@decibelsystems/tools 2.1.2 → 2.1.4

package/README.md

@@ -1,42 +1,73 @@
 # @decibelsystems/tools
 
-MCP server for project intelligence. 27 facade tools (170+ internal handlers) across work tracking, architecture, experiments, design, git forensics, agent coordination, and more.
+**Project intelligence for AI coding sessions.** A single MCP server that gives Claude (or any MCP client) a durable memory for your project — issues, decisions, friction, roadmap, and more — stored as plain files inside your repo, so the context survives when the chat window doesn't.
 
-Tested with Claude Desktop, Claude Code, and Cursor. [Learn more](https://decibel.systems/tools)
+> 29 facade tools (170+ internal handlers) across work tracking, architecture, experiments, design, git forensics, agent coordination, and security. Tested with Claude Desktop, Claude Code, and Cursor. [Learn more →](https://decibel.systems/tools)
 
 <a href="https://github.com/decibelsystems/decibel-tools-mcp#cursor">
   <img src="https://cursor.com/deeplink/mcp-install-dark.svg" alt="Add to Cursor" height="32" />
 </a>
 
-> **Note:** The one-click Cursor install only works on GitHub. [Click here](https://github.com/decibelsystems/decibel-tools-mcp#cursor) or see manual setup below.
+---
+
+## What is this?
+
+When you work with an AI assistant, everything it "knows" about your project lives in the chat — and vanishes when the session ends. The next session starts cold: it re-discovers the same bugs, re-makes the same decisions, forgets why you chose Postgres over SQLite three weeks ago.
+
+Decibel fixes that. It’s an MCP server that lets your AI **write project knowledge to disk** in a structured way and **read it back** in any future session. Track an issue in one conversation; a week later, a fresh session asks "what should I work on?" and gets the answer. Record an architecture decision once; it’s there forever. No database to run, no account to create — it’s just YAML and Markdown in a `.decibel/` folder in your repo.
+
+## Objectives
+
+Decibel is built around a few goals:
+
+- **Persistence over recall.** Project state should outlive a single chat — so knowledge accrues instead of evaporating.
+- **Local-first and private.** Everything is plain files in *your* repo. No telemetry, no cloud dependency, no lock-in. You can read, diff, and commit it like any other source.
+- **One tool, many domains.** A handful of "facade" tools (each with an `action`) cover tracking, decisions, design, security, and coordination — instead of 170 separate tools cluttering the model’s context.
+- **AI-native, human-readable.** Designed for an assistant to drive, but every artifact is something a person can open and understand.
+- **Works everywhere MCP does.** Same tool set across Claude Code, Claude Desktop, Cursor, and custom agents over HTTP.
+
+## Contents
+
+- [Requirements](#requirements)
+- [Quick Start](#quick-start)
+- [Connect your AI client](#connect-your-ai-client) — [Claude Code](#claude-code) · [Claude Desktop](#claude-desktop) · [Cursor](#cursor)
+- [Your first 5 minutes](#your-first-5-minutes)
+- [The tools](#the-tools)
+- [Daemon mode](#daemon-mode)
+- [Configuration & Pro license](#configuration--pro-license)
+- [Data storage](#data-storage)
+- [Environment variables](#environment-variables)
+- [Troubleshooting](#troubleshooting)
+- [Privacy](#privacy)
+
+---
+
+## Requirements
+
+- **Node.js ≥ 18** (`node --version` to check). On macOS, the easiest path is [Homebrew](https://brew.sh): `brew install node`.
+- An MCP-capable client: Claude Code, Claude Desktop, Cursor, or your own.
 
 ## Quick Start
 
 ```bash
-# Install globally
+# Install globally…
 npm install -g @decibelsystems/tools
 
-# Or run directly with npx
+# …or run on demand with npx (no install)
 npx @decibelsystems/tools
 ```
 
-### Project Setup
-
-After installing, initialize your first project:
+Then wire it into your AI client below, and [initialize your first project](#your-first-5-minutes).
 
-```bash
-# Copy the example registry (one-time setup)
-cp projects.example.json projects.json
-# Edit projects.json with your project paths
-```
+---
 
-Or use the MCP tools directly — call `project_init` with your project path and it will create the `.decibel/` folder and register the project automatically.
+## Connect your AI client
 
-## Platform Setup
+The tool set is identical across every client — only the config file location differs.
 
