@ddtcorex/dsh-maestro-review 0.10.0 → 0.11.1

package/README.md

@@ -6,8 +6,9 @@ child agents on fresh worktrees, webhook intake for GitLab events, and a setting
 client UI injected into the DSH Web slots.
 
 Part of the Maestro Harness suite (`dsh-maestro-*`). Cordis patch rows:
-`maestro-review-webhook` (intake), `maestro-review-orchestrator` (pipeline),
-`maestro-review-settings-rpc` (settings UI) — all served by this npm package.
+`maestro-review-host` (package root, bundled skills), `maestro-review-webhook` (intake),
+`maestro-review-orchestrator` (pipeline), `maestro-review-settings-rpc` (settings UI),
+all served by this npm package.
 
 ## What it provides
 
@@ -16,9 +17,9 @@ Part of the Maestro Harness suite (`dsh-maestro-*`). Cordis patch rows:
 - **Orchestrator** — reviewer + auditor agent runs against a disposable worktree of the MR,
   model selection overridable globally (`reviewModel`) and per project mapping.
 - **Webhook intake** — receives GitLab MR events, enqueues reviews (dedup + retention).
-- **Review findings/history/signals** — findings written through the `review-findings`
+- **Review findings/history/signals**: findings written through the `report_review_findings`
   tool by tool-only review subagents (never free text); history + signals tracked per MR.
-- **Govard/workspace tooling** available inside review runs.
+- **Review tools** (workspace search, Magento/Hyva scans, query-log stats, GitLab diff tools) mounted into review runs.
 - **Client half** — settings section rendered into DSH Web slots; notification copy stays
   here, delivery goes through the optional `maestroNotifier` service.
 
@@ -38,8 +39,10 @@ Templates live in `templates/`, the image in `docker/`.
 ## Settings
 
 Reads its configuration through the **shared namespaced settings store**
-(`~/.dsh/maestro/settings.json`, owned by `@ddtcorex/dsh-maestro-config-lib`) via the flat
-adapter in `src/config-store.ts`; machine runtime state stays in a package-local sidecar.
+(`~/.dsh/dsh-maestro-config/settings.json`) via the flat adapter in
+`src/host/config-store.ts`, over the embedded store copy `src/host/vendor/store.ts`
+(generated from `dsh-maestro-core`, no runtime dependency); machine runtime state stays in a
+package-local sidecar.
 
 ## Install
 
@@ -53,8 +56,7 @@ dsh plugin --profile web add @ddtcorex/dsh-maestro-review
 pnpm install
 pnpm verify        # tsc --noEmit
 pnpm test          # vitest run
-pnpm build         # tsc -> lib/
-pnpm run build:client   # browser bundle -> lib/client.js (required after client changes)
+pnpm build         # tsc -> lib/, plus the browser bundle lib/client.js
 ```
 
 See AGENTS.md for conventions (host/client split, secrets handling, live-validation rules).

package/cordis.patch.yml

@@ -1,6 +1,6 @@
-# dsh-maestro-review bundle patch — 4 rows as spec §4
-# RPC channel: /dsh-maestro-review (loopback, see src/index.ts + src/settings-rpc.ts)
-# channel: /dsh-maestro-review
+# dsh-maestro-review bundle patch: 4 rows, maestro-review-host, maestro-review-webhook,
+# maestro-review-orchestrator, maestro-review-settings-rpc
+# RPC channel: /dsh-maestro-review (see src/host/settings-rpc.ts)
 - insert:
