@gaunt-sloth/agent 2.0.0-alpha.3 → 2.0.0-alpha.30

package/dist/tools/gthGrepTool.js

@@ -0,0 +1,482 @@
+/**
+ * @module gthGrepTool
+ * The `gth_grep` content-search tool — a structured, permission-light regex search over file
+ * CONTENTS. Complements `search_files` (which only matches file NAMES) and gives the lean agent a
+ * grep primitive without falling back to the shell-approval-gated `run_shell_command`. Being a
+ * built-in (not a dev tool) it is available in every mode, unlike `run_shell_command`.
+ *
+ * Two execution paths, ONE output shape:
+ *  - shell out to ripgrep (`rg`) when it is on PATH;
+ *  - fall back to an in-process JS scanner when `rg` is absent (CI machines may not have ripgrep).
+ * Both sandbox to the current work-dir boundary ({@link getCurrentWorkDir}), bound each matching
+ * line's preview, cap the total match count, and enforce the `.aiignore` privacy boundary on BOTH
+ * engines ({@link makeAiignoreFilter}) — since the tool reads file contents through its own path, it
+ * must honour `.aiignore` itself rather than rely on the filesystem toolkit.
+ *
+ * Named `gth_grep`, NOT `grep`: the experimental deep backend (deepagents) registers its own `grep`
+ * built-in and `createDeepAgent` throws on a name collision because both backends share the resolved
+ * toolset — the same reason {@link file://./gthChecklistTool.ts} is not called `write_todos`.
+ */
+import { tool } from '@langchain/core/tools';
+import { z } from 'zod';
+import { execFile } from 'node:child_process';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { normalizeBuiltInTools } from '@gaunt-sloth/core/config.js';
+import { getCurrentWorkDir } from '@gaunt-sloth/core/utils/systemUtils.js';
+import { shouldIgnoreFile } from '@gaunt-sloth/core/utils/aiignoreUtils.js';
+export const GREP_TOOL_NAME = 'gth_grep';
+/**
+ * Resolve the effective {@link GrepFileSet} from config. Reads the `gth_grep` entry of the SAME
+ * `builtInTools` registry that {@link file://../builtInToolsConfig.ts} uses to decide enablement, so
+ * the corpus selection and the tool's presence resolve from one source. Defaults to `gitignore`
+ * (the coordinator-set default, and already rg's native default — so rg-present machines see no
+ * behaviour change; only the selection becomes explicit).
+ */
+export function resolveGrepFileSet(config) {
+    const entry = normalizeBuiltInTools(config?.builtInTools)[GREP_TOOL_NAME];
+    if (entry && typeof entry === 'object' && entry.fileSet === 'all')
+        return 'all';
+    return 'gitignore';
+}
+/**
+ * Build the `.aiignore` privacy filter for a grep run.
+ *
+ * SECURITY (GS2-51): `gth_grep` reads file CONTENTS through its OWN ripgrep / `fs.readFile` path,
+ * so — unlike the gsloth filesystem toolkit — it must enforce `.aiignore` ITSELF. Otherwise, being
+ * on by default, it would be a default-on bypass of that boundary on BOTH backends: the deep backend
+ * deliberately disables its fs toolkit precisely so a model cannot read an `.aiignore`-protected file
+ * (see {@link file://../core/GthDeepAgent.ts}), and `gth_grep` would re-open exactly that hole.
+ * `.gitignore` means "don't commit" (build junk); `.aiignore` means "don't let the AI read this,
+ * even though it is a real tracked file" — so an `.aiignore`'d-but-tracked-and-not-hidden file is the
+ * PRIMARY case, and is enforced on BOTH engines and under BOTH {@link GrepFileSet} corpora (the
+ * privacy boundary is orthogonal to the gitignore/all selection).
+ *
+ * Reuses the SAME {@link shouldIgnoreFile} matcher and the SAME rootDir (the work-dir) the fs toolkit
+ * uses, so a file is treated identically here as there — no hand-rolled `.aiignore` parsing.
+ *
+ * @returns predicate that is TRUE when `absPath` is ALLOWED (not aiignored).
+ */
+function makeAiignoreFilter(workDir, aiignore) {
+    return (absPath) => !shouldIgnoreFile(absPath, workDir, aiignore?.patterns, aiignore?.enabled);
+}
+/** Default cap on the number of matches returned when the caller does not pass `limit`. */
+const DEFAULT_LIMIT = 100;
+/** Noise directories both paths skip: the JS fallback walk, and rg via `--glob !<dir>` excludes. */
+const IGNORED_DIRS = new Set(['.git', 'node_modules', 'dist', '.idea']);
+/** Longest matching-line preview kept before truncation, so one minified line can't blow context. */
+const MAX_LINE_LENGTH = 250;
+const TRUNCATION_MARKER = ' … (line truncated)';
+/**
+ * JS-fallback only: cap the length of text fed to the regex per line. A single huge/minified line
+ * would otherwise let a model-supplied pattern block the event loop (large linear scans, and
+ * catastrophic backtracking grows with input length). rg (native, non-backtracking) is immune, so
+ * this bounds the fallback only. Matches beyond the cap on such a line are not found.
