@greppleai/grip 0.0.0-stage → 0.0.1

package/dist/daemon/server.js

@@ -0,0 +1,400 @@
+import { randomBytes } from "node:crypto";
+import { createServer as createHttpServer, } from "node:http";
+import { createServer as createHttpsServer } from "node:https";
+import WebSocket, { WebSocketServer } from "ws";
+import { RemoteWorkspaceServerProtocol, } from "../core/remote-workspace-protocol/session.js";
+import { DAEMON_WEBSOCKET_PATH } from "./config.js";
+import { createDaemonAuthorization, rejectDaemonUpgrade, validateDaemonNetworkPolicy, validateDaemonUpgrade, } from "./security.js";
+import { createDaemonWorkspaceRuntime } from "./workspace-runtime.js";
+function websocketPayload(data) {
+    if (Buffer.isBuffer(data))
+        return Uint8Array.from(data);
+    if (Array.isArray(data))
+        return Uint8Array.from(Buffer.concat(data));
+    return Uint8Array.from(new Uint8Array(data));
+}
+function websocketCloseCode(code) {
+    switch (code) {
+        case "normal":
+            return 1000;
+        case "protocol_error":
+            return 1002;
+        case "invalid_payload":
+            return 1007;
+        case "policy_violation":
+            return 1008;
+        case "message_too_large":
+            return 1009;
+    }
+}
+function waitForWebSocketClose(websocket) {
+    if (websocket.readyState === WebSocket.CLOSED)
+        return Promise.resolve();
+    return new Promise((resolve) => websocket.once("close", () => resolve()));
+}
+function waitWithin(promise, timeoutMs, forceSignal) {
+    if (forceSignal.aborted)
+        return Promise.resolve(false);
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            forceSignal.removeEventListener("abort", onForce);
+            resolve(value);
+        };
+        const timer = setTimeout(() => finish(false), timeoutMs);
+        const onForce = () => finish(false);
+        forceSignal.addEventListener("abort", onForce, { once: true });
+        promise.then(() => finish(true), () => finish(false));
+    });
+}
+function terminateDaemonConnections(connections) {
+    for (const connection of connections)
+        connection.websocket.terminate();
+}
+function beginDaemonConnectionDrain(connections, hostDisposal) {
+    return Promise.allSettled([...connections.map((connection) => connection.protocol.beginDrain()), hostDisposal]).then(() => undefined);
+}
+function disconnectDaemonConnections(connections) {
+    return Promise.allSettled(connections.map((connection) => connection.protocol.disconnect())).then(() => undefined);
+}
+function requestDaemonConnectionClose(connections) {
+    for (const connection of connections) {
+        if (connection.websocket.readyState === WebSocket.OPEN) {
+            connection.websocket.close(1001, "Daemon shutting down");
+        }
+    }
+}
+function waitForDaemonConnectionsClosed(connections) {
+    return Promise.allSettled(connections.map((connection) => connection.closed)).then(() => undefined);
+}
+function destroyDaemonSockets(sockets) {
+    for (const socket of sockets)
+        socket.destroy();
+}
+function formatHostForUrl(host) {
+    return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+export function createDaemonServer(configuration) {
+    validateDaemonNetworkPolicy(configuration);
+    const authorization = createDaemonAuthorization(configuration.token);
+    const workspaceId = randomBytes(18).toString("base64url");
+    const workspace = Object.freeze({
+        id: workspaceId,
+        root: configuration.workspaceRoot,
+        pathFlavor: process.platform === "win32" ? "windows" : "posix",
+    });
+    let runtime = createDaemonWorkspaceRuntime(configuration);
+    let runtimeHandler = runtime.createHandler(workspace);
+    const handler = {
+        handleRequest: (request, context) => runtimeHandler.handleRequest(request, context),
+        validateToolArguments: (toolName, value) => runtimeHandler.validateToolArguments(toolName, value),
+    };
+    const requestListener = (_request, response) => {
+        response.writeHead(404, { "content-type": "text/plain" });
+        response.end("Not found\n");
+    };
+    const server = configuration.tls
+        ? createHttpsServer({
+            cert: configuration.tls.cert,
+            key: configuration.tls.key,
+            passphrase: configuration.tls.passphrase,
+            minVersion: "TLSv1.2",
+        }, requestListener)
+        : createHttpServer(requestListener);
+    const websocketServer = new WebSocketServer({
+        noServer: true,
+        clientTracking: false,
+        maxPayload: configuration.protocolLimits.maxMessageBytes,
+        perMessageDeflate: false,
+        allowSynchronousEvents: false,
+        skipUTF8Validation: false,
+    });
+    const sockets = new Set();
+    const pendingSockets = new Set();
+    const pendingSocketTimers = new Map();
+    const pendingSocketDeadlines = new Map();
+    const connections = new Set();
+    let catalog = runtime.catalog;
+    let reloadQueue = Promise.resolve();
+    const forceController = new AbortController();
+    let currentAddress;
+    let listenPromise;
+    let rejectListen;
+    let closePromise;
+    let serverState = "created";
+    const stopListener = () => {
+        if (!server.listening && !listenPromise)
+            return Promise.resolve();
+        return new Promise((resolve) => {
+            let settled = false;
+            const cleanup = () => {
+                server.off("listening", onListening);
+                server.off("error", onError);
+                server.off("close", onClose);
+            };
+            const finish = () => {
+                if (settled)
+                    return;
+                settled = true;
+                cleanup();
+                resolve();
+            };
+            const closeListener = () => server.close(() => finish());
+            const onListening = () => closeListener();
+            const onError = () => finish();
+            const onClose = () => finish();
+            server.once("error", onError);
+            server.once("close", onClose);
+            if (server.listening)
+                closeListener();
+            else
+                server.once("listening", onListening);
+        });
+    };
+    server.on("connection", (socket) => {
+        if (serverState !== "listening" || pendingSockets.size >= configuration.maxPendingConnections) {
+            socket.destroy();
+            return;
+        }
+        sockets.add(socket);
+        pendingSockets.add(socket);
+        const pendingTimer = setTimeout(() => socket.destroy(), configuration.handshakeTimeoutMs);
+        pendingTimer.unref?.();
+        pendingSocketTimers.set(socket, pendingTimer);
+        pendingSocketDeadlines.set(socket, performance.now() + configuration.handshakeTimeoutMs);
+        socket.once("close", () => {
+            sockets.delete(socket);
+            pendingSockets.delete(socket);
+            const timer = pendingSocketTimers.get(socket);
+            if (timer)
+                clearTimeout(timer);
+            pendingSocketTimers.delete(socket);
+            pendingSocketDeadlines.delete(socket);
+        });
+    });
+    server.on("upgrade", (request, socket, head) => {
+        const netSocket = socket;
+        const decision = validateDaemonUpgrade(request, configuration, authorization);
+        if (!decision.accepted) {
+            rejectDaemonUpgrade(netSocket, decision);
+            return;
+        }
+        if (serverState !== "listening" || connections.size >= configuration.maxConnections) {
+            rejectDaemonUpgrade(netSocket, { accepted: false, status: 503, message: "Service unavailable" });
+            return;
+        }
+        const handshakeDeadline = pendingSocketDeadlines.get(netSocket) ?? performance.now();
+        pendingSockets.delete(netSocket);
+        const pendingTimer = pendingSocketTimers.get(netSocket);
+        if (pendingTimer)
+            clearTimeout(pendingTimer);
+        pendingSocketTimers.delete(netSocket);
+        pendingSocketDeadlines.delete(netSocket);
+        websocketServer.handleUpgrade(request, socket, head, (websocket) => {
+            if (serverState !== "listening") {
+                websocket.terminate();
+                return;
+            }
+            const remainingHandshakeMs = Math.max(0, handshakeDeadline - performance.now());
+            const handshakeTimer = setTimeout(() => {
+                websocket.terminate();
+            }, remainingHandshakeMs);
+            handshakeTimer.unref?.();
+            let protocol;
+            const transport = {
+                send(message) {
+                    if (websocket.readyState !== WebSocket.OPEN)
+                        return Promise.reject(new Error("WebSocket is not open"));
+                    const serialized = JSON.stringify(message);
+                    const bytes = Buffer.byteLength(serialized, "utf8");
+                    if (websocket.bufferedAmount + bytes > configuration.protocolLimits.maxPendingOutboundBytes) {
+                        return Promise.reject(new Error("WebSocket outbound buffer exceeds daemon limits"));
+                    }
+                    return new Promise((resolve, reject) => {
+                        websocket.send(serialized, { binary: false, compress: false }, (error) => {
+                            if (error)
+                                reject(error);
+                            else
+                                resolve();
+                        });
+                    });
+                },
+                close(reason) {
+                    if (websocket.readyState === WebSocket.CLOSED)
+                        return Promise.resolve();
+                    websocket.close(websocketCloseCode(reason.code), reason.message);
+                    return waitForWebSocketClose(websocket);
+                },
+            };
+            protocol = new RemoteWorkspaceServerProtocol(transport, handler, {
+                workspace,
+                catalog,
+                capabilities: runtime.capabilities,
+                limits: configuration.protocolLimits,
+                backendLabel: "grip-workspace-daemon",
+            });
+            const connection = {
+                websocket,
+                protocol,
+                closed: Promise.resolve(),
+            };
+            connection.closed = waitForWebSocketClose(websocket).then(async () => {
