@gendigital/sage-opencode 0.10.0 → 0.12.0

package/README.md

@@ -38,9 +38,9 @@ Add the plugin to your OpenCode config (`~/.config/opencode/opencode.json`):
 }
 ```
 
-Or [build from source](https://github.com/gendigitalinc/sage/blob/main/docs/getting-started.md#opencode).
+Or [build from source](https://github.com/gendigitalinc/sage/blob/main/docs/user-guide.md#opencode).
 
-> To verify it's working, ask your agent to run `echo __sage_test_deny_cmd_a75bf229__`. Sage should block this harmless canary command.
+> To verify it's working, ask your agent to run `echo diagmark_cmd_a75bf229`. Sage should block this harmless canary command.
 
 ## What Sage intercepts
 
@@ -80,12 +80,12 @@ Sage works out of the box with no configuration. To customize behavior, edit `~/
 }
 ```
 
-See [Configuration](https://github.com/gendigitalinc/sage/blob/main/docs/configuration.md) for all options.
+See [Configuration](https://github.com/gendigitalinc/sage/blob/main/docs/user-guide.md#configuration) for all options.
 
 ## Links
 
 - [User Guide](https://github.com/gendigitalinc/sage/blob/main/docs/user-guide.md) — verify install, handle alerts, manage false positives
-- [Configuration](https://github.com/gendigitalinc/sage/blob/main/docs/configuration.md) — all config options
-- [Exceptions](https://github.com/gendigitalinc/sage/blob/main/docs/exceptions.md) — pattern-based allow/deny rules
-- [Privacy](https://github.com/gendigitalinc/sage/blob/main/docs/privacy.md) — what data is sent, what stays local
+- [Configuration](https://github.com/gendigitalinc/sage/blob/main/docs/user-guide.md#configuration) — all config options
+- [Exceptions](https://github.com/gendigitalinc/sage/blob/main/docs/user-guide.md#exceptions) — pattern-based allow/deny rules
+- [Privacy](https://github.com/gendigitalinc/sage/blob/main/docs/user-guide.md#privacy) — what data is sent, what stays local
 - [GitHub](https://github.com/gendigitalinc/sage)

package/dist/bundled-dirs.d.ts

@@ -6,7 +6,7 @@ export declare function getBundledDataDirs(): {
     pluginDir: string;
     packageRoot: string;
     threatsDir: string;
-    allowlistsDir: string;
+    trustedDomainsDir: string;
 };
 export declare function getSageVersion(): string;
 //# sourceMappingURL=bundled-dirs.d.ts.map

package/dist/bundled-dirs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundled-dirs.d.ts","sourceRoot":"","sources":["../src/bundled-dirs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,wBAAgB,kBAAkB,IAAI;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACtB,CASA;AAED,wBAAgB,cAAc,IAAI,MAAM,CASvC"}
+{"version":3,"file":"bundled-dirs.d.ts","sourceRoot":"","sources":["../src/bundled-dirs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,wBAAgB,kBAAkB,IAAI;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;CAC1B,CASA;AAED,wBAAgB,cAAc,IAAI,MAAM,CASvC"}

package/dist/bundled-dirs.js

@@ -12,7 +12,7 @@ export function getBundledDataDirs() {
         pluginDir,
         packageRoot,
         threatsDir: join(packageRoot, "resources", "threats"),
-        allowlistsDir: join(packageRoot, "resources", "allowlists"),
+        trustedDomainsDir: join(packageRoot, "resources", "trusted-domains"),
     };
 }
 export function getSageVersion() {

package/dist/bundled-dirs.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundled-dirs.js","sourceRoot":"","sources":["../src/bundled-dirs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,kBAAkB;IAMjC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1C,OAAO;QACN,SAAS;QACT,WAAW;QACX,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC;QACrD,aAAa,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC;KAC3D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc;IAC7B,IAAI,CAAC;QACJ,MAAM,EAAE,WAAW,EAAE,GAAG,kBAAkB,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAA4B,CAAC;QAClF,OAAQ,GAAG,CAAC,OAAkB,IAAI,OAAO,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,OAAO,CAAC;IAChB,CAAC;AACF,CAAC"}
+{"version":3,"file":"bundled-dirs.js","sourceRoot":"","sources":["../src/bundled-dirs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,kBAAkB;IAMjC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1C,OAAO;QACN,SAAS;QACT,WAAW;QACX,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC;QACrD,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,iBAAiB,CAAC;KACpE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc;IAC7B,IAAI,CAAC;QACJ,MAAM,EAAE,WAAW,EAAE,GAAG,kBAAkB,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAA4B,CAAC;QAClF,OAAQ,GAAG,CAAC,OAAkB,IAAI,OAAO,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,OAAO,CAAC;IAChB,CAAC;AACF,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAQlD,eAAO,MAAM,UAAU,EAAE,MAoKxB,CAAC;AAEF,eAAe,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwBH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAmLlD,eAAO,MAAM,UAAU,EAAE,MAyOxB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/index.js

@@ -2,12 +2,164 @@
  * Sage OpenCode plugin.