     # Mounts the package root (lib/index.js -> apply()). Required: `dsh plugin add`
     # applies ONLY the rows in this file, so without it the skill-provider
@@ -32,4 +32,4 @@
       # rpc.handle registers a webServer route inside an effect fiber which carries only the row's inject (not the module's);
       # without webServer the row fails on harnesses that provide webServer after rows apply
       # (DSH 0.1.5-rc.1+).
-      inject: ['connection', 'maestroTunnel', 'webServer']
+      inject: ['connection', 'webServer']

package/lib/client.js

@@ -0,0 +1,493 @@
+window.__ModuleLoader__.load({
+  id: '@ddtcorex/dsh-maestro-review',
+  factory: (require) => {
+    var module = { exports: {} };
+    var exports = module.exports;
+    var React = require("react");
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client/index.tsx
+var index_exports = {};
+__export(index_exports, {
+  REVIEW_CHANNEL: () => REVIEW_CHANNEL,
+  apply: () => apply,
+  default: () => index_default,
+  inject: () => inject,
+  makeRpcCall: () => makeRpcCall
+});
+module.exports = __toCommonJS(index_exports);
+var React2 = __toESM(require("react"), 1);
+
+// src/client/review/ReviewSettings.tsx
+var React = __toESM(require("react"), 1);
+
+// src/client/BrandMark.tsx
+var import_react = require("react");
+
+// src/client/maestro-mark.ts
+var MAESTRO_MARK_PATH = "M2 11 L5 4 L8 9 L11 4 L14 11";
+var MAESTRO_MARK_VIEWBOX = "0 0 16 16";
+var MAESTRO_MARK_STROKE_WIDTH = 1.6;
+var MAESTRO_BRAND_TILE = "#0A84FF";
+
+// src/client/BrandMark.tsx
+function MaestroMark(props) {
+  const s = props.size ?? 16;
+  return (0, import_react.createElement)(
+    "svg",
+    { width: s, height: s, viewBox: MAESTRO_MARK_VIEWBOX, fill: "none", "aria-hidden": "true" },
+    (0, import_react.createElement)("path", { d: MAESTRO_MARK_PATH, stroke: "currentColor", strokeWidth: MAESTRO_MARK_STROKE_WIDTH, strokeLinecap: "round", strokeLinejoin: "round" })
+  );
+}
+function BrandBadge(props) {
+  const outer = props.outer ?? 28;
+  const size = props.size ?? 16;
+  const radius = props.radius ?? 8;
+  return (0, import_react.createElement)("span", {
+    "data-maestro-logo": "",
+    style: {
+      width: outer,
+      height: outer,
+      borderRadius: radius,
+      display: "inline-flex",
+      alignItems: "center",
+      justifyContent: "center",
+      background: `var(--dsw-alias-brand-primary, ${MAESTRO_BRAND_TILE})`,
+      backgroundColor: MAESTRO_BRAND_TILE,
+      color: "#fff",
+      flex: "none",
+      border: "1px solid rgba(0,0,0,0.08)",
+      boxShadow: "0 0 0 1px var(--dsw-alias-border-l1)",
+      boxSizing: "border-box",
+      ...props.style
+    }
+  }, (0, import_react.createElement)(MaestroMark, { size }));
+}
+
+// src/client/review/ReviewSettings.tsx
+var FIELD_LABELS = {
+  gitlabBaseUrl: "GitLab base URL",
+  botUsername: "Bot username",
+  webhookPort: "Webhook port",
+  autoRereviewOnPush: "Re-review on push",
+  autoReviewOnAssign: "Review on assign",
+  agentTimeoutMs: "Agent timeout (ms)",
+  reviewSessionRetentionDays: "Session retention (days)"
+};
+function Field(props) {
+  return React.createElement(
+    "div",
+    { "data-review-row": "" },
+    React.createElement(
+      "div",
+      { "data-review-row-text": "" },
+      React.createElement("label", { "data-review-label": "", htmlFor: props.id }, props.label),
+      props.hint ? React.createElement("p", { "data-review-hint": "" }, props.hint) : null
+    ),
+    React.createElement("div", { "data-review-control": "" }, props.children)
+  );
+}
+function SecretField(props) {
+  return Field({
+    id: props.id,
+    label: props.label,
+    hint: props.present ? "A value is stored. Leave blank to keep it." : "Not set.",
+    children: React.createElement(
+      "div",
+      { "data-review-secret-group": "" },
+      React.createElement("input", {
+        id: props.id,
+        type: "password",
+        value: props.value,
+        placeholder: props.present ? "stored \u2014 type to replace" : "not set",
+        disabled: props.disabled,
+        autoComplete: "new-password",
+        "data-review-secret": "",
+        onChange: (e) => props.onChange(e.target.value)
+      }),
+      // The save belongs to this field: it stays disabled until the field
+      // holds something, and floating it below the row left it orphaned.