+                clearTimeout(handshakeTimer);
+                connections.delete(connection);
+                await protocol.disconnect().catch(() => undefined);
+            });
+            connections.add(connection);
+            websocket.on("message", (data, isBinary) => {
+                if (isBinary) {
+                    websocket.close(1003, "Text protocol required");
+                    return;
+                }
+                void protocol
+                    .receive(websocketPayload(data))
+                    .then(() => {
+                    if (protocol.handshakeComplete)
+                        clearTimeout(handshakeTimer);
+                })
+                    .catch(() => undefined);
+            });
+            websocket.on("error", () => undefined);
+        });
+    });
+    const api = {
+        listen() {
+            if (serverState === "closing" || serverState === "closed")
+                return Promise.reject(new Error("Daemon server is closing"));
+            if (currentAddress)
+                return Promise.resolve(currentAddress);
+            if (listenPromise)
+                return listenPromise;
+            listenPromise = new Promise((resolve, reject) => {
+                rejectListen = reject;
+                const onError = (error) => {
+                    server.off("listening", onListening);
+                    listenPromise = undefined;
+                    rejectListen = undefined;
+                    reject(error);
+                };
+                const onListening = () => {
+                    server.off("error", onError);
+                    if (serverState !== "created") {
+                        rejectListen = undefined;
+                        reject(new Error("Daemon server closed before listening completed"));
+                        return;
+                    }
+                    const address = server.address();
+                    if (!address || typeof address === "string") {
+                        rejectListen = undefined;
+                        reject(new Error("Daemon listener did not return a TCP address"));
+                        return;
+                    }
+                    serverState = "listening";
+                    const port = address.port;
+                    currentAddress = Object.freeze({
+                        host: configuration.host,
+                        port,
+                        secure: configuration.tls !== undefined,
+                        url: `${configuration.tls ? "wss" : "ws"}://${formatHostForUrl(configuration.host)}:${port}${DAEMON_WEBSOCKET_PATH}`,
+                        workspaceRoot: configuration.workspaceRoot,
+                        workspaceId,
+                    });
+                    rejectListen = undefined;
+                    resolve(currentAddress);
+                };
+                server.once("error", onError);
+                server.once("listening", onListening);
+                server.listen(configuration.port, configuration.host);
+            });
+            return listenPromise;
+        },
+        address() {
+            return currentAddress ? { ...currentAddress } : undefined;
+        },
+        state() {
+            return serverState;
+        },
+        reload() {
+            if (serverState !== "listening")
+                return Promise.reject(new Error("Daemon server is not listening"));
+            reloadQueue = reloadQueue.then(async () => {
+                if (serverState !== "listening")
+                    throw new Error("Daemon server is not listening");
+                const candidate = createDaemonWorkspaceRuntime(configuration);
+                const candidateCatalog = { ...candidate.catalog, generation: catalog.generation + 1 };
+                const previous = runtime;
+                const previousCatalog = catalog;
+                runtime = candidate;
+                runtimeHandler = candidate.createHandler(workspace);
+                catalog = candidateCatalog;
+                try {
+                    await Promise.all([...connections].map((connection) => connection.protocol.publishCatalog(catalog)));
+                }
+                catch (error) {
+                    runtime = previous;
+                    runtimeHandler = previous.createHandler(workspace);
+                    catalog = previousCatalog;
+                    await Promise.allSettled([...connections].map((connection) => connection.protocol.disconnect()));
+                    await candidate.dispose();
+                    throw error;
+                }
+                await previous.retire();
+            });
+            return reloadQueue;
+        },
+        close() {
+            if (closePromise)
+                return closePromise;
+            serverState = "closing";
+            rejectListen?.(new Error("Daemon server closed before listening completed"));
+            rejectListen = undefined;
+            const deadline = performance.now() + configuration.shutdownTimeoutMs;
+            const remainingMs = () => Math.max(0, deadline - performance.now());
+            closePromise = (async () => {
+                const listenerClose = stopListener();
+                const snapshot = [...connections];
+                await waitWithin(reloadQueue.catch(() => undefined), remainingMs(), forceController.signal);
+                const hostDisposal = runtime.dispose();
+                const drained = await waitWithin(beginDaemonConnectionDrain(snapshot, hostDisposal), remainingMs(), forceController.signal);
+                if (!drained)
+                    terminateDaemonConnections(snapshot);
+                await waitWithin(disconnectDaemonConnections(snapshot), remainingMs(), forceController.signal);
+                requestDaemonConnectionClose(snapshot);
+                const socketsClosed = await waitWithin(waitForDaemonConnectionsClosed(snapshot), remainingMs(), forceController.signal);
+                if (!socketsClosed)
+                    terminateDaemonConnections(snapshot);
+                destroyDaemonSockets(sockets);
+                await listenerClose;
+                connections.clear();
+            })().finally(() => {
+                terminateDaemonConnections(connections);
+                destroyDaemonSockets(sockets);
+                for (const timer of pendingSocketTimers.values())
+                    clearTimeout(timer);
+                pendingSocketTimers.clear();
+                pendingSocketDeadlines.clear();
+                pendingSockets.clear();
+                connections.clear();
+                currentAddress = undefined;
+                serverState = "closed";
+            });
+            return closePromise;
+        },
+        forceClose() {
+            if (serverState === "closed")
+                return closePromise ?? Promise.resolve();
+            serverState = "closing";
+            forceController.abort();
+            currentAddress = undefined;
+            terminateDaemonConnections(connections);
+            destroyDaemonSockets(sockets);
+            return api.close();
+        },
+    };
+    return api;
+}
+//# sourceMappingURL=server.js.map

package/dist/daemon/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/daemon/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACN,YAAY,IAAI,gBAAgB,GAIhC,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/D,OAAO,SAAS,EAAE,EAAgB,eAAe,EAAE,MAAM,IAAI,CAAC;AAE9D,OAAO,EAIN,6BAA6B,GAC7B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAA4B,MAAM,aAAa,CAAC;AAC9E,OAAO,EACN,yBAAyB,EACzB,mBAAmB,EACnB,2BAA2B,EAC3B,qBAAqB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AA4BtE,SAAS,gBAAgB,CAAC,IAAa,EAAc;IACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAAA,CAC7C;AAED,SAAS,kBAAkB,CAAC,IAAsC,EAAU;IAC3E,QAAQ,IAAI,EAAE,CAAC;QACd,KAAK,QAAQ;YACZ,OAAO,IAAI,CAAC;QACb,KAAK,gBAAgB;YACpB,OAAO,IAAI,CAAC;QACb,KAAK,iBAAiB;YACrB,OAAO,IAAI,CAAC;QACb,KAAK,kBAAkB;YACtB,OAAO,IAAI,CAAC;QACb,KAAK,mBAAmB;YACvB,OAAO,IAAI,CAAC;IACd,CAAC;AAAA,CACD;AAED,SAAS,qBAAqB,CAAC,SAAoB,EAAiB;IACnE,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACxE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAAA,CAC1E;AAED,SAAS,UAAU,CAAC,OAAyB,EAAE,SAAiB,EAAE,WAAwB,EAAoB;IAC7G,IAAI,WAAW,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClD,OAAO,CAAC,KAAK,CAAC,CAAC;QAAA,CACf,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CACX,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAClB,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CACnB,CAAC;IAAA,CACF,CAAC,CAAC;AAAA,CACH;AACD,SAAS,0BAA0B,CAAC,WAAuC,EAAQ;IAClF,KAAK,MAAM,UAAU,IAAI,WAAW;QAAE,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;AAAA,CACvE;AAED,SAAS,0BAA0B,CAClC,WAAwC,EACxC,YAA2B,EACX;IAChB,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CACnH,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;AAAA,CACF;AAED,SAAS,2BAA2B,CAAC,WAAwC,EAAiB;IAC7F,OAAO,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAAA,CACnH;AAED,SAAS,4BAA4B,CAAC,WAAwC,EAAQ;IACrF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACtC,IAAI,UAAU,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YACxD,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC1D,CAAC;IACF,CAAC;AAAA,CACD;AAED,SAAS,8BAA8B,CAAC,WAAwC,EAAiB;IAChG,OAAO,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAAA,CACpG;AAED,SAAS,oBAAoB,CAAC,OAA4B,EAAQ;IACjE,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AAAA,CAC/C;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAU;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,CACxE;AAED,MAAM,UAAU,kBAAkB,CAAC,aAAkC,EAAgB;IACpF,2BAA2B,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,yBAAyB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,aAAa,CAAC,aAAa;QACjC,UAAU,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAE,SAAmB,CAAC,CAAC,CAAE,OAAiB;KACpF,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,4BAA4B,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,OAAO,GAAiC;QAC7C,aAAa,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;QACnF,qBAAqB,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC;KACjG,CAAC;IACF,MAAM,eAAe,GAAG,CAAC,QAAyB,EAAE,QAAwB,EAAE,EAAE,CAAC;QAChF,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAAA,CAC5B,CAAC;IACF,MAAM,MAAM,GAAe,aAAa,CAAC,GAAG;QAC3C,CAAC,CAAC,iBAAiB,CACjB;YACC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI;YAC5B,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG;YAC1B,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU;YACxC,UAAU,EAAE,SAAS;SACrB,EACD,eAAe,CACf;QACF,CAAC,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACrC,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC;QAC3C,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,eAAe;QACxD,iBAAiB,EAAE,KAAK;QACxB,sBAAsB,EAAE,KAAK;QAC7B,kBAAkB,EAAE,KAAK;KACzB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC9D,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAChD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAC9B,IAAI,WAAW,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACnD,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9C,IAAI,cAA+C,CAAC;IACpD,IAAI,aAAuD,CAAC;IAC5D,IAAI,YAAkD,CAAC;IACvD,IAAI,YAAuC,CAAC;IAC5C,IAAI,WAAW,GAAsB,SAAS,CAAC;IAE/C,MAAM,YAAY,GAAG,GAAkB,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,aAAa;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAClE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBACrC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAAA,CAC7B,CAAC;YACF,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC;gBACpB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,CAAC;YAAA,CACV,CAAC;YACF,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,IAAI,MAAM,CAAC,SAAS;gBAAE,aAAa,EAAE,CAAC;;gBACjC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAAA,CAC3C,CAAC,CAAC;IAAA,CACH,CAAC;IAEF,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC;QAC3C,IAAI,WAAW,KAAK,WAAW,IAAI,cAAc,CAAC,IAAI,IAAI,aAAa,CAAC,qBAAqB,EAAE,CAAC;YAC/F,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACR,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;QAC1F,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;QACvB,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC9C,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,kBAAkB,CAAC,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvB,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAA,CACtC,CAAC,CAAC;IAAA,CACH,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAgB,CAAC;QACnC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACxB,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QACD,IAAI,WAAW,KAAK,WAAW,IAAI,WAAW,CAAC,IAAI,IAAI,aAAa,CAAC,cAAc,EAAE,CAAC;YACrF,mBAAmB,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACjG,OAAO;QACR,CAAC;QACD,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;QACrF,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,YAAY;YAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,sBAAsB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,eAAe,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACnE,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;gBACjC,SAAS,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO;YACR,CAAC;YACD,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAChF,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;gBACvC,SAAS,CAAC,SAAS,EAAE,CAAC;YAAA,CACtB,EAAE,oBAAoB,CAAC,CAAC;YACzB,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC;YACzB,IAAI,QAAuC,CAAC;YAC5C,MAAM,SAAS,GAAG;gBACjB,IAAI,CAAC,OAAqC,EAAiB;oBAC1D,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;wBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;oBACvG,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;oBAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;oBACpD,IAAI,SAAS,CAAC,cAAc,GAAG,KAAK,GAAG,aAAa,CAAC,cAAc,CAAC,uBAAuB,EAAE,CAAC;wBAC7F,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;oBACrF,CAAC;oBACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;wBACvC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;4BACzE,IAAI,KAAK;gCAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gCACpB,OAAO,EAAE,CAAC;wBAAA,CACf,CAAC,CAAC;oBAAA,CACH,CAAC,CAAC;gBAAA,CACH;gBACD,KAAK,CAAC,MAA0C,EAAiB;oBAChE,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,MAAM;wBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;oBACxE,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;oBACjE,OAAO,qBAAqB,CAAC,SAAS,CAAC,CAAC;gBAAA,CACxC;aACD,CAAC;YACF,QAAQ,GAAG,IAAI,6BAA6B,CAAC,SAAS,EAAE,OAAO,EAAE;gBAChE,SAAS;gBACT,OAAO;gBACP,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM,EAAE,aAAa,CAAC,cAAc;gBACpC,YAAY,EAAE,uBAAuB;aACrC,CAAC,CAAC;YACH,MAAM,UAAU,GAAqB;gBACpC,SAAS;gBACT,QAAQ;gBACR,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE;aACzB,CAAC;YACF,UAAU,CAAC,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACrE,YAAY,CAAC,cAAc,CAAC,CAAC;gBAC7B,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC/B,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAAA,CACnD,CAAC,CAAC;YACH,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC5B,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;gBAC3C,IAAI,QAAQ,EAAE,CAAC;oBACd,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;oBAChD,OAAO;gBACR,CAAC;gBACD,KAAK,QAAQ;qBACX,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;qBAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;oBACX,IAAI,QAAQ,CAAC,iBAAiB;wBAAE,YAAY,CAAC,cAAc,CAAC,CAAC;gBAAA,CAC7D,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAAA,CACzB,CAAC,CAAC;YACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAAA,CACvC,CAAC,CAAC;IAAA,CACH,CAAC,CAAC;IAEH,MAAM,GAAG,GAAiB;QACzB,MAAM,GAAiC;YACtC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,QAAQ;gBACxD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;YAC9D,IAAI,cAAc;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAC3D,IAAI,aAAa;gBAAE,OAAO,aAAa,CAAC;YACxC,aAAa,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;gBAChD,YAAY,GAAG,MAAM,CAAC;gBACtB,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,EAAE,CAAC;oBACjC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;oBACrC,aAAa,GAAG,SAAS,CAAC;oBAC1B,YAAY,GAAG,SAAS,CAAC;oBACzB,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAA,CACd,CAAC;gBACF,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC;oBACzB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC7B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;wBAC/B,YAAY,GAAG,SAAS,CAAC;wBACzB,MAAM,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;wBACrE,OAAO;oBACR,CAAC;oBACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;wBAC7C,YAAY,GAAG,SAAS,CAAC;wBACzB,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC,CAAC;wBAClE,OAAO;oBACR,CAAC;oBACD,WAAW,GAAG,WAAW,CAAC;oBAC1B,MAAM,IAAI,GAAI,OAAuB,CAAC,IAAI,CAAC;oBAC3C,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;wBAC9B,IAAI,EAAE,aAAa,CAAC,IAAI;wBACxB,IAAI;wBACJ,MAAM,EAAE,aAAa,CAAC,GAAG,KAAK,SAAS;wBACvC,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,qBAAqB,EAAE;wBACpH,aAAa,EAAE,aAAa,CAAC,aAAa;wBAC1C,WAAW;qBACX,CAAC,CAAC;oBACH,YAAY,GAAG,SAAS,CAAC;oBACzB,OAAO,CAAC,cAAc,CAAC,CAAC;gBAAA,CACxB,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBACtC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;YAAA,CACtD,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QAAA,CACrB;QACD,OAAO,GAAoC;YAC1C,OAAO,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAAA,CAC1D;QACD,KAAK,GAAsB;YAC1B,OAAO,WAAW,CAAC;QAAA,CACnB;QACD,MAAM,GAAkB;YACvB,IAAI,WAAW,KAAK,WAAW;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;YACpG,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC1C,IAAI,WAAW,KAAK,WAAW;oBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBACnF,MAAM,SAAS,GAAG,4BAA4B,CAAC,aAAa,CAAC,CAAC;gBAC9D,MAAM,gBAAgB,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;gBACtF,MAAM,QAAQ,GAAG,OAAO,CAAC;gBACzB,MAAM,eAAe,GAAG,OAAO,CAAC;gBAChC,OAAO,GAAG,SAAS,CAAC;gBACpB,cAAc,GAAG,SAAS,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;gBACpD,OAAO,GAAG,gBAAgB,CAAC;gBAC3B,IAAI,CAAC;oBACJ,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACtG,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,OAAO,GAAG,QAAQ,CAAC;oBACnB,cAAc,GAAG,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;oBACnD,OAAO,GAAG,eAAe,CAAC;oBAC1B,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;oBACjG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;oBAC1B,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;YAAA,CACxB,CAAC,CAAC;YACH,OAAO,WAAW,CAAC;QAAA,CACnB;QACD,KAAK,GAAkB;YACtB,IAAI,YAAY;gBAAE,OAAO,YAAY,CAAC;YACtC,WAAW,GAAG,SAAS,CAAC;YACxB,YAAY,EAAE,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;YAC7E,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,iBAAiB,CAAC;YACrE,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YACpE,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,aAAa,GAAG,YAAY,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC;gBAClC,MAAM,UAAU,CACf,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAClC,WAAW,EAAE,EACb,eAAe,CAAC,MAAM,CACtB,CAAC;gBACF,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;gBACvC,MAAM,OAAO,GAAG,MAAM,UAAU,CAC/B,0BAA0B,CAAC,QAAQ,EAAE,YAAY,CAAC,EAClD,WAAW,EAAE,EACb,eAAe,CAAC,MAAM,CACtB,CAAC;gBACF,IAAI,CAAC,OAAO;oBAAE,0BAA0B,CAAC,QAAQ,CAAC,CAAC;gBACnD,MAAM,UAAU,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;gBAC/F,4BAA4B,CAAC,QAAQ,CAAC,CAAC;gBACvC,MAAM,aAAa,GAAG,MAAM,UAAU,CACrC,8BAA8B,CAAC,QAAQ,CAAC,EACxC,WAAW,EAAE,EACb,eAAe,CAAC,MAAM,CACtB,CAAC;gBACF,IAAI,CAAC,aAAa;oBAAE,0BAA0B,CAAC,QAAQ,CAAC,CAAC;gBACzD,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBAC9B,MAAM,aAAa,CAAC;gBACpB,WAAW,CAAC,KAAK,EAAE,CAAC;YAAA,CACpB,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAClB,0BAA0B,CAAC,WAAW,CAAC,CAAC;gBACxC,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBAC9B,KAAK,MAAM,KAAK,IAAI,mBAAmB,CAAC,MAAM,EAAE;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBACtE,mBAAmB,CAAC,KAAK,EAAE,CAAC;gBAC5B,sBAAsB,CAAC,KAAK,EAAE,CAAC;gBAC/B,cAAc,CAAC,KAAK,EAAE,CAAC;gBACvB,WAAW,CAAC,KAAK,EAAE,CAAC;gBACpB,cAAc,GAAG,SAAS,CAAC;gBAC3B,WAAW,GAAG,QAAQ,CAAC;YAAA,CACvB,CAAC,CAAC;YACH,OAAO,YAAY,CAAC;QAAA,CACpB;QACD,UAAU,GAAkB;YAC3B,IAAI,WAAW,KAAK,QAAQ;gBAAE,OAAO,YAAY,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACvE,WAAW,GAAG,SAAS,CAAC;YACxB,eAAe,CAAC,KAAK,EAAE,CAAC;YACxB,cAAc,GAAG,SAAS,CAAC;YAC3B,0BAA0B,CAAC,WAAW,CAAC,CAAC;YACxC,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC;QAAA,CACnB;KACD,CAAC;IACF,OAAO,GAAG,CAAC;AAAA,CACX","sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport {\n\tcreateServer as createHttpServer,\n\ttype Server as HttpServer,\n\ttype IncomingMessage,\n\ttype ServerResponse,\n} from \"node:http\";\nimport { createServer as createHttpsServer } from \"node:https\";\nimport type { AddressInfo, Socket } from \"node:net\";\nimport WebSocket, { type RawData, WebSocketServer } from \"ws\";\nimport type { RemoteWorkspaceServerMessage } from \"../core/remote-workspace-protocol/contract.ts\";\nimport {\n\ttype RemoteWorkspaceProtocolCloseCode,\n\ttype RemoteWorkspaceProtocolCloseReason,\n\ttype