@downcity/city 1.1.4 → 1.1.5

package/bin/rpc/Paths.js

@@ -1,36 +0,0 @@
-/**
- * Local RPC 路径工具。
- *
- * 关键点（中文）
- * - 本地受信任进程之间统一通过 IPC socket/pipe 通信。
- * - Unix 平台使用 city 全局 runtime 目录下的稳定 socket 文件，避免不同启动上下文
- *   的 `TMPDIR` 不一致，导致同一个 agent 被解析到两个不同 socket 路径。
- * - Windows 平台使用命名 pipe，并基于项目路径 hash 保证稳定唯一。
- */
-import crypto from "node:crypto";
-import path from "node:path";
-import { getCityRuntimeDirPath } from "../registry/CityPaths.js";
-function buildProjectDigest(projectRoot) {
-    return crypto
-        .createHash("sha1")
-        .update(path.resolve(projectRoot))
-        .digest("hex")
-        .slice(0, 16);
-}
-function buildWindowsPipeName(projectRoot) {
-    const digest = buildProjectDigest(projectRoot);
-    return `\\\\.\\pipe\\downcity-local-${digest}`;
-}
-function getLocalRpcUnixDirPath() {
-    return path.join(getCityRuntimeDirPath(), "local-rpc");
-}
-/**
- * 返回本地 RPC endpoint。
- */
-export function getLocalRpcEndpoint(projectRoot) {
-    if (process.platform === "win32") {
-        return buildWindowsPipeName(projectRoot);
-    }
-    return path.join(getLocalRpcUnixDirPath(), `downcity-local-${buildProjectDigest(projectRoot)}.sock`);
-}
-//# sourceMappingURL=Paths.js.map

package/bin/rpc/Paths.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"Paths.js","sourceRoot":"","sources":["../../src/rpc/Paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,SAAS,kBAAkB,CAAC,WAAmB;IAC7C,OAAO,MAAM;SACV,UAAU,CAAC,MAAM,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;SACjC,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,WAAmB;IAC/C,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,+BAA+B,MAAM,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,WAAW,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CACd,sBAAsB,EAAE,EACxB,kBAAkB,kBAAkB,CAAC,WAAW,CAAC,OAAO,CACzD,CAAC;AACJ,CAAC"}

package/bin/sandbox/MacOsSeatbeltSandbox.d.ts

@@ -1,16 +0,0 @@
-/**
- * macOS Seatbelt sandbox backend。
- *
- * 关键点（中文）
- * - 当前最小实现直接基于系统自带 `sandbox-exec`。
- * - 目标不是抽象完整 provider 体系，而是先把 shell 命令从“宿主机直跑”收敛成“带边界执行”。
- * - 边界只保留四类：路径、环境变量、网络、隔离后的 HOME/TMPDIR。
- */
-import type { SandboxSpawnParams, SandboxSpawnResult } from "../types/sandbox/SandboxRuntime.js";
-/**
- * 在 macOS seatbelt sandbox 中启动 shell 子进程。
- */
-export declare function spawnMacOsSeatbeltSandbox(params: SandboxSpawnParams & {
-    actualCwd: string;
-}): Promise<SandboxSpawnResult>;
-//# sourceMappingURL=MacOsSeatbeltSandbox.d.ts.map

package/bin/sandbox/MacOsSeatbeltSandbox.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"MacOsSeatbeltSandbox.d.ts","sourceRoot":"","sources":["../../src/sandbox/MacOsSeatbeltSandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,mCAAmC,CAAC;AAiI3C;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,kBAAkB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC,kBAAkB,CAAC,CA8C7B"}

