@inhuman.tools/harness 0.0.0-stage → 0.2.0

package/dist/server/daemon/kernel/fs-reflection/reflectKernel.js

@@ -0,0 +1,203 @@
+import { join } from "node:path";
+import { fail } from "@inhuman.tools/harness-diagnostics";
+import { CommandSpec, DEFAULT_APPROVAL_ASK_THROTTLE_MS, DEFAULT_AUTO_MODE_JUDGE, parsePermissionMode, DEFAULT_COMPACT_STRATEGY, DEFAULT_COMPACT_TRIGGERS, DEFAULT_COMPACT_KEEP_TURNS, DEFAULT_CONTEXT_GLOW_REMAINING, DEFAULT_LENGTH_CONTINUATIONS, DEFAULT_SPECULATIVE_POLICY_PROCESSING_TOOLS, DEFAULT_STATUSLINE, DEFAULT_STATUSLINE_REFRESH, hydrateKernelRoot, InstalledPlugin, parseCompactTrigger, parseLoopLimit, parseGrantRows, parseShellTailBytes, parseSuperKey, } from "@inhuman.tools/harness-model";
+import { parseTextOnlyContinue } from "@inhuman.tools/harness-model/shared";
+import { ConnectionSpec, DriverSpec } from "@inhuman.tools/plexus-expectations";
+import { parseRetentionLayer } from "@inhuman.tools/turn/context";
+import fs from "fs-extra";
+import { applyRegistryToDrivers, openDriverRegistry } from "../../../../connections/index.js";
+import { readPluginInventory } from "../../../../extensions/index.js";
+import { projectNousGatewayConnection, sourceNousConnectionId, NOUS_GATEWAY_CONNECTION_ID, NOUS_GATEWAY_DRIVER_NAME, } from "../../../../providers/nous/index.js";
+import { PRODUCT_PROVIDERS } from "../../../composition.js";
+import { defaultCommands, defaultCompactSource } from "../../../defaults/index.js";
+import { projectKeylessConnection } from "../../../drivers/web-search/pick.js";
+import { KEYLESS_CONNECTION_ID, KEYLESS_DRIVER_NAME } from "../../../drivers/web-search/types.js";
+import { parseConfigJson, parseKvBag } from "../../../schemas/well-known.js";
+/** 0 (or a bad value) puts the whole eat in the prefix; clamp to the default floor. */
+function clampKeepTurns(value) {
+    return Number.isInteger(value) && value >= 1 ? value : DEFAULT_COMPACT_KEEP_TURNS;
+}
+/** `grants.json`: stored grants of project, bot and global scope. A file that does not parse grants nothing. */
+function readGrantsJson(path) {
+    try {
+        const raw = fs.readJsonSync(join(path, "grants.json"));
+        const rows = parseGrantRows(JSON.stringify(Array.isArray(raw) ? raw : (raw?.rows ?? [])));
+        return rows.length === 0 ? "" : JSON.stringify(rows);
+    }
+    catch {
+        return "";
+    }
+}
+export function reflectKernel(path, into, registry = openDriverRegistry(PRODUCT_PROVIDERS)) {
+    hydrateKernelRoot(into);
+    const disabled = new Set();
+    let file;
+    try {
+        const raw = fs.readJsonSync(join(path, "config.json"));
+        file = parseConfigJson(raw);
+    }
+    catch (error) {
+        file = undefined;
+        // A config.json that exists but does not parse must not leave the previous grants live:
+        // fail closed (no standing auto grants) and say so. A missing file is just "no grants".
+        if (fs.pathExistsSync(join(path, "config.json")))
+            fail("config.json", error);
+    }
+    // The user layer of the authorization table. No file, or no block, is the dist defaults.
+    into.authorizationJson = file?.authorization == null ? "" : JSON.stringify(file.authorization);
+    into.grantsJson = readGrantsJson(path);
+    if (file !== undefined) {
+        for (const [name, policy] of Object.entries(file.plugins)) {
+            if (policy.enabled === false)
+                disabled.add(name);
+        }
+        Object.assign(into.compactTriggers, {
+            hard: file.compactTriggers?.hard ?? DEFAULT_COMPACT_TRIGGERS.hard,
+            soft: file.compactTriggers?.soft ?? DEFAULT_COMPACT_TRIGGERS.soft,
+        });
+        into.compactKeepTurns = clampKeepTurns(file.compactKeepTurns);
+        into.contextRetentionJson =
+            file.contextRetention === undefined ? "" : JSON.stringify(parseRetentionLayer(file.contextRetention));
+        Object.assign(into, {
+            contextGlowRemaining: file.contextGlowRemaining != null && parseCompactTrigger(file.contextGlowRemaining) != null
+                ? file.contextGlowRemaining
+                : DEFAULT_CONTEXT_GLOW_REMAINING,
+            compactStrategy: file.compact?.trim() || DEFAULT_COMPACT_STRATEGY,
+            autoModeClassifier: file.autoModeClassifier?.trim() || DEFAULT_AUTO_MODE_JUDGE,
+            speculativePolicyProcessingTools: file.speculativePolicyProcessingTools ?? DEFAULT_SPECULATIVE_POLICY_PROCESSING_TOOLS,
+            approvalAskThrottleMs: file.approvalAskThrottleMs ?? DEFAULT_APPROVAL_ASK_THROTTLE_MS,
+            superKey: parseSuperKey(file.superKey),
+            hideFloorTools: file.hideFloorTools === true,
+            defaultPermissionMode: parsePermissionMode(file.defaultPermissionMode) ?? "manual",
+            shellTailBytes: parseShellTailBytes(file.shellTailBytes),
+            maxRounds: parseLoopLimit(file.maxRounds),
+            maxDepth: parseLoopLimit(file.maxDepth),
+            maxBotRounds: parseLoopLimit(file.maxBotRounds),