  * Intercepts tool calls and uses @gendigital/sage-core to enforce security verdicts.
  */
-import { ApprovalStore, approveAction, createOperationalLogger, formatConfigurationWarnings, getConfigurationWarnings, loadConfig, resolveBranding, } from "@gendigital/sage-core";
+import { mkdirSync, watchFile } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { ApprovalStore, approveAction, checkAllowlistMigration, createOperationalLogger, foreignSourceRuntime, formatAllowlistMigrationWarning, formatConfigurationWarnings, formatNoticeById, getConfigurationWarnings, loadConfig, loadSkillVerdictCache, resolveBranding, resolvePath, } from "@gendigital/sage-core";
 import { tool } from "@opencode-ai/plugin/tool";
 import { getBundledDataDirs } from "./bundled-dirs.js";
 import { createSessionScanHandler } from "./startup-scan.js";
 import { createToolHandlers } from "./tool-handler.js";
 const APPROVAL_STORE_CLEANUP_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
+const DEFAULT_TOAST_DURATION_MS = 5000;
+// The startup security summary lists every risky skill, so it's shown longer to
+// give the user time to read the list before it dismisses.
+const STARTUP_SUMMARY_DURATION_MS = 10_000;
+// Module-scoped so repeated SagePlugin instantiations (OpenCode may load the
+// plugin more than once) share a single watcher and one notified-set, instead
+// of each instance attaching its own watcher and toasting the same verdict.
+const notifiedSkillVerdicts = new Set();
+let skillWatcherAttached = false;
+// One scan per session, shared across instances: the entry guards against
+// re-running the scan when session.updated fires repeatedly or on more than one
+// plugin instance.
+const sessionScanPromises = new Map();
+const toastQueue = [];
+let toastPumpRunning = false;
+// Bound to a live client's showToast by the first instance (see SagePlugin).
+let displayToast;
+async function pumpToasts() {
+    if (toastPumpRunning)
+        return;
+    toastPumpRunning = true;
+    try {
+        while (toastQueue.length > 0) {
+            const next = toastQueue[0];
+            // No client bound yet — leave the item queued; a later enqueue resumes.
+            if (!displayToast || !next)
+                break;
+            displayToast(next.message, next.variant, next.durationMs);
+            toastQueue.shift();
+            // Hold the slot for this toast's full duration before showing the next,
+            // so a following toast can't replace it early (showToast overwrites).
+            await new Promise((resolve) => setTimeout(resolve, next.durationMs));
+        }
+    }
+    finally {
+        toastPumpRunning = false;
+    }
+}
+function enqueueToast(message, variant, durationMs = DEFAULT_TOAST_DURATION_MS) {
+    toastQueue.push({ message, variant, durationMs });
+    void pumpToasts();
+}
+// Shared dedup key across the two surfacing paths: the scan-findings popup keys
+// on `finding.artifact` (which is `skillId.slice(0, 16)`), and the cache watcher
+// keys on the full skillId — so both reduce to this 16-char content-hash prefix
+// and `notifiedSkillVerdicts` never double-announces the same skill version.
+function shortSkillId(skillId) {
+    return skillId.slice(0, 16);
+}
+/**
+ * Read `~/.sage/skill_verdict_cache.json` and return every HIGH/CRITICAL verdict
+ * relevant to this runtime — one per cache entry, NOT deduped, since dedup is
+ * caller-specific (the popup keys on current content, the toast queue on
+ * skillId). HIGH maps to the "WARNING" label. Verdicts sourced only from other
+ * agent runtimes are skipped so one host doesn't echo another's finds.
