink.writeRaw, sink.waitForBackpressure);\n\t// An empty host (no session ever opened, or all closed) must not stay resident\n\t// forever: exit through the normal shutdown path once the window elapses.\n\tconst { router, handle } = createHostCore(options, writer, undefined, {\n\t\tonEmptyExit: () => void shutdown(0),\n\t});\n\tlet shuttingDown = false;\n\tconst shutdown = async (exitCode = 0): Promise<never> => {\n\t\tif (shuttingDown) process.exit(exitCode);\n\t\tshuttingDown = true;\n\t\tdetach();\n\t\tawait router.dispose();\n\t\tawait writer.flush();\n\t\tawait flushRawStdout();\n\t\tprocess.exit(exitCode);\n\t};\n\tconst onEnd = () => void shutdown();\n\tprocess.stdin.on(\"end\", onEnd);\n\tconst detachReader = attachJsonlLineReader(process.stdin, (line) => void handle(line), {\n\t\tmaxLineLength: MAX_RPC_LINE_CHARACTERS,\n\t\tonOversizedLine: () => void writer.enqueueControl(parseError(oversizedLineError())),\n\t});\n\tconst detach = () => {\n\t\tdetachReader();\n\t\tprocess.stdin.off(\"end\", onEnd);\n\t};\n\tregisterShutdownSignals(shutdown);\n\treturn new Promise(() => {});\n}\n\nasync function runSocketHost(options: MultiSessionHostOptions, socketPath: string): Promise<never> {\n\tawait prepareSocketPath(socketPath);\n\tconst writer = new SessionEventWriter(() => {});\n\tconst connections = new Map<string, Connection>();\n\tconst { router, handle } = createHostCore(\n\t\toptions,\n\t\twriter,\n\t\tparseClientCapabilities(envValue(\"RPC_CLIENT_CAPABILITIES\")).filter(\n\t\t\t(capability) => capability !== \"rendered_components\",\n\t\t),\n\t\t// Supervised hosts idle-exit via the supervisor, but a socket host that\n\t\t// outlives its supervisor (or is started bare) still self-exits when empty.\n\t\t// A connected client counts as occupancy even with no session open: exiting\n\t\t// under it would drop its socket and read as a crash to the supervisor.\n\t\t{ onEmptyExit: () => void shutdown(0), canExitWhenEmpty: () => connections.size === 0 },\n\t);\n\tlet nextConnection = 0;\n\tlet shuttingDown = false;\n\tconst secret =\n\t\tprocess.platform === \"win32\"\n\t\t\t? await ensureSocketSecret(process.env[SOCKET_SECRET_FILE_ENV] ?? socketSecretPath(socketPath))\n\t\t\t: undefined;\n\tconst server = createServer((socket) => {\n\t\tconst accept = (): void => {\n\t\t\tconst id = `socket-${++nextConnection}`;\n\t\t\tconst sink = socketSink(socket);\n\t\t\twriter.registerConnection(id, sink);\n\t\t\tconst detachReader = attachJsonlLineReader(\n\t\t\t\tsocket,\n\t\t\t\t(line) => {\n\t\t\t\t\t// Do not serialize awaited commands: extension_ui_response and other\n\t\t\t\t\t// re-entrant frames must be able to resolve a command already awaiting them.\n\t\t\t\t\tvoid writer\n\t\t\t\t\t\t.withConnection(id, () => handle(line))\n\t\t\t\t\t\t.catch((cause) => {\n\t\t\t\t\t\t\tprocess.stderr.write(`senpi rpc connection ${id} failed: ${errorMessage(cause)}\\n`);\n\t\t\t\t\t\t});\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tmaxLineLength: MAX_RPC_LINE_CHARACTERS,\n\t\t\t\t\tonOversizedLine: () => {\n\t\t\t\t\t\tvoid writer\n\t\t\t\t\t\t\t.withConnection(id, () => writer.enqueueControl(parseError(oversizedLineError())))\n\t\t\t\t\t\t\t.catch((cause) =>\n\t\t\t\t\t\t\t\tprocess.stderr.write(`senpi rpc connection ${id} failed: ${errorMessage(cause)}\\n`),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t);\n\t\t\tlet detached = false;\n\t\t\tconst detach = () => {\n\t\t\t\tif (detached) return;\n\t\t\t\tdetached = true;\n\t\t\t\tdetachReader();\n\t\t\t\twriter.unregisterConnection(id);\n\t\t\t\tconnections.delete(id);\n\t\t\t\t// A socket that dies without close_session still owns its sessions' attachments\n\t\t\t\t// and path reservations. Release them on the command chain so this runs after any\n\t\t\t\t// in-flight command for this connection settles, otherwise the path stays pinned\n\t\t\t\t// by a runtime whose client is gone and later resumes attach to that orphan.\n\t\t\t\tvoid router.releaseConnection(id).catch((cause) => {\n\t\t\t\t\tprocess.stderr.write(`senpi rpc connection ${id} release failed: ${errorMessage(cause)}\\n`);\n\t\t\t\t});\n\t\t\t};\n\t\t\tconnections.set(id, { id, sink, detach, close: () => socket.destroy() });\n\t\t\tsocket.once(\"close\", detach);\n\t\t\tsocket.once(\"error\", () => detach());\n\t\t};\n\t\tif (secret) authenticateSocket(socket, secret, accept);\n\t\telse accept();\n\t});\n\tserver.on(\"error\", (cause) => {\n\t\tif (!shuttingDown) process.stderr.write(`senpi rpc socket listener failed: ${errorMessage(cause)}\\n`);\n\t});\n\tconst shutdown = async (exitCode = 0, watchdogCleanup?: Promise<void>): Promise<never> => {\n\t\tif (shuttingDown) process.exit(exitCode);\n\t\tshuttingDown = true;\n\t\t// On Windows, destroying named-pipe sockets does not always make libuv's\n\t\t// server.close callback fire: connected pipe instances can remain in the\n\t\t// kernel after the JavaScript handles are destroyed. Keep the normal drain\n\t\t// path, but never let that platform-specific close stall orphan the host.\n\t\ttry {\n\t\t\tfor (const connection of connections.values()) {\n\t\t\t\tconnection.detach();\n\t\t\t\tconnection.close();\n\t\t\t}\n\t\t\tawait (process.platform === \"win32\"\n\t\t\t\t? Promise.race([closeServer(server), delay(WINDOWS_SHUTDOWN_HARD_EXIT_MS)])\n\t\t\t\t: closeServer(server));\n\t\t\tawait router.dispose();\n\t\t\tawait writer.flush();\n\t\t\tawait removeSocketPath(socketPath);\n\t\t\tif (watchdogCleanup) await watchdogCleanup;\n\t\t} finally {\n\t\t\t// Explicitly terminate after every shutdown trigger. Windows named-pipe\n\t\t\t// handles are not fully controllable from JS, and an unresolved cleanup\n\t\t\t// must not leave this daemon or its public endpoint alive.\n\t\t\tprocess.exit(exitCode);\n\t\t}\n\t};\n\tregisterShutdownSignals(shutdown);\n\t// Arm before listen: a supervisor death during the listen transition must\n\t// still close the child and clean its private endpoint.\n\tarmHostWatchdog(readHostWatchdogConfigFromBrandEnv(), (reason, cleanup) => {\n\t\tprocess.stderr.write(`senpi rpc host: ${reason}; shutting down\\n`);\n\t\t// Enter shutdown before killing session-owned child processes. The Windows\n\t\t// tree killer is synchronous, while the shutdown fallback must be armed\n\t\t// before any such cleanup can delay the event loop.