@integrity-labs/agt-cli 0.15.22 → 0.15.27

package/dist/manager-supervisor-HKN2GL7L.js

@@ -0,0 +1,314 @@
+// src/lib/manager-supervisor.ts
+import { execFileSync } from "child_process";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync,
+  chmodSync
+} from "fs";
+import { homedir, platform } from "os";
+import { dirname, join } from "path";
+var MACOS_LABEL = "team.augmented.agt-manager";
+var MACOS_PLIST = join(homedir(), "Library", "LaunchAgents", `${MACOS_LABEL}.plist`);
+var LINUX_UNIT_NAME = "agt-manager.service";
+var LINUX_UNIT_PATH = join(homedir(), ".config", "systemd", "user", LINUX_UNIT_NAME);
+async function installSupervisor(opts) {
+  switch (platform()) {
+    case "darwin":
+      return installMacos(opts);
+    case "linux":
+      return installLinux(opts);
+    default:
+      return { ok: false, error: `Unsupported platform: ${platform()}. Supervisor install is macOS / Linux only.` };
+  }
+}
+async function uninstallSupervisor() {
+  switch (platform()) {
+    case "darwin":
+      return uninstallMacos();
+    case "linux":
+      return uninstallLinux();
+    default:
+      return { ok: false, error: `Unsupported platform: ${platform()}. Supervisor uninstall is macOS / Linux only.` };
+  }
+}
+function supervisorStatus() {
+  switch (platform()) {
+    case "darwin":
+      return statusMacos();
+    case "linux":
+      return statusLinux();
+    default:
+      return { kind: "unsupported-platform", platform: platform() };
+  }
+}
+function installMacos(opts) {
+  if (!existsSync(opts.agtBin)) {
+    return { ok: false, error: `agt binary not found at ${opts.agtBin}` };
+  }
+  if (opts.intervalSec < 5) {
+    return { ok: false, error: "intervalSec must be >= 5" };
+  }
+  if (!opts.env.AGT_HOST || !opts.env.AGT_API_KEY) {
+    return { ok: false, error: "AGT_HOST and AGT_API_KEY must be set in the calling shell so the supervisor can pass them to the manager. Run `agt setup <token>` first." };
+  }
+  bestEffort(() => execFileSync("launchctl", ["unload", "-w", MACOS_PLIST], { stdio: "ignore" }));
+  mkdirSync(dirname(MACOS_PLIST), { recursive: true });
+  writeFileSync(MACOS_PLIST, renderMacosPlist(opts), { mode: 384 });
+  chmodSync(MACOS_PLIST, 384);
+  try {
+    execFileSync("launchctl", ["load", "-w", MACOS_PLIST], { stdio: "pipe" });
+  } catch (err) {
+    return { ok: false, error: `launchctl load failed: ${err.message}` };
+  }
+  try {
+    const out = execFileSync("launchctl", ["list", MACOS_LABEL], { encoding: "utf-8" });
+    return {
+      ok: true,
+      details: `Loaded launchd LaunchAgent ${MACOS_LABEL}. Logs: ${join(opts.configDir, "manager.log")}.
+${out.trim().split("\n").slice(0, 10).join("\n")}`
+    };
+  } catch (err) {
+    return { ok: false, error: `Plist written but launchctl list reported nothing for ${MACOS_LABEL}: ${err.message}` };
+  }
+}
+function uninstallMacos() {
+  bestEffort(() => execFileSync("launchctl", ["unload", "-w", MACOS_PLIST], { stdio: "ignore" }));
+  let removed = false;
+  if (existsSync(MACOS_PLIST)) {
+    try {
+      unlinkSync(MACOS_PLIST);
+      removed = true;
+    } catch (err) {
+      return { ok: false, error: `Failed to remove ${MACOS_PLIST}: ${err.message}` };
+    }
+  }
+  return {
+    ok: true,
+    details: removed ? `Removed ${MACOS_LABEL} from launchd and deleted ${MACOS_PLIST}.` : `${MACOS_LABEL} was already uninstalled (no plist at ${MACOS_PLIST}).`
+  };
+}
+function statusMacos() {
+  if (!existsSync(MACOS_PLIST)) return { kind: "not-installed" };
+  try {
+    const out = execFileSync("launchctl", ["list", MACOS_LABEL], { encoding: "utf-8" });
+    const pidMatch = /"PID"\s*=\s*(\d+);/.exec(out);
+    const pid = pidMatch ? Number(pidMatch[1]) : null;
+    return { kind: "installed", pid, details: `Plist: ${MACOS_PLIST}` };
+  } catch {
+    return { kind: "not-installed" };
+  }
+}
+function renderMacosPlist(opts) {
+  const envEntries = Object.entries(opts.env).filter(([k, v]) => k.length > 0 && v != null).map(([k, v]) => `      <key>${escapeXml(k)}</key>
+      <string>${escapeXml(v)}</string>`).join("\n");
+  const args = [
+    "manager",
+    "start",
+    "--interval",
+    String(opts.intervalSec),
+    "--config-dir",
+    opts.configDir
+  ];
+  const argsXml = args.map((a) => `    <string>${escapeXml(a)}</string>`).join("\n");
+  const logPath = join(opts.configDir, "manager.log");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${MACOS_LABEL}</string>
+
+  <key>ProgramArguments</key>
+  <array>
+    <string>${escapeXml(opts.agtBin)}</string>
+${argsXml}
+  </array>
+
+  <key>RunAtLoad</key>
+  <true/>
+
+  <key>KeepAlive</key>
+  <true/>
+
+  <!-- Throttle restarts so a crashloop doesn't peg the CPU. 10 seconds
+       between launches is enough room for transient API blips while
+       still recovering quickly from a real crash. -->
+  <key>ThrottleInterval</key>
+  <integer>10</integer>
+
+  <!-- Where the manager's stdout / stderr land. The manager's logger
