@geminixiang/mikan 1.0.0-beta.16 → 1.0.0-beta.18

package/dist/commands/sandbox.js

@@ -21,8 +21,11 @@ export class SandboxCommandHandler {
         const parsed = parseSandboxCommand(context.commandText);
         if (!parsed)
             return false;
-        if (context.services.sandbox.type !== "image" || !context.services.provisioner) {
-            await replyDiagnosticWithContext(context.responder, formatCommandSummary("Sandbox", ["`/pi-sandbox` 目前只支援 `image:*` managed sandbox。"]), { style: "muted" });
+        if ((context.services.sandbox.type !== "image" && context.services.sandbox.type !== "gondolin") ||
+            !context.services.resourceController) {
+            await replyDiagnosticWithContext(context.responder, formatCommandSummary("Sandbox", [
+                "`/pi-sandbox` 目前只支援 `image:*` 與 `gondolin:*` managed sandbox。",
+            ]), { style: "muted" });
             return true;
         }
         const containerKey = resolveActorVaultKey(context.services.sandbox, context.platformUserId, context.conversationId);
@@ -36,13 +39,13 @@ export class SandboxCommandHandler {
                     : "已將此 conversation 的 sandbox 設為 private workspace mode。",
                 `Workspace mount: ${parsed.action}`,
                 parsed.action === "full"
-                    ? "之後這個 container 會把整個 host workspace 掛到 /workspace。"
-                    : "之後這個 container 只會掛載 private workspace 檔案與當前 conversation 目錄。",
+                    ? "之後這個 runtime 會把整個 host workspace 掛到 /workspace。"
+                    : "之後這個 runtime 只會掛載 private workspace 檔案與當前 conversation 目錄。",
             ]), { style: "muted" });
             return true;
         }
         if (parsed.action === "boost") {
-            const boostLimits = context.services.provisioner.getBoostLimits();
+            const boostLimits = context.services.resourceController.getBoostLimits();
             if (!boostLimits?.cpus && !boostLimits?.memory) {
                 await replyDiagnosticWithContext(context.responder, formatCommandSummary("Sandbox Boost", [
                     "此 mikan instance 尚未設定 sandbox boost 規格。",
@@ -50,17 +53,17 @@ export class SandboxCommandHandler {
                 ]), { style: "muted" });
                 return true;
             }
-            const status = await context.services.provisioner.boost(containerKey);
+            const status = await context.services.resourceController.boost(containerKey);
             await replyDiagnosticWithContext(context.responder, formatCommandSummary("Sandbox Boost", [
                 "已暫時提升此 conversation 的 sandbox 規格。",
                 `Current: ${formatLimits(status.limits)}`,
-                "boost 會在此 sandbox container 關閉後結束。",
+                "boost 會在此 sandbox runtime 關閉後結束。",
             ]), { style: "muted" });
             return true;
         }
-        const status = context.services.provisioner.getLimitStatus(containerKey);
-        const defaultLimits = context.services.provisioner.getDefaultLimits();
-        const boostLimits = context.services.provisioner.getBoostLimits();
+        const status = context.services.resourceController.getLimitStatus(containerKey);
+        const defaultLimits = context.services.resourceController.getDefaultLimits();
+        const boostLimits = context.services.resourceController.getBoostLimits();
         const workspaceMount = readConversationWorkspaceMountMode(context.services.workingDir, context.conversationId);
         await replyDiagnosticWithContext(context.responder, formatCommandSummary("Sandbox", [
             `Current: ${formatLimits(status.limits)}`,

package/dist/commands/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/commands/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAI9E,MAAM,gBAAgB,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;AAE/C,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACpE,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,OAAO,qBAAqB;IAChC,KAAK,CAAC,SAAS,CAAC,OAAuB;QACrC,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1B,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC/E,MAAM,0BAA0B,CAC9B,OAAO,CAAC,SAAS,EACjB,oBAAoB,CAAC,SAAS,EAAE,CAAC,gDAAgD,CAAC,CAAC,EACnF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,oBAAoB,CACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,EACxB,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,cAAc,CACvB,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5D,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE;gBACpF,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE;aACtD,CAAC,CAAC;YACH,MAAM,0BAA0B,CAC9B,OAAO,CAAC,SAAS,EACjB,oBAAoB,CAAC,mBAAmB,EAAE;gBACxC,MAAM,CAAC,MAAM,KAAK,MAAM;oBACtB,CAAC,CAAC,oDAAoD;oBACtD,CAAC,CAAC,uDAAuD;gBAC3D,oBAAoB,MAAM,CAAC,MAAM,EAAE;gBACnC,MAAM,CAAC,MAAM,KAAK,MAAM;oBACtB,CAAC,CAAC,mDAAmD;oBACrD,CAAC,CAAC,8DAA8D;aACnE,CAAC,EACF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;YAClE,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;gBAC/C,MAAM,0BAA0B,CAC9B,OAAO,CAAC,SAAS,EACjB,oBAAoB,CAAC,eAAe,EAAE;oBACpC,yCAAyC;oBACzC,yCAAyC;iBAC1C,CAAC,EACF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtE,MAAM,0BAA0B,CAC9B,OAAO,CAAC,SAAS,EACjB,oBAAoB,CAAC,eAAe,EAAE;gBACpC,mCAAmC;gBACnC,YAAY,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;gBACzC,oCAAoC;aACrC,CAAC,EACF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACtE,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;QAClE,MAAM,cAAc,GAAG,kCAAkC,CACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,EAC3B,OAAO,CAAC,cAAc,CACvB,CAAC;QACF,MAAM,0BAA0B,CAC9B,OAAO,CAAC,SAAS,EACjB,oBAAoB,CAClB,SAAS,EACT;YACE,YAAY,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACzC,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE;YACnD,oBAAoB,cAAc,EAAE;YACpC,EAAE;YACF,YAAY,YAAY,CAAC,aAAa,CAAC,EAAE;YACzC,WAAW,CAAC,CAAC,CAAC,UAAU,YAAY,CAAC,EAAE,GAAG,aAAa,EAAE,GAAG,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;SACzF,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CACvD,EACD,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,YAAY,CAAC,MAAsD;IAC1E,OAAO,OAAO,MAAM,EAAE,IAAI,IAAI,WAAW,aAAa,MAAM,EAAE,MAAM,IAAI,WAAW,EAAE,CAAC;AACxF,CAAC","sourcesContent":["import { join } from \"node:path\";\nimport { updateConversationSettings } from \"../config.js\";\nimport { readConversationWorkspaceMountMode } from \"../execution-resolver.js\";\nimport { resolveActorVaultKey } from \"../vault/routing.js\";\nimport { slashForms } from \"./manifest.js\";\nimport { matchCommand } from \"./parse.js\";\nimport type { CommandContext, CommandHandler, ParsedSandboxCommand } from \"./types.js\";\nimport { formatCommandSummary, replyDiagnosticWithContext } from \"./utils.js\";\n\nexport type { ParsedSandboxCommand } from \"./types.js\";\n\nconst SANDBOX_COMMANDS = slashForms(\"sandbox\");\n\nexport function parseSandboxCommand(text: string): ParsedSandboxCommand | null {\n  const matched = matchCommand(text, SANDBOX_COMMANDS, { stripMention: true });\n  if (!matched) return null;\n\n  const action = matched.args.length === 1 ? matched.args[0].toLowerCase() : undefined;\n  if (action === \"boost\" || action === \"private\" || action === \"full\") {\n    return { action };\n  }\n  return {};\n}\n\nexport class SandboxCommandHandler implements CommandHandler {\n  async tryHandle(context: CommandContext): Promise<boolean> {\n    const parsed = parseSandboxCommand(context.commandText);\n    if (!parsed) return false;\n\n    if (context.services.sandbox.type !== \"image\" || !context.services.provisioner) {\n      await replyDiagnosticWithContext(\n        context.responder,\n        formatCommandSummary(\"Sandbox\", [\"`/pi-sandbox` 目前只支援 `image:*` managed sandbox。\"]),\n        { style: \"muted\" },\n      );\n      return true;\n    }\n\n    const containerKey = resolveActorVaultKey(\n      context.services.sandbox,\n      context.platformUserId,\n      context.conversationId,\n    );\n\n    if (parsed.action === \"private\" || parsed.action === \"full\") {\n      updateConversationSettings(join(context.services.workingDir, context.conversationId), {\n        sandbox: { image: { workspaceMount: parsed.action } },\n      });\n      await replyDiagnosticWithContext(\n        context.responder,\n        formatCommandSummary(\"Sandbox Workspace\", [\n          parsed.action === \"full\"\n            ? \"已將此 conversation 的 sandbox 設為 full workspace mode。\"\n            : \"已將此 conversation 的 sandbox 設為 private workspace mode。\",\n          `Workspace mount: ${parsed.action}`,\n          parsed.action === \"full\"\n            ? \"之後這個 container 會把整個 host workspace 掛到 /workspace。\"\n            : \"之後這個 container 只會掛載 private workspace 檔案與當前 conversation 目錄。\",\n        ]),\n        { style: \"muted\" },\n      );\n      return true;\n    }\n\n    if (parsed.action === \"boost\") {\n      const boostLimits = context.services.provisioner.getBoostLimits();\n      if (!boostLimits?.cpus && !boostLimits?.memory) {\n        await replyDiagnosticWithContext(\n          context.responder,\n          formatCommandSummary(\"Sandbox Boost\", [\n            \"此 mikan instance 尚未設定 sandbox boost 規格。\",\n            \"請先在全域 settings.json 設定 `sandbox.boost`。\",\n          ]),\n          { style: \"muted\" },\n        );\n        return true;\n      }\n\n      const status = await context.services.provisioner.boost(containerKey);\n      await replyDiagnosticWithContext(\n        context.responder,\n        formatCommandSummary(\"Sandbox Boost\", [\n          \"已暫時提升此 conversation 的 sandbox 規格。\",\n          `Current: ${formatLimits(status.limits)}`,\n          \"boost 會在此 sandbox container 關閉後結束。\",\n        ]),\n        { style: \"muted\" },\n      );\n      return true;\n    }\n\n    const status = context.services.provisioner.getLimitStatus(containerKey);\n    const defaultLimits = context.services.provisioner.getDefaultLimits();\n    const boostLimits = context.services.provisioner.getBoostLimits();\n    const workspaceMount = readConversationWorkspaceMountMode(\n      context.services.workingDir,\n      context.conversationId,\n    );\n    await replyDiagnosticWithContext(\n      context.responder,\n      formatCommandSummary(\n        \"Sandbox\",\n        [\n          `Current: ${formatLimits(status.limits)}`,\n          `Status: ${status.boosted ? \"boosted\" : \"default\"}`,\n          `Workspace mount: ${workspaceMount}`,\n          \"\",\n          `Default: ${formatLimits(defaultLimits)}`,\n          boostLimits ? `Boost: ${formatLimits({ ...defaultLimits, ...boostLimits })}` : undefined,\n        ].filter((line): line is string => line !== undefined),\n      ),\n      { style: \"muted\" },\n    );\n    return true;\n  }\n}\n\nfunction formatLimits(limits: { cpus?: string; memory?: string } | undefined): string {\n  return `CPU ${limits?.cpus ?? \"unlimited\"} / Memory ${limits?.memory ?? \"unlimited\"}`;\n}\n"]}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/commands/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAI9E,MAAM,gBAAgB,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;AAE/C,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACpE,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,OAAO,qBAAqB;IAChC,KAAK,CAAC,SAAS,CAAC,OAAuB;QACrC,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1B,IACE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;YAC3F,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EACpC,CAAC;YACD,MAAM,0BAA0B,CAC9B,OAAO,CAAC,SAAS,EACjB,oBAAoB,CAAC,SAAS,EAAE;gBAC9B,+DAA+D;aAChE,CAAC,EACF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,oBAAoB,CACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,EACxB,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,cAAc,CACvB,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5D,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE;gBACpF,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE;aACtD,CAAC,CAAC;YACH,MAAM,0BAA0B,CAC9B,OAAO,CAAC,SAAS,EACjB,oBAAoB,CAAC,mBAAmB,EAAE;gBACxC,MAAM,CAAC,MAAM,KAAK,MAAM;oBACtB,CAAC,CAAC,oDAAoD;oBACtD,CAAC,CAAC,uDAAuD;gBAC3D,oBAAoB,MAAM,CAAC,MAAM,EAAE;gBACnC,MAAM,CAAC,MAAM,KAAK,MAAM;oBACtB,CAAC,CAAC,iDAAiD;oBACnD,CAAC,CAAC,4DAA4D;aACjE,CAAC,EACF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,cAAc,EAAE,CAAC;YACzE,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;gBAC/C,MAAM,0BAA0B,CAC9B,OAAO,CAAC,SAAS,EACjB,oBAAoB,CAAC,eAAe,EAAE;oBACpC,yCAAyC;oBACzC,yCAAyC;iBAC1C,CAAC,EACF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC7E,MAAM,0BAA0B,CAC9B,OAAO,CAAC,SAAS,EACjB,oBAAoB,CAAC,eAAe,EAAE;gBACpC,mCAAmC;gBACnC,YAAY,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;gBACzC,kCAAkC;aACnC,CAAC,EACF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAChF,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,CAAC;QAC7E,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,cAAc,EAAE,CAAC;QACzE,MAAM,cAAc,GAAG,kCAAkC,CACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,EAC3B,OAAO,CAAC,cAAc,CACvB,CAAC;QACF,MAAM,0BAA0B,CAC9B,OAAO,CAAC,SAAS,EACjB,oBAAoB,CAClB,SAAS,EACT;YACE,YAAY,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACzC,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE;YACnD,oBAAoB,cAAc,EAAE;YACpC,EAAE;YACF,YAAY,YAAY,CAAC,aAAa,CAAC,EAAE;YACzC,WAAW,CAAC,CAAC,CAAC,UAAU,YAAY,CAAC,EAAE,GAAG,aAAa,EAAE,GAAG,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;SACzF,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CACvD,EACD,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,YAAY,CAAC,MAAsD;IAC1E,OAAO,OAAO,MAAM,EAAE,IAAI,IAAI,WAAW,aAAa,MAAM,EAAE,MAAM,IAAI,WAAW,EAAE,CAAC;AACxF,CAAC","sourcesContent":["import { join } from \"node:path\";\nimport { updateConversationSettings } from \"../config.js\";\nimport { readConversationWorkspaceMountMode } from \"../execution-resolver.js\";\nimport { resolveActorVaultKey } from \"../vault/routing.js\";\nimport { slashForms } from \"./manifest.js\";\nimport { matchCommand } from \"./parse.js\";\nimport type { CommandContext, CommandHandler, ParsedSandboxCommand } from \"./types.js\";\nimport { formatCommandSummary, replyDiagnosticWithContext } from \"./utils.js\";\n\nexport type { ParsedSandboxCommand } from \"./types.js\";\n\nconst SANDBOX_COMMANDS = slashForms(\"sandbox\");\n\nexport function parseSandboxCommand(text: string): ParsedSandboxCommand | null {\n  const matched = matchCommand(text, SANDBOX_COMMANDS, { stripMention: true });\n  if (!matched) return null;\n\n  const action = matched.args.length === 1 ? matched.args[0].toLowerCase() : undefined;\n  if (action === \"boost\" || action === \"private\" || action === \"full\") {\n    return { action };\n  }\n  return {};\n}\n\nexport class SandboxCommandHandler implements CommandHandler {\n  async tryHandle(context: CommandContext): Promise<boolean> {\n    const parsed = parseSandboxCommand(context.commandText);\n    if (!parsed) return false;\n\n    if (\n      (context.services.sandbox.type !== \"image\" && context.services.sandbox.type !== \"gondolin\") ||\n      !context.services.resourceController\n    ) {\n      await replyDiagnosticWithContext(\n        context.responder,\n        formatCommandSummary(\"Sandbox\", [\n          \"`/pi-sandbox` 目前只支援 `image:*` 與 `gondolin:*` managed sandbox。\",\n        ]),\n        { style: \"muted\" },\n      );\n      return true;\n    }\n\n    const containerKey = resolveActorVaultKey(\n      context.services.sandbox,\n      context.platformUserId,\n      context.conversationId,\n    );\n\n    if (parsed.action === \"private\" || parsed.action === \"full\") {\n      updateConversationSettings(join(context.services.workingDir, context.conversationId), {\n        sandbox: { image: { workspaceMount: parsed.action } },\n      });\n      await replyDiagnosticWithContext(\n        context.responder,\n        formatCommandSummary(\"Sandbox Workspace\", [\n          parsed.action === \"full\"\n            ? \"已將此 conversation 的 sandbox 設為 full workspace mode。\"\n            : \"已將此 conversation 的 sandbox 設為 private workspace mode。\",\n          `Workspace mount: ${parsed.action}`,\n          parsed.action === \"full\"\n            ? \"之後這個 runtime 會把整個 host workspace 掛到 /workspace。\"\n            : \"之後這個 runtime 只會掛載 private workspace 檔案與當前 conversation 目錄。\",\n        ]),\n        { style: \"muted\" },\n      );\n      return true;\n    }\n\n    if (parsed.action === \"boost\") {\n      const boostLimits = context.services.resourceController.getBoostLimits();\n      if (!boostLimits?.cpus && !boostLimits?.memory) {\n        await replyDiagnosticWithContext(\n          context.responder,\n          formatCommandSummary(\"Sandbox Boost\", [\n            \"此 mikan instance 尚未設定 sandbox boost 規格。\",\n            \"請先在全域 settings.json 設定 `sandbox.boost`。\",\n          ]),\n          { style: \"muted\" },\n        );\n        return true;\n      }\n\n      const status = await context.services.resourceController.boost(containerKey);\n      await replyDiagnosticWithContext(\n        context.responder,\n        formatCommandSummary(\"Sandbox Boost\", [\n          \"已暫時提升此 conversation 的 sandbox 規格。\",\n          `Current: ${formatLimits(status.limits)}`,\n          \"boost 會在此 sandbox runtime 關閉後結束。\",\n        ]),\n        { style: \"muted\" },\n      );\n      return true;\n    }\n\n    const status = context.services.resourceController.getLimitStatus(containerKey);\n    const defaultLimits = context.services.resourceController.getDefaultLimits();\n    const boostLimits = context.services.resourceController.getBoostLimits();\n    const workspaceMount = readConversationWorkspaceMountMode(\n      context.services.workingDir,\n      context.conversationId,\n    );\n    await replyDiagnosticWithContext(\n      context.responder,\n      formatCommandSummary(\n        \"Sandbox\",\n        [\n          `Current: ${formatLimits(status.limits)}`,\n          `Status: ${status.boosted ? \"boosted\" : \"default\"}`,\n          `Workspace mount: ${workspaceMount}`,\n          \"\",\n          `Default: ${formatLimits(defaultLimits)}`,\n          boostLimits ? `Boost: ${formatLimits({ ...defaultLimits, ...boostLimits })}` : undefined,\n        ].filter((line): line is string => line !== undefined),\n      ),\n      { style: \"muted\" },\n    );\n    return true;\n  }\n}\n\nfunction formatLimits(limits: { cpus?: string; memory?: string } | undefined): string {\n  return `CPU ${limits?.cpus ?? \"unlimited\"} / Memory ${limits?.memory ?? \"unlimited\"}`;\n}\n"]}