 ### Claude Code
 
-Add to `.mcp.json` in your project root or `~/.claude/settings.json`:
+Add to `.mcp.json` in your project root (or `~/.claude/settings.json` to make it global):
 
 ```json
 {
@@ -49,24 +80,30 @@ Add to `.mcp.json` in your project root or `~/.claude/settings.json`:
 }
 ```
 
-### Cursor
+### Claude Desktop
 
-Add to `~/.cursor/mcp.json`:
+Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS). If the file doesn’t exist yet, create it.
+
+> **Important — use the login-shell wrapper.** Claude Desktop launches with a stripped `PATH` and often can’t find a bare `npx`, so the server silently fails to start. Wrapping the command in `zsh -lc` makes it load your shell profile and find Node, wherever it’s installed:
 
 ```json
 {
   "mcpServers": {
     "decibel-tools": {
-      "command": "npx",
-      "args": ["-y", "@decibelsystems/tools"]
+      "command": "/bin/zsh",
+      "args": ["-lc", "npx -y @decibelsystems/tools"]
     }
   }
 }
 ```
 
-### Claude Desktop
+After saving, **fully quit Claude Desktop (⌘Q, not just the window) and reopen.** The server appears under the **Desktop** group in *Settings → Connectors*. First launch is slow while `npx` downloads the package — give it 30–60s.
 
-Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS):
+*Prefer a background service?* Run the [daemon](#daemon-mode) and add it as a **custom connector** (URL `http://127.0.0.1:4888/mcp`) instead — no per-app process, shared across clients.
+
+### Cursor
+
+Add to `~/.cursor/mcp.json`:
 
 ```json
 {
@@ -81,92 +118,120 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
 
 ---
 
-## Facade Tools
+## Your first 5 minutes
+
+**1. Register a project.** Tools are scoped to a project, so this comes first. Just ask your assistant:
+
+> "Run `project_init` for this folder."
 
-All tools are accessed through **facade commands** — one tool per domain, with an `action` parameter to select the operation. For example: `sentinel` with action `create_issue`.
+That creates a `.decibel/` directory and registers the project. (Prefer files? Copy `projects.example.json` to `projects.json` and add your paths.)
+
+**2. Start using it.** Everything is plain-language — the assistant maps your request to the right tool:
+
+| You say… | What happens |
+|----------|--------------|
+| "Track a bug: the daemon doesn’t reconnect after sleep" | `sentinel` logs an issue |
+| "Record why we chose Postgres over SQLite" | `architect` writes an ADR |
+| "This build step keeps breaking — log it" | `friction` captures the pain point |
+| "What should I work on next?" | `oracle` returns prioritized actions |
+| "How healthy is this project?" | `workflow status` / `oracle` report |
+
+**3. Come back later.** In a brand-new session, ask *"what’s open and what should I work on?"* — and the assistant reads back everything from `.decibel/`. That’s the whole point.
+
+> 💡 **Tip:** Add a short note to your `CLAUDE.md` (Claude Code) or project instructions (Claude Desktop) telling the assistant to prefer Decibel tools for tracking work — so it reaches for them automatically.
+
+---
 
-### Core (always available)
+## The tools
 
-| Facade | Domain | Key Actions |
+Every tool is a **facade**: one tool per domain, with an `action` parameter selecting the operation (e.g. `sentinel` + action `create_issue`).
+
+### Core — always available
+
+| Facade | Domain | Key actions |
 |--------|--------|-------------|
 | **sentinel** | Work tracking | `create_issue`, `close_issue`, `log_epic`, `list_epics`, `scan` |
-| **architect** | Decisions | `create_adr`, `create_policy`, `list_policies`, `compile_oversight` |
+| **architect** | Decisions (ADRs) | `create_adr`, `create_policy`, `list_policies`, `compile_oversight` |
 | **dojo** | Incubation | `add_wish`, `create_proposal`, `scaffold_experiment`, `run_experiment` |
-| **designer** | Design | `record_design_decision`, `crit`, `sync_tokens`, `review_figma` |
-| **oracle** | Recommendations | `next_actions`, `roadmap` |
+| **designer** | Design decisions | `record_design_decision`, `crit`, `sync_tokens`, `review_figma` |
+| **oracle** | Recommendations | `next_actions`, `portfolio_summary`, `roadmap` |
 | **roadmap** | Strategy | `get`, `list`, `get_health`, `link_epic`, `init` |
 | **git** | Git forensics | `history`, `changes`, `link_issue` |
 | **workflow** | Composites | `status`, `preflight`, `ship`, `investigate` |
-| **vector** | Agent runs | `track`, `drift`, `score` |
-| **context** | AI memory | `pin`, `unpin`, `list`, `refresh`, `event_append`, `event_search` |
+| **vector** | Agent run tracking | `track`, `drift`, `score` |
+| **context** | AI memory | `pin`, `unpin`, `list`, `event_append`, `event_search` |
 | **auditor** | Code quality | `health`, `refactor_score` |
 | **forecast** | Estimation | `estimate`, `decompose`, `capacity` |
 | **velocity** | Metrics | `trends`, `contributors` |
-| **coordinator** | Multi-agent | `lock`, `unlock`, `heartbeat`, `log`, `message` |
+| **coordinator** | Multi-agent locks | `lock`, `unlock`, `heartbeat`, `log`, `message` |
 | **swarm** | Agent sessions | `start_session`, `join_session`, `emit_signal`, `claim_signal` |
+| **peers** | Peer discovery | agent-to-agent presence & messaging |
+| **concepts** | Concept graph | relate and query project concepts |
 | **friction** | Pain points | `log`, `list`, `resolve`, `bump` |
 | **registry** | Projects | `add`, `remove`, `list`, `alias`, `init`, `status` |
 | **feedback** | Tool feedback | `submit`, `list` |
-| **learnings** | Knowledge | `append`, `list` |
+| **learnings** | Knowledge base | `append`, `list` |
 | **provenance** | Audit trail | `list` |
 | **bench** | Benchmarks | `run`, `compare` |
-| **guardian** | Security | `scan_deps`, `scan_secrets`, `scan_http`, `scan_config`, `report` |
+| **guardian** | Security scanning | `scan_deps`, `scan_secrets`, `scan_http`, `scan_config`, `report` |
 
-### Pro (requires license key)
+### Pro — requires a license key
 
-| Facade | Domain | Key Actions |
+| Facade | Domain | Key actions |
 |--------|--------|-------------|
 | **voice** | Voice inbox | `sync`, `list`, `process` |
 | **studio** | Creative assets | `generate_image`, `generate_video` |
 | **corpus** | Code patterns | `search`, `index` |
 | **agentic** | Config compilation | `compile_pack`, `render`, `lint`, `golden_eval` |
 
-> Add your license key to `~/.decibel/config.yaml` under `license.key` to enable pro features.
+> Add your license key to `~/.decibel/config.yaml` under `license.key` to unlock Pro. See [Configuration](#configuration--pro-license).
 
 ---
 
-## Daemon Mode
+## Daemon mode
 
-Run as a persistent background service with HTTP transport:
+Run Decibel as a persistent background service with an HTTP transport — useful when several clients (Desktop, Cursor, custom agents) should share one server and one set of `.decibel` data.
 