+      React.createElement("button", {
+        type: "button",
+        disabled: props.disabled || props.value === "",
+        "data-review-save-secret": props.name,
+        onClick: props.onSave
+      }, "Save")
+    )
+  });
+}
+function ReviewSettings(props) {
+  const { rpcCall } = props;
+  const [cfg, setCfg] = React.useState({});
+  const [gitlabToken, setGitlabToken] = React.useState("");
+  const [webhookSecret, setWebhookSecret] = React.useState("");
+  const [busy, setBusy] = React.useState(false);
+  const [notice, setNotice] = React.useState(null);
+  const fail = React.useCallback((e) => {
+    setNotice({ tone: "bad", text: e instanceof Error ? e.message : String(e) });
+  }, []);
+  const refresh = React.useCallback(async () => {
+    setBusy(true);
+    try {
+      setCfg(await rpcCall("maestro.getConfig") ?? {});
+    } catch (e) {
+      fail(e);
+    } finally {
+      setBusy(false);
+    }
+  }, [rpcCall, fail]);
+  React.useEffect(() => {
+    void refresh();
+  }, [refresh]);
+  const save = React.useCallback(
+    async (patch) => {
+      setBusy(true);
+      try {
+        await rpcCall("maestro.saveConfig", patch);
+        if ("gitlabToken" in patch) setGitlabToken("");
+        if ("webhookSecret" in patch) setWebhookSecret("");
+        setNotice({ tone: "ok", text: "Saved." });
+        await refresh();
+      } catch (e) {
+        fail(e);
+      } finally {
+        setBusy(false);
+      }
+    },
+    [rpcCall, refresh, fail]
+  );
+  const text = (key, placeholder = "") => Field({
+    id: `review-${String(key)}`,
+    label: FIELD_LABELS[key] ?? String(key),
+    children: React.createElement("input", {
+      id: `review-${String(key)}`,
+      type: "text",
+      value: cfg[key] ?? "",
+      placeholder,
+      disabled: busy,
+      "data-review-input": String(key),
+      onChange: (e) => setCfg((c) => ({ ...c, [key]: e.target.value })),
+      onBlur: (e) => void save({ [key]: e.target.value })
+    })
+  });
+  const toggle = (key) => Field({
+    id: `review-${String(key)}`,
+    label: FIELD_LABELS[key] ?? String(key),
+    children: React.createElement("input", {
+      id: `review-${String(key)}`,
+      type: "checkbox",
+      checked: cfg[key] === true,
+      disabled: busy,
+      "data-review-toggle": String(key),
+      onChange: (e) => void save({ [key]: e.target.checked })
+    })
+  });
+  return React.createElement(
+    "div",
+    { "data-review-root": "" },
+    // House header: badge, title, one-line status. The notice lives here so it
+    // reports without pushing the rows down.
+    React.createElement(
+      "div",
+      { "data-review-header": "" },
+      React.createElement(BrandBadge, { style: { alignSelf: "flex-start", marginTop: 2 } }),
+      React.createElement(
+        "div",
+        { "data-review-heading": "" },
+        React.createElement("h2", { "data-review-title": "" }, "GitLab and Review"),
+        React.createElement(
+          "div",
+          { "data-review-status": "" },
+          notice ? React.createElement("p", { "data-review-notice": "", "data-tone": notice.tone, role: "status" }, notice.text) : React.createElement("span", null, "GitLab credentials and review triggers.")