RemoteWorkspaceServerHandler,\n\tRemoteWorkspaceServerProtocol,\n} from \"../core/remote-workspace-protocol/session.ts\";\nimport { DAEMON_WEBSOCKET_PATH, type DaemonConfiguration } from \"./config.ts\";\nimport {\n\tcreateDaemonAuthorization,\n\trejectDaemonUpgrade,\n\tvalidateDaemonNetworkPolicy,\n\tvalidateDaemonUpgrade,\n} from \"./security.ts\";\nimport { createDaemonWorkspaceRuntime } from \"./workspace-runtime.ts\";\n\nexport interface DaemonServerAddress {\n\treadonly host: string;\n\treadonly port: number;\n\treadonly secure: boolean;\n\treadonly url: string;\n\treadonly workspaceRoot: string;\n\treadonly workspaceId: string;\n}\n\nexport type DaemonServerState = \"created\" | \"listening\" | \"closing\" | \"closed\";\n\nexport interface DaemonServer {\n\tlisten(): Promise<DaemonServerAddress>;\n\taddress(): DaemonServerAddress | undefined;\n\tstate(): DaemonServerState;\n\treload(): Promise<void>;\n\tclose(): Promise<void>;\n\tforceClose(): Promise<void>;\n}\n\ninterface DaemonConnection {\n\treadonly websocket: WebSocket;\n\treadonly protocol: RemoteWorkspaceServerProtocol;\n\tclosed: Promise<void>;\n}\n\nfunction websocketPayload(data: RawData): Uint8Array {\n\tif (Buffer.isBuffer(data)) return Uint8Array.from(data);\n\tif (Array.isArray(data)) return Uint8Array.from(Buffer.concat(data));\n\treturn Uint8Array.from(new Uint8Array(data));\n}\n\nfunction websocketCloseCode(code: RemoteWorkspaceProtocolCloseCode): number {\n\tswitch (code) {\n\t\tcase \"normal\":\n\t\t\treturn 1000;\n\t\tcase \"protocol_error\":\n\t\t\treturn 1002;\n\t\tcase \"invalid_payload\":\n\t\t\treturn 1007;\n\t\tcase \"policy_violation\":\n\t\t\treturn 1008;\n\t\tcase \"message_too_large\":\n\t\t\treturn 1009;\n\t}\n}\n\nfunction waitForWebSocketClose(websocket: WebSocket): Promise<void> {\n\tif (websocket.readyState === WebSocket.CLOSED) return Promise.resolve();\n\treturn new Promise((resolve) => websocket.once(\"close\", () => resolve()));\n}\n\nfunction waitWithin(promise: Promise<unknown>, timeoutMs: number, forceSignal: AbortSignal): Promise<boolean> {\n\tif (forceSignal.aborted) return Promise.resolve(false);\n\treturn new Promise((resolve) => {\n\t\tlet settled = false;\n\t\tconst finish = (value: boolean) => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timer);\n\t\t\tforceSignal.removeEventListener(\"abort\", onForce);\n\t\t\tresolve(value);\n\t\t};\n\t\tconst timer = setTimeout(() => finish(false), timeoutMs);\n\t\tconst onForce = () => finish(false);\n\t\tforceSignal.addEventListener(\"abort\", onForce, { once: true });\n\t\tpromise.then(\n\t\t\t() => finish(true),\n\t\t\t() => finish(false),\n\t\t);\n\t});\n}\nfunction terminateDaemonConnections(connections: Iterable<DaemonConnection>): void {\n\tfor (const connection of connections) connection.websocket.terminate();\n}\n\nfunction beginDaemonConnectionDrain(\n\tconnections: readonly DaemonConnection[],\n\thostDisposal: Promise<void>,\n): Promise<void> {\n\treturn Promise.allSettled([...connections.map((connection) => connection.protocol.beginDrain()), hostDisposal]).then(\n\t\t() => undefined,\n\t);\n}\n\nfunction disconnectDaemonConnections(connections: readonly DaemonConnection[]): Promise<void> {\n\treturn Promise.allSettled(connections.map((connection) => connection.protocol.disconnect())).then(() => undefined);\n}\n\nfunction requestDaemonConnectionClose(connections: readonly DaemonConnection[]): void {\n\tfor (const connection of connections) {\n\t\tif (connection.websocket.readyState === WebSocket.OPEN) {\n\t\t\tconnection.websocket.close(1001, \"Daemon shutting down\");\n\t\t}\n\t}\n}\n\nfunction waitForDaemonConnectionsClosed(connections: readonly DaemonConnection[]): Promise<void> {\n\treturn Promise.allSettled(connections.map((connection) => connection.closed)).then(() => undefined);\n}\n\nfunction destroyDaemonSockets(sockets: ReadonlySet<Socket>): void {\n\tfor (const socket of sockets) socket.destroy();\n}\n\nfunction formatHostForUrl(host: string): string {\n\treturn host.includes(\":\") && !host.startsWith(\"[\") ? `[${host}]` : host;\n}\n\nexport function createDaemonServer(configuration: DaemonConfiguration): DaemonServer {\n\tvalidateDaemonNetworkPolicy(configuration);\n\tconst authorization = createDaemonAuthorization(configuration.token);\n\tconst workspaceId = randomBytes(18).toString(\"base64url\");\n\tconst workspace = Object.freeze({\n\t\tid: workspaceId,\n\t\troot: configuration.workspaceRoot,\n\t\tpathFlavor: process.platform === \"win32\" ? (\"windows\" as const) : (\"posix\" as const),\n\t});\n\tlet runtime = createDaemonWorkspaceRuntime(configuration);\n\tlet runtimeHandler = runtime.createHandler(workspace);\n\tconst handler: RemoteWorkspaceServerHandler = {\n\t\thandleRequest: (request, context) => runtimeHandler.handleRequest(request, context),\n\t\tvalidateToolArguments: (toolName, value) => runtimeHandler.validateToolArguments(toolName, value),\n\t};\n\tconst requestListener = (_request: IncomingMessage, response: ServerResponse) => {\n\t\tresponse.writeHead(404, { \"content-type\": \"text/plain\" });\n\t\tresponse.end(\"Not found\\n\");\n\t};\n\tconst server: HttpServer = configuration.tls\n\t\t? createHttpsServer(\n\t\t\t\t{\n\t\t\t\t\tcert: configuration.tls.cert,\n\t\t\t\t\tkey: configuration.tls.key,\n\t\t\t\t\tpassphrase: configuration.tls.passphrase,\n\t\t\t\t\tminVersion: \"TLSv1.2\",\n\t\t\t\t},\n\t\t\t\trequestListener,\n\t\t\t)\n\t\t: createHttpServer(requestListener);\n\tconst websocketServer = new WebSocketServer({\n\t\tnoServer: true,\n\t\tclientTracking: false,\n\t\tmaxPayload: configuration.protocolLimits.maxMessageBytes,\n\t\tperMessageDeflate: false,\n\t\tallowSynchronousEvents: false,\n\t\tskipUTF8Validation: false,\n\t});\n\tconst sockets = new Set<Socket>();\n\tconst pendingSockets = new Set<Socket>();\n\tconst pendingSocketTimers = new Map<Socket, NodeJS.Timeout>();\n\tconst pendingSocketDeadlines = new Map<Socket, number>();\n\tconst connections = new Set<DaemonConnection>();\n\tlet catalog = runtime.catalog;\n\tlet reloadQueue: Promise<void> = Promise.resolve();\n\tconst forceController = new AbortController();\n\tlet currentAddress: DaemonServerAddress | undefined;\n\tlet listenPromise: Promise<DaemonServerAddress> | undefined;\n\tlet rejectListen: ((error: Error) => void) | undefined;\n\tlet closePromise: Promise<void> | undefined;\n\tlet serverState: DaemonServerState = \"created\";\n\n\tconst stopListener = (): Promise<void> => {\n\t\tif (!server.listening && !listenPromise) return Promise.resolve();\n\t\treturn new Promise((resolve) => {\n\t\t\tlet settled = false;\n\t\t\tconst cleanup = () => {\n\t\t\t\tserver.off(\"listening\", onListening);\n\t\t\t\tserver.off(\"error\", onError);\n\t\t\t\tserver.off(\"close\", onClose);\n\t\t\t};\n\t\t\tconst finish = () => {\n\t\t\t\tif (settled) return;\n\t\t\t\tsettled = true;\n\t\t\t\tcleanup();\n\t\t\t\tresolve();\n\t\t\t};\n\t\t\tconst closeListener = () => server.close(() => finish());\n\t\t\tconst onListening = () => closeListener();\n\t\t\tconst onError = () => finish();\n\t\t\tconst onClose = () => finish();\n\t\t\tserver.once(\"error\", onError);\n\t\t\tserver.once(\"close\", onClose);\n\t\t\tif (server.listening) closeListener();\n\t\t\telse server.once(\"listening\", onListening);\n\t\t});\n\t};\n\n\tserver.on(\"connection\", (socket: Socket) => {\n\t\tif (serverState !== \"listening\" || pendingSockets.size >= configuration.maxPendingConnections) {\n\t\t\tsocket.destroy();\n\t\t\treturn;\n\t\t}\n\t\tsockets.add(socket);\n\t\tpendingSockets.add(socket);\n\t\tconst pendingTimer = setTimeout(() => socket.destroy(), configuration.handshakeTimeoutMs);\n\t\tpendingTimer.unref?.();\n\t\tpendingSocketTimers.set(socket, pendingTimer);\n\t\tpendingSocketDeadlines.set(socket, performance.now() + configuration.handshakeTimeoutMs);\n\t\tsocket.once(\"close\", () => {\n\t\t\tsockets.delete(socket);\n\t\t\tpendingSockets.delete(socket);\n\t\t\tconst timer = pendingSocketTimers.get(socket);\n\t\t\tif (timer) clearTimeout(timer);\n\t\t\tpendingSocketTimers.delete(socket);\n\t\t\tpendingSocketDeadlines.delete(socket);\n\t\t});\n\t});\n\n\tserver.on(\"upgrade\", (request, socket, head) => {\n\t\tconst netSocket = socket as Socket;\n\t\tconst decision = validateDaemonUpgrade(request, configuration, authorization);\n\t\tif (!decision.accepted) {\n\t\t\trejectDaemonUpgrade(netSocket, decision);\n\t\t\treturn;\n\t\t}\n\t\tif (serverState !== \"listening\" || connections.size >= configuration.maxConnections) {\n\t\t\trejectDaemonUpgrade(netSocket, { accepted: false, status: 503, message: \"Service unavailable\" });\n\t\t\treturn;\n\t\t}\n\t\tconst handshakeDeadline = pendingSocketDeadlines.get(netSocket) ?? performance.now();\n\t\tpendingSockets.delete(netSocket);\n\t\tconst pendingTimer = pendingSocketTimers.get(netSocket);\n\t\tif (pendingTimer) clearTimeout(pendingTimer);\n\t\tpendingSocketTimers.delete(netSocket);\n\t\tpendingSocketDeadlines.delete(netSocket);\n\t\twebsocketServer.handleUpgrade(request, socket, head, (websocket) => {\n\t\t\tif (serverState !== \"listening\") {\n\t\t\t\twebsocket.terminate();\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst remainingHandshakeMs = Math.max(0, handshakeDeadline - performance.now());\n\t\t\tconst handshakeTimer = setTimeout(() => {\n\t\t\t\twebsocket.terminate();\n\t\t\t}, remainingHandshakeMs);\n\t\t\thandshakeTimer.unref?.();\n\t\t\tlet protocol: RemoteWorkspaceServerProtocol;\n\t\t\tconst transport = {\n\t\t\t\tsend(message: RemoteWorkspaceServerMessage): Promise<void> {\n\t\t\t\t\tif (websocket.readyState !