 ```bash
-# Start daemon (default port 4888)
+# Start the daemon (default 127.0.0.1:4888)
 npx @decibelsystems/tools --daemon
 
-# Dual mode: stdio + HTTP from one process
+# Both transports (stdio + HTTP) from one process
 npx @decibelsystems/tools --daemon --stdio
 
-# macOS launchd management
+# Manage it as a macOS launchd service (auto-start on login)
 npx @decibelsystems/tools --daemon install
 npx @decibelsystems/tools --daemon uninstall
 npx @decibelsystems/tools --daemon status
 ```
 
-The daemon includes log rotation, crash loop protection (5 crashes in 60s), graceful shutdown with request draining, and a `/health` endpoint.
+The daemon includes log rotation, crash-loop protection (5 crashes in 60s), graceful shutdown with request draining, and a `/health` endpoint. MCP clients connect at **`http://127.0.0.1:4888/mcp`**; check it’s alive with `curl http://127.0.0.1:4888/health`.
+
+---
 
-### Configuration
+## Configuration & Pro license
 
-Create `~/.decibel/config.yaml` to configure the daemon:
+Create `~/.decibel/config.yaml`:
 
 ```yaml
 daemon:
   port: 4888
-  host: localhost
-  auth_token: your-secret-token
+  host: 127.0.0.1
+  auth_token: your-secret-token   # optional; required for non-localhost
   log_max_size_mb: 10
   log_max_files: 3
   rate_limit_rpm: 60
 license:
-  key: your-license-key
+  key: your-license-key           # unlocks Pro facades
 ```
 
-CLI flags override config file values. Send `SIGHUP` to reload config without restarting.
+CLI flags override config-file values. Send `SIGHUP` to reload config without restarting.
 
 ---
 
-## Data Storage
+## Data storage
 
-Data is stored in project-local `.decibel/` folders:
+Everything lives in a project-local `.decibel/` folder — readable, diffable, commit-able:
 