\n\t\tvoid shutdown(0, cleanup);\n\t\tsetImmediate(killTrackedDetachedChildren);\n\t});\n\tawait listen(server, socketPath, secret);\n\tprocess.stderr.write(`senpi rpc listening on ${formatSocketAddress(socketPath)}\\n`);\n\n\t// Opt-in only: set by the lifecycle supervisor so this host can never outlive\n\t// it, including when the supervisor is SIGKILLed and runs no handler at all.\n\treturn new Promise(() => {});\n}\n\nfunction delay(ms: number): Promise<void> {\n\treturn new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction parseError(error: string): RpcResponse {\n\treturn { type: \"response\", command: \"parse\", success: false, error };\n}\n\nfunction oversizedLineError(): string {\n\treturn `RPC input line exceeds ${MAX_RPC_LINE_CHARACTERS} characters.`;\n}\n\nfunction errorMessage(cause: unknown): string {\n\treturn cause instanceof Error ? cause.message : String(cause);\n}\n\nfunction resolveSocketPath(value: string, agentDir: string): string {\n\tif (value === \"unix://\") return join(agentDir, \"rpc\", \"rpc.sock\");\n\tif (value.startsWith(\"unix://\")) {\n\t\tconst path = value.slice(\"unix://\".length);\n\t\tif (path.length === 0) return join(agentDir, \"rpc\", \"rpc.sock\");\n\t\tif (path.startsWith(\"@\") && process.platform === \"linux\") return `\\0${path.slice(1)}`;\n\t\treturn path;\n\t}\n\treturn value;\n}\n\nfunction formatSocketAddress(socketPath: string): string {\n\treturn socketPath.startsWith(\"\\0\") ? `unix://@${socketPath.slice(1)}` : `unix://${socketPath}`;\n}\n\nfunction socketSink(socket: Socket): RpcConnectionSink {\n\tlet needsDrain = false;\n\treturn {\n\t\twriteRaw(chunk) {\n\t\t\tif (!socket.destroyed) needsDrain = !socket.write(chunk);\n\t\t},\n\t\tclose() {\n\t\t\tsocket.destroy();\n\t\t},\n\t\twaitForBackpressure() {\n\t\t\tif (socket.destroyed || !needsDrain) return Promise.resolve();\n\t\t\tneedsDrain = false;\n\t\t\treturn new Promise<void>((resolve) => {\n\t\t\t\tconst done = () => {\n\t\t\t\t\tsocket.off(\"drain\", done);\n\t\t\t\t\tsocket.off(\"close\", done);\n\t\t\t\t\tresolve();\n\t\t\t\t};\n\t\t\t\tsocket.once(\"drain\", done);\n\t\t\t\tsocket.once(\"close\", done);\n\t\t\t});\n\t\t},\n\t};\n}\n\nasync function prepareSocketPath(socketPath: string): Promise<void> {\n\tif (process.platform === \"win32\" || socketPath.startsWith(\"\\0\")) return;\n\tawait mkdir(dirname(socketPath), { recursive: true, mode: 0o700 });\n\ttry {\n\t\tawait access(socketPath);\n\t} catch (cause) {\n\t\tif (isNodeErrorCode(cause, \"ENOENT\")) return;\n\t\tthrow cause;\n\t}\n\tif (await probeSocket(socketPath)) throw new Error(`${socketPath}: address already in use by a live server.`);\n\tawait unlink(socketPath);\n}\n\nfunction probeSocket(socketPath: string): Promise<boolean> {\n\treturn new Promise((resolve) => {\n\t\tconst socket = createConnection(resolveSocketTransportAddress(socketPath, process.platform));\n\t\tconst settle = (live: boolean) => {\n\t\t\tsocket.destroy();\n\t\t\tresolve(live);\n\t\t};\n\t\tsocket.once(\"connect\", () => settle(true));\n\t\tsocket.once(\"error\", () => settle(false));\n\t\tsocket.setTimeout(1_000, () => settle(false));\n\t});\n}\n\nfunction listen(server: Server, socketPath: string, secret?: Uint8Array): Promise<void> {\n\treturn new Promise((resolve, reject) => {\n\t\tserver.once(\"error\", reject);\n\t\tserver.listen(resolveSocketTransportAddress(socketPath, process.platform, secret), async () => {\n\t\t\tserver.off(\"error\", reject);\n\t\t\ttry {\n\t\t\t\tif (process.platform !== \"win32\" && !socketPath.startsWith(\"\\0\")) await chmod(socketPath, 0o600);\n\t\t\t\tresolve();\n\t\t\t} catch (cause) {\n\t\t\t\treject(cause);\n\t\t\t}\n\t\t});\n\t});\n}\n\nfunction closeServer(server: Server): Promise<void> {\n\treturn new Promise((resolve, reject) => {\n\t\tserver.close((cause) => (cause ? reject(cause) : resolve()));\n\t});\n}\n\nasync function removeSocketPath(socketPath: string): Promise<void> {\n\tif (process.platform === \"win32\" || socketPath.startsWith(\"\\0\")) return;\n\ttry {\n\t\tawait unlink(socketPath);\n\t} catch (cause) {\n\t\tif (!isNodeErrorCode(cause, \"ENOENT\")) throw cause;\n\t}\n}\n\nfunction isNodeErrorCode(cause: unknown, code: string): boolean {\n\treturn cause instanceof Error && \"code\" in cause && cause.code === code;\n}\n\nfunction registerShutdownSignals(shutdown: (exitCode?: number) => Promise<never>): void {\n\tfor (const signal of process.platform === \"win32\" ? ([\"SIGTERM\"] as const) : ([\"SIGTERM\", \"SIGHUP\"] as const)) {\n\t\tprocess.on(signal, () => {\n\t\t\tkillTrackedDetachedChildren();\n\t\t\tvoid shutdown(signal === \"SIGHUP\" ? 129 : 143);\n\t\t});\n\t}\n}\n"]}
+{"version":3,"file":"multi-session-host.js","sourceRoot":"","sources":["../../../src/modes/rpc/multi-session-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAA4B,MAAM,UAAU,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EACN,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,cAAc,GACd,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAEnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAA0B,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACN,2BAA2B,EAC3B,sBAAsB,EAEtB,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,EAC7B,sBAAsB,EACtB,gBAAgB,GAChB,MAAM,uBAAuB,CAAC;AAc/B,kFAAkF;AAClF,MAAM,CAAC,MAAM,gCAAgC,GAAG,oCAAoC,CAAC;AACrF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAG,8BAA8B,CAAC;AACzE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AACjE,sGAAsG;AACtG,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,MAAM,CAAC;AAC5D,0GAA0G;AAC1G,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,MAAM,CAAC;AACtD,oGAAoG;AACpG,MAAM,6BAA6B,GAAG,KAAK,CAAC;AAc5C;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACpC,GAAiD,EACjD,YAA+B,EAAE;IAEjC,OAAO;QACN,GAAG,EAAE,SAAS,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;QAC9B,cAAc,EACb,SAAS,CAAC,cAAc;YACxB,eAAe,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YACtD,gCAAgC;QACjC,WAAW,EACV,SAAS,CAAC,WAAW,IAAI,eAAe,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,IAAI,0BAA0B;KACxG,CAAC;AACH,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAgC;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAChG,OAAO,aAAa,CAAC,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,cAAc,CAC7B,OAAgC,EAChC,MAA0B,EAC1B,YAAY,GAAG,uBAAuB,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,EAC3E,OAA0B,EAAE;IAE5B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,oBAAoB,CACtC,IAAI,kBAAkB,CAAC;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,IAAI,MAAM;KACjG,CAAC,EACF,MAAM,EACN,OAAO,EACP,OAAO,CAAC,aAAa,EACrB,EAAE,YAAY,EAAE,EAChB;QACC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACvC,CACD,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QACpD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,4BAA4B,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3F,OAAO;QACR,CAAC;QACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,UAAU,EAAE,CAAC;YAChB,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;YACpD,OAAO;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAoB,CAAC,CAAC;QAC3D,IAAI,QAAQ;YAAE,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,oEAAoE;AACpE,KAAK,UAAU,YAAY,CAAC,OAAgC;IAC3D,cAAc,EAAE,CAAC;IACjB,MAAM,IAAI,GAAsB,EAAE,QAAQ,EAAE,cAAc,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,CAAC;IAChH,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC/E,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE;QACrE,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,GAAG,CAAC,EAAkB,EAAE;QACvD,IAAI,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,EAAE,CAAC;QACT,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,cAAc,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC;IACpC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE;QACtF,aAAa,EAAE,uBAAuB;QACtC,eAAe,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;KACnF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,GAAG,EAAE;QACnB,YAAY,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC;IACF,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAgC,EAAE,UAAkB;IAChF,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;IAClD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CACxC,OAAO,EACP,MAAM,EACN,uBAAuB,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAClE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,qBAAqB,CACpD;IACD,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CACvF,CAAC;IACF,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,MAAM,GACX,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC3B,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC/F,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,cAAc,GAAG,kCAAkC,EAAE,CAAC;IAC5D,0EAA0E;IAC1E,yEAAyE;IACzE,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,0BAA0B,GAC/B,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,YAAY,CAAC;IACxG,MAAM,yBAAyB,GAC9B,0BAA0B,IAAI,cAAc,EAAE,UAAU;QACvD,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,2BAA2B,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,aAA6C,CAAC;IAClD,IAAI,wBAAwD,CAAC;IAC7D,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,GAAS,EAAE;YACzB,MAAM,EAAE,GAAG,UAAU,EAAE,cAAc,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAChC,MAAM,CAAC,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACpC,MAAM,YAAY,GAAG,qBAAqB,CACzC,MAAM,EACN,CAAC,IAAI,EAAE,EAAE;gBACR,qEAAqE;gBACrE,6EAA6E;gBAC7E,KAAK,MAAM;qBACT,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;qBACtC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,YAAY,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrF,CAAC,CAAC,CAAC;YACL,CAAC,EACD;gBACC,aAAa,EAAE,uBAAuB;gBACtC,eAAe,EAAE,GAAG,EAAE;oBACrB,KAAK,MAAM;yBACT,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;yBACjF,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,YAAY,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CACnF,CAAC;gBACJ,CAAC;aACD,CACD,CAAC;YACF,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,MAAM,MAAM,GAAG,GAAG,EAAE;gBACnB,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,EAAE,CAAC;gBACf,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;gBAChC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvB,gFAAgF;gBAChF,kFAAkF;gBAClF,iFAAiF;gBACjF,6EAA6E;gBAC7E,KAAK,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,oBAAoB,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC7F,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC;YACF,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC;QACF,IAAI,MAAM;YAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;;YAClD,MAAM,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5B,IAAI,CAAC,YAAY;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,GAAG,CAAC,EAAE,eAA+B,EAAkB,EAAE;QACxF,IAAI,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,YAAY,GAAG,IAAI,CAAC;QACpB,yEAAyE;QACzE,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,CAAC;YACJ,KAAK,MAAM,UAAU,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/C,UAAU,CAAC,MAAM,EAAE,CAAC;gBACpB,UAAU,CAAC,KAAK,EAAE,CAAC;YACpB,CAAC;YACD,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,MAAM,uBAAuB,CAAC,UAAU,EAAE,GAAG,EAAE,CAC9C,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;gBAC3E,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CACtB,CAAC;YACF,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,uEAAuE;YACvE,iEAAiE;YACjE,kEAAkE;YAClE,MAAM,iBAAiB,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;YAC5D,IAAI,0BAA0B,EAAE,CAAC;gBAChC,MAAM,iBAAiB,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,OAAO,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,eAAe;gBAAE,MAAM,eAAe,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACV,wEAAwE;YACxE,wEAAwE;YACxE,2DAA2D;YAC3D,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;IACF,CAAC,CAAC;IACF,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAClC,0EAA0E;IAC1E,wDAAwD;IACxD,MAAM,QAAQ,GACb,cAAc,IAAI,yBAAyB;QAC1C,CAAC,CAAC;YACA,GAAG,cAAc;YACjB,wEAAwE;YACxE,2EAA2E;YAC3E,sEAAsE;YACtE,wBAAwB;YACxB,aAAa,EAAE,KAAK,IAAI,EAAE;gBACzB,wBAAwB,KAAK,MAAM,sBAAsB,CAAC,yBAAyB,CAAC,CAAC;YACtF,CAAC;SACD;QACF,CAAC,CAAC,cAAc,CAAC;IACnB,eAAe,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,MAAM,mBAAmB,CAAC,CAAC;QACnE,2EAA2E;QAC3E,wEAAwE;QACxE,oDAAoD;QACpD,KAAK,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1B,YAAY,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,aAAa,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,yBAAyB,EAAE,CAAC;QAC/B,uEAAuE;QACvE,0EAA0E;QAC1E,uCAAuC;QACvC,wBAAwB,GAAG,MAAM,yBAAyB,CAAC,yBAAyB,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,mBAAmB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAEpF,8EAA8E;IAC9E,6EAA6E;IAC7E,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAChC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB;IAC1B,OAAO,0BAA0B,uBAAuB,cAAc,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,QAAgB;