+            maxBotDepth: parseLoopLimit(file.maxBotDepth),
+            lengthContinuations: parseLoopLimit(file.lengthContinuations, DEFAULT_LENGTH_CONTINUATIONS),
+            retryMaxMs: parseLoopLimit(file.retryMaxMs),
+            retryMaxAttempts: parseLoopLimit(file.retryMaxAttempts),
+            statusline: file.statusline === undefined ? DEFAULT_STATUSLINE : file.statusline.trim(),
+            statuslineRefresh: file.statuslineRefresh?.trim() || DEFAULT_STATUSLINE_REFRESH,
+        });
+        into.reActLoopIntentDetectedTrigger.applyFlags(parseTextOnlyContinue(file.reActLoopIntentDetectedTrigger));
+    }
+    const inventory = readPluginInventory(path, disabled);
+    const keepDrivers = new Set();
+    applyRegistryToDrivers(registry, into.drivers);
+    for (const driver of registry.list())
+        keepDrivers.add(driver.name);
+    for (const rec of inventory.drivers) {
+        keepDrivers.add(rec.name);
+        into.drivers[rec.name] ??= new DriverSpec();
+        Object.assign(into.drivers[rec.name], {
+            name: rec.name,
+            description: rec.description,
+            importPath: rec.importPath,
+            abilityClaim: [...rec.abilityClaim],
+            multiplicity: rec.multiplicity,
+        });
+    }
+    for (const name of Object.keys(into.drivers)) {
+        if (!keepDrivers.has(name))
+            delete into.drivers[name];
+    }
+    const keepConnections = new Set();
+    if (into.drivers[KEYLESS_DRIVER_NAME] !== undefined)
+        keepConnections.add(KEYLESS_CONNECTION_ID);
+    if (into.drivers[NOUS_GATEWAY_DRIVER_NAME] !== undefined)
+        keepConnections.add(NOUS_GATEWAY_CONNECTION_ID);
+    for (const [id, slice] of Object.entries(file?.connections ?? {})) {
+        const driver = into.drivers[slice.driver];
+        if (driver === undefined)
+            continue;
+        keepConnections.add(id);
+        into.connections[id] ??= new ConnectionSpec({ driver });
+        Object.assign(into.connections[id], {
+            driver,
+            name: slice.name,
+            annotation: slice.annotation,
+            configuration: slice.settings,
+        });
+    }
+    if (into.drivers[NOUS_GATEWAY_DRIVER_NAME] === undefined || sourceNousConnectionId(into) === null) {
+        keepConnections.delete(NOUS_GATEWAY_CONNECTION_ID);
+    }
+    for (const id of Object.keys(into.connections)) {
+        if (!keepConnections.has(id) && !id.startsWith("__prv_"))
+            delete into.connections[id];
+    }
+    const keepPlugins = new Set();
+    for (const rec of inventory.plugins) {
+        keepPlugins.add(rec.pluginName);
+        into.plugins[rec.pluginName] ??= new InstalledPlugin();
+        Object.assign(into.plugins[rec.pluginName], {
+            pluginName: rec.pluginName,
+            sourceNpm: rec.sourceNpm,
+            sourceVersion: rec.sourceVersion,
+            rootPath: rec.rootPath,
+            enabled: rec.enabled,
+            foreground: file?.plugins[rec.pluginName]?.foreground !== false,
+            modules: [...rec.modules],
+        });
+    }
+    for (const name of Object.keys(into.plugins)) {
+        if (!keepPlugins.has(name))
+            delete into.plugins[name];
+    }
+    const keepCommands = new Set();
+    for (const rec of [...defaultCommands(), ...inventory.commands]) {
+        if (rec.verb === "compact")
+            continue;
+        keepCommands.add(rec.verb);
+        into.commands[rec.verb] ??= new CommandSpec();
+        Object.assign(into.commands[rec.verb], {
+            verb: rec.verb,
+            description: rec.description,
+            aliases: [],
+            source: rec.source,
+            body: rec.body,
+        });
+    }
+    const source = join(path, "compact.scm");
+    let body;
+    try {
+        body = fs.readFileSync(source, "utf8");
+    }
+    catch {
+        body = defaultCompactSource();
+    }
+    into.commands.compact ??= new CommandSpec();
+    Object.assign(into.commands.compact, {
+        verb: "compact",
+        description: "Compact conversation context",
+        aliases: [],
+        source,
+        body,
+    });
+    keepCommands.add("compact");
+    for (const verb of Object.keys(into.commands)) {
+        if (!keepCommands.has(verb))
+            delete into.commands[verb];
+    }
+    let bag = {};
+    try {
+        bag = parseKvBag(fs.readJsonSync(join(path, "kv.json")));
+    }
+    catch { }
+    const series = [];
+    for (const key of Object.keys(into.kvs)) {
+        if (!(key in bag))
+            series.push({ form: "kv-clear", key });
+    }
+    for (const [key, value] of Object.entries(bag)) {
+        if (into.kvs[key] !== value)
+            series.push({ form: "kv-set", key, value });
+    }
+    if (series.length > 0)
+        into.applyKvs(series);
+    projectKeylessConnection(into);
+    projectNousGatewayConnection(into);
+    return into;
+}
+//# sourceMappingURL=reflectKernel.js.map