 ```
 {project}/
@@ -186,39 +251,55 @@ Data is stored in project-local `.decibel/` folders:
     ├── learnings/       # Knowledge documents
     ├── context/         # Pinned facts, events
     ├── guardian/        # Security scan results, allowlists
-    └── voice/inbox/     # Voice messages
+    └── voice/inbox/     # Voice messages (Pro)
 ```
 
-## Environment Variables
+## Environment variables
 
 ### Core
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `DECIBEL_ENV` | `dev` | Environment (dev, staging, prod) |
+| `DECIBEL_ENV` | `dev` | Environment (`dev`, `staging`, `prod`) |
 | `DECIBEL_ORG` | `default` | Organization name |
 | `DECIBEL_MCP_ROOT` | `~/.decibel` | Global data storage root |
 | `DECIBEL_PROJECT_ROOT` | — | Current project root path |
 | `DECIBEL_REGISTRY_PATH` | — | Custom registry file location |
+| `DECIBEL_PRO` | — | Set to `1` to enable Pro facades in dev |
 
-### Optional Integrations
+### Optional integrations
 
-| Variable | Used By |
+| Variable | Used by |
 |----------|---------|
-| `SUPABASE_URL` | Voice inbox, swarm sessions |
-| `SUPABASE_SERVICE_KEY` | Supabase service role key |
+| `SUPABASE_URL` / `SUPABASE_SERVICE_KEY` | Voice inbox, swarm sessions |
 | `FIGMA_ACCESS_TOKEN` | Designer: `sync_tokens`, `review_figma` |
 | `OPENAI_API_KEY` | Studio: image generation |
 | `TOGETHER_API_KEY` | Studio: alternative image generation |
 
-## Privacy Policy
+---
+
+## Troubleshooting
 
-**Local Storage Only**: All project data is stored locally in `.decibel/` folders within your project directories. No data is sent to external servers by default.
+**Tools don’t show up in Claude Desktop.**
+1. You almost certainly hit the `PATH` problem — use the [`zsh -lc` wrapper](#claude-desktop), not a bare `npx`.
+2. **Fully quit** (⌘Q) and reopen — a closed window isn’t a restart.
+3. First launch downloads the package; wait 30–60s.
+4. Check the log: `~/Library/Logs/Claude/mcp-server-decibel-tools.log`.
+
+**`PROJECT_NOT_FOUND` errors.** Nothing’s registered yet — run `project_init` (or `registry add`) for your project before calling other tools.
+
+**Local server vs. hosted connector.** decibel-tools is a *local* MCP server — it’s configured in the JSON file and only appears once you add it there. It won’t show up in the connector *search* (that only lists Anthropic’s hosted catalog). Hosted connectors (GitHub, Gmail) are separate, account-scoped, and enabled per-app and per-conversation.
+
+**Pro facades missing.** They need a `license.key` in `~/.decibel/config.yaml` (or `DECIBEL_PRO=1` in dev).
+
+---
 
-**Optional Cloud Integrations**: Some tools optionally connect to external services when you explicitly configure API keys (Figma, Supabase, OpenAI). These are clearly marked with `openWorldHint: true` in their tool annotations.
+## Privacy
 
-**No Telemetry**: This MCP server does not collect telemetry, usage analytics, or any form of tracking data.
+- **Local storage only.** All project data stays in `.decibel/` folders in your repos. Nothing is sent anywhere by default.
+- **Optional cloud integrations** activate only when you configure API keys (Figma, Supabase, OpenAI) — marked `openWorldHint: true` in their tool annotations.
+- **No telemetry.** No usage analytics, no tracking.
 
 ## License
 
-MIT - [Decibel Systems](https://decibel.systems)
+MIT — [Decibel Systems](https://decibel.systems)

package/dist/agentCommands.d.ts

@@ -0,0 +1,11 @@
+export declare const ORG_ID: string;
+/**
+ * Settle a command from an SDK ack (POST /agents/commands/ack). The SDK ran
+ * onCommand and reports done|failed (+ optional result/error). We write it back to
+ * Core via service_role, org-scoped. Returns false if Supabase is unconfigured.
+ * Only 'done'|'failed' are accepted from an ack (the SDK can't set other states).
+ */
+export declare function settleCommandFromAck(id: string, status: 'done' | 'failed', result?: Record<string, unknown> | null, error?: string | null): Promise<boolean>;
+/** Start the command dispatcher loop. Returns a stop function. No-ops if Supabase unconfigured. */
+export declare function startCommandDispatcher(): () => void;
+//# sourceMappingURL=agentCommands.d.ts.map

package/dist/agentCommands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentCommands.d.ts","sourceRoot":"","sources":["../src/agentCommands.ts"],"names":[],"mappings":"AAyCA,eAAO,MAAM,MAAM,QAAuE,CAAC;AAoO3F;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,GAAG,QAAQ,EACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,IAAI,MAAM,IAAI,CAcnD"}

package/dist/agentCommands.js

@@ -0,0 +1,267 @@
+// ============================================================================
+// Agent-command dispatcher — HQ → agent control surface (Plan D, v1)