+ */
+async function collectRiskySkills(agentRuntime) {
+    const cache = await loadSkillVerdictCache();
+    const out = [];
+    for (const [skillId, verdict] of Object.entries(cache.entries)) {
+        const risk = (verdict.verdict ?? "").toUpperCase();
+        if (risk !== "HIGH" && risk !== "CRITICAL")
+            continue;
+        if (foreignSourceRuntime(verdict.sources, agentRuntime))
+            continue;
+        const key = verdict.sources?.find((s) => s.containerKey)?.containerKey ||
+            verdict.skillName ||
+            skillId.slice(0, 16);
+        out.push({
+            skillId,
+            key,
+            severity: risk === "CRITICAL" ? "CRITICAL" : "WARNING",
+            summary: verdict.summary?.trim(),
+        });
+    }
+    return out;
+}
+/**
+ * Watch `~/.sage/skill_verdict_cache.json` and queue one toast per verdict the
+ * upload worker writes mid-session (it writes asynchronously, ~one session after
+ * discovery). The serial queue shows them one at a time so two skills finishing
+ * together are both seen.
+ *
+ * Verdicts cached by earlier sessions are *seeded silently* on attach — marked
+ * notified without a toast — because the plugin initialises before the TUI is
+ * ready to render toasts. Those are surfaced instead by the session-start
+ * summary popup (see `surfaceStartupSummary`), which runs after the scan when
+ * the TUI is up.
+ *
+ * Dedup keys on `skillId` (content hash), not the container key, so editing a
+ * skill — which yields a new hash under the same key — is treated as a new
+ * finding and re-announced rather than silently collapsed into the old one.
+ */
+function setupSkillFindingsWatcher(logger, agentRuntime) {
+    if (skillWatcherAttached)
+        return;
+    const sageDir = resolvePath("~/.sage");
+    const seedNotified = async () => {
+        try {
+            for (const s of await collectRiskySkills(agentRuntime)) {
+                notifiedSkillVerdicts.add(shortSkillId(s.skillId));
+            }
+        }
+        catch (e) {
+            logger.debug("Skill verdict seed failed", { error: String(e) });
+        }
+    };
+    // Mid-session: queue one toast per newly written (not-yet-notified) verdict.
+    const announceNew = async () => {
+        try {
+            for (const s of await collectRiskySkills(agentRuntime)) {
+                const short = shortSkillId(s.skillId);
+                if (notifiedSkillVerdicts.has(short))
+                    continue;
+                notifiedSkillVerdicts.add(short);
+                const detail = s.summary ? `${s.key} — ${s.summary}` : `${s.key} detected`;
+                logger.debug("Skill finding toast queued", { key: s.key, severity: s.severity });
+                enqueueToast(`${detail} (${s.severity})`, s.severity === "CRITICAL" ? "error" : "warning");
+            }
+        }
+        catch (e) {
+            logger.debug("Skill verdict watcher scan failed", { error: String(e) });
+        }
+    };
+    try {
+        mkdirSync(sageDir, { recursive: true });
+        void seedNotified();
+        // Poll the cache file with watchFile rather than watch() the directory.
+        // On Windows, fs.watch aborts the whole process (an uncatchable libuv
+        // assertion in fs-event.c) when the watched path is an 8.3 short name
+        // (e.g. an os.tmpdir() like C:\Users\FOO~1.BAR\...) or symlinked home.
+        // watchFile is stat-based polling — immune to that. A few seconds of
+        // latency for mid-session verdicts is fine (matches the statusline poll
+        // cadence used elsewhere). Handles a not-yet-existent file (polls until
+        // it appears).
+        const cacheFile = join(sageDir, "skill_verdict_cache.json");
+        const watcher = watchFile(cacheFile, { interval: 3000 }, (curr, prev) => {
+            if (curr.mtimeMs !== prev.mtimeMs)
+                void announceNew();
+        });
+        watcher.unref?.();
+        skillWatcherAttached = true;
+        logger.debug("Skill findings watcher attached", { cacheFile });
+    }
+    catch (e) {
+        // ~/.sage/ may be unwritable — no watcher, no notifications (fail-open).
+        logger.debug("Skill findings watcher setup failed", { error: String(e) });
+    }
+}
 export const SagePlugin = async ({ client, directory }) => {
     const config = await loadConfig();
     const operationalLogger = createOperationalLogger(config.operational_logging, "opencode");
@@ -15,101 +167,169 @@ export const SagePlugin = async ({ client, directory }) => {
     const toolLogger = operationalLogger.forComponent("tool-handler");
     const scanLogger = operationalLogger.forComponent("startup-scan");
     const branding = resolveBranding(config.brand_key, logger);
+    const showToast = (msg, variant, durationMs = DEFAULT_TOAST_DURATION_MS) => {
+        client.tui
+            .showToast({
+            body: { title: branding.name, message: msg, variant, duration: durationMs },
+        })
+            .catch(() => { });
+    };
+    // Bind the module-scoped skill-toast queue to this (first) instance's client.
+    // The queue passes each item's own duration, which showToast honors.