package/dist/commands/types.d.ts

@@ -2,6 +2,7 @@ import type { ThinkingLevel } from "@earendil-works/pi-agent-core";
 import type { MessagingBot, ConversationContext, PlatformName } from "../adapter.js";
 import type { DockerContainerManager } from "../provisioner.js";
 import type { SandboxConfig } from "../sandbox/index.js";
+import type { SandboxResourceController } from "../types.js";
 import type { VaultManager } from "../vault/index.js";
 export interface LinkTokenStoreLike {
     create(platform: PlatformName, platformUserId: string, conversationId: string, vaultId: string, providerId: string): {
@@ -34,6 +35,7 @@ export interface CommandServices {
     sandbox: SandboxConfig;
     vaultManager: VaultManager;
     provisioner?: DockerContainerManager;
+    resourceController?: SandboxResourceController;
     linkTokenStore: LinkTokenStoreLike;
     sessionViewTokenStore: SessionViewTokenStoreLike;
     adminTokenStore: AdminTokenStoreLike;

package/dist/commands/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/commands/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IACjC,MAAM,CACJ,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,CACJ,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,gBAAgB,CAAC,EAAE,MAAM,GACxB;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,EAAE,YAAY,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACvB;AAED,UAAU,oBAAoB;IAC5B,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,uBAAuB,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1F,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;CACjE;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,cAAc,EAAE,kBAAkB,CAAC;IACnC,qBAAqB,EAAE,yBAAyB,CAAC;IACjD,eAAe,EAAE,mBAAmB,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,YAAY,CAAC;IAClB,SAAS,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC5C,QAAQ,EAAE,YAAY,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtD;AAID,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;CACvC;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC7E;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,GACzB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/commands/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IACjC,MAAM,CACJ,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,CACJ,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,gBAAgB,CAAC,EAAE,MAAM,GACxB;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,EAAE,YAAY,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACvB;AAED,UAAU,oBAAoB;IAC5B,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,uBAAuB,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1F,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;CACjE;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;IAC/C,cAAc,EAAE,kBAAkB,CAAC;IACnC,qBAAqB,EAAE,yBAAyB,CAAC;IACjD,eAAe,EAAE,mBAAmB,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,YAAY,CAAC;IAClB,SAAS,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC5C,QAAQ,EAAE,YAAY,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtD;AAID,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;CACvC;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC7E;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,GACzB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/commands/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/commands/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ThinkingLevel } from \"@earendil-works/pi-agent-core\";\nimport type { MessagingBot, ConversationContext, PlatformName } from \"../adapter.js\";\nimport type { DockerContainerManager } from \"../provisioner.js\";\nimport type { SandboxConfig } from \"../sandbox/index.js\";\nimport type { VaultManager } from \"../vault/index.js\";\n\nexport interface LinkTokenStoreLike {\n  create(\n    platform: PlatformName,\n    platformUserId: string,\n    conversationId: string,\n    vaultId: string,\n    providerId: string,\n  ): { token: string };\n}\n\nexport interface SessionViewTokenStoreLike {\n  create(\n    platform: PlatformName,\n    platformUserId: string,\n    conversationId: string,\n    sessionKey: string,\n    sessionFile: string,\n    platformUserName?: string,\n  ): { token: string };\n}\n\nexport interface AdminTokenStoreLike {\n  create(args: {\n    platform: PlatformName;\n    platformUserId: string;\n    conversationId: string;\n    platformUserName?: string;\n  }): { token: string };\n}\n\ninterface CommandRuntimeBridge {\n  handleNewCommand(sessionKey: string, conversationId: string, bot: MessagingBot): Promise<void>;\n  switchConversationModel(conversationId: string, provider: string, model: string): boolean;\n  refreshConversationEnvironment(conversationId: string): boolean;\n}\n\nexport interface CommandServices {\n  workingDir: string;\n  runtime?: CommandRuntimeBridge;\n  sandbox: SandboxConfig;\n  vaultManager: VaultManager;\n  provisioner?: DockerContainerManager;\n  linkTokenStore: LinkTokenStoreLike;\n  sessionViewTokenStore: SessionViewTokenStoreLike;\n  adminTokenStore: AdminTokenStoreLike;\n  portalBaseUrl?: string;\n}\n\nexport interface CommandContext {\n  bot: MessagingBot;\n  responder: ConversationContext[\"responder\"];\n  platform: PlatformName;\n  platformUserId: string;\n  conversationId: string;\n  vaultConversationId?: string;\n  sessionKey: string;\n  commandText: string;\n  privateConversation: boolean;\n  services: CommandServices;\n}\n\nexport interface CommandHandler {\n  tryHandle(context: CommandContext): Promise<boolean>;\n}\n\n// ── command-specific parsed types ────────────────────────────────────────────\n\nexport interface ParsedModelCommand {\n  provider?: string;\n  model?: string;\n  thinkingLevel?: ThinkingLevel;\n}\n\nexport interface ParsedSandboxCommand {\n  action?: \"boost\" | \"private\" | \"full\";\n}\n\nexport type ParsedLoginCommand =\n  | { action: \"setup\" }\n  | { action: \"shared_create\" | \"shared_update\" | \"shared_delete\"; name: string }\n  | { action: \"shared_list\" }\n  | { action: \"copy_shared\"; name: string };\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/commands/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ThinkingLevel } from \"@earendil-works/pi-agent-core\";\nimport type { MessagingBot, ConversationContext, PlatformName } from \"../adapter.js\";\nimport type { DockerContainerManager } from \"../provisioner.js\";\nimport type { SandboxConfig } from \"../sandbox/index.js\";\nimport type { SandboxResourceController } from \"../types.js\";\nimport type { VaultManager } from \"../vault/index.js\";\n\nexport interface LinkTokenStoreLike {\n  create(\n    platform: PlatformName,\n    platformUserId: string,\n    conversationId: string,\n    vaultId: string,\n    providerId: string,\n  ): { token: string };\n}\n\nexport interface SessionViewTokenStoreLike {\n  create(\n    platform: PlatformName,\n    platformUserId: string,\n    conversationId: string,\n    sessionKey: string,\n    sessionFile: string,\n    platformUserName?: string,\n  ): { token: string };\n}\n\nexport interface AdminTokenStoreLike {\n  create(args: {\n    platform: PlatformName;\n    platformUserId: string;\n    conversationId: string;\n    platformUserName?: string;\n  }): { token: string };\n}\n\ninterface CommandRuntimeBridge {\n  handleNewCommand(sessionKey: string, conversationId: string, bot: MessagingBot): Promise<void>;\n  switchConversationModel(conversationId: string, provider: string, model: string): boolean;\n  refreshConversationEnvironment(conversationId: string): boolean;\n}\n\nexport interface CommandServices {\n  workingDir: string;\n  runtime?: CommandRuntimeBridge;\n  sandbox: SandboxConfig;\n  vaultManager: VaultManager;\n  provisioner?: DockerContainerManager;\n  resourceController?: SandboxResourceController;\n  linkTokenStore: LinkTokenStoreLike;\n  sessionViewTokenStore: SessionViewTokenStoreLike;\n  adminTokenStore: AdminTokenStoreLike;\n  portalBaseUrl?: string;\n}\n\nexport interface CommandContext {\n  bot: MessagingBot;\n  responder: ConversationContext[\"responder\"];\n  platform: PlatformName;\n  platformUserId: string;\n  conversationId: string;\n  vaultConversationId?: string;\n  sessionKey: string;\n  commandText: string;\n  privateConversation: boolean;\n  services: CommandServices;\n}\n\nexport interface CommandHandler {\n  tryHandle(context: CommandContext): Promise<boolean>;\n}\n\n// ── command-specific parsed types ────────────────────────────────────────────\n\nexport interface ParsedModelCommand {\n  provider?: string;\n  model?: string;\n  thinkingLevel?: ThinkingLevel;\n}\n\nexport interface ParsedSandboxCommand {\n  action?: \"boost\" | \"private\" | \"full\";\n}\n\nexport type ParsedLoginCommand =\n  | { action: \"setup\" }\n  | { action: \"shared_create\" | \"shared_update\" | \"shared_delete\"; name: string }\n  | { action: \"shared_list\" }\n  | { action: \"copy_shared\"; name: string };\n"]}

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,qBAAa,0BAA2B,SAAQ,KAAK;aACvB,YAAY,EAAE,MAAM;IAAhD,YAA4B,YAAY,EAAE,MAAM,EAG/C;CACF;AAED,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClG,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAmB,MAAM,YAAY,CAAC;AA0MlG,wBAAgB,kBAAkB,IAAI,WAAW,CAEhD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CA2BxE;AAED,wBAAgB,2BAA2B,CAAC,eAAe,EAAE,MAAM,GAAG,WAAW,CAahF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAUlF;AAUD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,eAAe,EAAE,MAAM,GAAG,eAAe,CAYxF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,eAAe,GACtB,IAAI,CAaN;AAED,wBAAgB,2BAA2B,CAAC,IAAI,WAAwB,GAAG,MAAM,GAAG,SAAS,CA2B5F;AAED,wBAAgB,uBAAuB,CAAC,IAAI,WAAwB,GAAG,MAAM,CAY5E;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAInE;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,IAAI,CAWN;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAOrD;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQjE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD;AAqED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAEtE;AAED,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,MAAM,EACvB,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAC1B,IAAI,CAEN"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,qBAAa,0BAA2B,SAAQ,KAAK;aACvB,YAAY,EAAE,MAAM;IAAhD,YAA4B,YAAY,EAAE,MAAM,EAG/C;CACF;AAED,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClG,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAmB,MAAM,YAAY,CAAC;AAiQlG,wBAAgB,kBAAkB,IAAI,WAAW,CAEhD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CA2BxE;AAED,wBAAgB,2BAA2B,CAAC,eAAe,EAAE,MAAM,GAAG,WAAW,CAahF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAUlF;AAUD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,eAAe,EAAE,MAAM,GAAG,eAAe,CAYxF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,eAAe,GACtB,IAAI,CAaN;AAED,wBAAgB,2BAA2B,CAAC,IAAI,WAAwB,GAAG,MAAM,GAAG,SAAS,CA2B5F;AAED,wBAAgB,uBAAuB,CAAC,IAAI,WAAwB,GAAG,MAAM,CAY5E;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAInE;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,IAAI,CAWN;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAOrD;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQjE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD;AAqED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAEtE;AAED,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,MAAM,EACvB,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAC1B,IAAI,CAEN"}