+// ============================================================================
+// The inverse of agentPresence: HQ (org admin) WRITES commands into
+// hq.agent_commands under RLS; this daemon picks up pending commands targeted at
+// sessions IT hosts and dispatches them, writing status/result back via
+// SERVICE_ROLE. v1 kinds (Ben-scoped, allowlisted): 'message' + 'request_status'.
+// No shell, no lifecycle. Contract co-designed with decibel-hq (hq.agent_commands
+// migration + cancel RPC + expire sweep). EPIC-0033.
+//
+// SAFETY: a 'message' is delivered to the target peer as untrusted-channel DATA
+// (via the claude-peers broker) — it is NOT an auto-executed instruction. The
+// daemon only transports it.
+//
+// ⚠️ LOAD-BEARING CROSS-ORG INVARIANT (per HQ /security-review):
+//   target_session_key / target_host are FREE TEXT on hq.agent_commands — HQ does
+//   NOT bind them to a same-org live session (keys churn). The ENTIRE cross-org
+//   targeting defense therefore rests on THIS query: it MUST filter on org_id
+//   FIRST (the org this daemon is authorized to serve), with target_host ==
+//   own hostname + target_session_key ∈ live registry as defense-in-depth.
+//   An org-A admin can write a row naming an org-B peer's guessable session_key,
+//   but that row carries org_id=A; as long as org-B's daemon only ever dispatches
+//   rows scoped to org B's org_id, the A-row never reaches B. DO NOT refactor this
+//   to key purely on (host, session_key) ignoring org_id — that opens cross-org
+//   targeting on a shared host.
+//
+// Other boundaries:
+//   - host-match: only dispatch commands whose target_host == this host.
+//   - expiry: skip expires_at < now; also call the DB sweep each cycle.
+//   - poll every 5s (robust; realtime is HQ's status view, not our pickup path).
+// ============================================================================
+import { createClient } from '@supabase/supabase-js';
+import { log } from './config.js';
+import { withRetryResult } from './supabaseRetry.js';
+import { enqueueCommand } from './agentInbox.js';
+import { resolveHost } from './agentPresence.js';
+const BROKER_URL = `http://127.0.0.1:${process.env.CLAUDE_PEERS_PORT ?? '7899'}`;
+// Exported so the HTTP inbox endpoints (httpServer.ts) org-scope drainCommands to
+// the same org this daemon serves — keeps the org-id-first invariant on the read path.
+export const ORG_ID = process.env.DECIBEL_ORG_ID || '1cb79e24-e06f-46c9-8a22-5ee025ffb0f4';
+const POLL_MS = 5_000;
+const ALLOWED_KINDS = new Set(['message', 'request_status']);
+// Ben-scoped staged rollout: the FIRST run dispatches request_status ONLY so he can
+// watch a read-only round-trip before any message reaches a live agent. 'message'
+// dispatch stays held (rows left pending → they expire) until DECIBEL_ENABLE_AGENT_MESSAGES=1.
+const MESSAGES_ENABLED = process.env.DECIBEL_ENABLE_AGENT_MESSAGES === '1';
+function serviceClient() {
+    const url = process.env.SUPABASE_URL;
+    const key = process.env.SUPABASE_SERVICE_KEY;
+    if (!url || !key)
+        return null;
+    return createClient(url, key, {
+        auth: { persistSession: false, autoRefreshToken: false },
+        db: { schema: 'hq' },
+    });
+}
+async function brokerListPeers() {
+    try {
+        const res = await fetch(`${BROKER_URL}/list-peers`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ requester_id: 'decibel-daemon', scope: 'machine' }),
+            signal: AbortSignal.timeout(2000),
+        });
+        if (!res.ok)
+            return [];
+        return (await res.json());
+    }
+    catch {
+        return [];
+    }
+}
+/** Send a peer message via the claude-peers broker. Returns ok + optional error. */
+async function brokerSend(to, message) {
+    try {
+        const res = await fetch(`${BROKER_URL}/send-message`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            // Broker contract: {from_id, to_id, text} (claude-peers broker.ts:280,
+            // shared/types.ts:59 — confirmed line-by-line by the claude-peers owner).
+            // from_id="decibel-daemon": a plainly NON-privileged relay label. Deliberately
+            // NOT "system" — a "system" sender reads to the receiving agent as a trusted/
+            // privileged directive, the OPPOSITE of the required posture (an HQ command is
+            // untrusted-channel DATA, not an auto-executed instruction). Human provenance
+            // rides in `text` ("HQ · <issuer>: ..."). FK is off in the broker so any
+            // from_id delivers; if FK is ever enabled, register decibel-daemon then.
+            body: JSON.stringify({ from_id: 'decibel-daemon', to_id: to, text: message }),
+            signal: AbortSignal.timeout(3000),
+        });
+        const body = (await res.json().catch(() => ({})));