+ */
+const MAX_SCAN_LINE_LENGTH = 4096;
+/** Ceiling on rg stdout we buffer (matches are sliced to `limit` anyway). */
+const RG_MAX_BUFFER = 32 * 1024 * 1024;
+const schema = z.object({
+    pattern: z.string().min(1).describe('Regular expression to search file CONTENTS for.'),
+    path: z
+        .string()
+        .optional()
+        .describe('Relative directory or file to search, within the working directory. Defaults to the ' +
+        'current working directory.'),
+    include: z
+        .string()
+        .optional()
+        .describe('Optional file glob to filter matched files, e.g. "*.ts" or "*.{ts,tsx}".'),
+    limit: z
+        .number()
+        .int()
+        .min(1)
+        .optional()
+        .describe(`Maximum number of matches to return (default ${DEFAULT_LIMIT}).`),
+});
+const description = [
+    'Search file CONTENTS by regular expression (ripgrep-backed, with an in-process fallback).',
+    'Use this to find WHERE a symbol, string, or pattern appears across files — unlike search_files,',
+    'which matches file NAMES only. Returns matching files with 1-based line numbers and a bounded',
+    'preview of each matching line.',
+    '',
+    'Args: pattern (regex, required); path (relative dir/file, defaults to the working directory);',
+    'include (file glob such as "*.ts" or "*.{ts,tsx}"); limit (max matches). Searches are confined',
+    'to the working directory.',
+].join('\n');
+/** Error whose message is safe to return to the model as the tool observation. */
+class GrepError extends Error {
+}
+/** Sentinel: `rg` is not installed — the orchestrator must use the JS fallback. */
+class RipgrepUnavailableError extends Error {
+}
+/** Truncate an over-long matching-line preview with a clear marker. */
+function truncateLine(text) {
+    if (text.length <= MAX_LINE_LENGTH)
+        return text;
+    return text.slice(0, MAX_LINE_LENGTH) + TRUNCATION_MARKER;
+}
+/**
+ * Render matches in the concise, opencode-style grouped form. Shared by BOTH execution paths so
+ * the rg and JS-fallback outputs are provably identical.
+ */
+export function formatGrepOutput(matches) {
+    if (matches.length === 0)
+        return 'No matches found';
+    const lines = [`Found ${matches.length} matches`];
+    let currentPath = '';
+    for (const m of matches) {
+        if (m.path !== currentPath) {
+            if (currentPath)
+                lines.push('');
+            currentPath = m.path;
+            lines.push(`${m.path}:`);
+        }
+        lines.push(`  Line ${m.line}: ${truncateLine(m.text)}`);
+    }
+    return lines.join('\n');
+}
+/** rg prints `./foo` for the cwd root; normalise to bare relative paths to match the JS scanner. */
+function normalizeRelPath(p) {
+    return p.startsWith('./') ? p.slice(2) : p;
+}
+/** Escape the literal parts of a glob for use inside a RegExp. */
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Compile an include glob (matched against a file's basename in the JS fallback) to a RegExp.
+ * Supports `*`, `?`, and `{a,b,c}` brace alternation, e.g. `*.ts`, `*.{ts,tsx}`.
+ *
+ * NOTE (rg-vs-JS divergence): this matches the basename only, whereas rg applies `--glob` with full
+ * gitignore-style path-glob semantics (a glob can match against the path, not just the basename).
+ * For the common `*.ext` case the two agree; more elaborate globs may differ between the two paths.
+ */
+export function globToRegExp(glob) {
+    let re = '';
+    let i = 0;
+    while (i < glob.length) {
+        const c = glob[i];
+        if (c === '*') {
+            re += '[^/]*';
+        }
+        else if (c === '?') {
+            re += '[^/]';
+        }
+        else if (c === '{') {
+            const end = glob.indexOf('}', i);
+            if (end === -1) {
+                re += '\\{';
+            }
+            else {
+                const options = glob
+                    .slice(i + 1, end)
+                    .split(',')
+                    .map(escapeRegExp);
+                re += '(?:' + options.join('|') + ')';
+                i = end + 1;
+                continue;
+            }
+        }
+        else {
+            re += escapeRegExp(c);
+        }
+        i++;
+    }
+    return new RegExp('^' + re + '$');
+}
+/**
+ * Resolve a path to its real, symlink-free location, walking up to the nearest EXISTING ancestor
+ * when the path itself does not exist yet. Only an existing component can be (or sit behind) a
+ * symlink, so resolving the nearest real ancestor is enough to catch an intermediate symlinked
+ * directory. Terminates because `path.dirname` strictly shortens the path to the filesystem root.
+ */
+async function realpathNearestExisting(absPath) {
+    let current = absPath;
+    for (;;) {
+        try {
+            return await fs.realpath(current);
+        }
+        catch {
+            const parent = path.dirname(current);
+            if (parent === current)
+                return current; // filesystem root; nothing left to resolve
+            current = parent;
+        }
+    }
+}
+/** True when `child` equals `root` or is a descendant of it. */
+function isWithin(child, root) {
+    return child === root || child.startsWith(`${root}${path.sep}`);
+}
+/**
+ * Resolve `path` under the working directory and refuse anything that escapes it. The whole tool
+ * is sandboxed to this boundary.