package/dist/config.js

@@ -73,6 +73,40 @@ const SettingsFileSchema = Type.Object({
         image: Type.Optional(Type.Object({
             workspaceMount: Type.Optional(Type.Union([Type.Literal("private"), Type.Literal("full")])),
         })),
+        gondolin: Type.Optional(Type.Object({
+            remote: Type.Optional(Type.Object({
+                url: Type.Optional(Type.String()),
+                caFile: Type.Optional(Type.String()),
+                certFile: Type.Optional(Type.String()),
+                keyFile: Type.Optional(Type.String()),
+                workspaceRoot: Type.Optional(Type.String()),
+                maxRuntimes: Type.Optional(Type.Number()),
+                imageSelector: Type.Optional(Type.String()),
+                queueWaitSeconds: Type.Optional(Type.Number()),
+                workers: Type.Optional(Type.Array(Type.Object({
+                    name: Type.Optional(Type.String()),
+                    url: Type.String(),
+                    caFile: Type.Optional(Type.String()),
+                    certFile: Type.Optional(Type.String()),
+                    keyFile: Type.Optional(Type.String()),
+                    workspaceRoot: Type.Optional(Type.String()),
+                    maxRuntimes: Type.Optional(Type.Number()),
+                    draining: Type.Optional(Type.Boolean()),
+                }))),
+                gateway: Type.Optional(Type.Object({
+                    port: Type.Number(),
+                    certFile: Type.Optional(Type.String()),
+                    keyFile: Type.Optional(Type.String()),
+                    clientCaFile: Type.Optional(Type.String()),
+                    hostnames: Type.Optional(Type.Array(Type.String())),
+                    workspaceRoot: Type.Optional(Type.String()),
+                    workers: Type.Optional(Type.Record(Type.String(), Type.Object({
+                        maxRuntimes: Type.Optional(Type.Number()),
+                        draining: Type.Optional(Type.Boolean()),
+                    }))),
+                })),
+            })),
+        })),
         defaultSharedVault: Type.Optional(Type.String()),
     })),
     autoReply: Type.Optional(Type.Object({
@@ -111,6 +145,7 @@ function normalizeSandboxSettings(sandbox) {
         ...(sandbox.memory !== undefined ? { memory: sandbox.memory } : {}),
         ...(sandbox.boost !== undefined ? { boost: sandbox.boost } : {}),
         ...(sandbox.image !== undefined ? { image: sandbox.image } : {}),
+        ...(sandbox.gondolin !== undefined ? { gondolin: sandbox.gondolin } : {}),
         ...(defaultSharedVault ? { defaultSharedVault } : {}),
     };
 }
@@ -131,6 +166,11 @@ function mergeSandboxSettings(base, override) {
         ...override,
         ...(base.boost || override.boost ? { boost: { ...base.boost, ...override.boost } } : {}),
         ...(base.image || override.image ? { image: { ...base.image, ...override.image } } : {}),
+        // `remote` is one connection description; merging two halves of it would
+        // pair a URL with the wrong certificates, so the override wins wholesale.
+        ...(base.gondolin || override.gondolin
+            ? { gondolin: { ...base.gondolin, ...override.gondolin } }
+            : {}),
     };
 }
 function getSettingsPath() {