+    displayToast ??= showToast;
     const warningMessage = formatConfigurationWarnings(await getConfigurationWarnings(undefined, logger), branding);
     if (warningMessage) {
         client.tui
             .showToast({
-            body: { title: branding.name, message: warningMessage, variant: "warning", duration: 5000 },
+            body: {
+                title: branding.name,
+                message: warningMessage,
+                variant: "warning",
+                duration: DEFAULT_TOAST_DURATION_MS,
+            },
+        })
+            .catch(() => { });
+    }
+    const allowlistMigration = await checkAllowlistMigration();
+    if (allowlistMigration.needed) {
+        client.tui
+            .showToast({
+            body: {
+                title: branding.name,
+                message: formatAllowlistMigrationWarning(allowlistMigration.entryTypes, branding),
+                variant: "warning",
+                duration: 8000,
+            },
         })
             .catch(() => { });
     }
-    const { threatsDir, allowlistsDir } = getBundledDataDirs();
+    const { threatsDir, trustedDomainsDir } = getBundledDataDirs();
     const approvalStore = new ApprovalStore();
-    // State: track findings per session for one-shot injection
-    const pendingFindingsBySession = new Map();
-    // Track scanned sessions to avoid re-triggering on repeated session.updated events
-    const scannedSessions = new Set();
+    // Watch for verdicts the upload worker writes mid-session (queued toasts).
+    // Verdicts cached by earlier sessions are surfaced by surfaceStartupSummary.
+    setupSkillFindingsWatcher(logger, "opencode");
+    // Surface the scan's structured findings after the scan (TUI ready). Findings
+    // are install- and content-accurate: the scan hashes current on-disk content
+    // and looks up its verdict, so a deleted skill isn't discovered and an edited
+    // skill is matched by its new hash — no cache re-derivation needed.
+    //
+    // Single startup surface: one summary toast listing every risky skill from
+    // this scan. Summarized skills are marked notified so the cache watcher does
+    // not also announce them per-skill; verdicts that land *after* the scan
+    // (worker uploads) are still surfaced individually by the watcher.
+    const surfaceStartupSummary = (scanResults) => {
+        try {
+            const skills = [];
+            const seen = new Set();
+            for (const result of scanResults) {
+                for (const finding of result.findings) {
+                    if (finding.threatId !== "SKILL_CHECK")
+                        continue;
+                    if (finding.severity !== "critical" && finding.severity !== "warning")
+                        continue;
+                    if (seen.has(result.plugin.key))
+                        continue;
+                    seen.add(result.plugin.key);
+                    skills.push({
+                        key: result.plugin.key,
+                        severity: finding.severity === "critical" ? "CRITICAL" : "WARNING",
+                        finding,
+                    });
+                }
+            }
+            if (skills.length === 0)
+                return;
+            // Mark every summarized skill as notified so the cache watcher doesn't
+            // also announce it per-skill. `finding.artifact` is the 16-char short
+            // hash — the same key the watcher dedups on. Verdicts that land after
+            // this scan (worker uploads) are still surfaced individually.
+            for (const s of skills) {
+                if (s.finding.artifact)
+                    notifiedSkillVerdicts.add(s.finding.artifact);
+            }
+            // The summary: a single toast listing every risky skill, shown longer.
+            const hasCritical = skills.some((s) => s.severity === "CRITICAL");
+            const body = skills.map((s) => `${s.key} (${s.severity})`).join("\n");
+            enqueueToast(`${branding.name} detected ${skills.length} malicious/suspicious skill(s):\n${body}`, hasCritical ? "error" : "warning", STARTUP_SUMMARY_DURATION_MS);
+        }
+        catch (e) {
+            logger.debug("Skill summary popup failed", { error: String(e) });
+        }
+    };
     // Set up the cron job that cleans up the approval store.
     const interval = setInterval(() => {
         approvalStore.cleanup();
     }, APPROVAL_STORE_CLEANUP_INTERVAL_MS);
     interval.unref?.();
-    const toolHandlers = createToolHandlers(toolLogger, approvalStore, threatsDir, allowlistsDir, {
-        showToast: (msg, variant) => {
-            client.tui
-                .showToast({
-                body: { title: branding.name, message: msg, variant, duration: 5000 },
-            })
-                .catch(() => { });
-        },
-    }, branding);
+    const toolHandlers = createToolHandlers(toolLogger, approvalStore, threatsDir, trustedDomainsDir, { showToast }, branding);
+    /**
+     * Run the session scan exactly once per session and cache the promise. The
+     * cached promise is the dedupe guard — a second call (repeated
+     * `session.updated`, or another plugin instance) returns the same
+     * in-flight/settled promise instead of re-scanning. The scan's structured
+     * findings drive the summary popup (see `surfaceStartupSummary`).