+        )
+      )
+    ),
+    React.createElement(
+      "div",
+      { "data-review-actions": "" },
+      React.createElement("button", { type: "button", disabled: busy, onClick: () => void refresh() }, "Refresh")
+    ),
+    text("gitlabBaseUrl", "https://gitlab.example.com"),
+    text("botUsername", "maestro-bot"),
+    SecretField({
+      id: "review-gitlab-token",
+      name: "gitlabToken",
+      label: "GitLab token",
+      present: cfg.hasGitlabToken === true,
+      value: gitlabToken,
+      disabled: busy,
+      onChange: setGitlabToken,
+      onSave: () => void save({ gitlabToken })
+    }),
+    SecretField({
+      id: "review-webhook-secret",
+      name: "webhookSecret",
+      label: "Webhook secret",
+      present: cfg.hasWebhookSecret === true,
+      value: webhookSecret,
+      disabled: busy,
+      onChange: setWebhookSecret,
+      onSave: () => void save({ webhookSecret })
+    }),
+    text("webhookPort", "3081"),
+    toggle("autoRereviewOnPush"),
+    toggle("autoReviewOnAssign"),
+    text("agentTimeoutMs", "600000"),
+    text("reviewSessionRetentionDays", "30")
+  );
+}
+
+// src/client/review/styles.ts
+var REVIEW_CSS = `
+[data-review-root], [data-review-root] * { box-sizing: border-box; }
+[data-review-root] {
+  display: flex; flex-direction: column; gap: 12px;
+  color: var(--dsw-alias-label-primary);
+  font-size: 13px; line-height: 1.5;
+  min-width: 0; width: 100%; max-width: 640px;
+}
+
+/* House header: badge + title + one-line status. */
+[data-review-header] { display: flex; gap: 10px; align-items: flex-start; padding: 2px 2px 8px; }
+[data-review-heading] { display: flex; flex-direction: column; min-width: 0; }
+[data-review-title] { margin: 0; font-size: 15px; font-weight: 600; line-height: 22px; }
+[data-review-status] { font-size: 12px; line-height: 16px; color: var(--dsw-alias-label-secondary); overflow-wrap: anywhere; }
+[data-review-status] [data-review-notice] { margin: 0; }
+[data-review-status] [data-review-notice][data-tone="ok"] { color: var(--dsw-alias-state-success-primary); }
+[data-review-status] [data-review-notice][data-tone="bad"] { color: var(--dsw-alias-state-error-primary); }
+
+[data-review-actions] { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; }
+[data-review-actions] button {
+  min-height: 32px; padding: 0 12px; border-radius: 8px;
+  border: 1px solid var(--dsw-alias-border-l2); background: var(--dsw-alias-bg-layer-1);
+  color: inherit; font: inherit; cursor: pointer;
+}
+[data-review-actions] button:disabled { opacity: 0.55; cursor: default; }
+[data-review-actions] button:focus-visible { outline: 2px solid var(--dsw-alias-border-l2); outline-offset: 2px; }
+
+/* House row: label and hint left, control held right, hairline between. */
+[data-review-row] {
+  display: flex; align-items: center; gap: 8px;
+  padding: 16px 0; border-bottom: 1px solid var(--dsw-alias-border-l2); min-width: 0;
+}
+[data-review-row]:last-of-type { border-bottom: none; }
+[data-review-row-text] { flex: 1; min-width: 0; display: flex; flex-direction: column; gap: 4px; padding-right: 48px; }
+[data-review-control] { flex: none; display: flex; align-items: center; justify-content: flex-end; gap: 8px; min-height: 36px; }
+/* Declared once. These two rules previously existed twice \u2014 the 12px/600 pair
+   sat AFTER the house values and won on source order at equal specificity, so
+   the whole tab rendered at the old weight and the old hint size. */
+[data-review-label] { font-size: 14px; font-weight: 400; line-height: 22px; color: var(--dsw-alias-label-primary); }
+[data-review-hint] { margin: 0; font-size: 12px; line-height: 18px; color: var(--dsw-alias-label-tertiary); }
+
+/* A secret whose value is committed by a button: input and save travel
+   together on ONE row. The button used to sit on a row of its own below the
+   field \u2014 the group was a column and the button was align-self: flex-end \u2014
+   which orphaned it from the control it saves. It stays disabled until the
+   field holds something, so proximity to that field is the point. */
+[data-review-secret-group] { display: flex; flex-direction: row; align-items: center; gap: 8px; min-width: 220px; }
+[data-review-secret-group] input { flex: 1 1 auto; min-width: 0; }
+[data-review-secret-group] button {
+  flex: none; align-self: center; min-height: 44px; padding: 0 12px; border-radius: 8px;
+  border: 1px solid var(--dsw-alias-border-l2); background: var(--dsw-alias-bg-layer-1);
+  color: inherit; font: inherit; cursor: pointer;
+}
+[data-review-secret-group] button:disabled { opacity: 0.55; cursor: default; }
+[data-review-secret-group] button:focus-visible { outline: 2px solid var(--dsw-alias-border-l2); outline-offset: 2px; }
+
+/* Every row control gets the same box \u2014 the shared settings field box, copied
+   from the host's own form primitive (ui-primitives ConfigField) so this tab
+   follows the shell instead of carrying a geometry of its own. Only
+   min-height: 44px is Maestro's: it is the touch target AGENTS.md requires,
+   which the host's line-box sizing does not give.