package/dist/server/daemon/kernel/fs-reflection/reflectKernel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reflectKernel.js","sourceRoot":"","sources":["../../../../../src/server/daemon/kernel/fs-reflection/reflectKernel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC1D,OAAO,EACL,WAAW,EACX,gCAAgC,EAChC,uBAAuB,EACvB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,EAC5B,2CAA2C,EAC3C,kBAAkB,EAClB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EAEf,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAmB,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,MAAM,UAAU,CAAC;AAE1B,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAuB,MAAM,eAAe,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,UAAU,EAAmB,MAAM,gCAAgC,CAAC;AAE9F,uFAAuF;AACvF,SAAS,cAAc,CAAC,KAAgC;IACtD,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,0BAA0B,CAAC;AAC5G,CAAC;AAED,gHAAgH;AAChH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAY,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA0B,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAClH,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,IAAgB,EAChB,WAA2B,kBAAkB,CAAC,iBAAiB,CAAC;IAEhE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,IAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAY,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QAChE,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,GAAG,SAAS,CAAC;QACjB,wFAAwF;QACxF,wFAAwF;QACxF,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YAAE,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC;IACD,yFAAyF;IACzF,IAAI,CAAC,iBAAiB,GAAG,IAAI,EAAE,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC/F,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;YAClC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,IAAI,wBAAwB,CAAC,IAAI;YACjE,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,IAAI,wBAAwB,CAAC,IAAI;SAClE,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,CAAC,oBAAoB;YACvB,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACxG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAClB,oBAAoB,EAClB,IAAI,CAAC,oBAAoB,IAAI,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,IAAI;gBACzF,CAAC,CAAC,IAAI,CAAC,oBAAoB;gBAC3B,CAAC,CAAC,8BAA8B;YACpC,eAAe,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,wBAAwB;YACjE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,uBAAuB;YAC9E,gCAAgC,EAC9B,IAAI,CAAC,gCAAgC,IAAI,2CAA2C;YACtF,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,IAAI,gCAAgC;YACrF,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;YACtC,cAAc,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;YAC5C,qBAAqB,EAAE,mBAAmB,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,QAAQ;YAClF,cAAc,EAAE,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC;YACxD,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;YACzC,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;YACvC,YAAY,EAAE,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC;YAC/C,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC;YAC7C,mBAAmB,EAAE,cAAc,CAAC,IAAI,CAAC,mBAAmB,EAAE,4BAA4B,CAAC;YAC3F,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;YAC3C,gBAAgB,EAAE,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACvD,UAAU,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;YACvF,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,0BAA0B;SAChF,CAAC,CAAC;QACH,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEtD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE;QAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnE,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACpC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACpC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,YAAY,EAAE,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;YACnC,YAAY,EAAE,GAAG,CAAC,YAAY;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,SAAS;QAAE,eAAe,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAChG,IAAI,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,KAAK,SAAS;QAAE,eAAe,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC1G,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE;YAClC,MAAM;YACN,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,aAAa,EAAE,KAAK,CAAC,QAAQ;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,KAAK,SAAS,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAClG,eAAe,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACrD,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACpC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE;YAC1C,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,UAAU,KAAK,KAAK;YAC/D,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,eAAe,EAAE,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChE,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QACrC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACrC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACzC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,oBAAoB,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,WAAW,EAAE,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,EAAE;QACX,MAAM;QACN,IAAI;KACL,CAAC,CAAC;IACH,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,GAAG,GAA2B,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE7C,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/B,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAEnC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/server/daemon/kernel/glance-ask-line.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Glance-sized sitting-ask question. Family + optional description.
+ * Not pretty-mcp interpolation — command/path stay off KernelRoot.
+ */
+import { type ApprovableJob } from "@inhuman.tools/harness-model";
+export declare function glanceAskLine(head: ApprovableJob | null): string;
+//# sourceMappingURL=glance-ask-line.d.ts.map

package/dist/server/daemon/kernel/glance-ask-line.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glance-ask-line.d.ts","sourceRoot":"","sources":["../../../../src/server/daemon/kernel/glance-ask-line.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAEL,KAAK,aAAa,EASnB,MAAM,8BAA8B,CAAC;AAEtC,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,GAAG,MAAM,CAqBhE"}