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC9C,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,UAAU,EAAE,CAAC;AAChG,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IACjC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,OAAO;QACN,QAAQ,CAAC,KAAK;YACb,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,UAAU,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK;YACJ,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC;QACD,mBAAmB;YAClB,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,UAAU;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YAC9D,UAAU,GAAG,KAAK,CAAC;YACnB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACpC,MAAM,IAAI,GAAG,GAAG,EAAE;oBACjB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC1B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC1B,OAAO,EAAE,CAAC;gBACX,CAAC,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACJ,CAAC;KACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IACxE,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO;QAC7C,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,MAAM,WAAW,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,4CAA4C,CAAC,CAAC;IAC9G,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB;IACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,6BAA6B,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,CAAC,IAAa,EAAE,EAAE;YAChC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,UAAkB,EAAE,MAAmB;IACtE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE;YAC7F,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACJ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClE,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;oBAC/B,gEAAgE;oBAChE,2DAA2D;oBAC3D,OAAO,OAAO,CAAC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;gBACtD,CAAC;gBACD,OAAO,CAAC,SAAS,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;QACF,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,OAAO,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY;IACpD,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACzE,CAAC;AAED,SAAS,uBAAuB,CAAC,QAA+C;IAC/E,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAE,CAAC,SAAS,CAAW,CAAC,CAAC,CAAE,CAAC,SAAS,EAAE,QAAQ,CAAW,EAAE,CAAC;QAC/G,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACvB,2BAA2B,EAAE,CAAC;YAC9B,KAAK,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACJ,CAAC;AACF,CAAC","sourcesContent":["import { access, chmod, mkdir, unlink } from \"node:fs/promises\";\nimport { createConnection, createServer, type Server, type Socket } from \"node:net\";\nimport { dirname, join } from \"node:path\";\nimport type { CreateAgentSessionRuntimeFactory } from \"../../core/agent-session-runtime.ts\";\nimport { envValue } from \"../../core/brand.ts\";\nimport {\n\tflushRawStdout,\n\ttakeOverStdout,\n\twaitForRawStdoutBackpressure,\n\twriteRawStdout,\n} from \"../../core/output-guard.ts\";\nimport { killTrackedDetachedChildren } from \"../../utils/shell.ts\";\nimport type { RpcConnectionSink } from \"./connection-handler.ts\";\nimport { parseClientCapabilities } from \"./custom-capability.ts\";\nimport { parseIdleExitMs } from \"./host-lifecycle.ts\";\nimport { armHostWatchdog, readHostWatchdogConfigFromBrandEnv } from \"./host-watchdog.ts\";\nimport { attachJsonlLineReader, MAX_RPC_LINE_CHARACTERS } from \"./jsonl.ts\";\nimport { rpcCommandShapeError } from \"./rpc-input-validation.ts\";\nimport type { RpcCommand, RpcResponse } from \"./rpc-types.ts\";\nimport { type RpcBindingFactory, SessionCommandRouter } from \"./session-command-router.ts\";\nimport { SessionEventWriter } from \"./session-event-writer.ts\";\nimport { RpcSessionRegistry } from \"./session-registry.ts\";\nimport {\n\tPUBLIC_SOCKET_IDENTITY_FILE,\n\treadSocketIdentityFile,\n\ttype SocketFileIdentity,\n\tshieldSocketDuringClose,\n\tstatSocketIdentity,\n\tunlinkOwnedSocket,\n\twaitForSocketIdentityFile,\n} from \"./socket-ownership.ts\";\nimport {\n\tauthenticateSocket,\n\tensureSocketSecret,\n\tresolveSocketTransportAddress,\n\tSOCKET_SECRET_FILE_ENV,\n\tsocketSecretPath,\n} from \"./socket-transport.ts\";\n\nexport interface MultiSessionHostOptions {\n\tagentDir: string;\n\tcreateRuntime: CreateAgentSessionRuntimeFactory;\n\tcwd: string;\n\tpermissionPreset?: string;\n\tcreationModel?: { provider: string; modelId: string };\n\tinitialThinkingLevel?: string;\n\tlisten?: string;\n\t/** Test seam: defaults to the real shared-session binding. */\n\tcreateBinding?: RpcBindingFactory;\n}\n\n/** Environment override for the idle-session eviction window, in milliseconds. */\nexport const RPC_SESSION_IDLE_EVICTION_MS_ENV = \"SENPI_RPC_SESSION_IDLE_EVICTION_MS\";\n/** Environment override for the empty-host exit window, in milliseconds. */\nexport const RPC_HOST_EMPTY_EXIT_MS_ENV = \"SENPI_RPC_HOST_EMPTY_EXIT_MS\";\n/** Environment override for the graceful close_session teardown window, in milliseconds. */\nexport const RPC_CLOSE_GRACE_MS_ENV = \"SENPI_RPC_CLOSE_GRACE_MS\";\n/** Default idle-eviction window: 30 minutes after a session's last routed command or settled turn. */\nexport const DEFAULT_SESSION_IDLE_EVICTION_MS = 30 * 60_000;\n/** Default empty-host exit: 15 minutes with zero open sessions, matching the supervisor's idle window. */\nexport const DEFAULT_HOST_EMPTY_EXIT_MS = 15 * 60_000;\n/** Win32 named-pipe close can leave libuv's server callback pending after handles are destroyed. */\nconst WINDOWS_SHUTDOWN_HARD_EXIT_MS = 2_000;\n\n/** Explicit occupancy-policy overrides for createHostCore; tests inject clocks and hooks here. */\nexport interface HostIdleOverrides {\n\tnow?: () => number;\n\tidleEvictionMs?: number;\n\temptyExitMs?: number;\n\tcloseGraceMs?: number;\n\t/** Shutdown hook the empty-exit window invokes; hosts pass their exit path. */\n\tonEmptyExit?: () => void;\n\t/** Gate consulted before the empty-exit window advances (connected clients block it). */\n\tcanExitWhenEmpty?: () => boolean;\n}\n\n/**\n * Resolve the host's idle lifecycle policy.\n */\nexport function resolveHostIdlePolicy(\n\tenv: Readonly<Record<string, string | undefined>>,\n\toverrides: HostIdleOverrides = {},\n): { now: () => number; idleEvictionMs: number; emptyExitMs: number } {\n\treturn {\n\t\tnow: overrides.now ?? Date.now,\n\t\tidleEvictionMs:\n\t\t\toverrides.idleEvictionMs ??\n\t\t\tparseIdleExitMs(env[RPC_SESSION_IDLE_EVICTION_MS_ENV]) ??