+       redirects stderr into manager.log itself, but launchd needs an
+       explicit destination at the OS level for any pre-logger output
+       (e.g., Node startup errors before the watchdog wires up). -->
+  <key>StandardOutPath</key>
+  <string>${escapeXml(logPath)}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(logPath)}</string>
+
+  <key>WorkingDirectory</key>
+  <string>${escapeXml(opts.configDir)}</string>
+
+  <key>EnvironmentVariables</key>
+  <dict>
+${envEntries}
+  </dict>
+</dict>
+</plist>
+`;
+}
+function bestEffort(fn) {
+  try {
+    fn();
+  } catch {
+  }
+}
+function escapeXml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function installLinux(opts) {
+  if (!existsSync(opts.agtBin)) {
+    return { ok: false, error: `agt binary not found at ${opts.agtBin}` };
+  }
+  if (opts.intervalSec < 5) {
+    return { ok: false, error: "intervalSec must be >= 5" };
+  }
+  if (!opts.env.AGT_HOST || !opts.env.AGT_API_KEY) {
+    return { ok: false, error: "AGT_HOST and AGT_API_KEY must be set in the calling shell so the supervisor can pass them to the unit. Run `agt setup <token>` first." };
+  }
+  bestEffort(() => execFileSync("systemctl", ["--user", "stop", LINUX_UNIT_NAME], { stdio: "ignore" }));
+  mkdirSync(dirname(LINUX_UNIT_PATH), { recursive: true, mode: 448 });
+  writeFileSync(LINUX_UNIT_PATH, renderLinuxUnit(opts), { mode: 384 });
+  chmodSync(LINUX_UNIT_PATH, 384);
+  try {
+    execFileSync("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
+  } catch (err) {
+    return { ok: false, error: `systemctl --user daemon-reload failed: ${err.message}` };
+  }
+  try {
+    execFileSync("systemctl", ["--user", "enable", "--now", LINUX_UNIT_NAME], { stdio: "pipe" });
+  } catch (err) {
+    return { ok: false, error: `systemctl --user enable --now failed: ${err.message}. (Hint: 'systemctl --user' requires a per-user dbus session; on a fresh SSH login try 'export XDG_RUNTIME_DIR=/run/user/$(id -u)' first.)` };
+  }
+  let isActive = "";
+  try {
+    isActive = execFileSync("systemctl", ["--user", "is-active", LINUX_UNIT_NAME], { encoding: "utf-8" }).trim();
+  } catch (err) {
+    isActive = (err.stdout?.toString() ?? "").trim() || "unknown";
+  }
+  return {
+    ok: true,
+    details: `Loaded systemd --user unit ${LINUX_UNIT_NAME} (status: ${isActive}). Logs: ${join(opts.configDir, "manager.log")}.
+For reboot survival on a headless host run as root: 'loginctl enable-linger ${process.env["USER"] ?? "<your-user>"}'`
+  };
+}
+function uninstallLinux() {
+  bestEffort(() => execFileSync("systemctl", ["--user", "disable", "--now", LINUX_UNIT_NAME], { stdio: "ignore" }));
+  let removed = false;
+  if (existsSync(LINUX_UNIT_PATH)) {
+    try {
+      unlinkSync(LINUX_UNIT_PATH);
+      removed = true;
+    } catch (err) {
+      return { ok: false, error: `Failed to remove ${LINUX_UNIT_PATH}: ${err.message}` };
+    }
+  }
+  bestEffort(() => execFileSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" }));
+  return {
+    ok: true,
+    details: removed ? `Disabled systemd --user unit ${LINUX_UNIT_NAME} and deleted ${LINUX_UNIT_PATH}.` : `${LINUX_UNIT_NAME} was already uninstalled (no unit file at ${LINUX_UNIT_PATH}).`
+  };
+}
+function statusLinux() {
+  if (!existsSync(LINUX_UNIT_PATH)) return { kind: "not-installed" };
+  let pid = null;
+  let activeState = "unknown";
+  try {
+    const out = execFileSync(
+      "systemctl",
+      ["--user", "show", LINUX_UNIT_NAME, "--property=MainPID,ActiveState"],
+      { encoding: "utf-8" }
+    );
+    const pidMatch = /^MainPID=(\d+)/m.exec(out);
+    if (pidMatch && pidMatch[1] !== "0") pid = Number(pidMatch[1]);
+    const stateMatch = /^ActiveState=(\S+)/m.exec(out);
+    if (stateMatch) activeState = stateMatch[1] ?? "unknown";
+  } catch {
+    return { kind: "not-installed" };
+  }
+  return { kind: "installed", pid, details: `Unit: ${LINUX_UNIT_PATH} (${activeState})` };
+}
+function renderLinuxUnit(opts) {
+  const envLines = Object.entries(opts.env).filter(([k, v]) => k.length > 0 && v != null).map(([k, v]) => `Environment="${k}=${escapeForSystemdEnv(v)}"`).join("\n");
+  const execArgs = [
+    opts.agtBin,
+    "manager",
+    "start",
+    "--interval",
+    String(opts.intervalSec),
+    "--config-dir",
+    opts.configDir
+  ].map(shellQuoteForSystemd).join(" ");
+  const logPath = join(opts.configDir, "manager.log");
+  return `# agt manager supervisor (ENG-4593)
+# Managed by \`agt manager install\` \u2014 edits will be overwritten.
+
+[Unit]
+Description=Augmented host manager daemon
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=${opts.configDir}
+${envLines}
+ExecStart=${execArgs}
+
+# Restart policy \u2014 always come back, with throttling so a crashloop
+# can't peg the CPU. StartLimitBurst/IntervalSec follow systemd's
+# defaults but are stated explicitly so future operators don't have
+# to read the man page to understand the recovery envelope.