package/dist/server/daemon/kernel/glance-ask-line.js

@@ -0,0 +1,36 @@
+/**
+ * Glance-sized sitting-ask question. Family + optional description.
+ * Not pretty-mcp interpolation — command/path stay off KernelRoot.
+ */
+import { AgentMessageJob, BotCallJob, CallJob, clampChars, flattenOverviewLine, GLANCE_ASK_DESCRIPTION_MAX_CHARS, GLANCE_ASK_LINE_MAX_CHARS, MCPToolJob, ToolCallJob, } from "@inhuman.tools/harness-model";
+export function glanceAskLine(head) {
+    if (head == null)
+        return "";
+    if (!(head instanceof ToolCallJob))
+        return "";
+    const args = head.args;
+    const description = args != null && typeof args.description === "string"
+        ? flattenOverviewLine(args.description, GLANCE_ASK_DESCRIPTION_MAX_CHARS)
+        : "";
+    if (description !== "")
+        return clampChars(`approve ${description}?`, GLANCE_ASK_LINE_MAX_CHARS);
+    if (head instanceof BotCallJob)
+        return "confirm bot?";
+    if (head instanceof CallJob || head instanceof AgentMessageJob)
+        return "confirm agent?";
+    if (head instanceof MCPToolJob) {
+        const tool = head.serverToolName.trim() || head.name.trim();
+        return tool === "" ? "" : clampChars(`confirm ${tool}?`, GLANCE_ASK_LINE_MAX_CHARS);
+    }
+    const name = head.name.trim();
+    if (name === "shell")
+        return "confirm shell command?";
+    if (name === "edit_file")
+        return "confirm edit?";
+    if (name === "write_file")
+        return "confirm write?";
+    if (name === "")
+        return "";
+    return clampChars(`confirm ${name}?`, GLANCE_ASK_LINE_MAX_CHARS);
+}
+//# sourceMappingURL=glance-ask-line.js.map

package/dist/server/daemon/kernel/glance-ask-line.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glance-ask-line.js","sourceRoot":"","sources":["../../../../src/server/daemon/kernel/glance-ask-line.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,eAAe,EAEf,UAAU,EACV,OAAO,EACP,UAAU,EACV,mBAAmB,EACnB,gCAAgC,EAChC,yBAAyB,EACzB,UAAU,EACV,WAAW,GACZ,MAAM,8BAA8B,CAAC;AAEtC,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,YAAY,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,WAAW,GACf,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QAClD,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,gCAAgC,CAAC;QACzE,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,WAAW,KAAK,EAAE;QAAE,OAAO,UAAU,CAAC,WAAW,WAAW,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAChG,IAAI,IAAI,YAAY,UAAU;QAAE,OAAO,cAAc,CAAC;IACtD,IAAI,IAAI,YAAY,OAAO,IAAI,IAAI,YAAY,eAAe;QAAE,OAAO,gBAAgB,CAAC;IACxF,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5D,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,IAAI,GAAG,EAAE,yBAAyB,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,wBAAwB,CAAC;IACtD,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,eAAe,CAAC;IACjD,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,gBAAgB,CAAC;IACnD,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3B,OAAO,UAAU,CAAC,WAAW,IAAI,GAAG,EAAE,yBAAyB,CAAC,CAAC;AACnE,CAAC"}

package/dist/server/daemon/kernel/kernel-package.d.ts

@@ -0,0 +1,7 @@
+/** Packages every kernel starts with, by name. The range comes from the copy this daemon resolves. */
+export declare const KERNEL_SEED_PACKAGES: readonly ["@inhuman.tools/plugin-tasks"];
+/** `^<version>` of the resolved package, or the fixed fallback when it cannot be resolved. */
+export declare function seedRange(name: string, require?: NodeJS.Require): string;
+/** Add missing seed packages and rewrite any `workspace:` spec to a real range. Returns whether anything changed. */
+export declare function healKernelDependencies(deps: Record<string, string>, resolveRange?: (name: string) => string): boolean;
+//# sourceMappingURL=kernel-package.d.ts.map

package/dist/server/daemon/kernel/kernel-package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-package.d.ts","sourceRoot":"","sources":["../../../../src/server/daemon/kernel/kernel-package.ts"],"names":[],"mappings":"AAQA,sGAAsG;AACtG,eAAO,MAAM,oBAAoB,0CAA2C,CAAC;AAE7E,8FAA8F;AAC9F,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,OAAwC,GAAG,MAAM,CAUxG;AAED,qHAAqH;AACrH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,YAAY,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAkC,GACjE,OAAO,CAcT"}