+   The password type belongs in this list: without it the two secret fields
+   rendered at the UA default \u2014 21px tall, no radius \u2014 beside their neighbours
+   in the same column. */
+[data-review-control] input[type="text"], [data-review-control] input[type="password"], [data-review-control] select {
+  min-height: 44px; padding: 6px 12px; border: 0.5px solid var(--dsw-alias-border-l4);
+  border-radius: var(--dsw-radius-md); background: var(--dsw-alias-bg-layer-3);
+  color: var(--dsw-alias-label-primary); font: inherit;
+}
+[data-review-control] input:focus-visible, [data-review-control] select:focus-visible {
+  outline: 2px solid var(--dsw-alias-border-l2); outline-offset: 2px;
+}
+/* The checkbox is the one control the harness draws at its own size; without
+   this it rendered at the UA's 13px. Same values as the reference row. */
+[data-review-control] input[type="checkbox"] {
+  width: 16px; height: 16px; margin: 0; flex: none;
+  accent-color: var(--dsw-alias-brand-primary, #0A84FF);
+}
+
+[data-review-pin], [data-review-lan] { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
+[data-review-pin] code, [data-review-lan] code {
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  padding: 2px 6px; border-radius: 6px; background: var(--dsw-alias-bg-layer-2);
+}
+[data-review-pin] button, [data-review-lan] button {
+  min-height: 32px; padding: 0 10px; border-radius: 8px;
+  border: 1px solid var(--dsw-alias-border-l2); background: var(--dsw-alias-bg-layer-1);
+  color: inherit; font: inherit; cursor: pointer;
+}
+
+@media (max-width: 640px) {
+  /* Below the measure the row stacks: a right-held control has no room left,
+     and a wrapped one reads as a third column. */
+  [data-review-row] { flex-direction: column; align-items: stretch; gap: 8px; }
+  [data-review-row-text] { padding-right: 0; }
+  [data-review-control] { justify-content: flex-start; }
+}
+
+@media (max-width: 480px) {
+  [data-review-actions] button { flex: 1 1 auto; min-height: 40px; }
+}
+
+/* iOS 16px field floor: the magnifier fires below this on a focused field. */
+@media (max-width: 1023px) and (pointer: coarse) {
+  html[data-mobile-nav-ios] [data-review-root] input,
+  html[data-mobile-nav-ios] [data-review-root] select { font-size: 16px !important; }
+}
+`;
+
+// src/client/settings-nav-icon.ts
+var SETTINGS_NAV_MARKER = "data-maestro-review-settings-nav";
+function registerSettingsNavIcon(label, root) {
+  if (typeof document === "undefined" && root === void 0) {
+    return () => {
+    };
+  }
+  const scope = root ?? document;
+  let disposed = false;
+  const sync = () => {
+    if (disposed) return;
+    const currentLabel = label().trim();
+    const buttons = scope.querySelectorAll('[role="dialog"] nav button');
+    for (const button of Array.from(buttons)) {
+      const el = button;
+      const matches = currentLabel.length > 0 && button.textContent != null && button.textContent.trim() === currentLabel;
+      if (matches) el.setAttribute(SETTINGS_NAV_MARKER, "");
+      else if (el.hasAttribute(SETTINGS_NAV_MARKER)) el.removeAttribute(SETTINGS_NAV_MARKER);
+    }
+  };
+  sync();
+  let observer = null;
+  if (typeof MutationObserver !== "undefined") {
+    observer = new MutationObserver(sync);
+    observer.observe(document.body, { childList: true, subtree: true, characterData: true });
+  }
+  return () => {
+    disposed = true;
+    if (observer !== null) observer.disconnect();
+    for (const element of Array.from(scope.querySelectorAll(`[${SETTINGS_NAV_MARKER}]`))) {