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAA4B,YAAoB;QAC9C,KAAK,CAAC,mCAAmC,YAAY,EAAE,CAAC,CAAC;4BAD/B,YAAY;QAEtC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAKD,MAAM,gBAAgB,GAAuB;IAC3C,GAAG,EAAE;QACH,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,mBAAmB;QAC1B,aAAa,EAAE,KAAK;QACpB,SAAS,EAAE;YACT,QAAQ,EAAE,WAAW;YACrB,KAAK,EAAE,kBAAkB;SAC1B;KACF;IACD,KAAK,EAAE;QACL,SAAS,EAAE,WAAW;KACvB;IACD,OAAO,EAAE;QACP,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE;YACL,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,IAAI;SACb;QACD,KAAK,EAAE;YACL,cAAc,EAAE,SAAS;SAC1B;QACD,kBAAkB,EAAE,EAAE;KACvB;CACF,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAChB,IAAI,CAAC,MAAM,CAAC;QACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACtC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,KAAK,CAAC;YACT,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;SACpB,CAAC,CACH;QACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;SACpC,CAAC,CACH;KACF,CAAC,CACH;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACV,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KAClC,CAAC,CACH;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;QACV,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;KAC1F,CAAC,CACH;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;YACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;SACrC,CAAC,CACH;QACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;YACV,cAAc,EAAE,IAAI,CAAC,QAAQ,CAC3B,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAC5D;SACF,CAAC,CACH;QACD,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KACjD,CAAC,CACH;IACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC;QACV,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KAChD,CAAC,CACH;CACF,CAAC,CAAC;AAIH,SAAS,gBAAgB,CAAC,YAAoB;IAC5C,OAAO,0BAA0B,CAAC,YAAY,EAAE,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC7E,MAAM,KAAK,uBAAuB;QAChC,CAAC,CAAC,8BAA8B,YAAY,2CAA2C;QACvF,CAAC,CAAC,8BAA8B,YAAY,KAAK,MAAM,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA0B;IACzD,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,OAAwB;IACxD,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC9D,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,IAAiC,EACjC,QAAqC;IAErC,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3B,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,GAAG,IAAI;QACP,GAAG,QAAQ;QACX,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,0BAA0B,CAAC,YAAY,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB,EAAE,IAAY;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,oDAAoD,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAgC;IAC5D,OAAO,aAAa,CAAC,KAAK,EAAE,mBAAmB,CAAkB,CAAC;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,QAA8B;IACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAE7B,OAAO;QACL,QAAQ;QACR,KAAK;QACL,aAAa;QACb,SAAS;QACT,OAAO;QACP,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,uBAAuB,CAAC,qBAAqB,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wBAAwB,CAAC,eAAuB;IAC9D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IACvF,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1C,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC1D,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC5C,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,gDAAgD,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,CAAC,UAAU,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,kDAAkD,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,qDAAqD,QAAQ,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,eAAuB;IACjE,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,kBAAkB,GAAG,uBAAuB,CAChD,gBAAgB,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAClE,CAAC;IACF,yEAAyE;IACzE,8EAA8E;IAC9E,MAAM,OAAO,GAAG,oBAAoB,CAAC,YAAY,CAAC,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACvF,OAAO,aAAa,CAAC;QACnB,GAAG,YAAY;QACf,GAAG,kBAAkB;QACrB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,eAAwB;IAC9D,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,eAAe;QAC3B,CAAC,CAAC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GAA8B,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAEvD,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,eAAuB;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC3D,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACrE,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,eAAuB,EACvB,MAAuB;IAEvB,eAAe,CAAC,eAAe,CAAC,CAAC;IAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IAE9D,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACpC,CAAC;IAED,sBAAsB,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEpB,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YACzE,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/E,SAAS;QACX,CAAC;QAED,IACE,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;YAC5B,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC;YAC7B,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAC9B,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,MAAc;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAgB,EAChB,UAAkB,EAClB,WAAmB;IAEnB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC;QAAE,OAAO;IAChD,MAAM,OAAO,GACX,gBAAgB,QAAQ,+CAA+C,UAAU,KAAK;QACtF,0EAA0E;QAC1E,qEAAqE,CAAC;IACxE,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,UAAU,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,SAAS,CAAC;IAC5B,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,YAAY,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1B,sBAAsB,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAChF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,MAA2C;IAClE,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,qBAAqB,CAAC,MAA0B;IACvD,OAAO;QACL,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA4B,EAC5B,MAA4B;IAE5B,MAAM,OAAO,GAAuB;QAClC,GAAG,QAAQ;QACX,GAAG,EAAE;YACH,GAAG,QAAQ,CAAC,GAAG;YACf,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF;QACD,MAAM,EAAE;YACN,GAAG,QAAQ,CAAC,MAAM;YAClB,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE;QACD,0EAA0E;QAC1E,6EAA6E;QAC7E,mEAAmE;QACnE,OAAO,EAAE,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;QACrE,KAAK,EAAE;YACL,GAAG,QAAQ,CAAC,KAAK;YACjB,GAAG,MAAM,CAAC,KAAK;SAChB;KACF,CAAC;IACF,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,kBAAkB,CACzB,YAAoB,EACpB,KAA2B,EAC3B,eAAmC;IAEnC,IAAI,QAAQ,GAAG,eAAe,CAAC;IAC/B,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,QAAQ,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,yBAAyB,CAAC;gBAC1D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,+CAA+C,CAAC;gBAC5F,CAAC,CAAC,MAAM,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACvC,sBAAsB,CACpB,YAAY,EACZ,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAA2B;IAC9D,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,eAAuB,EACvB,KAA2B;IAE3B,kBAAkB,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC","sourcesContent":["import type { ThinkingLevel } from \"@earendil-works/pi-agent-core\";\nimport { Type, type Static } from \"@sinclair/typebox\";\nimport { existsSync, readFileSync, renameSync, rmSync } from \"fs\";\nimport { homedir } from \"os\";\nimport { basename, dirname, join, resolve } from \"path\";\nimport { readEnv } from \"./utils/env.js\";\nimport { ensureDirExists, readJsonSchemaFileIfExists } from \"./utils/file-guards.js\";\nimport { atomicWritePrivateFile } from \"./utils/fs-atomic.js\";\nimport * as log from \"./log.js\";\n\nexport class MissingGlobalSettingsError extends Error {\n  constructor(public readonly settingsPath: string) {\n    super(`Missing global settings file at ${settingsPath}`);\n    this.name = \"MissingGlobalSettingsError\";\n  }\n}\n\nexport type { AgentConfig, AutoReplyConfig, JudgeModelConfig, SandboxSettings } from \"./types.js\";\nimport type { AgentConfig, AutoReplyConfig, JudgeModelConfig, SandboxSettings } from \"./types.js\";\n\nconst ONBOARD_SETTINGS: SettingsFileConfig = {\n  llm: {\n    provider: \"anthropic\",\n    model: \"claude-sonnet-4-6\",\n    thinkingLevel: \"off\",\n    autoReply: {\n      provider: \"anthropic\",\n      model: \"claude-haiku-4-5\",\n    },\n  },\n  slack: {\n    replyMode: \"top-level\",\n  },\n  sandbox: {\n    cpus: \"0.5\",\n    memory: \"1g\",\n    boost: {\n      cpus: \"2\",\n      memory: \"4g\",\n    },\n    image: {\n      workspaceMount: \"private\",\n    },\n    defaultSharedVault: \"\",\n  },\n};\n\nconst SettingsFileSchema = Type.Object({\n  llm: Type.Optional(\n    Type.Object({\n      provider: Type.Optional(Type.String()),\n      model: Type.Optional(Type.String()),\n      thinkingLevel: Type.Optional(\n        Type.Union([\n          Type.Literal(\"off\"),\n          Type.Literal(\"minimal\"),\n          Type.Literal(\"low\"),\n          Type.Literal(\"medium\"),\n          Type.Literal(\"high\"),\n          Type.Literal(\"xhigh\"),\n          Type.Literal(\"max\"),\n        ]),\n      ),\n      autoReply: Type.Optional(\n        Type.Object({\n          provider: Type.Optional(Type.String()),\n          model: Type.Optional(Type.String()),\n        }),\n      ),\n    }),\n  ),\n  sentry: Type.Optional(\n    Type.Object({\n      dsn: Type.Optional(Type.String()),\n    }),\n  ),\n  slack: Type.Optional(\n    Type.Object({\n      replyMode: Type.Optional(Type.Union([Type.Literal(\"top-level\"), Type.Literal(\"thread\")])),\n    }),\n  ),\n  sandbox: Type.Optional(\n    Type.Object({\n      cpus: Type.Optional(Type.String()),\n      memory: Type.Optional(Type.String()),\n      boost: Type.Optional(\n        Type.Object({\n          cpus: Type.Optional(Type.String()),\n          memory: Type.Optional(Type.String()),\n        }),\n      ),\n      image: Type.Optional(\n        Type.Object({\n          workspaceMount: Type.Optional(\n            Type.Union([Type.Literal(\"private\"), Type.Literal(\"full\")]),\n          ),\n        }),\n      ),\n      defaultSharedVault: Type.Optional(Type.String()),\n    }),\n  ),\n  autoReply: Type.Optional(\n    Type.Object({\n      enabled: Type.Optional(Type.Boolean()),\n      rules: Type.Optional(Type.Array(Type.String())),\n    }),\n  ),\n});\n\ntype SettingsFileConfig = Static<typeof SettingsFileSchema>;\n\nfunction loadSettingsFile(settingsPath: string): SettingsFileConfig | undefined {\n  return readJsonSchemaFileIfExists(settingsPath, SettingsFileSchema, (detail) =>\n    detail === \"unexpected JSON shape\"\n      ? `Malformed settings file at ${settingsPath}: expected a JSON object at the top level`\n      : `Malformed settings file at ${settingsPath}: ${detail}`,\n  );\n}\n\nfunction getStateDir(): string {\n  const raw = readEnv(\"STATE_DIR\");\n  return raw ? resolve(raw) : join(homedir(), \".mikan\");\n}\n\nfunction normalizeSettingsConfig(config: SettingsFileConfig): Partial<AgentConfig> {\n  return {\n    ...(config.llm?.provider !== undefined ? { provider: config.llm.provider } : {}),\n    ...(config.llm?.model !== undefined ? { model: config.llm.model } : {}),\n    ...(config.llm?.thinkingLevel !== undefined ? { thinkingLevel: config.llm.thinkingLevel } : {}),\n    ...(config.sentry?.dsn !== undefined ? { sentryDsn: config.sentry.dsn } : {}),\n    ...(config.sandbox !== undefined ? { sandbox: normalizeSandboxSettings(config.sandbox) } : {}),\n    ...(config.slack !== undefined ? { slack: config.slack } : {}),\n  };\n}\n\n/**\n * File shape → in-memory shape for the sandbox group. An empty or\n * whitespace-only `defaultSharedVault` means \"no default\" and is dropped;\n * non-empty values are trimmed. Everything else passes through as-is.\n */\nfunction normalizeSandboxSettings(sandbox: SandboxSettings): SandboxSettings {\n  const defaultSharedVault = sandbox.defaultSharedVault?.trim();\n  return {\n    ...(sandbox.cpus !== undefined ? { cpus: sandbox.cpus } : {}),\n    ...(sandbox.memory !== undefined ? { memory: sandbox.memory } : {}),\n    ...(sandbox.boost !== undefined ? { boost: sandbox.boost } : {}),\n    ...(sandbox.image !== undefined ? { image: sandbox.image } : {}),\n    ...(defaultSharedVault ? { defaultSharedVault } : {}),\n  };\n}\n\n/**\n * Merge two sandbox settings groups. The merge invariant is LEAF-LEVEL:\n * an override that only sets `sandbox.memory` keeps the base `sandbox.cpus`,\n * and an override that only sets `boost.memory` keeps the base `boost.cpus`\n * (same for `image`). This mirrors how the fields merged when they were\n * flat top-level keys; a group-level spread would silently drop base leaves.\n */\nfunction mergeSandboxSettings(\n  base: SandboxSettings | undefined,\n  override: SandboxSettings | undefined,\n): SandboxSettings | undefined {\n  if (!base) return override;\n  if (!override) return base;\n  return {\n    ...base,\n    ...override,\n    ...(base.boost || override.boost ? { boost: { ...base.boost, ...override.boost } } : {}),\n    ...(base.image || override.image ? { image: { ...base.image, ...override.image } } : {}),\n  };\n}\n\nfunction getSettingsPath(): string {\n  return join(getStateDir(), \"settings.json\");\n}\n\nfunction requireGlobalSettings(): SettingsFileConfig {\n  const settingsPath = getSettingsPath();\n  const config = loadSettingsFile(settingsPath);\n  if (!config) {\n    throw new MissingGlobalSettingsError(settingsPath);\n  }\n  return config;\n}\n\nfunction requireString(value: string | undefined, path: string): string {\n  if (!value) {\n    throw new Error(\n      `Missing required global setting: ${path}. Run \\`mikan --onboard\\` to create settings.json.`,\n    );\n  }\n  return value;\n}\n\nfunction requireThinkingLevel(value: ThinkingLevel | undefined): ThinkingLevel {\n  return requireString(value, \"llm.thinkingLevel\") as ThinkingLevel;\n}\n\nfunction toAgentConfig(fromFile: Partial<AgentConfig>): AgentConfig {\n  const provider = requireString(fromFile.provider, \"llm.provider\");\n  const model = requireString(fromFile.model, \"llm.model\");\n  const thinkingLevel = requireThinkingLevel(fromFile.thinkingLevel);\n  const sentryDsn = fromFile.sentryDsn ?? process.env.SENTRY_DSN;\n  const sandbox = fromFile.sandbox;\n  const slack = fromFile.slack;\n\n  return {\n    provider,\n    model,\n    thinkingLevel,\n    sentryDsn,\n    sandbox,\n    slack,\n  };\n}\n\nfunction loadRawGlobalSettings(): Partial<AgentConfig> {\n  return normalizeSettingsConfig(requireGlobalSettings());\n}\n\nexport function loadGlobalSettings(): AgentConfig {\n  return toAgentConfig(loadRawGlobalSettings());\n}\n\n/**\n * Host-authoritative location of a conversation's settings file:\n * `<stateDir>/conversations/<conversationId>/settings.json`.\n *\n * Conversation settings used to live at `<conversationDir>/settings.json`,\n * but conversation dirs are bind-mounted read-write into sandbox containers\n * in image mode — code inside the sandbox could edit its own settings.json\n * and flip `sandbox.image.workspaceMount` to \"full\", remounting the entire\n * workspace into its container (cross-conversation access). Settings are an\n * administrator surface, so they live under the host-only state dir.\n *\n * Migration: on first access per conversation, a legacy\n * `<conversationDir>/settings.json` is moved here. The new file's existence\n * (an empty `{}` is written when there is nothing to migrate) is the\n * migration marker — a legacy file (re)appearing later, e.g. planted from\n * inside the sandbox, is never read again.\n */\nexport function conversationSettingsPath(conversationDir: string): string {\n  const conversationId = basename(resolve(conversationDir));\n  const hostPath = join(getStateDir(), \"conversations\", conversationId, \"settings.json\");\n  if (existsSync(hostPath)) return hostPath;\n\n  ensureDirExists(dirname(hostPath));\n  const legacyPath = join(conversationDir, \"settings.json\");\n  let content = \"{}\\n\";\n  let migrated = false;\n  if (existsSync(legacyPath)) {\n    try {\n      content = readFileSync(legacyPath, \"utf-8\");\n      migrated = true;\n    } catch (err) {\n      log.logWarning(`Could not read legacy conversation settings: ${legacyPath}`, String(err));\n    }\n  }\n  atomicWritePrivateFile(hostPath, content);\n  if (migrated) {\n    try {\n      rmSync(legacyPath);\n    } catch (err) {\n      log.logWarning(`Could not remove legacy conversation settings: ${legacyPath}`, String(err));\n    }\n    log.logInfo(`Migrated conversation settings to host-only path: ${hostPath}`);\n  }\n  return hostPath;\n}\n\nexport function resolveConversationSettings(conversationDir: string): AgentConfig {\n  const globalConfig = loadRawGlobalSettings();\n  const conversationConfig = normalizeSettingsConfig(\n    loadSettingsFile(conversationSettingsPath(conversationDir)) ?? {},\n  );\n  // The sandbox group merges at the leaf level (see mergeSandboxSettings):\n  // a conversation that only sets sandbox.memory keeps the global sandbox.cpus.\n  const sandbox = mergeSandboxSettings(globalConfig.sandbox, conversationConfig.sandbox);\n  return toAgentConfig({\n    ...globalConfig,\n    ...conversationConfig,\n    ...(sandbox ? { sandbox } : {}),\n  });\n}\n\n/**\n * Resolve the model used to judge auto-reply rules. Falls back to the main\n * llm.{provider,model} when llm.autoReply is not set, so a missing override\n * keeps current behavior.\n *\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport function loadAutoReplyJudgeModel(conversationDir?: string): JudgeModelConfig {\n  const global = requireGlobalSettings();\n  const local = conversationDir\n    ? (loadSettingsFile(conversationSettingsPath(conversationDir)) ?? {})\n    : {};\n  const merged: SettingsFileConfig[\"llm\"] = { ...global.llm, ...local.llm };\n  const judge = { ...global.llm?.autoReply, ...local.llm?.autoReply };\n  const provider = requireString(judge.provider ?? merged?.provider, \"llm.autoReply.provider\");\n  const model = requireString(judge.model ?? merged?.model, \"llm.autoReply.model\");\n  return { provider, model };\n}\n\nconst AUTO_REPLY_FILE = \"auto-reply\";\nconst AUTO_REPLY_DISABLED_FILE = \"auto-reply.disabled\";\n\nfunction readAutoReplyRulesFile(path: string): string[] {\n  const text = readFileSync(path, \"utf-8\").trim();\n  return text ? [text] : [];\n}\n\n/**\n * Load the mom-compatible auto-reply marker file state for a conversation.\n *\n * - `auto-reply` exists: enabled; empty file means reply to any top-level message.\n * - `auto-reply.disabled` exists: disabled, preserving any rules text for re-enable.\n * - neither exists: disabled.\n *\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport function loadConversationAutoReplyConfig(conversationDir: string): AutoReplyConfig {\n  const enabledPath = join(conversationDir, AUTO_REPLY_FILE);\n  if (existsSync(enabledPath)) {\n    return { enabled: true, rules: readAutoReplyRulesFile(enabledPath) };\n  }\n\n  const disabledPath = join(conversationDir, AUTO_REPLY_DISABLED_FILE);\n  if (existsSync(disabledPath)) {\n    return { enabled: false, rules: readAutoReplyRulesFile(disabledPath) };\n  }\n\n  return { enabled: false, rules: [] };\n}\n\n/**\n * Save auto-reply state using mom-compatible marker files.