+Restart=always
+RestartSec=5
+StartLimitBurst=5
+StartLimitIntervalSec=60
+
+# stdout/stderr \u2192 manager.log. journalctl --user -u agt-manager
+# still captures everything; this just gives operators a single file
+# to tail without learning systemd plumbing.
+StandardOutput=append:${logPath}
+StandardError=append:${logPath}
+
+[Install]
+WantedBy=default.target
+`;
+}
+function escapeForSystemdEnv(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+function shellQuoteForSystemd(arg) {
+  if (/^[A-Za-z0-9_./:=-]+$/.test(arg)) return arg;
+  return `"${arg.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+var _internals = {
+  MACOS_LABEL,
+  MACOS_PLIST,
+  LINUX_UNIT_NAME,
+  LINUX_UNIT_PATH,
+  renderMacosPlist,
+  renderLinuxUnit,
+  escapeXml,
+  escapeForSystemdEnv,
+  shellQuoteForSystemd,
+  readPlist: () => existsSync(MACOS_PLIST) ? readFileSync(MACOS_PLIST, "utf-8") : null,
+  readUnit: () => existsSync(LINUX_UNIT_PATH) ? readFileSync(LINUX_UNIT_PATH, "utf-8") : null
+};
+export {
+  _internals,
+  installSupervisor,
+  supervisorStatus,
+  uninstallSupervisor
+};
+//# sourceMappingURL=manager-supervisor-HKN2GL7L.js.map

package/dist/manager-supervisor-HKN2GL7L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/manager-supervisor.ts"],"sourcesContent":["/**\n * OS-level supervision for the agt manager daemon (ENG-4593).\n *\n * Hands manager lifecycle off to the OS so a missing process is the OS's\n * problem, not ours. Replaces the in-process `agt manager start\n * --supervise` wrapper from ENG-4488.\n *\n *   macOS:  launchd LaunchAgent (KeepAlive=true + ThrottleInterval=10)\n *   Linux:  systemd --user unit (Restart=always + RestartSec=5)  [Phase 2]\n *\n * Public surface:\n *   - installSupervisor(opts)   — write the unit, load/enable it, verify\n *   - uninstallSupervisor()     — unload/disable + remove the unit (idempotent)\n *   - supervisorStatus()        — quick readout of whether the OS knows about us\n *\n * Each platform implementation lives in its own helper. The dispatcher\n * picks one based on `process.platform` and rejects unsupported OSes\n * with a clear error rather than silently no-oping.\n */\n\nimport { execFileSync } from 'node:child_process';\nimport {\n  existsSync,\n  mkdirSync,\n  readFileSync,\n  unlinkSync,\n  writeFileSync,\n  chmodSync,\n} from 'node:fs';\nimport { homedir, platform } from 'node:os';\nimport { dirname, join } from 'node:path';\n\n// macOS LaunchAgent label and on-disk path. Stable so install/uninstall\n// can find each other without a state file.\nconst MACOS_LABEL = 'team.augmented.agt-manager';\nconst MACOS_PLIST = join(homedir(), 'Library', 'LaunchAgents', `${MACOS_LABEL}.plist`);\n\n// Linux systemd --user unit. Lives under the operator's XDG config so it\n// survives reboot only after `loginctl enable-linger` (we surface that as\n// a follow-up step rather than running it ourselves — needs root).\nconst LINUX_UNIT_NAME = 'agt-manager.service';\nconst LINUX_UNIT_PATH = join(homedir(), '.config', 'systemd', 'user', LINUX_UNIT_NAME);\n\nexport interface InstallOpts {\n  /** Absolute path to the agt binary the supervisor should launch. */\n  agtBin: string;\n  /** Poll interval passed to `agt manager start`. Min 5 seconds. */\n  intervalSec: number;\n  /** Manager config directory (where pid/log/state files live). */\n  configDir: string;\n  /**\n   * Environment variables the supervised manager needs at launch time.\n   * AGT_HOST and AGT_API_KEY are required for the manager to call the\n   * API; AGT_TEAM is optional but typical.\n   */\n  env: Record<string, string>;\n}\n\nexport type SupervisorPresence =\n  | { kind: 'installed'; pid: number | null; details: string }\n  | { kind: 'not-installed' }\n  | { kind: 'unsupported-platform'; platform: string };\n\n// ---------------------------------------------------------------------------\n// Public dispatcher\n// ---------------------------------------------------------------------------\n\nexport async function installSupervisor(opts: InstallOpts): Promise<{ ok: true; details: string } | { ok: false; error: string }> {\n  switch (platform()) {\n    case 'darwin':\n      return installMacos(opts);\n    case 'linux':\n      return installLinux(opts);\n    default:\n      return { ok: false, error: `Unsupported platform: ${platform()}. Supervisor install is macOS / Linux only.