== WebSocket.OPEN) return Promise.reject(new Error(\"WebSocket is not open\"));\n\t\t\t\t\tconst serialized = JSON.stringify(message);\n\t\t\t\t\tconst bytes = Buffer.byteLength(serialized, \"utf8\");\n\t\t\t\t\tif (websocket.bufferedAmount + bytes > configuration.protocolLimits.maxPendingOutboundBytes) {\n\t\t\t\t\t\treturn Promise.reject(new Error(\"WebSocket outbound buffer exceeds daemon limits\"));\n\t\t\t\t\t}\n\t\t\t\t\treturn new Promise((resolve, reject) => {\n\t\t\t\t\t\twebsocket.send(serialized, { binary: false, compress: false }, (error) => {\n\t\t\t\t\t\t\tif (error) reject(error);\n\t\t\t\t\t\t\telse resolve();\n\t\t\t\t\t\t});\n\t\t\t\t\t});\n\t\t\t\t},\n\t\t\t\tclose(reason: RemoteWorkspaceProtocolCloseReason): Promise<void> {\n\t\t\t\t\tif (websocket.readyState === WebSocket.CLOSED) return Promise.resolve();\n\t\t\t\t\twebsocket.close(websocketCloseCode(reason.code), reason.message);\n\t\t\t\t\treturn waitForWebSocketClose(websocket);\n\t\t\t\t},\n\t\t\t};\n\t\t\tprotocol = new RemoteWorkspaceServerProtocol(transport, handler, {\n\t\t\t\tworkspace,\n\t\t\t\tcatalog,\n\t\t\t\tcapabilities: runtime.capabilities,\n\t\t\t\tlimits: configuration.protocolLimits,\n\t\t\t\tbackendLabel: \"grip-workspace-daemon\",\n\t\t\t});\n\t\t\tconst connection: DaemonConnection = {\n\t\t\t\twebsocket,\n\t\t\t\tprotocol,\n\t\t\t\tclosed: Promise.resolve(),\n\t\t\t};\n\t\t\tconnection.closed = waitForWebSocketClose(websocket).then(async () => {\n\t\t\t\tclearTimeout(handshakeTimer);\n\t\t\t\tconnections.delete(connection);\n\t\t\t\tawait protocol.disconnect().catch(() => undefined);\n\t\t\t});\n\t\t\tconnections.add(connection);\n\t\t\twebsocket.on(\"message\", (data, isBinary) => {\n\t\t\t\tif (isBinary) {\n\t\t\t\t\twebsocket.close(1003, \"Text protocol required\");\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tvoid protocol\n\t\t\t\t\t.receive(websocketPayload(data))\n\t\t\t\t\t.then(() => {\n\t\t\t\t\t\tif (protocol.handshakeComplete) clearTimeout(handshakeTimer);\n\t\t\t\t\t})\n\t\t\t\t\t.catch(() => undefined);\n\t\t\t});\n\t\t\twebsocket.on(\"error\", () => undefined);\n\t\t});\n\t});\n\n\tconst api: DaemonServer = {\n\t\tlisten(): Promise<DaemonServerAddress> {\n\t\t\tif (serverState === \"closing\" || serverState === \"closed\")\n\t\t\t\treturn Promise.reject(new Error(\"Daemon server is closing\"));\n\t\t\tif (currentAddress) return Promise.resolve(currentAddress);\n\t\t\tif (listenPromise) return listenPromise;\n\t\t\tlistenPromise = new Promise((resolve, reject) => {\n\t\t\t\trejectListen = reject;\n\t\t\t\tconst onError = (error: Error) => {\n\t\t\t\t\tserver.off(\"listening\", onListening);\n\t\t\t\t\tlistenPromise = undefined;\n\t\t\t\t\trejectListen = undefined;\n\t\t\t\t\treject(error);\n\t\t\t\t};\n\t\t\t\tconst onListening = () => {\n\t\t\t\t\tserver.off(\"error\", onError);\n\t\t\t\t\tif (serverState !== \"created\") {\n\t\t\t\t\t\trejectListen = undefined;\n\t\t\t\t\t\treject(new Error(\"Daemon server closed before listening completed\"));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\tconst address = server.address();\n\t\t\t\t\tif (!address || typeof address === \"string\") {\n\t\t\t\t\t\trejectListen = undefined;\n\t\t\t\t\t\treject(new Error(\"Daemon listener did not return a TCP address\"));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\tserverState = \"listening\";\n\t\t\t\t\tconst port = (address as AddressInfo).port;\n\t\t\t\t\tcurrentAddress = Object.freeze({\n\t\t\t\t\t\thost: configuration.host,\n\t\t\t\t\t\tport,\n\t\t\t\t\t\tsecure: configuration.tls !== undefined,\n\t\t\t\t\t\turl: `${configuration.tls ? \"wss\" : \"ws\"}://${formatHostForUrl(configuration.host)}:${port}${DAEMON_WEBSOCKET_PATH}`,\n\t\t\t\t\t\tworkspaceRoot: configuration.workspaceRoot,\n\t\t\t\t\t\tworkspaceId,\n\t\t\t\t\t});\n\t\t\t\t\trejectListen = undefined;\n\t\t\t\t\tresolve(currentAddress);\n\t\t\t\t};\n\t\t\t\tserver.once(\"error\", onError);\n\t\t\t\tserver.once(\"listening\", onListening);\n\t\t\t\tserver.listen(configuration.port, configuration.host);\n\t\t\t});\n\t\t\treturn listenPromise;\n\t\t},\n\t\taddress(): DaemonServerAddress | undefined {\n\t\t\treturn currentAddress ? { ...currentAddress } : undefined;\n\t\t},\n\t\tstate(): DaemonServerState {\n\t\t\treturn serverState;\n\t\t},\n\t\treload(): Promise<void> {\n\t\t\tif (serverState !== \"listening\") return Promise.reject(new Error(\"Daemon server is not listening\"));\n\t\t\treloadQueue = reloadQueue.then(async () => {\n\t\t\t\tif (serverState !== \"listening\") throw new Error(\"Daemon server is not listening\");\n\t\t\t\tconst candidate = createDaemonWorkspaceRuntime(configuration);\n\t\t\t\tconst candidateCatalog = { ...candidate.catalog, generation: catalog.generation + 1 };\n\t\t\t\tconst previous = runtime;\n\t\t\t\tconst previousCatalog = catalog;\n\t\t\t\truntime = candidate;\n\t\t\t\truntimeHandler = candidate.createHandler(workspace);\n\t\t\t\tcatalog = candidateCatalog;\n\t\t\t\ttry {\n\t\t\t\t\tawait Promise.all([...connections].map((connection) => connection.protocol.publishCatalog(catalog)));\n\t\t\t\t} catch (error) {\n\t\t\t\t\truntime = previous;\n\t\t\t\t\truntimeHandler = previous.createHandler(workspace);\n\t\t\t\t\tcatalog = previousCatalog;\n\t\t\t\t\tawait Promise.allSettled([...connections].map((connection) => connection.protocol.disconnect()));\n\t\t\t\t\tawait candidate.dispose();\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tawait previous.retire();\n\t\t\t});\n\t\t\treturn reloadQueue;\n\t\t},\n\t\tclose(): Promise<void> {\n\t\t\tif (closePromise) return closePromise;\n\t\t\tserverState = \"closing\";\n\t\t\trejectListen?.(new Error(\"Daemon server closed before listening completed\"));\n\t\t\trejectListen = undefined;\n\t\t\tconst deadline = performance.now() + configuration.shutdownTimeoutMs;\n\t\t\tconst remainingMs = () => Math.max(0, deadline - performance.now());\n\t\t\tclosePromise = (async () => {\n\t\t\t\tconst listenerClose = stopListener();\n\t\t\t\tconst snapshot = [...connections];\n\t\t\t\tawait waitWithin(\n\t\t\t\t\treloadQueue.catch(() => undefined),\n\t\t\t\t\tremainingMs(),\n\t\t\t\t\tforceController.signal,\n\t\t\t\t);\n\t\t\t\tconst hostDisposal = runtime.dispose();\n\t\t\t\tconst drained = await waitWithin(\n\t\t\t\t\tbeginDaemonConnectionDrain(snapshot, hostDisposal),\n\t\t\t\t\tremainingMs(),\n\t\t\t\t\tforceController.signal,\n\t\t\t\t);\n\t\t\t\tif (!drained) terminateDaemonConnections(snapshot);\n\t\t\t\tawait waitWithin(disconnectDaemonConnections(snapshot), remainingMs(), forceController.signal);\n\t\t\t\trequestDaemonConnectionClose(snapshot);\n\t\t\t\tconst socketsClosed = await waitWithin(\n\t\t\t\t\twaitForDaemonConnectionsClosed(snapshot),\n\t\t\t\t\tremainingMs(),\n\t\t\t\t\tforceController.signal,\n\t\t\t\t);\n\t\t\t\tif (!socketsClosed) terminateDaemonConnections(snapshot);\n\t\t\t\tdestroyDaemonSockets(sockets);\n\t\t\t\tawait listenerClose;\n\t\t\t\tconnections.clear();\n\t\t\t})().finally(() => {\n\t\t\t\tterminateDaemonConnections(connections);\n\t\t\t\tdestroyDaemonSockets(sockets);\n\t\t\t\tfor (const timer of pendingSocketTimers.values()) clearTimeout(timer);\n\t\t\t\tpendingSocketTimers.clear();\n\t\t\t\tpendingSocketDeadlines.clear();\n\t\t\t\tpendingSockets.clear();\n\t\t\t\tconnections.clear();\n\t\t\t\tcurrentAddress = undefined;\n\t\t\t\tserverState = \"closed\";\n\t\t\t});\n\t\t\treturn closePromise;\n\t\t},\n\t\tforceClose(): Promise<void> {\n\t\t\tif (serverState === \"closed\") return closePromise ?? Promise.resolve();\n\t\t\tserverState = \"closing\";\n\t\t\tforceController.abort();\n\t\t\tcurrentAddress = undefined;\n\t\t\tterminateDaemonConnections(connections);\n\t\t\tdestroyDaemonSockets(sockets);\n\t\t\treturn api.close();\n\t\t},\n\t};\n\treturn api;\n}\n"]}

package/dist/daemon/workspace-runtime.d.ts

@@ -0,0 +1,46 @@
+import { type LspRuntimeState } from "../core/lsp/integration.ts";
+import { type RemoteWorkspaceCapability, type RemoteWorkspaceCatalog, type RemoteWorkspaceIdentity } from "../core/remote-workspace-protocol/contract.ts";
+import { type RemoteWorkspaceServerHandler } from "../core/remote-workspace-protocol/session.ts";
+import { type ToolAccessMode, type ToolBackendInfo, type ToolExecOptions, type ToolExecResult, type ToolFileStat, type ToolGlobOptions, type ToolGrepOptions, type ToolGrepResult, type ToolMkdirOptions, type ToolOperations } from "../core/tools/operations.ts";
+import { WorkspaceToolHost } from "../core/tools/workspace-tool-host.ts";
+import type { DaemonConfiguration } from "./config.ts";
+export declare class ConfinedDaemonToolOperations implements ToolOperations {
+    readonly cwd: string;
+    private readonly local;
+    private readonly allowedRoots;
+    private readonly allowProcessExec;
+    private readonly environment;
+    private readonly maxBufferedOutputBytes;
+    constructor(configuration: DaemonConfiguration);
+    createChildEnvironment(extra?: Record<string, string>): Record<string, string>;
+    private isWithinAllowedRoot;
+    private lexicalPath;
+    private existingPath;
+    private existingWritablePath;
+    private ensureConfinedWritableParent;
+    private writablePath;
+    private atomicWriteFile;
+    exec(command: string, options: ToolExecOptions): Promise<ToolExecResult>;
+    access(path: string, mode?: ToolAccessMode): Promise<void>;
+    readFile(path: string): Promise<Buffer>;
+    writeFile(path: string, content: string | Buffer): Promise<void>;
+    mkdir(path: string, options?: ToolMkdirOptions): Promise<void>;
+    stat(path: string): Promise<ToolFileStat>;
+    readdir(path: string): Promise<string[]>;
+    glob(pattern: string, cwd: string, options: ToolGlobOptions): Promise<string[]>;
+    grep(options: ToolGrepOptions): Promise<ToolGrepResult>;
+    detectImageMimeType(path: string): Promise<string | null | undefined>;
+    getBackendInfo(): ToolBackendInfo;
+}
+export interface DaemonWorkspaceRuntime {
+    readonly operations: ConfinedDaemonToolOperations;
+    readonly host: WorkspaceToolHost;
+    readonly lspRuntime?: LspRuntimeState;
+    readonly catalog: RemoteWorkspaceCatalog;
+    readonly capabilities: readonly RemoteWorkspaceCapability[];
+    createHandler(workspace: RemoteWorkspaceIdentity): RemoteWorkspaceServerHandler;
+    retire(): Promise<void>;
+    dispose(): Promise<void>;
+}
+export declare function createDaemonWorkspaceRuntime(configuration: DaemonConfiguration): DaemonWorkspaceRuntime;
+//# sourceMappingURL=workspace-runtime.d.ts.map