+        return { ok: body.ok === true, error: body.error ?? (res.ok ? undefined : `HTTP ${res.status}`) };
+    }
+    catch (e) {
+        return { ok: false, error: e instanceof Error ? e.message : String(e) };
+    }
+}
+const TERMINAL = new Set(['done', 'failed', 'cancelled', 'expired']);
+async function settle(client, id, patch) {
+    // Stamp completed_at on terminal transitions so HQ can show completion timing.
+    if (typeof patch.status === 'string' && TERMINAL.has(patch.status) && !('completed_at' in patch)) {
+        patch = { ...patch, completed_at: new Date().toISOString() };
+    }
+    // org_id-scoped settle too — never update a row outside our authorized org.
+    const { error } = await client.from('agent_commands').update(patch).eq('id', id).eq('org_id', ORG_ID);
+    if (error)
+        log(`Commands: settle ${id} failed: ${error.message}`);
+}
+async function dispatchOne(client, cmd, peers, sdkSessions) {
+    // Defensive expiry + kind allowlist (DB also enforces, belt-and-suspenders).
+    if (cmd.expires_at && Date.parse(cmd.expires_at) < Date.now())
+        return;
+    if (!ALLOWED_KINDS.has(cmd.kind)) {
+        await settle(client, cmd.id, { status: 'failed', error: `unsupported kind '${cmd.kind}'` });
+        return;
+    }
+    // Staged rollout: hold 'message' until explicitly enabled. Leave the row pending
+    // (untouched) so it simply expires — do NOT settle, so it can dispatch later if
+    // messages are enabled before it expires.
+    if (cmd.kind === 'message' && !MESSAGES_ENABLED)
+        return;
+    const peer = peers.find((p) => p.id === cmd.target_session_key);
+    const isSdkSession = !peer && sdkSessions.has(cmd.target_session_key);
+    // Target not (yet) resolvable as either a broker peer OR a known SDK session.
+    // DON'T permanently fail it — a session that registers in the split-second after
+    // the command was issued would otherwise be lost on the first tick. Leave it
+    // 'pending' so the next tick re-checks; the DB expiry sweep terminates it (→
+    // 'expired') if the target never appears. (Race fix found via SDK e2e 2026-06-15.)
+    if (!peer && !isSdkSession) {
+        return; // leave pending; retried next tick, expires if truly absent
+    }
+    // SDK-runtime target (registered via /agents/register, NOT a claude-peers peer):
+    // it has no broker transport, so we don't resolve/deliver here. Enqueue it for the
+    // SDK to poll + ack (which settles the Core row). Mark 'delivered' so HQ sees
+    // pickup; the SDK ack flips it to done/failed. (request_status is treated the same
+    // way for SDK sessions — the SDK answers it via onCommand and acks with a result.)
+    if (isSdkSession) {
+        await settle(client, cmd.id, { status: 'delivered', delivered_at: new Date().toISOString() });
+        enqueueCommand(cmd.target_session_key, {
+            id: cmd.id,
+            org_id: cmd.org_id,
+            kind: cmd.kind,
+            payload: cmd.payload ?? {},
+            enqueued_at: Date.now(),
+        });
+        return;
+    }
+    // From here, peer is a live broker session. Mark delivered (picked up).
+    await settle(client, cmd.id, { status: 'delivered', delivered_at: new Date().toISOString() });
+    if (cmd.kind === 'request_status') {
+        await settle(client, cmd.id, {
+            status: 'done',
+            result: { summary: peer.summary || null, cwd: peer.cwd || null, last_seen: peer.last_seen, status: 'active' },
+        });
+        return;
+    }
+    // kind === 'message'
+    const text = cmd.payload?.text;
+    if (!text) {
+        await settle(client, cmd.id, { status: 'failed', error: 'message payload missing text' });
+        return;
+    }
+    const label = cmd.payload?.from_label ? `${cmd.payload.from_label}: ` : '';
+    const r = await brokerSend(cmd.target_session_key, `${label}${text}`);
+    if (r.ok) {
+        await settle(client, cmd.id, { status: 'done', result: { delivered: true } });
+    }
+    else {
+        await settle(client, cmd.id, { status: 'failed', error: r.error || 'broker send failed' });
+    }
+}
+async function tick(client) {
+    const host = resolveHost();
+    // DB-side sweep: flip pending->expired where past expiry (idempotent, service_role).
+    try {
+        await client.rpc('expire_stale_agent_commands');
+    }
+    catch { /* RPC optional/non-fatal */ }
+    // Pending commands for OUR org (primary cross-org filter — see invariant above),
+    // targeted at sessions THIS daemon hosts. withRetryResult smooths transient
+    // "fetch failed" blips (issue 2026-06-13) before giving up for this tick.
+    const { data, error } = await withRetryResult(() => client
+        .from('agent_commands')