+     */
+    const scanSession = (sessionID) => {
+        if (sessionID === "unknown")
+            return Promise.resolve();
+        const existing = sessionScanPromises.get(sessionID);
+        if (existing)
+            return existing;
+        const promise = (async () => {
+            logger.debug(`${branding.name}: starting session scan`, { sessionID });
+            const scanHandler = createSessionScanHandler(scanLogger, directory, 
+            // After the scan (TUI ready): summary popup from the structured findings.
+            surfaceStartupSummary, branding, 
+            // One-time notices (e.g. skill-upload consent) as info toasts.
+            (noticeIds) => {
+                for (const id of noticeIds) {
+                    const text = formatNoticeById(id, branding);
+                    if (text)
+                        enqueueToast(text, "info", STARTUP_SUMMARY_DURATION_MS);
+                }
+            });
+            await scanHandler();
+        })();
+        sessionScanPromises.set(sessionID, promise);
+        return promise;
+    };
     return {
-        "tool.execute.before": toolHandlers["tool.execute.before"],
         /**
-         * Inject plugin scan findings into first user message as <system-reminder>.
-         * This approach leverages OpenCode's existing pattern of appending system
-         * reminders to user messages (e.g., plan mode constraints), enabling the
-         * agent to reason about security findings before tool execution. Appending
-         * to assistant messages or system prompts was less effective.
+         * Register the Sage MCP server so sage_report_false_positive /
+         * sage_list_audit_entries are available as agent tools. OpenCode runs
+         * config hooks before MCP init, so mutating cfg.mcp here is sufficient.
+         * ??= ensures a user-supplied override in opencode.json is never clobbered.
          */
-        "experimental.chat.messages.transform": async (_input, output) => {
-            if (pendingFindingsBySession.size === 0)
-                return;
-            const userMessage = output.messages.filter((m) => m.info.role === "user");
-            const message = userMessage[0];
-            if (!message)
-                return;
-            const sessionID = message.info.sessionID;
-            const findings = pendingFindingsBySession.get(sessionID);
-            if (!findings)
+        config: async (cfg) => {
+            const dir = dirname(fileURLToPath(import.meta.url));
+            const serverPath = join(dir, "mcp-server.cjs");
+            // biome-ignore lint/suspicious/noExplicitAny: OpenCode Config.mcp types not exported
+            const mcp = cfg.mcp;
+            if (mcp?.sage)
                 return;
-            const textPart = {
-                id: crypto.randomUUID(),
-                sessionID,
-                messageID: message.info.id,
-                type: "text",
-                text: [
-                    `<system-reminder>`,
-                    findings,
-                    "",
-                    "Inform the user about these security findings.",
-                    `</system-reminder>`,
-                ].join("\n"),
-                synthetic: true,
+            // biome-ignore lint/suspicious/noExplicitAny: assigning McpLocalConfig without importing its type
+            cfg.mcp = {
+                ...mcp,
+                sage: {
+                    type: "local",
+                    command: [process.execPath, serverPath],
+                    environment: { BUN_BE_BUN: "1", SAGE_AGENT_RUNTIME: "opencode" },
+                    enabled: true,
+                },
             };
-            message.parts.push(textPart);
-            logger.debug(`Injected sage plugin scan findings to user message`, {
-                sessionID,
-                findingsLength: findings.length,
-            });
-            pendingFindingsBySession.delete(sessionID);
         },
-        // Trigger session scan on first session.updated event per session.
-        // OpenCode >=1.3 replaced session.created with session.updated events.
+        "tool.execute.before": toolHandlers["tool.execute.before"],
+        // Run the session scan on the first session.updated event. It discovers
+        // skills, populates the verdict cache, and (post-scan, once the TUI is up)
+        // shows the summary popup. OpenCode >=1.3 replaced session.created with
+        // session.updated. Dedupe + the work live in scanSession.