+ */
+async function resolveTarget(inputPath, workDir) {
+    const absWorkDir = path.resolve(workDir);
+    const requested = path.resolve(absWorkDir, inputPath ?? '.');
+    const rel = path.relative(absWorkDir, requested);
+    if (rel.startsWith('..') || path.isAbsolute(rel)) {
+        throw new GrepError(`Refusing to search '${inputPath}': path escapes the working directory (${absWorkDir}).`);
+    }
+    // Symlink containment: the lexical check above cannot catch a symlink INSIDE the workdir that
+    // points outside it (rel would not start with `..`, and stat/rg/the walk would then follow it out
+    // of the sandbox). Resolve real paths and re-assert containment. The workdir root is realpath'd
+    // too, since its own path may contain symlinks (e.g. /tmp -> /private/tmp). A not-yet-existing
+    // target resolves via its nearest existing ancestor, so a missing path is contained here and then
+    // reported as "not found" by the stat below, rather than crashing.
+    const realRoot = await realpathNearestExisting(absWorkDir);
+    const realTarget = await realpathNearestExisting(requested);
+    if (!isWithin(realTarget, realRoot)) {
+        throw new GrepError(`Refusing to search '${inputPath}': path escapes the working directory (${absWorkDir}).`);
+    }
+    let stat;
+    try {
+        stat = await fs.stat(requested);
+    }
+    catch {
+        throw new GrepError(`Path not found: ${inputPath ?? '.'}`);
+    }
+    if (stat.isDirectory()) {
+        return { searchRoot: requested };
+    }
+    return { searchRoot: path.dirname(requested), file: path.basename(requested) };
+}
+/** Parse ripgrep's `path:line:text` output (with `--with-filename --line-number --no-heading`). */
+function parseRipgrepOutput(stdout) {
+    const matches = [];
+    for (const raw of stdout.split('\n')) {
+        if (!raw)
+            continue;
+        const first = raw.indexOf(':');
+        if (first < 0)
+            continue;
+        const second = raw.indexOf(':', first + 1);
+        if (second < 0)
+            continue;
+        const lineNum = Number(raw.slice(first + 1, second));
+        if (!Number.isInteger(lineNum))
+            continue;
+        matches.push({
+            path: normalizeRelPath(raw.slice(0, first)),
+            line: lineNum,
+            text: raw.slice(second + 1),
+        });
+    }
+    return matches;
+}
+function buildRipgrepArgs(pattern, target, include, fileSet) {
+    // GS2-51 — the searched corpus is a resolved config choice ({@link GrepFileSet}), applied
+    // consistently to both engines. `gitignore` (default) keeps rg's native behaviour: honour
+    // `.gitignore`/`.ignore` and skip hidden dot-files — so nothing is added here. `all` scans
+    // everything but the noise dirs, so pass `--no-ignore --hidden` (the IGNORED_DIRS excludes below
+    // still apply). NOTE (residual rg-vs-JS divergence): under `gitignore` the JS fallback
+    // ({@link collectFiles}) is only a best-effort approximation (skips IGNORED_DIRS + hidden
+    // dot-files); it does NOT read arbitrary `.gitignore` rules the way rg does, so the searched
+    // file-set can still differ when rg is absent. A full gitignore parser is deliberately out of
+    // scope — see the note on {@link collectFiles}.
+    const args = ['--line-number', '--no-heading', '--with-filename', '--color=never'];
+    if (fileSet === 'all') {
+        args.push('--no-ignore', '--hidden');
+    }
+    // Exclude the same noise dirs the JS fallback skips, so the two paths stay consistent. rg only
+    // auto-skips node_modules etc. when a .gitignore says so; outside a git repo (or under
+    // `--no-ignore`) it descends into them, so we exclude them explicitly here.
+    for (const dir of IGNORED_DIRS) {
+        args.push('--glob', `!${dir}`);
+    }
+    if (include) {
+        args.push('--glob', include);
+    }
+    args.push('-e', pattern, '--', target.file ?? '.');
+    return args;
+}
+/**
+ * Run ripgrep. Resolves to matches (empty on rg exit 1 = "no matches"). Rejects with
+ * {@link RipgrepUnavailableError} when `rg` is not on PATH, or {@link GrepError} on a real rg error
+ * (e.g. an invalid regex → rg exit 2).
+ */
+function runRipgrep(pattern, target, include, fileSet, isAllowed) {
+    const args = buildRipgrepArgs(pattern, target, include, fileSet);
+    return new Promise((resolve, reject) => {
+        execFile('rg', args, { cwd: target.searchRoot, maxBuffer: RG_MAX_BUFFER }, (error, stdout, stderr) => {
+            if (error) {
+                const code = error
+                    .code;
+                if (code === 'ENOENT') {
+                    reject(new RipgrepUnavailableError('ripgrep (rg) not found on PATH'));
+                    return;
+                }
+                // rg exit code 1 == no matches (execFile surfaces the non-zero exit as an error).
+                if (code === 1) {
+                    resolve([]);
+                    return;
+                }
+                const detail = (stderr ?? '').toString().trim();
+                reject(new GrepError(`Search failed: ${detail || error.message}`));
+                return;
+            }
+            // rg does not consult `.aiignore` — post-filter its matched paths through the SAME hook the
+            // JS fallback uses, so both engines enforce the privacy boundary identically. A match whose
+            // file is aiignored is dropped before it can reach the model.