\n *\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport function saveConversationAutoReplyConfig(\n  conversationDir: string,\n  config: AutoReplyConfig,\n): void {\n  ensureDirExists(conversationDir);\n\n  const enabledPath = join(conversationDir, AUTO_REPLY_FILE);\n  const disabledPath = join(conversationDir, AUTO_REPLY_DISABLED_FILE);\n  const targetPath = config.enabled ? enabledPath : disabledPath;\n  const otherPath = config.enabled ? disabledPath : enabledPath;\n\n  if (existsSync(otherPath)) {\n    renameSync(otherPath, targetPath);\n  }\n\n  atomicWritePrivateFile(targetPath, config.rules.join(\"\\n\"));\n}\n\nexport function resolveWorkspaceDirFromArgv(args = process.argv.slice(2)): string | undefined {\n  for (let i = 0; i < args.length; i++) {\n    const arg = args[i];\n\n    if (arg === \"--sandbox\" || arg === \"--download\" || arg === \"--state-dir\") {\n      i += 1;\n      continue;\n    }\n\n    if (arg === \"--version\" || arg === \"-v\" || arg === \"-V\" || arg === \"--onboard\") {\n      continue;\n    }\n\n    if (\n      arg.startsWith(\"--sandbox=\") ||\n      arg.startsWith(\"--download=\") ||\n      arg.startsWith(\"--state-dir=\")\n    ) {\n      continue;\n    }\n\n    if (!arg.startsWith(\"-\")) {\n      return arg;\n    }\n  }\n\n  return undefined;\n}\n\nexport function resolveStateDirFromArgv(args = process.argv.slice(2)): string {\n  for (let i = 0; i < args.length; i++) {\n    const arg = args[i];\n    if (arg.startsWith(\"--state-dir=\")) {\n      return resolve(arg.slice(\"--state-dir=\".length));\n    }\n    if (arg === \"--state-dir\") {\n      return resolve(args[++i] || \"\");\n    }\n  }\n\n  return join(homedir(), \".mikan\");\n}\n\n/**\n * True when `child` is `parent` or a path inside it. Purely lexical (no\n * symlink resolution) — used for configuration sanity checks, not as the\n * final security boundary.\n */\nexport function isPathInside(child: string, parent: string): boolean {\n  const parentPath = resolve(parent);\n  const childPath = resolve(child);\n  return childPath === parentPath || childPath.startsWith(parentPath + \"/\");\n}\n\n/**\n * The state dir (extensions code, extension data, vaults, auth.json) must\n * never live inside the working dir: conversation opt-in \"full\" mode mounts\n * the entire working dir read-write into sandbox containers, and a mounted\n * state dir would let sandboxed code plant extension modules that the host\n * process later imports — a sandbox escape. Fatal under sandboxed modes;\n * host mode has no mounts, so only warn about the bad hygiene.\n */\nexport function assertStateDirOutsideWorkspace(\n  stateDir: string,\n  workingDir: string,\n  sandboxType: string,\n): void {\n  if (!isPathInside(stateDir, workingDir)) return;\n  const message =\n    `--state-dir (${stateDir}) must not be inside the working directory (${workingDir}): ` +\n    `sandbox containers mount the working directory, and a mounted state dir ` +\n    `would expose extensions, vaults, and credentials to sandboxed code.`;\n  if (sandboxType === \"host\") {\n    log.logWarning(\"Insecure state dir location\", message);\n    return;\n  }\n  throw new Error(message);\n}\n\nexport function resolveSentryDsn(): string | undefined {\n  const fromFile = normalizeSettingsConfig(loadSettingsFile(getSettingsPath()) ?? {});\n  if (fromFile.sentryDsn) {\n    return fromFile.sentryDsn;\n  }\n\n  return process.env.SENTRY_DSN;\n}\n\nexport function createGlobalSettingsFile(stateDir: string): string {\n  const settingsPath = join(stateDir, \"settings.json\");\n  if (existsSync(settingsPath)) {\n    throw new Error(`Global settings already exists at ${settingsPath}`);\n  }\n  ensureDirExists(stateDir);\n  atomicWritePrivateFile(settingsPath, JSON.stringify(ONBOARD_SETTINGS, null, 2));\n  return settingsPath;\n}\n\n/**\n * Externally-visible base URL of the link/OAuth server, e.g.\n * `https://mikan.example.com` (no trailing slash). Read from `LINK_URL` or\n * `MIKAN_LINK_URL`, the same env var the bot uses to build credential onboarding links.\n */\nexport function resolveLinkBaseUrl(): string | undefined {\n  const raw = readEnv(\"LINK_URL\");\n  if (!raw) return undefined;\n  return raw.replace(/\\/+$/, \"\");\n}\n\nfunction hasDefinedValue(values: Record<string, unknown> | undefined): boolean {\n  return values !== undefined && Object.values(values).some((value) => value !== undefined);\n}\n\nfunction compactSettingsConfig(config: SettingsFileConfig): SettingsFileConfig {\n  return {\n    ...(hasDefinedValue(config.llm) ? { llm: config.llm } : {}),\n    ...(hasDefinedValue(config.sentry) ? { sentry: config.sentry } : {}),\n    ...(hasDefinedValue(config.sandbox) ? { sandbox: config.sandbox } : {}),\n    ...(hasDefinedValue(config.autoReply) ? { autoReply: config.autoReply } : {}),\n    ...(hasDefinedValue(config.slack) ? { slack: config.slack } : {}),\n  };\n}\n\nfunction patchSettingsConfig(\n  existing: SettingsFileConfig,\n  config: Partial<AgentConfig>,\n): SettingsFileConfig {\n  const patched: SettingsFileConfig = {\n    ...existing,\n    llm: {\n      ...existing.llm,\n      ...(config.provider !== undefined ? { provider: config.provider } : {}),\n      ...(config.model !== undefined ? { model: config.model } : {}),\n      ...(config.thinkingLevel !== undefined ? { thinkingLevel: config.thinkingLevel } : {}),\n    },\n    sentry: {\n      ...existing.sentry,\n      ...(config.sentryDsn !== undefined ? { dsn: config.sentryDsn } : {}),\n    },\n    // Leaf-level merge: a patch that only sets sandbox.boost.memory keeps the\n    // existing boost.cpus (and every other existing leaf). compactSettingsConfig\n    // drops the group entirely when it ends up with no defined values.\n    sandbox: mergeSandboxSettings(existing.sandbox, config.sandbox) ?? {},\n    slack: {\n      ...existing.slack,\n      ...config.slack,\n    },\n  };\n  return compactSettingsConfig(patched);\n}\n\nfunction updateSettingsFile(\n  settingsPath: string,\n  patch: Partial<AgentConfig>,\n  defaultSettings: SettingsFileConfig,\n): void {\n  let existing = defaultSettings;\n  if (existsSync(settingsPath)) {\n    try {\n      existing = loadSettingsFile(settingsPath) ?? {};\n    } catch (err) {\n      const detail = err instanceof Error ? err.message : String(err);\n      const message = detail.startsWith(\"Malformed settings file\")\n        ? detail.replace(\"Malformed settings file\", \"Refusing to overwrite malformed settings file\")\n        : detail;\n      throw new Error(message, { cause: err });\n    }\n  }\n\n  ensureDirExists(dirname(settingsPath));\n  atomicWritePrivateFile(\n    settingsPath,\n    JSON.stringify(patchSettingsConfig(existing, patch), null, 2),\n  );\n}\n\nexport function updateGlobalSettings(patch: Partial<AgentConfig>): void {\n  updateSettingsFile(join(getStateDir(), \"settings.json\"), patch, ONBOARD_SETTINGS);\n}\n\nexport function updateConversationSettings(\n  conversationDir: string,\n  patch: Partial<AgentConfig>,\n): void {\n  updateSettingsFile(conversationSettingsPath(conversationDir), patch, {});\n}\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAA4B,YAAoB;QAC9C,KAAK,CAAC,mCAAmC,YAAY,EAAE,CAAC,CAAC;4BAD/B,YAAY;QAEtC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAKD,MAAM,gBAAgB,GAAuB;IAC3C,GAAG,EAAE;QACH,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,mBAAmB;QAC1B,aAAa,EAAE,KAAK;QACpB,SAAS,EAAE;YACT,QAAQ,EAAE,WAAW;YACrB,KAAK,EAAE,kBAAkB;SAC1B;KACF;IACD,KAAK,EAAE;QACL,SAAS,EAAE,WAAW;KACvB;IACD,OAAO,EAAE;QACP,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE;YACL,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,IAAI;SACb;QACD,KAAK,EAAE;YACL,cAAc,EAAE,SAAS;SAC1B;QACD,kBAAkB,EAAE,EAAE;KACvB;CACF,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAChB,IAAI,CAAC,MAAM,CAAC;QACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACtC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAC1B,IAAI,CAAC,KAAK,CAAC;YACT,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;SACpB,CAAC,CACH;QACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;SACpC,CAAC,CACH;KACF,CAAC,CACH;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACV,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KAClC,CAAC,CACH;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;QACV,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;KAC1F,CAAC,CACH;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;YACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;SACrC,CAAC,CACH;QACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;YACV,cAAc,EAAE,IAAI,CAAC,QAAQ,CAC3B,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAC5D;SACF,CAAC,CACH;QACD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;gBACV,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACtC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC3C,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACzC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC3C,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC9C,OAAO,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,KAAK,CACR,IAAI,CAAC,MAAM,CAAC;oBACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBAClC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE;oBAClB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACtC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC3C,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;iBACxC,CAAC,CACH,CACF;gBACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;oBACV,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACtC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC1C,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;oBACnD,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC3C,OAAO,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CACT,IAAI,CAAC,MAAM,EAAE,EACb,IAAI,CAAC,MAAM,CAAC;wBACV,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;wBACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;qBACxC,CAAC,CACH,CACF;iBACF,CAAC,CACH;aACF,CAAC,CACH;SACF,CAAC,CACH;QACD,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;KACjD,CAAC,CACH;IACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC;QACV,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;KAChD,CAAC,CACH;CACF,CAAC,CAAC;AAIH,SAAS,gBAAgB,CAAC,YAAoB;IAC5C,OAAO,0BAA0B,CAAC,YAAY,EAAE,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC7E,MAAM,KAAK,uBAAuB;QAChC,CAAC,CAAC,8BAA8B,YAAY,2CAA2C;QACvF,CAAC,CAAC,8BAA8B,YAAY,KAAK,MAAM,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA0B;IACzD,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,OAAwB;IACxD,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC9D,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,IAAiC,EACjC,QAAqC;IAErC,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3B,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,GAAG,IAAI;QACP,GAAG,QAAQ;QACX,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,yEAAyE;QACzE,0EAA0E;QAC1E,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;YACpC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE;YAC1D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,0BAA0B,CAAC,YAAY,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB,EAAE,IAAY;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,oDAAoD,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAgC;IAC5D,OAAO,aAAa,CAAC,KAAK,EAAE,mBAAmB,CAAkB,CAAC;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,QAA8B;IACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAE7B,OAAO;QACL,QAAQ;QACR,KAAK;QACL,aAAa;QACb,SAAS;QACT,OAAO;QACP,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,uBAAuB,CAAC,qBAAqB,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wBAAwB,CAAC,eAAuB;IAC9D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IACvF,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1C,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC1D,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC5C,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,gDAAgD,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,CAAC,UAAU,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,kDAAkD,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,qDAAqD,QAAQ,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,eAAuB;IACjE,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,kBAAkB,GAAG,uBAAuB,CAChD,gBAAgB,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAClE,CAAC;IACF,yEAAyE;IACzE,8EAA8E;IAC9E,MAAM,OAAO,GAAG,oBAAoB,CAAC,YAAY,CAAC,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACvF,OAAO,aAAa,CAAC;QACnB,GAAG,YAAY;QACf,GAAG,kBAAkB;QACrB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,eAAwB;IAC9D,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,eAAe;QAC3B,CAAC,CAAC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GAA8B,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAEvD,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,eAAuB;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC3D,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACrE,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,eAAuB,EACvB,MAAuB;IAEvB,eAAe,CAAC,eAAe,CAAC,CAAC;IAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IAE9D,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACpC,CAAC;IAED,sBAAsB,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEpB,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YACzE,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/E,SAAS;QACX,CAAC;QAED,IACE,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;YAC5B,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC;YAC7B,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAC9B,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,MAAc;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAgB,EAChB,UAAkB,EAClB,WAAmB;IAEnB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC;QAAE,OAAO;IAChD,MAAM,OAAO,GACX,gBAAgB,QAAQ,+CAA+C,UAAU,KAAK;QACtF,0EAA0E;QAC1E,qEAAqE,CAAC;IACxE,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,UAAU,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,SAAS,CAAC;IAC5B,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,YAAY,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1B,sBAAsB,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAChF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,MAA2C;IAClE,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,qBAAqB,CAAC,MAA0B;IACvD,OAAO;QACL,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA4B,EAC5B,MAA4B;IAE5B,MAAM,OAAO,GAAuB;QAClC,GAAG,QAAQ;QACX,GAAG,EAAE;YACH,GAAG,QAAQ,CAAC,GAAG;YACf,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF;QACD,MAAM,EAAE;YACN,GAAG,QAAQ,CAAC,MAAM;YAClB,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE;QACD,0EAA0E;QAC1E,6EAA6E;QAC7E,mEAAmE;QACnE,OAAO,EAAE,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;QACrE,KAAK,EAAE;YACL,GAAG,QAAQ,CAAC,KAAK;YACjB,GAAG,MAAM,CAAC,KAAK;SAChB;KACF,CAAC;IACF,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,kBAAkB,CACzB,YAAoB,EACpB,KAA2B,EAC3B,eAAmC;IAEnC,IAAI,QAAQ,GAAG,eAAe,CAAC;IAC/B,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,QAAQ,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,yBAAyB,CAAC;gBAC1D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,+CAA+C,CAAC;gBAC5F,CAAC,CAAC,MAAM,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACvC,sBAAsB,CACpB,YAAY,EACZ,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAA2B;IAC9D,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,eAAuB,EACvB,KAA2B;IAE3B,kBAAkB,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC","sourcesContent":["import type { ThinkingLevel } from \"@earendil-works/pi-agent-core\";\nimport { Type, type Static } from \"@sinclair/typebox\";\nimport { existsSync, readFileSync, renameSync, rmSync } from \"fs\";\nimport { homedir } from \"os\";\nimport { basename, dirname, join, resolve } from \"path\";\nimport { readEnv } from \"./utils/env.js\";\nimport { ensureDirExists, readJsonSchemaFileIfExists } from \"./utils/file-guards.js\";\nimport { atomicWritePrivateFile } from \"./utils/fs-atomic.js\";\nimport * as log from \"./log.js\";\n\nexport class MissingGlobalSettingsError extends Error {\n  constructor(public readonly settingsPath: string) {\n    super(`Missing global settings file at ${settingsPath}`);\n    this.name = \"MissingGlobalSettingsError\";\n  }\n}\n\nexport type { AgentConfig, AutoReplyConfig, JudgeModelConfig, SandboxSettings } from \"./types.js\";\nimport type { AgentConfig, AutoReplyConfig, JudgeModelConfig, SandboxSettings } from \"./types.js\";\n\nconst ONBOARD_SETTINGS: SettingsFileConfig = {\n  llm: {\n    provider: \"anthropic\",\n    model: \"claude-sonnet-4-6\",\n    thinkingLevel: \"off\",\n    autoReply: {\n      provider: \"anthropic\",\n      model: \"claude-haiku-4-5\",\n    },\n  },\n  slack: {\n    replyMode: \"top-level\",\n  },\n  sandbox: {\n    cpus: \"0.5\",\n    memory: \"1g\",\n    boost: {\n      cpus: \"2\",\n      memory: \"4g\",\n    },\n    image: {\n      workspaceMount: \"private\",\n    },\n    defaultSharedVault: \"\",\n  },\n};\n\nconst SettingsFileSchema = Type.Object({\n  llm: Type.Optional(\n    Type.Object({\n      provider: Type.Optional(Type.String()),\n      model: Type.Optional(Type.String()),\n      thinkingLevel: Type.Optional(\n        Type.Union([\n          Type.Literal(\"off\"),\n          Type.Literal(\"minimal\"),\n          Type.Literal(\"low\"),\n          Type.Literal(\"medium\"),\n          Type.Literal(\"high\"),\n          Type.Literal(\"xhigh\"),\n          Type.Literal(\"max\"),\n        ]),\n      ),\n      autoReply: Type.Optional(\n        Type.Object({\n          provider: Type.Optional(Type.String()),\n          model: Type.Optional(Type.String()),\n        }),\n      ),\n    }),\n  ),\n  sentry: Type.Optional(\n    Type.Object({\n      dsn: Type.Optional(Type.String()),\n    }),\n  ),\n  slack: Type.Optional(\n    Type.Object({\n      replyMode: Type.Optional(Type.Union([Type.Literal(\"top-level\"), Type.Literal(\"thread\")])),\n    }),\n  ),\n  sandbox: Type.Optional(\n    Type.Object({\n      cpus: Type.Optional(Type.String()),\n      memory: Type.Optional(Type.String()),\n      boost: Type.Optional(\n        Type.Object({\n          cpus: Type.Optional(Type.String()),\n          memory: Type.Optional(Type.String()),\n        }),\n      ),\n      image: Type.Optional(\n        Type.Object({\n          workspaceMount: Type.Optional(\n            Type.Union([Type.Literal(\"private\"), Type.Literal(\"full\")]),\n          ),\n        }),\n      ),\n      gondolin: Type.Optional(\n        Type.Object({\n          remote: Type.Optional(\n            Type.Object({\n              url: Type.Optional(Type.String()),\n              caFile: Type.Optional(Type.String()),\n              certFile: Type.Optional(Type.String()),\n              keyFile: Type.Optional(Type.String()),\n              workspaceRoot: Type.Optional(Type.String()),\n              maxRuntimes: Type.Optional(Type.Number()),\n              imageSelector: Type.Optional(Type.String()),\n              queueWaitSeconds: Type.Optional(Type.Number()),\n              workers: Type.Optional(\n                Type.Array(\n                  Type.Object({\n                    name: Type.Optional(Type.String()),\n                    url: Type.String(),\n                    caFile: Type.Optional(Type.String()),\n                    certFile: Type.Optional(Type.String()),\n                    keyFile: Type.Optional(Type.String()),\n                    workspaceRoot: Type.Optional(Type.String()),\n                    maxRuntimes: Type.Optional(Type.Number()),\n                    draining: Type.Optional(Type.Boolean()),\n                  }),\n                ),\n              ),\n              gateway: Type.Optional(\n                Type.Object({\n                  port: Type.Number(),\n                  certFile: Type.Optional(Type.String()),\n                  keyFile: Type.Optional(Type.String()),\n                  clientCaFile: Type.Optional(Type.String()),\n                  hostnames: Type.Optional(Type.Array(Type.String())),\n                  workspaceRoot: Type.Optional(Type.String()),\n                  workers: Type.Optional(\n                    Type.Record(\n                      Type.String(),\n                      Type.Object({\n                        maxRuntimes: Type.Optional(Type.Number()),\n                        draining: Type.Optional(Type.Boolean()),\n                      }),\n                    ),\n                  ),\n                }),\n              ),\n            }),\n          ),\n        }),\n      ),\n      defaultSharedVault: Type.Optional(Type.String()),\n    }),\n  ),\n  autoReply: Type.Optional(\n    Type.Object({\n      enabled: Type.Optional(Type.Boolean()),\n      rules: Type.Optional(Type.Array(Type.String())),\n    }),\n  ),\n});\n\ntype SettingsFileConfig = Static<typeof SettingsFileSchema>;\n\nfunction loadSettingsFile(settingsPath: string): SettingsFileConfig | undefined {\n  return readJsonSchemaFileIfExists(settingsPath, SettingsFileSchema, (detail) =>\n    detail === \"unexpected JSON shape\"\n      ? `Malformed settings file at ${settingsPath}: expected a JSON object at the top level`\n      : `Malformed settings file at ${settingsPath}: ${detail}`,\n  );\n}\n\nfunction getStateDir(): string {\n  const raw = readEnv(\"STATE_DIR\");\n  return raw ? resolve(raw) : join(homedir(), \".mikan\");\n}\n\nfunction normalizeSettingsConfig(config: SettingsFileConfig): Partial<AgentConfig> {\n  return {\n    ...(config.llm?.provider !== undefined ? { provider: config.llm.provider } : {}),\n    ...(config.llm?.model !== undefined ? { model: config.llm.model } : {}),\n    ...(config.llm?.thinkingLevel !== undefined ? { thinkingLevel: config.llm.thinkingLevel } : {}),\n    ...(config.sentry?.dsn !== undefined ? { sentryDsn: config.sentry.dsn } : {}),\n    ...(config.sandbox !== undefined ? { sandbox: normalizeSandboxSettings(config.sandbox) } : {}),\n    ...(config.slack !== undefined ? { slack: config.slack } : {}),\n  };\n}\n\n/**\n * File shape → in-memory shape for the sandbox group. An empty or\n * whitespace-only `defaultSharedVault` means \"no default\" and is dropped;\n * non-empty values are trimmed. Everything else passes through as-is.\n */\nfunction normalizeSandboxSettings(sandbox: SandboxSettings): SandboxSettings {\n  const defaultSharedVault = sandbox.defaultSharedVault?.trim();\n  return {\n    ...(sandbox.cpus !== undefined ? { cpus: sandbox.cpus } : {}),\n    ...(sandbox.memory !== undefined ? { memory: sandbox.memory } : {}),\n    ...(sandbox.boost !== undefined ? { boost: sandbox.boost } : {}),\n    ...(sandbox.image !== undefined ? { image: sandbox.image } : {}),\n    ...(sandbox.gondolin !== undefined ? { gondolin: sandbox.gondolin } : {}),\n    ...(defaultSharedVault ? { defaultSharedVault } : {}),\n  };\n}\n\n/**\n * Merge two sandbox settings groups. The merge invariant is LEAF-LEVEL:\n * an override that only sets `sandbox.memory` keeps the base `sandbox.cpus`,\n * and an override that only sets `boost.memory` keeps the base `boost.cpus`\n * (same for `image`). This mirrors how the fields merged when they were\n * flat top-level keys; a group-level spread would silently drop base leaves.\n */\nfunction mergeSandboxSettings(\n  base: SandboxSettings | undefined,\n  override: SandboxSettings | undefined,\n): SandboxSettings | undefined {\n  if (!base) return override;\n  if (!override) return base;\n  return {\n    ...base,\n    ...override,\n    ...(base.boost || override.boost ? { boost: { ...base.boost, ...override.boost } } : {}),\n    ...(base.image || override.image ? { image: { ...base.image, ...override.image } } : {}),\n    // `remote` is one connection description; merging two halves of it would\n    // pair a URL with the wrong certificates, so the override wins wholesale.\n    ...(base.gondolin || override.gondolin\n      ? { gondolin: { ...base.gondolin, ...override.gondolin } }\n      : {}),\n  };\n}\n\nfunction getSettingsPath(): string {\n  return join(getStateDir(), \"settings.json\");\n}\n\nfunction requireGlobalSettings(): SettingsFileConfig {\n  const settingsPath = getSettingsPath();\n  const config = loadSettingsFile(settingsPath);\n  if (!config) {\n    throw new MissingGlobalSettingsError(settingsPath);\n  }\n  return config;\n}\n\nfunction requireString(value: string | undefined, path: string): string {\n  if (!value) {\n    throw new Error(\n      `Missing required global setting: ${path}. Run \\`mikan --onboard\\` to create settings.json.`,\n    );\n  }\n  return value;\n}\n\nfunction requireThinkingLevel(value: ThinkingLevel | undefined): ThinkingLevel {\n  return requireString(value, \"llm.thinkingLevel\") as ThinkingLevel;\n}\n\nfunction toAgentConfig(fromFile: Partial<AgentConfig>): AgentConfig {\n  const provider = requireString(fromFile.provider, \"llm.provider\");\n  const model = requireString(fromFile.model, \"llm.model\");\n  const thinkingLevel = requireThinkingLevel(fromFile.thinkingLevel);\n  const sentryDsn = fromFile.sentryDsn ?? process.env.SENTRY_DSN;\n  const sandbox = fromFile.sandbox;\n  const slack = fromFile.slack;\n\n  return {\n    provider,\n    model,\n    thinkingLevel,\n    sentryDsn,\n    sandbox,\n    slack,\n  };\n}\n\nfunction loadRawGlobalSettings(): Partial<AgentConfig> {\n  return normalizeSettingsConfig(requireGlobalSettings());\n}\n\nexport function loadGlobalSettings(): AgentConfig {\n  return toAgentConfig(loadRawGlobalSettings());\n}\n\n/**\n * Host-authoritative location of a conversation's settings file:\n * `<stateDir>/conversations/<conversationId>/settings.json`.\n *\n * Conversation settings used to live at `<conversationDir>/settings.json`,\n * but conversation dirs are bind-mounted read-write into sandbox containers\n * in image mode — code inside the sandbox could edit its own settings.json\n * and flip `sandbox.image.workspaceMount` to \"full\", remounting the entire\n * workspace into its container (cross-conversation access). Settings are an\n * administrator surface, so they live under the host-only state dir.\n *\n * Migration: on first access per conversation, a legacy\n * `<conversationDir>/settings.json` is moved here. The new file's existence\n * (an empty `{}` is written when there is nothing to migrate) is the\n * migration marker — a legacy file (re)appearing later, e.g. planted from\n * inside the sandbox, is never read again.\n */\nexport function conversationSettingsPath(conversationDir: string): string {\n  const conversationId = basename(resolve(conversationDir));\n  const hostPath = join(getStateDir(), \"conversations\", conversationId, \"settings.json\");\n  if (existsSync(hostPath)) return hostPath;\n\n  ensureDirExists(dirname(hostPath));\n  const legacyPath = join(conversationDir, \"settings.json\");\n  let content = \"{}\\n\";\n  let migrated = false;\n  if (existsSync(legacyPath)) {\n    try {\n      content = readFileSync(legacyPath, \"utf-8\");\n      migrated = true;\n    } catch (err) {\n      log.logWarning(`Could not read legacy conversation settings: ${legacyPath}`, String(err));\n    }\n  }\n  atomicWritePrivateFile(hostPath, content);\n  if (migrated) {\n    try {\n      rmSync(legacyPath);\n    } catch (err) {\n      log.logWarning(`Could not remove legacy conversation settings: ${legacyPath}`, String(err));\n    }\n    log.logInfo(`Migrated conversation settings to host-only path: ${hostPath}`);\n  }\n  return hostPath;\n}\n\nexport function resolveConversationSettings(conversationDir: string): AgentConfig {\n  const globalConfig = loadRawGlobalSettings();\n  const conversationConfig = normalizeSettingsConfig(\n    loadSettingsFile(conversationSettingsPath(conversationDir)) ?? {},\n  );\n  // The sandbox group merges at the leaf level (see mergeSandboxSettings):\n  // a conversation that only sets sandbox.memory keeps the global sandbox.cpus.\n  const sandbox = mergeSandboxSettings(globalConfig.sandbox, conversationConfig.sandbox);\n  return toAgentConfig({\n    ...globalConfig,\n    ...conversationConfig,\n    ...(sandbox ? { sandbox } : {}),\n  });\n}\n\n/**\n * Resolve the model used to judge auto-reply rules. Falls back to the main\n * llm.{provider,model} when llm.autoReply is not set, so a missing override\n * keeps current behavior.\n *\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport function loadAutoReplyJudgeModel(conversationDir?: string): JudgeModelConfig {\n  const global = requireGlobalSettings();\n  const local = conversationDir\n    ? (loadSettingsFile(conversationSettingsPath(conversationDir)) ?? {})\n    : {};\n  const merged: SettingsFileConfig[\"llm\"] = { ...global.llm, ...local.llm };\n  const judge = { ...global.llm?.autoReply, ...local.llm?.autoReply };\n  const provider = requireString(judge.provider ?? merged?.provider, \"llm.autoReply.provider\");\n  const model = requireString(judge.model ?? merged?.model, \"llm.autoReply.model\");\n  return { provider, model };\n}\n\nconst AUTO_REPLY_FILE = \"auto-reply\";\nconst AUTO_REPLY_DISABLED_FILE = \"auto-reply.disabled\";\n\nfunction readAutoReplyRulesFile(path: string): string[] {\n  const text = readFileSync(path, \"utf-8\").trim();\n  return text ? [text] : [];\n}\n\n/**\n * Load the mom-compatible auto-reply marker file state for a conversation.\n *\n * - `auto-reply` exists: enabled; empty file means reply to any top-level message.\n * - `auto-reply.disabled` exists: disabled, preserving any rules text for re-enable.\n * - neither exists: disabled.\n *\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport function loadConversationAutoReplyConfig(conversationDir: string): AutoReplyConfig {\n  const enabledPath = join(conversationDir, AUTO_REPLY_FILE);\n  if (existsSync(enabledPath)) {\n    return { enabled: true, rules: readAutoReplyRulesFile(enabledPath) };\n  }\n\n  const disabledPath = join(conversationDir, AUTO_REPLY_DISABLED_FILE);\n  if (existsSync(disabledPath)) {\n    return { enabled: false, rules: readAutoReplyRulesFile(disabledPath) };\n  }\n\n  return { enabled: false, rules: [] };\n}\n\n/**\n * Save auto-reply state using mom-compatible marker files.\n *\n * @deprecated Auto-reply is kept for compatibility while its future is undecided.\n */\nexport function saveConversationAutoReplyConfig(\n  conversationDir: string,\n  config: AutoReplyConfig,\n): void {\n  ensureDirExists(conversationDir);\n\n  const enabledPath = join(conversationDir, AUTO_REPLY_FILE);\n  const disabledPath = join(conversationDir, AUTO_REPLY_DISABLED_FILE);\n  const targetPath = config.enabled ? enabledPath : disabledPath;\n  const otherPath = config.enabled ? disabledPath : enabledPath;\n\n  if (existsSync(otherPath)) {\n    renameSync(otherPath, targetPath);\n  }\n\n  atomicWritePrivateFile(targetPath, config.rules.join(\"\\n\"));\n}\n\nexport function resolveWorkspaceDirFromArgv(args = process.argv.slice(2)): string | undefined {\n  for (let i = 0; i < args.length; i++) {\n    const arg = args[i];\n\n    if (arg === \"--sandbox\" || arg === \"--download\" || arg === \"--state-dir\") {\n      i += 1;\n      continue;\n    }\n\n    if (arg === \"--version\" || arg === \"-v\" || arg === \"-V\" || arg === \"--onboard\") {\n      continue;\n    }\n\n    if (\n      arg.startsWith(\"--sandbox=\") ||\n      arg.startsWith(\"--download=\") ||\n      arg.startsWith(\"--state-dir=\")\n    ) {\n      continue;\n    }\n\n    if (!arg.startsWith(\"-\")) {\n      return arg;\n    }\n  }\n\n  return undefined;\n}\n\nexport function resolveStateDirFromArgv(args = process.argv.slice(2)): string {\n  for (let i = 0; i < args.length; i++) {\n    const arg = args[i];\n    if (arg.startsWith(\"--state-dir=\")) {\n      return resolve(arg.slice(\"--state-dir=\".length));\n    }\n    if (arg === \"--state-dir\") {\n      return resolve(args[++i] || \"\");\n    }\n  }\n\n  return join(homedir(), \".mikan\");\n}\n\n/**\n * True when `child` is `parent` or a path inside it. Purely lexical (no\n * symlink resolution) — used for configuration sanity checks, not as the\n * final security boundary.\n */\nexport function isPathInside(child: string, parent: string): boolean {\n  const parentPath = resolve(parent);\n  const childPath = resolve(child);\n  return childPath === parentPath || childPath.startsWith(parentPath + \"/\");\n}\n\n/**\n * The state dir (extensions code, extension data, vaults, auth.json) must\n * never live inside the working dir: conversation opt-in \"full\" mode mounts\n * the entire working dir read-write into sandbox containers, and a mounted\n * state dir would let sandboxed code plant extension modules that the host\n * process later imports — a sandbox escape. Fatal under sandboxed modes;\n * host mode has no mounts, so only warn about the bad hygiene.\n */\nexport function assertStateDirOutsideWorkspace(\n  stateDir: string,\n  workingDir: string,\n  sandboxType: string,\n): void {\n  if (!isPathInside(stateDir, workingDir)) return;\n  const message =\n    `--state-dir (${stateDir}) must not be inside the working directory (${workingDir}): ` +\n    `sandbox containers mount the working directory, and a mounted state dir ` +\n    `would expose extensions, vaults, and credentials to sandboxed code.`;\n  if (sandboxType === \"host\") {\n    log.logWarning(\"Insecure state dir location\", message);\n    return;\n  }\n  throw new Error(message);\n}\n\nexport function resolveSentryDsn(): string | undefined {\n  const fromFile = normalizeSettingsConfig(loadSettingsFile(getSettingsPath()) ?? {});\n  if (fromFile.sentryDsn) {\n    return fromFile.sentryDsn;\n  }\n\n  return process.env.SENTRY_DSN;\n}\n\nexport function createGlobalSettingsFile(stateDir: string): string {\n  const settingsPath = join(stateDir, \"settings.json\");\n  if (existsSync(settingsPath)) {\n    throw new Error(`Global settings already exists at ${settingsPath}`);\n  }\n  ensureDirExists(stateDir);\n  atomicWritePrivateFile(settingsPath, JSON.stringify(ONBOARD_SETTINGS, null, 2));\n  return settingsPath;\n}\n\n/**\n * Externally-visible base URL of the link/OAuth server, e.g.\n * `https://mikan.example.com` (no trailing slash). Read from `LINK_URL` or\n * `MIKAN_LINK_URL`, the same env var the bot uses to build credential onboarding links.\n */\nexport function resolveLinkBaseUrl(): string | undefined {\n  const raw = readEnv(\"LINK_URL\");\n  if (!raw) return undefined;\n  return raw.replace(/\\/+$/, \"\");\n}\n\nfunction hasDefinedValue(values: Record<string, unknown> | undefined): boolean {\n  return values !== undefined && Object.values(values).some((value) => value !== undefined);\n}\n\nfunction compactSettingsConfig(config: SettingsFileConfig): SettingsFileConfig {\n  return {\n    ...(hasDefinedValue(config.llm) ? { llm: config.llm } : {}),\n    ...(hasDefinedValue(config.sentry) ? { sentry: config.sentry } : {}),\n    ...(hasDefinedValue(config.sandbox) ? { sandbox: config.sandbox } : {}),\n    ...(hasDefinedValue(config.autoReply) ? { autoReply: config.autoReply } : {}),\n    ...(hasDefinedValue(config.slack) ? { slack: config.slack } : {}),\n  };\n}\n\nfunction patchSettingsConfig(\n  existing: SettingsFileConfig,\n  config: Partial<AgentConfig>,\n): SettingsFileConfig {\n  const patched: SettingsFileConfig = {\n    ...existing,\n    llm: {\n      ...existing.llm,\n      ...(config.provider !== undefined ? { provider: config.provider } : {}),\n      ...(config.model !== undefined ? { model: config.model } : {}),\n      ...(config.thinkingLevel !== undefined ? { thinkingLevel: config.thinkingLevel } : {}),\n    },\n    sentry: {\n      ...existing.sentry,\n      ...(config.sentryDsn !== undefined ? { dsn: config.sentryDsn } : {}),\n    },\n    // Leaf-level merge: a patch that only sets sandbox.boost.memory keeps the\n    // existing boost.cpus (and every other existing leaf). compactSettingsConfig\n    // drops the group entirely when it ends up with no defined values.\n    sandbox: mergeSandboxSettings(existing.sandbox, config.sandbox) ?? {},\n    slack: {\n      ...existing.slack,\n      ...config.slack,\n    },\n  };\n  return compactSettingsConfig(patched);\n}\n\nfunction updateSettingsFile(\n  settingsPath: string,\n  patch: Partial<AgentConfig>,\n  defaultSettings: SettingsFileConfig,\n): void {\n  let existing = defaultSettings;\n  if (existsSync(settingsPath)) {\n    try {\n      existing = loadSettingsFile(settingsPath) ?? {};\n    } catch (err) {\n      const detail = err instanceof Error ? err.message : String(err);\n      const message = detail.startsWith(\"Malformed settings file\")\n        ? detail.replace(\"Malformed settings file\", \"Refusing to overwrite malformed settings file\")\n        : detail;\n      throw new Error(message, { cause: err });\n    }\n  }\n\n  ensureDirExists(dirname(settingsPath));\n  atomicWritePrivateFile(\n    settingsPath,\n    JSON.stringify(patchSettingsConfig(existing, patch), null, 2),\n  );\n}\n\nexport function updateGlobalSettings(patch: Partial<AgentConfig>): void {\n  updateSettingsFile(join(getStateDir(), \"settings.json\"), patch, ONBOARD_SETTINGS);\n}\n\nexport function updateConversationSettings(\n  conversationDir: string,\n  patch: Partial<AgentConfig>,\n): void {\n  updateSettingsFile(conversationSettingsPath(conversationDir), patch, {});\n}\n"]}