package/bin/sandbox/MacOsSeatbeltSandbox.js

@@ -1,152 +0,0 @@
-/**
- * macOS Seatbelt sandbox backend。
- *
- * 关键点（中文）
- * - 当前最小实现直接基于系统自带 `sandbox-exec`。
- * - 目标不是抽象完整 provider 体系，而是先把 shell 命令从“宿主机直跑”收敛成“带边界执行”。
- * - 边界只保留四类：路径、环境变量、网络、隔离后的 HOME/TMPDIR。
- */
-import { spawn } from "node:child_process";
-import path from "node:path";
-import fs from "fs-extra";
-const DEFAULT_PATH_VALUE = "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
-function escapeSeatbeltString(value) {
-    return String(value || "").replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-}
-function dedupePaths(values) {
-    const seen = new Set();
-    const result = [];
-    for (const value of values) {
-        const normalized = path.resolve(String(value || "").trim());
-        if (!normalized || seen.has(normalized))
-            continue;
-        seen.add(normalized);
-        result.push(normalized);
-    }
-    return result;
-}
-function buildReadablePaths(params) {
-    return dedupePaths([
-        "/bin",
-        "/usr",
-        "/System",
-        "/etc",
-        "/dev",
-        "/Library",
-        "/opt/homebrew",
-        "/usr/local",
-        params.rootPath,
-        params.shellHomeDir,
-        params.shellTmpDir,
-        path.dirname(params.shellPath),
-    ]);
-}
-function buildWritablePaths(params) {
-    return dedupePaths([
-        ...params.config.writablePaths,
-        params.shellDir,
-        params.shellHomeDir,
-        params.shellTmpDir,
-    ]);
-}
-function buildNetworkRules(networkMode) {
-    if (networkMode === "restricted" || networkMode === "full") {
-        return ["(allow network-outbound)", "(allow network-inbound)"];
-    }
-    return [];
-}
-function buildSeatbeltProfile(params) {
-    const readablePaths = buildReadablePaths({
-        rootPath: params.config.rootPath,
-        shellPath: params.shellPath,
-        shellHomeDir: params.shellHomeDir,
-        shellTmpDir: params.shellTmpDir,
-    });
-    const writablePaths = buildWritablePaths({
-        ...params,
-        shellHomeDir: params.shellHomeDir,
-        shellTmpDir: params.shellTmpDir,
-    });
-    const lines = [
-        "(version 1)",
-        "(deny default)",
-        '(import "system.sb")',
-        "(allow process*)",
-        "(allow sysctl-read)",
-        "(allow file-read-metadata)",
-        ...readablePaths.map((value) => `(allow file-read* (subpath "${escapeSeatbeltString(value)}"))`),
-        ...writablePaths.map((value) => `(allow file-write* (subpath "${escapeSeatbeltString(value)}"))`),
-        ...buildNetworkRules(params.config.networkMode),
-    ];
-    // 关键点（中文）
-    // - `cwd` 需要显式出现在读集合里，否则很多命令刚启动时就会因为工作目录不可见而失败。
-    // - 这里单独追加，避免未来 rootPath 与 cwd 的关系变化时被遗漏。
-    if (!readablePaths.includes(params.actualCwd)) {
-        lines.push(`(allow file-read* (subpath "${escapeSeatbeltString(params.actualCwd)}"))`);
-    }
-    return `${lines.join("\n")}\n`;
-}
-function buildSandboxEnv(params) {
-    const env = {};
-    for (const key of params.config.envAllowlist) {
-        const value = params.baseEnv[key];
-        if (typeof value !== "string" || !value.trim())
-            continue;
-        env[key] = value;
-    }
-    for (const [key, value] of Object.entries(params.baseEnv)) {
-        if (!key.startsWith("DC_"))
-            continue;
-        if (typeof value !== "string" || !value.trim())
-            continue;
-        env[key] = value;
-    }
-    env.PATH = String(env.PATH || params.baseEnv.PATH || DEFAULT_PATH_VALUE);
-    env.HOME = params.shellHomeDir;
-    env.ZDOTDIR = params.shellHomeDir;
-    env.TMPDIR = params.shellTmpDir;
-    env.SHELL = params.shellPath;
-    return env;
-}
-/**
- * 在 macOS seatbelt sandbox 中启动 shell 子进程。
- */
-export async function spawnMacOsSeatbeltSandbox(params) {
-    const sandboxRootDir = path.join(params.shellDir, "sandbox");
-    const shellHomeDir = path.join(sandboxRootDir, "home");
-    const shellTmpDir = path.join(sandboxRootDir, "tmp");
-    const profilePath = path.join(sandboxRootDir, "profile.sb");
-    await fs.ensureDir(shellHomeDir);
-    await fs.ensureDir(shellTmpDir);
-    const profile = buildSeatbeltProfile({
-        ...params,
-        shellHomeDir,
-        shellTmpDir,
-    });
-    await fs.writeFile(profilePath, profile, "utf-8");
-    const child = spawn("sandbox-exec", [
-        "-f",
-        profilePath,
-        params.shellPath,
-        params.login ? "-lc" : "-c",
-        params.cmd,
-    ], {
-        cwd: params.actualCwd,
-        stdio: "pipe",
-        env: buildSandboxEnv({
-            ...params,
-            shellHomeDir,
-            shellTmpDir,
-        }),
-    });
-    child.stdout.setEncoding("utf8");
-    child.stderr.setEncoding("utf8");
-    return {
-        child,
-        cwd: params.actualCwd,
-        sandboxed: true,
-        backend: "macos-seatbelt",
-        networkMode: params.config.networkMode,
-    };
-}
-//# sourceMappingURL=MacOsSeatbeltSandbox.js.map