\n\t\t\tDEFAULT_SESSION_IDLE_EVICTION_MS,\n\t\temptyExitMs:\n\t\t\toverrides.emptyExitMs ?? parseIdleExitMs(env[RPC_HOST_EMPTY_EXIT_MS_ENV]) ?? DEFAULT_HOST_EMPTY_EXIT_MS,\n\t};\n}\n\ninterface Connection {\n\treadonly id: string;\n\treadonly sink: RpcConnectionSink;\n\treadonly detach: () => void;\n\treadonly close: () => void;\n}\n\n/**\n * Socket agent events are delivered only to connections attached to their\n * session, tagged with its routing sessionId. Content-free session lifecycle\n * events remain visible to every connection. Responses and extension UI\n * requests remain requester-only; foreign observation uses attach-on-open.\n */\nexport async function runMultiSessionHost(options: MultiSessionHostOptions): Promise<never> {\n\tif (options.listen === undefined || options.listen === \"stdio://\") return runStdioHost(options);\n\treturn runSocketHost(options, resolveSocketPath(options.listen, options.agentDir));\n}\n\nexport function createHostCore(\n\toptions: MultiSessionHostOptions,\n\twriter: SessionEventWriter,\n\tcapabilities = parseClientCapabilities(envValue(\"RPC_CLIENT_CAPABILITIES\")),\n\tidle: HostIdleOverrides = {},\n) {\n\tconst policy = resolveHostIdlePolicy(process.env, idle);\n\tconst router = new SessionCommandRouter(\n\t\tnew RpcSessionRegistry({\n\t\t\tagentDir: options.agentDir,\n\t\t\tcreateRuntime: options.createRuntime,\n\t\t\tnow: policy.now,\n\t\t\tcloseGraceMs: idle.closeGraceMs ?? parseIdleExitMs(process.env[RPC_CLOSE_GRACE_MS_ENV]) ?? 10_000,\n\t\t}),\n\t\twriter,\n\t\toptions,\n\t\toptions.createBinding,\n\t\t{ capabilities },\n\t\t{\n\t\t\tnow: policy.now,\n\t\t\tidleEvictionMs: policy.idleEvictionMs,\n\t\t\temptyExitMs: policy.emptyExitMs,\n\t\t\tonEmptyExit: idle.onEmptyExit,\n\t\t\tcanExitWhenEmpty: idle.canExitWhenEmpty,\n\t\t},\n\t);\n\tconst handle = async (line: string): Promise<void> => {\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(line);\n\t\t} catch (cause) {\n\t\t\tawait writer.enqueueControl(parseError(`Failed to parse command: ${errorMessage(cause)}`));\n\t\t\treturn;\n\t\t}\n\t\tconst shapeError = rpcCommandShapeError(parsed);\n\t\tif (shapeError) {\n\t\t\tawait writer.enqueueControl(parseError(shapeError));\n\t\t\treturn;\n\t\t}\n\t\tconst response = await router.handle(parsed as RpcCommand);\n\t\tif (response) await writer.enqueueControl(response);\n\t};\n\treturn { router, handle };\n}\n\n/** Plain-stdio host with no eagerly-created AgentSessionRuntime. */\nasync function runStdioHost(options: MultiSessionHostOptions): Promise<never> {\n\ttakeOverStdout();\n\tconst sink: RpcConnectionSink = { writeRaw: writeRawStdout, waitForBackpressure: waitForRawStdoutBackpressure };\n\tconst writer = new SessionEventWriter(sink.writeRaw, sink.waitForBackpressure);\n\t// An empty host (no session ever opened, or all closed) must not stay resident\n\t// forever: exit through the normal shutdown path once the window elapses.\n\tconst { router, handle } = createHostCore(options, writer, undefined, {\n\t\tonEmptyExit: () => void shutdown(0),\n\t});\n\tlet shuttingDown = false;\n\tconst shutdown = async (exitCode = 0): Promise<never> => {\n\t\tif (shuttingDown) process.exit(exitCode);\n\t\tshuttingDown = true;\n\t\tdetach();\n\t\tawait router.dispose();\n\t\tawait writer.flush();\n\t\tawait flushRawStdout();\n\t\tprocess.exit(exitCode);\n\t};\n\tconst onEnd = () => void shutdown();\n\tprocess.stdin.on(\"end\", onEnd);\n\tconst detachReader = attachJsonlLineReader(process.stdin, (line) => void handle(line), {\n\t\tmaxLineLength: MAX_RPC_LINE_CHARACTERS,\n\t\tonOversizedLine: () => void writer.enqueueControl(parseError(oversizedLineError())),\n\t});\n\tconst detach = () => {\n\t\tdetachReader();\n\t\tprocess.stdin.off(\"end\", onEnd);\n\t};\n\tregisterShutdownSignals(shutdown);\n\treturn new Promise(() => {});\n}\n\nasync function runSocketHost(options: MultiSessionHostOptions, socketPath: string): Promise<never> {\n\tawait prepareSocketPath(socketPath);\n\tconst writer = new SessionEventWriter(() => {});\n\tconst connections = new Map<string, Connection>();\n\tconst { router, handle } = createHostCore(\n\t\toptions,\n\t\twriter,\n\t\tparseClientCapabilities(envValue(\"RPC_CLIENT_CAPABILITIES\")).filter(\n\t\t\t(capability) => capability !== \"rendered_components\",\n\t\t),\n\t\t// Supervised hosts idle-exit via the supervisor, but a socket host that\n\t\t// outlives its supervisor (or is started bare) still self-exits when empty.\n\t\t// A connected client counts as occupancy even with no session open: exiting\n\t\t// under it would drop its socket and read as a crash to the supervisor.\n\t\t{ onEmptyExit: () => void shutdown(0), canExitWhenEmpty: () => connections.size === 0 },\n\t);\n\tlet nextConnection = 0;\n\tlet shuttingDown = false;\n\tconst secret =\n\t\tprocess.platform === \"win32\"\n\t\t\t? await ensureSocketSecret(process.env[SOCKET_SECRET_FILE_ENV] ?? socketSecretPath(socketPath))\n\t\t\t: undefined;\n\tconst watchdogConfig = readHostWatchdogConfigFromBrandEnv();\n\t// Crash-path ownership for the supervisor's PUBLIC socket: the supervisor\n\t// records the identity of the entry it bound (inside its private scratch\n\t// directory, which no replacement supervisor writes) right after its listen,\n\t// and this host removes that path only while the identity still matches. A\n\t// blind path removal here would unlink a newer host's freshly published\n\t// entry after a takeover - the startup path already refuses to touch a\n\t// socket owned by a live server; teardown follows the same rule.\n\tconst supervisorPublicSocketPath =\n\t\tprocess.platform === \"win32\" || socketPath.startsWith(\"\\0\") ? undefined : watchdogConfig?.publicSocket;\n\tconst supervisorPublicOwnerFile =\n\t\tsupervisorPublicSocketPath && watchdogConfig?.scratchDir\n\t\t\t? join(watchdogConfig.scratchDir, PUBLIC_SOCKET_IDENTITY_FILE)\n\t\t\t: undefined;\n\tlet boundIdentity: SocketFileIdentity | undefined;\n\tlet supervisorPublicIdentity: SocketFileIdentity | undefined;\n\tconst server = createServer((socket) => {\n\t\tconst accept = (): void => {\n\t\t\tconst id = `socket-${++nextConnection}`;\n\t\t\tconst sink = socketSink(socket);\n\t\t\twriter.registerConnection(id, sink);\n\t\t\tconst detachReader = attachJsonlLineReader(\n\t\t\t\tsocket,\n\t\t\t\t(line) => {\n\t\t\t\t\t// Do not serialize awaited commands: extension_ui_response and other\n\t\t\t\t\t// re-entrant frames must be able to resolve a command already awaiting them.