+      element.removeAttribute(SETTINGS_NAV_MARKER);
+    }
+  };
+}
+
+// src/client/index.tsx
+var REVIEW_CHANNEL = "/dsh-maestro-review";
+function unwrap(res) {
+  return res && typeof res === "object" && "ok" in res ? res.ok ? res.value : null : res;
+}
+function makeRpcCall(ctx) {
+  return async (endpoint, payload) => {
+    const conn = ctx.get?.("connection");
+    if (conn?.rpc?.call === void 0) throw new Error("RPC not available");
+    const res = await conn.rpc.call(REVIEW_CHANNEL, endpoint, payload ?? {});
+    const value = unwrap(res);
+    if (value === null) {
+      throw new Error(String(res?.error?.message ?? res?.error ?? endpoint));
+    }
+    return value;
+  };
+}
+var REVIEW_NAV_CSS = `
+[${SETTINGS_NAV_MARKER}] > svg:first-child,
+[${SETTINGS_NAV_MARKER}] > svg.zWKi1a_navIcon {
+  display: none !important;
+}
+
+[${SETTINGS_NAV_MARKER}]::before {
+  content: '';
+  flex: none;
+  width: 16px;
+  height: 16px;
+  display: inline-block;
+  background: currentColor;
+  -webkit-mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16' fill='none' stroke='black' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 11 L5 4 L8 9 L11 4 L14 11'/%3E%3C/svg%3E") center / contain no-repeat;
+  mask: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16' fill='none' stroke='black' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 11 L5 4 L8 9 L11 4 L14 11'/%3E%3C/svg%3E") center / contain no-repeat;
+}
+`;
+function installStyleTag(css, pluginCss) {
+  if (typeof document === "undefined") return () => {
+  };
+  const tag = document.createElement("style");
+  tag.dataset.plugin = "@ddtcorex/dsh-maestro-review";
+  tag.dataset.pluginCss = pluginCss;
+  tag.textContent = css;
+  document.head.appendChild(tag);
+  return () => {
+    document.querySelector(`style[data-plugin-css="${pluginCss}"]`)?.remove();
+  };
+}
+var inject = ["slots", "connection"];
+function apply(ctx) {
+  const slots = ctx.get?.("slots");
+  if (!slots?.inject || !slots?.register) return;
+  const rpcCall = makeRpcCall(ctx);
+  ctx.effect(() => registerSettingsNavIcon(() => "Maestro Review"), "maestro-review: settings nav icon");
+  ctx.effect(() => installStyleTag(REVIEW_NAV_CSS, "maestro-review/settings-nav.css"), "maestro-review: settings nav css");
+  ctx.effect(() => installStyleTag(REVIEW_CSS, "maestro-review/settings.css"), "maestro-review: settings css");
+  ctx.effect(() => {
+    const dispose = slots.inject(
+      "settings.section",
+      () => slots.register(
+        {
+          name: "settings.section",
+          id: "maestro-review",
+          order: 32,
+          label: () => "Maestro Review",
+          inject: () => ({ rpcCall })
+        },
+        (props) => React2.createElement(ReviewSettings, props)
+      )
+    );
+    return () => {
+      try {
+        ;
+        dispose?.();
+      } catch {
+      }
+    };
+  }, "maestro-review: settings");
+}
+var index_default = { inject, apply };
+
+    return module.exports;
+  }
+});

package/lib/config-store.d.ts

@@ -55,7 +55,7 @@ export interface MaestroUserConfig {
 }
 /**
  * Settings live in the SHARED namespaced store (`~/.dsh/dsh-maestro-config/settings.json`,
- * owned by @ddtcorex/dsh-maestro-config-lib); this store is a thin adapter that
+ * owned by dsh-maestro-core and embedded here at `src/host/vendor/store.ts`); this store is a thin adapter that
  * keeps the package's flat `MaestroUserConfig` API while delegating persistence.