` };\n  }\n}\n\nexport async function uninstallSupervisor(): Promise<{ ok: true; details: string } | { ok: false; error: string }> {\n  switch (platform()) {\n    case 'darwin':\n      return uninstallMacos();\n    case 'linux':\n      return uninstallLinux();\n    default:\n      return { ok: false, error: `Unsupported platform: ${platform()}. Supervisor uninstall is macOS / Linux only.` };\n  }\n}\n\nexport function supervisorStatus(): SupervisorPresence {\n  switch (platform()) {\n    case 'darwin':\n      return statusMacos();\n    case 'linux':\n      return statusLinux();\n    default:\n      return { kind: 'unsupported-platform', platform: platform() };\n  }\n}\n\n// ---------------------------------------------------------------------------\n// macOS — launchd LaunchAgent\n// ---------------------------------------------------------------------------\n\nfunction installMacos(opts: InstallOpts): { ok: true; details: string } | { ok: false; error: string } {\n  if (!existsSync(opts.agtBin)) {\n    return { ok: false, error: `agt binary not found at ${opts.agtBin}` };\n  }\n  if (opts.intervalSec < 5) {\n    return { ok: false, error: 'intervalSec must be >= 5' };\n  }\n  if (!opts.env.AGT_HOST || !opts.env.AGT_API_KEY) {\n    return { ok: false, error: 'AGT_HOST and AGT_API_KEY must be set in the calling shell so the supervisor can pass them to the manager. Run `agt setup <token>` first.' };\n  }\n\n  // If a previous version is already loaded, unload it before rewriting\n  // the plist — otherwise launchctl bootstrap will fail with EALREADY.\n  bestEffort(() => execFileSync('launchctl', ['unload', '-w', MACOS_PLIST], { stdio: 'ignore' }));\n\n  // Ensure the LaunchAgents directory exists. macOS creates it on first\n  // login, but freshly-installed admin users may not have it yet.\n  mkdirSync(dirname(MACOS_PLIST), { recursive: true });\n  // 0o600 — plist embeds AGT_API_KEY in EnvironmentVariables. World-\n  // readable would expose the host's tlk_ token to every local user.\n  writeFileSync(MACOS_PLIST, renderMacosPlist(opts), { mode: 0o600 });\n  chmodSync(MACOS_PLIST, 0o600);\n\n  try {\n    execFileSync('launchctl', ['load', '-w', MACOS_PLIST], { stdio: 'pipe' });\n  } catch (err) {\n    return { ok: false, error: `launchctl load failed: ${(err as Error).message}` };\n  }\n\n  // Verify launchd actually picked it up. `list <label>` returns 0 with\n  // a plist of the loaded job's metadata; non-zero if not loaded.\n  try {\n    const out = execFileSync('launchctl', ['list', MACOS_LABEL], { encoding: 'utf-8' });\n    return {\n      ok: true,\n      details: `Loaded launchd LaunchAgent ${MACOS_LABEL}. Logs: ${join(opts.configDir, 'manager.log')}.\\n${out.trim().split('\\n').slice(0, 10).join('\\n')}`,\n    };\n  } catch (err) {\n    return { ok: false, error: `Plist written but launchctl list reported nothing for ${MACOS_LABEL}: ${(err as Error).message}` };\n  }\n}\n\nfunction uninstallMacos(): { ok: true; details: string } | { ok: false; error: string } {\n  // Both steps are idempotent — unload reports an error if nothing's\n  // loaded, removing the file errors if it doesn't exist. Swallow both;\n  // the desired end state is \"no LaunchAgent for this label\".\n  bestEffort(() => execFileSync('launchctl', ['unload', '-w', MACOS_PLIST], { stdio: 'ignore' }));\n  let removed = false;\n  if (existsSync(MACOS_PLIST)) {\n    try {\n      unlinkSync(MACOS_PLIST);\n      removed = true;\n    } catch (err) {\n      return { ok: false, error: `Failed to remove ${MACOS_PLIST}: ${(err as Error).message}` };\n    }\n  }\n  return {\n    ok: true,\n    details: removed\n      ? `Removed ${MACOS_LABEL} from launchd and deleted ${MACOS_PLIST}.`\n      : `${MACOS_LABEL} was already uninstalled (no plist at ${MACOS_PLIST}).`,\n  };\n}\n\nfunction statusMacos(): SupervisorPresence {\n  if (!existsSync(MACOS_PLIST)) return { kind: 'not-installed' };\n  // launchctl list emits a 3-column line: PID  Status  Label. PID is \"-\"\n  // when the job is loaded but not currently running.\n  try {\n    const out = execFileSync('launchctl', ['list', MACOS_LABEL], { encoding: 'utf-8' });\n    const pidMatch = /\"PID\"\\s*=\\s*(\\d+);/.exec(out);\n    const pid = pidMatch ? Number(pidMatch[1]) : null;\n    return { kind: 'installed', pid, details: `Plist: ${MACOS_PLIST}` };\n  } catch {\n    // File exists but launchctl can't find the label → user removed it\n    // out-of-band. Surface as \"not installed\" so re-install just works.