+            resolve(parseRipgrepOutput(stdout.toString()).filter((m) => isAllowed(path.join(target.searchRoot, m.path))));
+        });
+    });
+}
+/**
+ * Recursively collect regular files under `dir`, skipping {@link IGNORED_DIRS}. Symlinked entries
+ * (dirs and files) report `isDirectory()`/`isFile()` as false here, so the walk never follows them
+ * out of the sandbox — only the explicit target path needs the realpath guard in {@link resolveTarget}.
+ *
+ * GS2-51 — corpus selection ({@link GrepFileSet}), applied consistently with the rg path:
+ * - `skipHidden` true (the `gitignore` default): additionally skip hidden dot-files/dirs, moving the
+ *   fallback CLOSER to rg's default of honouring `.gitignore` + hiding dot-files;
+ * - `skipHidden` false (`all`): skip only IGNORED_DIRS — everything-but-noise (the historical
+ *   behaviour), matching rg's `--no-ignore --hidden`.
+ *
+ * NOTE (residual rg-vs-JS divergence — deliberate, bounded scope): even under `gitignore` this is
+ * only a best-effort approximation. It does NOT parse arbitrary `.gitignore`/`.ignore` rules the way
+ * rg does — a file gitignored by a custom pattern (but not a dot-file and not under IGNORED_DIRS) is
+ * still searched by the fallback though rg would skip it. Implementing a full gitignore engine here
+ * is out of scope; this is documented, not fixed — exactly like the regex-dialect divergence noted
+ * in {@link runJsScanner}.
+ */
+async function collectFiles(dir, out, skipHidden) {
+    let entries;
+    try {
+        entries = (await fs.readdir(dir, { withFileTypes: true }));
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        // Hidden-skip is checked first so it covers BOTH hidden files and hidden dirs.
+        if (skipHidden && entry.name.startsWith('.'))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (IGNORED_DIRS.has(entry.name))
+                continue;
+            await collectFiles(full, out, skipHidden);
+        }
+        else if (entry.isFile()) {
+            out.push(full);
+        }
+    }
+}
+/**
+ * In-process fallback used when `rg` is absent: walk files under the target (respecting `include`
+ * and the ignore list) and apply the regex per line. Produces the identical {@link GrepMatch} shape
+ * as the ripgrep path.
+ */
+async function runJsScanner(pattern, target, include, limit, fileSet, isAllowed) {
+    let regex;
+    try {
+        // NOTE (rg-vs-JS divergence): the fallback uses the ECMAScript regex dialect (`new RegExp`),
+        // whereas rg uses the Rust `regex` crate. Host-specific features differ — notably lookaround
+        // and backreferences work here but are unsupported by rg — so the same pattern can behave
+        // differently depending on which path runs.
+        regex = new RegExp(pattern);
+    }
+    catch (e) {
+        throw new GrepError(`Search failed: invalid regular expression: ${e.message}`);
+    }
+    const includeRe = include ? globToRegExp(include) : undefined;
+    const files = [];
+    if (target.file) {
+        // An explicitly-named target file is searched even if it is a hidden dot-file — the corpus
+        // selection only governs directory discovery, matching rg's behaviour on an explicit arg. The
+        // one exception is `.aiignore`: an aiignored file named by hand is still blocked below (hidden ≠
+        // aiignored), so naming the file cannot be used as a bypass.
+        files.push(path.join(target.searchRoot, target.file));
+    }
+    else {
+        await collectFiles(target.searchRoot, files, fileSet === 'gitignore');
+    }
+    const matches = [];
+    for (const file of files) {
+        if (matches.length >= limit)
+            break;
+        if (includeRe && !includeRe.test(path.basename(file)))
+            continue;
+        // `.aiignore` privacy boundary (GS2-51): skip BEFORE reading, so an aiignored file's contents
+        // are never even loaded — covers both the walk and an explicitly-named single-file target.
+        if (!isAllowed(file))
+            continue;
+        let content;
+        try {
+            content = await fs.readFile(file, 'utf8');
+        }
+        catch {
+            continue; // unreadable / non-text; skip
+        }
+        const rel = normalizeRelPath(path.relative(target.searchRoot, file));
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            if (matches.length >= limit)
+                break;
+            const line = lines[i];
+            // Bound the regex input per line (see MAX_SCAN_LINE_LENGTH): a huge/minified line must not
+            // block the event loop. We test a truncated view but store the original line (its preview is
+            // bounded again at format time); a match beyond the cap on such a line is not reported.
+            const scanText = line.length > MAX_SCAN_LINE_LENGTH ? line.slice(0, MAX_SCAN_LINE_LENGTH) : line;
+            if (regex.test(scanText)) {
+                matches.push({ path: rel, line: i + 1, text: line });
+            }
+        }
+    }
+    return matches;
+}
+async function grepImpl(args, workDir, fileSet, aiignore) {
+    const limit = args.limit ?? DEFAULT_LIMIT;
+    let target;
+    try {
+        target = await resolveTarget(args.path, workDir);
+    }
+    catch (e) {
+        if (e instanceof GrepError)
+            return e.message;
+        throw e;
+    }
+    // The `.aiignore` privacy filter is resolved against the work-dir root (matching the fs toolkit)
+    // and enforced on whichever engine runs — see makeAiignoreFilter.