  * Machine runtime state (RUNTIME_KEYS) never enters settings — it stays in this
  * package's own sidecar so a settings edit can never silently flip tunnel state.

package/lib/config-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../src/host/config-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAO1D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,kBAAkB,CAAA;IAClC,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,+EAA+E;IAC/E,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,CAAA;IACvC,wGAAwG;IACxG,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,gGAAgG;IAChG,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,uFAAuF;IACvF,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IAC9B,WAAW,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mEAAmE;IACnE,2BAA2B,CAAC,EAAE,OAAO,CAAA;CACtC;AAMD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAExD;AAyBD,wBAAsB,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAMjF;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAc3G"}
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../src/host/config-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAO1D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,kBAAkB,CAAA;IAClC,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,+EAA+E;IAC/E,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,CAAA;IACvC,wGAAwG;IACxG,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,gGAAgG;IAChG,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,uFAAuF;IACvF,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IAC9B,WAAW,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mEAAmE;IACnE,2BAA2B,CAAC,EAAE,OAAO,CAAA;CACtC;AAuBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAExD;AAyBD,wBAAsB,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4BjF;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAc3G"}

package/lib/config-store.js

@@ -1,13 +1,29 @@
 import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { RUNTIME_KEYS, readFlat, writeLegacyPatch, } from '@ddtcorex/dsh-maestro-config-lib';
+import { RUNTIME_KEYS, readFlat, writeLegacyPatch, } from './vendor/store.js';
 function resolveDshHome(dshHome) {
     return dshHome ?? process.env.DSH_HOME ?? join(homedir(), '.dsh');
 }
+/**
+ * The keys review reads and may persist: its own gitlab + review settings, plus
+ * the one machine-runtime flag that belongs to its own sidecar.
+ *
+ * Deliberately the READ counterpart of `SAVABLE_KEYS` in `settings-rpc.ts`, plus
+ * `lastTunnelRunning` — which review reads from its sidecar and never writes to
+ * the shared store. Keep both in step: a key here that is not savable is a read
+ * review needs but cannot change, and a savable key missing here is one the UI
+ * could write but never read back.
+ */
+const REVIEW_OWNED_KEYS = [
+    'gitlabBaseUrl', 'gitlabToken', 'botUsername', 'webhookSecret', 'webhookPort',
+    'projectMappings', 'autoRereviewOnPush', 'autoReviewOnAssign',
+    'reviewModel', 'agentTimeoutMs', 'reviewSessionRetentionDays',
+    'lastTunnelRunning',
+];
 /**
  * Settings live in the SHARED namespaced store (`~/.dsh/dsh-maestro-config/settings.json`,
- * owned by @ddtcorex/dsh-maestro-config-lib); this store is a thin adapter that
+ * owned by dsh-maestro-core and embedded here at `src/host/vendor/store.ts`); this store is a thin adapter that
  * keeps the package's flat `MaestroUserConfig` API while delegating persistence.
  * Machine runtime state (RUNTIME_KEYS) never enters settings — it stays in this
  * package's own sidecar so a settings edit can never silently flip tunnel state.