\n    return { kind: 'not-installed' };\n  }\n}\n\nfunction renderMacosPlist(opts: InstallOpts): string {\n  // Load the operator's env into the plist so the manager has the same\n  // AGT_HOST / AGT_API_KEY / AGT_TEAM the shell session does. launchd\n  // does NOT inherit env from the user's shell — anything we don't bake\n  // in here won't be visible to the process.\n  const envEntries = Object.entries(opts.env)\n    .filter(([k, v]) => k.length > 0 && v != null)\n    .map(([k, v]) => `      <key>${escapeXml(k)}</key>\\n      <string>${escapeXml(v)}</string>`)\n    .join('\\n');\n\n  const args = [\n    'manager',\n    'start',\n    '--interval',\n    String(opts.intervalSec),\n    '--config-dir',\n    opts.configDir,\n  ];\n  const argsXml = args.map((a) => `    <string>${escapeXml(a)}</string>`).join('\\n');\n\n  const logPath = join(opts.configDir, 'manager.log');\n\n  return `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n  <key>Label</key>\n  <string>${MACOS_LABEL}</string>\n\n  <key>ProgramArguments</key>\n  <array>\n    <string>${escapeXml(opts.agtBin)}</string>\n${argsXml}\n  </array>\n\n  <key>RunAtLoad</key>\n  <true/>\n\n  <key>KeepAlive</key>\n  <true/>\n\n  <!-- Throttle restarts so a crashloop doesn't peg the CPU. 10 seconds\n       between launches is enough room for transient API blips while\n       still recovering quickly from a real crash. -->\n  <key>ThrottleInterval</key>\n  <integer>10</integer>\n\n  <!-- Where the manager's stdout / stderr land. The manager's logger\n       redirects stderr into manager.log itself, but launchd needs an\n       explicit destination at the OS level for any pre-logger output\n       (e.g., Node startup errors before the watchdog wires up). -->\n  <key>StandardOutPath</key>\n  <string>${escapeXml(logPath)}</string>\n  <key>StandardErrorPath</key>\n  <string>${escapeXml(logPath)}</string>\n\n  <key>WorkingDirectory</key>\n  <string>${escapeXml(opts.configDir)}</string>\n\n  <key>EnvironmentVariables</key>\n  <dict>\n${envEntries}\n  </dict>\n</dict>\n</plist>\n`;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nfunction bestEffort(fn: () => void): void {\n  try { fn(); } catch { /* swallow */ }\n}\n\nfunction escapeXml(s: string): string {\n  return s\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&apos;');\n}\n\n// ---------------------------------------------------------------------------\n// Linux — systemd --user unit\n// ---------------------------------------------------------------------------\n\nfunction installLinux(opts: InstallOpts): { ok: true; details: string } | { ok: false; error: string } {\n  if (!existsSync(opts.agtBin)) {\n    return { ok: false, error: `agt binary not found at ${opts.agtBin}` };\n  }\n  if (opts.intervalSec < 5) {\n    return { ok: false, error: 'intervalSec must be >= 5' };\n  }\n  if (!opts.env.AGT_HOST || !opts.env.AGT_API_KEY) {\n    return { ok: false, error: 'AGT_HOST and AGT_API_KEY must be set in the calling shell so the supervisor can pass them to the unit. Run `agt setup <token>` first.' };\n  }\n\n  // Stop any previous instance before rewriting the unit — saves a\n  // restart loop while daemon-reload picks up the new file.\n  bestEffort(() => execFileSync('systemctl', ['--user', 'stop', LINUX_UNIT_NAME], { stdio: 'ignore' }));\n\n  // ~/.config/systemd/user/ is the canonical user-unit path. Create it\n  // recursively in case this is a fresh user with no XDG layout yet.\n  // 0o700 — the unit body contains AGT_API_KEY in Environment= lines.\n  mkdirSync(dirname(LINUX_UNIT_PATH), { recursive: true, mode: 0o700 });\n  writeFileSync(LINUX_UNIT_PATH, renderLinuxUnit(opts), { mode: 0o600 });\n  chmodSync(LINUX_UNIT_PATH, 0o600);\n\n  try {\n    execFileSync('systemctl', ['--user', 'daemon-reload'], { stdio: 'pipe' });\n  } catch (err) {\n    return { ok: false, error: `systemctl --user daemon-reload failed: ${(err as Error).message}` };\n  }\n\n  // `enable --now` enables the unit at boot AND starts it immediately.\n  // Surviving reboot on a headless host additionally requires\n  // `loginctl enable-linger <user>` (root-only); we surface that as a\n  // post-install hint rather than running it ourselves.