package/bin/sandbox/MacOsSeatbeltSandbox.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"MacOsSeatbeltSandbox.js","sourceRoot":"","sources":["../../src/sandbox/MacOsSeatbeltSandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,UAAU,CAAC;AAM1B,MAAM,kBAAkB,GACtB,gEAAgE,CAAC;AAEnE,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,WAAW,CAAC,MAAgB;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QAClD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAK3B;IACC,OAAO,WAAW,CAAC;QACjB,MAAM;QACN,MAAM;QACN,SAAS;QACT,MAAM;QACN,MAAM;QACN,UAAU;QACV,eAAe;QACf,YAAY;QACZ,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,YAAY;QACnB,MAAM,CAAC,WAAW;QAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,MAG3B;IACC,OAAO,WAAW,CAAC;QACjB,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa;QAC9B,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,YAAY;QACnB,MAAM,CAAC,WAAW;KACnB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAwD;IACjF,IAAI,WAAW,KAAK,YAAY,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3D,OAAO,CAAC,0BAA0B,EAAE,yBAAyB,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,oBAAoB,CAAC,MAI7B;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC;QACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;QAChC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,kBAAkB,CAAC;QACvC,GAAG,MAAM;QACT,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,aAAa;QACb,gBAAgB;QAChB,sBAAsB;QACtB,kBAAkB;QAClB,qBAAqB;QACrB,4BAA4B;QAC5B,GAAG,aAAa,CAAC,GAAG,CAClB,CAAC,KAAK,EAAE,EAAE,CAAC,+BAA+B,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAC3E;QACD,GAAG,aAAa,CAAC,GAAG,CAClB,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAC5E;QACD,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;KAChD,CAAC;IAEF,UAAU;IACV,gDAAgD;IAChD,0CAA0C;IAC1C,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,+BAA+B,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,MAGxB;IACC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,SAAS;QACzD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,SAAS;QACzD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC,CAAC;IACzE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;IAC/B,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC;IAClC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;IAChC,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;IAE7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAkD;IAElD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAE5D,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAEhC,MAAM,OAAO,GAAG,oBAAoB,CAAC;QACnC,GAAG,MAAM;QACT,YAAY;QACZ,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAElD,MAAM,KAAK,GAAG,KAAK,CACjB,cAAc,EACd;QACE,IAAI;QACJ,WAAW;QACX,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC3B,MAAM,CAAC,GAAG;KACX,EACD;QACE,GAAG,EAAE,MAAM,CAAC,SAAS;QACrB,KAAK,EAAE,MAAM;QACb,GAAG,EAAE,eAAe,CAAC;YACnB,GAAG,MAAM;YACT,YAAY;YACZ,WAAW;SACZ,CAAC;KACH,CACF,CAAC;IAEF,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAEjC,OAAO;QACL,KAAK;QACL,GAAG,EAAE,MAAM,CAAC,SAAS;QACrB,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,gBAAgB;QACzB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW;KACvC,CAAC;AACJ,CAAC"}