package/dist/server/daemon/kernel/kernel-package.js

@@ -0,0 +1,40 @@
+/**
+ * The kernel folder is itself an npm project: `inhuman install` runs `npm install --save` in it. npm rejects
+ * `workspace:` specs, so the seeded dependency ranges must be real semver ranges.
+ */
+import { createRequire } from "node:module";
+const FALLBACK_RANGE = "^0.1.0";
+/** Packages every kernel starts with, by name. The range comes from the copy this daemon resolves. */
+export const KERNEL_SEED_PACKAGES = ["@inhuman.tools/plugin-tasks"];
+/** `^<version>` of the resolved package, or the fixed fallback when it cannot be resolved. */
+export function seedRange(name, require = createRequire(import.meta.url)) {
+    try {
+        const manifest = require(`${name}/package.json`);
+        if (typeof manifest.version === "string" && /^\d+\.\d+\.\d+/.test(manifest.version)) {
+            return `^${manifest.version}`;
+        }
+    }
+    catch {
+        /* not resolvable: fall back */
+    }
+    return FALLBACK_RANGE;
+}
+/** Add missing seed packages and rewrite any `workspace:` spec to a real range. Returns whether anything changed. */
+export function healKernelDependencies(deps, resolveRange = (name) => seedRange(name)) {
+    let changed = false;
+    for (const name of KERNEL_SEED_PACKAGES) {
+        const recorded = deps[name];
+        if (recorded != null && !recorded.startsWith("workspace:"))
+            continue;
+        deps[name] = resolveRange(name);
+        changed = true;
+    }
+    for (const [name, range] of Object.entries(deps)) {
+        if (!range.startsWith("workspace:"))
+            continue;
+        deps[name] = resolveRange(name);
+        changed = true;
+    }
+    return changed;
+}
+//# sourceMappingURL=kernel-package.js.map

package/dist/server/daemon/kernel/kernel-package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-package.js","sourceRoot":"","sources":["../../../../src/server/daemon/kernel/kernel-package.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEhC,sGAAsG;AACtG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,6BAA6B,CAAU,CAAC;AAE7E,8FAA8F;AAC9F,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,UAA0B,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;IAC9F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,IAAI,eAAe,CAA0B,CAAC;QAC1E,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,sBAAsB,CACpC,IAA4B,EAC5B,eAAyC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC;IAElE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,QAAQ,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,SAAS;QACrE,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,SAAS;QAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/server/daemon/kernel/remote-access.d.ts

@@ -0,0 +1,75 @@
+import type { CredentialsStore } from "../../../connections/credentials.js";
+import { type DevicePollClock } from "../../../providers/auth/index.js";
+export declare const DEFAULT_RELAY_URL = "https://harness.inhuman.tools";
+export declare const WORKOS_CLIENT_ID_ENV = "HARNESS_REMOTE_WORKOS_CLIENT_ID";
+export declare const RELAY_URL_ENV = "HARNESS_REMOTE_URL";
+/** DEV ONLY (local e2e against `wrangler dev`): a ready-made relay bearer, `dev.<secret>.<sub>.<email>`. Unset in every real run. */
+export declare const DEV_TOKEN_ENV = "HARNESS_REMOTE_DEV_TOKEN";
+export declare const WORKOS_DEVICE_CODE_URL = "https://api.workos.com/user_management/authorize/device";
+export declare const WORKOS_TOKEN_URL = "https://api.workos.com/user_management/authenticate";
+/** Reserved ids in the credentials store; connection ids are slugs of a name and never contain `:`. */
+export declare const REMOTE_TOKENS_ID = "remote:tokens";
+export declare const REMOTE_MACHINE_ID = "remote:machine";
+export declare const REMOTE_LOGIN_HINT = "Approve this machine for remote access in the browser, then continue";
+export type RemoteStatus = {
+    readonly loggedIn: boolean;
+    readonly email?: string;
+    readonly machineId: string;
+    readonly machineName: string;
+    readonly relayUrl: string;
+    readonly connected: boolean;
+    /** Why remote access is down: set when the relay or WorkOS refused the stored login. */
+    readonly lastError?: string;
+};
+export type RemoteAccessOptions = {
+    readonly credentials: CredentialsStore & {
+        write: NonNullable<CredentialsStore["write"]>;
+    };
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly fetch?: typeof fetch;
+    readonly hostname?: () => string;
+    readonly clock?: DevicePollClock;
+};
+/** Parks the open-url form; resolves when the human continues, rejects when they cancel. */
+export type RemoteLoginUi = (body: string) => Promise<unknown>;
+/** Cheap boot-time check, before any kernel exists. */
+export declare function remoteLoggedIn(root: string, env?: Readonly<Record<string, string | undefined>>): boolean;
+export declare class RemoteAccess {
+    #private;
+    constructor(options: RemoteAccessOptions);
+    get relayUrl(): string;
+    /** Minted once and kept; survives logout. */
+    machine(): {
+        readonly machineId: string;
+        readonly machineName: string;
+    };
+    /** `connected` is the connector's control socket; this class only knows the login. */
+    status(connected?: boolean): RemoteStatus;
+    /**
+     * Device login. `ui` parks the open-url form first; the poll starts after
+     * the human continues. A UI cancel rejects `ui`, and nothing is stored.
+     */
+    login(ui: RemoteLoginUi, options?: {
+        name?: string;
+        signal?: AbortSignal;
+    }): Promise<{
+        email: string;
+        machineId: string;
+    }>;
+    logout(): {
+        readonly wasLoggedIn: boolean;
+    };
+    /** A transient reason shown in `remote/status`; `undefined` clears it. */
+    noteError(message: string | undefined): void;
+    /** The stored login is dead (revoked grant, relay 401 on a fresh token): drop it and say why. */
+    revoke(reason: string): void;
+    /**
+     * A bearer token for the relay, refreshed first when it expires within the
+     * skew. `undefined` when logged out, including when WorkOS answers
+     * `invalid_grant` (the tokens are then dropped). Other refresh failures
+     * reject and keep the tokens. Concurrent callers share one refresh,
+     * which matters because WorkOS rotates refresh tokens.
+     */
+    accessToken(now?: number, force?: boolean): Promise<string | undefined>;
+}
+//# sourceMappingURL=remote-access.d.ts.map