package/dist/execution-resolver.d.ts

@@ -17,6 +17,6 @@ export declare class ActorExecutionResolver {
     private resolveSandboxConfig;
     private buildEnsureReadyCallback;
     private resolveMounts;
-    private buildImageSandboxMounts;
+    private buildWorkspaceMounts;
 }
 //# sourceMappingURL=execution-resolver.d.ts.map

package/dist/execution-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-resolver.d.ts","sourceRoot":"","sources":["../src/execution-resolver.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAkB,KAAK,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEvF,OAAO,EAAgD,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAKnG,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAExE,wBAAgB,kCAAkC,CAChD,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,cAAc,EAAE,MAAM,GACrB,uBAAuB,CAmBzB;AAiCD,qBAAa,sBAAsB;IAI/B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,WAAW,CAAC;IACpB,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,iBAAiB,CAAC;IAP5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAqB;IAE7D,YACU,UAAU,EAAE,aAAa,EACzB,YAAY,EAAE,YAAY,EAC1B,WAAW,CAAC,EAAE,sBAAsB,YAAA,EACpC,YAAY,CAAC,EAAE,MAAM,YAAA,EACrB,iBAAiB,CAAC,EAAE,MAAM,YAAA,EAChC;IAEE,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkBtD;IAED,OAAO,CAAC,wBAAwB;IAsBhC,OAAO,CAAC,oBAAoB;IAuB5B,OAAO,CAAC,wBAAwB;IA4ChC,OAAO,CAAC,aAAa;IA0BrB,OAAO,CAAC,uBAAuB;CAsBhC"}
+{"version":3,"file":"execution-resolver.d.ts","sourceRoot":"","sources":["../src/execution-resolver.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAkB,KAAK,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEvF,OAAO,EAAgD,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAKnG,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAExE,wBAAgB,kCAAkC,CAChD,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,cAAc,EAAE,MAAM,GACrB,uBAAuB,CAmBzB;AAiCD,qBAAa,sBAAsB;IAI/B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,WAAW,CAAC;IACpB,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,iBAAiB,CAAC;IAP5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAqB;IAE7D,YACU,UAAU,EAAE,aAAa,EACzB,YAAY,EAAE,YAAY,EAC1B,WAAW,CAAC,EAAE,sBAAsB,YAAA,EACpC,YAAY,CAAC,EAAE,MAAM,YAAA,EACrB,iBAAiB,CAAC,EAAE,MAAM,YAAA,EAChC;IAEE,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAatD;IAED,OAAO,CAAC,wBAAwB;IAsBhC,OAAO,CAAC,oBAAoB;IA8B5B,OAAO,CAAC,wBAAwB;IA4ChC,OAAO,CAAC,aAAa;IA0BrB,OAAO,CAAC,oBAAoB;CAsB7B"}

package/dist/execution-resolver.js

@@ -55,13 +55,8 @@ export class ActorExecutionResolver {
         const vaultKey = resolveActorVaultKey(this.baseConfig, context.userId, context.conversationId);
         this.ensureDefaultSharedVault(vaultKey, context.trustModel);
         const vault = this.vaultManager.resolve(vaultKey);
-        const config = this.resolveSandboxConfig(vaultKey);
-        const env = config.type !== "host" &&
-            config.type !== "microvm" &&
-            vault &&
-            Object.keys(vault.env).length > 0
-            ? vault.env
-            : undefined;
+        const config = this.resolveSandboxConfig(vaultKey, context.conversationId, vault);
+        const env = config.type !== "host" && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;
         return createExecutor(config, env, this.buildEnsureReadyCallback(vaultKey, context.conversationId, config, vault));
     }
     ensureDefaultSharedVault(vaultKey, trustModel) {
@@ -84,13 +79,16 @@ export class ActorExecutionResolver {
             return;
         this.vaultManager.copySharedVaultTo(profile, vaultKey);
     }
-    resolveSandboxConfig(vaultKey) {
+    resolveSandboxConfig(vaultKey, conversationId, vault) {
         const config = this.vaultManager.getSandboxConfig(vaultKey, this.baseConfig);
-        if (this.baseConfig.type === "microvm" && config.type === "microvm") {
+        if (this.baseConfig.type === "gondolin" && config.type === "gondolin") {
+            const mounts = this.resolveMounts(conversationId, vault);
             return {
                 ...config,
                 workspacePath: this.hostWorkspacePath,
+                mounts,
                 instanceId: vaultKey,
+                resourceKey: vaultKey,
             };
         }
         if (this.baseConfig.type !== "image") {
@@ -142,7 +140,7 @@ export class ActorExecutionResolver {
     }
     resolveMounts(conversationId, vault) {
         const mountsByTarget = new Map();
-        for (const mount of this.buildImageSandboxMounts(conversationId)) {
+        for (const mount of this.buildWorkspaceMounts(conversationId)) {
             mountsByTarget.set(mount.target, mount);
         }
         for (const mount of vault?.mounts ?? []) {
@@ -153,7 +151,7 @@ export class ActorExecutionResolver {
                     operation: "resolve_mounts",
                     severity: "warning",
                     context: {
-                        sandboxType: "image",
+                        sandboxType: this.baseConfig.type,
                         conversationId,
                         target: mount.target,
                         hasVault: Boolean(vault),
@@ -165,7 +163,7 @@ export class ActorExecutionResolver {
         }
         return [...mountsByTarget.values()];
     }
-    buildImageSandboxMounts(conversationId) {
+    buildWorkspaceMounts(conversationId) {
         if (!this.workspaceDir) {
             return [];
         }