\n\t\t\t\t\tvoid writer\n\t\t\t\t\t\t.withConnection(id, () => handle(line))\n\t\t\t\t\t\t.catch((cause) => {\n\t\t\t\t\t\t\tprocess.stderr.write(`senpi rpc connection ${id} failed: ${errorMessage(cause)}\\n`);\n\t\t\t\t\t\t});\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tmaxLineLength: MAX_RPC_LINE_CHARACTERS,\n\t\t\t\t\tonOversizedLine: () => {\n\t\t\t\t\t\tvoid writer\n\t\t\t\t\t\t\t.withConnection(id, () => writer.enqueueControl(parseError(oversizedLineError())))\n\t\t\t\t\t\t\t.catch((cause) =>\n\t\t\t\t\t\t\t\tprocess.stderr.write(`senpi rpc connection ${id} failed: ${errorMessage(cause)}\\n`),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t);\n\t\t\tlet detached = false;\n\t\t\tconst detach = () => {\n\t\t\t\tif (detached) return;\n\t\t\t\tdetached = true;\n\t\t\t\tdetachReader();\n\t\t\t\twriter.unregisterConnection(id);\n\t\t\t\tconnections.delete(id);\n\t\t\t\t// A socket that dies without close_session still owns its sessions' attachments\n\t\t\t\t// and path reservations. Release them on the command chain so this runs after any\n\t\t\t\t// in-flight command for this connection settles, otherwise the path stays pinned\n\t\t\t\t// by a runtime whose client is gone and later resumes attach to that orphan.\n\t\t\t\tvoid router.releaseConnection(id).catch((cause) => {\n\t\t\t\t\tprocess.stderr.write(`senpi rpc connection ${id} release failed: ${errorMessage(cause)}\\n`);\n\t\t\t\t});\n\t\t\t};\n\t\t\tconnections.set(id, { id, sink, detach, close: () => socket.destroy() });\n\t\t\tsocket.once(\"close\", detach);\n\t\t\tsocket.once(\"error\", () => detach());\n\t\t};\n\t\tif (secret) authenticateSocket(socket, secret, accept);\n\t\telse accept();\n\t});\n\tserver.on(\"error\", (cause) => {\n\t\tif (!shuttingDown) process.stderr.write(`senpi rpc socket listener failed: ${errorMessage(cause)}\\n`);\n\t});\n\tconst shutdown = async (exitCode = 0, watchdogCleanup?: Promise<void>): Promise<never> => {\n\t\tif (shuttingDown) process.exit(exitCode);\n\t\tshuttingDown = true;\n\t\t// On Windows, destroying named-pipe sockets does not always make libuv's\n\t\t// server.close callback fire: connected pipe instances can remain in the\n\t\t// kernel after the JavaScript handles are destroyed. Keep the normal drain\n\t\t// path, but never let that platform-specific close stall orphan the host.\n\t\ttry {\n\t\t\tfor (const connection of connections.values()) {\n\t\t\t\tconnection.detach();\n\t\t\t\tconnection.close();\n\t\t\t}\n\t\t\t// libuv unlinks the bound NAME when the listening handle closes - which\n\t\t\t// would delete a newer host's entry renamed over this path. Shield the\n\t\t\t// current entry for the close, then let the ownership check decide.\n\t\t\tawait shieldSocketDuringClose(socketPath, () =>\n\t\t\t\tprocess.platform === \"win32\"\n\t\t\t\t\t? Promise.race([closeServer(server), delay(WINDOWS_SHUTDOWN_HARD_EXIT_MS)])\n\t\t\t\t\t: closeServer(server),\n\t\t\t);\n\t\t\tawait router.dispose();\n\t\t\tawait writer.flush();\n\t\t\t// Ownership-checked: unlink only the entry THIS process bound. After a\n\t\t\t// takeover renamed a newer host's socket over the same path, the\n\t\t\t// identity no longer matches and the replacement stays published.\n\t\t\tawait unlinkOwnedSocket(socketPath, boundIdentity, hostLog);\n\t\t\tif (supervisorPublicSocketPath) {\n\t\t\t\tawait unlinkOwnedSocket(supervisorPublicSocketPath, supervisorPublicIdentity, hostLog);\n\t\t\t}\n\t\t\tif (watchdogCleanup) await watchdogCleanup;\n\t\t} finally {\n\t\t\t// Explicitly terminate after every shutdown trigger. Windows named-pipe\n\t\t\t// handles are not fully controllable from JS, and an unresolved cleanup\n\t\t\t// must not leave this daemon or its public endpoint alive.\n\t\t\tprocess.exit(exitCode);\n\t\t}\n\t};\n\tregisterShutdownSignals(shutdown);\n\t// Arm before listen: a supervisor death during the listen transition must\n\t// still close the child and clean its private endpoint.\n\tconst watchdog =\n\t\twatchdogConfig && supervisorPublicOwnerFile\n\t\t\t? {\n\t\t\t\t\t...watchdogConfig,\n\t\t\t\t\t// The supervisor may die while this host is still waiting for the token\n\t\t\t\t\t// below; read it before the watchdog removes the scratch directory, or the\n\t\t\t\t\t// shutdown's ownership check has nothing to prove with and leaves the\n\t\t\t\t\t// public socket behind.\n\t\t\t\t\tbeforeCleanup: async () => {\n\t\t\t\t\t\tsupervisorPublicIdentity ??= await readSocketIdentityFile(supervisorPublicOwnerFile);\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: watchdogConfig;\n\tarmHostWatchdog(watchdog, (reason, cleanup) => {\n\t\tprocess.stderr.write(`senpi rpc host: ${reason}; shutting down\\n`);\n\t\t// Enter shutdown before killing session-owned child processes. The Windows\n\t\t// tree killer is synchronous, while the shutdown fallback must be armed\n\t\t// before any such cleanup can delay the event loop.\n\t\tvoid shutdown(0, cleanup);\n\t\tsetImmediate(killTrackedDetachedChildren);\n\t});\n\tboundIdentity = await listen(server, socketPath, secret);\n\tif (supervisorPublicOwnerFile) {\n\t\t// The supervisor publishes its public-socket token after this internal\n\t\t// listener is ready, so a short bounded wait keeps the lifecycles in step\n\t\t// without delaying unsupervised hosts.\n\t\tsupervisorPublicIdentity = await waitForSocketIdentityFile(supervisorPublicOwnerFile);\n\t}\n\tprocess.stderr.write(`senpi rpc listening on ${formatSocketAddress(socketPath)}\\n`);\n\n\t// Opt-in only: set by the lifecycle supervisor so this host can never outlive\n\t// it, including when the supervisor is SIGKILLed and runs no handler at all.\n\treturn new Promise(() => {});\n}\n\nfunction delay(ms: number): Promise<void> {\n\treturn new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction parseError(error: string): RpcResponse {\n\treturn { type: \"response\", command: \"parse\", success: false, error };\n}\n\nfunction oversizedLineError(): string {\n\treturn `RPC input line exceeds ${MAX_RPC_LINE_CHARACTERS} characters.