+        .select('id,org_id,target_session_key,target_host,kind,payload,expires_at,status')
+        .eq('org_id', ORG_ID)
+        .eq('status', 'pending')
+        .eq('target_host', host), 'commands.poll');
+    if (error) {
+        log(`Commands: poll failed: ${error.message}`);
+        return;
+    }
+    const pending = (data ?? []);
+    if (pending.length === 0)
+        return;
+    // SDK runtimes hosting on this box (live, non-claude-code sessions): commands
+    // targeting these route to the in-daemon inbox for the SDK to poll+ack, instead
+    // of failing as "not found in live registry". org-id-first + host-match preserved.
+    const sdkSessions = await loadSdkSessions(client, host);
+    const peers = await brokerListPeers();
+    for (const cmd of pending) {
+        try {
+            await dispatchOne(client, cmd, peers, sdkSessions);
+        }
+        catch (e) {
+            log(`Commands: dispatch ${cmd.id} error: ${e instanceof Error ? e.message : String(e)}`);
+            await settle(client, cmd.id, { status: 'failed', error: 'dispatch exception' }).catch(() => { });
+        }
+    }
+}
+/**
+ * Live SDK-runtime session_keys this daemon hosts (org + host scoped, runtime not
+ * claude-code, status active). These receive commands via the inbox, not the broker.
+ */
+async function loadSdkSessions(client, host) {
+    const { data, error } = await withRetryResult(() => client
+        .from('agent_sessions')
+        .select('session_key,runtime,status')
+        .eq('org_id', ORG_ID)
+        .eq('host', host)
+        .eq('status', 'active')
+        .neq('runtime', 'claude-code'), 'commands.sdkSessions');
+    const set = new Set();
+    if (error)
+        log(`Commands: loadSdkSessions query error: ${error.message}`);
+    if (!error && data) {
+        for (const r of data)
+            set.add(r.session_key);
+    }
+    return set;
+}
+/**
+ * Settle a command from an SDK ack (POST /agents/commands/ack). The SDK ran
+ * onCommand and reports done|failed (+ optional result/error). We write it back to
+ * Core via service_role, org-scoped. Returns false if Supabase is unconfigured.
+ * Only 'done'|'failed' are accepted from an ack (the SDK can't set other states).
+ */
+export async function settleCommandFromAck(id, status, result, error) {
+    const client = serviceClient();
+    if (!client)
+        return false;
+    if (status !== 'done' && status !== 'failed')
+        return false;
+    const patch = { status };
+    if (result !== undefined && result !== null)
+        patch.result = result;
+    if (error !== undefined && error !== null)
+        patch.error = error;
+    await settle(client, id, patch);
+    return true;
+}
+/** Start the command dispatcher loop. Returns a stop function. No-ops if Supabase unconfigured. */
+export function startCommandDispatcher() {
+    const client = serviceClient();
+    if (!client) {
+        log('Commands: SUPABASE_URL/SERVICE_KEY not set — agent-command dispatcher disabled.');
+        return () => { };
+    }
+    log(`Commands: dispatcher started (5s poll of hq.agent_commands, host ${resolveHost()}, org ${ORG_ID}).`);
+    const run = () => {
+        tick(client).catch((e) => log(`Commands: tick error: ${e instanceof Error ? e.message : String(e)}`));
+    };
+    run();
+    const iv = setInterval(run, POLL_MS);
+    if (typeof iv.unref === 'function')
+        iv.unref();
+    return () => clearInterval(iv);
+}
+//# sourceMappingURL=agentCommands.js.map

package/dist/agentCommands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentCommands.js","sourceRoot":"","sources":["../src/agentCommands.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAC/E,oEAAoE;AACpE,iFAAiF;AACjF,wEAAwE;AACxE,kFAAkF;AAClF,kFAAkF;AAClF,qDAAqD;AACrD,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,6BAA6B;AAC7B,EAAE;AACF,iEAAiE;AACjE,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,iFAAiF;AACjF,kFAAkF;AAClF,mFAAmF;AACnF,gFAAgF;AAChF,gCAAgC;AAChC,EAAE;AACF,oBAAoB;AACpB,yEAAyE;AACzE,wEAAwE;AACxE,iFAAiF;AACjF,+EAA+E;AAE/E,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,UAAU,GAAG,oBAAoB,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,MAAM,EAAE,CAAC;AACjF,kFAAkF;AAClF,uFAAuF;AACvF,MAAM,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,sCAAsC,CAAC;AAC3F,MAAM,OAAO,GAAG,KAAK,CAAC;AACtB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAC7D,oFAAoF;AACpF,kFAAkF;AAClF,+FAA+F;AAC/F,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,GAAG,CAAC;AAqB3E,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC7C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;QAC5B,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;QACxD,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;KACrB,CAAC,CAAC;AACL,CAAC;AAGD,KAAK,UAAU,eAAe;