+    const isAllowed = makeAiignoreFilter(workDir, aiignore);
+    let matches;
+    try {
+        matches = await runRipgrep(args.pattern, target, args.include, fileSet, isAllowed);
+    }
+    catch (e) {
+        if (e instanceof RipgrepUnavailableError) {
+            try {
+                matches = await runJsScanner(args.pattern, target, args.include, limit, fileSet, isAllowed);
+            }
+            catch (inner) {
+                if (inner instanceof GrepError)
+                    return inner.message;
+                throw inner;
+            }
+        }
+        else if (e instanceof GrepError) {
+            return e.message;
+        }
+        else {
+            throw e;
+        }
+    }
+    // ripgrep has no total-match cap of its own; bound the count here so both paths agree.
+    if (matches.length > limit)
+        matches = matches.slice(0, limit);
+    return formatGrepOutput(matches);
+}
+export function get(config) {
+    // Resolve the corpus selection once at tool-construction time from the same config that decided
+    // this tool is enabled (GS2-51); the searched file-set is a config choice, not a per-call arg.
+    const fileSet = resolveGrepFileSet(config);
+    // The `.aiignore` privacy boundary (GS2-51) is read from the SAME config the fs toolkit reads it
+    // from, so gth_grep enforces it identically — see makeAiignoreFilter.
+    const aiignore = config?.aiignore;
+    const impl = async (args) => grepImpl(args, getCurrentWorkDir(), fileSet, aiignore);
+    return tool(impl, { name: GREP_TOOL_NAME, description, schema });
+}
+//# sourceMappingURL=gthGrepTool.js.map

package/dist/tools/gthGrepTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gthGrepTool.js","sourceRoot":"","sources":["../../src/tools/gthGrepTool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAElC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAa,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAE5E,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AASzC;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAiB;IAClD,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,cAAc,CAAC,CAAC;IAC1E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAChF,OAAO,WAAW,CAAC;AACrB,CAAC;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,kBAAkB,CAAC,OAAe,EAAE,QAA+B;IAC1E,OAAO,CAAC,OAAe,EAAW,EAAE,CAClC,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC/E,CAAC;AAED,2FAA2F;AAC3F,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,oGAAoG;AACpG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACxE,qGAAqG;AACrG,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAChD;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,6EAA6E;AAC7E,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAUvC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IACtF,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,sFAAsF;QACpF,4BAA4B,CAC/B;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,0EAA0E,CAAC;IACvF,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,gDAAgD,aAAa,IAAI,CAAC;CAC/E,CAAC,CAAC;AAIH,MAAM,WAAW,GAAG;IAClB,2FAA2F;IAC3F,iGAAiG;IACjG,+FAA+F;IAC/F,gCAAgC;IAChC,EAAE;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,2BAA2B;CAC5B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,kFAAkF;AAClF,MAAM,SAAU,SAAQ,KAAK;CAAG;AAChC,mFAAmF;AACnF,MAAM,uBAAwB,SAAQ,KAAK;CAAG;AAE9C,uEAAuE;AACvE,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,IAAI,CAAC,MAAM,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAoB;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACpD,MAAM,KAAK,GAAa,CAAC,SAAS,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IAC5D,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC3B,IAAI,WAAW;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChC,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,oGAAoG;AACpG,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,kEAAkE;AAClE,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,EAAE,IAAI,OAAO,CAAC;QAChB,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACjC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,EAAE,IAAI,KAAK,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,IAAI;qBACjB,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;qBACjB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,YAAY,CAAC,CAAC;gBACrB,EAAE,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;gBACtC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;gBACZ,SAAS;YACX,CAAC;QACH,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;AACpC,CAAC;AASD;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CAAC,OAAe;IACpD,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC,CAAC,2CAA2C;YACnF,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY;IAC3C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAC1B,SAA6B,EAC7B,OAAe;IAEf,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CACjB,uBAAuB,SAAS,0CAA0C,UAAU,IAAI,CACzF,CAAC;IACJ,CAAC;IACD,8FAA8F;IAC9F,kGAAkG;IAClG,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAClG,mEAAmE;IACnE,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CACjB,uBAAuB,SAAS,0CAA0C,UAAU,IAAI,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,mBAAmB,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,mGAAmG;AACnG,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS;QACxB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,MAAM,GAAG,CAAC;YAAE,SAAS;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,SAAS;QACzC,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAe,EACf,MAAsB,EACtB,OAA2B,EAC3B,OAAoB;IAEpB,0FAA0F;IAC1F,0FAA0F;IAC1F,2FAA2F;IAC3F,iGAAiG;IACjG,uFAAuF;IACvF,0FAA0F;IAC1F,6FAA6F;IAC7F,8FAA8F;IAC9F,gDAAgD;IAChD,MAAM,IAAI,GAAG,CAAC,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;IACnF,