`;\n}\n\nfunction errorMessage(cause: unknown): string {\n\treturn cause instanceof Error ? cause.message : String(cause);\n}\n\nfunction resolveSocketPath(value: string, agentDir: string): string {\n\tif (value === \"unix://\") return join(agentDir, \"rpc\", \"rpc.sock\");\n\tif (value.startsWith(\"unix://\")) {\n\t\tconst path = value.slice(\"unix://\".length);\n\t\tif (path.length === 0) return join(agentDir, \"rpc\", \"rpc.sock\");\n\t\tif (path.startsWith(\"@\") && process.platform === \"linux\") return `\\0${path.slice(1)}`;\n\t\treturn path;\n\t}\n\treturn value;\n}\n\nfunction formatSocketAddress(socketPath: string): string {\n\treturn socketPath.startsWith(\"\\0\") ? `unix://@${socketPath.slice(1)}` : `unix://${socketPath}`;\n}\n\nfunction socketSink(socket: Socket): RpcConnectionSink {\n\tlet needsDrain = false;\n\treturn {\n\t\twriteRaw(chunk) {\n\t\t\tif (!socket.destroyed) needsDrain = !socket.write(chunk);\n\t\t},\n\t\tclose() {\n\t\t\tsocket.destroy();\n\t\t},\n\t\twaitForBackpressure() {\n\t\t\tif (socket.destroyed || !needsDrain) return Promise.resolve();\n\t\t\tneedsDrain = false;\n\t\t\treturn new Promise<void>((resolve) => {\n\t\t\t\tconst done = () => {\n\t\t\t\t\tsocket.off(\"drain\", done);\n\t\t\t\t\tsocket.off(\"close\", done);\n\t\t\t\t\tresolve();\n\t\t\t\t};\n\t\t\t\tsocket.once(\"drain\", done);\n\t\t\t\tsocket.once(\"close\", done);\n\t\t\t});\n\t\t},\n\t};\n}\n\nasync function prepareSocketPath(socketPath: string): Promise<void> {\n\tif (process.platform === \"win32\" || socketPath.startsWith(\"\\0\")) return;\n\tawait mkdir(dirname(socketPath), { recursive: true, mode: 0o700 });\n\ttry {\n\t\tawait access(socketPath);\n\t} catch (cause) {\n\t\tif (isNodeErrorCode(cause, \"ENOENT\")) return;\n\t\tthrow cause;\n\t}\n\tif (await probeSocket(socketPath)) throw new Error(`${socketPath}: address already in use by a live server.`);\n\tawait unlink(socketPath);\n}\n\nfunction probeSocket(socketPath: string): Promise<boolean> {\n\treturn new Promise((resolve) => {\n\t\tconst socket = createConnection(resolveSocketTransportAddress(socketPath, process.platform));\n\t\tconst settle = (live: boolean) => {\n\t\t\tsocket.destroy();\n\t\t\tresolve(live);\n\t\t};\n\t\tsocket.once(\"connect\", () => settle(true));\n\t\tsocket.once(\"error\", () => settle(false));\n\t\tsocket.setTimeout(1_000, () => settle(false));\n\t});\n}\n\nfunction listen(server: Server, socketPath: string, secret?: Uint8Array): Promise<SocketFileIdentity | undefined> {\n\treturn new Promise((resolve, reject) => {\n\t\tserver.once(\"error\", reject);\n\t\tserver.listen(resolveSocketTransportAddress(socketPath, process.platform, secret), async () => {\n\t\t\tserver.off(\"error\", reject);\n\t\t\ttry {\n\t\t\t\tif (process.platform !== \"win32\" && !socketPath.startsWith(\"\\0\")) {\n\t\t\t\t\tawait chmod(socketPath, 0o600);\n\t\t\t\t\t// Record which filesystem entry THIS listener created; shutdown\n\t\t\t\t\t// removes the path only while this identity still matches.\n\t\t\t\t\treturn resolve(await statSocketIdentity(socketPath));\n\t\t\t\t}\n\t\t\t\tresolve(undefined);\n\t\t\t} catch (cause) {\n\t\t\t\treject(cause);\n\t\t\t}\n\t\t});\n\t});\n}\n\nfunction closeServer(server: Server): Promise<void> {\n\treturn new Promise((resolve, reject) => {\n\t\tserver.close((cause) => (cause ? reject(cause) : resolve()));\n\t});\n}\n\nfunction hostLog(message: string): void {\n\tprocess.stderr.write(`senpi rpc host: ${message}\\n`);\n}\n\nfunction isNodeErrorCode(cause: unknown, code: string): boolean {\n\treturn cause instanceof Error && \"code\" in cause && cause.code === code;\n}\n\nfunction registerShutdownSignals(shutdown: (exitCode?: number) => Promise<never>): void {\n\tfor (const signal of process.platform === \"win32\" ? ([\"SIGTERM\"] as const) : ([\"SIGTERM\", \"SIGHUP\"] as const)) {\n\t\tprocess.on(signal, () => {\n\t\t\tkillTrackedDetachedChildren();\n\t\t\tvoid shutdown(signal === \"SIGHUP\" ? 129 : 143);\n\t\t});\n\t}\n}\n"]}

package/dist/modes/rpc/socket-ownership.d.ts

@@ -0,0 +1,46 @@
+/** Filesystem identity of one bound socket path entry. */
+export interface SocketFileIdentity {
+    readonly dev: number;
+    readonly ino: number;
+}
+/**
+ * Name of the sidecar, inside the lifecycle supervisor's private scratch
+ * directory, that records which public socket entry that supervisor bound. The
+ * directory is per-supervisor, so a replacement supervisor's token can never be
+ * mistaken for the old one's.
+ */
+export declare const PUBLIC_SOCKET_IDENTITY_FILE = "public-socket.owner";
+/** Default bound on waiting for a supervisor to publish its ownership token. */
+export declare const SOCKET_IDENTITY_WAIT_MS = 30000;
+/** Reads the current identity of a socket path entry; `undefined` once absent. */
+export declare function statSocketIdentity(socketPath: string): Promise<SocketFileIdentity | undefined>;
+/** Records a bound socket identity for teardown paths that cannot hold it in memory. */
+export declare function writeSocketIdentityFile(path: string, identity: SocketFileIdentity): Promise<void>;
+export declare function readSocketIdentityFile(path: string): Promise<SocketFileIdentity | undefined>;
+/**
+ * Waits, bounded, for an identity file to appear. The lifecycle supervisor
+ * publishes its public-socket token after this host's internal listener is
+ * ready, so supervised hosts poll briefly instead of assuming ordering.
+ */
+export declare function waitForSocketIdentityFile(path: string, timeoutMs?: number, intervalMs?: number): Promise<SocketFileIdentity | undefined>;
+/**
+ * Unlinks a socket path only while it still refers to the entry `identity`
+ * describes. An absent path is nothing to do; a mismatched identity means a
+ * newer host owns the name now and is left alone; an unknown identity can
+ * never be proven ours, so the path is left and the decision is logged.
+ */
+export declare function unlinkOwnedSocket(socketPath: string, identity: SocketFileIdentity | undefined, log: (message: string) => void): Promise<void>;
+/**
+ * Runs `close` with the socket path's current entry shielded from libuv's
+ * close-time unlink.
+ *
+ * libuv unlinks the NAME a pipe was bound to when its listening handle
+ * closes - even when a takeover has renamed a DIFFERENT socket over that
+ * name, so an ordinary `server.close()` silently deletes the newer host's
+ * freshly published entry. Moving the current entry aside for the duration
+ * of the close (libuv's unlink then hits ENOENT) and restoring it afterwards
+ * keeps the filesystem exactly as it was; ownership-checked removal via
+ * `unlinkOwnedSocket` decides afterwards what may actually be deleted.