package/bin/sandbox/SandboxConfigResolver.d.ts

@@ -1,31 +0,0 @@
-/**
- * Sandbox 配置解析器。
- *
- * 关键点（中文）
- * - 这里负责把 `downcity.json` 中面向用户的最小配置，收敛成运行时可直接执行的绝对路径配置。
- * - 当前版本只服务 shell / CLI 这条命令执行链，不引入审批、profile 绑定或用户权限系统。
- * - 解析结果只回答一个问题：这次命令执行的 sandbox 边界是什么。
- */
-import type { AgentContext } from "@downcity/agent/types/agent/AgentContext.js";
-import type { ResolvedSandboxConfig } from "../types/sandbox/SandboxRuntime.js";
-/**
- * 判断目标路径是否位于根目录内，或与根目录本身相同。
- */
-export declare function isPathInsideRoot(rootPath: string, targetPath: string): boolean;
-/**
- * 解析当前请求最终使用的 sandbox 配置。
- */
-export declare function resolveSandboxConfig(context: AgentContext): ResolvedSandboxConfig;
-/**
- * 归一化 sandbox 内实际使用的工作目录。
- *
- * 说明（中文）
- * - sandbox 启用时，工作目录必须收敛在 `rootPath` 范围内。
- * - 超出项目根目录的 `cwd` 会被强制拉回 `rootPath`，避免宿主目录通过 `cwd` 泄漏回去。
- */
-export declare function resolveSandboxCwd(params: {
-    rootPath: string;
-    requestedCwd: string;
-    context: AgentContext;
-}): string;
-//# sourceMappingURL=SandboxConfigResolver.d.ts.map

package/bin/sandbox/SandboxConfigResolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SandboxConfigResolver.d.ts","sourceRoot":"","sources":["../../src/sandbox/SandboxConfigResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6CAA6C,CAAC;AAChF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AA0B/E;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAM9E;AAwCD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,YAAY,GAAG,qBAAqB,CAqBjF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,YAAY,CAAC;CACvB,GAAG,MAAM,CAUT"}