\n  try {\n    execFileSync('systemctl', ['--user', 'enable', '--now', LINUX_UNIT_NAME], { stdio: 'pipe' });\n  } catch (err) {\n    return { ok: false, error: `systemctl --user enable --now failed: ${(err as Error).message}. (Hint: 'systemctl --user' requires a per-user dbus session; on a fresh SSH login try 'export XDG_RUNTIME_DIR=/run/user/$(id -u)' first.)` };\n  }\n\n  let isActive = '';\n  try {\n    isActive = execFileSync('systemctl', ['--user', 'is-active', LINUX_UNIT_NAME], { encoding: 'utf-8' }).trim();\n  } catch (err) {\n    // is-active exits non-zero for inactive/failed states. Capture its\n    // output so the operator sees the real status.\n    isActive = ((err as { stdout?: Buffer; stderr?: Buffer }).stdout?.toString() ?? '').trim() || 'unknown';\n  }\n\n  return {\n    ok: true,\n    details: `Loaded systemd --user unit ${LINUX_UNIT_NAME} (status: ${isActive}). Logs: ${join(opts.configDir, 'manager.log')}.\\nFor reboot survival on a headless host run as root: 'loginctl enable-linger ${process.env['USER'] ?? '<your-user>'}'`,\n  };\n}\n\nfunction uninstallLinux(): { ok: true; details: string } | { ok: false; error: string } {\n  // disable --now stops + un-enables in one shot. Both legs are idempotent\n  // — disable on a non-existent unit returns 0 with a notice on stderr.\n  bestEffort(() => execFileSync('systemctl', ['--user', 'disable', '--now', LINUX_UNIT_NAME], { stdio: 'ignore' }));\n\n  let removed = false;\n  if (existsSync(LINUX_UNIT_PATH)) {\n    try {\n      unlinkSync(LINUX_UNIT_PATH);\n      removed = true;\n    } catch (err) {\n      return { ok: false, error: `Failed to remove ${LINUX_UNIT_PATH}: ${(err as Error).message}` };\n    }\n  }\n\n  // Reload so a future install with the same path doesn't reuse the\n  // stale unit metadata systemd cached in memory.\n  bestEffort(() => execFileSync('systemctl', ['--user', 'daemon-reload'], { stdio: 'ignore' }));\n\n  return {\n    ok: true,\n    details: removed\n      ? `Disabled systemd --user unit ${LINUX_UNIT_NAME} and deleted ${LINUX_UNIT_PATH}.`\n      : `${LINUX_UNIT_NAME} was already uninstalled (no unit file at ${LINUX_UNIT_PATH}).`,\n  };\n}\n\nfunction statusLinux(): SupervisorPresence {\n  if (!existsSync(LINUX_UNIT_PATH)) return { kind: 'not-installed' };\n  let pid: number | null = null;\n  let activeState = 'unknown';\n  try {\n    const out = execFileSync(\n      'systemctl',\n      ['--user', 'show', LINUX_UNIT_NAME, '--property=MainPID,ActiveState'],\n      { encoding: 'utf-8' },\n    );\n    const pidMatch = /^MainPID=(\\d+)/m.exec(out);\n    if (pidMatch && pidMatch[1] !== '0') pid = Number(pidMatch[1]);\n    const stateMatch = /^ActiveState=(\\S+)/m.exec(out);\n    if (stateMatch) activeState = stateMatch[1] ?? 'unknown';\n  } catch {\n    return { kind: 'not-installed' };\n  }\n  return { kind: 'installed', pid, details: `Unit: ${LINUX_UNIT_PATH} (${activeState})` };\n}\n\nfunction renderLinuxUnit(opts: InstallOpts): string {\n  // systemd parses Environment= lines with a peculiar grammar — quotes\n  // are optional but values can't contain literal newlines. We trust\n  // the env values we forward (AGT_HOST/AGT_API_KEY/PATH etc. are\n  // never multi-line) and quote everything to be safe with spaces.\n  const envLines = Object.entries(opts.env)\n    .filter(([k, v]) => k.length > 0 && v != null)\n    .map(([k, v]) => `Environment=\"${k}=${escapeForSystemdEnv(v)}\"`)\n    .join('\\n');\n\n  // ExecStart cannot use shell metacharacters; pass the args explicitly\n  // via systemd's array-of-args style (newline-separated wouldn't\n  // parse — systemd splits on whitespace within ExecStart). So we\n  // shell-quote each arg and join.\n  const execArgs = [\n    opts.agtBin,\n    'manager',\n    'start',\n    '--interval',\n    String(opts.intervalSec),\n    '--config-dir',\n    opts.configDir,\n  ]\n    .map(shellQuoteForSystemd)\n    .join(' ');\n\n  const logPath = join(opts.configDir, 'manager.log');\n\n  return `# agt manager supervisor (ENG-4593)\n# Managed by \\`agt manager install\\` — edits will be overwritten.\n\n[Unit]\nDescription=Augmented host manager daemon\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nWorkingDirectory=${opts.configDir}\n${envLines}\nExecStart=${execArgs}\n\n# Restart policy — always come back, with throttling so a crashloop\n# can't peg the CPU. StartLimitBurst/IntervalSec follow systemd's\n# defaults but are stated explicitly so future operators don't have\n# to read the man page to understand the recovery envelope.