package/dist/execution-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-resolver.js","sourceRoot":"","sources":["../src/execution-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAqC,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAyC,MAAM,kBAAkB,CAAC;AACnG,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAKhC,MAAM,UAAU,kCAAkC,CAChD,YAAgC,EAChC,cAAsB;IAEtB,MAAM,aAAa,GAAG,4BAA4B,EAAE,CAAC;IACrD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,OAAO,CACL,2BAA2B,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,cAAc,IAAI,aAAa,CAC7F,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,UAAU,CACZ,2DAA2D,EAC3D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACF,MAAM,GAAG,GAAG,gCAAgC,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC,CAAC;QACxF,OAAO,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,IAAI,aAAa,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B;IACnC,IAAI,CAAC;QACH,OAAO,kBAAkB,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,cAAc,IAAI,SAAS,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,UAAU,CACZ,yEAAyE,EACzE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CACvC,YAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,oBAAoB,CACzB,YAAY,EACZ,CAAC,KAAK,EAAmF,EAAE,CACzF,QAAQ,CAAC,KAAK,CAAC,EACjB,GAAG,EAAE,CAAC,+EAA+E,CACtF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,UAAU,CACZ,mFAAmF,EACnF,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,sBAAsB;IAGjC,YACU,UAAyB,EACzB,YAA0B,EAC1B,WAAoC,EACpC,YAAqB,EACrB,iBAA0B;QAJ1B,eAAU,GAAV,UAAU,CAAe;QACzB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAyB;QACpC,iBAAY,GAAZ,YAAY,CAAS;QACrB,sBAAiB,GAAjB,iBAAiB,CAAS;QAPnB,4BAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;IAQ1D,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/F,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAE5D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,GAAG,GACP,MAAM,CAAC,IAAI,KAAK,MAAM;YACtB,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,KAAK;YACL,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;YAC/B,CAAC,CAAC,KAAK,CAAC,GAAG;YACX,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO,cAAc,CACnB,MAAM,EACN,GAAG,EACH,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,CAC/E,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAAC,QAAgB,EAAE,UAAsC;QACvF,IACE,CAAC,+BAA+B,CAAC;YAC/B,UAAU;YACV,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;SAClC,CAAC,EACF,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO;QAEjD,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO;QAEtE,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAEO,oBAAoB,CAAC,QAAgB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACpE,OAAO;gBACL,GAAG,MAAM;gBACT,aAAa,EAAE,IAAI,CAAC,iBAAiB;gBACrC,UAAU,EAAE,QAAQ;aACrB,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,sBAAsB,CAAC,aAAa,CAAC,QAAQ,CAAC;SAC1D,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,QAAgB,EAChB,cAAsB,EACtB,MAAqB,EACrB,KAAqB;QAErB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACpE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,IAAI,sBAAsB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACpF,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE;oBACnD,aAAa,EAAE,QAAQ;oBACvB,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC;oBACjD,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qBAAqB,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,mBAAmB;oBAC5B,SAAS,EAAE,8BAA8B;oBACzC,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE;wBACP,WAAW,EAAE,OAAO;wBACpB,mBAAmB,EAAE,MAAM,CAAC,IAAI;wBAChC,cAAc;wBACd,QAAQ;wBACR,iBAAiB,EAAE,QAAQ;wBAC3B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;qBACzB;iBACF,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,wBAAwB,QAAQ,gBAAgB,QAAQ,GAAG,CACrG,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,cAAsB,EAAE,KAAqB;QACjE,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAAE,CAAC;YACjE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,qBAAqB,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE;oBAChE,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,iBAAiB;oBAC1B,SAAS,EAAE,gBAAgB;oBAC3B,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE;wBACP,WAAW,EAAE,OAAO;wBACpB,cAAc;wBACd,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;qBACzB;iBACF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,uBAAuB,CAAC,cAAsB;QACpD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,kCAAkC,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,KAAK,MAAM,EAAE,CAAC;YACrF,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACtD,eAAe,CAAC,eAAe,CAAC,CAAC;YACjC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,CAAC;QAED,OAAO;YACL,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE;YAChF,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE;YAC1E,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE;YAC1E,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,cAAc,EAAE,EAAE;SACpE,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { existsSync } from \"fs\";\nimport { join } from \"path\";\nimport {\n  conversationSettingsPath,\n  loadGlobalSettings,\n  resolveConversationSettings,\n} from \"./config.js\";\nimport { ensureDirExists, isRecord, readJsonFileIfExists } from \"./utils/file-guards.js\";\nimport { DockerContainerManager, type ContainerMount } from \"./provisioner.js\";\nimport { createExecutor, type Executor, type SandboxConfig } from \"./sandbox/index.js\";\nimport { reportUserFacingError } from \"./observability/sentry.js\";\nimport { normalizeSharedVaultName, type ResolvedVault, type VaultManager } from \"./vault/index.js\";\nimport { allowsAmbientDefaultSharedVault } from \"./vault/policy.js\";\nimport { resolveActorVaultKey } from \"./vault/routing.js\";\nimport * as log from \"./log.js\";\n\nexport type { ActorContext, ImageWorkspaceMountMode } from \"./types.js\";\nimport type { ActorContext, ImageWorkspaceMountMode } from \"./types.js\";\n\nexport function readConversationWorkspaceMountMode(\n  workspaceDir: string | undefined,\n  conversationId: string,\n): ImageWorkspaceMountMode {\n  const globalDefault = readGlobalWorkspaceMountMode();\n  if (!workspaceDir) {\n    return globalDefault;\n  }\n\n  const conversationDir = join(workspaceDir, conversationId);\n  try {\n    return (\n      resolveConversationSettings(conversationDir).sandbox?.image?.workspaceMount ?? globalDefault\n    );\n  } catch (err) {\n    log.logWarning(\n      \"Falling back while resolving conversation workspace mount\",\n      err instanceof Error ? err.message : String(err),\n    );\n    const raw = readConversationSettingsFallback(conversationSettingsPath(conversationDir));\n    return raw?.sandbox?.image?.workspaceMount ?? globalDefault;\n  }\n}\n\nfunction readGlobalWorkspaceMountMode(): ImageWorkspaceMountMode {\n  try {\n    return loadGlobalSettings().sandbox?.image?.workspaceMount ?? \"private\";\n  } catch (err) {\n    log.logWarning(\n      \"Using default workspace mount because global settings could not be read\",\n      err instanceof Error ? err.message : String(err),\n    );\n    return \"private\";\n  }\n}\n\nfunction readConversationSettingsFallback(\n  settingsPath: string,\n): { sandbox?: { image?: { workspaceMount?: ImageWorkspaceMountMode } } } | undefined {\n  try {\n    return readJsonFileIfExists(\n      settingsPath,\n      (value): value is { sandbox?: { image?: { workspaceMount?: ImageWorkspaceMountMode } } } =>\n        isRecord(value),\n      () => \"Ignoring malformed conversation settings file while resolving workspace mount\",\n    );\n  } catch (err) {\n    log.logWarning(\n      \"Ignoring malformed conversation settings fallback while resolving workspace mount\",\n      err instanceof Error ? err.message : String(err),\n    );\n    return undefined;\n  }\n}\n\nexport class ActorExecutionResolver {\n  private readonly ensuredConversationDirs = new Set<string>();\n\n  constructor(\n    private baseConfig: SandboxConfig,\n    private vaultManager: VaultManager,\n    private provisioner?: DockerContainerManager,\n    private workspaceDir?: string,\n    private hostWorkspacePath?: string,\n  ) {}\n\n  async resolve(context: ActorContext): Promise<Executor> {\n    const vaultKey = resolveActorVaultKey(this.baseConfig, context.userId, context.conversationId);\n    this.ensureDefaultSharedVault(vaultKey, context.trustModel);\n\n    const vault = this.vaultManager.resolve(vaultKey);\n    const config = this.resolveSandboxConfig(vaultKey);\n    const env =\n      config.type !== \"host\" &&\n      config.type !== \"microvm\" &&\n      vault &&\n      Object.keys(vault.env).length > 0\n        ? vault.env\n        : undefined;\n    return createExecutor(\n      config,\n      env,\n      this.buildEnsureReadyCallback(vaultKey, context.conversationId, config, vault),\n    );\n  }\n\n  private ensureDefaultSharedVault(vaultKey: string, trustModel: ActorContext[\"trustModel\"]): void {\n    if (\n      !allowsAmbientDefaultSharedVault({\n        trustModel,\n        sandboxType: this.baseConfig.type,\n      })\n    ) {\n      return;\n    }\n    if (this.vaultManager.hasEntry(vaultKey)) return;\n\n    let profile: string | undefined;\n    try {\n      profile = loadGlobalSettings().sandbox?.defaultSharedVault;\n    } catch {\n      return;\n    }\n    if (!profile || normalizeSharedVaultName(profile) !== profile) return;\n\n    this.vaultManager.copySharedVaultTo(profile, vaultKey);\n  }\n\n  private resolveSandboxConfig(vaultKey: string): SandboxConfig {\n    const config = this.vaultManager.getSandboxConfig(vaultKey, this.baseConfig);\n    if (this.baseConfig.type === \"microvm\" && config.type === \"microvm\") {\n      return {\n        ...config,\n        workspacePath: this.hostWorkspacePath,\n        instanceId: vaultKey,\n      };\n    }\n    if (this.baseConfig.type !== \"image\") {\n      return config;\n    }\n\n    if (config.type === \"container\") {\n      return config;\n    }\n\n    return {\n      type: \"container\",\n      container: DockerContainerManager.containerName(vaultKey),\n    };\n  }\n\n  private buildEnsureReadyCallback(\n    vaultKey: string,\n    conversationId: string,\n    config: SandboxConfig,\n    vault?: ResolvedVault,\n  ): (() => Promise<void>) | undefined {\n    if (this.baseConfig.type !== \"image\" || config.type !== \"container\") {\n      return undefined;\n    }\n\n    return async () => {\n      const expected = config.container || DockerContainerManager.containerName(vaultKey);\n      let actual: string | undefined;\n      try {\n        actual = await this.provisioner?.provision(vaultKey, {\n          containerName: expected,\n          mounts: this.resolveMounts(conversationId, vault),\n          conversationId,\n        });\n      } catch (err) {\n        reportUserFacingError(err, {\n          domain: \"sandbox\",\n          surface: \"sandbox_provision\",\n          operation: \"ensure_image_container_ready\",\n          severity: \"error\",\n          context: {\n            sandboxType: \"image\",\n            resolvedSandboxType: config.type,\n            conversationId,\n            vaultKey,\n            expectedContainer: expected,\n            hasVault: Boolean(vault),\n          },\n        });\n        throw err;\n      }\n      if (actual && actual !== expected) {\n        throw new Error(\n          `Provisioner returned container \"${actual}\" for container key \"${vaultKey}\", expected \"${expected}\"`,\n        );\n      }\n    };\n  }\n\n  private resolveMounts(conversationId: string, vault?: ResolvedVault): ContainerMount[] {\n    const mountsByTarget = new Map<string, ContainerMount>();\n    for (const mount of this.buildImageSandboxMounts(conversationId)) {\n      mountsByTarget.set(mount.target, mount);\n    }\n    for (const mount of vault?.mounts ?? []) {\n      if (!existsSync(mount.source)) {\n        reportUserFacingError(new Error(\"Vault mount source is missing\"), {\n          domain: \"sandbox\",\n          surface: \"vault_injection\",\n          operation: \"resolve_mounts\",\n          severity: \"warning\",\n          context: {\n            sandboxType: \"image\",\n            conversationId,\n            target: mount.target,\n            hasVault: Boolean(vault),\n          },\n        });\n        continue;\n      }\n      mountsByTarget.set(mount.target, { source: mount.source, target: mount.target });\n    }\n    return [...mountsByTarget.values()];\n  }\n\n  private buildImageSandboxMounts(conversationId: string): ContainerMount[] {\n    if (!this.workspaceDir) {\n      return [];\n    }\n\n    if (readConversationWorkspaceMountMode(this.workspaceDir, conversationId) === \"full\") {\n      return [{ source: this.workspaceDir, target: \"/workspace\" }];\n    }\n\n    const conversationDir = join(this.workspaceDir, conversationId);\n    if (!this.ensuredConversationDirs.has(conversationId)) {\n      ensureDirExists(conversationDir);\n      this.ensuredConversationDirs.add(conversationId);\n    }\n\n    return [\n      { source: join(this.workspaceDir, \"MEMORY.md\"), target: \"/workspace/MEMORY.md\" },\n      { source: join(this.workspaceDir, \"skills\"), target: \"/workspace/skills\" },\n      { source: join(this.workspaceDir, \"events\"), target: \"/workspace/events\" },\n      { source: conversationDir, target: `/workspace/${conversationId}` },\n    ];\n  }\n}\n"]}
+{"version":3,"file":"execution-resolver.js","sourceRoot":"","sources":["../src/execution-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAqC,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAyC,MAAM,kBAAkB,CAAC;AACnG,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAKhC,MAAM,UAAU,kCAAkC,CAChD,YAAgC,EAChC,cAAsB;IAEtB,MAAM,aAAa,GAAG,4BAA4B,EAAE,CAAC;IACrD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,OAAO,CACL,2BAA2B,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,cAAc,IAAI,aAAa,CAC7F,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,UAAU,CACZ,2DAA2D,EAC3D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACF,MAAM,GAAG,GAAG,gCAAgC,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC,CAAC;QACxF,OAAO,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,IAAI,aAAa,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B;IACnC,IAAI,CAAC;QACH,OAAO,kBAAkB,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,cAAc,IAAI,SAAS,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,UAAU,CACZ,yEAAyE,EACzE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CACvC,YAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,oBAAoB,CACzB,YAAY,EACZ,CAAC,KAAK,EAAmF,EAAE,CACzF,QAAQ,CAAC,KAAK,CAAC,EACjB,GAAG,EAAE,CAAC,+EAA+E,CACtF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,UAAU,CACZ,mFAAmF,EACnF,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,sBAAsB;IAGjC,YACU,UAAyB,EACzB,YAA0B,EAC1B,WAAoC,EACpC,YAAqB,EACrB,iBAA0B;QAJ1B,eAAU,GAAV,UAAU,CAAe;QACzB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAyB;QACpC,iBAAY,GAAZ,YAAY,CAAS;QACrB,sBAAiB,GAAjB,iBAAiB,CAAS;QAPnB,4BAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;IAQ1D,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/F,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAE5D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAClF,MAAM,GAAG,GACP,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,OAAO,cAAc,CACnB,MAAM,EACN,GAAG,EACH,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,CAC/E,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAAC,QAAgB,EAAE,UAAsC;QACvF,IACE,CAAC,+BAA+B,CAAC;YAC/B,UAAU;YACV,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;SAClC,CAAC,EACF,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO;QAEjD,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,KAAK,OAAO;YAAE,OAAO;QAEtE,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAEO,oBAAoB,CAC1B,QAAgB,EAChB,cAAsB,EACtB,KAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACtE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YACzD,OAAO;gBACL,GAAG,MAAM;gBACT,aAAa,EAAE,IAAI,CAAC,iBAAiB;gBACrC,MAAM;gBACN,UAAU,EAAE,QAAQ;gBACpB,WAAW,EAAE,QAAQ;aACtB,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,sBAAsB,CAAC,aAAa,CAAC,QAAQ,CAAC;SAC1D,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAC9B,QAAgB,EAChB,cAAsB,EACtB,MAAqB,EACrB,KAAqB;QAErB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACpE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,IAAI,sBAAsB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACpF,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE;oBACnD,aAAa,EAAE,QAAQ;oBACvB,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC;oBACjD,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qBAAqB,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,mBAAmB;oBAC5B,SAAS,EAAE,8BAA8B;oBACzC,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE;wBACP,WAAW,EAAE,OAAO;wBACpB,mBAAmB,EAAE,MAAM,CAAC,IAAI;wBAChC,cAAc;wBACd,QAAQ;wBACR,iBAAiB,EAAE,QAAQ;wBAC3B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;qBACzB;iBACF,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,wBAAwB,QAAQ,gBAAgB,QAAQ,GAAG,CACrG,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,cAAsB,EAAE,KAAqB;QACjE,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9D,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,qBAAqB,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE;oBAChE,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,iBAAiB;oBAC1B,SAAS,EAAE,gBAAgB;oBAC3B,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE;wBACP,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;wBACjC,cAAc;wBACd,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;qBACzB;iBACF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,oBAAoB,CAAC,cAAsB;QACjD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,kCAAkC,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,KAAK,MAAM,EAAE,CAAC;YACrF,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACtD,eAAe,CAAC,eAAe,CAAC,CAAC;YACjC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,CAAC;QAED,OAAO;YACL,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE;YAChF,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE;YAC1E,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE;YAC1E,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,cAAc,EAAE,EAAE;SACpE,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { existsSync } from \"fs\";\nimport { join } from \"path\";\nimport {\n  conversationSettingsPath,\n  loadGlobalSettings,\n  resolveConversationSettings,\n} from \"./config.js\";\nimport { ensureDirExists, isRecord, readJsonFileIfExists } from \"./utils/file-guards.js\";\nimport { DockerContainerManager, type ContainerMount } from \"./provisioner.js\";\nimport { createExecutor, type Executor, type SandboxConfig } from \"./sandbox/index.js\";\nimport { reportUserFacingError } from \"./observability/sentry.js\";\nimport { normalizeSharedVaultName, type ResolvedVault, type VaultManager } from \"./vault/index.js\";\nimport { allowsAmbientDefaultSharedVault } from \"./vault/policy.js\";\nimport { resolveActorVaultKey } from \"./vault/routing.js\";\nimport * as log from \"./log.js\";\n\nexport type { ActorContext, ImageWorkspaceMountMode } from \"./types.js\";\nimport type { ActorContext, ImageWorkspaceMountMode } from \"./types.js\";\n\nexport function readConversationWorkspaceMountMode(\n  workspaceDir: string | undefined,\n  conversationId: string,\n): ImageWorkspaceMountMode {\n  const globalDefault = readGlobalWorkspaceMountMode();\n  if (!workspaceDir) {\n    return globalDefault;\n  }\n\n  const conversationDir = join(workspaceDir, conversationId);\n  try {\n    return (\n      resolveConversationSettings(conversationDir).sandbox?.image?.workspaceMount ?? globalDefault\n    );\n  } catch (err) {\n    log.logWarning(\n      \"Falling back while resolving conversation workspace mount\",\n      err instanceof Error ? err.message : String(err),\n    );\n    const raw = readConversationSettingsFallback(conversationSettingsPath(conversationDir));\n    return raw?.sandbox?.image?.workspaceMount ?? globalDefault;\n  }\n}\n\nfunction readGlobalWorkspaceMountMode(): ImageWorkspaceMountMode {\n  try {\n    return loadGlobalSettings().sandbox?.image?.workspaceMount ?? \"private\";\n  } catch (err) {\n    log.logWarning(\n      \"Using default workspace mount because global settings could not be read\",\n      err instanceof Error ? err.message : String(err),\n    );\n    return \"private\";\n  }\n}\n\nfunction readConversationSettingsFallback(\n  settingsPath: string,\n): { sandbox?: { image?: { workspaceMount?: ImageWorkspaceMountMode } } } | undefined {\n  try {\n    return readJsonFileIfExists(\n      settingsPath,\n      (value): value is { sandbox?: { image?: { workspaceMount?: ImageWorkspaceMountMode } } } =>\n        isRecord(value),\n      () => \"Ignoring malformed conversation settings file while resolving workspace mount\",\n    );\n  } catch (err) {\n    log.logWarning(\n      \"Ignoring malformed conversation settings fallback while resolving workspace mount\",\n      err instanceof Error ? err.message : String(err),\n    );\n    return undefined;\n  }\n}\n\nexport class ActorExecutionResolver {\n  private readonly ensuredConversationDirs = new Set<string>();\n\n  constructor(\n    private baseConfig: SandboxConfig,\n    private vaultManager: VaultManager,\n    private provisioner?: DockerContainerManager,\n    private workspaceDir?: string,\n    private hostWorkspacePath?: string,\n  ) {}\n\n  async resolve(context: ActorContext): Promise<Executor> {\n    const vaultKey = resolveActorVaultKey(this.baseConfig, context.userId, context.conversationId);\n    this.ensureDefaultSharedVault(vaultKey, context.trustModel);\n\n    const vault = this.vaultManager.resolve(vaultKey);\n    const config = this.resolveSandboxConfig(vaultKey, context.conversationId, vault);\n    const env =\n      config.type !== \"host\" && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;\n    return createExecutor(\n      config,\n      env,\n      this.buildEnsureReadyCallback(vaultKey, context.conversationId, config, vault),\n    );\n  }\n\n  private ensureDefaultSharedVault(vaultKey: string, trustModel: ActorContext[\"trustModel\"]): void {\n    if (\n      !allowsAmbientDefaultSharedVault({\n        trustModel,\n        sandboxType: this.baseConfig.type,\n      })\n    ) {\n      return;\n    }\n    if (this.vaultManager.hasEntry(vaultKey)) return;\n\n    let profile: string | undefined;\n    try {\n      profile = loadGlobalSettings().sandbox?.defaultSharedVault;\n    } catch {\n      return;\n    }\n    if (!profile || normalizeSharedVaultName(profile) !== profile) return;\n\n    this.vaultManager.copySharedVaultTo(profile, vaultKey);\n  }\n\n  private resolveSandboxConfig(\n    vaultKey: string,\n    conversationId: string,\n    vault?: ResolvedVault,\n  ): SandboxConfig {\n    const config = this.vaultManager.getSandboxConfig(vaultKey, this.baseConfig);\n    if (this.baseConfig.type === \"gondolin\" && config.type === \"gondolin\") {\n      const mounts = this.resolveMounts(conversationId, vault);\n      return {\n        ...config,\n        workspacePath: this.hostWorkspacePath,\n        mounts,\n        instanceId: vaultKey,\n        resourceKey: vaultKey,\n      };\n    }\n    if (this.baseConfig.type !== \"image\") {\n      return config;\n    }\n\n    if (config.type === \"container\") {\n      return config;\n    }\n\n    return {\n      type: \"container\",\n      container: DockerContainerManager.containerName(vaultKey),\n    };\n  }\n\n  private buildEnsureReadyCallback(\n    vaultKey: string,\n    conversationId: string,\n    config: SandboxConfig,\n    vault?: ResolvedVault,\n  ): (() => Promise<void>) | undefined {\n    if (this.baseConfig.type !== \"image\" || config.type !== \"container\") {\n      return undefined;\n    }\n\n    return async () => {\n      const expected = config.container || DockerContainerManager.containerName(vaultKey);\n      let actual: string | undefined;\n      try {\n        actual = await this.provisioner?.provision(vaultKey, {\n          containerName: expected,\n          mounts: this.resolveMounts(conversationId, vault),\n          conversationId,\n        });\n      } catch (err) {\n        reportUserFacingError(err, {\n          domain: \"sandbox\",\n          surface: \"sandbox_provision\",\n          operation: \"ensure_image_container_ready\",\n          severity: \"error\",\n          context: {\n            sandboxType: \"image\",\n            resolvedSandboxType: config.type,\n            conversationId,\n            vaultKey,\n            expectedContainer: expected,\n            hasVault: Boolean(vault),\n          },\n        });\n        throw err;\n      }\n      if (actual && actual !== expected) {\n        throw new Error(\n          `Provisioner returned container \"${actual}\" for container key \"${vaultKey}\", expected \"${expected}\"`,\n        );\n      }\n    };\n  }\n\n  private resolveMounts(conversationId: string, vault?: ResolvedVault): ContainerMount[] {\n    const mountsByTarget = new Map<string, ContainerMount>();\n    for (const mount of this.buildWorkspaceMounts(conversationId)) {\n      mountsByTarget.set(mount.target, mount);\n    }\n    for (const mount of vault?.mounts ?? []) {\n      if (!existsSync(mount.source)) {\n        reportUserFacingError(new Error(\"Vault mount source is missing\"), {\n          domain: \"sandbox\",\n          surface: \"vault_injection\",\n          operation: \"resolve_mounts\",\n          severity: \"warning\",\n          context: {\n            sandboxType: this.baseConfig.type,\n            conversationId,\n            target: mount.target,\n            hasVault: Boolean(vault),\n          },\n        });\n        continue;\n      }\n      mountsByTarget.set(mount.target, { source: mount.source, target: mount.target });\n    }\n    return [...mountsByTarget.values()];\n  }\n\n  private buildWorkspaceMounts(conversationId: string): ContainerMount[] {\n    if (!this.workspaceDir) {\n      return [];\n    }\n\n    if (readConversationWorkspaceMountMode(this.workspaceDir, conversationId) === \"full\") {\n      return [{ source: this.workspaceDir, target: \"/workspace\" }];\n    }\n\n    const conversationDir = join(this.workspaceDir, conversationId);\n    if (!this.ensuredConversationDirs.has(conversationId)) {\n      ensureDirExists(conversationDir);\n      this.ensuredConversationDirs.add(conversationId);\n    }\n\n    return [\n      { source: join(this.workspaceDir, \"MEMORY.md\"), target: \"/workspace/MEMORY.md\" },\n      { source: join(this.workspaceDir, \"skills\"), target: \"/workspace/skills\" },\n      { source: join(this.workspaceDir, \"events\"), target: \"/workspace/events\" },\n      { source: conversationDir, target: `/workspace/${conversationId}` },\n    ];\n  }\n}\n"]}