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,aAAa,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAC1E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiB,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,OAAe;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,eAAe,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,uEAAuE;YACvE,0EAA0E;YAC1E,+EAA+E;YAC/E,8EAA8E;YAC9E,+EAA+E;YAC/E,8EAA8E;YAC9E,yEAAyE;YACzE,yEAAyE;YACzE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC7E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAqC,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IACpG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AAErE,KAAK,UAAU,MAAM,CAAC,MAAgB,EAAE,EAAU,EAAE,KAA8B;IAChF,+EAA+E;IAC/E,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,IAAI,KAAK,CAAC,EAAE,CAAC;QACjG,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC/D,CAAC;IACD,4EAA4E;IAC5E,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtG,IAAI,KAAK;QAAE,GAAG,CAAC,oBAAoB,EAAE,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAAgB,EAChB,GAAe,EACf,KAAmB,EACnB,WAAwB;IAExB,6EAA6E;IAC7E,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO;IACtE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,qBAAqB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAC5F,OAAO;IACT,CAAC;IAED,iFAAiF;IACjF,gFAAgF;IAChF,0CAA0C;IAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,gBAAgB;QAAE,OAAO;IAExD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,CAAC,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAEtE,8EAA8E;IAC9E,iFAAiF;IACjF,6EAA6E;IAC7E,6EAA6E;IAC7E,mFAAmF;IACnF,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3B,OAAO,CAAC,4DAA4D;IACtE,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,8EAA8E;IAC9E,mFAAmF;IACnF,mFAAmF;IACnF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC9F,cAAc,CAAC,GAAG,CAAC,kBAAkB,EAAE;YACrC,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAG,GAAG,CAAC,OAAmC,IAAI,EAAE;YACvD,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,wEAAwE;IACxE,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAE9F,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAClC,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,EAAE,OAAO,EAAE,IAAK,CAAC,OAAO,IAAI,IAAI,EAAE,GAAG,EAAE,IAAK,CAAC,GAAG,IAAI,IAAI,EAAE,SAAS,EAAE,IAAK,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;SACjH,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,qBAAqB;IACrB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC1F,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,MAAgB;IAClC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAE3B,qFAAqF;IACrF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;IAExC,iFAAiF;IACjF,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAC3C,GAAG,EAAE,CAAC,MAAM;SACT,IAAI,CAAC,gBAAgB,CAAC;SACtB,MAAM,CAAC,yEAAyE,CAAC;SACjF,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;SACpB,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;SACvB,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,EAC1B,eAAe,CAChB,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,0BAA0B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAiB,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,8EAA8E;IAC9E,gFAAgF;IAChF,mFAAmF;IACnF,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAExD,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,sBAAsB,GAAG,CAAC,EAAE,WAAW,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzF,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,MAAgB,EAAE,IAAY;IAC3D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAC3C,GAAG,EAAE,CAAC,MAAM;SACT,IAAI,CAAC,gBAAgB,CAAC;SACtB,MAAM,CAAC,4BAA4B,CAAC;SACpC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;SACpB,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC;SAChB,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;SACtB,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,EAChC,sBAAsB,CACvB,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,KAAK;QAAE,GAAG,CAAC,0CAA0C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,IAAsC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAU,EACV,MAAyB,EACzB,MAAuC,EACvC,KAAqB;IAErB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,KAAK,GAA4B,EAAE,MAAM,EAAE,CAAC;IAClD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IAC/D,MAAM,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,iFAAiF,CAAC,CAAC;QACvF,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAClB,CAAC;IACD,GAAG,CAAC,oEAAoE,WAAW,EAAE,SAAS,MAAM,IAAI,CAAC,CAAC;IAC1G,MAAM,GAAG,GAAG,GAAG,EAAE;QACf,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,yBAAyB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC;IACF,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,OAAQ,EAA6B,CAAC,KAAK,KAAK,UAAU;QAAG,EAA4B,CAAC,KAAK,EAAE,CAAC;IACtG,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AACjC,CAAC"}