package/bin/sandbox/SandboxConfigResolver.js

@@ -1,113 +0,0 @@
-/**
- * Sandbox 配置解析器。
- *
- * 关键点（中文）
- * - 这里负责把 `downcity.json` 中面向用户的最小配置，收敛成运行时可直接执行的绝对路径配置。
- * - 当前版本只服务 shell / CLI 这条命令执行链，不引入审批、profile 绑定或用户权限系统。
- * - 解析结果只回答一个问题：这次命令执行的 sandbox 边界是什么。
- */
-import path from "node:path";
-const DEFAULT_ENV_ALLOWLIST = [
-    "PATH",
-    "LANG",
-    "TERM",
-    "COLORTERM",
-    "LC_ALL",
-    "LC_CTYPE",
-    "SHELL",
-    "USER",
-    "LOGNAME",
-];
-function normalizeEnvAllowlist(values) {
-    const seen = new Set();
-    const result = [];
-    for (const value of values || DEFAULT_ENV_ALLOWLIST) {
-        const normalized = String(value || "").trim();
-        if (!normalized || seen.has(normalized))
-            continue;
-        seen.add(normalized);
-        result.push(normalized);
-    }
-    return result;
-}
-/**
- * 判断目标路径是否位于根目录内，或与根目录本身相同。
- */
-export function isPathInsideRoot(rootPath, targetPath) {
-    const normalizedRoot = path.resolve(rootPath);
-    const normalizedTarget = path.resolve(targetPath);
-    if (normalizedRoot === normalizedTarget)
-        return true;
-    const relative = path.relative(normalizedRoot, normalizedTarget);
-    return Boolean(relative) && !relative.startsWith("..") && !path.isAbsolute(relative);
-}
-function normalizeWritablePaths(params) {
-    const { rootPath, writablePaths, context } = params;
-    const rawValues = Array.isArray(writablePaths) && writablePaths.length > 0
-        ? writablePaths
-        : [rootPath];
-    const seen = new Set();
-    const result = [];
-    for (const rawValue of rawValues) {
-        const normalizedValue = String(rawValue || "").trim();
-        if (!normalizedValue)
-            continue;
-        const resolvedPath = path.resolve(path.isAbsolute(normalizedValue) ? normalizedValue : path.join(rootPath, normalizedValue));
-        if (!isPathInsideRoot(rootPath, resolvedPath)) {
-            context.logger.warn("[sandbox] writable path ignored because it escapes project root", {
-                rootPath,
-                ignoredPath: normalizedValue,
-                resolvedPath,
-            });
-            continue;
-        }
-        if (seen.has(resolvedPath))
-            continue;
-        seen.add(resolvedPath);
-        result.push(resolvedPath);
-    }
-    if (result.length === 0) {
-        result.push(path.resolve(rootPath));
-    }
-    return result;
-}
-/**
- * 解析当前请求最终使用的 sandbox 配置。
- */
-export function resolveSandboxConfig(context) {
-    const rootPath = path.resolve(context.rootPath);
-    const projectConfig = context.config?.sandbox;
-    if (process.platform !== "darwin") {
-        throw new Error(`sandbox backend is required for shell execution, but current platform is unsupported: ${process.platform}`);
-    }
-    return {
-        backend: "macos-seatbelt",
-        rootPath,
-        envAllowlist: normalizeEnvAllowlist(projectConfig?.envAllowlist),
-        writablePaths: normalizeWritablePaths({
-            rootPath,
-            writablePaths: projectConfig?.writablePaths,
-            context,
-        }),
-        networkMode: projectConfig?.networkMode || "full",
-    };
-}
-/**
- * 归一化 sandbox 内实际使用的工作目录。
- *
- * 说明（中文）
- * - sandbox 启用时，工作目录必须收敛在 `rootPath` 范围内。
- * - 超出项目根目录的 `cwd` 会被强制拉回 `rootPath`，避免宿主目录通过 `cwd` 泄漏回去。
- */
-export function resolveSandboxCwd(params) {
-    const normalizedCwd = path.resolve(params.requestedCwd);
-    if (isPathInsideRoot(params.rootPath, normalizedCwd)) {
-        return normalizedCwd;
-    }
-    params.context.logger.warn("[sandbox] cwd escapes project root and was reset to rootPath", {
-        rootPath: params.rootPath,
-        requestedCwd: normalizedCwd,
-    });
-    return params.rootPath;
-}
-//# sourceMappingURL=SandboxConfigResolver.js.map

package/bin/sandbox/SandboxConfigResolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SandboxConfigResolver.js","sourceRoot":"","sources":["../../src/sandbox/SandboxConfigResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,MAAM,qBAAqB,GAAG;IAC5B,MAAM;IACN,MAAM;IACN,MAAM;IACN,WAAW;IACX,QAAQ;IACR,UAAU;IACV,OAAO;IACP,MAAM;IACN,SAAS;CACV,CAAC;AAEF,SAAS,qBAAqB,CAAC,MAAiB;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QAClD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,UAAkB;IACnE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,cAAc,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,sBAAsB,CAAC,MAI/B;IACC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACpD,MAAM,SAAS,GACb,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QACtD,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,CAAC,eAAe;YAAE,SAAS;QAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAC/B,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAC1F,CAAC;QACF,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;gBACrF,QAAQ;gBACR,WAAW,EAAE,eAAe;gBAC5B,YAAY;aACb,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,SAAS;QACrC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAqB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;IAE9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,yFAAyF,OAAO,CAAC,QAAQ,EAAE,CAC5G,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,QAAQ;QACR,YAAY,EAAE,qBAAqB,CAAC,aAAa,EAAE,YAAY,CAAC;QAChE,aAAa,EAAE,sBAAsB,CAAC;YACpC,QAAQ;YACR,aAAa,EAAE,aAAa,EAAE,aAAa;YAC3C,OAAO;SACR,CAAC;QACF,WAAW,EAAE,aAAa,EAAE,WAAW,IAAI,MAAM;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAIjC;IACC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;QACrD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE;QACzF,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,aAAa;KAC5B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC"}