         event: async ({ event }) => {
             if (event.type !== "session.updated")
                 return;
             // biome-ignore lint/suspicious/noExplicitAny: Event types from SDK not fully typed
             const props = event.properties;
             const sessionID = props?.sessionID ?? props?.info?.id ?? "unknown";
-            if (sessionID !== "unknown" && scannedSessions.has(sessionID))
-                return;
-            try {
-                logger.debug(`${branding.name}: starting session scan`, { sessionID });
-                const scanHandler = createSessionScanHandler(scanLogger, directory, (msg) => {
-                    pendingFindingsBySession.set(sessionID, msg);
-                }, branding);
-                await scanHandler();
-                if (sessionID !== "unknown") {
-                    scannedSessions.add(sessionID);
-                }
-            }
-            catch (error) {
-                logger.error(`${branding.name} session scan failed (fail-open)`, {
-                    sessionID,
-                    error: String(error),
-                });
-            }
+            await scanSession(sessionID);
         },
         tool: {
             sage_approve: tool({

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACN,aAAa,EACb,aAAa,EACb,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,UAAU,EACV,eAAe,GACf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,kCAAkC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEtE,MAAM,CAAC,MAAM,UAAU,GAAW,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;IACjE,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,2BAA2B,CACjD,MAAM,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,EACjD,QAAQ,CACR,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG;aACR,SAAS,CAAC;YACV,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC3F,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;IAE1C,2DAA2D;IAC3D,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3D,mFAAmF;IACnF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,yDAAyD;IACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,aAAa,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC,EAAE,kCAAkC,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IAEnB,MAAM,YAAY,GAAG,kBAAkB,CACtC,UAAU,EACV,aAAa,EACb,UAAU,EACV,aAAa,EACb;QACC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YAC3B,MAAM,CAAC,GAAG;iBACR,SAAS,CAAC;gBACV,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;aACrE,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnB,CAAC;KACD,EACD,QAAQ,CACR,CAAC;IAEF,OAAO;QACN,qBAAqB,EAAE,YAAY,CAAC,qBAAqB,CAAC;QAE1D;;;;;;WAMG;QACH,sCAAsC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAChE,IAAI,wBAAwB,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO;YAEhD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,OAAO;gBAAE,OAAO;YAErB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;YACzC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,MAAM,QAAQ,GAAG;gBAChB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvB,SAAS;gBACT,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC1B,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE;oBACL,mBAAmB;oBACnB,QAAQ;oBACR,EAAE;oBACF,gDAAgD;oBAChD,oBAAoB;iBACpB,CAAC,IAAI,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,IAAI;aACf,CAAC;YACF,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE7B,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE;gBAClE,SAAS;gBACT,cAAc,EAAE,QAAQ,CAAC,MAAM;aAC/B,CAAC,CAAC;YACH,wBAAwB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;QAED,mEAAmE;QACnE,uEAAuE;QACvE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO;YAE7C,mFAAmF;YACnF,MAAM,KAAK,GAAI,KAAa,CAAC,UAAU,CAAC;YACxC,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,IAAI,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,SAAS,CAAC;YACnE,IAAI,SAAS,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAO;YAEtE,IAAI,CAAC;gBACJ,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;gBACvE,MAAM,WAAW,GAAG,wBAAwB,CAC3C,UAAU,EACV,SAAS,EACT,CAAC,GAAG,EAAE,EAAE;oBACP,wBAAwB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAC9C,CAAC,EACD,QAAQ,CACR,CAAC;gBACF,MAAM,WAAW,EAAE,CAAC;gBACpB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC7B,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAChC,CAAC;YACF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,kCAAkC,EAAE;oBAChE,SAAS;oBACT,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;iBACpB,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,IAAI,EAAE;YACL,YAAY,EAAE,IAAI,CAAC;gBAClB,WAAW,EAAE,YAAY,QAAQ,CAAC,IAAI,8FAA8F,QAAQ,CAAC,IAAI,uDAAuD;gBACxM,IAAI,EAAE;oBACL,QAAQ,EAAE,IAAI,CAAC,MAAM;yBACnB,MAAM,EAAE;yBACR,QAAQ,CAAC,kBAAkB,QAAQ,CAAC,IAAI,kBAAkB,CAAC;iBAC7D;gBACD,KAAK,CAAC,OAAO,CAAC,IAA0B,EAAE,OAAO;oBAChD,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACxD,IAAI,CAAC,OAAO,EAAE,CAAC;wBACd,OAAO,cAAc,QAAQ,CAAC,IAAI,qCAAqC,CAAC;oBACzE,CAAC;oBAED,IAAI,CAAC;wBACJ,+EAA+E;wBAC/E,yGAAyG;wBACzG,MAAM,OAAO,CAAC,GAAG,CAAC;4BACjB,UAAU,EAAE,WAAW;4BACvB,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;4BAChE,MAAM,EAAE,EAAE;4BACV,QAAQ,EAAE,EAAE;yBACZ,CAAC,CAAC;oBACJ,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAChB,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,0BAA0B,EAAE;4BACxD,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;yBACpB,CAAC,CAAC;wBACH,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;wBAC3C,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;wBACxE,OAAO,mBAAmB,CAAC;oBAC5B,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAEvE,OAAO,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC9D,CAAC;aACD,CAAC;SACF;KACD,CAAC;AACH,CAAC,CAAC;AAEF,eAAe,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAEN,aAAa,EACb,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,+BAA+B,EAC/B,2BAA2B,EAC3B,gBAAgB,EAChB,wBAAwB,EAExB,UAAU,EACV,qBAAqB,EAGrB,eAAe,EACf,WAAW,GACX,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,kCAAkC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAKtE,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC,gFAAgF;AAChF,2DAA2D;AAC3D,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAE3C,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;AAChD,IAAI,oBAAoB,GAAG,KAAK,CAAC;AAEjC,0EAA0E;AAC1E,gFAAgF;AAChF,mBAAmB;AACnB,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAyB,CAAC;AAO7D,MAAM,UAAU,GAAkB,EAAE,CAAC;AACrC,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAC7B,6EAA6E;AAC7E,IAAI,YAAiC,CAAC;AAEtC,KAAK,UAAU,UAAU;IACxB,IAAI,gBAAgB;QAAE,OAAO;IAC7B,gBAAgB,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC;QACJ,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC3B,wEAAwE;YACxE,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI;gBAAE,MAAM;YAClC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1D,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACtE,CAAC;IACF,CAAC;YAAS,CAAC;QACV,gBAAgB,GAAG,KAAK,CAAC;IAC1B,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CACpB,OAAe,EACf,OAAqB,EACrB,UAAU,GAAG,yBAAyB;IAEtC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IAClD,KAAK,UAAU,EAAE,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,6EAA6E;AAC7E,SAAS,YAAY,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AASD;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAAC,YAA0B;IAC3D,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,UAAU;YAAE,SAAS;QACrD,IAAI,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC;YAAE,SAAS;QAClE,MAAM,GAAG,GACR,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,YAAY;YAC1D,OAAO,CAAC,SAAS;YACjB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC;YACR,OAAO;YACP,GAAG;YACH,QAAQ,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACtD,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE;SAChC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,yBAAyB,CAAC,MAAc,EAAE,YAA0B;IAC5E,IAAI,oBAAoB;QAAE,OAAO;IACjC,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,YAAY,GAAG,KAAK,IAAmB,EAAE;QAC9C,IAAI,CAAC;YACJ,KAAK,MAAM,CAAC,IAAI,MAAM,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxD,qBAAqB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,CAAC;QACF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACZ,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;IACF,CAAC,CAAC;IAEF,6EAA6E;IAC7E,MAAM,WAAW,GAAG,KAAK,IAAmB,EAAE;QAC7C,IAAI,CAAC;YACJ,KAAK,MAAM,CAAC,IAAI,MAAM,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACtC,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAC/C,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC;gBAC3E,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACjF,YAAY,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC5F,CAAC;QACF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACZ,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACF,CAAC,CAAC;IAEF,IAAI,CAAC;QACJ,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,KAAK,YAAY,EAAE,CAAC;QACpB,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,eAAe;QACf,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YACvE,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;gBAAE,KAAK,WAAW,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,oBAAoB,GAAG,IAAI,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,yEAAyE;QACzE,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAW,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;IACjE,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAY,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,GAAG,yBAAyB,EAAE,EAAE;QACnF,MAAM,CAAC,GAAG;aACR,SAAS,CAAC;YACV,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE;SAC3E,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,8EAA8E;IAC9E,qEAAqE;IACrE,YAAY,KAAK,SAAS,CAAC;IAC3B,MAAM,cAAc,GAAG,2BAA2B,CACjD,MAAM,wBAAwB,CAAC,SAAS,EAAE,MAAM,CAAC,EACjD,QAAQ,CACR,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG;aACR,SAAS,CAAC;YACV,IAAI,EAAE;gBACL,KAAK,EAAE,QAAQ,CAAC,IAAI;gBACpB,OAAO,EAAE,cAAc;gBACvB,OAAO,EAAE,SAAS;gBAClB,QAAQ,EAAE,yBAAyB;aACnC;SACD,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,EAAE,CAAC;IAC3D,IAAI,kBAAkB,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG;aACR,SAAS,CAAC;YACV,IAAI,EAAE;gBACL,KAAK,EAAE,QAAQ,CAAC,IAAI;gBACpB,OAAO,EAAE,+BAA+B,CAAC,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC;gBACjF,OAAO,EAAE,SAAS;gBAClB,QAAQ,EAAE,IAAI;aACd;SACD,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAC/D,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;IAE1C,2EAA2E;IAC3E,6EAA6E;IAC7E,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE9C,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,oEAAoE;IACpE,EAAE;IACF,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,qBAAqB,GAAG,CAAC,WAA+B,EAAQ,EAAE;QACvE,IAAI,CAAC;YACJ,MAAM,MAAM,GAIP,EAAE,CAAC;YACR,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;gBAClC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,aAAa;wBAAE,SAAS;oBACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;wBAAE,SAAS;oBAChF,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;wBAAE,SAAS;oBAC1C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC5B,MAAM,CAAC,IAAI,CAAC;wBACX,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;wBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;wBAClE,OAAO;qBACP,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAEhC,uEAAuE;YACvE,sEAAsE;YACtE,sEAAsE;YACtE,8DAA8D;YAC9D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ;oBAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvE,CAAC;YAED,uEAAuE;YACvE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtE,YAAY,CACX,GAAG,QAAQ,CAAC,IAAI,aAAa,MAAM,CAAC,MAAM,oCAAoC,IAAI,EAAE,EACpF,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EACjC,2BAA2B,CAC3B,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACZ,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACF,CAAC,CAAC;IAEF,yDAAyD;IACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,aAAa,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC,EAAE,kCAAkC,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IAEnB,MAAM,YAAY,GAAG,kBAAkB,CACtC,UAAU,EACV,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,EAAE,SAAS,EAAE,EACb,QAAQ,CACR,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAiB,EAAE;QACxD,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACvE,MAAM,WAAW,GAAG,wBAAwB,CAC3C,UAAU,EACV,SAAS;YACT,0EAA0E;YAC1E,qBAAqB,EACrB,QAAQ;YACR,+DAA+D;YAC/D,CAAC,SAAS,EAAE,EAAE;gBACb,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;oBAC5B,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;oBAC5C,IAAI,IAAI;wBAAE,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC;gBACnE,CAAC;YACF,CAAC,CACD,CAAC;YACF,MAAM,WAAW,EAAE,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;QACL,mBAAmB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACN;;;;;WAKG;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAC/C,qFAAqF;YACrF,MAAM,GAAG,GAAI,GAAW,CAAC,GAA0C,CAAC;YACpE,IAAI,GAAG,EAAE,IAAI;gBAAE,OAAO;YACtB,kGAAkG;YACjG,GAAW,CAAC,GAAG,GAAG;gBAClB,GAAG,GAAG;gBACN,IAAI,EAAE;oBACL,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC;oBACvC,WAAW,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE;oBAChE,OAAO,EAAE,IAAI;iBACb;aACD,CAAC;QACH,CAAC;QAED,qBAAqB,EAAE,YAAY,CAAC,qBAAqB,CAAC;QAE1D,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,0DAA0D;QAC1D,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO;YAC7C,mFAAmF;YACnF,MAAM,KAAK,GAAI,KAAa,CAAC,UAAU,CAAC;YACxC,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,IAAI,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,SAAS,CAAC;YACnE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,EAAE;YACL,YAAY,EAAE,IAAI,CAAC;gBAClB,WAAW,EAAE,YAAY,QAAQ,CAAC,IAAI,8FAA8F,QAAQ,CAAC,IAAI,uDAAuD;gBACxM,IAAI,EAAE;oBACL,QAAQ,EAAE,IAAI,CAAC,MAAM;yBACnB,MAAM,EAAE;yBACR,QAAQ,CAAC,kBAAkB,QAAQ,CAAC,IAAI,kBAAkB,CAAC;iBAC7D;gBACD,KAAK,CAAC,OAAO,CAAC,IAA0B,EAAE,OAAO;oBAChD,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACxD,IAAI,CAAC,OAAO,EAAE,CAAC;wBACd,OAAO,cAAc,QAAQ,CAAC,IAAI,qCAAqC,CAAC;oBACzE,CAAC;oBAED,IAAI,CAAC;wBACJ,+EAA+E;wBAC/E,yGAAyG;wBACzG,MAAM,OAAO,CAAC,GAAG,CAAC;4BACjB,UAAU,EAAE,WAAW;4BACvB,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;4BAChE,MAAM,EAAE,EAAE;4BACV,QAAQ,EAAE,EAAE;yBACZ,CAAC,CAAC;oBACJ,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAChB,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,0BAA0B,EAAE;4BACxD,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;yBACpB,CAAC,CAAC;wBACH,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;wBAC3C,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;wBACxE,OAAO,mBAAmB,CAAC;oBAC5B,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAEvE,OAAO,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC9D,CAAC;aACD,CAAC;SACF;KACD,CAAC;AACH,CAAC,CAAC;AAEF,eAAe,UAAU,CAAC"}