package/dist/server/daemon/kernel/remote-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-access.d.ts","sourceRoot":"","sources":["../../../../src/server/daemon/kernel/remote-access.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAQL,KAAK,eAAe,EAErB,MAAM,kBAAkB,CAAC;AAI1B,eAAO,MAAM,iBAAiB,kCAAkC,CAAC;AACjE,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AACtE,eAAO,MAAM,aAAa,uBAAuB,CAAC;AAClD,qIAAqI;AACrI,eAAO,MAAM,aAAa,6BAA6B,CAAC;AAGxD,eAAO,MAAM,sBAAsB,4DAAmC,CAAC;AACvE,eAAO,MAAM,gBAAgB,wDAA+B,CAAC;AAE7D,uGAAuG;AACvG,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAChD,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAElD,eAAO,MAAM,iBAAiB,yEAAyE,CAAC;AAExG,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG;QAAE,KAAK,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IAC3F,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;CAClC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE/D,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GAAG,OAAO,CAGrH;AAiBD,qBAAa,YAAY;;gBASX,OAAO,EAAE,mBAAmB;IAQxC,IAAI,QAAQ,IAAI,MAAM,CAGrB;IAED,6CAA6C;IAC7C,OAAO,IAAI;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE;IAQvE,sFAAsF;IACtF,MAAM,CAAC,SAAS,UAAQ,GAAG,YAAY;IAevC;;;OAGG;IACG,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO;;;;IAkBpF,MAAM,IAAI;QAAE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;KAAE;IAO3C,0EAA0E;IAC1E,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAI5C,iGAAiG;IACjG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAK5B;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,SAAa,EAAE,KAAK,UAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CA6E1E"}