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC;IACD,+FAA+F;IAC/F,uFAAuF;IACvF,4EAA4E;IAC5E,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CACjB,OAAe,EACf,MAAsB,EACtB,OAA2B,EAC3B,OAAoB,EACpB,SAAoB;IAEpB,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACjE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CACN,IAAI,EACJ,IAAI,EACJ,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,EACpD,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACxB,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,GAAiC,KAA+C;qBACvF,IAAI,CAAC;gBACR,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,uBAAuB,CAAC,gCAAgC,CAAC,CAAC,CAAC;oBACtE,OAAO;gBACT,CAAC;gBACD,kFAAkF;gBAClF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,OAAO,CAAC,EAAE,CAAC,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;gBAChD,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,8DAA8D;YAC9D,OAAO,CACL,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACjD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAChD,CACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,GAAa,EAAE,UAAmB;IACzE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAa,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,+EAA+E;QAC/E,IAAI,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC3C,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,MAAsB,EACtB,OAA2B,EAC3B,KAAa,EACb,OAAoB,EACpB,SAAoB;IAEpB,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,6FAA6F;QAC7F,6FAA6F;QAC7F,0FAA0F;QAC1F,4CAA4C;QAC5C,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,8CAA+C,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,2FAA2F;QAC3F,8FAA8F;QAC9F,iGAAiG;QACjG,6DAA6D;QAC7D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,KAAK,WAAW,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK;YAAE,MAAM;QACnC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QAChE,8FAA8F;QAC9F,2FAA2F;QAC3F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,8BAA8B;QAC1C,CAAC;QACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK;gBAAE,MAAM;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,2FAA2F;YAC3F,6FAA6F;YAC7F,wFAAwF;YACxF,MAAM,QAAQ,GACZ,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClF,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,IAAc,EACd,OAAe,EACf,OAAoB,EACpB,QAA+B;IAE/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC1C,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,SAAS;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC;QAC7C,MAAM,CAAC,CAAC;IACV,CAAC;IAED,iGAAiG;IACjG,kEAAkE;IAClE,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAExD,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,uBAAuB,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YAC9F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,SAAS;oBAAE,OAAO,KAAK,CAAC,OAAO,CAAC;gBACrD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,YAAY,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,OAAO,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,MAAiB;IACnC,gGAAgG;IAChG,+FAA+F;IAC/F,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3C,iGAAiG;IACjG,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,EAAE,IAAc,EAAmB,EAAE,CACrD,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;AACnE,CAAC"}

package/dist/tools/shell/env.js

@@ -2,7 +2,7 @@
  * @module tools/shell/env
  *
  * Credential scrubbing for the shell tool's child environment. By default a
- * spawned child inherits `process.env` verbatim, so an approved (or yolo'd)
+ * spawned child inherits `process.env` verbatim, so an approved (or bypassed)
  * command can `echo $ANTHROPIC_API_KEY` and exfiltrate the operator's LLM/cloud
  * credentials. {@link buildScrubbedEnv} returns a copy of the parent env with
  * those credentials removed before spawn.

package/dist/tools/shell/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../../src/tools/shell/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA0B;IACzD,gBAAgB;IAChB,mBAAmB;IACnB,sBAAsB;IACtB,yBAAyB;IACzB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gCAAgC;IAChC,cAAc;IACd,aAAa;IACb,kBAAkB;IAClB,iBAAiB;IACjB,oBAAoB;IACpB,gBAAgB;IAChB,kBAAkB;IAClB,oBAAoB;IACpB,mBAAmB;IACnB,eAAe;IACf,sBAAsB;IACtB,eAAe;IACf,qCAAqC;IACrC,uBAAuB;IACvB,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA0B;IACzD,oEAAoE;IACpE,cAAc;IACd,UAAU;CACX,CAAC;AAEF,iFAAiF;AACjF,+EAA+E;AAC/E,wCAAwC;AACxC,MAAM,eAAe,GAAG;IACtB,YAAY;IACZ,sBAAsB;IACtB,eAAe;IACf,WAAW;IACX,UAAU;CACX,CAAC;AAEF,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAA4B,UAAU;IACrE,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../../src/tools/shell/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA0B;IACzD,gBAAgB;IAChB,mBAAmB;IACnB,sBAAsB;IACtB,yBAAyB;IACzB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gCAAgC;IAChC,cAAc;IACd,aAAa;IACb,kBAAkB;IAClB,iBAAiB;IACjB,oBAAoB;IACpB,gBAAgB;IAChB,kBAAkB;IAClB,oBAAoB;IACpB,mBAAmB;IACnB,eAAe;IACf,sBAAsB;IACtB,eAAe;IACf,qCAAqC;IACrC,uBAAuB;IACvB,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA0B;IACzD,oEAAoE;IACpE,cAAc;IACd,UAAU;CACX,CAAC;AAEF,iFAAiF;AACjF,+EAA+E;AAC/E,wCAAwC;AACxC,MAAM,eAAe,GAAG;IACtB,YAAY;IACZ,sBAAsB;IACtB,eAAe;IACf,WAAW;IACX,UAAU;CACX,CAAC;AAEF,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAM,GAAsB,UAAU;IACrE,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/tools/shell/outputBuffer.js.map

@@ -1 +1 @@