@@ -38,7 +54,31 @@ export async function loadUserConfig(dshHome) {
         readFlat({ dshHome }),
         readRuntimeState(dshHome),
     ]);
-    return { ...flat, ...runtime };
+    // Scope the read to the keys review OWNS. `readFlat` returns the WHOLE store
+    // view — every `DOMAIN_KEY_MAP` key across every domain — so returning it
+    // unfiltered made review's own settings RPC (`/dsh-maestro-review`,
+    // `maestro.getConfig`) answer with remote's tunnel identity: `tunnelHostname`,
+    // `tunnelId`, `tunnelCredentialsFile` (the local path of the machine's
+    // Cloudflare credentials file), `lanPort`, `lanPinEnabled`, `proxyPort`,
+    // `pinSessionTtlHours` — plus the notifier's telegram token and chat id.
+    //
+    // The leak was one-directional and therefore invisible: `SAVABLE_KEYS` already
+    // rejected every one of those keys on a WRITE (with `OWNER_OF` naming the
+    // owning plugin), and nothing in review reads them — but the read side handed
+    // them to the client anyway.
+    //
+    // An ALLOWLIST, not a denylist, so a key added to the shared store later
+    // cannot leak by default. `tests/config-scope.spec.ts` pins the set.
+    const scoped = {};
+    for (const key of REVIEW_OWNED_KEYS) {
+        const value = flat[key];
+        if (value !== undefined)
+            scoped[key] = value;
+        const local = runtime[key];
+        if (local !== undefined)
+            scoped[key] = local;
+    }
+    return scoped;
 }
 export async function saveUserConfig(patch, dshHome) {
     const settingsPatch = {};

package/lib/config-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../src/host/config-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,gBAAgB,GACjB,MAAM,kCAAkC,CAAA;AA2DzC,SAAS,cAAc,CAAC,OAAgB;IACtC,OAAO,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,oBAAoB,EAAE,eAAe,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB;IACxC,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,oBAAoB,EAAE,cAAc,CAAC,CAAA;AAC5E,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAA;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA8B,EAC9B,OAAgB;IAEhB,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAA;IACjE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5D,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1F,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;QACrB,gBAAgB,CAAC,OAAO,CAAC;KAC1B,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,EAAuB,CAAA;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAwB,EAAE,OAAgB;IAC7E,MAAM,aAAa,GAA4B,EAAE,CAAA;IACjD,MAAM,YAAY,GAA4B,EAAE,CAAA;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAK,YAAkC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;;YAC3E,aAAa,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACjC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,gBAAgB,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,CAAA;AAChC,CAAC"}
+{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../src/host/config-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AA2D1B,SAAS,cAAc,CAAC,OAAgB;IACtC,OAAO,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG;IACxB,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa;IAC7E,iBAAiB,EAAE,oBAAoB,EAAE,oBAAoB;IAC7D,aAAa,EAAE,gBAAgB,EAAE,4BAA4B;IAC7D,mBAAmB;CACoC,CAAA;AAEzD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,oBAAoB,EAAE,eAAe,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB;IACxC,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,oBAAoB,EAAE,cAAc,CAAC,CAAA;AAC5E,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAA;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAA8B,EAC9B,OAAgB;IAEhB,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAA;IACjE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5D,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1F,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;QACrB,gBAAgB,CAAC,OAAO,CAAC;KAC1B,CAAC,CAAA;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,oEAAoE;IACpE,+EAA+E;IAC/E,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,EAAE;IACF,+EAA+E;IAC/E,0EAA0E;IAC1E,8EAA8E;IAC9E,6BAA6B;IAC7B,EAAE;IACF,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAa,CAAC,CAAA;QACjC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAa,CAAC,GAAG,KAAK,CAAA;QACtD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAa,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAa,CAAC,GAAG,KAAK,CAAA;IACxD,CAAC;IACD,OAAO,MAA2B,CAAA;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAwB,EAAE,OAAgB;IAC7E,MAAM,aAAa,GAA4B,EAAE,CAAA;IACjD,MAAM,YAAY,GAA4B,EAAE,CAAA;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAK,YAAkC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;;YAC3E,aAAa,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACjC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,gBAAgB,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,CAAA;AAChC,CAAC"}