package/dist/server/daemon/kernel/remote-access.js

@@ -0,0 +1,206 @@
+/**
+ * Daemon side of remote access: WorkOS device login, token storage and
+ * refresh, the machine identity. A kernel service, not a PEW connection:
+ * it provides no ability, has no model catalog and no per-connection config.
+ * Tokens and the machine id live in the kernel's durable credentials under
+ * reserved ids; the connector (phase 3b) calls {@link RemoteAccess.accessToken}.
+ */
+import { randomBytes } from "node:crypto";
+import { hostname } from "node:os";
+import { accessTokenExpiring, OidcGrantError, pollDeviceToken, refreshOidcToken, requestDeviceCode, secretsFromTokens, } from "../../../providers/auth/index.js";
+import { readConnectionSecrets } from "../../secrets.js";
+export const DEFAULT_RELAY_URL = "https://harness.inhuman.tools";
+export const WORKOS_CLIENT_ID_ENV = "HARNESS_REMOTE_WORKOS_CLIENT_ID";
+export const RELAY_URL_ENV = "HARNESS_REMOTE_URL";
+/** DEV ONLY (local e2e against `wrangler dev`): a ready-made relay bearer, `dev.<secret>.<sub>.<email>`. Unset in every real run. */
+export const DEV_TOKEN_ENV = "HARNESS_REMOTE_DEV_TOKEN";
+const WORKOS_API = "https://api.workos.com/user_management";
+export const WORKOS_DEVICE_CODE_URL = `${WORKOS_API}/authorize/device`;
+export const WORKOS_TOKEN_URL = `${WORKOS_API}/authenticate`;
+/** Reserved ids in the credentials store; connection ids are slugs of a name and never contain `:`. */
+export const REMOTE_TOKENS_ID = "remote:tokens";
+export const REMOTE_MACHINE_ID = "remote:machine";
+export const REMOTE_LOGIN_HINT = "Approve this machine for remote access in the browser, then continue";
+/** Cheap boot-time check, before any kernel exists. */
+export function remoteLoggedIn(root, env = process.env) {
+    if (devToken(env) !== undefined)
+        return true;
+    return readConnectionSecrets(root, REMOTE_TOKENS_ID).refreshToken !== undefined;
+}
+function devToken(env) {
+    const token = env[DEV_TOKEN_ENV]?.trim();
+    return token === undefined || token === "" ? undefined : token;
+}
+/** The email in a dev bearer (everything after `dev.<secret>.<sub>.`), or a placeholder. */
+function devEmail(token) {
+    const email = token.split(".").slice(3).join(".");
+    return email === "" ? "dev@local" : email;
+}
+function quote(text) {
+    return `"${text.replaceAll("\\", "\\\\").replaceAll('"', String.raw `\"`)}"`;
+}
+export class RemoteAccess {
+    #credentials;
+    #env;
+    #fetch;
+    #hostname;
+    #clock;
+    #refreshing = null;
+    #lastError;
+    constructor(options) {
+        this.#credentials = options.credentials;
+        this.#env = options.env ?? process.env;
+        this.#fetch = options.fetch;
+        this.#hostname = options.hostname ?? hostname;
+        this.#clock = options.clock;
+    }
+    get relayUrl() {
+        const url = this.#env[RELAY_URL_ENV]?.trim();
+        return (url === undefined || url === "" ? DEFAULT_RELAY_URL : url).replace(/\/+$/, "");
+    }
+    /** Minted once and kept; survives logout. */
+    machine() {
+        const bag = this.#credentials.read(REMOTE_MACHINE_ID);
+        const machineId = bag.machineId ?? randomBytes(16).toString("base64url");
+        const machineName = bag.machineName ?? this.#hostname();
+        if (bag.machineId === undefined)
+            this.#credentials.write(REMOTE_MACHINE_ID, { ...bag, machineId });
+        return { machineId, machineName };
+    }
+    /** `connected` is the connector's control socket; this class only knows the login. */
+    status(connected = false) {
+        const dev = devToken(this.#env);
+        const tokens = this.#credentials.read(REMOTE_TOKENS_ID);
+        const loggedIn = dev !== undefined || tokens.refreshToken !== undefined;
+        const email = dev === undefined ? tokens.email : devEmail(dev);
+        return {
+            loggedIn,
+            ...(loggedIn && email !== undefined ? { email } : {}),
+            ...this.machine(),
+            relayUrl: this.relayUrl,
+            connected,
+            ...(this.#lastError === undefined ? {} : { lastError: this.#lastError }),
+        };
+    }
+    /**
+     * Device login. `ui` parks the open-url form first; the poll starts after
+     * the human continues. A UI cancel rejects `ui`, and nothing is stored.
+     */
+    async login(ui, options = {}) {
+        const clientId = await this.#configuredClientId();
+        const client = this.#deviceClient(clientId);
+        const device = await requestDeviceCode(client);
+        await ui(`(harness/open-url :url ${quote(device.verificationUriComplete)} :description ${quote(REMOTE_LOGIN_HINT)})`);
+        const tokens = await pollDeviceToken(client, device, this.#clock, options.signal);
+        // The refresh token is bound to the client that minted it.
+        this.#credentials.write(REMOTE_TOKENS_ID, { ...secretsFromTokens(tokens), clientId });
+        this.#lastError = undefined;
+        if (options.name !== undefined) {
+            const bag = this.#credentials.read(REMOTE_MACHINE_ID);
+            this.#credentials.write(REMOTE_MACHINE_ID, { ...bag, machineName: options.name });
+        }
+        return { email: tokens.email ?? "", machineId: this.machine().machineId };
+    }
+    logout() {
+        const wasLoggedIn = this.#credentials.read(REMOTE_TOKENS_ID).refreshToken !== undefined;
+        this.#credentials.write(REMOTE_TOKENS_ID, {});
+        this.#lastError = undefined;
+        return { wasLoggedIn };
+    }
+    /** A transient reason shown in `remote/status`; `undefined` clears it. */
+    noteError(message) {
+        this.#lastError = message;
+    }
+    /** The stored login is dead (revoked grant, relay 401 on a fresh token): drop it and say why. */
+    revoke(reason) {
+        this.#credentials.write(REMOTE_TOKENS_ID, {});
+        this.#lastError = reason;
+    }
+    /**
+     * A bearer token for the relay, refreshed first when it expires within the
+     * skew. `undefined` when logged out, including when WorkOS answers
+     * `invalid_grant` (the tokens are then dropped). Other refresh failures
+     * reject and keep the tokens. Concurrent callers share one refresh,
+     * which matters because WorkOS rotates refresh tokens.
+     */
+    accessToken(now = Date.now(), force = false) {
+        const dev = devToken(this.#env);
+        if (dev !== undefined)
+            return Promise.resolve(dev);
+        const tokens = this.#credentials.read(REMOTE_TOKENS_ID);
+        if (tokens.apiKey === undefined || tokens.refreshToken === undefined)
+            return Promise.resolve(undefined);
+        if (!force && !accessTokenExpiring(tokens.expiresAt, now))
+            return Promise.resolve(tokens.apiKey);
+        const { refreshToken, clientId } = tokens;
+        this.#refreshing ??= this.#refresh(refreshToken, clientId).finally(() => {
+            this.#refreshing = null;
+        });
+        return this.#refreshing;
+    }
+    async #refresh(refreshToken, storedClientId) {
+        let refreshed;
+        try {
+            const clientId = storedClientId ?? (await this.#configuredClientId());
+            refreshed = await refreshOidcToken(this.#profile(clientId), refreshToken);
+        }
+        catch (error) {
+            if (!(error instanceof OidcGrantError) || error.code !== "invalid_grant")
+                throw error;
+            this.revoke("The remote-access login expired or was revoked. Run `inhuman login` again.");
+            return undefined;
+        }
+        const previous = this.#credentials.read(REMOTE_TOKENS_ID);
+        // A refresh body may omit the user; keep who we were.
+        this.#credentials.write(REMOTE_TOKENS_ID, { ...previous, ...secretsFromTokens(refreshed) });
+        return refreshed.apiKey;
+    }
+    /** The env override, else the client the relay publishes at `/api/config`. */
+    async #configuredClientId() {
+        const override = this.#env[WORKOS_CLIENT_ID_ENV]?.trim();
+        if (override !== undefined && override !== "")
+            return override;
+        const url = `${this.relayUrl}/api/config`;
+        let published;
+        try {
+            const res = await (this.#fetch ?? fetch)(url, { signal: AbortSignal.timeout(10_000) });
+            if (!res.ok)
+                throw new Error(`HTTP ${res.status}`);
+            published = (await res.json()).workosClientId;
+        }
+        catch (error) {
+            throw new Error(`Could not reach the relay at ${url}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (typeof published !== "string" || published.trim() === "") {
+            throw new Error(`Remote access is not configured: the relay at ${this.relayUrl} publishes no WorkOS client id; set ${WORKOS_CLIENT_ID_ENV} to override`);
+        }
+        return published.trim();
+    }
+    #deviceClient(clientId) {
+        return {
+            driver: "remote",
+            label: "WorkOS",
+            clientId,
+            deviceCodeUrl: WORKOS_DEVICE_CODE_URL,
+            tokenUrl: WORKOS_TOKEN_URL,
+            scope: "",
+            minIntervalSec: 1,
+            ...(this.#fetch === undefined ? {} : { fetch: this.#fetch }),
+        };
+    }
+    #profile(clientId) {
+        return {
+            driver: "remote",
+            clientId,
+            authorizeUrl: "",
+            tokenUrl: WORKOS_TOKEN_URL,
+            userinfoUrl: "",
+            scope: "",
+            extraAuthorize: {},
+            loginHint: REMOTE_LOGIN_HINT,
+            baseUrl: this.relayUrl,
+            ...(this.#fetch === undefined ? {} : { fetch: this.#fetch }),
+        };
+    }
+}
+//# sourceMappingURL=remote-access.js.map