package/bin/sandbox/SandboxRunner.d.ts

@@ -1,46 +0,0 @@
-/**
- * SandboxRunner 入口。
- *
- * 关键点（中文）
- * - 这里不实现完整的 session/read/write 协议，只负责 shell 子进程创建时统一进入 sandbox backend。
- * - 当前版本只接入 macOS seatbelt backend。
- * - shell 命令不再允许回退到宿主机普通子进程执行。
- */
-import type { AgentContext } from "@downcity/agent/types/agent/AgentContext.js";
-import type { SandboxSpawnResult } from "../types/sandbox/SandboxRuntime.js";
-/**
- * 启动 shell 子进程。
- */
-export declare function spawnShellProcess(params: {
-    context: AgentContext;
-    shellId: string;
-    shellDir: string;
-    cmd: string;
-    cwd: string;
-    shellPath: string;
-    login: boolean;
-    baseEnv: NodeJS.ProcessEnv;
-}): Promise<SandboxSpawnResult>;
-/**
- * 执行一次 one-shot sandbox 命令并等待结束。
- *
- * 关键点（中文）
- * - 供 task script 这类“直接执行命令但不需要 shell session 管理”的路径复用。
- * - 非零退出码会直接抛错，行为与原先 `execa(..., { reject: true })` 保持一致。
- */
-export declare function runSandboxCommand(params: {
-    context: AgentContext;
-    shellId: string;
-    shellDir: string;
-    cmd: string;
-    cwd: string;
-    shellPath: string;
-    login: boolean;
-    baseEnv: NodeJS.ProcessEnv;
-}): Promise<{
-    stdout: string;
-    stderr: string;
-    exitCode: number;
-    spawn: SandboxSpawnResult;
-}>;
-//# sourceMappingURL=SandboxRunner.d.ts.map

package/bin/sandbox/SandboxRunner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SandboxRunner.d.ts","sourceRoot":"","sources":["../../src/sandbox/SandboxRunner.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6CAA6C,CAAC;AAChF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAI5E;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;CAC5B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkB9B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;CAC5B,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,kBAAkB,CAAC;CAC3B,CAAC,CAiCD"}

package/bin/sandbox/SandboxRunner.js

@@ -1,70 +0,0 @@
-/**
- * SandboxRunner 入口。
- *
- * 关键点（中文）
- * - 这里不实现完整的 session/read/write 协议，只负责 shell 子进程创建时统一进入 sandbox backend。
- * - 当前版本只接入 macOS seatbelt backend。
- * - shell 命令不再允许回退到宿主机普通子进程执行。
- */
-import { resolveSandboxConfig, resolveSandboxCwd } from "../sandbox/SandboxConfigResolver.js";
-import { spawnMacOsSeatbeltSandbox } from "../sandbox/MacOsSeatbeltSandbox.js";
-/**
- * 启动 shell 子进程。
- */
-export async function spawnShellProcess(params) {
-    const config = resolveSandboxConfig(params.context);
-    const actualCwd = resolveSandboxCwd({
-        rootPath: config.rootPath,
-        requestedCwd: params.cwd,
-        context: params.context,
-    });
-    return spawnMacOsSeatbeltSandbox({
-        shellId: params.shellId,
-        shellDir: params.shellDir,
-        cmd: params.cmd,
-        cwd: params.cwd,
-        shellPath: params.shellPath,
-        login: params.login,
-        baseEnv: params.baseEnv,
-        config,
-        actualCwd,
-    });
-}
-/**
- * 执行一次 one-shot sandbox 命令并等待结束。
- *
- * 关键点（中文）
- * - 供 task script 这类“直接执行命令但不需要 shell session 管理”的路径复用。
- * - 非零退出码会直接抛错，行为与原先 `execa(..., { reject: true })` 保持一致。
- */
-export async function runSandboxCommand(params) {
-    const spawn = await spawnShellProcess(params);
-    const stdoutChunks = [];
-    const stderrChunks = [];
-    spawn.child.stdout.on("data", (chunk) => {
-        stdoutChunks.push(String(chunk ?? ""));
-    });
-    spawn.child.stderr.on("data", (chunk) => {
-        stderrChunks.push(String(chunk ?? ""));
-    });
-    const exitCode = await new Promise((resolve, reject) => {
-        spawn.child.on("error", (error) => reject(error));
-        spawn.child.on("close", (code) => resolve(typeof code === "number" ? code : -1));
-    });
-    const stdout = stdoutChunks.join("");
-    const stderr = stderrChunks.join("");
-    if (exitCode !== 0) {
-        const message = [stdout.trim(), stderr.trim()]
-            .filter(Boolean)
-            .join("\n")
-            .trim();
-        throw new Error(message || `Sandbox command failed with exit code ${exitCode}`);
-    }
-    return {
-        stdout,
-        stderr,
-        exitCode,
-        spawn,
-    };
-}
-//# sourceMappingURL=SandboxRunner.js.map