package/dist/daemon/workspace-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-runtime.d.ts","sourceRoot":"","sources":["../../src/daemon/workspace-runtime.ts"],"names":[],"mappings":"AAKA,OAAO,EAAmD,KAAK,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGnH,OAAO,EAEN,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAG5B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAEN,KAAK,4BAA4B,EAGjC,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EAGN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EAEpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EAEnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAA0B,MAAM,sCAAsC,CAAC;AACjG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAsKvD,qBAAa,4BAA6B,YAAW,cAAc;IAClE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;IACjD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAEhD,YAAY,aAAa,EAAE,mBAAmB,EAiB7C;IAED,sBAAsB,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUjF;IACD,OAAO,CAAC,mBAAmB;IAK3B,OAAO,CAAC,WAAW;YAQL,YAAY;YAMZ,oBAAoB;YAqBpB,4BAA4B;YAqB5B,YAAY;YAQZ,eAAe;IA4BvB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAS7E;IAEK,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/D;IAEK,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5C;IAEK,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErE;IAEK,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;IAEK,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAE9C;IAEK,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE7C;IAEK,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsBpF;IAEK,IAAI,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB5D;IAEK,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAE1E;IAED,cAAc,IAAI,eAAe,CAEhC;CACD;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC5D,aAAa,CAAC,SAAS,EAAE,uBAAuB,GAAG,4BAA4B,CAAC;IAChF,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AA6OD,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,mBAAmB,GAAG,sBAAsB,CA4FvG","sourcesContent":["import { spawn } from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport { mkdir as fsMkdir, lstat, open, readFile, realpath, rename, rm } from \"node:fs/promises\";\nimport { basename, isAbsolute, relative, resolve, sep } from \"node:path\";\nimport type { AgentToolResult } from \"@greppleai/grip-agent-core\";\nimport { createLspRuntimeState, createLspToolDefinitions, type LspRuntimeState } from \"../core/lsp/integration.ts\";\nimport type { LspServerStatus } from \"../core/lsp/manager.ts\";\nimport { createManagedStdioConnectionFactory, resolveLspConnectionFactory } from \"../core/lsp/transport.ts\";\nimport {\n\thashRemoteWorkspaceJson,\n\ttype RemoteWorkspaceCapability,\n\ttype RemoteWorkspaceCatalog,\n\ttype RemoteWorkspaceIdentity,\n\ttype RemoteWorkspaceMethod,\n\ttype RemoteWorkspaceOperationKind,\n} from \"../core/remote-workspace-protocol/contract.ts\";\nimport {\n\tRemoteWorkspaceRequestError,\n\ttype RemoteWorkspaceServerHandler,\n\ttype RemoteWorkspaceServerRequestContext,\n\ttype RemoteWorkspaceTypedRequest,\n} from \"../core/remote-workspace-protocol/session.ts\";\nimport { withFileMutationQueue } from \"../core/tools/file-mutation-queue.ts\";\nimport {\n\tGRIP_SESSION_ENVIRONMENT_NAMES,\n\tLocalToolOperations,\n\ttype ToolAccessMode,\n\ttype ToolBackendInfo,\n\ttype ToolExecOptions,\n\ttype ToolExecResult,\n\ttype ToolFileStat,\n\ttype ToolGlobOptions,\n\ttype ToolGrepMatch,\n\ttype ToolGrepOptions,\n\ttype ToolGrepResult,\n\ttype ToolMkdirOptions,\n\ttype ToolOperations,\n\ttype WorkspaceToolExecutionOptions,\n} from \"../core/tools/operations.ts\";\nimport { WorkspaceToolHost, type WorkspaceToolName } from \"../core/tools/workspace-tool-host.ts\";\nimport type { DaemonConfiguration } from \"./config.ts\";\nimport { loadDaemonLspConfiguration } from \"./lsp-config.ts\";\nimport { redactDaemonText } from \"./security.ts\";\n\nconst PRIMITIVE_OPERATIONS: RemoteWorkspaceMethod[] = [\n\t\"workspace.access\",\n\t\"workspace.read\",\n\t\"workspace.write\",\n\t\"workspace.mkdir\",\n\t\"workspace.stat\",\n\t\"workspace.readdir\",\n\t\"workspace.glob\",\n\t\"workspace.grep\",\n\t\"workspace.detect_image_mime\",\n\t\"workspace.exec\",\n];\n\nconst SECRET_ENVIRONMENT_SUFFIX = /_(?:API_KEY|TOKEN|SECRET|PASSWORD|PRIVATE_KEY|CREDENTIALS)$/iu;\nconst BASELINE_ENVIRONMENT =\n\tprocess.platform === \"win32\"\n\t\t? [\"PATH\", \"PATHEXT\", \"SYSTEMROOT\", \"COMSPEC\", \"TEMP\", \"TMP\", \"USER\", \"USERNAME\"]\n\t\t: [\"PATH\", \"HOME\", \"USER\", \"LOGNAME\", \"SHELL\", \"LANG\", \"TERM\", \"COLORTERM\", \"NO_COLOR\", \"TMPDIR\"];\n\nfunction isSecretEnvironmentName(name: string): boolean {\n\tconst upper = name.toUpperCase();\n\treturn (\n\t\tupper === \"GRIP_DAEMON_TOKEN\" ||\n\t\tupper === \"PI_DAEMON_TOKEN\" ||\n\t\tupper === \"GRIP_REMOTE_TOKEN\" ||\n\t\tupper.startsWith(\"GRIP_DAEMON_TLS_\") ||\n\t\tupper.startsWith(\"PI_DAEMON_TLS_\") ||\n\t\tSECRET_ENVIRONMENT_SUFFIX.test(upper)\n\t);\n}\nprocess.platform === \"win32\"\n\t? [\"PATH\", \"PATHEXT\", \"SYSTEMROOT\", \"TEMP\", \"TMP\"]\n\t: [\"PATH\", \"HOME\", \"LANG\", \"LC_ALL\", \"TERM\", \"TMPDIR\"];\n\nfunction isMissingPath(error: unknown): boolean {\n\treturn error instanceof Error && \"code\" in error && error.code === \"ENOENT\";\n}\n\nfunction sanitizeLspStatus(\n\tstatus: LspServerStatus,\n\tconfiguration: DaemonConfiguration,\n): Omit<LspServerStatus, \"capabilities\"> {\n\tconst { capabilities: _capabilities, ...safe } = status;\n\tconst secrets = [configuration.token, configuration.tls?.passphrase];\n\tconst redact = (value: string | undefined) => (value ? redactDaemonText(value, secrets) : undefined);\n\treturn {\n\t\t...safe,\n\t\tserverId: redact(safe.serverId)!,\n\t\tlanguageIds: safe.languageIds.map((value) => redact(value)!),\n\t\ttransport: redact(safe.transport)!,\n\t\t...(safe.instanceKey ? { instanceKey: redact(safe.instanceKey) } : {}),\n\t\t...(safe.workspaceRoot ? { workspaceRoot: redact(safe.workspaceRoot) } : {}),\n\t\t...(safe.rootUri ? { rootUri: redact(safe.rootUri) } : {}),\n\t\t...(safe.endpoint ? { endpoint: redact(safe.endpoint) } : {}),\n\t\t...(safe.lastError ? { lastError: redact(safe.lastError) } : {}),\n\t\t...(safe.lastRequestError ? { lastRequestError: redact(safe.lastRequestError) } : {}),\n\t\t...(safe.stderr ? { stderr: redact(safe.stderr) } : {}),\n\t\t...(safe.synchronizationError ? { synchronizationError: redact(safe.synchronizationError) } : {}),\n\t};\n}\n\nfunction portableToolResult(result: AgentToolResult<unknown>): AgentToolResult<unknown> {\n\tconst clone = JSON.parse(JSON.stringify(result)) as AgentToolResult<unknown>;\n\tconst details = clone.details;\n\tif (!details || typeof details !== \"object\" || !(\"fullOutputPath\" in details)) return clone;\n\tconst fullOutputPath = (details as { fullOutputPath?: unknown }).fullOutputPath;\n\tif (typeof fullOutputPath !== \"string\") return clone;\n\tdelete (details as { fullOutputPath?: unknown }).fullOutputPath;\n\tfor (const content of clone.content) {\n\t\tif (content.type === \"text\") {\n\t\t\tcontent.text = content.text.replaceAll(fullOutputPath, \"[remote full output is not transferable]\");\n\t\t}\n\t}\n\treturn clone;\n}\n\nfunction operationKind(name: string): RemoteWorkspaceOperationKind {\n\tif (name.startsWith(\"lsp_\")) return \"service\";\n\tswitch (name) {\n\t\tcase \"read\":\n\t\tcase \"grep\":\n\t\tcase \"find\":\n\t\tcase \"ls\":\n\t\t\treturn \"read\";\n\t\tcase \"edit\":\n\t\tcase \"write\":\n\t\t\treturn \"mutation\";\n\t\tcase \"bash\":\n\t\t\treturn \"process\";\n\t}\n\tthrow new Error(`Unknown daemon tool: ${name}`);\n}\n\nfunction runCommand(\n\tcommand: string,\n\targs: string[],\n\tenvironment: NodeJS.ProcessEnv,\n\tmaxBufferedBytes: number,\n): Promise<Buffer> {\n\treturn new Promise((resolvePromise, reject) => {\n\t\tconst child = spawn(command, args, { stdio: [\"ignore\", \"pipe\", \"pipe\"], windowsHide: true, env: environment });\n\t\tconst stdout: Buffer[] = [];\n\t\tconst stderr: Buffer[] = [];\n\t\tlet bufferedBytes = 0;\n\t\tlet settled = false;\n\t\tconst append = (target: Buffer[], chunk: Buffer) => {\n\t\t\tif (settled) return;\n\t\t\tbufferedBytes += chunk.byteLength;\n\t\t\tif (bufferedBytes > maxBufferedBytes) {\n\t\t\t\tsettled = true;\n\t\t\t\tchild.kill();\n\t\t\t\treject(new Error(`${command} output exceeded the daemon buffered-output limit`));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\ttarget.push(Buffer.from(chunk));\n\t\t};\n\t\tchild.stdout.on(\"data\", (chunk: Buffer) => append(stdout, chunk));\n\t\tchild.stderr.on(\"data\", (chunk: Buffer) => append(stderr, chunk));\n\t\tchild.once(\"error\", (error) => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\treject(error);\n\t\t});\n\t\tchild.once(\"close\", (code) => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tif (code === 0 || (command === \"rg\" && code === 1)) {\n\t\t\t\tresolvePromise(Buffer.concat(stdout));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\treject(new Error(Buffer.concat(stderr).toString(\"utf8\").trim() || `${command} exited with code ${code}`));\n\t\t});\n\t});\n}\n\nfunction isUnknownRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null;\n}\n\nfunction nestedText(record: Record<string, unknown> | undefined, key: string): string | undefined {\n\tconst nested = record?.[key];\n\treturn isUnknownRecord(nested) && typeof nested.text === \"string\" ? nested.text : undefined;\n}\n\nfunction parseDaemonGrepMatch(line: string): ToolGrepMatch | undefined {\n\tif (!line) return undefined;\n\tlet event: unknown;\n\ttry {\n\t\tevent = JSON.parse(line) as unknown;\n\t} catch {\n\t\treturn undefined;\n\t}\n\tconst eventRecord = isUnknownRecord(event) ? event : undefined;\n\tif (eventRecord?.type !== \"match\") return undefined;\n\tconst data = isUnknownRecord(eventRecord.data) ? eventRecord.data : undefined;\n\tconst filePath = nestedText(data, \"path\");\n\tconst lineNumber = data?.line_number;\n\tif (!filePath || typeof lineNumber !== \"number\") return undefined;\n\tconst lineText = nestedText(data, \"lines\");\n\treturn { filePath, lineNumber, ...(lineText === undefined ? {} : { lineText }) };\n}\n\nexport class ConfinedDaemonToolOperations implements ToolOperations {\n\treadonly cwd: string;\n\tprivate readonly local: LocalToolOperations;\n\tprivate readonly allowedRoots: readonly string[];\n\tprivate readonly allowProcessExec: boolean;\n\tprivate readonly environment: NodeJS.ProcessEnv;\n\tprivate readonly maxBufferedOutputBytes: number;\n\n\tconstructor(configuration: DaemonConfiguration) {\n\t\tthis.cwd = configuration.workspaceRoot;\n\t\tthis.local = new LocalToolOperations(this.cwd);\n\t\tthis.allowedRoots = Object.freeze([\n\t\t\tthis.cwd,\n\t\t\t...(configuration.temporaryRoot ? [configuration.temporaryRoot] : []),\n\t\t]);\n\t\tthis.allowProcessExec = configuration.allowProcessExec;\n\t\tthis.maxBufferedOutputBytes = configuration.maxBufferedOutputBytes;\n\t\tconst localeNames = Object.keys(process.env).filter((name) => /^LC_/iu.test(name));\n\t\tconst names = new Set([...BASELINE_ENVIRONMENT, ...localeNames, ...configuration.forwardedEnvironment]);\n\t\tthis.environment = {};\n\t\tfor (const name of names) {\n\t\t\tif (isSecretEnvironmentName(name)) continue;\n\t\t\tconst value = process.env[name];\n\t\t\tif (value !== undefined) this.environment[name] = value;\n\t\t}\n\t}\n\n\tcreateChildEnvironment(extra: Record<string, string> = {}): Record<string, string> {\n\t\tconst environment: Record<string, string> = {};\n\t\tfor (const [name, value] of Object.entries(this.environment)) {\n\t\t\tif (value !