package/dist/server/daemon/kernel/remote-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-access.js","sourceRoot":"","sources":["../../../../src/server/daemon/kernel/remote-access.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAIlB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AACjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAClD,qIAAqI;AACrI,MAAM,CAAC,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAExD,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,UAAU,mBAAmB,CAAC;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,UAAU,eAAe,CAAC;AAE7D,uGAAuG;AACvG,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAElD,MAAM,CAAC,MAAM,iBAAiB,GAAG,sEAAsE,CAAC;AAwBxG,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAoD,OAAO,CAAC,GAAG;IAC1G,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC;AAClF,CAAC;AAED,SAAS,QAAQ,CAAC,GAAiD;IACjE,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC;AAED,4FAA4F;AAC5F,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5C,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC,GAAG,CAAC;AAC9E,CAAC;AAED,MAAM,OAAO,YAAY;IACd,YAAY,CAAqC;IACjD,IAAI,CAA+C;IACnD,MAAM,CAA2B;IACjC,SAAS,CAAe;IACxB,MAAM,CAA8B;IAC7C,WAAW,GAAuC,IAAI,CAAC;IACvD,UAAU,CAAqB;IAE/B,YAAY,OAA4B;QACtC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,IAAI,QAAQ;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,6CAA6C;IAC7C,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACxD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QACnG,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACpC,CAAC;IAED,sFAAsF;IACtF,MAAM,CAAC,SAAS,GAAG,KAAK;QACtB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC;QACxE,MAAM,KAAK,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/D,OAAO;YACL,QAAQ;YACR,GAAG,CAAC,QAAQ,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,IAAI,CAAC,OAAO,EAAE;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS;YACT,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;SACzE,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,EAAiB,EAAE,UAAmD,EAAE;QAClF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,CACN,0BAA0B,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,iBAAiB,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAC5G,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAClF,2DAA2D;QAC3D,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACtD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM;QACJ,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC;QACxF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC;IAED,0EAA0E;IAC1E,SAAS,CAAC,OAA2B;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;IAC5B,CAAC;IAED,iGAAiG;IACjG,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,GAAG,KAAK;QACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxG,IAAI,CAAC,KAAK,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjG,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAC1C,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACtE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB,EAAE,cAAkC;QACrE,IAAI,SAAS,CAAC;QACd,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;YACtE,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;gBAAE,MAAM,KAAK,CAAC;YACtF,IAAI,CAAC,MAAM,CAAC,4EAA4E,CAAC,CAAC;YAC1F,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC1D,sDAAsD;QACtD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5F,OAAO,SAAS,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,mBAAmB;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC;QACzD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAC;QAC/D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,aAAa,CAAC;QAC1C,IAAI,SAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,SAAS,GAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkC,CAAC,cAAc,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,iDAAiD,IAAI,CAAC,QAAQ,uCAAuC,oBAAoB,cAAc,CACxI,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,QAAQ;YACf,QAAQ;YACR,aAAa,EAAE,sBAAsB;YACrC,QAAQ,EAAE,gBAAgB;YAC1B,KAAK,EAAE,EAAE;YACT,cAAc,EAAE,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SAC7D,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,QAAgB;QACvB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,QAAQ;YACR,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,gBAAgB;YAC1B,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,EAAE;YACT,cAAc,EAAE,EAAE;YAClB,SAAS,EAAE,iBAAiB;YAC5B,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SAC7D,CAAC;IACJ,CAAC;CACF"}