-{"version":3,"file":"outputBuffer.js","sourceRoot":"","sources":["../../../src/tools/shell/outputBuffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAa7B;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IACf,IAAI,GAAG,EAAE,CAAC;IACV,SAAS,GAAG,CAAC,CAAC;IACL,UAAU,GAAa,EAAE,CAAC;IACnC,SAAS,GAAG,CAAC,CAAC;IACd,eAAe,GAAG,CAAC,CAAC;IAC5B,0DAA0D;IAClD,IAAI,GAAG,EAAE,CAAC;IACV,aAAa,GAAG,KAAK,CAAC;IAEb,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,WAAW,CAAS;IAErC;;;;;OAKG;IACH,YAAY,cAAsB,EAAE,WAAW,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;QAChE,iDAAiD;QACjD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,uDAAuD;QACvD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC3D,CAAC;IAED,wEAAwE;IACxE,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC;QAE9B,6EAA6E;QAC7E,gEAAgE;QAChE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACrC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;oBACb,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC7E,CAAC;gBACD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;YAC9C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;gBACnB,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,6DAA6D;YAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC3E,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;YAClB,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,8EAA8E;IACtE,QAAQ,CAAC,KAAa;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,EAAG,CAAC;YACzC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QACD,2EAA2E;QAC3E,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;YAClD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;YAC7B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,mEAAmE;IACnE,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAqC,YAAY;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,IAAI;gBACtB,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,IAAI,CAAC,eAAe;aACjC,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa;YACjC,CAAC,CAAC,SAAS,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ;YACvD,CAAC,CAAC,aAAa,CAAC;QAClB,MAAM,WAAW,GACf,8BAA8B,IAAI,CAAC,eAAe,gBAAgB;YAClE,iBAAiB,IAAI,CAAC,SAAS,WAAW,IAAI,CAAC,SAAS,UAAU;YAClE,GAAG,QAAQ,eAAe,SAAS,uCAAuC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,WAAW,GAAG,IAAI;YACpC,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,eAAe;YAChC,SAAS;SACV,CAAC;IACJ,CAAC;CACF;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,IAAI,GAAG,gBAAgB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC;IACzF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3C,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"outputBuffer.js","sourceRoot":"","sources":["../../../src/tools/shell/outputBuffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAa7B;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IACf,IAAI,GAAG,EAAE,CAAC;IACV,SAAS,GAAG,CAAC,CAAC;IACL,UAAU,GAAa,EAAE,CAAC;IACnC,SAAS,GAAG,CAAC,CAAC;IACd,eAAe,GAAG,CAAC,CAAC;IAC5B,0DAA0D;IAClD,IAAI,GAAG,EAAE,CAAC;IACV,aAAa,GAAG,KAAK,CAAC;IAEb,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,WAAW,CAAS;IAErC;;;;;OAKG;IACH,YAAY,cAAsB,EAAE,WAAW,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;QAChE,iDAAiD;QACjD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,uDAAuD;QACvD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC3D,CAAC;IAED,wEAAwE;IACxE,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC;QAE9B,6EAA6E;QAC7E,gEAAgE;QAChE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACrC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;oBACb,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC7E,CAAC;gBACD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;YAC9C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;gBACnB,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,6DAA6D;YAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC3E,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;YAClB,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,8EAA8E;IACtE,QAAQ,CAAC,KAAa;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,EAAG,CAAC;YACzC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QACD,2EAA2E;QAC3E,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;YAClD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;YAC7B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,mEAAmE;IACnE,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,GAAgC,YAAY;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,IAAI;gBACtB,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,IAAI,CAAC,eAAe;aACjC,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa;YACjC,CAAC,CAAC,SAAS,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ;YACvD,CAAC,CAAC,aAAa,CAAC;QAClB,MAAM,WAAW,GACf,8BAA8B,IAAI,CAAC,eAAe,gBAAgB;YAClE,iBAAiB,IAAI,CAAC,SAAS,WAAW,IAAI,CAAC,SAAS,UAAU;YAClE,GAAG,QAAQ,eAAe,SAAS,uCAAuC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,WAAW,GAAG,IAAI;YACpC,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,eAAe;YAChC,SAAS;SACV,CAAC;IACJ,CAAC;CACF;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,IAAI,GAAG,gBAAgB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC;IACzF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3C,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/tools/shell/workDir.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Working directory the shell tool spawns in: the ACP session override when set (ACP transport),
+ * otherwise `getCurrentWorkDir()` (local runner + AG-UI, unchanged).
+ */
+export declare function getShellWorkDir(): string;
+/**
+ * ACP-only: point the shell tool at the current ACP session's fs-backend root (the resolved
+ * `session/new.cwd`, or the startup workspace when a session carries no cwd). Pass `undefined` to
+ * clear the override and restore the `getCurrentWorkDir()` default (used by tests).
+ */
+export declare function setAcpShellWorkDir(cwd: string | undefined): void;

package/dist/tools/shell/workDir.js

@@ -0,0 +1,45 @@
+/**
+ * @packageDocumentation
+ * Resolves the working directory the shell tool (`run_shell_command`) spawns in, keeping it aligned
+ * with the deepagents filesystem-backend root so the shell and the fs tools (ls/read_file/write_file/
+ * edit_file/glob/grep) share ONE path namespace.