== undefined) environment[name] = value;\n\t\t}\n\t\tObject.assign(environment, extra);\n\t\tfor (const name of Object.keys(environment)) {\n\t\t\tif (isSecretEnvironmentName(name)) delete environment[name];\n\t\t}\n\t\treturn environment;\n\t}\n\tprivate isWithinAllowedRoot(candidate: string, root: string): boolean {\n\t\tconst pathRelative = relative(root, candidate);\n\t\treturn pathRelative !== \"..\" && !pathRelative.startsWith(`..${sep}`) && !isAbsolute(pathRelative);\n\t}\n\n\tprivate lexicalPath(path: string): string {\n\t\tconst candidate = resolve(this.cwd, path);\n\t\tif (!this.allowedRoots.some((root) => this.isWithinAllowedRoot(candidate, root))) {\n\t\t\tthrow new Error(`Path escapes the daemon workspace and allowed temporary root: ${path}`);\n\t\t}\n\t\treturn candidate;\n\t}\n\n\tprivate async existingPath(path: string): Promise<string> {\n\t\tconst candidate = this.lexicalPath(path);\n\t\tconst canonical = await realpath(candidate);\n\t\treturn this.lexicalPath(canonical);\n\t}\n\n\tprivate async existingWritablePath(candidate: string, path: string): Promise<string | undefined> {\n\t\ttry {\n\t\t\tconst stat = await lstat(candidate);\n\t\t\tif (stat.isSymbolicLink()) {\n\t\t\t\ttry {\n\t\t\t\t\tthis.lexicalPath(await realpath(candidate));\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (isMissingPath(error)) throw new Error(`Writable path uses a broken symbolic link: ${path}`);\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tthrow new Error(`Writable path uses a symbolic link: ${path}`);\n\t\t\t}\n\t\t\tconst canonical = await realpath(candidate);\n\t\t\tthis.lexicalPath(canonical);\n\t\t\treturn this.lexicalPath(canonical);\n\t\t} catch (error) {\n\t\t\tif (isMissingPath(error)) return undefined;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tprivate async ensureConfinedWritableParent(candidate: string, path: string): Promise<void> {\n\t\tlet parent = resolve(candidate, \"..\");\n\t\twhile (true) {\n\t\t\ttry {\n\t\t\t\tconst parentStat = await lstat(parent);\n\t\t\t\tif (parentStat.isSymbolicLink()) {\n\t\t\t\t\tthis.lexicalPath(await realpath(parent));\n\t\t\t\t\tthrow new Error(`Writable parent uses a symbolic link: ${path}`);\n\t\t\t\t}\n\t\t\t\tconst canonicalParent = await realpath(parent);\n\t\t\t\tthis.lexicalPath(canonicalParent);\n\t\t\t\treturn;\n\t\t\t} catch (error) {\n\t\t\t\tif (!isMissingPath(error)) throw error;\n\t\t\t\tconst next = resolve(parent, \"..\");\n\t\t\t\tif (next === parent) throw new Error(`No confined parent exists for path: ${path}`);\n\t\t\t\tparent = next;\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async writablePath(path: string): Promise<string> {\n\t\tconst candidate = this.lexicalPath(path);\n\t\tconst existing = await this.existingWritablePath(candidate, path);\n\t\tif (existing) return existing;\n\t\tawait this.ensureConfinedWritableParent(candidate, path);\n\t\treturn candidate;\n\t}\n\n\tprivate async atomicWriteFile(path: string, content: string | Buffer): Promise<void> {\n\t\tconst target = await this.writablePath(path);\n\t\tconst parent = resolve(target, \"..\");\n\t\tconst temporary = resolve(parent, `.grip-remote-write-${process.pid}-${randomUUID()}-${basename(target)}.tmp`);\n\t\tthis.lexicalPath(temporary);\n\t\tlet wroteTemporary = false;\n\t\ttry {\n\t\t\tconst handle = await open(temporary, \"wx\", 0o600);\n\t\t\ttry {\n\t\t\t\tawait handle.writeFile(content, typeof content === \"string\" ? \"utf8\" : undefined);\n\t\t\t} finally {\n\t\t\t\tawait handle.close();\n\t\t\t}\n\t\t\twroteTemporary = true;\n\t\t\tthis.lexicalPath(await realpath(temporary));\n\t\t\ttry {\n\t\t\t\tif ((await lstat(target)).isSymbolicLink()) throw new Error(`Writable path uses a symbolic link: ${path}`);\n\t\t\t} catch (error) {\n\t\t\t\tif (!isMissingPath(error)) throw error;\n\t\t\t}\n\t\t\tawait rename(temporary, target);\n\t\t\twroteTemporary = false;\n\t\t\tthis.lexicalPath(await realpath(target));\n\t\t} finally {\n\t\t\tif (wroteTemporary) await rm(temporary, { force: true });\n\t\t}\n\t}\n\n\tasync exec(command: string, options: ToolExecOptions): Promise<ToolExecResult> {\n\t\tif (!this.allowProcessExec) throw new Error(\"Process execution is disabled by daemon policy\");\n\t\tconst cwd = await this.existingPath(options.cwd ?? this.cwd);\n\t\tconst environment = { ...this.environment };\n\t\tfor (const name of GRIP_SESSION_ENVIRONMENT_NAMES) {\n\t\t\tconst value = options.env?.[name];\n\t\t\tif (value !== undefined) environment[name] = value;\n\t\t}\n\t\treturn this.local.exec(command, { ...options, cwd, env: environment });\n\t}\n\n\tasync access(path: string, mode?: ToolAccessMode): Promise<void> {\n\t\tawait this.local.access(await this.existingPath(path), mode);\n\t}\n\n\tasync readFile(path: string): Promise<Buffer> {\n\t\treturn this.local.readFile(await this.existingPath(path));\n\t}\n\n\tasync writeFile(path: string, content: string | Buffer): Promise<void> {\n\t\tawait this.atomicWriteFile(path, content);\n\t}\n\n\tasync mkdir(path: string, options?: ToolMkdirOptions): Promise<void> {\n\t\tawait fsMkdir(await this.writablePath(path), options);\n\t}\n\n\tasync stat(path: string): Promise<ToolFileStat> {\n\t\treturn this.local.stat(await this.existingPath(path));\n\t}\n\n\tasync readdir(path: string): Promise<string[]> {\n\t\treturn this.local.readdir(await this.existingPath(path));\n\t}\n\n\tasync glob(pattern: string, cwd: string, options: ToolGlobOptions): Promise<string[]> {\n\t\tconst searchRoot = await this.existingPath(cwd);\n\t\tconst args = [\"--glob\", \"--color=never\", \"--hidden\", \"--no-require-git\", \"--max-results\", String(options.limit)];\n\t\tfor (const ignored of options.ignore) args.push(\"--exclude\", ignored);\n\t\tlet effectivePattern = pattern;\n\t\tif (pattern.includes(\"/\")) {\n\t\t\targs.push(\"--full-path\");\n\t\t\tif (!pattern.startsWith(\"/\") && !pattern.startsWith(\"**/\") && pattern !== \"**\")\n\t\t\t\teffectivePattern = `**/${pattern}`;\n\t\t}\n\t\targs.push(\"--\", effectivePattern, searchRoot);\n\t\tconst output = await runCommand(\"fd\", args, this.environment, this.maxBufferedOutputBytes);\n\t\tconst results: string[] = [];\n\t\tfor (const entry of output.toString(\"utf8\").split(\"\\n\")) {\n\t\t\tif (!entry) continue;\n\t\t\ttry {\n\t\t\t\tresults.push(await this.existingPath(entry));\n\t\t\t} catch {\n\t\t\t\t// Symlinks escaping the workspace are deliberately omitted.\n\t\t\t}\n\t\t}\n\t\treturn results;\n\t}\n\n\tasync grep(options: ToolGrepOptions): Promise<ToolGrepResult> {\n\t\tconst searchPath = await this.existingPath(options.path);\n\t\tconst isDirectory = (await this.local.stat(searchPath)).isDirectory();\n\t\tconst args = [\"--json\", \"--line-number\", \"--color=never\", \"--hidden\"];\n\t\tif (options.ignoreCase) args.push(\"--ignore-case\");\n\t\tif (options.literal) args.push(\"--fixed-strings\");\n\t\tif (options.glob) args.push(\"--glob\", options.glob);\n\t\targs.push(\"--\", options.pattern, searchPath);\n\t\tconst output = await runCommand(\"rg\", args, this.environment, this.maxBufferedOutputBytes);\n\t\tconst matches: ToolGrepMatch[] = [];\n\t\tfor (const line of output.toString(\"utf8\").split(\"\\n\")) {\n\t\t\tif (matches.length >= options.limit) continue;\n\t\t\tconst match = parseDaemonGrepMatch(line);\n\t\t\tif (!match) continue;\n\t\t\ttry {\n\t\t\t\tawait this.existingPath(match.filePath);\n\t\t\t} catch {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tmatches.push(match);\n\t\t}\n\t\treturn { isDirectory, matches };\n\t}\n\n\tasync detectImageMimeType(path: string): Promise<string | null | undefined> {\n\t\treturn this.local.detectImageMimeType(await this.existingPath(path));\n\t}\n\n\tgetBackendInfo(): ToolBackendInfo {\n\t\treturn { type: \"local\", cwd: this.cwd };\n\t}\n}\n\nexport interface DaemonWorkspaceRuntime {\n\treadonly operations: ConfinedDaemonToolOperations;\n\treadonly host: WorkspaceToolHost;\n\treadonly lspRuntime?: LspRuntimeState;\n\treadonly catalog: RemoteWorkspaceCatalog;\n\treadonly capabilities: readonly RemoteWorkspaceCapability[];\n\tcreateHandler(workspace: RemoteWorkspaceIdentity): RemoteWorkspaceServerHandler;\n\tretire(): Promise<void>;\n\tdispose(): Promise<void>;\n}\n\ntype DaemonRequestInterruptionCode = \"cancelled\" | \"deadline_exceeded\";\ntype DaemonInterruptedExecutionState = \"not_started\" | \"indeterminate\";\n\nfunction requestError(code: DaemonRequestInterruptionCode, message: string, state: DaemonInterruptedExecutionState) {\n\treturn new RemoteWorkspaceRequestError({ code, message, executionState: state, retryable: false });\n}\ninterface DaemonRequestRuntime {\n\tconfiguration: DaemonConfiguration;\n\toperations: ConfinedDaemonToolOperations;\n\thost: WorkspaceToolHost;\n\tlspRuntime: LspRuntimeState | undefined;\n\tworkspace: RemoteWorkspaceIdentity;\n}\n\nfunction withDaemonWorkspace<T extends Record<string, unknown>>(result: T, workspace: RemoteWorkspaceIdentity) {\n\treturn { ...result, workspace };\n}\n\nasync function synchronizeDaemonToolFile(\n\ttoolName: string,\n\tinvocationArguments: unknown,\n\truntime: DaemonRequestRuntime,\n): Promise<void> {\n\tif (!runtime.lspRuntime) return;\n\tconst args = invocationArguments as { path?: unknown };\n\tif (typeof args.path !== \"string\") return;\n\ttry {\n\t\tif (toolName === \"read\") {\n\t\t\tawait runtime.lspRuntime.fileSync.handleFileRead(args.path, runtime.operations);\n\t\t} else if (toolName === \"write\" || toolName === \"edit\") {\n\t\t\tawait runtime.lspRuntime.fileSync.handleFileWrite(args.path, runtime.operations);\n\t\t}\n\t} catch {\n\t\t// Synchronization remains best-effort, matching local AgentSession behavior.\n\t}\n}\n\nasync function invokeDaemonTool(\n\trequest: RemoteWorkspaceTypedRequest,\n\tparams: Record<string, unknown>,\n\tcontext: RemoteWorkspaceServerRequestContext,\n\truntime: DaemonRequestRuntime,\n): Promise<AgentToolResult<unknown>> {\n\tconst toolName = params.toolName as string;\n\tconst kind = operationKind(toolName);\n\tif (kind !== \"read\") context.markSideEffectStarted();\n\tlet updateQueue = Promise.resolve();\n\ttry {\n\t\tconst result = await runtime.host.executePrepared(toolName, {\n\t\t\ttoolCallId: request.id,\n\t\t\targuments: params.arguments,\n\t\t\tsignal: context.signal,\n\t\t\texecutionOptions: params.executionOptions as WorkspaceToolExecutionOptions,\n\t\t\tonUpdate: (update) => {\n\t\t\t\tupdateQueue = updateQueue.then(() => context.sendUpdate(portableToolResult(update)));\n\t\t\t},\n\t\t});\n\t\tawait updateQueue;\n\t\tawait synchronizeDaemonToolFile(toolName, params.arguments, runtime);\n\t\tif (kind !