\nRestart=always\nRestartSec=5\nStartLimitBurst=5\nStartLimitIntervalSec=60\n\n# stdout/stderr → manager.log. journalctl --user -u agt-manager\n# still captures everything; this just gives operators a single file\n# to tail without learning systemd plumbing.\nStandardOutput=append:${logPath}\nStandardError=append:${logPath}\n\n[Install]\nWantedBy=default.target\n`;\n}\n\nfunction escapeForSystemdEnv(value: string): string {\n  // Inside an Environment=\"K=V\" line, \" and \\\\ need escaping. Newlines\n  // would terminate the directive — reject them upstream.\n  return value.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"');\n}\n\nfunction shellQuoteForSystemd(arg: string): string {\n  // systemd's ExecStart parser supports double-quoted strings with\n  // backslash escapes, similar to a POSIX shell but no command\n  // substitution. Wrap any arg containing whitespace or shell metas.\n  if (/^[A-Za-z0-9_./:=-]+$/.test(arg)) return arg;\n  return `\"${arg.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"')}\"`;\n}\n\n// Exposed for unit tests / introspection.\nexport const _internals = {\n  MACOS_LABEL,\n  MACOS_PLIST,\n  LINUX_UNIT_NAME,\n  LINUX_UNIT_PATH,\n  renderMacosPlist,\n  renderLinuxUnit,\n  escapeXml,\n  escapeForSystemdEnv,\n  shellQuoteForSystemd,\n  readPlist: () => (existsSync(MACOS_PLIST) ? readFileSync(MACOS_PLIST, 'utf-8') : null),\n  readUnit: () => (existsSync(LINUX_UNIT_PATH) ? readFileSync(LINUX_UNIT_PATH, 'utf-8') : null),\n};\n"],"mappings":";AAoBA,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAAS,gBAAgB;AAClC,SAAS,SAAS,YAAY;AAI9B,IAAM,cAAc;AACpB,IAAM,cAAc,KAAK,QAAQ,GAAG,WAAW,gBAAgB,GAAG,WAAW,QAAQ;AAKrF,IAAM,kBAAkB;AACxB,IAAM,kBAAkB,KAAK,QAAQ,GAAG,WAAW,WAAW,QAAQ,eAAe;AA0BrF,eAAsB,kBAAkB,MAA0F;AAChI,UAAQ,SAAS,GAAG;AAAA,IAClB,KAAK;AACH,aAAO,aAAa,IAAI;AAAA,IAC1B,KAAK;AACH,aAAO,aAAa,IAAI;AAAA,IAC1B;AACE,aAAO,EAAE,IAAI,OAAO,OAAO,yBAAyB,SAAS,CAAC,8CAA8C;AAAA,EAChH;AACF;AAEA,eAAsB,sBAA6F;AACjH,UAAQ,SAAS,GAAG;AAAA,IAClB,KAAK;AACH,aAAO,eAAe;AAAA,IACxB,KAAK;AACH,aAAO,eAAe;AAAA,IACxB;AACE,aAAO,EAAE,IAAI,OAAO,OAAO,yBAAyB,SAAS,CAAC,gDAAgD;AAAA,EAClH;AACF;AAEO,SAAS,mBAAuC;AACrD,UAAQ,SAAS,GAAG;AAAA,IAClB,KAAK;AACH,aAAO,YAAY;AAAA,IACrB,KAAK;AACH,aAAO,YAAY;AAAA,IACrB;AACE,aAAO,EAAE,MAAM,wBAAwB,UAAU,SAAS,EAAE;AAAA,EAChE;AACF;AAMA,SAAS,aAAa,MAAiF;AACrG,MAAI,CAAC,WAAW,KAAK,MAAM,GAAG;AAC5B,WAAO,EAAE,IAAI,OAAO,OAAO,2BAA2B,KAAK,MAAM,GAAG;AAAA,EACtE;AACA,MAAI,KAAK,cAAc,GAAG;AACxB,WAAO,EAAE,IAAI,OAAO,OAAO,2BAA2B;AAAA,EACxD;AACA,MAAI,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,IAAI,aAAa;AAC/C,WAAO,EAAE,IAAI,OAAO,OAAO,2IAA2I;AAAA,EACxK;AAIA,aAAW,MAAM,aAAa,aAAa,CAAC,UAAU,MAAM,WAAW,GAAG,EAAE,OAAO,SAAS,CAAC,CAAC;AAI9F,YAAU,QAAQ,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;AAGnD,gBAAc,aAAa,iBAAiB,IAAI,GAAG,EAAE,MAAM,IAAM,CAAC;AAClE,YAAU,aAAa,GAAK;AAE5B,MAAI;AACF,iBAAa,aAAa,CAAC,QAAQ,MAAM,WAAW,GAAG,EAAE,OAAO,OAAO,CAAC;AAAA,EAC1E,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,OAAO,0BAA2B,IAAc,OAAO,GAAG;AAAA,EAChF;AAIA,MAAI;AACF,UAAM,MAAM,aAAa,aAAa,CAAC,QAAQ,WAAW,GAAG,EAAE,UAAU,QAAQ,CAAC;AAClF,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,8BAA8B,WAAW,WAAW,KAAK,KAAK,WAAW,aAAa,CAAC;AAAA,EAAM,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,IACtJ;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,OAAO,yDAAyD,WAAW,KAAM,IAAc,OAAO,GAAG;AAAA,EAC/H;AACF;AAEA,SAAS,iBAA+E;AAItF,aAAW,MAAM,aAAa,aAAa,CAAC,UAAU,MAAM,WAAW,GAAG,EAAE,OAAO,SAAS,CAAC,CAAC;AAC9F,MAAI,UAAU;AACd,MAAI,WAAW,WAAW,GAAG;AAC3B,QAAI;AACF,iBAAW,WAAW;AACtB,gBAAU;AAAA,IACZ,SAAS,KAAK;AACZ,aAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,WAAW,KAAM,IAAc,OAAO,GAAG;AAAA,IAC1F;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS,UACL,WAAW,WAAW,6BAA6B,WAAW,MAC9D,GAAG,WAAW,yCAAyC,WAAW;AAAA,EACxE;AACF;AAEA,SAAS,cAAkC;AACzC,MAAI,CAAC,WAAW,WAAW,EAAG,QAAO,EAAE,MAAM,gBAAgB;AAG7D,MAAI;AACF,UAAM,MAAM,aAAa,aAAa,CAAC,QAAQ,WAAW,GAAG,EAAE,UAAU,QAAQ,CAAC;AAClF,UAAM,WAAW,qBAAqB,KAAK,GAAG;AAC9C,UAAM,MAAM,WAAW,OAAO,SAAS,CAAC,CAAC,IAAI;AAC7C,WAAO,EAAE,MAAM,aAAa,KAAK,SAAS,UAAU,WAAW,GAAG;AAAA,EACpE,QAAQ;AAGN,WAAO,EAAE,MAAM,gBAAgB;AAAA,EACjC;AACF;AAEA,SAAS,iBAAiB,MAA2