+ */
+export declare function shieldSocketDuringClose(socketPath: string, close: () => Promise<void>): Promise<void>;
+//# sourceMappingURL=socket-ownership.d.ts.map

package/dist/modes/rpc/socket-ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket-ownership.d.ts","sourceRoot":"","sources":["../../../src/modes/rpc/socket-ownership.ts"],"names":[],"mappings":"AAeA,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,wBAAwB,CAAC;AAEjE,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAM9C,kFAAkF;AAClF,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAQpG;AAED,wFAAwF;AACxF,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKvG;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAwBlG;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,MAAgC,EAC3C,UAAU,SAAK,GACb,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAQzC;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACtC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,kBAAkB,GAAG,SAAS,EACxC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC5B,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB3G"}

package/dist/modes/rpc/socket-ownership.js

@@ -0,0 +1,178 @@
+/**
+ * Ownership-checked removal for Unix domain socket path entries.
+ *
+ * A socket path is a rendezvous name, not a capability: once a host unlinks
+ * its entry, any other process may bind the same path. Teardown that removes
+ * "its" socket by path alone can therefore delete a NEWER host's freshly
+ * published entry after a takeover renamed a replacement over that path. The
+ * startup path already refuses to touch a socket owned by a live server
+ * (`prepareSocketPath`); these helpers give every teardown path the same rule:
+ * capture the bound entry's filesystem identity (dev + ino) at listen time and
+ * unlink only while the path still stat-matches that identity.
+ */
+import { mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+/**
+ * Name of the sidecar, inside the lifecycle supervisor's private scratch
+ * directory, that records which public socket entry that supervisor bound. The
+ * directory is per-supervisor, so a replacement supervisor's token can never be
+ * mistaken for the old one's.
+ */
+export const PUBLIC_SOCKET_IDENTITY_FILE = "public-socket.owner";
+/** Default bound on waiting for a supervisor to publish its ownership token. */
+export const SOCKET_IDENTITY_WAIT_MS = 30_000;
+function sameSocketIdentity(a, b) {
+    return a.dev === b.dev && a.ino === b.ino;
+}
+/** Reads the current identity of a socket path entry; `undefined` once absent. */
+export async function statSocketIdentity(socketPath) {
+    try {
+        const { dev, ino } = await stat(socketPath);
+        return { dev, ino };
+    }
+    catch (cause) {
+        if (isNodeErrorCode(cause, "ENOENT"))
+            return undefined;
+        throw cause;
+    }
+}
+/** Records a bound socket identity for teardown paths that cannot hold it in memory. */
+export async function writeSocketIdentityFile(path, identity) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const tmpPath = `${path}.${process.pid}.tmp`;
+    await writeFile(tmpPath, `${JSON.stringify(identity)}\n`, { mode: 0o600 });
+    await rename(tmpPath, path);
+}
+export async function readSocketIdentityFile(path) {
+    let raw;
+    try {
+        raw = await readFile(path, "utf8");
+    }
+    catch (cause) {
+        if (isNodeErrorCode(cause, "ENOENT"))
+            return undefined;
+        throw cause;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        // Truncated or in-progress JSON is not a token: callers wait or leave the path.
+        return undefined;
+    }
+    if (typeof parsed !== "object" ||
+        parsed === null ||
+        typeof parsed.dev !== "number" ||
+        typeof parsed.ino !== "number") {
+        return undefined;
+    }
+    return { dev: parsed.dev, ino: parsed.ino };
+}
+/**
+ * Waits, bounded, for an identity file to appear. The lifecycle supervisor
+ * publishes its public-socket token after this host's internal listener is
+ * ready, so supervised hosts poll briefly instead of assuming ordering.
+ */
+export async function waitForSocketIdentityFile(path, timeoutMs = SOCKET_IDENTITY_WAIT_MS, intervalMs = 25) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const identity = await readSocketIdentityFile(path);
+        if (identity !== undefined)
+            return identity;
+        if (Date.now() >= deadline)
+            return undefined;
+        await delayUnrefed(intervalMs);
+    }
+}
+/**
+ * Unlinks a socket path only while it still refers to the entry `identity`
+ * describes. An absent path is nothing to do; a mismatched identity means a
+ * newer host owns the name now and is left alone; an unknown identity can
+ * never be proven ours, so the path is left and the decision is logged.
+ */
+export async function unlinkOwnedSocket(socketPath, identity, log) {
+    if (process.platform === "win32" || socketPath.startsWith("\0"))
+        return;
+    let current;
+    try {
+        current = await statSocketIdentity(socketPath);
+    }
+    catch (cause) {
+        log(`socket ${socketPath} ownership could not be verified (${errorMessage(cause)}); leaving it`);
+        return;
+    }
+    if (current === undefined)
+        return;
+    if (identity === undefined) {
+        log(`socket path ${socketPath} ownership unknown; leaving it`);
+        return;
+    }
+    if (!sameSocketIdentity(current, identity)) {
+        log(`socket path ${socketPath} now owned by another host; leaving it`);
+        return;
+    }
+    try {
+        await unlink(socketPath);
+    }
+    catch (cause) {
+        if (!isNodeErrorCode(cause, "ENOENT")) {
+            log(`socket ${socketPath} removal failed (${errorMessage(cause)})`);
+        }
+    }
+}
+/**
+ * Runs `close` with the socket path's current entry shielded from libuv's
+ * close-time unlink.
+ *
+ * libuv unlinks the NAME a pipe was bound to when its listening handle
+ * closes - even when a takeover has renamed a DIFFERENT socket over that
+ * name, so an ordinary `server.close()` silently deletes the newer host's
+ * freshly published entry. Moving the current entry aside for the duration
+ * of the close (libuv's unlink then hits ENOENT) and restoring it afterwards
+ * keeps the filesystem exactly as it was; ownership-checked removal via
+ * `unlinkOwnedSocket` decides afterwards what may actually be deleted.
+ */
+export async function shieldSocketDuringClose(socketPath, close) {
+    if (process.platform === "win32" || socketPath.startsWith("\0"))
+        return close();
+    const shieldPath = `${socketPath}.shield-${process.pid}`;
+    let shielded = false;
+    try {
+        if ((await statSocketIdentity(socketPath)) !== undefined) {
+            await rename(socketPath, shieldPath);
+            shielded = true;
+        }
+    }
+    catch {
+        // Without a shield the close degrades to today's behavior; the
+        // ownership-checked unlink still runs afterwards.
+    }
+    try {
+        await close();
+    }
+    finally {
+        if (shielded) {
+            try {
+                await rename(shieldPath, socketPath);
+            }
+            catch {
+                // Best effort: a failed restore leaves the entry under the shield
+                // name; startup probes treat a dead entry as replaceable.
+            }
+        }
+    }
+}
+function delayUnrefed(ms) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(resolve, ms);
+        timer.unref?.();
+    });
+}
+function errorMessage(cause) {
+    return cause instanceof Error ? cause.message : String(cause);
+}
+function isNodeErrorCode(cause, code) {
+    return cause instanceof Error && "code" in cause && cause.code === code;
+}
+//# sourceMappingURL=socket-ownership.js.map