== \"read\") context.markCommitted();\n\t\treturn portableToolResult(result);\n\t} catch (error) {\n\t\tawait updateQueue.catch(() => undefined);\n\t\tif (context.signal.aborted) {\n\t\t\tthrow requestError(\n\t\t\t\t\"cancelled\",\n\t\t\t\t\"Remote workspace tool invocation was cancelled\",\n\t\t\t\tkind === \"read\" ? \"not_started\" : \"indeterminate\",\n\t\t\t);\n\t\t}\n\t\tthrow new RemoteWorkspaceRequestError({\n\t\t\tcode: \"internal_error\",\n\t\t\tmessage: error instanceof Error ? error.message.slice(0, 4096) : \"Workspace tool failed\",\n\t\t\texecutionState: kind === \"read\" ? \"not_started\" : \"indeterminate\",\n\t\t\tretryable: false,\n\t\t});\n\t}\n}\n\nasync function executeDaemonWorkspaceProcess(\n\tparams: Record<string, unknown>,\n\tcontext: RemoteWorkspaceServerRequestContext,\n\truntime: DaemonRequestRuntime,\n): Promise<ToolExecResult> {\n\tcontext.markSideEffectStarted();\n\tlet updateQueue = Promise.resolve();\n\tlet pendingOutputBytes = 0;\n\tlet outputLimitExceeded = false;\n\tconst outputController = new AbortController();\n\tconst signal = AbortSignal.any([context.signal, outputController.signal]);\n\tlet result: ToolExecResult;\n\ttry {\n\t\tresult = await runtime.operations.exec(params.command as string, {\n\t\t\tcwd: params.cwd as string,\n\t\t\tsignal,\n\t\t\tonData: (data) => {\n\t\t\t\tif (outputLimitExceeded) return;\n\t\t\t\tconst chunk = Buffer.from(data);\n\t\t\t\tpendingOutputBytes += chunk.byteLength;\n\t\t\t\tif (pendingOutputBytes > runtime.configuration.maxBufferedOutputBytes) {\n\t\t\t\t\toutputLimitExceeded = true;\n\t\t\t\t\toutputController.abort();\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tupdateQueue = updateQueue\n\t\t\t\t\t.then(() => context.sendUpdate({ dataBase64: chunk.toString(\"base64\") }))\n\t\t\t\t\t.finally(() => {\n\t\t\t\t\t\tpendingOutputBytes -= chunk.byteLength;\n\t\t\t\t\t});\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\tif (outputLimitExceeded) throw new Error(\"Process output exceeded the daemon buffered-output limit\");\n\t\tthrow error;\n\t}\n\tawait updateQueue;\n\tcontext.markCommitted();\n\treturn result;\n}\n\nasync function readDaemonResource(\n\tparams: Record<string, unknown>,\n\truntime: DaemonRequestRuntime,\n): Promise<Record<string, unknown>> {\n\tconst path = params.path as string;\n\tconst resourcePath =\n\t\tpath === \"SANDBOX.md\"\n\t\t\t? runtime.configuration.sandboxInstructionsPath\n\t\t\t: path === \"AGENTS.md\"\n\t\t\t\t? runtime.configuration.userAgentsPath\n\t\t\t\t: undefined;\n\tif (!resourcePath) {\n\t\tthrow new RemoteWorkspaceRequestError({\n\t\t\tcode: \"not_available\",\n\t\t\tmessage: \"Requested daemon resource is not available\",\n\t\t\texecutionState: \"not_started\",\n\t\t\tretryable: false,\n\t\t});\n\t}\n\treturn withDaemonWorkspace({ contentBase64: (await readFile(resourcePath)).toString(\"base64\") }, runtime.workspace);\n}\n\nfunction getDaemonLspStatus(runtime: DaemonRequestRuntime): Record<string, unknown> {\n\tif (!runtime.lspRuntime) {\n\t\tthrow new RemoteWorkspaceRequestError({\n\t\t\tcode: \"not_available\",\n\t\t\tmessage: \"Daemon LSP is not configured\",\n\t\t\texecutionState: \"not_started\",\n\t\t\tretryable: false,\n\t\t});\n\t}\n\treturn {\n\t\tenabled: true,\n\t\tservers: runtime.lspRuntime.manager.getStatus().map((status) => sanitizeLspStatus(status, runtime.configuration)),\n\t};\n}\n\nasync function dispatchDaemonWorkspaceRequest(\n\trequest: RemoteWorkspaceTypedRequest,\n\tcontext: RemoteWorkspaceServerRequestContext,\n\truntime: DaemonRequestRuntime,\n): Promise<unknown> {\n\tconst params = request.params as Record<string, unknown>;\n\tswitch (request.method) {\n\t\tcase \"tool.invoke\":\n\t\t\treturn invokeDaemonTool(request, params, context, runtime);\n\t\tcase \"workspace.access\":\n\t\t\tawait runtime.operations.access(params.path as string, params.mode as ToolAccessMode | undefined);\n\t\t\treturn {};\n\t\tcase \"workspace.read\":\n\t\t\treturn withDaemonWorkspace(\n\t\t\t\t{ contentBase64: (await runtime.operations.readFile(params.path as string)).toString(\"base64\") },\n\t\t\t\truntime.workspace,\n\t\t\t);\n\t\tcase \"workspace.write\":\n\t\t\tcontext.markSideEffectStarted();\n\t\t\tawait withFileMutationQueue(resolve(runtime.configuration.workspaceRoot, params.path as string), () =>\n\t\t\t\truntime.operations.writeFile(params.path as string, Buffer.from(params.contentBase64 as string, \"base64\")),\n\t\t\t);\n\t\t\tcontext.markCommitted();\n\t\t\treturn {};\n\t\tcase \"workspace.mkdir\":\n\t\t\tcontext.markSideEffectStarted();\n\t\t\tawait withFileMutationQueue(resolve(runtime.configuration.workspaceRoot, params.path as string), () =>\n\t\t\t\truntime.operations.mkdir(params.path as string, { recursive: params.recursive === true }),\n\t\t\t);\n\t\t\tcontext.markCommitted();\n\t\t\treturn {};\n\t\tcase \"workspace.stat\": {\n\t\t\tconst value = await runtime.operations.stat(params.path as string);\n\t\t\treturn withDaemonWorkspace(\n\t\t\t\t{ kind: value.isDirectory() ? \"directory\" : value.isFile() ? \"file\" : \"other\" },\n\t\t\t\truntime.workspace,\n\t\t\t);\n\t\t}\n\t\tcase \"workspace.readdir\":\n\t\t\treturn withDaemonWorkspace(\n\t\t\t\t{ entries: await runtime.operations.readdir(params.path as string) },\n\t\t\t\truntime.workspace,\n\t\t\t);\n\t\tcase \"workspace.glob\":\n\t\t\treturn withDaemonWorkspace(\n\t\t\t\t{\n\t\t\t\t\tmatches: await runtime.operations.glob(params.pattern as string, params.cwd as string, {\n\t\t\t\t\t\tignore: params.ignore as string[],\n\t\t\t\t\t\tlimit: params.limit as number,\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t\truntime.workspace,\n\t\t\t);\n\t\tcase \"workspace.grep\": {\n\t\t\tconst result = await runtime.operations.grep(params as unknown as ToolGrepOptions);\n\t\t\treturn withDaemonWorkspace(result as unknown as Record<string, unknown>, runtime.workspace);\n\t\t}\n\t\tcase \"workspace.detect_image_mime\":\n\t\t\treturn withDaemonWorkspace(\n\t\t\t\t{ mimeType: (await runtime.operations.detectImageMimeType(params.path as string)) ?? null },\n\t\t\t\truntime.workspace,\n\t\t\t);\n\t\tcase \"workspace.exec\":\n\t\t\treturn executeDaemonWorkspaceProcess(params, context, runtime);\n\t\tcase \"resource.read\":\n\t\t\treturn readDaemonResource(params, runtime);\n\t\tcase \"lsp.status\":\n\t\t\treturn getDaemonLspStatus(runtime);\n\t\tdefault:\n\t\t\tthrow new RemoteWorkspaceRequestError({\n\t\t\t\tcode: \"method_not_supported\",\n\t\t\t\tmessage: `Workspace operation is not implemented: ${request.method}`,\n\t\t\t\texecutionState: \"not_started\",\n\t\t\t\tretryable: false,\n\t\t\t});\n\t}\n}\n\nexport function createDaemonWorkspaceRuntime(configuration: DaemonConfiguration): DaemonWorkspaceRuntime {\n\tconst operations = new ConfinedDaemonToolOperations(configuration);\n\tconst toolNames: WorkspaceToolName[] = [\"read\", \"edit\", \"write\", \"grep\", \"find\", \"ls\"];\n\tif (configuration.allowProcessExec) toolNames.splice(1, 0, \"bash\");\n\tconst lspConfiguration = loadDaemonLspConfiguration(configuration);\n\tconst lspRuntime = lspConfiguration.enabled\n\t\t? createLspRuntimeState(configuration.workspaceRoot, {\n\t\t\t\tconfiguration: lspConfiguration,\n\t\t\t\tgetToolBackendInfo: () => operations.getBackendInfo(),\n\t\t\t\tgetToolOperations: () => operations,\n\t\t\t\tresolveConnectionFactory: (transport) =>\n\t\t\t\t\ttransport.type === \"spawn\"\n\t\t\t\t\t\t? createManagedStdioConnectionFactory({\n\t\t\t\t\t\t\t\t...transport,\n\t\t\t\t\t\t\t\tenv: operations.createChildEnvironment(transport.env),\n\t\t\t\t\t\t\t\tinheritEnvironment: false,\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t: resolveLspConnectionFactory(transport),\n\t\t\t})\n\t\t: undefined;\n\tconst host = new WorkspaceToolHost({\n\t\tcwd: configuration.workspaceRoot,\n\t\toperations,\n\t\ttoolNames,\n\t\tadditionalDefinitions: lspRuntime\n\t\t\t? createLspToolDefinitions(\n\t\t\t\t\t() => lspRuntime,\n\t\t\t\t\t() => operations,\n\t\t\t\t)\n\t\t\t: undefined,\n\t\tdisposeTimeoutMs: Math.min(configuration.shutdownTimeoutMs, 60_000),\n\t});\n\tconst catalog: RemoteWorkspaceCatalog = {\n\t\tgeneration: 1,\n\t\ttools: host.getCatalog().map((entry) => ({\n\t\t\tname: entry.name,\n\t\t\texecutionMode: operationKind(entry.name),\n\t\t\tparameterSchema: structuredClone(entry.parameters) as Record<string, unknown>,\n\t\t\tschemaHash: hashRemoteWorkspaceJson(entry.parameters),\n\t\t\tfeatureFlags: [],\n\t\t})),\n\t\toperations: [\n\t\t\t...PRIMITIVE_OPERATIONS.filter((method) => method !== \"workspace.exec\" || configuration.allowProcessExec),\n\t\t\t...(configuration.sandboxInstructionsPath || configuration.userAgentsPath ? ([\"resource.read\"] as const) : []),\n\t\t\t...(lspRuntime ? ([\"lsp.status\"] as const) : []),\n\t\t],\n\t};\n\tconst capabilities: RemoteWorkspaceCapability[] = [\n\t\t\"catalog_refresh\",\n\t\t\"primitive_operations\",\n\t\t\"tool_updates\",\n\t\t...(lspRuntime ? ([\"lsp_status\"] as const) : []),\n\t];\n\tlet activeRequests = 0;\n\n\treturn {\n\t\toperations,\n\t\thost,\n\t\tlspRuntime,\n\t\tcatalog,\n\t\tcapabilities,\n\t\tcreateHandler(workspace) {\n\t\t\tconst requestRuntime: DaemonRequestRuntime = { configuration, operations, host, lspRuntime, workspace };\n\t\t\treturn {\n\t\t\t\tvalidateToolArguments: (toolName, value) => host.validatePreparedArguments(toolName, value),\n\t\t\t\tasync handleRequest(request, context) {\n\t\t\t\t\tif (activeRequests >= configuration.maxGlobalRequests) {\n\t\t\t\t\t\tthrow new RemoteWorkspaceRequestError({\n\t\t\t\t\t\t\tcode: \"limit_exceeded\",\n\t\t\t\t\t\t\tmessage: \"Daemon global active request limit reached\",\n\t\t\t\t\t\t\texecutionState: \"not_started\",\n\t\t\t\t\t\t\tretryable: true,\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t\tactiveRequests++;\n\t\t\t\t\ttry {\n\t\t\t\t\t\treturn await dispatchDaemonWorkspaceRequest(request, context, requestRuntime);\n\t\t\t\t\t} finally {\n\t\t\t\t\t\tactiveRequests--;\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t};\n\t\t},\n\t\tretire: async () => {\n\t\t\tawait host.waitForIdle(configuration.shutdownTimeoutMs);\n\t\t\tawait lspRuntime?.manager.shutdownAll();\n\t\t\tawait host.dispose();\n\t\t},\n\t\tdispose: async () => {\n\t\t\tawait Promise.all([lspRuntime?.manager.shutdownAll(), host.dispose()]);\n\t\t},\n\t};\n}\n"]}