package/bin/sandbox/SandboxRunner.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SandboxRunner.js","sourceRoot":"","sources":["../../src/sandbox/SandboxRunner.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MASvC;IACC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,iBAAiB,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,GAAG;QACxB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,OAAO,yBAAyB,CAAC;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM;QACN,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MASvC;IAMC,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;QACvD,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;QACvD,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7D,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aAC3C,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,IAAI,CAAC;aACV,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,yCAAyC,QAAQ,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO;QACL,MAAM;QACN,MAAM;QACN,QAAQ;QACR,KAAK;KACN,CAAC;AACJ,CAAC"}

package/bin/store/StoreChannelAccountRepository.d.ts

@@ -1,34 +0,0 @@
-/**
- * ConsoleStore 渠道账号仓储。
- *
- * 关键点（中文）
- * - 统一管理 `channel_accounts` 表。
- * - 负责敏感字段解密/加密与 channel account 的语义化组装。
- */
-import type { StoredChannelAccount, UpsertChannelAccountInput } from "../types/store/Store.js";
-import type { ConsoleStoreContext } from "./StoreShared.js";
-/**
- * 同步列出 channel accounts。
- */
-export declare function listChannelAccountsSync(context: ConsoleStoreContext, channelInput?: string): StoredChannelAccount[];
-/**
- * 同步按 ID 获取 channel account。
- */
-export declare function getChannelAccountSync(context: ConsoleStoreContext, accountIdInput: string): StoredChannelAccount | null;
-/**
- * 异步列出 channel accounts。
- */
-export declare function listChannelAccounts(context: ConsoleStoreContext, channelInput?: string): Promise<StoredChannelAccount[]>;
-/**
- * 异步按 ID 获取 channel account。
- */
-export declare function getChannelAccount(context: ConsoleStoreContext, accountIdInput: string): Promise<StoredChannelAccount | null>;
-/**
- * 新增或更新 channel account。
- */
-export declare function upsertChannelAccount(context: ConsoleStoreContext, input: UpsertChannelAccountInput): Promise<void>;
-/**
- * 删除 channel account。
- */
-export declare function removeChannelAccount(context: ConsoleStoreContext, accountIdInput: string): void;
-//# sourceMappingURL=StoreChannelAccountRepository.d.ts.map

package/bin/store/StoreChannelAccountRepository.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"StoreChannelAccountRepository.d.ts","sourceRoot":"","sources":["../../src/store/StoreChannelAccountRepository.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAQ5D;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,mBAAmB,EAC5B,YAAY,CAAC,EAAE,MAAM,GACpB,oBAAoB,EAAE,CA8BxB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,mBAAmB,EAC5B,cAAc,EAAE,MAAM,GACrB,oBAAoB,GAAG,IAAI,CAI7B;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,mBAAmB,EAC5B,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,EAAE,CAAC,CA8BjC;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,mBAAmB,EAC5B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAItC;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,IAAI,CAAC,CA4Df;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,mBAAmB,EAC5B,cAAc,EAAE,MAAM,GACrB,IAAI,CAGN"}