B;AAKnD,QAAM,aAAa,OAAO,QAAQ,KAAK,GAAG,EACvC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,KAAK,IAAI,EAC5C,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,cAAc,UAAU,CAAC,CAAC;AAAA,gBAAyB,UAAU,CAAC,CAAC,WAAW,EAC1F,KAAK,IAAI;AAEZ,QAAM,OAAO;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,KAAK,WAAW;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,EACP;AACA,QAAM,UAAU,KAAK,IAAI,CAAC,MAAM,eAAe,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI;AAEjF,QAAM,UAAU,KAAK,KAAK,WAAW,aAAa;AAElD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,YAKG,WAAW;AAAA;AAAA;AAAA;AAAA,cAIT,UAAU,KAAK,MAAM,CAAC;AAAA,EAClC,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAoBG,UAAU,OAAO,CAAC;AAAA;AAAA,YAElB,UAAU,OAAO,CAAC;AAAA;AAAA;AAAA,YAGlB,UAAU,KAAK,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA,EAInC,UAAU;AAAA;AAAA;AAAA;AAAA;AAKZ;AAMA,SAAS,WAAW,IAAsB;AACxC,MAAI;AAAE,OAAG;AAAA,EAAG,QAAQ;AAAA,EAAgB;AACtC;AAEA,SAAS,UAAU,GAAmB;AACpC,SAAO,EACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,QAAQ;AAC3B;AAMA,SAAS,aAAa,MAAiF;AACrG,MAAI,CAAC,WAAW,KAAK,MAAM,GAAG;AAC5B,WAAO,EAAE,IAAI,OAAO,OAAO,2BAA2B,KAAK,MAAM,GAAG;AAAA,EACtE;AACA,MAAI,KAAK,cAAc,GAAG;AACxB,WAAO,EAAE,IAAI,OAAO,OAAO,2BAA2B;AAAA,EACxD;AACA,MAAI,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,IAAI,aAAa;AAC/C,WAAO,EAAE,IAAI,OAAO,OAAO,wIAAwI;AAAA,EACrK;AAIA,aAAW,MAAM,aAAa,aAAa,CAAC,UAAU,QAAQ,eAAe,GAAG,EAAE,OAAO,SAAS,CAAC,CAAC;AAKpG,YAAU,QAAQ,eAAe,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACpE,gBAAc,iBAAiB,gBAAgB,IAAI,GAAG,EAAE,MAAM,IAAM,CAAC;AACrE,YAAU,iBAAiB,GAAK;AAEhC,MAAI;AACF,iBAAa,aAAa,CAAC,UAAU,eAAe,GAAG,EAAE,OAAO,OAAO,CAAC;AAAA,EAC1E,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,OAAO,0CAA2C,IAAc,OAAO,GAAG;AAAA,EAChG;AAMA,MAAI;AACF,iBAAa,aAAa,CAAC,UAAU,UAAU,SAAS,eAAe,GAAG,EAAE,OAAO,OAAO,CAAC;AAAA,EAC7F,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,OAAO,yCAA0C,IAAc,OAAO,6IAA6I;AAAA,EACzO;AAEA,MAAI,WAAW;AACf,MAAI;AACF,eAAW,aAAa,aAAa,CAAC,UAAU,aAAa,eAAe,GAAG,EAAE,UAAU,QAAQ,CAAC,EAAE,KAAK;AAAA,EAC7G,SAAS,KAAK;AAGZ,gBAAa,IAA6C,QAAQ,SAAS,KAAK,IAAI,KAAK,KAAK;AAAA,EAChG;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS,8BAA8B,eAAe,aAAa,QAAQ,YAAY,KAAK,KAAK,WAAW,aAAa,CAAC;AAAA,8EAAkF,QAAQ,IAAI,MAAM,KAAK,aAAa;AAAA,EAClP;AACF;AAEA,SAAS,iBAA+E;AAGtF,aAAW,MAAM,aAAa,aAAa,CAAC,UAAU,WAAW,SAAS,eAAe,GAAG,EAAE,OAAO,SAAS,CAAC,CAAC;AAEhH,MAAI,UAAU;AACd,MAAI,WAAW,eAAe,GAAG;AAC/B,QAAI;AACF,iBAAW,eAAe;AAC1B,gBAAU;AAAA,IACZ,SAAS,KAAK;AACZ,aAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,eAAe,KAAM,IAAc,OAAO,GAAG;AAAA,IAC9F;AAAA,EACF;AAIA,aAAW,MAAM,aAAa,aAAa,CAAC,UAAU,eAAe,GAAG,EAAE,OAAO,SAAS,CAAC,CAAC;AAE5F,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS,UACL,gCAAgC,eAAe,gBAAgB,eAAe,MAC9E,GAAG,eAAe,6CAA6C,eAAe;AAAA,EACpF;AACF;AAEA,SAAS,cAAkC;AACzC,MAAI,CAAC,WAAW,eAAe,EAAG,QAAO,EAAE,MAAM,gBAAgB;AACjE,MAAI,MAAqB;AACzB,MAAI,cAAc;AAClB,MAAI;AACF,UAAM,MAAM;AAAA,MACV;AAAA,MACA,CAAC,UAAU,QAAQ,iBAAiB,gCAAgC;AAAA,MACpE,EAAE,UAAU,QAAQ;AAAA,IACtB;AACA,UAAM,WAAW,kBAAkB,KAAK,GAAG;AAC3C,QAAI,YAAY,SAAS,CAAC,MAAM,IAAK,OAAM,OAAO,SAAS,CAAC,CAAC;AAC7D,UAAM,aAAa,sBAAsB,KAAK,GAAG;AACjD,QAAI,WAAY,eAAc,WAAW,CAAC,KAAK;AAAA,EACjD,QAAQ;AACN,WAAO,EAAE,MAAM,gBAAgB;AAAA,EACjC;AACA,SAAO,EAAE,MAAM,aAAa,KAAK,SAAS,SAAS,eAAe,KAAK,WAAW,IAAI;AACxF;AAEA,SAAS,gBAAgB,MAA2B;AAKlD,QAAM,WAAW,OAAO,QAAQ,KAAK,GAAG,EACrC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,KAAK,IAAI,EAC5C,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,oBAAoB,CAAC,CAAC,GAAG,EAC9D,KAAK,IAAI;AAMZ,QAAM,WAAW;AAAA,IACf,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,KAAK,WAAW;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,EACP,EACG,IAAI,oBAAoB,EACxB,KAAK,GAAG;AAEX,QAAM,UAAU,KAAK,KAAK,WAAW,aAAa;AAElD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAUU,KAAK,SAAS;AAAA,EAC/B,QAAQ;AAAA,YACE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAcI,OAAO;AAAA,uBACR,OAAO;AAAA;AAAA;AAAA;AAAA;AAK9B;AAEA,SAAS,oBAAoB,OAAuB;AAGlD,SAAO,MAAM,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK;AACzD;AAEA,SAAS,qBAAqB,KAAqB;AAIjD,MAAI,uBAAuB,KAAK,GAAG,EAAG,QAAO;AAC7C,SAAO,IAAI,IAAI,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK,CAAC;AAC5D;AAGO,IAAM,aAAa;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,MAAO,WAAW,WAAW,IAAI,aAAa,aAAa,OAAO,IAAI;AAAA,EACjF,UAAU,MAAO,WAAW,eAAe,IAAI,aAAa,iBAAiB,OAAO,IAAI;AAC1F;","names":[]}