+ *
+ * DEFAULT (local `code`/`chat` runner + AG-UI): `getCurrentWorkDir()`. On these surfaces the fs
+ * backend is rooted at `getCurrentWorkDir()` by `GthDeepAgent.init()` (`rootDir: getCurrentWorkDir()`),
+ * so the shell already matches it — this is exactly EXT-22 S4. These surfaces NEVER call
+ * {@link setAcpShellWorkDir}, so {@link getShellWorkDir} stays `getCurrentWorkDir()` for them.
+ *
+ * ACP transport override: unlike the local runner, the ACP server does NOT call `init()`; it re-roots
+ * ITS per-session fs backend to each `session/new.cwd` (see `gthAcpServer.ts`). The shell tool
+ * instances are built ONCE at startup (`buildDeepAgentParams`), so they cannot themselves see the
+ * later session cwd. The ACP server therefore updates this module-level override on every
+ * `session/new`; the shell reads it at spawn time so it tracks the session fs root.
+ *
+ * This also removes the EXT-22 S4 `INIT_CWD` hazard on ACP: `getCurrentWorkDir()` prefers `INIT_CWD`,
+ * which is stale in the long-lived ACP subprocess (the reason `acpModule` roots the startup workspace
+ * at raw `process.cwd()`). Once the override tracks the session cwd, the ACP shell never consults
+ * `INIT_CWD`.
+ *
+ * Scope note: this mirrors the ACP design, which is ALREADY "latest-session-cwd wins" process-wide —
+ * `gthAcpServer` clobbers every backend to the newest session cwd. A single process-wide override has
+ * the same semantics. The ACP subprocess is dedicated (never co-hosts a local runner / AG-UI), so the
+ * override can never leak into a non-ACP surface.
+ */
+import { getCurrentWorkDir } from '@gaunt-sloth/core/utils/systemUtils.js';
+let acpShellWorkDir;
+/**
+ * Working directory the shell tool spawns in: the ACP session override when set (ACP transport),
+ * otherwise `getCurrentWorkDir()` (local runner + AG-UI, unchanged).
+ */
+export function getShellWorkDir() {
+    return acpShellWorkDir ?? getCurrentWorkDir();
+}
+/**
+ * ACP-only: point the shell tool at the current ACP session's fs-backend root (the resolved
+ * `session/new.cwd`, or the startup workspace when a session carries no cwd). Pass `undefined` to
+ * clear the override and restore the `getCurrentWorkDir()` default (used by tests).
+ */
+export function setAcpShellWorkDir(cwd) {
+    acpShellWorkDir = cwd;
+}
+//# sourceMappingURL=workDir.js.map

package/dist/tools/shell/workDir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workDir.js","sourceRoot":"","sources":["../../../src/tools/shell/workDir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAE3E,IAAI,eAAmC,CAAC;AAExC;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,eAAe,IAAI,iBAAiB,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,eAAe,GAAG,GAAG,CAAC;AACxB,CAAC"}

package/dist/utils/mcpAuthError.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @packageDocumentation
+ * EXT-31 — classify and format MCP integration connect/tool-load failures so an expired or invalid
+ * credential is SURFACED (named + actionable) instead of silently dropping the integration's tools.
+ *
+ * The `@langchain/mcp-adapters` client only tags a bare HTTP 401 as an authentication error; a 403
+ * (forbidden / expired scope) otherwise falls through as a generic "Failed to connect". This module
+ * classifies auth failures independently (401/403 + credential keywords) so a stale token is not
+ * mistaken for "this integration was never configured" or an unrelated transient error.
+ *
+ * Pure + side-effect free: callers do the surfacing (`displayWarning`) with the returned message.
+ */
+/** Coarse classification of an MCP connect/tool-load failure. */
+export type McpConnectErrorKind = 'auth' | 'other';
+/** Options that tune the suggested fix path in the surfaced message. */
+export interface McpConnectFailureOptions {
+    /** The server uses OAuth (`authProvider: 'OAuth'`) — suggest re-running the OAuth login. */
+    oauth?: boolean;
+}
+/**
+ * Classify an MCP connect/tool-load failure as a credential problem (`auth`) or anything else
+ * (`other`). Detection is independent of the adapter (which only tags 401), so a 403 or an
+ * "expired token" surfaced by the upstream server is still recognised as auth.
+ */
+export declare function classifyMcpConnectError(error: unknown): McpConnectErrorKind;
+/**
+ * Build the user-facing message for a failed MCP integration. For `auth` failures it names the
+ * integration, states the credential is expired/invalid, and points at the concrete fix path
+ * (OAuth login or the API token / authorization header, plus the `mcpServers` entry in gth config).
+ * For `other` failures it surfaces the failure plainly and explicitly says it is NOT an auth error,
+ * so an unrelated transient never triggers a spurious "re-authenticate" nudge.
+ *
+ * Either way the caller degrades gracefully AFTER surfacing this — the integration's tools are
+ * dropped for the session, but the user (and the log) now knows why.
+ */
+export declare function formatMcpConnectFailureMessage(serverName: string | undefined, error: unknown, options?: McpConnectFailureOptions): string;